diff --git a/actions/providers/providers.ts b/actions/providers/providers.ts
index a1704c4fea..3a651783df 100644
--- a/actions/providers/providers.ts
+++ b/actions/providers/providers.ts
@@ -158,27 +158,50 @@ export const addCredentialsProvider = async (formData: FormData) => {
const providerId = formData.get("providerId");
const providerType = formData.get("providerType");
+ const isRole = formData.get("role_arn") !== null;
+
let secret = {};
+ let secretType = "static"; // Default to static credentials
if (providerType === "aws") {
- secret = {
- aws_access_key_id: formData.get("aws_access_key_id"),
- aws_secret_access_key: formData.get("aws_secret_access_key"),
- aws_session_token: formData.get("aws_session_token") || undefined,
- };
+ if (isRole) {
+ // Role-based configuration for AWS
+ secretType = "role";
+ secret = {
+ role_arn: formData.get("role_arn"),
+ aws_access_key_id: formData.get("aws_access_key_id") || undefined,
+ aws_secret_access_key:
+ formData.get("aws_secret_access_key") || undefined,
+ aws_session_token: formData.get("aws_session_token") || undefined,
+ session_duration:
+ parseInt(formData.get("session_duration") as string, 10) || 3600,
+ external_id: formData.get("external_id") || undefined,
+ role_session_name: formData.get("role_session_name") || undefined,
+ };
+ } else {
+ // Static credentials configuration for AWS
+ secret = {
+ aws_access_key_id: formData.get("aws_access_key_id"),
+ aws_secret_access_key: formData.get("aws_secret_access_key"),
+ aws_session_token: formData.get("aws_session_token") || undefined,
+ };
+ }
} else if (providerType === "azure") {
+ // Static credentials configuration for Azure
secret = {
client_id: formData.get("client_id"),
client_secret: formData.get("client_secret"),
tenant_id: formData.get("tenant_id"),
};
} else if (providerType === "gcp") {
+ // Static credentials configuration for GCP
secret = {
client_id: formData.get("client_id"),
client_secret: formData.get("client_secret"),
refresh_token: formData.get("refresh_token"),
};
} else if (providerType === "kubernetes") {
+ // Static credentials configuration for Kubernetes
secret = {
kubeconfig_content: formData.get("kubeconfig_content"),
};
@@ -188,7 +211,7 @@ export const addCredentialsProvider = async (formData: FormData) => {
data: {
type: "ProviderSecret",
attributes: {
- secret_type: "static",
+ secret_type: secretType,
secret,
name: secretName,
},
diff --git a/app/(prowler)/providers/(set-up-provider)/add-credentials/page.tsx b/app/(prowler)/providers/(set-up-provider)/add-credentials/page.tsx
index b5fda55e11..6a525990fa 100644
--- a/app/(prowler)/providers/(set-up-provider)/add-credentials/page.tsx
+++ b/app/(prowler)/providers/(set-up-provider)/add-credentials/page.tsx
@@ -1,7 +1,10 @@
import { redirect } from "next/navigation";
import React from "react";
-import { ViaCredentialsForm } from "@/components/providers/workflow/forms";
+import {
+ ViaCredentialsForm,
+ ViaRoleForm,
+} from "@/components/providers/workflow/forms";
interface Props {
searchParams: { type: string; id: string; via?: string };
@@ -20,9 +23,13 @@ export default function AddCredentialsPage({ searchParams }: Props) {
(searchParams.type === "aws" && searchParams.via === "credentials") ||
(searchParams.type !== "aws" && !searchParams.via);
+ const useRoleForm =
+ searchParams.type === "aws" && searchParams.via === "role";
+
return (
<>
{useCredentialsForm && }
+ {useRoleForm && }
>
);
}
diff --git a/components/providers/workflow/forms/index.ts b/components/providers/workflow/forms/index.ts
index cf0417ed09..be1bb3277d 100644
--- a/components/providers/workflow/forms/index.ts
+++ b/components/providers/workflow/forms/index.ts
@@ -3,3 +3,4 @@ export * from "./launch-scan-form";
export * from "./radio-group-aws-via-credentials-form";
export * from "./test-connection-form";
export * from "./via-credentials-form";
+export * from "./via-role-form";
diff --git a/components/providers/workflow/forms/radio-group-aws-via-credentials-form.tsx b/components/providers/workflow/forms/radio-group-aws-via-credentials-form.tsx
index a0a04f551d..7a870c79ff 100644
--- a/components/providers/workflow/forms/radio-group-aws-via-credentials-form.tsx
+++ b/components/providers/workflow/forms/radio-group-aws-via-credentials-form.tsx
@@ -34,20 +34,9 @@ export const RadioGroupAWSViaCredentialsForm = ({
>
Using IAM Role
-
+
- Connect via CloudFormation
-
-
-
-
- Connect via Terraform
+ Connect assuming IAM Role
diff --git a/components/providers/workflow/forms/via-credentials-form.tsx b/components/providers/workflow/forms/via-credentials-form.tsx
index 56a9161ea0..176ed40a00 100644
--- a/components/providers/workflow/forms/via-credentials-form.tsx
