aws_assume_role 0.0.3 → 0.1.0

data/lib/aws_assume_role/profile.rb

@@ -1,203 +0,0 @@
-require 'keyring'
-
-module AWSAssumeRole
-
-    # Base Profile superclass
-    class Profile
-
-        include Logging
-
-        # Class methods for dispatch to individual Profile strategy
-
-        @implementations = {}
-        @named_profiles  = {}
-        @config_file     = '-'
-
-        class << self
-
-            attr_accessor :implementations
-            attr_accessor :named_profiles
-            attr_accessor :config_file
-
-        end
-
-        def self.register_implementation(type, impl)
-            logger.info('Registering implementation ' \
-                        "for type '#{type}': #{impl}")
-            AWSAssumeRole::Profile.implementations[type] = impl
-        end
-
-        def self.load_profiles
-            Dir.glob(
-                File.expand_path('profile/*.rb', File.dirname(__FILE__)),
-            ).each do |profile_class|
-                require profile_class
-            end
-        end
-
-        def self.create(name, options)
-
-            options['type'] = 'basic' unless options.key?('type')
-
-            if implementations.key?(options['type'])
-                logger.info("Creating profile '#{name}' "\
-                            "with type #{options['type']}")
-                i = implementations[options['type']].new(name, options)
-                named_profiles[name] = i
-                return i
-            end
-
-            STDERR.puts 'No implementation for profiles of type '\
-                "'#{options['type']}'"
-            exit -1 # rubocop:disable Lint/AmbiguousOperator
-
-        end
-
-        def self.get_by_name(name)
-            unless named_profiles.key?(name)
-                STDERR.puts "No profile '#{name}' found"
-                exit -1 # rubocop:disable Lint/AmbiguousOperator
-            end
-            named_profiles[name]
-        end
-
-        def self.load_config_file(config_path)
-            @config_file = config_path
-            logger.info("Loading configuration from #{config_path}")
-            parse_config(File.open(config_path))
-        end
-
-        def self.parse_config(yaml)
-
-            require 'yaml'
-
-            profiles = YAML.load(yaml)
-            profiles.each do |name, options|
-                options['config_file'] = config_file
-                options['name']        = name
-                AWSAssumeRole::Profile.create(name, options)
-            end
-
-        end
-
-        # Superclass for Profile strategies
-
-        def set_env(prefix = '') # rubocop:disable Style/AccessorMethodName
-
-            logger.info("Setting environment with prefix '#{prefix}'")
-
-            ENV["#{prefix}AWS_ACCESS_KEY_ID"]     = access_key_id
-            ENV["#{prefix}AWS_SECRET_ACCESS_KEY"] = secret_access_key
-            ENV["#{prefix}AWS_DEFAULT_REGION"]    = region
-
-            return unless respond_to?(:session_token)
-
-            logger.info(':session_token available, setting environment')
-            ENV["#{prefix}AWS_SESSION_TOKEN"] = session_token
-
-        end
-
-        def access_key_id
-            raise NotImplementedError
-        end
-
-        def secret_access_key
-            raise NotImplementedError
-        end
-
-        def region
-            raise NotImplementedError
-        end
-
-        def sts_client
-            raise NotImplementedError
-        end
-
-        attr_reader :name
-
-        def use
-            raise NotImplementedError
-        end
-
-        def add
-            raise NotImplementedError
-        end
-
-        def remove
-            raise NotImplementedError
-        end
-
-        def token_code
-            puts "Enter your MFA's time-based one time password: "
-            token_code = STDIN.gets
-            token_code.chomp!
-        end
-
-        def keyring_key
-            "#{@options['config_file']}|#{@options['name']}"
-        end
-
-        def session(duration = 3600)
-
-            # See if we already have a non-expired session cached in this
-            # object.
-
-            unless @session.nil?
-
-                logger.info('Found session cached in object')
-                return @session unless @session.expired?
-                logger.info('Session expired, deleting keyring key '\
-                            "'#{keyring_key}'")
-                @session.delete_from_keyring(keyring_key)
-
-            end
-
-            # See if there's a non-exipred session cached in the keyring
-
-            @session = AWSAssumeRole::Credentials.load_from_keyring(keyring_key)
-
-            unless @session.nil?
-
-                logger.info("Found session in keyring for '#{keyring_key}'")
-                return @session unless @session.expired?
-                logger.info('Session expired, deleting keyring key '\
-                            "'#{keyring_key}'")
-                @session.delete_from_keyring(keyring_key)
-
-            end
-
-            begin
-                identity  = sts_client.get_caller_identity
-            rescue Aws::Errors::MissingCredentialsError
-                STDERR.puts "No credentials found. Set one in the credentials file "\
-                     "or environment."
-                exit -1 # rubocop:disable Lint/AmbiguousOperator
-            end
-            user_name = identity.arn.split('/')[1]
-            mfa_arn   = "arn:aws:iam::#{identity.account}:mfa/#{user_name}"
-
-            mfa_token_code = token_code
-
-            begin
-                session = sts_client.get_session_token(
-                    duration_seconds: duration,
-                    serial_number:    mfa_arn,
-                    token_code:       mfa_token_code,
-                )
-            rescue Aws::STS::Errors::AccessDenied
-                STDERR.puts 'MultiFactorAuthentication failed with invalid MFA ' \
-                            'one time pass code.'
-                exit -1 # rubocop:disable Lint/AmbiguousOperator
-            end
-
-            @session = Credentials.create_from_sdk(session.credentials)
-            logger.info("Storing session in keyring '#{keyring_key}'")
-            @session.store_in_keyring(keyring_key)
-
-            @session
-
-        end
-
-    end
-
-end

data/lib/aws_assume_role/profile/assume_role.rb

@@ -1,127 +0,0 @@
-# AWSAssumeRole
-module AWSAssumeRole
-
-    class Profile
-
-        # A Profile implementation for assuming roles using STS
-        class AssumeRole < Profile
-
-            include Logging
-
-            register_implementation('assume_role', self)
-
-            @sts_client = nil
-            @role       = nil
-            @options    = nil
-            @name       = nil
-
-            def default_options
-                {
-                    'parent'   => 'default',
-                    'duration' => 3600,
-                }
-            end
-
-            def initialize(name, options = {})
-
-                require 'aws-sdk'
-
-                @options = default_options.merge(options)
-                @name    = name
-
-            end
-
-            def sts_client
-
-                return @sts_client unless @sts_client.nil?
-
-                parent = AWSAssumeRole::Profile.get_by_name(@options['parent'])
-
-                @sts_client = Aws::STS::Client.new(
-                    access_key_id:     parent.session.access_key_id,
-                    secret_access_key: parent.session.secret_access_key,
-                    session_token:     parent.session.session_token,
-                )
-
-                @sts_client
-
-            rescue Aws::Errors::MissingRegionError
-
-                STDERR.puts 'No region was given. \
-                    Set one in the credentials file or environment'
-                exit -1 # rubocop:disable Lint/AmbiguousOperator
-
-            end
-
-            def role_credentials
-
-                # Check for non-expired session cached here
-
-                unless @role_credentials.nil?
-
-                    return @role_credentials unless @role_credentials.expired?
-                    @role_credentials.delete_from_keyring(keyring_key)
-
-                end
-
-                # See if here's a non-exipred session in the keyring
-
-                @role_credentials = Credentials.load_from_keyring(keyring_key)
-
-                unless @role_credentials.nil?
-
-                    return @role_credentials unless @role_credentials.expired?
-                    @role_credentials.delete_from_keyring(keyring_key)
-
-                end
-
-                role = sts_client.assume_role(
-                    role_arn:          @options['role_arn'],
-                    role_session_name: name, # use something else?
-                    duration_seconds:  @options['duration'],
-                )
-
-                @role_credentials =
-                    Credentials.create_from_sdk(role.credentials)
-
-                @role_credentials.store_in_keyring(keyring_key)
-
-                @role_credentials
-
-            end
-
-            def access_key_id
-                role_credentials.access_key_id
-            end
-
-            def secret_access_key
-                role_credentials.secret_access_key
-            end
-
-            def session_token
-                role_credentials.session_token
-            end
-
-            def region
-                @options['region']
-            end
-
-            def use
-                set_env if @options['set_environment']
-            end
-
-            def remove
-                Credentials.new({}).delete_from_keyring(keyring_key)
-            end
-
-            def add
-                STDERR.puts "You can't add credentials to an assume_role "\
-                    'just basic/parent accounts.'
-                exit -1 # rubocop:disable Lint/AmbiguousOperator
-            end
-
-        end
-
-    end
-
-end

