Configure integration with AWS

Learn how to configure package manager integrations with AWS CodeArtifact.

Configure Endor Labs to integrate with AWS CodeArtifact to use private libraries to build and scan your software.

You must Create an OpenID Connect provider in AWS IAM to allow Endor Labs to authenticate and assume roles securely. Then, configure an IAM role with a trust policy to grant Endor Labs read-only access to AWS CodeArtifact repositories.

You can configure the resources using the AWS Management Console, AWS CloudFormation Template, or the AWS CLI.

Create AWS resources from the AWS management console

Create the AWS resources required for this integration from the AWS user management console.

Create an OpenID Connect provider

In AWS, create an OpenID Connect provider and authenticate Endor Labs to assume roles.

Sign into Identity and Access Management (IAM).
From Access Management, select Identity Providers.
Click Add Provider and choose OpenID Connect.
In Provider URL enter the Endor Labs application URL https://api.endorlabs.com/.
Enter an Audience such as endor-aws-code-artifact and click Add Provider.

You must keep the Provider URL and Audience values handy.

Create an IAM role with trust policies

In AWS IAM, create roles that Endor Labs can assume once its users or services are authenticated. Associate each role with a trust policy that grants Endor Labs read-only access to repositories in AWS CodeArtifact.

From IAM, select Roles.
Click Create Role.
From Trusted entity type, select Web Identity and click Next.
Select the Identity provider you created in the previous task and for Audience select the exact value used in the previous task and click Next.
From Permission policies, select AWSCodeArtifactReadOnlyAccess and click Next.
Enter a name for the role such as endor-aws-code-artifact-role and include an optional description.
Click Create Role.

You must keep the role ARN handy to enter in the Endor Labs application.

You can now go and configure the package manager integration in Endor Labs

Create AWS resources using a CFT template

Use AWS CloudFormation Template (CFT) to automate the creation and configuration of AWS resources required for this integration.

Create a .cft file from the following script entering the OIDC URL, audience, namespace, and role name.

AWSTemplateFormatVersion: '2010-09-09'
Description: CloudFormation template to create an IAM OpenID Connect (OIDC) identity provider and an IAM role with AWSCodeArtifactReadOnlyAccess.

Parameters:
  OIDCUrl:
    Description: The URL of the OIDC provider (e.g., https://api.endorlabs.com).
    Type: String
    Default: "https://api.endorlabs.com"

  ClientId:
    Description: The audience claim to use in the OIDC trust policy (e.g., endor-aws-code-artifact).
    Type: String
    Default: "endor-aws-code-artifact"

  Namespace:
    Description: The namespace in the OIDC sub claim to allow (e.g., demo).
    Type: String
    Default: "Enter your Endor Labs Tenant"

  RoleName:
    Description: IAM role name (e.g., endor-aws-code-artifact-role).
    Type: String
    Default: "endor-aws-code-artifact-role"

Resources:
  OpenIDConnectProvider:
    Type: "AWS::IAM::OIDCProvider"
    Properties:
      Url: !Ref OIDCUrl
      ClientIdList:
        - !Ref ClientId
    DeletionPolicy: Retain

  CodeArtifactRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Ref RoleName
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Federated: !Ref OpenIDConnectProvider  # Directly reference OIDC Provider created in the same template
            Action: "sts:AssumeRoleWithWebIdentity"
            Condition:
              StringEquals:
                "api.endorlabs.com:aud": !Ref ClientId
              StringLike:
                "api.endorlabs.com:sub":
                  - !Sub "${Namespace}/*"
                  - !Sub "${Namespace}.*/*"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AWSCodeArtifactReadOnlyAccess"
    DeletionPolicy: Retain

Outputs:
  TargetRoleArn:
    Description: The ARN of the newly created IAM role
    Value: !GetAtt CodeArtifactRole.Arn

  AllowedAudience:
    Description: The allowed audience
    Value: !Ref ClientId

Save this file with an appropriate name such as awscodeartifact-endor-labs.cft, and have it handy.
Sign into AWS CloudFormation and search for Stacks.
Click Create Stack and select Choose an existing template.
From Template source, select Upload a template file.
Click Choose file, select the file you saved awscodeartifact-endor-labs.cft and click Next.
In Specify stack details, choose a name for the stack, verify the Parameters you entered in the script and click Next.
Select the acknowledgement from Configure stack options and click Next.
From Review and Create, review the details and click Submit. Check the progress of the creation of your resources from Stacks. Once the stack is created, you can see the status as CREATE_COMPLETE.
Click Outputs to see the target role ARN and the AllowedAudience values. Have the values handy to enter in the Endor Labs application.
You can now go and configure the package manager integration in Endor Labs

Create resources from the AWS CLI

To create the necessary resources for CodeArtifact integration with the AWS CLI use the following procedure:

First, create a new OIDC provider in AWS:

aws iam create-open-id-connect-provider \
    --url https://api.endorlabs.com \
    --client-id-list endor-aws-code-artifact

Keep the OpenIDConnectProviderArn returned during the create command handy. If you lose it you can retrieve it using the following command:

aws iam list-open-id-connect-providers

Next, you’ll need to create a role to provide the OIDC provider access to AWS CodeArtifact. Ensure you replace <insert-your-namespace> with your Endor Labs namespace and <insert-your-account-id> with your AWS account ID.

aws iam create-role \
    --role-name endor-aws-code-artifact-role \
    --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<insert-your-account-id>:oidc-provider/api.endorlabs.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "api.endorlabs.com:aud": "endor-aws-code-artifact"
                },
                "StringLike": {
                    "api.endorlabs.com:sub": [
                        "<insert-your-tenant>/*",
                        "<insert-your-tenant>.*/*"
                    ]
                }
            }
        }
    ]
}'

Finally, assign the role a permissions policy to access AWS CodeArtifact.

aws iam attach-role-policy \
    --role-name endor-aws-code-artifact-role \
    --policy-arn arn:aws:iam::aws:policy/AWSCodeArtifactReadOnlyAccess

You can now go and configure the package manager integration in Endor Labs

Configure package manager integration in Endor Labs with AWS CodeArtifact

After creating an IAM role in AWS with the necessary trust policies, configure AWS CodeArtifact package manager integration within the Endor Labs application.

Sign in to Endor Labs and under Manage, select Integrations.
Select the package manager configuration you’d like to customize and click Manage
In the upper right-hand corner, select Add Package Manager.
Select AWS Code Artifactory.
In DOMAIN, enter the name of your repository in AWS CodeArtifact.
In DOMAIN OWNER, enter the AWS account ID that owns the CodeArtifact repository.
In REPOSITORY, enter the repository name.
In TARGET ROLE ARN, enter the role ARN you created.
In ALLOWED AUDIENCE, enter the Audience value specified during role creation. In this example we used endor-aws-code-artifact.
In REGION, enter the AWS region of the AWS Code Artifact Repository.
Select if you want to Propagate this package manager to all child namespaces from Advanced.
Select Add Package Manager.