|
| 1 | +Connect to S3 authenticating with Google Cloud |
| 2 | +==== |
| 3 | + |
| 4 | +> Use Google Cloud to authenticate with S3 by configuring as an OpenID Connect (OIDC) Identity Provider in AWS IAM. |
| 5 | +
|
| 6 | + |
| 7 | +:::{tip} |
| 8 | +Refer to [Custom connection profile using OpenID Connect provider and AssumeRoleWithWebIdentity STS API](../protocols/profiles/aws_oidc.md) for custom configuration of connection profiles using OIDC web identity federation to connect to AWS S3. |
| 9 | +::: |
| 10 | + |
| 11 | +:::{admonition} Requirements |
| 12 | +:class: warning |
| 13 | +* Cyberduck [9.3.0](https://cyberduck.io/changelog/) or later required |
| 14 | +* Mountain Duck [5.1.0](https://mountainduck.io/changelog/) or later required |
| 15 | + ::: |
| 16 | + |
| 17 | +## Configuration in Google Cloud Console |
| 18 | + |
| 19 | +Create an OAuth application in the [Google Cloud Console](https://console.cloud.google.com/auth/clients) and configure it as an OIDC Identity Provider. |
| 20 | + |
| 21 | +:::{admonition} Setup a Custom OAuth Client ID Tutorial |
| 22 | +:class: tip |
| 23 | + |
| 24 | +Follow the [step-by-step instructions](custom_oauth_client_id.md) to Setup a Custom OAuth Client ID for Google. |
| 25 | +::: |
| 26 | + |
| 27 | + |
| 28 | +1. Navigate to _Solutions → All products → Management → Google Auth Platform → Clients_ in the [Google Cloud Console](https://console.cloud.google.com/auth/clients) and choose _Create client → OAuth client ID_. |
| 29 | +2. Select _iOS_ as the application type. |
| 30 | + |
| 31 | + :::{important} |
| 32 | + Other types require a OAuth Client Secret and do not allow for a supported redirect URI. |
| 33 | + ::: |
| 34 | + |
| 35 | +3. Enter `io.cyberduck` for use with Cyberduck or `io.mountainduck` to use with Mountain Duck for the _Bundle ID_. |
| 36 | +4. Copy the OAuth Client ID from the credentials screen. |
| 37 | + |
| 38 | + |
| 39 | +## Configuration in AWS IAM |
| 40 | + |
| 41 | +### Create an OIDC identity provider |
| 42 | + |
| 43 | +:::{tip} |
| 44 | +Google is already built-in to AWS as a trusted OIDC identity provider. Instead of using a ARN you can reference the built-in Google IdP in a role with `accounts.google.com`. |
| 45 | +::: |
| 46 | + |
| 47 | +### Create a role |
| 48 | + |
| 49 | +Assign a role to the identity provider created in the previous step with permissions to access S3. |
| 50 | + |
| 51 | +1. In AWS [IAM console](https://console.aws.amazon.com/iam/), choose _Create Role_ in _Roles_. |
| 52 | +2. Select _Web identity_ as the trusted entity type. |
| 53 | +3. Select _Google_ as the _Identity Provider_. |
| 54 | +4. Enter the OAuth Client ID from the application registration in Google Cloud Console for _Audience_. |
| 55 | +5. The resulting trust policy will look similar to the following: |
| 56 | + |
| 57 | + ```json |
| 58 | + { |
| 59 | + "Version": "2012-10-17", |
| 60 | + "Statement": [ |
| 61 | + { |
| 62 | + "Effect": "Allow", |
| 63 | + "Principal": { |
| 64 | + "Federated": "accounts.google.com" |
| 65 | + }, |
| 66 | + "Action": "sts:AssumeRoleWithWebIdentity", |
| 67 | + "Condition": { |
| 68 | + "StringEquals": { |
| 69 | + "accounts.google.com:aud": "<OAuth Client ID>.apps.googleusercontent.com" |
| 70 | + } |
| 71 | + } |
| 72 | + } |
| 73 | + ] |
| 74 | + } |
| 75 | + ``` |
| 76 | + |
| 77 | +6. In the next step attach a permission policy to the role such as the managed policy `AmazonS3FullAccess`. |
| 78 | +7. Copy the Role ARN from the _Summary_ tab. |
| 79 | + |
| 80 | + |
| 81 | +### Create a bookmark in Cyberduck or Mountain Duck |
| 82 | + |
| 83 | +1. Open _Preferences… → Profiles_ in Cyberduck or Mountain Duck. |
| 84 | +2. Enable the *AWS S3 (Google OpenID Connect)* connection profile. |
| 85 | +3. Add a new [Bookmark](../cyberduck/bookmarks.md) in Cyberduck or Mountain Duck and choose *AWS S3 (Google)* in the protocol dropdown. |
| 86 | +4. Enter the OAuth Client ID from the application registration in Google Cloud Console for _OAuth Client ID_ when prompted. It will be saved in the bookmark as a [custom property](hidden_properties.md#in-duck-bookmark-files). |
| 87 | + |
| 88 | + :::{image} _images/S3_Client_Id_Prompt.png |
| 89 | + :alt: OAuth Client ID Prompt |
| 90 | + :width: 400px |
| 91 | + ::: |
| 92 | + |
| 93 | + :::{tip} |
| 94 | + The _OAuth Client ID_ is the same as the _OAuth Client ID_ from the application registration in Google Cloud Console with the `.apps.googleusercontent.com` suffix. |
| 95 | + ::: |
| 96 | + |
| 97 | + :::{note} |
| 98 | + Alternatively set `OAuth Client ID` in a [custom connection profile](../protocols/profiles/aws_oidc.md). |
| 99 | + ::: |
| 100 | + |
| 101 | +5. Enter the Role ARN from the previous step when prompted. It will be saved in the bookmark as a [custom property](hidden_properties.md#in-duck-bookmark-files). |
| 102 | + |
| 103 | + :::{note} |
| 104 | + Alternatively set `role_arn` as a custom property in a [custom connection profile](../protocols/profiles/aws_oidc.md). |
| 105 | + ::: |
| 106 | + |
| 107 | + :::{image} _images/S3_Role_ARN_Prompt.png |
| 108 | + :alt: MFA Prompt |
| 109 | + :width: 400px |
| 110 | + ::: |
| 111 | + |
| 112 | +:::{admonition} Troubleshooting |
| 113 | +:class: attention |
| 114 | +### `Not authorized to perform sts:AssumeRoleWithWebIdentity` |
| 115 | +Validate the _Trusted entities_ in _Trust relationships_ in the IAM console. |
| 116 | + |
| 117 | +### `Request ARN is invalid` |
| 118 | +The role ARN entered is not valid. |
| 119 | + |
| 120 | +### `The security token included in the request is invalid` |
| 121 | +Invalid client token ID. Check the OAuth Client ID in the connection profile. |
| 122 | +::: |
| 123 | + |
| 124 | +## References |
| 125 | +- [AWS Identity and Access Management → OIDC federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html) |
| 126 | +- [Google Identity Platform → OpenID Connect](https://developers.google.com/identity/openid-connect/openid-connect) |
0 commit comments