aws_assume_role 1.0.6-linux

data/lib/aws_assume_role/credentials/factories/default_chain_provider.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require_relative "includes"
+require_relative "../../logging"
+require_relative "../../profile_configuration"
+require_relative "abstract_factory"
+require_relative "environment"
+require_relative "repository"
+require_relative "instance_profile"
+require_relative "assume_role"
+require_relative "shared"
+require_relative "static"
+
+class AwsAssumeRole::Credentials::Factories::DefaultChainProvider < Dry::Struct
+    constructor_type :schema
+    include AwsAssumeRole::Credentials::Factories
+    include AwsAssumeRole::Logging
+
+    attribute :access_key_id, Dry::Types["strict.string"].optional
+    attribute :credentials, Dry::Types["object"].optional
+    attribute :duration_seconds, Dry::Types["coercible.int"].optional
+    attribute :external_id, Dry::Types["strict.string"].optional
+    attribute :instance_profile_credentials_retries, Dry::Types["strict.int"].default(0)
+    attribute :instance_profile_credentials_timeout, Dry::Types["coercible.float"].default(1.0)
+    attribute :mfa_serial, Dry::Types["strict.string"].optional
+    attribute :no_profile, Dry::Types["strict.bool"].default(false)
+    attribute :path, Dry::Types["strict.string"].optional
+    attribute :persist_session, Dry::Types["strict.bool"].default(true)
+    attribute :profile_name, Dry::Types["strict.string"].optional
+    attribute :profile, Dry::Types["strict.string"].optional
+    attribute :region, Dry::Types["strict.string"].optional
+    attribute :role_arn, Dry::Types["strict.string"].optional
+    attribute :role_session_name, Dry::Types["strict.string"].optional
+    attribute :secret_access_key, Dry::Types["strict.string"].optional
+    attribute :serial_number, Dry::Types["strict.string"].optional
+    attribute :session_token, Dry::Types["strict.string"].optional
+    attribute :source_profile, Dry::Types["strict.string"].optional
+    attribute :use_mfa, Dry::Types["strict.bool"].default(false)
+    attribute :yubikey_oath_name, Dry::Types["strict.string"].optional
+
+    def self.new(options)
+        if options.respond_to? :resolve
+            finalize_instance new_with_seahorse(options)
+        else
+            finalize_instance(options)
+        end
+    end
+
+    def self.finalize_instance(options)
+        new_opts = options.to_h
+        new_opts[:profile_name] ||= new_opts[:profile]
+        new_opts[:original_profile] = new_opts[:profile_name]
+        instance = allocate
+        instance.send(:initialize, new_opts)
+        instance
+    end
+
+    def self.new_with_seahorse(resolver)
+        keys = resolver.resolve
+        options = keys.map do |k|
+            [k, resolver.send(k)]
+        end
+        finalize_instance(options.to_h)
+    end
+
+    def resolve(nil_with_role_not_set: false, explicit_default_profile: false)
+        resolve_final_credentials(explicit_default_profile)
+        # nil_creds = Aws::Credentials.new(nil, nil, nil)
+        return nil if (nil_with_role_not_set &&
+                             @role_arn &&
+                             @credentials.credentials.session_token.nil?) || @credentials.nil?
+        @credentials
+    end
+
+    def to_h
+        to_hash
+    end
+
+    private
+
+    def resolve_final_credentials(explicit_default_profile = false)
+        resolve_credentials(:credential_provider, true, explicit_default_profile)
+        return @credentials if @credentials && @credentials.set? && !use_mfa && !role_arn
+        resolve_credentials(:second_factor_provider, true, explicit_default_profile)
+        return @credentials if @credentials && @credentials.set?
+        resolve_credentials(:instance_role_provider, true, explicit_default_profile)
+        return @credentials if @credentials && @credentials.set?
+        nil
+    end
+
+    def resolve_credentials(type, break_if_successful = false, explicit_default_profile = false)
+        factories_to_try = Repository.factories[type]
+        factories_to_try.each do |x|
+            options = to_h
+            options[:credentials] = credentials if credentials && credentials.set?
+            logger.debug "About to try credential lookup with #{x}"
+            factory = x.new(options)
+            @region ||= factory.region
+            @profile ||= factory.profile
+            @role_arn ||= factory.role_arn
+            next unless factory.credentials && factory.credentials.set?
+            logger.debug "Profile currently #{@profile}"
+            next if explicit_default_profile && (@profile == "default") && (@profile != @original_profile)
+            @credentials ||= factory.credentials
+            logger.debug "Got #{@credentials}"
+            break if break_if_successful
+        end
+    end
+end
+
+module AwsAssumeRole
+    DefaultProvider = AwsAssumeRole::Credentials::Factories::DefaultChainProvider
+end

data/lib/aws_assume_role/credentials/factories/environment.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require_relative "abstract_factory"
+
+class AwsAssumeRole::Credentials::Factories::Environment < AwsAssumeRole::Credentials::Factories::AbstractFactory
+    type :credential_provider
+    priority 10
+
+    def initialize(_options, **)
+        key =    %w[AWS_ACCESS_KEY_ID AMAZON_ACCESS_KEY_ID AWS_ACCESS_KEY]
+        secret = %w[AWS_SECRET_ACCESS_KEY AMAZON_SECRET_ACCESS_KEY AWS_SECRET_KEY]
+        token =  %w[AWS_SESSION_TOKEN AMAZON_SESSION_TOKEN]
+        region = %w[AWS_DEFAULT_REGION]
+        profile = %w[AWS_PROFILE]
+        @credentials = Aws::Credentials.new(envar(key), envar(secret), envar(token))
+        @region = envar(region)
+        @profile = envar(profile)
+    end
+
+    def envar(keys)
+        keys.each do |key|
+            return ENV[key] if ENV.key?(key)
+        end
+        nil
+    end
+end

data/lib/aws_assume_role/credentials/factories/includes.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require_relative "../includes"
+require_relative "../../logging"
+require_relative "../../vendored/aws"
+require_relative "../../../aws_assume_role"
+
+module AwsAssumeRole::Credentials
+    module Factories
+        Types = Dry::Types.module
+        include AwsAssumeRole
+        include AwsAssumeRole::Logging
+        include AwsAssumeRole::Vendored::Aws
+    end
+end

data/lib/aws_assume_role/credentials/factories/instance_profile.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require_relative "abstract_factory"
+
+class AwsAssumeRole::Credentials::Factories::InstanceProfile < AwsAssumeRole::Credentials::Factories::AbstractFactory
+    type :instance_role_provider
+    priority 40
+
+    def initialize(options = {})
+        options[:retries] ||= options[:instance_profile_credentials_retries] || 0
+        options[:http_open_timeout] ||= options[:instance_profile_credentials_timeout] || 1
+        options[:http_read_timeout] ||= options[:instance_profile_credentials_timeout] || 1
+        @credentials = if ENV["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"]
+                           Aws::ECSCredentials.new(options)
+                       else
+                           Aws::InstanceProfileCredentials.new(options)
+                       end
+    end
+end

data/lib/aws_assume_role/credentials/factories/repository.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require_relative "includes"
+require_relative "abstract_factory"
+
+class AwsAssumeRole::Credentials::Factories::Repository
+    include AwsAssumeRole::Credentials::Factories
+
+    SubFactoryRepositoryType = Types::Hash.schema(Types::Coercible::Int => Types::Strict::Array)
+
+    FactoryRepositoryType = Types::Hash.schema(
+        credential_provider: SubFactoryRepositoryType,
+        second_factor_provider: SubFactoryRepositoryType,
+        instance_role_provider: SubFactoryRepositoryType,
+    )
+
+    def self.factories
+        repository.keys.map { |t| [t, flatten_factory_type_list(t)] }.to_h
+    end
+
+    def self.repository
+        @repository ||= FactoryRepositoryType[
+            credential_provider: {},
+            second_factor_provider: {},
+            instance_role_provider: {},
+        ]
+    end
+
+    def self.register_factory(klass, type, priority)
+        repository[type][priority] ||= []
+        repository[type][priority] << klass
+    end
+
+    def self.flatten_factory_type_list(type)
+        repository[type].keys.sort.map { |x| @repository[type][x] }.flatten
+    end
+end

