syntax = "proto3";

package envoy.extensions.common.aws.v3;

import "envoy/config/core/v3/base.proto";

import "google/protobuf/duration.proto";

import "udpa/annotations/sensitive.proto";
import "udpa/annotations/status.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.extensions.common.aws.v3";
option java_outer_classname = "CredentialProviderProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/common/aws/v3;awsv3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: AWS common configuration]

// Configuration for AWS credential provider. This is optional and the credentials are normally
// retrieved from the environment or AWS configuration files by following the default credential
// provider chain. However, this configuration can be used to override the default behavior.
// [#next-free-field: 11]
message AwsCredentialProvider {
  // The option to use `AssumeRoleWithWebIdentity <https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html>`_.
  AssumeRoleWithWebIdentityCredentialProvider assume_role_with_web_identity_provider = 1;

  // The option to use an inline credential. If inline credential is provided, no chain will be created and only the inline credential will be used.
  InlineCredentialProvider inline_credential = 2;

  // The option to specify parameters for credential retrieval from an envoy data source, such as a file in AWS credential format.
  CredentialsFileCredentialProvider credentials_file_provider = 3;

  // Create a custom credential provider chain instead of the default credential provider chain.
  // If set to TRUE, the credential provider chain that is created contains only those set in this credential provider message.
  // If set to FALSE, the settings provided here will act as modifiers to the default credential provider chain.
  // Defaults to FALSE.
  //
  // This has no effect if inline_credential is provided.
  bool custom_credential_provider_chain = 4;

  // The option to use `IAM Roles Anywhere <https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html>`_.
  IAMRolesAnywhereCredentialProvider iam_roles_anywhere_credential_provider = 5;

  // The option to use credentials sourced from standard `AWS configuration files <https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html>`_.
  ConfigCredentialProvider config_credential_provider = 6;

  // The option to use credentials sourced from `container environment variables <https://docs.aws.amazon.com/sdkref/latest/guide/feature-container-credentials.html>`_.
  ContainerCredentialProvider container_credential_provider = 7;

  // The option to use credentials sourced from `environment variables <https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html>`_.
  EnvironmentCredentialProvider environment_credential_provider = 8;

  // The option to use credentials sourced from an EC2 `Instance Profile <https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html>`_.
  InstanceProfileCredentialProvider instance_profile_credential_provider = 9;

  // The option to use `STS:AssumeRole aka Role Chaining <https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html>`_.
  AssumeRoleCredentialProvider assume_role_credential_provider = 10;
}

// Configuration to use an inline AWS credential. This is an equivalent to setting the well-known
// environment variables ``AWS_ACCESS_KEY_ID``, ``AWS_SECRET_ACCESS_KEY``, and the optional ``AWS_SESSION_TOKEN``.
message InlineCredentialProvider {
  // The AWS access key ID.
  string access_key_id = 1 [(validate.rules).string = {min_len: 1}];

  // The AWS secret access key.
  string secret_access_key = 2
      [(validate.rules).string = {min_len: 1}, (udpa.annotations.sensitive) = true];

  // The AWS session token. This is optional.
  string session_token = 3 [(udpa.annotations.sensitive) = true];
}

// Configuration to use `AssumeRoleWithWebIdentity <https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html>`_
// to retrieve AWS credentials.
message AssumeRoleWithWebIdentityCredentialProvider {
  // Data source for a web identity token that is provided by the identity provider to assume the role.
  // If a ``watched_directory`` is not provided, one will be automatically inferred from the directory of the token file. This is to ensure
  // that if the token file is rotated, the new token will be picked up. This behaviour differs from the standard envoy data source behavior, which does not
  // automatically watch the directory of a file data source.
  // Even when file rotation occurs, current credentials will continue to be used until they expire, at which point new credentials will be retrieved using the new token.
  config.core.v3.DataSource web_identity_token_data_source = 1
      [(udpa.annotations.sensitive) = true];

  // The ARN of the role to assume.
  string role_arn = 2 [(validate.rules).string = {min_len: 1}];

  // Optional role session name to use in AssumeRoleWithWebIdentity API call.
  string role_session_name = 3;
}

message CredentialsFileCredentialProvider {
  // Data source from which to retrieve AWS credentials
  // When using this data source, if a ``watched_directory`` is provided, the credential file will be re-read when a file move is detected.
  // See :ref:`watched_directory <envoy_v3_api_msg_config.core.v3.DataSource>` for more information about the ``watched_directory`` field.
  config.core.v3.DataSource credentials_data_source = 1 [(udpa.annotations.sensitive) = true];

