imbi-plugin-aws 0.1.0__tar.gz

imbi_plugin_aws-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,45 @@
+name: Publish to PyPI
+on:
+  release:
+    types: [published]
+
+permissions:
+  id-token: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Set up Python
+        run: uv python install 3.14
+
+      - name: Build
+        run: uv build
+
+      - name: Upload dist
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    steps:
+      - name: Download dist
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish package
+        uses: pypa/gh-action-pypi-publish@release/v1

imbi_plugin_aws-0.1.0/.github/workflows/test.yml

@@ -0,0 +1,54 @@
+name: Testing
+on:
+  pull_request:
+  push:
+    branches: [ "main" ]
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
+    tags-ignore: [ "*" ]
+
+jobs:
+  lint:
+    name: "Static Analysis"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Install just
+        uses: extractions/setup-just@v2
+        with:
+          just-version: '1.47.1'
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Run linters
+        run: just lint
+
+  test:
+    name: "Automated Tests"
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: [ "3.14" ]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Install just
+        uses: extractions/setup-just@v2
+        with:
+          just-version: '1.47.1'
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "${{ matrix.python }}"
+          enable-cache: true
+      - name: Test with python ${{ matrix.python }}
+        run: just test
+      - name: Upload Coverage
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./build/coverage.xml
+          flags: unittests

imbi_plugin_aws-0.1.0/.gitignore

@@ -0,0 +1,10 @@
+__pycache__/
+*.py[cod]
+.venv/
+.pytest_cache/
+.coverage
+htmlcov/
+dist/
+build/
+*.egg-info/
+.ruff_cache/

imbi_plugin_aws-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,36 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-added-large-files
+      - id: check-merge-conflict
+      - id: check-toml
+      - id: debug-statements
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.14.6
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: https://github.com/tombi-toml/tombi-pre-commit
+    rev: v0.7.25
+    hooks:
+      - id: tombi-format
+
+  - repo: local
+    hooks:
+      - id: basedpyright
+        name: basedpyright
+        language: system
+        types: [python]
+        pass_filenames: false
+        entry: uv
+        args:
+          - run
+          - basedpyright
+          - src

imbi_plugin_aws-0.1.0/LICENSE

@@ -0,0 +1,28 @@
+BSD 3-Clause License
+
+Copyright (c) 2026, Imbi
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

imbi_plugin_aws-0.1.0/PKG-INFO

@@ -0,0 +1,99 @@
+Metadata-Version: 2.4
+Name: imbi-plugin-aws
+Version: 0.1.0
+Summary: AWS plugins for Imbi (IAM Identity Center, SSM, CloudWatch Logs)
+Author-email: "Gavin M. Roy" <gavinr@aweber.com>
+License: BSD-3-Clause
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Natural Language :: English
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.14
+Requires-Dist: httpx<1,>=0.27
+Requires-Dist: imbi-common>=0.8.3
+Requires-Dist: pydantic>=2
+Description-Content-Type: text/markdown
+
+# imbi-plugin-aws
+
+AWS provider for the Imbi project logs and configuration tabs.
+
+## Plugins shipped
+
+This package ships (or will ship) three entry points from one
+distribution:
+
+| Slug                   | Type            | Status   |
+| ---------------------- | --------------- | -------- |
+| `aws-iam-ic`           | `identity`      | ✅ shipped |
+| `aws-ssm`              | `configuration` | planned  |
+| `aws-cloudwatch-logs`  | `logs`          | planned  |
+
+The identity plugin federates each Imbi user into AWS via IAM Identity
+Center (formerly AWS SSO) and mints short-lived STS credentials per
+call.  The data plugins (when shipped) consume those credentials
+transparently — see the contract below.
+
+## Identity consumption contract for the data plugins
+
+When a project's `(:Project)-[:USES_PLUGIN]->(:Plugin)` edge or
+project-type fallback names this package's `aws-iam-ic` plugin via the
+`identity_plugin_id` edge property, the host-side
+`hydrate_identity()` helper runs `aws-iam-ic.materialize()` *before*
+calling the data plugin's handler.  `materialize()` calls
+`GetRoleCredentials` against the IAM IC Portal API and returns
+short-lived STS keys in `IdentityCredentials.extra`:
+
+```python
+IdentityCredentials(
+    access_token=<unchanged IAM IC token>,
+    extra={
+        'aws_access_key_id':     'AKIA...',
+        'aws_secret_access_key': '...',
+        'aws_session_token':     '...',
+        'aws_region':            'us-east-1',
+        'aws_account_id':        '111111111111',
+    },
+)
+```
+
+The host attaches this to `PluginContext.identity` and the data plugins
+read it from there.  Concretely, when `aws-ssm` (or
+`aws-cloudwatch-logs`) is invoked:
+
+```python
+async def list_keys(self, ctx, credentials):
+    if ctx.identity is not None:
+        # IAM IC path: credentials dict is empty (no operator-supplied
+        # static keys); read STS from ctx.identity.extra.
+        aws_creds = ctx.identity.extra
+    else:
+        # Static-key path: ServiceApplication.plugin_credentials carries
+        # access_key_id / secret_access_key / session_token.
+        aws_creds = credentials
+    session = aiobotocore.session.get_session()
+    client = session.create_client(
+        'ssm',
+        region_name=aws_creds['aws_region'],
+        aws_access_key_id=aws_creds['aws_access_key_id'],
+        aws_secret_access_key=aws_creds['aws_secret_access_key'],
+        aws_session_token=aws_creds.get('aws_session_token'),
+    )
+    ...
+```
+
+The data plugin doesn't know whether the caller is federated (via
+`aws-iam-ic`) or running as a service principal (legacy
+`ServiceApplication.plugin_credentials`).  Same five well-known keys,
+sourced differently.
+
+`requires_identity=true` on a future logs/configuration manifest would
+make the federated path mandatory; today both plugins fall back to the
+service-principal credentials when no `ctx.identity` is set.
+
+## License
+
+BSD-3-Clause.