data/lib/aws_assume_role/credentials/factories/shared.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require_relative "abstract_factory"
+require_relative "../providers/shared_keyring_credentials"
+
+class AwsAssumeRole::Credentials::Factories::Shared < AwsAssumeRole::Credentials::Factories::AbstractFactory
+    type :credential_provider
+    priority 30
+
+    def initialize(options = {})
+        logger.debug "Shared Factory initiated with #{options}"
+        @profile = options[:profile]
+        @credentials = AwsAssumeRole::Credentials::Providers::SharedKeyringCredentials.new(options)
+        @region = @credentials.region
+        @role_arn = @credentials.role_arn
+    rescue Aws::Errors::NoSuchProfileError
+        nil
+    end
+end

data/lib/aws_assume_role/credentials/factories/static.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require_relative "abstract_factory"
+
+class AwsAssumeRole::Credentials::Factories::Static < AwsAssumeRole::Credentials::Factories::AbstractFactory
+    type :credential_provider
+    priority 0
+
+    def initialize(options = {})
+        @credentials = Aws::Credentials.new(
+            options[:access_key_id],
+            options[:secret_access_key],
+            options[:session_token],
+        )
+        @region = options[:region]
+        @profile = options[:profile]
+    end
+end

data/lib/aws_assume_role/credentials/factories.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require_relative "factories/repository"
+require_relative "factories/abstract_factory"
+require_relative "factories/default_chain_provider"
+require_relative "factories/assume_role"
+require_relative "factories/environment"
+require_relative "factories/instance_profile"
+require_relative "factories/shared_keyring"
+require_relative "factories/shared"
+require_relative "factories/static"

data/lib/aws_assume_role/credentials/includes.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+require_relative "../includes"
+module AwsAssumeRole
+    module Credentials end
+end

data/lib/aws_assume_role/credentials/providers/assume_role_credentials.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require_relative "includes"
+require "set"
+
+class AwsAssumeRole::Credentials::Providers::AssumeRoleCredentials
+    include AwsAssumeRole::Vendored::Aws::CredentialProvider
+    include AwsAssumeRole::Vendored::Aws::RefreshingCredentials
+
+    # @option options [required, String] :role_arn
+    # @option options [required, String] :role_session_name
+    # @option options [String] :policy
+    # @option options [Integer] :duration_seconds
+    # @option options [String] :external_id
+    # @option options [STS::Client] :client
+    #
+    #
+
+    STS_KEYS = %i[role_arn role_session_name policy duration_seconds external_id client credentials region].freeze
+
+    def initialize(options = {})
+        client_opts = {}
+        @assume_role_params = {}
+        options.each_pair do |key, value|
+            if self.class.assume_role_options.include?(key)
+                @assume_role_params[key] = value
+            else
+                next unless STS_KEYS.include?(key)
+                client_opts[key] = value
+            end
+        end
+        @client = client_opts[:client] || ::Aws::STS::Client.new(client_opts)
+        super
+    end
+
+    # @return [STS::Client]
+    attr_reader :client
+
+    private
+
+    def refresh
+        c = @client.assume_role(@assume_role_params).credentials
+        @credentials = ::Aws::Credentials.new(
+            c.access_key_id,
+            c.secret_access_key,
+            c.session_token,
+        )
+        @expiration = c.expiration
+    end
+
+    class << self
+      # @api private
+      def assume_role_options
+          @aro ||= begin
+              input = ::Aws::STS::Client.api.operation(:assume_role).input
+              Set.new(input.shape.member_names)
+          end
+      end
+      end
+end

data/lib/aws_assume_role/credentials/providers/includes.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+require_relative "../includes"
+require_relative "../../vendored/aws"
+require_relative "../../ui"
+require_relative "../../logging"
+module AwsAssumeRole::Credentials
+    module Providers end
+end

data/lib/aws_assume_role/credentials/providers/mfa_session_credentials.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+require_relative "includes"
+require_relative "../../types"
+require_relative "../../configuration"
+begin
+    require "smartcard"
+    require "yubioath"
+    SMARTCARD_SUPPORT = true
+rescue LoadError
+    SMARTCARD_SUPPORT = false
+end
+
+class AwsAssumeRole::Credentials::Providers::MfaSessionCredentials < Dry::Struct
+    constructor_type :schema
+    include AwsAssumeRole::Vendored::Aws::CredentialProvider
+    include AwsAssumeRole::Vendored::Aws::RefreshingCredentials
+    include AwsAssumeRole::Ui
+    include AwsAssumeRole::Logging
+
+    attribute :permanent_credentials, Dry::Types["object"].optional
+    attribute :credentials, Dry::Types["object"].optional
+    attribute :expiration, Dry::Types["strict.time"].default(Time.now)
+    attribute :first_time, Dry::Types["strict.bool"].default(true)
+    attribute :persist_session, Dry::Types["strict.bool"].default(true)
+    attribute :duration_seconds, Dry::Types["coercible.int"].default(3600)
+    attribute :region, AwsAssumeRole::Types::Region.optional
+    attribute :serial_number, AwsAssumeRole::Types::MfaSerial.optional.default("automatic")
+    attribute :yubikey_oath_name, Dry::Types["strict.string"].optional
+
+    def initialize(options)
+        options.each { |key, value| instance_variable_set("@#{key}", value) }
+        @permanent_credentials ||= @credentials
+        @credentials = nil
+        @serial_number = resolve_serial_number(serial_number)
+        AwsAssumeRole::Vendored::Aws::RefreshingCredentials.instance_method(:initialize).bind(self).call(options)
+    end
+
+    private
+
+    def keyring_username
+        @keyring_username ||= "#{@identity.to_json}|#{@serial_number}"
+    end
+
+    def sts_client
+        @sts_client ||= Aws::STS::Client.new(region: @region, credentials: @permanent_credentials)
+    end
+
+    def prompt_for_token
+        text = @first_time ? t("options.mfa_token.first_time") : t("options.mfa_token.other_times")
+        Ui.input.ask text
+    end
+
+    def initialized
+        @first_time = false
+    end
+
+    def refresh
+        return set_credentials_from_keyring if @persist_session && @first_time
+        refresh_using_mfa if near_expiration?
+        broadcast(:mfa_completed)
+    end
+
+    def retrieve_yubikey_token
+        raise t("options.mfa_token.smartcard_not_supported") unless SMARTCARD_SUPPORT
+        context = Smartcard::PCSC::Context.new
+        raise "Yubikey not found" unless context.readers.length == 1
+        reader_name = context.readers.first
+        card = Smartcard::PCSC::Card.new(context, reader_name, :shared)
+        codes = YubiOATH.new(card).calculate_all(timestamp: Time.now)
+        codes.fetch(BinData::String.new(@yubikey_oath_name))
+    end
+
+    def refresh_using_mfa
+        token_code = @yubikey_oath_name ? retrieve_yubikey_token : prompt_for_token
+        token = sts_client.get_session_token(
+            duration_seconds: @duration_seconds,
+            serial_number: @serial_number,
+            token_code: token_code,
+        )
+        initialized
+        instance_credentials token.credentials
+        persist_credentials if @persist_session
+    end
+
+    def credentials_from_keyring
+        @credentials_from_keyring ||= AwsAssumeRole::Store::Keyring.fetch keyring_username
+    rescue Aws::Errors::NoSuchProfileError
+        logger.debug "Key not found"
+        @credentials_from_keyring = nil
+        return nil
+    end
+
+    def persist_credentials
+        AwsAssumeRole::Store::Keyring.save_credentials keyring_username, @credentials, expiration: @expiration
+    end
+
+    def instance_credentials(credentials)
+        return unless credentials
+        @credentials = AwsAssumeRole::Store::Serialization.credentials_from_hash(credentials)
+        @expiration = credentials.respond_to?(:expiration) ? credentials.expiration : Time.parse(credentials[:expiration])
+    end
+
+    def set_credentials_from_keyring
+        instance_credentials credentials_from_keyring if credentials_from_keyring
+        initialized
+        refresh_using_mfa unless @credentials && !near_expiration?
+    end
+
+    def identity
+        @identity ||= sts_client.get_caller_identity
+    end
+
+    def resolve_serial_number(serial_number)
+        return serial_number unless serial_number.nil? || serial_number == "automatic"
+        user_name = identity.arn.split("/")[1]
+        "arn:aws:iam::#{identity.account}:mfa/#{user_name}"
+    end
+end

