Oracle Cloud Go SDK and Instance Principal based Authentication

Lucas Jellema

In a recent article, I described the use of the OCI SDK for Go(Lang) – in my example to interact with the ObjectStorage service. In the article, I used authentication based on tenancy and user ocid, fingerprint and private key. However, when the Go application is running in an OCI environment – Compute Instance, Function, Container on Kubernetes – it is usually a much better idea to have the application leverage the identity and associated privileges of its runtime environment. On OCI, this is called Instance Principal – the identity assigned to a runtime environment such as a compute instance or function.

I was wondering how exactly to leverage the instance principal in my Go code. It took me a little digging (probably looking in all the wrong places first) and I ended up with a ridiculously simple statement:

configurationProvider, err := auth.InstancePrincipalConfigurationProvider()

where configurationProvider is a common.ConfigurationProvider. Note: a package import is added for “github.com/oracle/oci-go-sdk/v54/common/auth”

The code changes and becomes much simpler. The sections in blue rectangles can be dropped, the line in the red rectangle is all that is required for instance principal based authentication.

image

What of course is required in order to make the code function correctly is:

  • define dynamic group that includes the instance (compute instance, function, OKE node) in which the code will run
  • define policies that grant to the dynamic group the required permissions for the code to do its OCI interactions

Resources

Example of InstancePrincipal Authentication: https://github.com/oracle/oci-go-sdk/blob/4e29eeb31529a52f73c80e1444f30c75d6c512c3/example/example_instance_principals_test.go#L28 

Accessing the Oracle Cloud Infrastructure API Using Instance Principals (blog article) – https://blogs.oracle.com/developers/post/accessing-the-oracle-cloud-infrastructure-api-using-instance-principals

OCI Docs – Calling OCI Services from an instance – https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/callingservicesfrominstances.htm

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Next Post

Quick Start Compute Instance on OCI (for software development)

I have worked quite a bit in Oracle Cloud, starting back in 2015. I have used many different OCI services – such as Integration, Streaming, Functions, OKE, API Gateway, Object Storage, DBaaS and several more. However, for some reason I have almost complete avoided the almost simplest service of all: […]
%d bloggers like this: