Connect an AWS SDK or CLI¶

Issue Signature v4 credentials for a service account and point the official AWS CLI or an AWS SDK at Stegflow to drive your workflows.

Prerequisites¶

• A running Stegflow instance you can sign in to (see Getting started).
• A tenant (see Create a tenant).
• Permission to manage identity in that tenant. On the tenant resource you need CreateUser (create the service account) and AttachPolicy (attach a policy), plus CreateAccessKey on the service account itself. The built-in Administrators group grants these.
• The AWS CLI v2, or any AWS SDK (for example boto3).

Steps¶

1. Create a service account¶

An external client authenticates as a service account: a machine user that holds the credentials requests are signed with. In Access Management, on the Users tab, find the Service accounts section and create one, with a name that reflects its use, for example ci-deployer or activity-worker.

2. Attach a policy to the service account¶

A service account carries no permissions on its own. Attach a policy that allows the API actions your client calls, for example StartExecution, DescribeExecution and ListStateMachines. Keep it to the least privilege it needs.

3. Generate an access key¶

1. Open the service account, in the Credentials area.
2. Generate a new set of credentials by specifying a Description and an optional, but recommended, Expiration date, then click Generate.

An Access Key ID and a Secret Access Key are generated.

4. Configure the AWS client¶

Give the client the access key, the secret, a region and the Stegflow endpoint URL. Any region works: Stegflow does not validate it, but the AWS tooling requires one to be set. Use whichever method fits your setup.

1
2
3

[stegflow]
aws_access_key_id = <ACCESS_KEY_ID>
aws_secret_access_key = <SECRET_ACCESS_KEY>

1
2
3

[profile stegflow]
region = us-east-1
endpoint_url = http://localhost:8080

aws --profile stegflow stepfunctions list-state-machines
aws --profile stegflow stepfunctions start-execution --state-machine-arn <STATE_MACHINE_ARN>

export AWS_ACCESS_KEY_ID="<ACCESS_KEY_ID>"
export AWS_SECRET_ACCESS_KEY="<SECRET_ACCESS_KEY>"
export AWS_DEFAULT_REGION="us-east-1"
export AWS_ENDPOINT_URL="http://localhost:8080"

aws stepfunctions list-state-machines
aws stepfunctions start-execution --state-machine-arn <STATE_MACHINE_ARN>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

import boto3

sfn = boto3.client(
    "stepfunctions",
    endpoint_url="http://localhost:8080",
    region_name="us-east-1",
    aws_access_key_id="<ACCESS_KEY_ID>",
    aws_secret_access_key="<SECRET_ACCESS_KEY>",
)

print(sfn.list_state_machines())

sfn.start_execution(stateMachineArn="<STATE_MACHINE_ARN>")

Result¶

Your AWS CLI or SDK now talks to Stegflow with scoped credentials. Reuse the same access key from activity workers or CI, and see AWS compatibility for the full list of supported actions.