data/lib/aws_assume_role/credentials/providers/shared_keyring_credentials.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require_relative "includes"
+require_relative "../../types"
+
+class AwsAssumeRole::Credentials::Providers::SharedKeyringCredentials < ::Aws::SharedCredentials
+    include AwsAssumeRole::Logging
+    attr_reader :region, :role_arn
+
+    def initialize(options = {})
+        logger.debug "SharedKeyringCredentials initiated with #{options}"
+        @path = options[:path]
+        @path ||= AwsAssumeRole.shared_config.credentials_path
+        @profile_name = options[:profile_name] ||= options[:profile]
+        @profile_name ||= ENV["AWS_PROFILE"]
+        @profile_name ||= AwsAssumeRole.shared_config.profile_name
+        logger.debug "SharedKeyringCredentials resolved profile name #{@profile_name}"
+        config = determine_config(@path, @profile_name)
+        @role_arn = config.profile_hash(@profile_name)
+        @region = config.profile_region(@profile_name)
+        @role_arn = config.profile_role(@profile_name)
+        attempted_credential = config.credentials(options)
+        return unless attempted_credential && attempted_credential.set?
+        @credentials = attempted_credential
+    end
+
+    private
+
+    def determine_config(path, profile_name)
+        if path && path == AwsAssumeRole.shared_config.credentials_path
+            logger.debug "SharedKeyringCredentials found shared credential path"
+            AwsAssumeRole.shared_config
+        else
+            logger.debug "SharedKeyringCredentials found custom credential path"
+            AwsAssumeRole::Store::SharedConfigWithKeyring.new(
+                credentials_path: path,
+                profile_name: profile_name,
+            )
+        end
+    end
+end

data/lib/aws_assume_role/includes.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "i18n"
+require "active_support/json"
+require "active_support/core_ext/object/blank"
+require "active_support/core_ext/string/inflections"
+require "active_support/core_ext/hash/compact"
+require "active_support/core_ext/hash/keys"
+require "active_support/core_ext/hash/slice"
+require "aws-sdk"
+require "aws-sdk-core/ini_parser"
+require "dry-configurable"
+require "dry-struct"
+require "dry-validation"
+require "dry-types"
+require "English"
+require "gli"
+require "highline"
+require "inifile"
+require "json"
+require "keyring"
+require "launchy"
+require "logger"
+require "open-uri"
+require "pastel"
+require "securerandom"
+require "set"
+require "thread"
+require "time"
+
+module AwsAssumeRole
+    module_function
+
+    def shared_config
+        enabled = ENV["AWS_SDK_CONFIG_OPT_OUT"] ? false : true
+        @shared_config ||= SharedConfigWithKeyring.new(config_enabled: enabled)
+    end
+end

