Add support for sts assume_role tokens

[akama]

AWS allows users to authenticate requests with temporary credentials that are requested from the STS service. Doing so requires that the token header is signed and included with the request. This adds an optional parameter to calls to allow for a token parameter to be passed in.

This is working for me and I've successfully incorporated into my code but I'm putting this in draft until I can test it a bit more. Please let me know if you would like anything changed.

I believe this might solve #76 as well.

[tmcgilchrist]

Happy to change these values but could it be done in another PR and the change made across the board for all lib_test tests.

[tmcgilchrist]

Finally could you add a test that does something basic like creating a token and then using it on a request.
Right now I run everything in lib_test manually against my AWS credentials and check that it passes.

Thanks for the code :-)

[akringwood]

So I don't quite know the exact best way to conduct the tests for this because the IAM api isn't generated yet which makes it hard to create/delete all the resources we would need to do a clean test. I suspect the best way might be to add some code that allows for the token to be passed in optionally on via env to the tests and support running the tests with that token. Then you would just need a role in your aws account that you test with and you could assume-role and run the tests.

[tmcgilchrist]

As a suggestion can you create the resources needed via the AWS cli and then pass those through to the OCaml code to perform the request. Longer term we would have IAM bindings and replace the AWS cli part.

I suspect the best way might be to add some code that allows for the token to be passed in optionally on via env to the tests and support running the tests with that token. Then you would just need a role in your aws account that you test with and you could assume-role and run the tests.

I think that matches my suggestion above?

[tmcgilchrist]

@UnrealAkama Are you able to finish off this change?
There should be working STS support in OCaml now, I fixed a few serialisation issues and the module AssumeRole seems to be working for the simple tests I've done with it but as you said SSM isn't there yet. Maybe having a manual setup via the AWS cli and then running a single test, until I have time to generate SSM bindings.

[akama]

Yah, that makes sense to me. I'll get a commit up in the next couple days that has a way to test it.

[akama]

Added in #117.