ENG-1610 Trusted Private Key support and implementation for GitLab

[lae]

Implements JWT creation using a Trusted Public/Private Key (TPK), configured in Amplify's dashboard, as a fallback for GitLab CI environments where the runner component is not available/usable (and thus no AMPLIFY_ID_TOKEN environment variable).

Changes

src/auth/tpk/mod.rs

• TpkJwt struct with builder-style configuration for issuer, audience, and algorithm. Defaults to https://tpk.amplify.security, https://api.amplify.security, and ES512 (ECDSA P-521) respectively.
• TpkJwt::from_env() - constructor wrapper that reads TRUSTED_PRIVATE_KEY from the environment
• TpkJwt::create_token() - creates a signed JWT using the TPK and custom claims from the caller (they're flattened when serialized)

src/auth/gitlab/mod.rs

GitlabAuth::get_token now falls back to signing a TPK JWT when AMPLIFY_ID_TOKEN is absent. The fallback token includes a minimal set of predefined GitLab CI/CD variables as claims, mirroring the shape of a real GitLab OIDC ID token:

Claim	Variable
ci_server_url	CI_SERVER_URL
pipeline_id	CI_PIPELINE_ID
project_id	CI_PROJECT_ID
project_path	CI_PROJECT_PATH
ref	CI_COMMIT_REF_NAME
job_id	CI_JOB_ID
sha	CI_COMMIT_SHA

These are all predefined GitLab CI variables that are expected to be present in any job.

Cargo.toml

We use jsonwebtoken for token creation/signing, but since TPKs are ES512 keypairs, I configured the dependency to pull from an active fork: Keats/jsonwebtoken#478. This'll have to be updated eventually when it's merged. Also ended up pulling in rust-crypto as the crypto backend instead of aws-lc-rs as a result.

[amplify-security]

🔍 Amplify code check status:  

⚠️ 0 issues detected in   📄 10 files and   ❇️ 1155 lines of code   🛠️ using Opengrep

Last updated by commit ecfd698 at 2026-02-25 17:23:25 UTC.

[mwillfox]

LGTM 🔥