feat: phase auth aws iam #262

nimish-ks · 2025-10-01T13:37:07Z

This PR adds support for AWS IAM external identity support.

❯ export PHASE_HOST=http://localhost
❯ phase auth --mode aws-iam --service-account=2115a1fc-0a78-4a7b-ad8c-6fa6cc15f489 --ttl 60 --no-login
[17:38:48] Using PHASE_HOST environment variable: http://localhost                                                                                                                                                                                                          auth.py:148
           Authenticating with AWS IAM credentials...                                                                                                                                                                                                                       auth.py:170
           AWS IAM authentication successful                                                                                                                                                                                                                                auth.py:180
{
    "authentication": {
        "tokenType": "ServiceAccount",
        "token": "pss_service:v2:f23fe858776e69d3156a7b0238a0ddf56ac1492e56b391e21928bbbc8fd3aed6:a7579d80027dddebb934f532ef6977a50d82dfbaa87f1b021cfef72086884605:ef4117923731fc296de2e46aa77ef2942c863321a32cf8f43725289301acb6e7:ebe39c4880a16ab115a57ae6f31b8835b26b291cf2f29ae4bca489630c830d96",
        "bearerToken": "ServiceAccount f23fe858776e69d3156a7b0238a0ddf56ac1492e56b391e21928bbbc8fd3aed6",
        "TTL": 60,
        "maxTTL": 86400
    }
}

…d deprecation notice - Renamed the function `get_default_user_id` to `get_default_account_id` for clarity and to better reflect its purpose. - Updated the function's docstring to indicate it now handles both user accounts and service accounts. - Added a deprecated version of `get_default_user_id` that calls the new function for backward compatibility.

- Replaced the usage of `get_default_user_id` with `get_default_account_id` in the keyring service name generation for improved clarity and consistency with recent changes.

- Updated the whoami command to display 'N/A (Service Account)' if the default user's email is not available, improving clarity for service accounts. - Renamed 'User ID' to 'Account ID' for consistency with recent changes.

- Changed terminology from 'User ID' to 'Account ID' for clarity. - Updated email handling to display 'Service Account' when applicable. - Adjusted prompts and error messages to reflect the new account terminology.

…onality - Updated the logout functionality to use `get_default_account_id` instead of `get_default_user_id` for consistency with recent changes. - Adjusted keyring password deletion and configuration updates to reflect the new account terminology.

- Eliminated the import of `get_default_user_id` from `phase_cli.utils.misc` as it is no longer needed, streamlining the code for better clarity and consistency.

- Updated the authentication process to support both Personal Access Tokens (PATs) and Service Account Tokens, improving flexibility. - Introduced checks for the PHASE_HOST environment variable to allow headless operation. - Replaced user ID references with account ID for consistency across the authentication flow. - Enhanced error handling and user prompts to accommodate service accounts and ensure clarity in user interactions.

- Added support for Personal Access Tokens (PATs) by prompting for user email when a PAT is detected. - Improved handling of unknown token formats to ensure user email is requested for clarity and safety. - Streamlined the authentication process to accommodate both PATs and Service Account Tokens.

- Added boto3 and botocore to requirements.txt to support AWS service integration. - Specified minimum versions for both libraries to ensure compatibility.

- Introduced a new authentication module with support for web-based and token-based authentication methods. - Added an HTTP server to handle authentication requests and process user credentials securely. - Enhanced user experience by providing clear prompts for both Personal Access Tokens and AWS IAM credentials. - Integrated error handling and logging for improved feedback during the authentication process.

- Eliminated the print_phase_links function to streamline the codebase and improve clarity. - This function was previously responsible for displaying a welcome message and links to community resources.

- Introduced a new module for AWS IAM authentication, enabling integration with Phase API. - Implemented functions to sign requests and authenticate using AWS credentials. - Added support for custom STS endpoints and region resolution. - Enhanced error handling for missing AWS credentials and authentication failures.

- Updated the authentication command to include AWS IAM as a mode of authentication. - Added a new argument for Service Account ID, required when using AWS IAM mode. - Adjusted the phase_auth function call to accommodate the new service_account_id parameter.

- Changed the minimum version of botocore to 1.40.17 for improved compatibility with AWS services. - Removed the specific version constraint for boto3 to allow for more flexibility in dependency resolution.

- Replaced boto3 session initialization with botocore's get_session for improved compatibility and flexibility. - Enhanced region resolution by incorporating environment variable support for AWS_DEFAULT_REGION. - Updated credential retrieval to ensure consistent handling of AWS credentials across the authentication process.

…tication - Refactored the `resolve_region_and_endpoint` function to eliminate unnecessary parameters and improve clarity. - Integrated botocore's `Config` for better handling of AWS region detection. - Removed the custom STS endpoint parameter from the `perform_aws_iam_auth` function to streamline the authentication process.

- Updated the `phase_auth` function to include an optional `ttl` parameter for specifying token time-to-live in seconds when using AWS IAM mode. - Adjusted the call to `perform_aws_iam_auth` to pass the new `ttl` argument, enhancing flexibility in token management.

- Updated the logout functionality to use the rich console for better error handling and user feedback. - Enhanced messages for logging out, purging data, and configuration errors to improve clarity and user experience.

…ies and TTL - Modified the `auth` command to include a new argument for Service Account ID, clarifying its use for external identities. - Added an optional `ttl` parameter for specifying token time-to-live, enhancing flexibility in token management during authentication. - Updated the `phase_auth` function call to accommodate the new `ttl` argument.

…-iam

- Introduced a new `no_login` parameter to the `phase_auth` function, allowing users to bypass the login process and print raw AWS IAM authentication results directly. - Updated the function's logic to handle the new parameter, enhancing flexibility for users who may want to view authentication results without logging in.

- Added a `--no-login` argument to the authentication command, allowing users to print authentication tokens directly to stdout without logging in, specifically for external identity modes like aws-iam. - Updated the `phase_auth` function call to incorporate the new `no_login` parameter, improving user experience and flexibility in authentication processes.

- Updated the `--no-login` argument to `--no-store` in the authentication command, clarifying its purpose to print authentication token responses without storing credentials. - Adjusted the `phase_auth` function to reflect this change, enhancing the user experience and understanding of the authentication process.

cloudflare-workers-and-pages · 2025-10-02T09:46:10Z

Deploying phase-cli-install-script with Cloudflare Pages

Latest commit:	`d02dddf`
Status:	✅ Deploy successful!
Preview URL:	https://1d130386.phase-cli-install-script.pages.dev
Branch Preview URL:	https://feat--phase-auth-aws-iam.phase-cli-install-script.pages.dev

View logs

- Introduced a new function `external_identity_auth_aws` for authenticating with Phase using AWS IAM credentials. - Added a utility function `b64_str` for Base64 encoding strings, used in the authentication payload. - Enhanced error handling for SSL and connection errors during the authentication process.

- Removed the `authenticate_with_phase` function and replaced it with `external_identity_auth_aws` for improved clarity and modularity. - Updated parameter names in `perform_aws_iam_auth` for consistency. - Simplified the authentication process by leveraging the new utility function for AWS IAM credentials.

- Changed the parameter name in the `perform_aws_iam_auth` function call for clarity and consistency, aligning with recent refactoring efforts.

- Introduced AWS_DEFAULT_GLOBAL_STS_ENDPOINT and AWS_DEFAULT_GLOBAL_STS_REGION constants to facilitate AWS service integration. - Updated PHASE_CLOUD_API_HOST for clarity in configuration management.

- Updated the `resolve_region_and_endpoint` function to utilize the newly introduced `AWS_DEFAULT_GLOBAL_STS_ENDPOINT` and `AWS_DEFAULT_GLOBAL_STS_REGION` constants for improved maintainability and clarity.

- Changed the endpoint in the `external_identity_auth_aws` function to reflect the correct routing for external identity authentication with AWS IAM.

Signed-off-by: rohan <rohan.chaturvedi@protonmail.com>

- Added a check to display top-level help and exit with code 0 when no arguments are provided to the CLI. - This serves as a temporary fix to improve user experience.

- Updated the phase_auth function to exit with code 2 when required parameters are missing or invalid, enhancing user experience and preventing further execution in error scenarios.

nimish-ks and others added 25 commits August 26, 2025 15:18

refactor: update keyring service name to use account ID

adce991

- Replaced the usage of `get_default_user_id` with `get_default_account_id` in the keyring service name generation for improved clarity and consistency with recent changes.

fix: handle missing email for default user in whoami command

598005f

- Updated the whoami command to display 'N/A (Service Account)' if the default user's email is not available, improving clarity for service accounts. - Renamed 'User ID' to 'Account ID' for consistency with recent changes.

refactor: update user switch functionality for consistency

a9910e0

- Changed terminology from 'User ID' to 'Account ID' for clarity. - Updated email handling to display 'Service Account' when applicable. - Adjusted prompts and error messages to reflect the new account terminology.

refactor: remove unused user ID reference in import_env.py

becfc85

- Eliminated the import of `get_default_user_id` from `phase_cli.utils.misc` as it is no longer needed, streamlining the code for better clarity and consistency.

chore(deps): add boto3 and botocore dependencies

fa6ed7c

- Added boto3 and botocore to requirements.txt to support AWS service integration. - Specified minimum versions for both libraries to ensure compatibility.

refactor: remove print_phase_links function from misc.py

82e6f8e

- Eliminated the print_phase_links function to streamline the codebase and improve clarity. - This function was previously responsible for displaying a welcome message and links to community resources.

chore(deps): update botocore version in requirements.txt

8b797cd

- Changed the minimum version of botocore to 1.40.17 for improved compatibility with AWS services. - Removed the specific version constraint for boto3 to allow for more flexibility in dependency resolution.

Merge branch 'main' into feat--phase-auth-svc-account

f97b535

Merge branch 'feat--phase-auth-svc-account' into feat--phase-auth-aws…

01bd79d

…-iam

chore: bump version to 1.20.0 in APKBUILD and const.py

8f5a4d5

nimish-ks requested a review from rohan-chaturvedi October 1, 2025 13:37

nimish-ks self-assigned this Oct 1, 2025

Merge remote-tracking branch 'origin/main' into feat--phase-auth-aws-iam

8ae3255

chore: reset changes from bad rebase

b08dc1a

nimish-ks and others added 11 commits October 2, 2025 15:46

feat: use consistent routing pattern

84ddda6

chore: remove phase cloud / self-hosted host switcher

9328df1

fix: update parameter naming in AWS IAM authentication call

cd68bdd

- Changed the parameter name in the `perform_aws_iam_auth` function call for clarity and consistency, aligning with recent refactoring efforts.

chore: bump version to 1.21.0 in APKBUILD and const.py

3727ca5

fix: remove unused import of PHASE_CLOUD_PUBLIC_API_HOST from misc.py

ddc2458

feat: add AWS configuration constants for STS endpoint and region

2bcd95b

- Introduced AWS_DEFAULT_GLOBAL_STS_ENDPOINT and AWS_DEFAULT_GLOBAL_STS_REGION constants to facilitate AWS service integration. - Updated PHASE_CLOUD_API_HOST for clarity in configuration management.

refactor: replace hardcoded STS endpoint and region with constants

a1eb0eb

- Updated the `resolve_region_and_endpoint` function to utilize the newly introduced `AWS_DEFAULT_GLOBAL_STS_ENDPOINT` and `AWS_DEFAULT_GLOBAL_STS_REGION` constants for improved maintainability and clarity.

fix: update AWS IAM authentication URL for external identities

7127977

- Changed the endpoint in the `external_identity_auth_aws` function to reflect the correct routing for external identity authentication with AWS IAM.

fix: add trailing slash

57b683f

Signed-off-by: rohan <rohan.chaturvedi@protonmail.com>

rohan-chaturvedi previously approved these changes Oct 4, 2025

View reviewed changes

fix: ensure CLI exits successfully with no arguments

aafb2ff

- Added a check to display top-level help and exit with code 0 when no arguments are provided to the CLI. - This serves as a temporary fix to improve user experience.

nimish-ks dismissed rohan-chaturvedi’s stale review via aafb2ff October 4, 2025 11:21

fix: improve error handling in phase_auth function

d02dddf

- Updated the phase_auth function to exit with code 2 when required parameters are missing or invalid, enhancing user experience and preventing further execution in error scenarios.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: phase auth aws iam #262

feat: phase auth aws iam #262

Uh oh!

nimish-ks commented Oct 1, 2025

Uh oh!

cloudflare-workers-and-pages bot commented Oct 2, 2025 •

edited

Loading

Uh oh!

Uh oh!

feat: phase auth aws iam #262

Are you sure you want to change the base?

feat: phase auth aws iam #262

Uh oh!

Conversation

nimish-ks commented Oct 1, 2025

Uh oh!

cloudflare-workers-and-pages bot commented Oct 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying phase-cli-install-script with Cloudflare Pages

Uh oh!

Uh oh!

cloudflare-workers-and-pages bot commented Oct 2, 2025 •

edited

Loading