aws-sdk-core 3.78.0 → 3.79.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 90c773fc0577d5607211e10f3d18d9cf3786d430
-  data.tar.gz: 1ac8f99565e2437ebb25f545a31fc13b252e619f
+  metadata.gz: 52713a4b23a1e90585c7a17f44213442b0a852cd
+  data.tar.gz: 42b9904fce3ff4291b28ef6e79a6d1a4ce6d2613
 SHA512:
-  metadata.gz: 5113990f262a560e7aabb293b4b08a4435d9fa0a0437ef4e7469aa922c8814dcb04a033e771345c396df2150a759a6e9ffc4cf36747f828d0e2669e3afa00c43
-  data.tar.gz: 0506d13ebca4fd603a3c78ba4f0e77a6e8d3e1b8ea0e2bf4d694efb7041bfb5c60d1ff36945fdd8da386b7d0dd2f486ddd49e2bfed1981e4a05600cd33db0ed1
+  metadata.gz: b5592fd6f513ea32dcbb010b7d29dc77c86b5e19d41ceab2d4f71aa69caa72286d8532098171a9ecb0116c80b83b3e52dd9cc7c289b869f6ba6fac070b66e771
+  data.tar.gz: 426ac9ade0cc503594e893b044365abdf22263b86ad7cb890cd08183ffc49d77b357c00d86a99acf2c1d273aead62c461d183cf38812f606ec904235f2ddebe3

data/VERSION

@@ -1 +1 @@
-3.78.0
+3.79.0

data/lib/aws-sdk-core/instance_profile_credentials.rb

@@ -11,6 +11,12 @@ module Aws
     # @api private
     class Non200Response < RuntimeError; end
 
+    # @api private
+    class TokenRetrivalError < RuntimeError; end
+
+    # @api private
+    class TokenExpiredError < RuntimeError; end
+
     # These are the errors we trap when attempting to talk to the
     # instance metadata service.  Any of these imply the service
     # is not present, no responding or some other non-recoverable
@@ -26,6 +32,14 @@ module Aws
       Non200Response,
     ]
 
+    # Path base for GET request for profile and credentials
+    # @api private
+    METADATA_PATH_BASE = '/latest/meta-data/iam/security-credentials/'
+
+    # Path for PUT request for token
+    # @api private
+    METADATA_TOKEN_PATH = '/latest/api/token'
+
     # @param [Hash] options
     # @option options [Integer] :retries (5) Number of times to retry
     #   when retrieving credentials.
@@ -40,6 +54,9 @@ module Aws
     # @option options [IO] :http_debug_output (nil) HTTP wire
     #   traces are sent to this object.  You can specify something
     #   like $stdout.
+    # @option options [Integer] :token_ttl Time-to-Live in seconds for EC2
+    #   Metadata Token used for fetching Metadata Profile Credentials, defaults
+    #   to 21600 seconds
     def initialize options = {}
       @retries = options[:retries] || 5
       @ip_address = options[:ip_address] || '169.254.169.254'
@@ -48,6 +65,7 @@ module Aws
       @http_read_timeout = options[:http_read_timeout] || 5
       @http_debug_output = options[:http_debug_output]
       @backoff = backoff(options[:backoff])
+      @token_ttl = options[:token_ttl] || 21600
       super
     end
 
@@ -94,9 +112,28 @@ module Aws
         begin
           retry_errors(NETWORK_ERRORS, max_retries: @retries) do
             open_connection do |conn|
-              path = '/latest/meta-data/iam/security-credentials/'
-              profile_name = http_get(conn, path).lines.first.strip
-              http_get(conn, path + profile_name)
+              # attempt to fetch token to start secure flow first
+              # and rescue to failover
+              begin
+                retry_errors(NETWORK_ERRORS, max_retries: @retries) do
+                  unless token_set?
+                    token_value, ttl = http_put(conn, METADATA_TOKEN_PATH, @token_ttl)
+                    @token = Token.new(token_value, ttl) if token_value && ttl
+                  end
+                end
+              rescue *NETWORK_ERRORS
+                # token attempt failed, reset token
+                # fallback to non-token mode
+                @token = nil
+              end
+
+              if token_set?
+                profile_name = http_get(conn, METADATA_PATH_BASE, @token.value).lines.first.strip
+                http_get(conn, METADATA_PATH_BASE + profile_name, @token.value)
+              else
+                profile_name = http_get(conn, METADATA_PATH_BASE).lines.first.strip
+                http_get(conn, METADATA_PATH_BASE + profile_name)
+              end
             end
           end
         rescue
@@ -105,6 +142,10 @@ module Aws
       end
     end
 
+    def token_set?
+      @token && !@token.expired?
+    end
+
     def _metadata_disabled?
       flag = ENV["AWS_EC2_METADATA_DISABLED"]
       !flag.nil? && flag.downcase == "true"
@@ -119,8 +160,11 @@ module Aws
       yield(http).tap { http.finish }
     end
 
-    def http_get(connection, path)
-      response = connection.request(Net::HTTP::Get.new(path, {"User-Agent" => "aws-sdk-ruby3/#{CORE_GEM_VERSION}"}))
+    # GET request fetch profile and credentials
+    def http_get(connection, path, token=nil)
+      headers = {"User-Agent" => "aws-sdk-ruby3/#{CORE_GEM_VERSION}"}
+      headers["x-aws-ec2-metadata-token"] = token if token
+      response = connection.request(Net::HTTP::Get.new(path, headers))
       if response.code.to_i == 200
         response.body
       else
@@ -128,6 +172,28 @@ module Aws
       end
     end
 
+    # PUT request fetch token with ttl
+    def http_put(connection, path, ttl)
+      headers = {
+        "User-Agent" => "aws-sdk-ruby3/#{CORE_GEM_VERSION}",
+        "x-aws-ec2-metadata-token-ttl-seconds" => ttl.to_s
+      }
+      response = connection.request(Net::HTTP::Put.new(path, headers))
+      case response.code.to_i
+      when 200
+        [
+          response.body,
+          response.header["x-aws-ec2-metadata-token-ttl-seconds"].to_i
+        ]
+      when 401
+        raise TokenExpiredError
+      when 400
+        raise TokenRetrivalError
+      else
+        raise Non200Response
+      end
+    end
+
     def retry_errors(error_classes, options = {}, &block)
       max_retries = options[:max_retries]
       retries = 0
@@ -144,5 +210,24 @@ module Aws
       end
     end
 
+    # @api private
+    # Token used to fetch IMDS profile and credentials
+    class Token
+
+      def initialize(value, ttl)
+        @ttl = ttl
+        @value = value
+        @created_time = Time.now
+      end
+
+      # [String] token value
+      attr_reader :value
+
+      def expired?
+        Time.now - @created_time > @ttl
+      end
+
+    end
+
   end
 end

data/lib/aws-sdk-sts.rb

@@ -40,6 +40,6 @@ require_relative 'aws-sdk-sts/customizations'
 # @service
 module Aws::STS
 
-  GEM_VERSION = '3.78.0'
+  GEM_VERSION = '3.79.0'
 
 end

data/lib/aws-sdk-sts/client.rb

@@ -1815,7 +1815,7 @@ module Aws::STS
         params: params,
         config: config)
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.78.0'
+      context[:gem_version] = '3.79.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-core
 version: !ruby/object:Gem::Version
-  version: 3.78.0
+  version: 3.79.0
 platform: ruby
 authors:
 - Amazon Web Services
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-11-15 00:00:00.000000000 Z
+date: 2019-11-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jmespath