Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add roleprovider for role assumption by ec2 instance #33

Closed
wants to merge 1 commit into from
Closed

Add roleprovider for role assumption by ec2 instance #33

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 39 additions & 17 deletions awsutil/generate_credentials.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,10 +50,10 @@ type CredentialsConfig struct {
// The profile for the shared credentials provider, if being used
Profile string

// The role ARN to use if using the web identity token provider
// The role ARN to assume
RoleARN string

// The role session name to use if using the web identity token provider
// The role session name to use when assuming another role
RoleSessionName string

// The web identity token file to use if using the web identity token provider
Expand Down Expand Up @@ -160,24 +160,46 @@ func (c *CredentialsConfig) GenerateCredentialChain(opt ...Option) (*credentials
if roleSessionName == "" {
roleSessionName = os.Getenv("AWS_ROLE_SESSION_NAME")
}
if roleARN != "" && tokenPath != "" {
// this session is only created to create the WebIdentityRoleProvider, as the env variables are already there
// this automatically assumes the role, but the provider needs to be added to the chain
c.log(hclog.Debug, "adding web identity provider", "roleARN", roleARN)
sess, err := session.NewSession()
if err != nil {
return nil, errors.Wrap(err, "error creating a new session to create a WebIdentityRoleProvider")
}
webIdentityProvider := stscreds.NewWebIdentityRoleProvider(sts.New(sess), roleARN, roleSessionName, tokenPath)
if roleARN != "" {
if tokenPath != "" {
// this session is only created to create the WebIdentityRoleProvider, as the env variables are already there
// this automatically assumes the role, but the provider needs to be added to the chain
c.log(hclog.Debug, "adding web identity provider", "roleARN", roleARN)
sess, err := session.NewSession()
if err != nil {
return nil, errors.Wrap(err, "error creating a new session to create a WebIdentityRoleProvider")
}
webIdentityProvider := stscreds.NewWebIdentityRoleProvider(sts.New(sess), roleARN, roleSessionName, tokenPath)

// Check if the webIdentityProvider can successfully retrieve
// credentials (via sts:AssumeRole), and warn if there's a problem.
if _, err := webIdentityProvider.Retrieve(); err != nil {
c.log(hclog.Warn, "error assuming role", "roleARN", roleARN, "tokenPath", tokenPath, "sessionName", roleSessionName, "err", err)
}

// Check if the webIdentityProvider can successfully retrieve
// credentials (via sts:AssumeRole), and warn if there's a problem.
if _, err := webIdentityProvider.Retrieve(); err != nil {
c.log(hclog.Warn, "error assuming role", "roleARN", roleARN, "tokenPath", tokenPath, "sessionName", roleSessionName, "err", err)
// Add the web identity role credential provider
providers = append(providers, webIdentityProvider)
}
else {
// this session is only created to create the instanceRoleProvider, as the env variables are already there
// this automatically assumes the role, but the provider needs to be added to the chain
c.log(hclog.Debug, "adding ec2-instance role provider", "roleARN", roleARN)
sess, err := session.NewSession()
if err != nil {
return nil, errors.Wrap(err, "error creating a new session for ec2 instance role credentials")
}
instanceRoleProvider := stscreds.NewCredentials(sess, roleARN, func(p *stscreds.AssumeRoleProvider) {
p.RoleSessionName = roleSessionName
})

// Check if the provider can successfully retrieve credentials (via sts:AssumeRole), and warn if there's a problem.
if _, err := instanceRoleProvider.Retrieve(); err != nil {
c.log(hclog.Warn, "error assuming role", "roleARN", roleARN, "sessionName", roleSessionName, "err", err)
}

// Add the web identity role credential provider
providers = append(providers, webIdentityProvider)
// Add the instance role credential provider
providers = append(providers, instanceRoleProvider)
}
}

if opts.withEnvironmentCredentials {
Expand Down