awsecrets 1.7.0 → 1.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6aa36c0c318ed589c8b39dbddc201dd41b0d834a
-  data.tar.gz: c8e27e1d1581142d600fbc48f6b9587e48a8cfb5
+  metadata.gz: 6c73c452155ea2f6e57b640272aed574718c74bc
+  data.tar.gz: 08928ae9c4c13605eb2834d0f57146062cf6e6ed
 SHA512:
-  metadata.gz: e40f0989187b3a11af86f96ac1f7e7e8ea9bbdf8a6d9c344cffa1bde961494f05f61b4ce5ab087b58ab31d76aec7864cb95d5cf047efdd8109950c0fa8adfd39
-  data.tar.gz: c4b93fd97b7e4f0cb541920a0e114218e1522303408262f2c31348ad258f7c0d26c43165b85e7c7976fe6b2acd67f1e84f2e0d50af2c71fd40cdc4c3440b60b3
+  metadata.gz: b36140f7f891eb7d4578fb434cd44c43de090305621668eb9eabf2b811d85f4fe2708c3536926ae62c1d6210898be35f35489bb5c7c663518a6a1ee02a5e2015
+  data.tar.gz: 1ea947503859e54e0c7bfe3b4214164b4768cedbb0e8b992762cc793a558a5c3d703280a41c396dd8d4a5532ee79f036d04d3ee85ad3ceb3ab0f025ed8e662db

data/README.md

@@ -59,6 +59,53 @@ EOF
 $ ec2sample i-1aa1aaaa
 ```
 
+### Use AssumeRole
+
+Support `role_arn` `role_session_name` `source_profile`.
+
+#### 1. .aws/config and .aws/credentials
+
+see http://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html
+
+```
+# .aws/config
+[profile assumed]
+role_arn = arn:aws:iam::123456780912:role/assumed-role
+role_session_name = awsecrets-assume-role
+source_profile = assume_test
+```
+
+```
+# .aws/credentials
+[assume_test]
+aws_access_key_id = XXXXXXXXXXXXXXXXXXXX
+aws_secret_access_key = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+```
+
+And execute
+
+```sh
+$ ec2sample i-1aa1aaaa --profile assumed --region ap-northeast-1
+```
+
+#### 2. secrets.yml
+
+```sh
+$ cat <<EOF > secrets.yml
+region: ap-northeast-1
+aws_access_key_id: XXXXXXXXXXXXXXXXXXXX
+aws_secret_access_key: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+role_arn = arn:aws:iam::123456780912:role/assumed-role
+role_session_name = awsecrets-assume-role
+```
+
+And execute
+
+```sh
+$ ec2sample i-1aa1aaaa
+```
+
+
 ## Contributing
 
 1. Fork it ( https://github.com/k1LoW/awsecrets/fork )

data/lib/awsecrets/version.rb

@@ -1,3 +1,3 @@
 module Awsecrets
-  VERSION = '1.7.0'
+  VERSION = '1.8.0'
 end

data/lib/awsecrets.rb

@@ -7,9 +7,9 @@ require 'yaml'
 module Awsecrets
   def self.load(profile: nil, region: nil, secrets_path: 'secrets.yml')
     @profile = profile
-    @secrets_path = secrets_path
     @region = region
-    @credentials = nil
+    @secrets_path = secrets_path
+    @credentials = @access_key_id = @secret_access_key = @session_token = @role_arn = @source_profile = nil
 
     # 1. Command Line Options
     load_options if load_method_args
@@ -22,74 +22,105 @@ module Awsecrets
     # 5. The CLI configuration file
     load_config
 
-    Aws.config[:region] = @region
-    Aws.config[:credentials] = @credentials
+    set_aws_config
   end
 
   def self.load_method_args
     return false unless @profile
-    @region = AWSConfig[@profile]['region'] if AWSConfig[@profile]['region'] && @region.nil?
-    @credentials = Aws::SharedCredentials.new(profile_name: @profile)
+    @region ||= AWSConfig[@profile]['region'] if AWSConfig[@profile]['region']
     true
   end
 
   def self.load_options
     opt = OptionParser.new
-    opt.on('--profile PROFILE') { |v| @profile = v } unless @profile
-    opt.on('--region REGION') { |v| @region = v } unless @region
-    opt.on('--secrets_path SECRETS_PATH') { |v| @secrets_path = v } unless @secrets_path
+    opt.on('--profile PROFILE') { |v| @profile ||= v }
+    opt.on('--region REGION') { |v| @region ||= v }
+    opt.on('--secrets_path SECRETS_PATH') { |v| @secrets_path ||= v }
     begin
       opt.parse!(ARGV)
     rescue OptionParser::InvalidOption
     end
     return unless @profile
-    @region = AWSConfig[@profile]['region'] if AWSConfig[@profile]['region'] && @region.nil?
-    @credentials = Aws::SharedCredentials.new(profile_name: @profile)
+    @region ||= AWSConfig[@profile]['region']
   end
 
   def self.load_env
-    @region = ENV['AWS_REGION'] unless @region
-    @region = ENV['AWS_DEFAULT_REGION'] unless @region
-    if @credentials.nil? && ENV['AWS_PROFILE']
-      @credentials = Aws::SharedCredentials.new(profile_name: ENV['AWS_PROFILE'])
-      @profile = ENV['AWS_PROFILE']
-    end
-    return unless @credentials.nil? && ENV['AWS_ACCESS_KEY_ID'] && ENV['AWS_SECRET_ACCESS_KEY']
-    @credentials = Aws::Credentials.new(
-      ENV['AWS_ACCESS_KEY_ID'],
-      ENV['AWS_SECRET_ACCESS_KEY'],
-      ENV['AWS_SESSION_TOKEN'] # Not necessary
-    )
+    @region ||= ENV['AWS_REGION']
+    @region ||= ENV['AWS_DEFAULT_REGION']
+    @profile ||= ENV['AWS_PROFILE']
+    return if @access_key_id
+    return unless ENV['AWS_ACCESS_KEY_ID'] && ENV['AWS_SECRET_ACCESS_KEY']
+    @access_key_id ||= ENV['AWS_ACCESS_KEY_ID']
+    @secret_access_key ||= ENV['AWS_SECRET_ACCESS_KEY']
+    @session_token ||= ENV['AWS_SESSION_TOKEN']
   end
 
   def self.load_yaml
     creds = YAML.load_file(@secrets_path) if File.exist?(@secrets_path)
-    if @region.nil? && creds
-      @region = creds['region'] if creds.include?('region')
-    end
-    return unless @credentials.nil? && creds &&
+    @region ||= creds['region'] if creds && creds.include?('region')
+    return if @access_key_id
+    return unless creds &&
                   creds.include?('aws_access_key_id') &&
                   creds.include?('aws_secret_access_key')
-    session_token = nil
-    session_token = creds['aws_session_token'] if creds.include?('aws_session_token')
-    @credentials = Aws::Credentials.new(
-      creds['aws_access_key_id'],
-      creds['aws_secret_access_key'],
-      session_token
+    @access_key_id ||= creds['aws_access_key_id']
+    @secret_access_key ||= creds['aws_secret_access_key']
+    @session_token ||= creds['aws_session_token'] if creds.include?('aws_session_token')
+    @role_arn ||= creds['role_arn'] if creds.include?('role_arn')
+    @role_session_name ||= creds['role_session_name'] if creds.include?('role_session_name')
+    return unless @role_arn && @role_session_name
+    @credentials ||= Aws::AssumeRoleCredentials.new(
+      client: Aws::STS::Client.new(
+        region: @region,
+        credentials: Aws::SharedCredentials.new(
+          region: @region,
+          access_key_id: @access_key_id,
+          secret_access_key: @secret_access_key
+        )
+      ),
+      role_arn: @role_arn,
+      role_session_name: @role_session_name
     )
   end
 
   def self.load_creds
-    return unless @credentials.nil?
-    @credentials = Aws::SharedCredentials.new(profile_name: nil)
   end
 
   def self.load_config
-    return unless @region.nil?
-    @region = if AWSConfig[@profile] && AWSConfig[@profile]['region']
-                AWSConfig[@profile]['region']
-              else
-                AWSConfig['default']['region']
-              end
+    @region ||= if AWSConfig[@profile] && AWSConfig[@profile]['region']
+                  AWSConfig[@profile]['region']
+                else
+                  AWSConfig['default']['region']
+                end
+
+    @role_arn ||= AWSConfig[@profile]['role_arn'] if AWSConfig[@profile]
+    @role_session_name ||= AWSConfig[@profile]['role_session_name'] if AWSConfig[@profile]
+    @source_profile ||= AWSConfig[@profile]['source_profile'] if AWSConfig[@profile]
+  end
+
+  def self.set_aws_config
+    Aws.config[:region] = @region
+
+    if @role_arn && @role_session_name && @source_profile
+      region = if AWSConfig[@source_profile.name] && AWSConfig[@source_profile.name]['region']
+                 AWSConfig[@source_profile.name]['region']
+               else
+                 AWSConfig['default']['region']
+               end
+
+      @credentials ||= Aws::AssumeRoleCredentials.new(
+        client: Aws::STS::Client.new(
+          region: region,
+          credentials: Aws::SharedCredentials.new(profile_name: @source_profile.name)
+        ),
+        role_arn: @role_arn,
+        role_session_name: @role_session_name
+      )
+    end
+
+    @credentials ||= Aws::SharedCredentials.new(profile_name: @profile) if @profile
+    @credentials ||= Aws::SharedCredentials.new(profile_name: 'default') unless @access_key_id
+    @credentials ||= Aws::Credentials.new(@access_key_id, @secret_access_key, @session_token)
+
+    Aws.config[:credentials] = @credentials
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: awsecrets
 version: !ruby/object:Gem::Version
-  version: 1.7.0
+  version: 1.8.0
 platform: ruby
 authors:
 - k1LoW
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-01-05 00:00:00.000000000 Z
+date: 2017-01-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk