plugin/rest: Adds AWS Web Identity support

[RichiCoder1]

Adds support for signing S3 requests using Web Identity credentials. Specifically supports the Env Var version that's used in EKS IRSA.

Closes: #2462

Remaining Work:

• Test Coverage
• Documentation

[tsandall]

@patrick-east PTAL

[patrick-east]

Looking pretty good 👍

Once the remaining TODO's are finished we should be in good shape.

You'll need to remove the changes from internal/compiler/wasm/opa, I don't think those should be getting modified from these changes.

[RichiCoder1]

You'll need to remove the changes from internal/compiler/wasm/opa, I don't think those should be getting modified from these changes.

I figured. Came from just running make, might be an env quirk. Will splice em out once I get test coverage done.

[RichiCoder1]

Added test coverage and some basic documentation. LMK how it looks!

[RichiCoder1]

Aside: Is there a trick to getting my doc changes to show in the preview? Doesn't seem to be showing up.

[patrick-east]

Aside: Is there a trick to getting my doc changes to show in the preview? Doesn't seem to be showing up.

They're under the edge version for the PR: https://deploy-preview-2725--openpolicyagent.netlify.app/docs/edge/configuration/#aws-signature (which on the "live" site is showing the docs for master)

[RichiCoder1]

They're under the edge version for the PR: deploy-preview-2725--openpolicyagent.netlify.app/docs/edge/configuration/#aws-signature (which on the "live" site is showing the docs for master)

Aha! There we go.

[patrick-east]

Changes look good!

Do you by chance have pointers to instructions/examples to try this out?

[RichiCoder1]

Do you by chance have pointers to instructions/examples to try this out?

Sadly the answer is spinning up an IAM role, s3 bucket w/ permissions, and EKS cluster, and then launching an OPA pod on that cluster w/ the approriate annotations on that pods SA.
That said, I already have all the above so I can give this a test run and report back this week.

[patrick-east]

That said, I already have all the above so I can give this a test run and report back this week.

@RichiCoder1 did you have a chance to try it out with the full setup?

[RichiCoder1]

did you have a chance to try it out with the full setup?

Sadly, no. We're launching a big feature and it ate up my time. Reaching the tail end of that though, hoping to circle back around.

[RichiCoder1]

Finally was able to test! Luckily due to the nature of this change, was able to swipe a token off of my cluster.
Discovered two issues, I was missing a Version param in STS, and I needed to require the Region for signing. Both are resolved and I can confirm it's functional locally. Gonna resolve the merge and issues and this should be good to go.

[patrick-east]

Thanks for getting it tested out!