Metadata-Version: 2.4
Name: eks-gcp-wif
Version: 0.1.1
Summary: EKS to GCP authentication via Workload Identity Federation
Home-page: https://github.com/yourusername/eks-gcp-wif
Author: Sajal Bera
Author-email: sajal.bera@nielsen.com
Keywords: aws gcp workload-identity authentication eks
Classifier: Programming Language :: Python :: 3
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Requires-Python: >=3.7
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: boto3>=1.26.0
Requires-Dist: google-auth>=2.16.0
Dynamic: author
Dynamic: author-email
Dynamic: classifier
Dynamic: description
Dynamic: description-content-type
Dynamic: home-page
Dynamic: keywords
Dynamic: license-file
Dynamic: requires-dist
Dynamic: requires-python
Dynamic: summary

# AWS-GCP Workload Identity Federation Auth

Minimal Python library for exchanging AWS EKS credentials for GCP credentials using Workload Identity Federation.

## Installation

```bash
pip install aws-gcp-wif-auth
```

## Usage

### Auto-detect Environment (Recommended)

```python
from aws_gcp_wif_auth import get_credentials

# Automatically uses WIF in EKS, ADC locally
credentials = get_credentials(
    project_number="123456789",
    pool_id="my-wif-pool",
    provider_id="my-wif-provider",
    service_account_email="my-sa@project.iam.gserviceaccount.com"
)
```

### Explicit WIF

```python
from aws_gcp_wif_auth import get_wif_credentials

credentials = get_wif_credentials(
    project_number="123456789",
    pool_id="my-wif-pool",
    provider_id="my-wif-provider",
    service_account_email="my-sa@project.iam.gserviceaccount.com",
    aws_region="us-east-1"
)
```

### Local Development (ADC)

```python
from aws_gcp_wif_auth import get_adc_credentials

# Uses: gcloud auth application-default login
credentials = get_adc_credentials()
```

### Authenticated Session

```python
from aws_gcp_wif_auth import get_authed_session

# Get session with auto-refreshing credentials
session = get_authed_session(
    project_number="123456789",
    pool_id="my-wif-pool",
    provider_id="my-wif-provider",
    service_account_email="my-sa@project.iam.gserviceaccount.com"
)

# Make API requests
response = session.get("https://storage.googleapis.com/storage/v1/b")
```

### Environment Detection

```python
from aws_gcp_wif_auth import is_eks_environment

if is_eks_environment():
    print("Running in EKS")
else:
    print("Running locally")
```

### Use with Google Cloud Libraries

```python
from google.cloud import storage
from aws_gcp_wif_auth import get_credentials

credentials = get_credentials(
    project_number="123456789",
    pool_id="my-pool",
    provider_id="my-provider",
    service_account_email="sa@project.iam.gserviceaccount.com"
)

client = storage.Client(credentials=credentials)
buckets = list(client.list_buckets())
```

## API Reference

### `get_credentials()`
Auto-detect environment and return appropriate credentials.

**Parameters:**
- `project_number`: GCP project number (required for WIF)
- `pool_id`: Workload Identity Pool ID (required for WIF)
- `provider_id`: Workload Identity Provider ID (required for WIF)
- `service_account_email`: GCP service account email (required for WIF)
- `aws_region`: AWS region (default: "us-east-1")
- `scopes`: OAuth scopes list (default: cloud-platform)
- `use_adc`: Force ADC instead of auto-detection (default: False)

### `get_wif_credentials()`
Explicitly use Workload Identity Federation.

### `get_adc_credentials()`
Explicitly use Application Default Credentials.

### `get_authed_session()`
Get authenticated session with auto-refreshing credentials.

### `is_eks_environment()`
Check if running in EKS environment.

## Requirements

- Python 3.8+
- Running in AWS EKS with IAM role for service account (for WIF)
- GCP Workload Identity Pool configured for AWS (for WIF)
- `gcloud auth application-default login` (for local ADC)

## License

MIT
