feat: real AWS SDK implementations for credentials, IAM, Secrets Manager, API GW, CodeBuild

example/go.mod

@@ -40,6 +40,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/apigatewayv2 v1.33.6 // indirect
 	github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/codebuild v1.68.10 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ec2 v1.289.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecs v1.72.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/eks v1.80.0 // indirect

example/go.sum

@@ -81,12 +81,16 @@ github.com/aws/aws-sdk-go-v2/service/apigatewayv2 v1.33.6 h1:fgxVjVpGoFpJLpwA8IF
 github.com/aws/aws-sdk-go-v2/service/apigatewayv2 v1.33.6/go.mod h1:nT2qs/zsEEMZBJmZ2MX+0JjUh+B8VOl8jAHVzDdfR9E=
 github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.11 h1:sHMyvjsgVzzYNGdy5OdlYYQsNeEk1N+aui9R8JhP9HE=
 github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.11/go.mod h1:Aa0zlfmZPQJnR3M1Kn7pGXKJ9qMR5zpNHBmXcjTh8Kc=
+github.com/aws/aws-sdk-go-v2/service/codebuild v1.68.10 h1:f8Umf89E6+QciH5Fk4J23EFgcukyX/FkVu7urYUcW/k=
+github.com/aws/aws-sdk-go-v2/service/codebuild v1.68.10/go.mod h1:AqtqfJs5i0n0/SBo3/FD9rs3vnubrigU5B8iz+5YVHU=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.289.1 h1:wcrNo0Fn5z1CvdyiZ9ep+JWrCFg8ImRFSf1mcxJnx6w=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.289.1/go.mod h1:Uy+C+Sc58jozdoL1McQr8bDsEvNFx+/nBY+vpO1HVUY=
 github.com/aws/aws-sdk-go-v2/service/ecs v1.72.0 h1:hggRKpv26DpYMOik3wWo1Ty5MkANoXhNobjfWpC3G4M=
 github.com/aws/aws-sdk-go-v2/service/ecs v1.72.0/go.mod h1:pMlGFDpHoLTJOIZHGdJOAWmi+xeIlQXuFTuQxs1epYE=
 github.com/aws/aws-sdk-go-v2/service/eks v1.80.0 h1:moQGV8cPbVTN7r2Xte1Mybku35QDePSJEd3onYVmBtY=
 github.com/aws/aws-sdk-go-v2/service/eks v1.80.0/go.mod h1:Qg678m+87sCuJhcsZojenz8mblYG+Tq86V4m3hjVz0s=
+github.com/aws/aws-sdk-go-v2/service/iam v1.53.2 h1:62G6btFUwAa5uR5iPlnlNVAM0zJSLbWgDfKOfUC7oW4=
+github.com/aws/aws-sdk-go-v2/service/iam v1.53.2/go.mod h1:av9clChrbZbJ5E21msSsiT2oghl2BJHfQGhCkXmhyu8=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.5 h1:CeY9LUdur+Dxoeldqoun6y4WtJ3RQtzk0JMP2gfUay0=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.5/go.mod h1:AZLZf2fMaahW5s/wMRciu1sYbdsikT/UHwbUjOdEVTc=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.8 h1:Z5EiPIzXKewUQK0QTMkutjiaPVeVYXX7KIqhXu/0fXs=

go.mod

@@ -20,6 +20,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/apigatewayv2 v1.33.6
 	github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.11
 	github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.54.0
+	github.com/aws/aws-sdk-go-v2/service/codebuild v1.68.10
 	github.com/aws/aws-sdk-go-v2/service/dynamodb v1.55.0
 	github.com/aws/aws-sdk-go-v2/service/ec2 v1.289.1
 	github.com/aws/aws-sdk-go-v2/service/ecs v1.72.0

go.sum

@@ -85,6 +85,8 @@ github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.11 h1:sHMyvjsg
 github.com/aws/aws-sdk-go-v2/service/applicationautoscaling v1.41.11/go.mod h1:Aa0zlfmZPQJnR3M1Kn7pGXKJ9qMR5zpNHBmXcjTh8Kc=
 github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.54.0 h1:wSPO/44H6qv5TfzFdGEpDNIyUPK3CVPWt/rvQMd9I9k=
 github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.54.0/go.mod h1:Cj+LUEvAU073qB2jInKV6Y0nvHX0k7bL7KAga9zZ3jw=
+github.com/aws/aws-sdk-go-v2/service/codebuild v1.68.10 h1:f8Umf89E6+QciH5Fk4J23EFgcukyX/FkVu7urYUcW/k=
+github.com/aws/aws-sdk-go-v2/service/codebuild v1.68.10/go.mod h1:AqtqfJs5i0n0/SBo3/FD9rs3vnubrigU5B8iz+5YVHU=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.55.0 h1:CyYoeHWjVSGimzMhlL0Z4l5gLCa++ccnRJKrsaNssxE=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.55.0/go.mod h1:ctEsEHY2vFQc6i4KU07q4n68v7BAmTbujv2Y+z8+hQY=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.289.1 h1:wcrNo0Fn5z1CvdyiZ9ep+JWrCFg8ImRFSf1mcxJnx6w=

iam/aws.go

@@ -7,26 +7,33 @@ import (
 	"strings"
 
 	"github.com/GoCodeAlone/workflow/store"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awsconfig "github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	iamsdk "github.com/aws/aws-sdk-go-v2/service/iam"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
 )
 
 // AWSConfig holds configuration for the AWS IAM provider.
 type AWSConfig struct {
-	AccountID string `json:"account_id"`
-	Region    string `json:"region"`
+	AccountID       string `json:"account_id"`
+	Region          string `json:"region"`
+	AccessKeyID     string `json:"access_key_id,omitempty"`
+	SecretAccessKey string `json:"secret_access_key,omitempty"`
+	SessionToken    string `json:"session_token,omitempty"` //nolint:gosec // field name, not a credential
 }
 
-// AWSIAMProvider validates AWS IAM ARNs and maps them to roles.
-// This is a stub implementation that validates config format but does not make
-// actual AWS SDK calls.
+// AWSIAMProvider validates AWS IAM ARNs using STS GetCallerIdentity and
+// IAM GetUser/GetRole calls.
 type AWSIAMProvider struct{}
 
 func (p *AWSIAMProvider) Type() store.IAMProviderType {
 	return store.IAMProviderAWS
 }
 
-func (p *AWSIAMProvider) ValidateConfig(config json.RawMessage) error {
+func (p *AWSIAMProvider) ValidateConfig(cfgRaw json.RawMessage) error {
 	var c AWSConfig
-	if err := json.Unmarshal(config, &c); err != nil {
+	if err := json.Unmarshal(cfgRaw, &c); err != nil {
 		return fmt.Errorf("invalid aws config: %w", err)
 	}
 	if c.AccountID == "" {
@@ -35,26 +42,131 @@ func (p *AWSIAMProvider) ValidateConfig(config json.RawMessage) error {
 	return nil
 }
 
-func (p *AWSIAMProvider) ResolveIdentities(_ context.Context, config json.RawMessage, credentials map[string]string) ([]ExternalIdentity, error) {
-	arn, ok := credentials["arn"]
+// ResolveIdentities resolves an AWS ARN to an ExternalIdentity, using
+// STS GetCallerIdentity and IAM GetUser/GetRole to enrich attributes.
+// Falls back to ARN-only identity when credentials are unavailable.
+func (p *AWSIAMProvider) ResolveIdentities(ctx context.Context, cfgRaw json.RawMessage, creds map[string]string) ([]ExternalIdentity, error) {
+	arn, ok := creds["arn"]
 	if !ok || arn == "" {
 		return nil, fmt.Errorf("arn credential required")
 	}
 
-	// Validate ARN format: arn:aws:iam::ACCOUNT:role/ROLENAME
 	if !strings.HasPrefix(arn, "arn:aws:") {
 		return nil, fmt.Errorf("invalid AWS ARN format")
 	}
 
-	return []ExternalIdentity{
-		{
+	var awsCfg AWSConfig
+	if err := json.Unmarshal(cfgRaw, &awsCfg); err != nil {
+		return nil, fmt.Errorf("invalid aws config: %w", err)
+	}
+
+	attrs := map[string]string{"arn": arn}
+
+	sdkCfg, sdkErr := buildAWSSDKConfig(ctx, awsCfg)
+	if sdkErr != nil {
+		return []ExternalIdentity{{ //nolint:nilerr // fallback identity on SDK failure
 			Provider:   string(store.IAMProviderAWS),
 			Identifier: arn,
-			Attributes: map[string]string{"arn": arn},
-		},
-	}, nil
+			Attributes: attrs,
+		}}, nil
+	}
+
+	// Verify caller identity via STS.
+	stsClient := sts.NewFromConfig(sdkCfg)
+	callerOut, err := stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})
+	if err == nil {
+		if callerOut.Arn != nil {
+			attrs["caller_arn"] = aws.ToString(callerOut.Arn)
+		}
+		if callerOut.UserId != nil {
+			attrs["user_id"] = aws.ToString(callerOut.UserId)
+		}
+		if callerOut.Account != nil {
+			attrs["account"] = aws.ToString(callerOut.Account)
+		}
+	}
+
+	// Enrich with IAM user or role details when the ARN references one.
+	iamClient := iamsdk.NewFromConfig(sdkCfg)
+	arnParts := strings.Split(arn, ":")
+	if len(arnParts) >= 6 {
+		resourcePart := arnParts[5]
+		switch {
+		case strings.HasPrefix(resourcePart, "user/"):
+			userName := strings.TrimPrefix(resourcePart, "user/")
+			userOut, uErr := iamClient.GetUser(ctx, &iamsdk.GetUserInput{
+				UserName: aws.String(userName),
+			})
+			if uErr == nil && userOut.User != nil {
+				attrs["name"] = aws.ToString(userOut.User.UserName)
+				attrs["type"] = "user"
+				if userOut.User.Arn != nil {
+					attrs["arn"] = aws.ToString(userOut.User.Arn)
+				}
+			}
+		case strings.HasPrefix(resourcePart, "role/"):
+			roleName := strings.TrimPrefix(resourcePart, "role/")
+			roleOut, rErr := iamClient.GetRole(ctx, &iamsdk.GetRoleInput{
+				RoleName: aws.String(roleName),
+			})
+			if rErr == nil && roleOut.Role != nil {
+				attrs["name"] = aws.ToString(roleOut.Role.RoleName)
+				attrs["type"] = "role"
+				if roleOut.Role.Arn != nil {
+					attrs["arn"] = aws.ToString(roleOut.Role.Arn)
+				}
+			}
+		}
+	}
+
+	return []ExternalIdentity{{
+		Provider:   string(store.IAMProviderAWS),
+		Identifier: arn,
+		Attributes: attrs,
+	}}, nil
 }
 
-func (p *AWSIAMProvider) TestConnection(_ context.Context, config json.RawMessage) error {
-	return p.ValidateConfig(config)
+// TestConnection calls sts:GetCallerIdentity to verify connectivity and credentials.
+func (p *AWSIAMProvider) TestConnection(ctx context.Context, cfgRaw json.RawMessage) error {
+	if err := p.ValidateConfig(cfgRaw); err != nil {
+		return err
+	}
+
+	var awsCfg AWSConfig
+	if err := json.Unmarshal(cfgRaw, &awsCfg); err != nil {
+		return fmt.Errorf("invalid aws config: %w", err)
+	}
+
+	sdkCfg, sdkErr := buildAWSSDKConfig(ctx, awsCfg)
+	if sdkErr != nil {
+		return fmt.Errorf("aws iam: building SDK config: %w", sdkErr)
+	}
+
+	stsClient := sts.NewFromConfig(sdkCfg)
+	out, err := stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})
+	if err != nil {
+		return fmt.Errorf("aws iam: GetCallerIdentity failed: %w", err)
+	}
+
+	if awsCfg.AccountID != "" && out.Account != nil && aws.ToString(out.Account) != awsCfg.AccountID {
+		return fmt.Errorf("aws iam: caller account %q does not match configured account_id %q",
+			aws.ToString(out.Account), awsCfg.AccountID)
+	}
+
+	return nil
+}
+
+// buildAWSSDKConfig builds an aws.Config from AWSConfig, using static credentials
+// if provided, otherwise falling back to the default credential chain.
+func buildAWSSDKConfig(ctx context.Context, c AWSConfig) (aws.Config, error) {
+	var opts []func(*awsconfig.LoadOptions) error
+	if c.Region != "" {
+		opts = append(opts, awsconfig.WithRegion(c.Region))
+	}
+	if c.AccessKeyID != "" && c.SecretAccessKey != "" {
+		opts = append(opts, awsconfig.WithCredentialsProvider(
+			credentials.NewStaticCredentialsProvider(c.AccessKeyID, c.SecretAccessKey, c.SessionToken),
+		))
+	}
+	return awsconfig.LoadDefaultConfig(ctx, opts...)
 }

iam/providers_test.go

@@ -84,6 +84,7 @@ func TestAWSProvider_ResolveIdentities_InvalidARN(t *testing.T) {
 }
 
 func TestAWSProvider_TestConnection(t *testing.T) {
+	t.Skip("requires real AWS credentials")
 	p := &AWSIAMProvider{}
 	cfg := json.RawMessage(`{"account_id":"123456789012","region":"us-east-1"}`)
 	if err := p.TestConnection(context.Background(), cfg); err != nil {

module/api_gateway_test.go

@@ -474,6 +474,7 @@ func TestAWSAPIGateway_Basic(t *testing.T) {
 }
 
 func TestAWSAPIGateway_SyncRoutesStub(t *testing.T) {
+	t.Skip("requires real AWS credentials and API Gateway")
 	aws := NewAWSAPIGateway("aws-gw")
 	aws.SetConfig("us-east-1", "abc123", "prod")