Today, AWS SDKs will cache the credentials returned by aws-spiffe-workload-helper in-memory and reuse them until they are close to expiry.
This works fine for long-lived consumers, but causes problems for short-lived consumers, as each invocation will trigger a call to the AWS API to exchange the X509 SVID for AWS credentials.
We could offer the ability to specify a local "cache" file, that can be shared between invocations of aws-spiffe-workload-helper.
Some various things we should establish before working on this ticket:
- Should the cache "bust" if the X509 SVID changes? If so, then we still need to connect to the Workload API on each invocation in order to determine if the upstream X509 SVID changes?
- How complex this "cache" needs to be? Do we need to break it down into individual caches for each SPIFFE ID?
- How users should configure the location of this cache?
Today, AWS SDKs will cache the credentials returned by
aws-spiffe-workload-helperin-memory and reuse them until they are close to expiry.This works fine for long-lived consumers, but causes problems for short-lived consumers, as each invocation will trigger a call to the AWS API to exchange the X509 SVID for AWS credentials.
We could offer the ability to specify a local "cache" file, that can be shared between invocations of
aws-spiffe-workload-helper.Some various things we should establish before working on this ticket: