feat(aws): add credential validation with --validate-creds flag

Adds an optional CredentialValidator interface to the provider package
and an AWS implementation that verifies the caller has all permissions
required for a Nebari deployment.

Default validation now uses sts:GetCallerIdentity instead of
Credentials.Retrieve, which only checks the local credential chain
without confirming AWS will accept them.

The new --validate-creds flag on the validate command runs the full
permission check via iam:SimulatePrincipalPolicy, batched in groups of
100 (the API limit) using slices.Chunk. Providers that don't implement
CredentialValidator print a note explaining the flag isn't supported.

The permission list lives in pkg/provider/aws/permissions.go to make
it easy to find and audit. Permissions are composed conditionally
based on cluster config:
  - VPC permissions skipped when ExistingVPCID is set
  - IAM permissions skipped when ExistingClusterRoleArn is set
  - EFS permissions only included when EFS.Enabled is true

Closes #6

Author: dcmcand

cmd/nic/validate.go

@@ -10,24 +10,30 @@ import (
 	"go.opentelemetry.io/otel/attribute"
 
 	"github.com/nebari-dev/nebari-infrastructure-core/pkg/config"
+	"github.com/nebari-dev/nebari-infrastructure-core/pkg/provider"
 	"github.com/nebari-dev/nebari-infrastructure-core/pkg/registry"
 )
 
 var (
 	validateConfigFile string
+	validateCreds      bool
 
 	validateCmd = &cobra.Command{
 		Use:   "validate",
 		Short: "Validate configuration file",
 		Long: `Validate the nebari-config.yaml file without deploying any infrastructure.
 This command checks that the configuration file is properly formatted and contains
-all required fields.`,
+all required fields.
+
+Use --validate-creds to perform thorough credential validation including permission
+checks (currently supported for AWS only).`,
 		RunE: runValidate,
 	}
 )
 
 func init() {
 	validateCmd.Flags().StringVarP(&validateConfigFile, "file", "f", "", "Path to nebari-config.yaml file (auto-discovered if omitted)")
+	validateCmd.Flags().BoolVar(&validateCreds, "validate-creds", false, "Perform thorough credential validation (AWS only)")
 }
 
 func runValidate(cmd *cobra.Command, args []string) error {
@@ -45,7 +51,10 @@ func runValidate(cmd *cobra.Command, args []string) error {
 	ctx, span := tracer.Start(ctx, "cmd.validate")
 	defer span.End()
 
-	span.SetAttributes(attribute.String("config.file", validateConfigFile))
+	span.SetAttributes(
+		attribute.String("config.file", validateConfigFile),
+		attribute.Bool("validate_creds", validateCreds),
+	)
 
 	slog.Info("Validating configuration", "config_file", validateConfigFile)
 
@@ -73,6 +82,31 @@ func runValidate(cmd *cobra.Command, args []string) error {
 	fmt.Printf("  Provider: %s\n", cfg.Cluster.ProviderName())
 	fmt.Printf("  Project: %s\n", cfg.ProjectName)
 
+	// Perform thorough credential validation if requested.
+	if validateCreds {
+		providerName := cfg.Cluster.ProviderName()
+		p, err := reg.ClusterProviders.Get(ctx, providerName)
+		if err != nil {
+			span.RecordError(err)
+			slog.Error("Provider not available", "error", err, "provider", providerName)
+			return err
+		}
+
+		cv, ok := p.(provider.CredentialValidator)
+		if !ok {
+			fmt.Printf("Note: The %s provider does not support --validate-creds\n", providerName)
+			return nil
+		}
+
+		slog.Info("Performing credential validation", "provider", providerName)
+		if err := cv.ValidateCredentials(ctx, cfg.ProjectName, cfg.Cluster); err != nil {
+			span.RecordError(err)
+			slog.Error("Credential validation failed", "error", err, "provider", providerName)
+			return err
+		}
+		fmt.Printf("✓ Credentials are valid with required permissions\n")
+	}
+
 	return nil
 }
 

go.mod

@@ -7,6 +7,8 @@ require (
 	github.com/aws/aws-sdk-go-v2/config v1.31.20
 	github.com/aws/aws-sdk-go-v2/service/ec2 v1.286.0
 	github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.33.19
+	github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.54.11
+	github.com/aws/aws-sdk-go-v2/service/iam v1.53.8
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.95.1
 	github.com/aws/aws-sdk-go-v2/service/sts v1.40.2
 	github.com/aws/smithy-go v1.25.0
@@ -24,6 +26,7 @@ require (
 	go.opentelemetry.io/otel/sdk v1.38.0
 	go.opentelemetry.io/otel/trace v1.38.0
 	golang.org/x/crypto v0.48.0
+	gopkg.in/yaml.v3 v3.0.1
 	helm.sh/helm/v3 v3.19.4
 	k8s.io/api v0.35.0
 	k8s.io/apimachinery v0.35.0
@@ -53,7 +56,6 @@ require (
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.54.11 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.8 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 // indirect
@@ -169,7 +171,6 @@ require (
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/apiextensions-apiserver v0.34.2 // indirect
 	k8s.io/apiserver v0.34.2 // indirect
 	k8s.io/cli-runtime v0.34.2 // indirect

go.sum

@@ -62,6 +62,8 @@ github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.33.19 h1:ybEda2mkkX
 github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.33.19/go.mod h1:RiMytGvN4azx4yLM0Kn3bX/XO9dLxj+eG72Smy+vNzI=
 github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.54.11 h1:0iNKMyO0SXuRfl5FF6TQASAHTXnTYZlQS3/oJSfpEbQ=
 github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.54.11/go.mod h1:WdVArS8riWgCC1JoIVmKdqfBfj2+cSWAjBU5dEapMhA=
+github.com/aws/aws-sdk-go-v2/service/iam v1.53.8 h1:p0oB4eZfBfBAOasnKvHJOlNcuHVE/ieuWs7uIZgQlyQ=
+github.com/aws/aws-sdk-go-v2/service/iam v1.53.8/go.mod h1:epCaPnGVdiX5ra1lHPfRkVuiQGxrdY8bRI2FBJU+6ok=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 h1:0ryTNEdJbzUCEWkVXEXoqlXV72J5keC1GvILMOuD00E=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4/go.mod h1:HQ4qwNZh32C3CBeO6iJLQlgtMzqeG17ziAA/3KDJFow=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.8 h1:Z5EiPIzXKewUQK0QTMkutjiaPVeVYXX7KIqhXu/0fXs=

pkg/provider/aws/credentials.go

@@ -0,0 +1,152 @@
+package aws
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awsconfig "github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/service/iam"
+	iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+
+	"github.com/nebari-dev/nebari-infrastructure-core/pkg/config"
+	"github.com/nebari-dev/nebari-infrastructure-core/pkg/provider"
+	"github.com/nebari-dev/nebari-infrastructure-core/pkg/status"
+)
+
+// iamSimulateBatchSize is the maximum number of action names per
+// SimulatePrincipalPolicy call. The AWS API caps this at 100.
+const iamSimulateBatchSize = 100
+
+// IAMClient defines the IAM operations needed for credential validation.
+type IAMClient interface {
+	SimulatePrincipalPolicy(ctx context.Context, params *iam.SimulatePrincipalPolicyInput, optFns ...func(*iam.Options)) (*iam.SimulatePrincipalPolicyOutput, error)
+}
+
+// newIAMClient creates a new IAM client for the specified region.
+func newIAMClient(ctx context.Context, region string) (IAMClient, error) {
+	cfg, err := awsconfig.LoadDefaultConfig(ctx, awsconfig.WithRegion(region))
+	if err != nil {
+		return nil, fmt.Errorf("failed to load AWS config: %w", err)
+	}
+	return iam.NewFromConfig(cfg), nil
+}
+
+// CredentialValidationResult contains the results of credential validation.
+type CredentialValidationResult struct {
+	AccountID          string
+	Arn                string
+	MissingPermissions []string
+}
+
+// validateCredentialsWithClients performs thorough credential validation using
+// provided clients (for testability).
+func validateCredentialsWithClients(ctx context.Context, stsClient STSClient, iamClient IAMClient, cfg *Config) (*CredentialValidationResult, error) {
+	tracer := otel.Tracer("nebari-infrastructure-core")
+	ctx, span := tracer.Start(ctx, "aws.validateCredentialsWithClients")
+	defer span.End()
+
+	identity, err := stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})
+	if err != nil {
+		span.RecordError(err)
+		return nil, fmt.Errorf("failed to get caller identity: %w", err)
+	}
+
+	result := &CredentialValidationResult{
+		AccountID: aws.ToString(identity.Account),
+		Arn:       aws.ToString(identity.Arn),
+	}
+
+	span.SetAttributes(
+		attribute.String("aws.account_id", result.AccountID),
+		attribute.String("aws.arn", result.Arn),
+	)
+
+	requiredPerms := getRequiredPermissions(cfg)
+
+	var missingPerms []string
+	for batch := range slices.Chunk(requiredPerms, iamSimulateBatchSize) {
+		simResult, err := iamClient.SimulatePrincipalPolicy(ctx, &iam.SimulatePrincipalPolicyInput{
+			PolicySourceArn: identity.Arn,
+			ActionNames:     batch,
+			ResourceArns:    []string{"*"},
+		})
+		if err != nil {
+			span.RecordError(err)
+			return nil, fmt.Errorf("failed to simulate IAM policy: %w", err)
+		}
+
+		for _, evalResult := range simResult.EvaluationResults {
+			if evalResult.EvalDecision != iamtypes.PolicyEvaluationDecisionTypeAllowed {
+				missingPerms = append(missingPerms, aws.ToString(evalResult.EvalActionName))
+			}
+		}
+	}
+
+	result.MissingPermissions = missingPerms
+
+	span.SetAttributes(
+		attribute.Int("permissions.checked", len(requiredPerms)),
+		attribute.Int("permissions.missing", len(missingPerms)),
+	)
+
+	return result, nil
+}
+
+// ValidateCredentials implements provider.CredentialValidator for thorough
+// credential validation including IAM permission checks.
+func (p *Provider) ValidateCredentials(ctx context.Context, projectName string, clusterConfig *config.ClusterConfig) error {
+	tracer := otel.Tracer("nebari-infrastructure-core")
+	ctx, span := tracer.Start(ctx, "aws.ValidateCredentials")
+	defer span.End()
+
+	span.SetAttributes(attribute.String("project_name", projectName))
+
+	awsCfg, err := extractAWSConfig(ctx, clusterConfig)
+	if err != nil {
+		span.RecordError(err)
+		return err
+	}
+
+	stsClient, err := newSTSClient(ctx, awsCfg.Region)
+	if err != nil {
+		span.RecordError(err)
+		return fmt.Errorf("failed to create STS client: %w", err)
+	}
+
+	iamClient, err := newIAMClient(ctx, awsCfg.Region)
+	if err != nil {
+		span.RecordError(err)
+		return fmt.Errorf("failed to create IAM client: %w", err)
+	}
+
+	result, err := validateCredentialsWithClients(ctx, stsClient, iamClient, awsCfg)
+	if err != nil {
+		span.RecordError(err)
+		return err
+	}
+
+	status.Send(ctx, status.NewUpdate(status.LevelSuccess, "AWS credentials validated").
+		WithResource("credentials").
+		WithAction("validated").
+		WithMetadata("identity", result.Arn).
+		WithMetadata("account", result.AccountID))
+
+	if len(result.MissingPermissions) > 0 {
+		status.Send(ctx, status.NewUpdate(status.LevelError, fmt.Sprintf("Missing %d required permissions: %s", len(result.MissingPermissions), strings.Join(result.MissingPermissions, ", "))).
+			WithResource("credentials").
+			WithAction("validated").
+			WithMetadata("missing_permissions", result.MissingPermissions))
+		return fmt.Errorf("credential validation failed: missing %d permissions: %s", len(result.MissingPermissions), strings.Join(result.MissingPermissions, ", "))
+	}
+
+	return nil
+}
+
+// Compile-time check that Provider implements CredentialValidator.
+var _ provider.CredentialValidator = (*Provider)(nil)