File

mod_aws_profile/README.markdown @ 5390:f2363e6d9a64

mod_http_oauth2: Advertise the currently supported id_token signing algorithm This field is REQUIRED. The algorithm RS256 MUST be included, but isn't because we don't implement it, as that would require implementing a pile of additional cryptography and JWT stuff. Instead the id_token is signed using the client secret, which allows verification by the client, since it's a shared secret per OpenID Connect Core 1.0 § 10.1 under Symmetric Signatures. OpenID Connect Discovery 1.0 has a lot of REQUIRED and MUST clauses that are not supported here, but that's okay because this is served from the RFC 8414 OAuth 2.0 Authorization Server Metadata .well-known endpoint!
author Kim Alvefur <zash@zash.se>
date Sun, 30 Apr 2023 16:13:40 +0200
parent 3698:1d719d4ef18f
line wrap: on
line source

# Introduction

This module adds support for reading AWS IAM access credentials from EC2 instance metadata,
to allow Prosody modules to gain role-based access to AWS services.

# Configuring

``` {.lua}
modules_enabled = {
    "aws_profile";
}
```

There is no other configuration.

# Usage in other modules

Other modules can import the credentials as a shared table:

``` {.lua}
local aws_credentials = module:shared("/*/aws_profile/credentials");
do_something(aws_credentials.access_key, aws_credentials.secret_key);
```

Note that credentials are time-limited, and will change periodically. The
shared table will automatically be updated. If you need to know when this
happens, you can also hook the `'aws_profile/credentials-refreshed'` event:

``` {.lua}
module:hook_global("aws_profile/credentials-refreshed", function (new_credentials)
  -- do something with new_credentials.access_key/secret_key
end);
```

# Compatibility

Meant for use with Prosody 0.11.x, may work in older versions.