feat(pc): add assumeRoleARN to providerConfig like "native" provider-aws

AUTHENTICATION.md

@@ -0,0 +1,24 @@
+## How can assumeRoleARN be used with provider-jet-aws ?
+
+provider-jet-aws will be configured to connect to AWS Account A via `InjectedIdentity` or `Secret` , request security credentials, and then `assumeRoleARN` to assume a role in AWS Account B to manage the resources within AWS Account B.
+
+The first thing that needs to be done is to create an IAM role within AWS Account B that provider-jet-aws will `assumeRoleARN` into.
+
+- From within the AWS console of AWS Account B, navigate to IAM > Roles > Create role > Another AWS account.
+
+  -  Enter the Account ID of Account A (the account provider-jet-aws will call `assumeRoleARN` from).
+
+Next, the provider-jet-aws must be configured to use `assumeRoleARN`. The code snippet below shows how to configure provider-jet-aws to connect to AWS Account A and assumeRoleARN into a role within AWS Account B.
+
+```bash
+cat > provider-config.yaml <<EOF
+apiVersion: aws.jet.crossplane.io/v1alpha1
+kind: ProviderConfig
+metadata:
+  name: account-b
+spec:
+  assumeRoleARN: "arn:aws:iam::999999999999:role/account-b"
+  credentials:
+    source: InjectedIdentity
+EOF
+```

apis/v1alpha1/types.go

@@ -26,6 +26,10 @@ import (
 type ProviderConfigSpec struct {
 	// Credentials required to authenticate to this provider.
 	Credentials ProviderCredentials `json:"credentials"`
+
+	// AssumeRoleARN to assume with provider credentials
+	// +optional
+	AssumeRoleARN *string `json:"assumeRoleARN,omitempty"`
 }
 
 // ProviderCredentials required to authenticate.

examples/ec2/vpc.yaml

@@ -8,3 +8,16 @@ spec:
     cidrBlock: 172.16.0.0/16
     tags:
       Name: DemoVpc
+---
+apiVersion: ec2.aws.jet.crossplane.io/v1alpha2
+kind: VPC
+metadata:
+  name: sample-vpc-account-b
+spec:
+  forProvider:
+    region: us-west-1
+    cidrBlock: 172.16.0.0/16
+    tags:
+      Name: AccountB
+  providerConfigRef:
+    name: aws-jet-provider-account-b

examples/provider.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: pkg.crossplane.io/v1
+kind: Provider
+metadata:
+  name: provider-aws
+spec:
+  package: crossplane/provider-jet-aws:main

examples/providerconfig/assumeRoleARN.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: aws.jet.crossplane.io/v1alpha1
+kind: ProviderConfig
+metadata:
+  name: aws-jet-provider-account-b
+spec:
+  assumeRoleARN: "arn:aws:iam::999999999999:role/account_b"
+  credentials:
+    source: Secret
+    secretRef:
+      name: example-aws-jet-creds
+      namespace: crossplane-system
+      key: credentials

examples/tfaws/providerconfig.yaml → examples/providerconfig/providerconfig.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: example-creds
+  name: example-aws-jet-creds
   namespace: crossplane-system
 type: Opaque
 data:
@@ -15,6 +15,6 @@ spec:
   credentials:
     source: Secret
     secretRef:
-      name: example-creds
+      name: example-aws-jet-creds
       namespace: crossplane-system
       key: credentials

examples/providerconfig/setup.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+#
+# This is a helper script that uses the AWS CLI configuration to construct an
+# JET-AWS ProviderConfig.
+
+cd "$(dirname "$0")"
+
+set -e -o pipefail
+
+AWS_PROFILE=${AWS_PROFILE:=default} # retrieve profile's credentials, save it under 'default' profile, and base64 encode it
+BASE64ENCODED_AWS_ACCOUNT_CREDS=$(echo "[default]\naws_access_key_id = $(aws configure get aws_access_key_id --profile $AWS_PROFILE)\naws_secret_access_key = $(aws configure get aws_secret_access_key --profile $AWS_PROFILE)" | base64  | tr -d "\n")
+
+cat providerconfig.yaml | sed "s/<REPLACEME>/${BASE64ENCODED_AWS_ACCOUNT_CREDS}/g" | kubectl apply -f -

