https://github.com/moriyoshi/nss-awsiam-go
This is a glibc NSS (name server switch) module, which does the query against AWS IAM user and group registry.
https://github.com/moriyoshi/nss-awsiam-go
aws glibc iam iam-groups iam-users linux nss nsswitch
Last synced: 2 months ago
JSON representation
This is a glibc NSS (name server switch) module, which does the query against AWS IAM user and group registry.
- Host: GitHub
- URL: https://github.com/moriyoshi/nss-awsiam-go
- Owner: moriyoshi
- License: mit
- Created: 2020-09-11T10:33:39.000Z (almost 6 years ago)
- Default Branch: main
- Last Pushed: 2024-10-08T09:23:12.000Z (almost 2 years ago)
- Last Synced: 2026-03-06T19:46:07.988Z (4 months ago)
- Topics: aws, glibc, iam, iam-groups, iam-users, linux, nss, nsswitch
- Language: Go
- Homepage:
- Size: 81.1 KB
- Stars: 1
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# nss_awsiam_go
This is a glibc NSS (name server switch) module, which does the query against AWS IAM user and group registry.
## Building
```
$ make
```
will produce `libnss_awsiam_go.so` in the current working directory. You can put it under `/lib/x86_64-linux-gnu` (may vary by the configuration of your OS) as `libnss_awsiam_go.so.2` to get it to work.
## Configuration
Configuration is done through the configuration variable file (`/etc/nss_awsiam_go.conf`).
For security reasons, this module doesn't accept shared configuration and credentials under `~/.aws`.
## Configuration variables
### Authorization
In addition to the default AWS SDK configuration scheme, it supports STS credentials for a assumed role through the following environment variables:
* `AWS_STS_ASSUME_ROLE_ARN`
This specifies the ARN for the assumed (target) IAM role. The difference from `AWS_ROLE_ARN` is that this can be used in nested STS contexts.
### Querying
You can configure the querying behavior by the following special environment variable:
* `NSS_AWSIAM_GO_TIMEOUT`
Specifies the timeout value of the query. Defaults to 3 seconds.
### Debugging
* `NSS_AWSIAM_GO_DEBUG`
Takes an integer value. 1 to enable error reporting, and 2 to enable AWS API request debugging.
### Miscellaneous
* `NSS_AWSIAM_GO_DEFAULT_SHELL`
Specify the default shell for all users.
* `NSS_AWSIAM_GO_HOMEDIR_TEMPLATE`
Specify the home directory template applied for all users. You can use the placeholder `{userName}`, `{userId}`, or `{uid}` everywhere in the template.
## Configuration at the AWS side
The following IAM permissions are necessary to grant to the IAM role with which the instance (or container) runs.
* `iam:GetGroup`
* `iam:GetGroupsForUser`
* `iam:GetSSHPublicKey`
* `iam:GetUser`
* `iam:ListUser`
* `iam:ListGroup`
## Note on `SIGURG` usage in Go runtime
Since Go 1.14, it started to use `SIGURG` to do the non-cooperative preemption. This may be troublesome because the hosting application will also receive the signal. This module should work without preemption. To prevent the preemption, specify `GODEBUG=asyncpreemptoff=1`.
## License
MIT License