aws-sdk-core 3.23.0 → 3.24.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 863e0c2db542c1c5c45bb03309f1d01ed64d3f7d
-  data.tar.gz: db3a641dd73c9f2b5fcb6809314e7881da912602
+  metadata.gz: aad412b598b70e2373c73086f4ed949ac84152fb
+  data.tar.gz: cfebe3b9d5e15b9b7d323059f80816d992eb6d0a
 SHA512:
-  metadata.gz: bb7fd926f77db04fa0caacafba5cdfe44019efd2236862eedc1e80fab038bf42787007e60dc6b82d98993d4fd556dcc20b6e66c4a0ee76cedfa030cc5cda2470
-  data.tar.gz: 65ea0631d143d0d1c132c232feaa26e78d8e5d8339ec1888600871ae8c2a172f15f60f67d56c696bbb77664b53299dca9fa13d3f3ccb3f43cdd55188539e8441
+  metadata.gz: e7591377e89f307f65a8261632906c36f755275449c861a447f24d72b47f3f2abf4d33d4e6b9ed114ca47d5a7a0108649070ec5da57a69483dbdb1475ecdf4f2
+  data.tar.gz: 595e31b23d517448b5d3cf1d82b4b42c5c47618a564a38d0432d5320b9c7bfe4d39c79ebd838b295bc9e7622dd06fc1a1d49fd0294576204a3b79723100e7932

data/VERSION

@@ -1 +1 @@
-3.23.0
+3.24.0

data/lib/aws-sdk-core.rb

@@ -14,6 +14,7 @@ require_relative 'aws-sdk-core/credential_provider_chain'
 require_relative 'aws-sdk-core/ecs_credentials'
 require_relative 'aws-sdk-core/instance_profile_credentials'
 require_relative 'aws-sdk-core/shared_credentials'
+require_relative 'aws-sdk-core/process_credentials'
 
 # client modules
 

data/lib/aws-sdk-core/credential_provider_chain.rb

@@ -23,6 +23,7 @@ module Aws
         [:env_credentials, {}],
         [:assume_role_credentials, {}],
         [:shared_credentials, {}],
+        [:process_credentials, {}],
         [:instance_profile_credentials, {
           retries: @config ? @config.instance_profile_credentials_retries : 0,
           http_open_timeout: @config ? @config.instance_profile_credentials_timeout : 1,
@@ -69,6 +70,20 @@ module Aws
       nil
     end
 
+    def process_credentials(options)
+      profile_name = options[:config].profile if options[:config]
+      profile_name ||= ENV['AWS_PROFILE'].nil? ? 'default' : ENV['AWS_PROFILE']
+      
+      config = Aws.shared_config
+      if config.config_enabled? && process_provider = config.credentials_process(profile_name)
+        ProcessCredentials.new(process_provider)
+      else
+        nil
+      end
+    rescue Errors::NoSuchProfileError
+      nil
+    end
+
     def assume_role_credentials(options)
       if Aws.shared_config.config_enabled?
         profile, region = nil, nil

data/lib/aws-sdk-core/errors.rb

@@ -102,6 +102,10 @@ module Aws
       end
     end
 
+    # Raised when a credentials provider process returns a JSON
+    # payload with either invalid version number or malformed contents
+    class InvalidProcessCredentialsPayload < RuntimeError; end
+
     # Raised when a client is constructed and region is not specified.
     class MissingRegionError < ArgumentError
       def initialize(*args)

data/lib/aws-sdk-core/process_credentials.rb

@@ -0,0 +1,74 @@
+require 'open3'
+
+module Aws
+
+  # A credential provider that executes a given process and attempts
+  # to read its stdout to recieve a JSON payload containing the credentials
+  #
+  # Automatically handles refreshing credentials if an Expiration time is 
+  # provided in the credentials payload
+  #
+  #     credentials = Aws::ProcessCredentials.new('/usr/bin/credential_proc').credentials
+  #
+  #     ec2 = Aws::EC2::Client.new(credentials: credentials)
+  #
+  # More documentation on process based credentials can be found here:
+  # https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#sourcing-credentials-from-external-processes
+  class ProcessCredentials
+
+    include CredentialProvider
+    include RefreshingCredentials
+
+    # Creates a new ProcessCredentials object, which allows an
+    # external process to be used as a credential provider.
+    #
+    # @param [String] process Invocation string for process
+    # credentials provider. 
+    def initialize(process)
+      @process = process
+      @credentials = credentials_from_process(@process)
+    end
+
+    private
+    def credentials_from_process(proc_invocation)
+      begin
+        raw_out, process_status = Open3.capture2(proc_invocation)
+      rescue Errno::ENOENT
+        raise Errors::InvalidProcessCredentialsPayload.new("Could not find process #{proc_invocation}")
+      end
+
+      if process_status.success?
+        creds_json = JSON.parse(raw_out)
+        payload_version = creds_json['Version']
+        if payload_version == 1
+          _parse_payload_format_v1(creds_json)
+        else
+          raise Errors::InvalidProcessCredentialsPayload.new("Invalid version #{payload_version} for credentials payload")
+        end
+      else
+        raise Errors::InvalidProcessCredentialsPayload.new('credential_process provider failure, the credential process had non zero exit status and failed to provide credentials')
+      end
+    end
+
+    def _parse_payload_format_v1(creds_json)
+      creds = Credentials.new(
+        creds_json['AccessKeyId'],
+        creds_json['SecretAccessKey'],
+        creds_json['SessionToken']
+      )
+
+      @expiration = creds_json['Expiration'] ? Time.iso8601(creds_json['Expiration']) : nil
+      return creds if creds.set?
+      raise Errors::InvalidProcessCredentialsPayload.new("Invalid payload for JSON credentials version 1")
+    end
+
+    def refresh
+      @credentials = credentials_from_process(@process)
+    end
+
+    def near_expiration?
+      # are we within 5 minutes of expiration?
+      @expiration && (Time.now.to_i + 5 * 60) > @expiration.to_i
+    end
+  end
+end

data/lib/aws-sdk-core/shared_config.rb

@@ -135,6 +135,11 @@ module Aws
       end
     end
 
+    def credentials_process(profile)
+      validate_profile_exists(profile)
+      @parsed_config[profile]['credential_process']
+    end
+
     private
     def credentials_present?
       (@parsed_credentials && !@parsed_credentials.empty?) ||

data/lib/aws-sdk-sts.rb

@@ -40,6 +40,6 @@ require_relative 'aws-sdk-sts/customizations'
 # @service
 module Aws::STS
 
-  GEM_VERSION = '3.23.0'
+  GEM_VERSION = '3.24.0'
 
 end

data/lib/aws-sdk-sts/client.rb

@@ -1486,7 +1486,7 @@ module Aws::STS
         params: params,
         config: config)
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.23.0'
+      context[:gem_version] = '3.24.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-core
 version: !ruby/object:Gem::Version
-  version: 3.23.0
+  version: 3.24.0
 platform: ruby
 authors:
 - Amazon Web Services
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-07-31 00:00:00.000000000 Z
+date: 2018-08-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jmespath
@@ -133,6 +133,7 @@ files:
 - lib/aws-sdk-core/plugins/signature_v4.rb
 - lib/aws-sdk-core/plugins/stub_responses.rb
 - lib/aws-sdk-core/plugins/user_agent.rb
+- lib/aws-sdk-core/process_credentials.rb
 - lib/aws-sdk-core/query.rb
 - lib/aws-sdk-core/query/ec2_param_builder.rb
 - lib/aws-sdk-core/query/handler.rb