Repository navigation
feat(aws): assume customer roles with Maple's own OIDC tokens - #1715
Confidence 8/10 · No issues found
🟢 Confidence 8/10 · likely safe to merge
The thumbprint reclassification is correct but untested, and the rewritten STS call still has no client span (F2).
2 notes · tests partial −1 · risk medium · 0/1 new units observable −1
The last commits make a stale OIDC thumbprint read as the customer's setup, which fixes F1; the STS call itself is unchanged and still uninstrumented (F2 open). None of the five open error issues in this file is addressed: toApiError is only renamed to toReadError, and the classified STS rejections still reach spans from stsError.
stsErrornow maps anInvalidIdentityTokennaming a thumbprint toassume_denied
Before merge
- Secret · Add secret
MAPLE_AWS_OIDC_SIGNING_KEYto every environment ·packages/backend/src/platform/Env.ts:285 - Migration · Check it is safe on production data and with the code still deployed ·
packages/db/drizzle/20261022223850_aws_oidc/migration.sql - Migration · Check it is safe on production data and with the code still deployed ·
packages/db/drizzle/20261022230028_merge_aws_oidc/migration.sql - Infra · Check every environment has what this config now expects ·
alchemy.run.ts - Manual · Post the preview result the description still lists as pending: a real connection check against STS in a real account
Findings
🔵 Note · F3 · New InvalidIdentityToken thumbprint branch has no test in fake-aws
tests · packages/backend/src/services/integrations/aws/api-impl.ts:74-76
The setupMissing branch added in this commit only fires on an InvalidIdentityToken whose message names a thumbprint, and the fake STS never sends that message — it answers The token signature is invalid., No OpenIDConnect provider found… and Incorrect token audience (packages/backend/src/services/integrations/aws/fake-aws.ts:211, :218, :222), so nothing pins the classification this commit exists for. Add a fake-aws case returning AWS's thumbprint message and assert the connection stays pending instead of reading as maple_identity.
Add a thumbprint case to the fake STS trust check and a test asserting the resulting connection state.
Still open from earlier reviews
- 🔵 Note · F2 · STS assume call has no
peer.serviceor client span ·packages/backend/src/services/integrations/aws/api-impl.ts:135
Fixed since the last review
- ✅
F1 · A wrong OIDC thumbprint is reported as Maple's fault, not the customer's
Production impact
Open errors in the changed files
| Issue | Service | Occurrences | File |
|---|---|---|---|
| @maple/backend/integrations/RailwayApiError | alerting | 8 | packages/backend/src/services/integrations/aws/api-impl.ts |
| @maple/backend/integrations/RailwayApiError | alerting | 6 | packages/backend/src/services/integrations/aws/api-impl.ts |
| @maple/backend/integrations/AwsApiError | maple-api | 4 | packages/backend/src/services/integrations/aws/api-impl.ts |
| @maple/backend/integrations/RailwayApiError | alerting | 4 | packages/backend/src/services/integrations/aws/api-impl.ts |
| @maple/backend/integrations/AwsApiError | maple-api | 3 | packages/backend/src/services/integrations/aws/api-impl.ts |
After this merges, Maple checks whether they stop.
Production traffic of the changed files (last 7 days)
| File | Calls/day | Busiest operations |
|---|---|---|
packages/backend/src/services/integrations/aws/setup.ts |
56k | maple 56k/day, 82.6% err |
apps/api/src/worker.ts |
12k | POST /mcp 5.7k/day, 0.0% errPOST /mcp 5.6k/day, 0.1% errGET /mcp 303/day, 0.0% err |
apps/api/src/routes/aws-oidc.http.ts |
896 | GET 757/day, 1.9% errGET 139/day, 0.0% err |
packages/backend/src/services/integrations/AwsConnectionService.ts |
8 | AwsConnectionService.checkDue 8/day, 0.0% err |
Telemetry this change adds and removes (1)
- ➕ span name
makeAwsOidcSigner·packages/backend/src/services/integrations/aws/oidc.ts:49
What was checked
- Thu
stsErrororder: throttle,assume_denied, thenInvalidIdentityTokenasmaple_identity(api-impl.ts:73-81) - The audience case still matches the regex through
Incorrect token audience(fake-aws.ts:222) checkRolereads credentials throughStsAnswer, so a changed STS shape fails asupstream
Observability coverage: 0 of 1 changes observable
| Change | Kind | Observable | Evidence |
|---|---|---|---|
STS AssumeRoleWithWebIdentity call over raw HttpClient |
outbound call | no | api-impl.ts:127-137 executes on FetchHttpClient.layer with no OTel instrumentation; no Client span or peer.service |
ed14019 · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.
Annotations
Check notice on line 76 in packages/backend/src/services/integrations/aws/api-impl.ts
maple-review-bot / Maple / review
tests: New `InvalidIdentityToken` thumbprint branch has no test in `fake-aws`
The `setupMissing` branch added in this commit only fires on an `InvalidIdentityToken` whose message names a thumbprint, and the fake STS never sends that message — it answers `The token signature is invalid.`, `No OpenIDConnect provider found…` and `Incorrect token audience` (`packages/backend/src/services/integrations/aws/fake-aws.ts:211`, `:218`, `:222`), so nothing pins the classification this commit exists for. Add a `fake-aws` case returning AWS's thumbprint message and assert the connection stays pending instead of reading as `maple_identity`.