cfndk 0.0.1 → 0.0.2
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/bin/cfndk +1 -1
- data/lib/cfndk.rb +1 -1
- data/lib/cfndk/credential_provider_chain.rb +113 -0
- data/lib/cfndk/version.rb +1 -1
- metadata +2 -2
- data/lib/cfndk/aws/credential_provider_chain.rb +0 -115
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: dddd69205f95f5871c77ab744edfa46723ec66c6
|
4
|
+
data.tar.gz: 156d7878eb40e490faaa63ee5a1f2db4b737629c
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 32f60b2829d35017e6fbea00d41ad4cd0637572b01b32f9892d7a47a29350fbf339b4ea054b23f002cf38b3765e89801e1af3572b6fc12d285a6925d28928d0a
|
7
|
+
data.tar.gz: 3ca54f445be5345cb62f0873a3cd8e2638bafad5dc2e0bbc25f36425e4d1457675e4ad5b78703af19aa47ff9aeca430d08b4f1989771b69756b76e599a0d0215
|
data/bin/cfndk
CHANGED
@@ -79,7 +79,7 @@ $LOAD_PATH.unshift File.dirname(__FILE__) + '/../lib'
|
|
79
79
|
|
80
80
|
data = open(option[:config_path], 'r') { |f| YAML.load(f) } if File.file?(option[:config_path]) && ARGV[0] != 'init'
|
81
81
|
|
82
|
-
credentials = CFnDK::
|
82
|
+
credentials = CFnDK::CredentialProviderChain.new.resolve
|
83
83
|
client = Aws::CloudFormation::Client.new(credentials: credentials)
|
84
84
|
stacks = CFnDK::Stacks.new(data, option, client)
|
85
85
|
|
data/lib/cfndk.rb
CHANGED
@@ -0,0 +1,113 @@
|
|
1
|
+
module CFnDK
|
2
|
+
class CredentialProviderChain
|
3
|
+
def initialize(config = nil)
|
4
|
+
@config = config
|
5
|
+
end
|
6
|
+
|
7
|
+
def resolve
|
8
|
+
providers.each do |method_name, options|
|
9
|
+
provider = send(method_name, options.merge(config: @config))
|
10
|
+
return provider if provider && provider.set?
|
11
|
+
end
|
12
|
+
nil
|
13
|
+
end
|
14
|
+
|
15
|
+
private
|
16
|
+
|
17
|
+
def providers
|
18
|
+
[
|
19
|
+
[:static_credentials, {}],
|
20
|
+
[:env_credentials, {}],
|
21
|
+
[:assume_role_credentials, {}],
|
22
|
+
[:shared_credentials, {}],
|
23
|
+
[:process_credentials, {}],
|
24
|
+
[:instance_profile_credentials, {
|
25
|
+
retries: @config ? @config.instance_profile_credentials_retries : 0,
|
26
|
+
http_open_timeout: @config ? @config.instance_profile_credentials_timeout : 1,
|
27
|
+
http_read_timeout: @config ? @config.instance_profile_credentials_timeout : 1,
|
28
|
+
}],
|
29
|
+
]
|
30
|
+
end
|
31
|
+
|
32
|
+
def static_credentials(options)
|
33
|
+
if options[:config]
|
34
|
+
::Aws::Credentials.new(
|
35
|
+
options[:config].access_key_id,
|
36
|
+
options[:config].secret_access_key,
|
37
|
+
options[:config].session_token)
|
38
|
+
else
|
39
|
+
nil
|
40
|
+
end
|
41
|
+
end
|
42
|
+
|
43
|
+
def env_credentials(options)
|
44
|
+
key = %w(AWS_ACCESS_KEY_ID AMAZON_ACCESS_KEY_ID AWS_ACCESS_KEY)
|
45
|
+
secret = %w(AWS_SECRET_ACCESS_KEY AMAZON_SECRET_ACCESS_KEY AWS_SECRET_KEY)
|
46
|
+
token = %w(AWS_SESSION_TOKEN AMAZON_SESSION_TOKEN)
|
47
|
+
::Aws::Credentials.new(envar(key), envar(secret), envar(token))
|
48
|
+
end
|
49
|
+
|
50
|
+
