Workload Identity Federation Auth

[dadgar]

🛠️ Description

Add the ability to authenticate using workload identity federation. This allows the SDK to source a workload credential and exchange it for an HCP service principal credential. The workload credential may be sourced from a:

• environment variable
• a file
• a HTTP request
• AWS IMDS

🔗 External Links

RFC HCP-363 and HCP-378.

👍 Definition of Done

• SDK added
• SDK updated
• Tests added?
• Docs updated?

Manual Testing

1. On PRDE created a SP and a identity provider pointing at my PRDE AWS account
2. Compiled and ran the following binary on PRDE (tried both IMDSv2: true and false)

package main

import (
	"crypto/tls"
	"log"

	"github.com/hashicorp/hcp-sdk-go/auth/workload"
	"github.com/hashicorp/hcp-sdk-go/config"
)

func main() {
	providerConfig := &workload.IdentityProviderConfig{
		ProviderResourceName: "iam/project/58967b2f-bc68-464e-8fb7-8e7d65b377f8/service-principal/test/workload-identity-provider/aws",
		AWS: &workload.AWSCredentialSource{
			IMDSv2: true,
		},
	}

	p, err := workload.New(providerConfig)
	if err != nil {
		log.Fatal(err)
	}

	_, err = config.NewHCPConfig(config.WithWorkloadIdentity(p), config.WithAPI("XXX.hashicorp.services", &tls.Config{}))
	if err != nil {
		log.Fatal(err)
	}

	t, err := p.Token()
	if err != nil {
		log.Fatal(err)
	}

	log.Printf("token: %#v", t)
}

3. Printed a valid access token.