+++ b/components/providers/workflow/forms/via-credentials-form.tsx
@@ -8,7 +8,7 @@ import * as z from "zod";
import { addCredentialsProvider } from "@/actions/providers/providers";
import { useToast } from "@/components/ui";
-import { CustomButton, CustomInput } from "@/components/ui/custom";
+import { CustomButton } from "@/components/ui/custom";
import { Form } from "@/components/ui/form";
import {
addCredentialsFormSchema,
@@ -50,7 +50,6 @@ export const ViaCredentialsForm = ({
const form = useForm({
resolver: zodResolver(formSchema),
defaultValues: {
- secretName: "",
providerId,
providerType,
...(providerType === "aws"
@@ -188,20 +187,6 @@ export const ViaCredentialsForm = ({
/>
)}
- Name (Optional)
-
-
{
+ const router = useRouter();
+ const { toast } = useToast();
+
+ const providerType = searchParams.type;
+ const providerId = searchParams.id;
+
+ const formSchema = addCredentialsRoleFormSchema(providerType);
+ type FormSchemaType = z.infer;
+
+ const form = useForm({
+ resolver: zodResolver(formSchema),
+ defaultValues: {
+ providerId,
+ providerType,
+ ...(providerType === "aws"
+ ? {
+ role_arn: "",
+ aws_access_key_id: "",
+ aws_secret_access_key: "",
+ aws_session_token: "",
+ session_duration: 3600,
+ external_id: "",
+ role_session_name: "",
+ }
+ : {}),
+ },
+ });
+
+ const isLoading = form.formState.isSubmitting;
+
+ const onSubmitClient = async (values: FormSchemaType) => {
+ console.log("via ROLE form", values);
+ const formData = new FormData();
+
+ Object.entries(values).forEach(
+ ([key, value]) =>
+ value !== undefined && formData.append(key, String(value)),
+ );
+
+ const data = await addCredentialsProvider(formData);
+
+ if (data?.errors && data.errors.length > 0) {
+ data.errors.forEach((error: ApiError) => {
+ const errorMessage = error.detail;
+ switch (error.source.pointer) {
+ case "/data/attributes/secret/role_arn":
+ form.setError("role_arn" as keyof FormSchemaType, {
+ type: "server",
+ message: errorMessage,
+ });
+ break;
+
+ default:
+ toast({
+ variant: "destructive",
+ title: "Oops! Something went wrong",
+ description: errorMessage,
+ });
+ }
+ });
+ } else {
+ router.push(
+ `/providers/test-connection?type=${providerType}&id=${providerId}`,
+ );
+ }
+ };
+
+ return (
+
+
+ );
+};
diff --git a/components/providers/workflow/forms/via-role/aws-role-form.tsx b/components/providers/workflow/forms/via-role/aws-role-form.tsx
new file mode 100644
index 0000000000..eb7f5d3a43
--- /dev/null
+++ b/components/providers/workflow/forms/via-role/aws-role-form.tsx
@@ -0,0 +1,105 @@
+import { Control } from "react-hook-form";
+
+import { CustomInput } from "@/components/ui/custom";
+import { AWSCredentialsRole } from "@/types";
+
+export const AWSCredentialsRoleForm = ({
+ control,
+}: {
+ control: Control;
+}) => {
+ return (
+ <>
+
+
+ Connect assuming IAM Role
+
+
+ Please provide the information for your AWS credentials.
+
+
+
+
+ Optional fields
+
+
+
+
+
+
+
+
+
+ >
+ );
+};
diff --git a/components/providers/workflow/forms/via-role/index.ts b/components/providers/workflow/forms/via-role/index.ts
new file mode 100644
index 0000000000..763c90c0c0
--- /dev/null
+++ b/components/providers/workflow/forms/via-role/index.ts
@@ -0,0 +1 @@
+export * from "./aws-role-form";
diff --git a/types/components.ts b/types/components.ts
index 9c84ce65ab..b6c4b59da2 100644
--- a/types/components.ts
+++ b/types/components.ts
@@ -34,6 +34,16 @@ export type AWSCredentials = {
providerId: string;
};
+export type AWSCredentialsRole = {
+ role_arn: string;
+ aws_access_key_id?: string;
+ aws_secret_access_key?: string;
+ aws_session_token?: string;
+ external_id?: string;
+ role_session_name?: string;
+ session_duration?: number;
+};
+
export type AzureCredentials = {
client_id: string;
client_secret: string;
diff --git a/types/formSchemas.ts b/types/formSchemas.ts
index bd7c0b6585..a90ffc8c02 100644
--- a/types/formSchemas.ts
+++ b/types/formSchemas.ts
@@ -104,6 +104,24 @@ export const addCredentialsFormSchema = (providerType: string) =>
: {}),
});
+export const addCredentialsRoleFormSchema = (providerType: string) =>
+ providerType === "aws"
+ ? z.object({
+ providerId: z.string(),
+ providerType: z.string(),
+ role_arn: z.string().optional(),
+ aws_access_key_id: z.string().optional(),
+ aws_secret_access_key: z.string().optional(),
+ aws_session_token: z.string().optional(),
+ session_duration: z.number().optional(),
+ external_id: z.string().optional(),
+ role_session_name: z.string().optional(),
+ })
+ : z.object({
+ providerId: z.string(),
+ providerType: z.string(),
+ });
+
export const testConnectionFormSchema = z.object({
providerId: z.string(),
});