data/lib/aws_assume_role/profile/basic.rb

@@ -1,152 +0,0 @@
-# AWSAssumeRole
-module AWSAssumeRole
-
-    class Profile
-
-        # Profile implementation which takes credentials from either
-        # passed options, from the environment, or from .aws/credentials
-        # file (per the standard behaviour of Aws::STS::Client)
-        class Basic < Profile
-
-            include Logging
-
-            register_implementation('basic', self)
-
-            @sts_client = nil
-            @options    = nil
-            @name       = nil
-
-            def initialize(name, options = {})
-
-                require 'aws-sdk'
-
-                @options = options
-                @name    = name
-
-            end
-
-            def sts_client
-                logger.debug("Calling STS client")
-
-                return @sts_client unless @sts_client.nil?
-
-                if @options.key?('profile')
-
-                    logger.info("Loading profile #{@options['profile']} from ~/.aws/credentials")
-                    # Attempt to load with profile name suplied
-                    @sts_client = Aws::STS::Client.new(
-                        profile: @options['profile'],
-                    )
-
-                elsif access_key_id && secret_access_key
-
-                    logger.debug("Access Key: #{access_key_id}")
-                    logger.debug("Secret Key: #{secret_access_key}")
-                    logger.debug("Region: #{region}")
-
-                    @sts_client = Aws::STS::Client.new(
-                        access_key_id:     access_key_id,
-                        secret_access_key: secret_access_key,
-                        region:            region,
-                    )
-
-                else
-
-                    @sts_client = Aws::STS::Client.new
-
-                end
-
-                @sts_client
-
-            rescue Aws::Errors::MissingRegionError
-
-                STDERR.puts 'No region was given. \
-                    Set one in the credentials file or environment'
-                exit -1 # rubocop:disable Lint/AmbiguousOperator
-
-            end
-
-            def basic_credentials
-                logger.debug("Loading basic credentials")
-                # Check for profile creds in keyring first
-                @basic_credentials = Credentials.load_from_keyring("#{keyring_key}|basic")
-
-                return @basic_credentials unless @basic_credentials.nil?
-
-                creds = {
-                    :access_key_id     => ENV['AWS_ACCESS_KEY_ID'],
-                    :secret_access_key => ENV['AWS_SECRET_ACCESS_KEY'],
-                }
-
-                if creds[:access_key_id].nil? or creds[:secret_access_key].nil?
-                    STDERR.puts 'No AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY ' \
-                                'found in the environment.'
-                    exit -1 # rubocop:disable Lint/AmbiguousOperator
-                end
-
-                unless @options['region'].nil?
-                    creds[:region] = @options['region']
-                else
-                    creds[:region] = ENV['AWS_DEFAULT_REGION']
-                end
-
-                @basic_credentials = AWSAssumeRole::Credentials.new(creds)
-
-                @basic_credentials
-            end
-
-            def access_key_id
-                @options['access_key_id'] || basic_credentials.access_key_id
-            end
-
-            def secret_access_key
-                @options['secret_access_key'] || basic_credentials.secret_access_key
-            end
-
-            def region
-                @options['region'] || basic_credentials.region
-            end
-
-            def remove
-                Credentials.new({}).delete_from_keyring(keyring_key)
-                Credentials.new({}).delete_from_keyring("#{keyring_key}|basic")
-            end
-
-            def add
-                if @options['profile']
-                    puts "WARNING: Storing credentials but a profile is specified and used for #{@name}"
-                end
-                if @options['access_key_id'] or @options['secret_access_key']
-                    puts "WARNING: Storing credentials but they are specified in config for #{@name}"
-                end
-
-                @basic_credentials = Credentials.load_from_keyring("#{keyring_key}|basic")
-                new_creds = get_credentials
-                @basic_credentials.delete_from_keyring(keyring_key) unless @basic_credentials.nil?
-                @basic_credentials = AWSAssumeRole::Credentials.new(new_creds)
-                @basic_credentials.store_in_keyring("#{keyring_key}|basic")
-            end
-
-            def get_credentials
-                puts "Enter your AWS_ACCESS_KEY_ID: "
-                id = STDIN.gets
-                id.chomp!
-                puts "Enter your AWS_SECRET_ACCESS_KEY: "
-                secret = STDIN.gets
-                secret.chomp!
-                puts "Enter a AWS Region:"
-                region = STDIN.gets
-                region.chomp!
-
-                creds = {
-                    :access_key_id     => id,
-                    :secret_access_key => secret,
-                    :region            => region,
-                }
-                creds
-            end
-        end
-
-    end
-
-end