Yevhenii Shcherbina
db7f4438b4
feat: generate STS external ID for Bedrock role assumption ( #26869 )
...
Implements:
https://linear.app/codercom/issue/AIGOV-495/add-externalid-to-prevent-confused-deputy-problem
When a Bedrock provider assumes an IAM role via STS, the gateway now
generates a unique external ID for it and sends that value on every
`AssumeRole` call. The external ID guards against the [confused deputy
problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html )
on cross-account role assumption. Per [AWS's
recommendation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html ),
the gateway generates and owns the value rather than accepting one from
the operator; that ownership is what makes it effective, since a party
who knows another's external ID can't induce the gateway to send it.
The external ID is server-owned and read-only over the API. It is
generated once, when a provider first has a `role_arn`, and is stable
thereafter. Clients cannot set it: create rejects any supplied
`external_id`, and update rejects a value that differs from the stored
one. An update may echo the stored value back unchanged, so the normal
read-modify-write flow (GET the provider, change a field, PATCH the full
settings object) keeps working. The value is not a secret and is
returned on GET so operators can copy it into the target role's trust
policy as an `sts:ExternalId` condition.
It is persisted in the existing JSON settings blob, so there is no
migration or audit-table change.
2026-07-01 20:44:15 +00:00
..
2026-06-05 14:33:15 +03:00
2026-06-03 15:30:37 -04:00
2026-06-03 15:30:37 -04:00
2025-06-24 11:16:31 +02:00
2024-02-26 10:03:49 -06:00
2026-01-08 15:24:11 +04:00
2026-03-12 13:39:24 -06:00
2026-03-11 15:19:56 +02:00
2023-09-04 21:42:45 +03:00
2026-07-01 20:15:03 +01:00
2025-06-20 13:16:55 -06:00
2026-06-02 10:46:40 +00:00
2026-06-30 20:24:51 +03:00
2026-06-29 13:34:58 +02:00
2026-07-01 20:44:15 +00:00
2025-10-27 17:07:25 +01:00
2025-06-20 13:16:55 -06:00
2026-04-27 12:58:26 +01:00
2024-08-22 15:40:53 +10:00
2026-06-30 13:02:15 -07:00
2026-05-13 14:59:33 -05:00
2026-06-30 13:02:15 -07:00
2026-06-02 10:46:40 +00:00
2026-06-30 13:02:15 -07:00
2026-01-08 15:24:11 +04:00
2026-01-08 15:24:11 +04:00
2026-06-03 15:30:37 -04:00
2026-06-11 09:06:07 +10:00
2026-06-03 15:30:37 -04:00
2026-04-27 12:58:26 +01:00
2025-03-04 15:37:29 -07:00
2025-03-04 15:37:29 -07:00
2025-03-04 15:37:29 -07:00
2026-01-08 15:24:11 +04:00
2026-06-22 19:26:34 -06:00
2026-06-22 12:15:27 -06:00
2026-06-22 19:26:34 -06:00
2025-06-20 13:16:55 -06:00
2025-03-26 01:56:39 -05:00
2026-06-25 13:49:39 -04:00
2026-07-01 00:16:25 +10:00
2026-03-05 09:35:57 -08:00
2026-06-03 15:30:37 -04:00
2025-09-22 17:14:07 +04:00
2026-06-26 12:45:53 +01:00
2026-07-01 15:59:55 +03:00
2026-06-12 14:41:58 +10:00
2026-05-15 14:36:54 -07:00
2026-03-10 12:08:40 +02:00
2026-05-15 14:36:54 -07:00
2026-04-29 10:28:27 -07:00
2026-05-15 14:36:54 -07:00
2024-03-17 09:45:26 -05:00
2026-01-08 15:24:11 +04:00
2026-05-15 14:36:54 -07:00
2026-06-03 15:16:42 -04:00
2026-06-12 14:41:58 +10:00
2026-06-03 15:30:37 -04:00
2025-09-03 10:49:19 +04:00
2026-01-08 15:24:11 +04:00
2026-04-27 12:58:26 +01:00
2026-06-03 15:30:37 -04:00
2026-03-02 22:52:39 -05:00
2026-06-03 15:16:42 -04:00
2025-09-03 10:49:19 +04:00
2025-03-26 01:56:39 -05:00
2023-09-08 18:21:33 +00:00
2026-06-04 08:43:51 -06:00
2026-06-03 15:30:37 -04:00
2025-12-03 11:32:59 +02:00
2026-04-21 15:11:50 -05:00
2026-06-03 15:30:37 -04:00
2026-04-21 15:11:50 -05:00
2026-06-03 15:30:37 -04:00
2025-10-30 17:41:08 -06:00
2026-01-08 15:24:11 +04:00
2026-04-27 12:58:26 +01:00
2026-06-03 15:16:42 -04:00
2026-04-16 12:46:52 -04:00
2025-09-11 15:08:57 +02:00
2026-01-08 15:24:11 +04:00
2026-05-05 19:43:08 -06:00
2026-06-11 09:58:16 -06:00
2026-06-11 09:58:16 -06:00
2026-06-03 15:30:37 -04:00
2026-02-06 14:09:39 +11:00
2026-02-05 19:35:20 +11:00
2026-02-06 14:09:39 +11:00
2025-09-22 17:14:07 +04:00
2024-08-20 14:47:46 +10:00
2025-12-03 11:32:59 +02:00
2024-05-23 07:54:59 -10:00
2026-03-25 13:11:08 +11:00
2026-03-04 11:14:52 -07:00
2023-08-09 13:00:25 +02:00
2026-04-24 17:09:17 -04:00
2026-02-26 14:34:30 +01:00
2026-04-24 17:09:17 -04:00
2025-07-03 13:22:54 +10:00
2026-06-03 15:30:37 -04:00
2026-01-08 15:24:11 +04:00
2025-06-20 13:16:55 -06:00
2026-06-25 15:41:09 -06:00
2026-06-05 14:33:15 +03:00
2025-10-06 08:56:43 +00:00
2025-12-03 11:32:59 +02:00
2026-03-03 08:47:34 +00:00
2025-12-03 11:32:59 +02:00
2023-08-18 18:55:43 +00:00
2026-01-08 15:24:11 +04:00
2025-03-26 01:56:39 -05:00
2026-06-03 15:30:37 -04:00
2026-04-27 12:58:26 +01:00
2024-03-17 09:45:26 -05:00
2026-06-03 15:30:37 -04:00
2026-01-08 15:24:11 +04:00
2026-06-03 15:30:37 -04:00
2026-04-27 12:58:26 +01:00
2026-05-21 16:51:34 +02:00
2026-06-17 13:01:57 +02:00
2026-06-04 11:14:36 +02:00
2025-06-20 13:16:55 -06:00
2026-06-03 15:30:37 -04:00
2026-04-27 12:58:26 +01:00
2026-04-16 09:44:34 -07:00
2026-06-03 15:30:37 -04:00
2026-04-16 09:44:34 -07:00
2026-06-29 13:34:58 +02:00
2026-06-05 14:33:13 -05:00
2026-06-02 08:36:01 -06:00
2026-06-16 13:26:04 -07:00
2026-06-23 11:37:33 -05:00
2026-06-23 11:37:33 -05:00
2026-03-04 20:26:03 -05:00
2026-06-03 15:30:37 -04:00
2026-01-08 15:24:11 +04:00
2024-03-17 09:45:26 -05:00
2026-06-10 14:21:54 -07:00
2026-07-01 15:59:55 +03:00
2026-06-23 11:58:00 -05:00
2026-06-23 11:58:00 -05:00
2026-06-03 15:30:37 -04:00
2026-04-27 12:58:26 +01:00
2024-03-15 13:16:36 +00:00
2024-03-15 13:16:36 +00:00
2026-06-03 15:16:42 -04:00
2026-01-08 15:24:11 +04:00
2026-06-03 13:21:45 +00:00
2023-07-20 12:05:39 +02:00
2026-06-25 15:41:09 -06:00
2023-07-20 12:05:39 +02:00
2026-06-05 16:08:20 +10:00
2026-06-03 15:30:37 -04:00
2026-04-27 12:58:26 +01:00
2025-03-26 10:36:53 +00:00
2025-03-26 10:36:53 +00:00
2026-02-23 22:46:17 -06:00
2026-04-27 12:58:26 +01:00
2026-04-27 12:58:26 +01:00
2026-06-22 16:38:18 +03:00
2026-04-27 12:58:26 +01:00
2025-11-28 08:33:50 +02:00
2026-06-17 13:01:57 +02:00
2025-11-28 08:33:50 +02:00
2026-05-27 12:33:39 +02:00
2026-06-17 13:01:57 +02:00
2026-06-17 13:01:57 +02:00
2026-05-14 14:45:20 +02:00
2026-06-17 13:01:57 +02:00
2025-11-25 15:24:25 +00:00
2025-11-25 15:24:25 +00:00
2026-06-03 15:30:37 -04:00
2026-01-08 15:24:11 +04:00
2026-06-03 15:30:37 -04:00
2025-12-03 11:32:59 +02:00
2026-03-07 01:36:03 +00:00
2026-02-02 15:50:09 +02:00
2026-06-03 15:30:37 -04:00
2026-02-13 14:21:31 +00:00
2026-06-03 15:30:37 -04:00
2026-02-17 16:24:13 +00:00
2026-06-03 15:30:37 -04:00
2026-05-25 19:14:29 +03:00
2026-03-12 08:33:09 -06:00
2026-03-12 08:33:09 -06:00
2026-03-07 01:36:03 +00:00
2026-02-17 16:24:13 +00:00
2026-06-03 15:30:37 -04:00
2026-01-08 15:24:11 +04:00
2026-06-03 15:30:37 -04:00
2026-01-08 15:24:11 +04:00
2026-06-23 17:32:47 -05:00
2026-06-23 17:32:47 -05:00
2026-06-02 08:05:26 -04:00
2026-03-23 23:19:23 +02:00
2026-06-03 15:30:37 -04:00
2025-12-03 11:32:59 +02:00
2026-06-03 15:30:37 -04:00
2025-12-03 11:32:59 +02:00
2026-06-03 15:30:37 -04:00
2025-09-22 17:14:07 +04:00
2026-06-03 15:30:37 -04:00
2025-10-03 10:20:06 -05:00
2025-07-24 16:44:36 +01:00
2025-12-15 11:26:41 -06:00
2025-09-22 17:14:07 +04:00
2026-06-03 15:30:37 -04:00
2026-02-19 09:31:12 +11:00
2026-03-06 00:04:09 +00:00
2026-03-23 23:19:23 +02:00
2026-06-03 15:30:37 -04:00
2026-04-27 12:58:26 +01:00
2026-06-03 15:30:37 -04:00
2026-06-03 15:30:37 -04:00
2026-04-27 22:51:01 +00:00
2025-09-22 17:14:07 +04:00
2025-04-15 18:30:20 -04:00
2025-09-22 17:14:07 +04:00
2026-06-03 15:30:37 -04:00
2025-12-03 11:32:59 +02:00
2026-03-19 15:14:00 +00:00
2026-03-18 22:10:04 +00:00
2026-03-18 22:10:04 +00:00
2023-10-10 11:14:20 +01:00
2026-01-08 15:24:11 +04:00
2025-06-20 13:16:55 -06:00
2025-03-26 01:56:39 -05:00
2025-06-20 13:16:55 -06:00
2026-01-08 15:24:11 +04:00
2026-01-08 15:24:11 +04:00
2026-02-12 12:14:56 +01:00
2026-02-12 12:14:56 +01:00
2026-02-12 12:14:56 +01:00
2026-02-12 12:14:56 +01:00
2024-11-18 21:10:01 +10:00
2026-06-02 10:50:27 -04:00
2026-01-08 15:24:11 +04:00
2024-07-09 13:23:11 -05:00
2025-09-26 11:20:25 +01:00