def envar(keys)
|
51
|
+
keys.each do |key|
|
52
|
+
return ENV[key] if ENV.key?(key)
|
53
|
+
end
|
54
|
+
nil
|
55
|
+
end
|
56
|
+
|
57
|
+
def shared_credentials(options)
|
58
|
+
if options[:config]
|
59
|
+
::Aws::SharedCredentials.new(profile_name: options[:config].profile)
|
60
|
+
else
|
61
|
+
::Aws::SharedCredentials.new(
|
62
|
+
profile_name: ENV['AWS_PROFILE'].nil? ? 'default' : ENV['AWS_PROFILE'])
|
63
|
+
end
|
64
|
+
rescue ::Aws::Errors::NoSuchProfileError
|
65
|
+
nil
|
66
|
+
end
|
67
|
+
|
68
|
+
def process_credentials(options)
|
69
|
+
profile_name = options[:config].profile if options[:config]
|
70
|
+
profile_name ||= ENV['AWS_PROFILE'].nil? ? 'default' : ENV['AWS_PROFILE']
|
71
|
+
|
72
|
+
config = ::Aws.shared_config
|
73
|
+
if config.config_enabled? && process_provider = config.credentials_process(profile_name)
|
74
|
+
::Aws::ProcessCredentials.new(process_provider)
|
75
|
+
else
|
76
|
+
nil
|
77
|
+
end
|
78
|
+
rescue ::Aws::Errors::NoSuchProfileError
|
79
|
+
nil
|
80
|
+
end
|
81
|
+
|
82
|
+
def assume_role_credentials(options)
|
83
|
+
if ::Aws.shared_config.config_enabled?
|
84
|
+
profile = nil
|
85
|
+
region = nil
|
86
|
+
if options[:config]
|
87
|
+
profile = options[:config].profile
|
88
|
+
region = options[:config].region
|
89
|
+
assume_role_with_profile(options[:config].profile, options[:config].region)
|
90
|
+
end
|
91
|
+
assume_role_with_profile(profile, region)
|
92
|
+
else
|
93
|
+
nil
|
94
|
+
end
|
95
|
+
end
|
96
|
+
|
97
|
+
def instance_profile_credentials(options)
|
98
|
+
if ENV['AWS_CONTAINER_CREDENTIALS_RELATIVE_URI']
|
99
|
+
::Aws::ECSCredentials.new(options)
|
100
|
+
else
|
101
|
+
::Aws::InstanceProfileCredentials.new(options)
|
102
|
+
end
|
103
|
+
end
|
104
|
+
|
105
|
+
def assume_role_with_profile(prof, region)
|
106
|
+
::Aws.shared_config.assume_role_credentials_from_config(
|
107
|
+
profile: prof,
|
108
|
+
region: region,
|
109
|
+
chain_config: @config
|
110
|
+
)
|
111
|
+
end
|
112
|
+
end
|
113
|
+
end
|
data/lib/cfndk/version.rb
CHANGED
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: cfndk
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.0.
|
4
|
+
version: 0.0.2
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Yoshihisa AMAKATA
|
@@ -112,7 +112,7 @@ files:
|
|
112
112
|
- bin/cfndk
|
113
113
|
- cfndk.gemspec
|
114
114
|
- lib/cfndk.rb
|
115
|
-
- lib/cfndk/
|
115
|
+
- lib/cfndk/credential_provider_chain.rb
|
116
116
|
- lib/cfndk/parameter_string.rb
|
117
117
|
- lib/cfndk/stack.rb
|
118
118
|
- lib/cfndk/stacks.rb
|
@@ -1,115 +0,0 @@
|
|
1
|
-
module CFnDK
|
2
|
-
module Aws
|
3
|
-
class CredentialProviderChain
|
4
|
-
def initialize(config = nil)
|
5
|
-
@config = config
|
6
|
-
end
|
7
|
-
|
8
|
-
def resolve
|
9
|
-
providers.each do |method_name, options|
|
10
|
-
provider = send(method_name, options.merge(config: @config))
|
11
|
-
return provider if provider && provider.set?