  // The profile within the credentials_file data source. If not provided, the default profile will be used.
  string profile = 2;
}

// Configuration to use `IAM Roles Anywhere <https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html>`_
// to retrieve AWS credentials.
// [#next-free-field: 9]
message IAMRolesAnywhereCredentialProvider {
  // The ARN of the role to assume via the IAM Roles Anywhere sessions API. See `Configure Roles <https://docs.aws.amazon.com/rolesanywhere/latest/userguide/getting-started.html#getting-started-step2>`_ for more details.
  string role_arn = 1 [(validate.rules).string = {min_len: 1}];

  // The certificate used for authenticating to the IAM Roles Anywhere service.
  // This certificate must match one configured in the IAM Roles Anywhere profile. See `Configure Roles <https://docs.aws.amazon.com/rolesanywhere/latest/userguide/getting-started.html#getting-started-step2>`_ for more details.
  config.core.v3.DataSource certificate = 2 [(validate.rules).message = {required: true}];

  // The optional certificate chain, required when you are using a subordinate certificate authority for certificate issuance.
  // A certificate chain can contain a maximum of 5 elements, see `The IAM Roles Anywhere authentication process <https://docs.aws.amazon.com/rolesanywhere/latest/userguide/authentication.html>`_ for more details.
  config.core.v3.DataSource certificate_chain = 3;

  // The TLS private key matching the certificate provided.
  config.core.v3.DataSource private_key = 4
      [(validate.rules).message = {required: true}, (udpa.annotations.sensitive) = true];

  // The arn of the IAM Roles Anywhere trust anchor configured in your AWS account. A trust anchor in IAM Roles anywhere establishes
  // trust between your certificate authority (CA) and AWS. See `Establish trust <https://docs.aws.amazon.com/rolesanywhere/latest/userguide/getting-started.html#getting-started-step1>`_ for more details.
  string trust_anchor_arn = 5 [(validate.rules).string = {min_len: 1}];

  // The IAM Roles Anywhere profile ARN configured in your AWS account.
  string profile_arn = 6 [(validate.rules).string = {min_len: 1}];

  // An optional role session name, used when identifying the role in subsequent AWS API calls.
  string role_session_name = 7;

  // An optional session duration, used when calculating the maximum time before vended credentials expire. This value cannot exceed the value configured
  // in the IAM Roles Anywhere profile and the resultant session duration is calculate by the formula `here <https://docs.aws.amazon.com/rolesanywhere/latest/userguide/authentication-create-session.html#credentials-object>`_.
  // If no session duration is provided here, the session duration is sourced from the IAM Roles Anywhere profile.
  google.protobuf.Duration session_duration = 8 [(validate.rules).duration = {
    lte {seconds: 43200}
    gte {seconds: 900}
  }];
}

// The Config Credential Provider has no configurable parameters, but listing it in a custom credential provider chain will enable this
// credential provider.
message ConfigCredentialProvider {
}

// The Container Credential Provider has no configurable parameters, but listing it in a custom credential provider chain will enable this
// credential provider.
message ContainerCredentialProvider {
}

// The Environment Credential Provider has no configurable parameters, but listing it in a custom credential provider chain will enable this
// credential provider.
message EnvironmentCredentialProvider {
}

// The Instance Profile Credential Provider has no configurable parameters, but listing it in a custom credential provider chain will enable this
// credential provider.
message InstanceProfileCredentialProvider {
}

// Configuration to use `AssumeRole <https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html>`_ for retrieving new credentials, via role chaining.
// [#next-free-field: 6]
message AssumeRoleCredentialProvider {
  // The ARN of the role to assume.
  string role_arn = 1 [(validate.rules).string = {min_len: 1}];

  // An optional role session name, used when identifying the role in subsequent AWS API calls. If not provided, the role session name will default
  // to the current timestamp.
  string role_session_name = 2;

  // Optional string value to use as the externalId
  string external_id = 3;

  // An optional duration, in seconds, of the role session. Minimum role duration is 900s (5 minutes) and maximum is 43200s (12 hours).
  // If the session duration is not provided, the default will be determined using the `table described here <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage-assume.html>`_.
  google.protobuf.Duration session_duration = 4 [(validate.rules).duration = {
    lte {seconds: 43200}
    gte {seconds: 900}
  }];

  // The credential provider for signing the AssumeRole request. This is optional and if not set,
  // it will be retrieved from the procedure described in :ref:`config_http_filters_aws_request_signing`.
  // This list of credential providers cannot include an AssumeRole credential provider and if one is provided
  // it will be ignored.
  AwsCredentialProvider credential_provider = 5;
}
