feat(machine-identity): Add AWS attributes for ABAC

This commit is contained in:
x032205
2025-07-23 16:30:55 -04:00
parent 14d4cfdbe4
commit e798eb2a4e
7 changed files with 144 additions and 65 deletions

View File

@@ -30,10 +30,10 @@ For methods like OIDC, these come as claims in the token and can be made availab
<Tabs>
<Tab title="OIDC Login Attributes">
1. Navigate to the Identity Authentication settings and select the OIDC Auth Method.
2. In the **Advanced section**, locate the Claim Mapping configuration.
3. Map the OIDC claims to permission attributes by specifying:
- **Attribute Name:** The identifier to be used in your policies (e.g., department).
1. Navigate to the Identity Authentication settings and select the OIDC Auth Method.
2. In the **Advanced section**, locate the Claim Mapping configuration.
3. Map the OIDC claims to permission attributes by specifying:
- **Attribute Name:** The identifier to be used in your policies (e.g., department).
- **Claim Path:** The dot notation path to the claim in the OIDC token (e.g., user.department).
For example, if your OIDC provider returns:
@@ -74,6 +74,21 @@ For methods like OIDC, these come as claims in the token and can be made availab
<img src="/images/platform/access-controls/abac-policy-k8s-format.png" />
</Tab>
<Tab title="AWS Attributes">
For identities authenticated using AWS Auth, several attributes can be accessed:
```
{{ identity.auth.aws.accountId }}
{{ identity.auth.aws.arn }}
{{ identity.auth.aws.userId }}
{{ identity.auth.aws.partition }}
{{ identity.auth.aws.service }}
{{ identity.auth.aws.resourceType }}
{{ identity.auth.aws.resourceName }}
```
<img src="/images/platform/access-controls/abac-policy-aws-format.png" />
</Tab>
<Tab title="Other Authentication Method Attributes">
At the moment we only support OIDC claims. Payloads on other authentication methods are not yet accessible.
</Tab>