|
12
|
-
end
|
13
|
-
nil
|
14
|
-
end
|
15
|
-
|
16
|
-
private
|
17
|
-
|
18
|
-
def providers
|
19
|
-
[
|
20
|
-
[:static_credentials, {}],
|
21
|
-
[:env_credentials, {}],
|
22
|
-
[:assume_role_credentials, {}],
|
23
|
-
[:shared_credentials, {}],
|
24
|
-
[:process_credentials, {}],
|
25
|
-
[:instance_profile_credentials, {
|
26
|
-
retries: @config ? @config.instance_profile_credentials_retries : 0,
|
27
|
-
http_open_timeout: @config ? @config.instance_profile_credentials_timeout : 1,
|
28
|
-
http_read_timeout: @config ? @config.instance_profile_credentials_timeout : 1,
|
29
|
-
}],
|
30
|
-
]
|
31
|
-
end
|
32
|
-
|
33
|
-
def static_credentials(options)
|
34
|
-
if options[:config]
|
35
|
-
::Aws::Credentials.new(
|
36
|
-
options[:config].access_key_id,
|
37
|
-
options[:config].secret_access_key,
|
38
|
-
options[:config].session_token)
|
39
|
-
else
|
40
|
-
nil
|
41
|
-
end
|
42
|
-
end
|
43
|
-
|
44
|
-
def env_credentials(options)
|
45
|
-
key = %w(AWS_ACCESS_KEY_ID AMAZON_ACCESS_KEY_ID AWS_ACCESS_KEY)
|
46
|
-
secret = %w(AWS_SECRET_ACCESS_KEY AMAZON_SECRET_ACCESS_KEY AWS_SECRET_KEY)
|
47
|
-
token = %w(AWS_SESSION_TOKEN AMAZON_SESSION_TOKEN)
|
48
|
-
::Aws::Credentials.new(envar(key), envar(secret), envar(token))
|
49
|
-
end
|
50
|
-
|
51
|
-
def envar(keys)
|
52
|
-
keys.each do |key|
|
53
|
-
return ENV[key] if ENV.key?(key)
|
54
|
-
end
|
55
|
-
nil
|
56
|
-
end
|
57
|
-
|
58
|
-
def shared_credentials(options)
|
59
|
-
if options[:config]
|
60
|
-
::Aws::SharedCredentials.new(profile_name: options[:config].profile)
|
61
|
-
else
|
62
|
-
::Aws::SharedCredentials.new(
|
63
|
-
profile_name: ENV['AWS_PROFILE'].nil? ? 'default' : ENV['AWS_PROFILE'])
|
64
|
-
end
|
65
|
-
rescue ::Aws::Errors::NoSuchProfileError
|
66
|
-
nil
|
67
|
-
end
|
68
|
-
|
69
|
-
def process_credentials(options)
|
70
|
-
profile_name = options[:config].profile if options[:config]
|
71
|
-
profile_name ||= ENV['AWS_PROFILE'].nil? ? 'default' : ENV['AWS_PROFILE']
|
72
|
-
|
73
|
-
config = ::Aws.shared_config
|
74
|
-
if config.config_enabled? && process_provider = config.credentials_process(profile_name)
|
75
|
-
::Aws::ProcessCredentials.new(process_provider)
|
76
|
-
else
|
77
|
-
nil
|
78
|
-
end
|
79
|
-
rescue ::Aws::Errors::NoSuchProfileError
|
80
|
-
nil
|
81
|
-
end
|
82
|
-
|
83
|
-
def assume_role_credentials(options)
|
84
|
-
if ::Aws.shared_config.config_enabled?
|
85
|
-
profile = nil
|
86
|
-
region = nil
|
87
|
-
if options[:config]
|
88
|
-
profile = options[:config].profile
|
89
|
-
region = options[:config].region
|
90
|
-
assume_role_with_profile(options[:config].profile, options[:config].region)
|
91
|
-
end
|
92
|
-
assume_role_with_profile(profile, region)
|
93
|
-
else
|
94
|
-
nil
|
95
|
-
end
|
96
|
-
end
|
97
|
-
|
98
|
-
def instance_profile_credentials(options)
|
99
|
-
if ENV['AWS_CONTAINER_CREDENTIALS_RELATIVE_URI']
|
100
|
-
::Aws::ECSCredentials.new(options)
|
101
|
-
else
|
102
|
-
::Aws::InstanceProfileCredentials.new(options)
|
103
|
-
end
|
104
|
-
end
|
105
|
-
|
106
|
-
def assume_role_with_profile(prof, region)
|
107
|
-
::Aws.shared_config.assume_role_credentials_from_config(
|
108
|
-
profile: prof,
|
109
|
-
region: region,
|
110
|
-
chain_config: @config
|
111
|
-
)
|
112
|
-
end
|
113
|
-
end
|
114
|
-
end
|
115
|
-
end
|