data/lib/aws_assume_role/logging.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require_relative "includes"
+require_relative "configuration"
+module AwsAssumeRole::Logging
+    module ClassMethods
+        def logger
+            @logger ||= begin
+                logger = Logger.new($stderr)
+                logger.level = AwsAssumeRole::Config.log_level
+                ENV["GLI_DEBUG"] = "true" if AwsAssumeRole::Config.log_level.zero?
+                logger
+            end
+        end
+    end
+
+    module InstanceMethods
+        def logger
+            self.class.logger
+        end
+    end
+
+    def self.included(base)
+        base.extend ClassMethods
+        base.include InstanceMethods
+    end
+end

data/lib/aws_assume_role/profile_configuration.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require_relative "includes"
+require_relative "logging"
+
+class AwsAssumeRole::ProfileConfiguration < Dry::Struct
+    constructor_type :schema
+    include AwsAssumeRole::Logging
+    attribute :access_key_id, Dry::Types["strict.string"].optional
+    attribute :credentials, Dry::Types["object"].optional
+    attribute :secret_access_key, Dry::Types["strict.string"].optional
+    attribute :session_token, Dry::Types["strict.string"].optional
+    attribute :duration_seconds, Dry::Types["coercible.int"].optional
+    attribute :external_id, Dry::Types["strict.string"].optional
+    attribute :path, Dry::Types["strict.string"].optional
+    attribute :persist_session, Dry::Types["strict.bool"].optional.default(true)
+    attribute :profile, Dry::Types["strict.string"].optional
+    attribute :region, Dry::Types["strict.string"].optional
+    attribute :role_arn, Dry::Types["strict.string"].optional
+    attribute :role_session_name, Dry::Types["strict.string"].optional
+    attribute :serial_number, Dry::Types["strict.string"].optional
+    attribute :mfa_serial, Dry::Types["strict.string"].optional
+    attribute :yubikey_oath_name, Dry::Types["strict.string"].optional
+    attribute :use_mfa, Dry::Types["strict.bool"].optional.default(false)
+    attribute :no_profile, Dry::Types["strict.bool"].optional.default(false)
+    attribute :shell_type, Dry::Types["strict.string"].optional
+    attribute :source_profile, Dry::Types["strict.string"].optional
+    attribute :args, Dry::Types["strict.array"].optional.default([])
+    attribute :instance_profile_credentials_retries, Dry::Types["strict.int"].default(0)
+    attribute :instance_profile_credentials_timeout, Dry::Types["coercible.float"].default(1.0)
+
+    attr_writer :credentials
+
+    def self.merge_mfa_variable(options)
+        new_hash = options.key?(:mfa_serial) ? options.merge(serial_number: options[:mfa_serial]) : options
+        new_hash[:use_mfa] ||= new_hash.fetch(:serial_number, nil) ? true : false
+        if new_hash.key?(:serial_number) && new_hash[:serial_number] == "automatic"
+            new_hash.delete(:serial_number)
+        end
+        new_hash
+    end
+
+    def self.new_from_cli(global_options, options, args)
+        options = global_options.merge options
+        options = options.map do |k, v|
+            [k.to_s.underscore.to_sym, v]
+        end.to_h
+        options[:args] = args
+        new merge_mfa_variable(options)
+    end
+
+    def self.new_from_credential_provider_initialization(options)
+        logger.debug "new_from_credential_provider_initialization with #{options.to_h}"
+        new_from_credential_provider(options, credentials: nil, delete: [])
+    end
+
+    def self.new_from_credential_provider(options = {}, credentials: nil, delete: [])
+        option_hash = options.to_h
+        config = option_hash.fetch(:config, {}).to_h
+        hash_to_merge = option_hash.merge config
+        hash_to_merge.merge(credentials: credentials) if credentials
+        delete.each do |k|
+            hash_to_merge.delete k
+        end
+        hash = merge_mfa_variable(hash_to_merge)
+        logger.debug "new_from_credential_provider with #{hash}"
+        new hash
+    end
+
+    def to_h
+        to_hash
+    end
+end