webnet/tailscale
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cmd/tailscale/cli: allow fetching keys from AWS Parameter Store

Browse Source 
This allows fetching auth keys, OAuth client secrets, and ID tokens (for
workload identity federation) from AWS Parameter Store by passing an ARN
as the value. This is a relatively low-overhead mechanism for fetching
these values from an external secret store without needing to run a
secret service.

Usage examples:

    # Auth key
    tailscale up \
      --auth-key=arn:aws:ssm:us-east-1:123456789012:parameter/tailscale/auth-key

    # OAuth client secret
    tailscale up \
      --client-secret=arn:aws:ssm:us-east-1:123456789012:parameter/tailscale/oauth-secret \
      --advertise-tags=tag:server

    # ID token (for workload identity federation)
    tailscale up \
      --client-id=my-client \
      --id-token=arn:aws:ssm:us-east-1:123456789012:parameter/tailscale/id-token \
      --advertise-tags=tag:server

Updates tailscale/corp#28792

Signed-off-by: Andrew Dunham <andrew@tailscale.com>
This commit is contained in:
Andrew Dunham
2026-01-14 02:29:06 -05:00
committed by Andrew Dunham
parent 65d6793204
commit bcceef3682
9 changed files with 327 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/client/tailscale/awsparamstore.go
+21
View File
@@ -0,0 +1,21 @@
// Copyright (c) Tailscale Inc & contributors
// SPDX-License-Identifier: BSD-3-Clause
package tailscale
import (
"context"
"tailscale.com/feature"
)
// ResolvePrefixAWSParameterStore is the string prefix for values that can be
// resolved from AWS Parameter Store.
const ResolvePrefixAWSParameterStore = "arn:aws:ssm:"
// HookResolveValueFromParameterStore resolves to [awsparamstore.ResolveValue] when
// the corresponding feature tag is enabled in the build process.
//
// It fetches a value from AWS Parameter Store given an ARN. If the provided
// value is not an Parameter Store ARN, it returns the value unchanged.
var HookResolveValueFromParameterStore feature.Hook[func(ctx context.Context, valueOrARN string) (string, error)]