go.mod

@@ -3,10 +3,10 @@ module github.com/crossplane-contrib/provider-jet-aws
 go 1.16
 
 require (
-	github.com/aws/aws-sdk-go-v2 v0.23.0
+	github.com/aws/aws-sdk-go-v2 v1.11.0
 	github.com/crossplane/crossplane-runtime v0.15.1-0.20211004150827-579c1833b513
 	github.com/crossplane/crossplane-tools v0.0.0-20210916125540-071de511ae8e
-	github.com/crossplane/provider-aws v0.19.0
+	github.com/crossplane/provider-aws v0.23.0
 	github.com/crossplane/terrajet v0.4.0-rc.0.0.20220128111246-e5aaa1790fe6
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.7.0
 	github.com/pkg/errors v0.9.1

internal/clients/aws.go

@@ -5,9 +5,11 @@ import (
 	"fmt"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
+
 	xpv1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
 	"github.com/crossplane/crossplane-runtime/pkg/fieldpath"
 	"github.com/crossplane/crossplane-runtime/pkg/resource"
+	xpabeta1 "github.com/crossplane/provider-aws/apis/v1beta1"
 	xpawsclient "github.com/crossplane/provider-aws/pkg/clients"
 	"github.com/crossplane/terrajet/pkg/terraform"
 	"github.com/pkg/errors"
@@ -59,22 +61,41 @@ func TerraformSetupBuilder(version, providerSource, providerVersion string) terr
 		}
 
 		var cfg *aws.Config
+		xpapc := &xpabeta1.ProviderConfig{
+			Spec: xpabeta1.ProviderConfigSpec{
+				Credentials:   xpabeta1.ProviderCredentials(pc.Spec.Credentials),
+				AssumeRoleARN: pc.Spec.AssumeRoleARN,
+			},
+		}
 		switch s := pc.Spec.Credentials.Source; s { //nolint:exhaustive
 		case xpv1.CredentialsSourceInjectedIdentity:
-			if cfg, err = xpawsclient.UsePodServiceAccount(ctx, []byte{}, xpawsclient.DefaultSection, region); err != nil {
-				return ps, errors.Wrap(err, "failed to use pod service account")
+			if pc.Spec.AssumeRoleARN != nil {
+				if cfg, err = xpawsclient.UsePodServiceAccountAssumeRole(ctx, []byte{}, xpawsclient.DefaultSection, region, xpapc); err != nil {
+					return ps, errors.Wrap(err, "failed to use pod service account assumeRoleARN")
+				}
+			} else {
+				if cfg, err = xpawsclient.UsePodServiceAccount(ctx, []byte{}, xpawsclient.DefaultSection, region); err != nil {
+					return ps, errors.Wrap(err, "failed to use pod service account")
+				}
 			}
 		default:
 			data, err := resource.CommonCredentialExtractor(ctx, s, client, pc.Spec.Credentials.CommonCredentialSelectors)
 			if err != nil {
 				return ps, errors.Wrap(err, "cannot get credentials")
 			}
-			if cfg, err = xpawsclient.UseProviderSecret(ctx, data, xpawsclient.DefaultSection, region); err != nil {
-				return ps, errors.Wrap(err, "failed to use provider secret")
+			if pc.Spec.AssumeRoleARN != nil {
+				if cfg, err = xpawsclient.UseProviderSecretAssumeRole(ctx, data, xpawsclient.DefaultSection, region, xpapc); err != nil {
+					return ps, errors.Wrap(err, "failed to use provider secret assumeRoleARN")
+				}
+			} else {
+				if cfg, err = xpawsclient.UseProviderSecret(ctx, data, xpawsclient.DefaultSection, region); err != nil {
+					return ps, errors.Wrap(err, "failed to use provider secret")
+				}
 			}
 		}
-		awsConf := xpawsclient.SetResolver(ctx, mg, cfg)
+		awsConf := xpawsclient.SetResolver(xpapc, cfg)
 		creds, err := awsConf.Credentials.Retrieve(ctx)
+
 		if err != nil {
 			return ps, errors.Wrap(err, "failed to retrieve aws credentials from aws config")
 		}

package/crds/aws.jet.crossplane.io_providerconfigs.yaml

@@ -46,6 +46,9 @@ spec:
           spec:
             description: A ProviderConfigSpec defines the desired state of a ProviderConfig.
             properties:
+              assumeRoleARN:
+                description: AssumeRoleARN to assume with provider credentials
+                type: string
               credentials:
                 description: Credentials required to authenticate to this provider.
                 properties: