Add Support for IAM Roles Anywhere CreateSession

[rittneje]

Describe the feature

Add native support for CreateSession to the SDK.

Use Case

We would like to leverage IAM Roles Anywhere to "bootstrap" AWS credentials into our external services that are written in Go. We are unable to use the precanned credential_process binaries.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS Go SDK V2 Module Versions Used

n/a

Go version used

n/a

[Madrigal]

For our understanding, why are you unable to use the vended binaries?

Note that these binaries are more than just "bootstrap" credentials. They are a long-running process that is used to refresh your credentials, which includes reading and sending your x509 certificate for validation. You can see what the credential helper does here and get an idea of the size of the effort it would take.

We could port just CreateSession API, but without the binaries I'm not sure that would be super helpful

[github-actions]

This issue has not received a response in 1 week. If you want to keep this issue open, please just leave a comment below and auto-close will be canceled.

[rittneje]

@Madrigal

For our understanding, why are you unable to use the vended binaries?

I can't get into specifics, but essentially we need to distribute a single static executable. This also highlights another flaw of the binaries - they expect the certificate and private key to be files, which is totally incompatible with things like HSMs. When adding native support to Go, please do so via x509.Certificate + crypto.Signer or similar.