aws-sdk-core 3.57.0 → 3.58.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5ff5e1546d4fdfee5d72e640a0b5b8acf1fb667d
-  data.tar.gz: 530f6672fe1880c12d6e54063025ac0c69981111
+  metadata.gz: 8b82f63254467071b547826de2acf86e9b8322ae
+  data.tar.gz: 162c01adc59d6d67ca4d39e6dc497bb26bd67139
 SHA512:
-  metadata.gz: a42d36ff4c5020b1f368becd6d181075069d7dbeb0760ca2b190c86169abf8129c8dc29a9caf51f1ee4ad77552ea4b7ab3fb8b25a49860aff67eb8d364dc19ba
-  data.tar.gz: 7078284fa33006f4d7874741acf18bf9cbfad1be43f110faa1bdd7d629f2f54fcdc59b686f7eeac55121a1e9cf4c09c8488ac8c8bfb955b2c3e03c93bf35c795
+  metadata.gz: 26359f249597293f05b3b02d2bc9bedaff303edf599dd13559d996f68e3ef2f955c1503165940c078c636b4cf1e8496c7817e2e43ff42647d3862c39e08f39c1
+  data.tar.gz: 19595dcfe15a41f59bdcd881dc683b23ad41c811dc49d6ee1427c1cd368aa62f9167a96c6401b8b1042d9b29e12d0c16d4d1ae9225e6686a34fd0bf884159120

data/VERSION

@@ -1 +1 @@
-3.57.0
+3.58.0

data/lib/aws-sdk-core.rb

@@ -9,6 +9,7 @@ require_relative 'aws-sdk-core/deprecations'
 require_relative 'aws-sdk-core/credential_provider'
 require_relative 'aws-sdk-core/refreshing_credentials'
 require_relative 'aws-sdk-core/assume_role_credentials'
+require_relative 'aws-sdk-core/assume_role_web_identity_credentials'
 require_relative 'aws-sdk-core/credentials'
 require_relative 'aws-sdk-core/credential_provider_chain'
 require_relative 'aws-sdk-core/ecs_credentials'

data/lib/aws-sdk-core/assume_role_web_identity_credentials.rb

@@ -0,0 +1,101 @@
+require 'set'
+require 'securerandom'
+require 'base64'
+
+module Aws
+
+  # An auto-refreshing credential provider that works by assuming
+  # a role via {Aws::STS::Client#assume_role_with_web_identity}.
+  #
+  #     role_credentials = Aws::AssumeRoleWebIdentityCredentials.new(
+  #       client: Aws::STS::Client.new(...),
+  #       role_arn: "linked::account::arn",
+  #       web_identity_token_file: "/path/to/token/file",
+  #       role_session_name: "session-name"
+  #       ...
+  #     )
+  #     For full list of parameters accepted
+  #     @see Aws::STS::Client#assume_role_with_web_identity 
+  #
+  #
+  # If you omit `:client` option, a new {STS::Client} object will be
+  # constructed.
+  class AssumeRoleWebIdentityCredentials
+
+    include CredentialProvider
+    include RefreshingCredentials
+
+    # @option options [required, String] :role_arn the IAM role
+    #   to be assumed
+    #
+    # @option options [required, String] :web_identity_token_file
+    #   absolute path to the file on disk containing OIDC token
+    #
+    # @option options [String] :role_session_name the IAM session
+    #   name used to distinguish session, when not provided, base64
+    #   encoded UUID is generated as the session name
+    #
+    # @option options [STS::Client] :client
+    def initialize(options = {})
+      client_opts = {}
+      @assume_role_web_identity_params = {}
+      @token_file = options.delete(:web_identity_token_file)
+      options.each_pair do |key, value|
+        if self.class.assume_role_web_identity_options.include?(key)
+          @assume_role_web_identity_params[key] = value
+        else
+          client_opts[key] = value
+        end
+      end
+
+      unless @assume_role_web_identity_params[:role_session_name]
+        # not provided, generate encoded UUID as session name
+        @assume_role_web_identity_params[:role_session_name] = _session_name
+      end
+      @client = client_opts[:client] || STS::Client.new(client_opts)
+      super
+    end
+
+    # @return [STS::Client]
+    attr_reader :client
+
+    private
+
+    def refresh
+      # read from token file everytime it refreshes
+      @assume_role_web_identity_params[:web_identity_token] = _token_from_file(@token_file)
+
+      c = @client.assume_role_with_web_identity(
+        @assume_role_web_identity_params).credentials
+      @credentials = Credentials.new(
+        c.access_key_id,
+        c.secret_access_key,
+        c.session_token
+      )
+      @expiration = c.expiration
+    end
+
+    def _token_from_file(path)
+      unless path && File.exist?(path)
+        raise Aws::Errors::MissingWebIdentityTokenFile.new
+      end
+      File.read(path)
+    end
+
+    def _session_name
+      Base64.strict_encode64(SecureRandom.uuid)
+    end
+
+    class << self
+
+      # @api private
+      def assume_role_web_identity_options
+        @arwio ||= begin
+          input = STS::Client.api.operation(:assume_role_with_web_identity).input
+          Set.new(input.shape.member_names)
+        end
+      end
+
+    end
+  end
+end

data/lib/aws-sdk-core/credential_provider_chain.rb

@@ -21,6 +21,7 @@ module Aws
       [
         [:static_credentials, {}],
         [:env_credentials, {}],
+        [:assume_role_web_identity_credentials, {}],
         [:assume_role_credentials, {}],
         [:shared_credentials, {}],
         [:process_credentials, {}],
@@ -98,6 +99,22 @@ module Aws
       end
     end
 
+    def assume_role_web_identity_credentials(options)
+      if role_arn = ENV['AWS_ROLE_ARN'] &&
+        token_file = ENV['AWS_WEB_IDENTITY_TOKEN_FILE']
+        AssumeRoleWebIdentityCredentials.new(
+          role_arn: role_arn,
+          web_identity_token_file: token_file,
+          role_session_name: ENV['AWS_ROLE_SESSION_NAME']
+        )
+      elsif Aws.shared_config.config_enabled?
+        profile = options[:config].profile if options[:config]
+        Aws.shared_config.assume_role_web_identity_credentials_from_config(profile)
+      else
+        nil
+      end
+    end
+
     def instance_profile_credentials(options)
       if ENV["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"]
         ECSCredentials.new(options)

data/lib/aws-sdk-core/errors.rb

@@ -158,6 +158,18 @@ module Aws
       end
     end
 
+    # Raised when :web_identity_token_file parameter is not
+    # provided or the file doesn't exist when initializing
+    # AssumeRoleWebIdentityCredentials credential provider
+    class MissingWebIdentityTokenFile < RuntimeError
+      def initialize(*args)
+        msg = 'Missing :web_identity_token_file parameter or'\
+          ' invalid file path provided for'\
+          ' Aws::AssumeRoleWebIdentityCredentials provider'
+        super(msg)
+      end
+    end
+
     # Raised when a credentials provider process returns a JSON
     # payload with either invalid version number or malformed contents
     class InvalidProcessCredentialsPayload < RuntimeError; end

data/lib/aws-sdk-core/plugins/retry_errors.rb

@@ -94,6 +94,7 @@ A delay randomiser function used by the default backoff function. Some predefine
 
         NETWORKING_ERRORS = Set.new([
           'RequestTimeout', # s3
+          'IDPCommunicationError', # sts
         ])
 
         def initialize(error, http_status_code)

data/lib/aws-sdk-core/shared_config.rb

@@ -121,6 +121,25 @@ module Aws
       credentials
     end
 
+    def assume_role_web_identity_credentials_from_config(profile)
+      p = profile || @profile_name
+      if @config_enabled && @parsed_config
+        entry = @parsed_config.fetch(p, {})
+        if entry['web_identity_token_file'] &&
+          entry['role_arn']
+          AssumeRoleWebIdentityCredentials.new(
+            role_arn: entry['role_arn'],
+            web_identity_token_file: entry['web_identity_token_file'],
+            role_session_name: entry['role_session_name']
+          )
+        else
+          nil
+        end
+      else
+        nil
+      end
+    end
+
     def region(opts = {})
       p = opts[:profile] || @profile_name
       if @config_enabled

data/lib/aws-sdk-sts.rb

@@ -40,6 +40,6 @@ require_relative 'aws-sdk-sts/customizations'
 # @service
 module Aws::STS
 
-  GEM_VERSION = '3.57.0'
+  GEM_VERSION = '3.58.0'
 
 end

data/lib/aws-sdk-sts/client.rb

@@ -1734,7 +1734,7 @@ module Aws::STS
         params: params,
         config: config)
       context[:gem_name] = 'aws-sdk-core'
-      context[:gem_version] = '3.57.0'
+      context[:gem_version] = '3.58.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-core
 version: !ruby/object:Gem::Version
-  version: 3.57.0
+  version: 3.58.0
 platform: ruby
 authors:
 - Amazon Web Services
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-06-28 00:00:00.000000000 Z
+date: 2019-07-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jmespath
@@ -83,6 +83,7 @@ files:
 - ca-bundle.crt
 - lib/aws-sdk-core.rb
 - lib/aws-sdk-core/assume_role_credentials.rb
+- lib/aws-sdk-core/assume_role_web_identity_credentials.rb
 - lib/aws-sdk-core/async_client_stubs.rb
 - lib/aws-sdk-core/binary.rb
 - lib/aws-sdk-core/binary/decode_handler.rb