dvla-kaping 1.0.4 → 1.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. checksums.yaml +4 -4
  2. data/.rubocop.yml +1 -1
  3. data/.ruby-version +1 -1
  4. data/.tool-versions +1 -1
  5. data/CHANGELOG.md +9 -4
  6. data/README.md +39 -5
  7. data/lib/dvla/kaping/aws_client.rb +25 -12
  8. data/lib/dvla/kaping/version.rb +1 -1
  9. metadata +10 -22
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 99f6221990bbf656183aec0b2880b716f67038fd43a8e4daa72a80004dc15d76
4
- data.tar.gz: 20b2397b50c3c0e847b8a0b6b675b53755c90cfaf89674db85922bbb7e7a00c8
3
+ metadata.gz: 760f300cb49bc582101a24d6854ad96ca73094f81423971c47c85fcbc680992e
4
+ data.tar.gz: 756336c4dc3963e399f7af55e3564c7b3165388c331ae35dd8c2895bf337c278
5
5
  SHA512:
6
- metadata.gz: 71ec529b6e6dedaa7655ad86b33acf5ccf2edac1d32a6f195eba38033134be880b928796e256efd63cb4cc9dde3d191488c4a781db54f851219a04859ecfa2a2
7
- data.tar.gz: 0efa699c3eba860ed2b4b03d80fe9a4452eef8dd541e7c39690cb113f6bb715036fb01688acfd1e1be14351318885fdead1a961116749f5da185980df06ab5ef
6
+ metadata.gz: 5b3ecb88b4d6c7156921bd9afb8599045064725c0cfbf3158cefbe8e7b16e7cd365071e4c63cbbb0a4e07cf502bc5bf5fbb699587f5d8d68e7745cb9ce53f763
7
+ data.tar.gz: f6bca6eacf464d5ce73f8a1b3028f752e53dcd63969f338f6773028c10597e4974d9648b6c8d7801f44c26431eb2234dd982df8379f6cca1b89e5d55b3948fcf
data/.rubocop.yml CHANGED
@@ -2,7 +2,7 @@ inherit_gem:
2
2
  dvla-lint: ".rubocop.yml"
3
3
 
4
4
  AllCops:
5
- TargetRubyVersion: 3.0
5
+ TargetRubyVersion: 4.0
6
6
 
7
7
  Style/StringLiterals:
8
8
  EnforcedStyle: single_quotes
data/.ruby-version CHANGED
@@ -1 +1 @@
1
- 3.4.7
1
+ 4.0.2
data/.tool-versions CHANGED
@@ -1 +1 @@
1
- ruby 3.4.7
1
+ ruby 4.0.2
data/CHANGELOG.md CHANGED
@@ -1,14 +1,19 @@
1
1
  ## [Unreleased]
2
2
 
3
- ## [1.0.2] - 2024-11-07
3
+ ## [1.0.5] - 2025-11-10
4
4
 
5
- - Initial release
5
+ - Fixed AWS credential handling to return proper credentials from assume role
6
+ - Added AWS credential chain and SSO documentation to README
7
+
8
+ ## [1.0.4] - 2025-11-10
9
+
10
+ - Update gems and fixed issue with git actions
6
11
 
7
12
  ## [1.0.3] - 2025-09-03
8
13
 
9
14
  - Moved runtime dependencies to the gemspec
10
15
 
11
- ## [1.0.4] - 2025-11-10
16
+ ## [1.0.2] - 2024-11-07
12
17
 
13
- - Update gems and fixed issue with git actions
18
+ - Initial release
14
19
 
data/README.md CHANGED
@@ -74,18 +74,52 @@ kaping:
74
74
 
75
75
  ```
76
76
  If you want to use the built-in client, and your OpenSearch instance is hosted in a Amazon VPC you will need to assume AWS permissions for access to run the queries.
77
- there are two options, you can either use profile or environment
77
+ There are two options, you can either use profile or environment
78
78
 
79
- Profile will just pick up the credentials save in your specified shared credentials ini file at ~/.aws/credentials,
79
+ Profile will just pick up the credentials saved in your specified shared credentials ini file at ~/.aws/credentials,
80
80
 
81
81
  ```yml
82
82
  aws:
83
- # to use an AWS profile config file then set to profile, otherwise environment settings will be used
84
- credential_type: profile
83
+ # to use an AWS profile config file, then set to profile, otherwise environment settings will be used
84
+ credential_type: profile | env | credentials
85
85
  account_id: ##########
86
+ role: ROLE
86
87
  region: aws-region
87
88
  profile: PROFILE
88
- role: ROLE
89
+
90
+ ```
91
+
92
+ ### AWS Credential Chain
93
+
94
+ The gem supports three credential strategies:
95
+
96
+ | credential_type | How it works |
97
+ |---|---|
98
+ | `profile` | Uses the named profile from `~/.aws/config` to create an STS client, then assumes the configured role. Supports SSO profiles. |
99
+ | `env` | Uses environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, or `AWS_PROFILE`) to create an STS client, then assumes the configured role. |
100
+ | `credentials` | Delegates to the AWS SDK default credential provider chain, which walks through env vars → shared config/credentials → SSO → ECS/EC2 instance roles in order. No role assumption is performed. |
101
+
102
+ ### Using AWS SSO
103
+
104
+ If your organisation uses AWS IAM Identity Center (SSO), authenticate first then set the profile:
105
+
106
+ ```bash
107
+ aws sso login --profile my-sso-profile
108
+ ```
109
+
110
+ Then either:
111
+ - Set `credential_type: profile` and `profile: my-sso-profile` in your `kaping.yml`
112
+ - Or set `credential_type: env` / `credentials` and export `AWS_PROFILE=my-sso-profile`
113
+
114
+ The SDK will resolve the cached SSO token automatically. Ensure your `~/.aws/config` has the SSO profile configured, for example:
115
+
116
+ ```ini
117
+ [profile my-sso-profile]
118
+ sso_start_url = https://my-org.awsapps.com/start
119
+ sso_region = eu-west-2
120
+ sso_account_id = 123456789012
121
+ sso_role_name = MyRole
122
+ region = eu-west-2
89
123
  ```
90
124
 
91
125
  ## Client
data/lib/dvla/kaping/aws_client.rb CHANGED
@@ -11,25 +11,34 @@ module DVLA
11
11
  @base_url = Kaping.yaml[:kaping_host]
12
12
  @aws_account_id = Kaping.yaml.dig(:aws, :account_id)
13
13
  @role = Kaping.yaml.dig(:aws, :role)
14
- @region = Kaping.yaml.dig(:aws, :region)
15
- Kaping.logger.info { "Kaping Client | base_url: '#{@base_url}'" }
14
+ @region = Kaping.yaml.dig(:aws, :region) || 'eu-west-2'
15
+ Kaping.logger.debug { "AWS Client | base_url: '#{@base_url}'" }
16
+ end
17
+
18
+ def select_credentials
19
+ case Kaping.yaml.dig(:aws, :credential_type)
20
+ when 'profile'
21
+ assume_role_profile(@aws_account_id, @role)
22
+ when 'env'
23
+ assume_role_env(@aws_account_id, @role)
24
+ when 'credentials'
25
+ Aws::CredentialProviderChain.new.resolve
26
+ else
27
+ logger.warn { 'Credential type not recognised, please set an option: profile, env or credentials' }
28
+ end
16
29
  end
17
30
 
18
31
  def connect
19
- credentials = if Kaping.yaml.dig(:aws, :credential_type) == 'profile'
20
- assume_role_profile(@aws_account_id, @role)
21
- else
22
- assume_role_env(@aws_account_id, @role)
23
- end
32
+ credentials = select_credentials
24
33
 
25
34
  signer = Aws::Sigv4::Signer.new(service: 'es',
26
35
  region: @region,
27
36
  credentials_provider: credentials)
28
37
 
29
38
  OpenSearch::Aws::Sigv4Client.new({
30
- host: @base_url,
31
- log: false,
32
- }, signer)
39
+ host: @base_url,
40
+ log: false,
41
+ }, signer)
33
42
  end
34
43
 
35
44
  private
@@ -38,7 +47,9 @@ module DVLA
38
47
  def assume_role_profile(aws_account_id, role)
39
48
  role_arn = "arn:aws:iam::#{aws_account_id}:role/#{role}"
40
49
  sts = Aws::STS::Client.new(region: @region, profile: Kaping.yaml.dig(:aws, :profile))
41
- sts.assume_role(role_arn: role_arn, role_session_name: 'kaping')
50
+ resp = sts.assume_role(role_arn: role_arn, role_session_name: 'kaping')
51
+ Aws::Credentials.new(resp.credentials.access_key_id, resp.credentials.secret_access_key,
52
+ resp.credentials.session_token)
42
53
  rescue Aws::STS::Errors::ServiceError => e
43
54
  raise "#{__method__}: AWS Profile Credentials Issue: #{e.message} #{e.class.name}"
44
55
  end
@@ -47,7 +58,9 @@ module DVLA
47
58
  def assume_role_env(aws_account_id, role)
48
59
  role_arn = "arn:aws:iam::#{aws_account_id}:role/#{role}"
49
60
  sts = Aws::STS::Client.new(region: @region)
50
- sts.assume_role(role_arn: role_arn, role_session_name: 'kaping')
61
+ resp = sts.assume_role(role_arn: role_arn, role_session_name: 'kaping')
62
+ Aws::Credentials.new(resp.credentials.access_key_id, resp.credentials.secret_access_key,
63
+ resp.credentials.session_token)
51
64
  rescue Aws::STS::Errors::ServiceError => e
52
65
  raise "#{__method__}: AWS ENV Credentials Issue: #{e.message} #{e.class.name}"
53
66
  end
data/lib/dvla/kaping/version.rb CHANGED
@@ -2,6 +2,6 @@
2
2
 
3
3
  module DVLA
4
4
  module Kaping
5
- VERSION = '1.0.4'
5
+ VERSION = '1.0.5'
6
6
  end
7
7
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: dvla-kaping
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.0.4
4
+ version: 1.0.5
5
5
  platform: ruby
6
6
  authors:
7
7
  - Driver and Vehicle Licensing Agency (DVLA)
8
8
  - Kevin Upstill
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2025-11-12 00:00:00.000000000 Z
11
+ date: 1980-01-02 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: aws-sdk-sts
@@ -30,54 +30,42 @@ dependencies:
30
30
  requirements:
31
31
  - - "~>"
32
32
  - !ruby/object:Gem::Version
33
- version: '1.8'
33
+ version: '1.12'
34
34
  type: :runtime
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - "~>"
39
39
  - !ruby/object:Gem::Version
40
- version: '1.8'
40
+ version: '1.12'
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: nokogiri
43
43
  requirement: !ruby/object:Gem::Requirement
44
44
  requirements:
45
45
  - - "~>"
46
46
  - !ruby/object:Gem::Version
47
- version: '1.18'
48
- - - ">="
49
- - !ruby/object:Gem::Version
50
- version: 1.18.8
47
+ version: '1.19'
51
48
  type: :runtime
52
49
  prerelease: false
53
50
  version_requirements: !ruby/object:Gem::Requirement
54
51
  requirements:
55
52
  - - "~>"
56
53
  - !ruby/object:Gem::Version
57
- version: '1.18'
58
- - - ">="
59
- - !ruby/object:Gem::Version
60
- version: 1.18.8
54
+ version: '1.19'
61
55
  - !ruby/object:Gem::Dependency
62
56
  name: opensearch-aws-sigv4
63
57
  requirement: !ruby/object:Gem::Requirement
64
58
  requirements:
65
59
  - - "~>"
66
60
  - !ruby/object:Gem::Version
67
- version: '1.2'
68
- - - ">="
69
- - !ruby/object:Gem::Version
70
- version: 1.2.1
61
+ version: '1.3'
71
62
  type: :runtime
72
63
  prerelease: false
73
64
  version_requirements: !ruby/object:Gem::Requirement
74
65
  requirements:
75
66
  - - "~>"
76
67
  - !ruby/object:Gem::Version
77
- version: '1.2'
78
- - - ">="
79
- - !ruby/object:Gem::Version
80
- version: 1.2.1
68
+ version: '1.3'
81
69
  description: Wrapper for the AWS elastic search API to create an idiomatic way to
82
70
  build complex search queries
83
71
  email:
@@ -118,14 +106,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
118
106
  requirements:
119
107
  - - ">="
120
108
  - !ruby/object:Gem::Version
121
- version: '3'
109
+ version: '4'
122
110
  required_rubygems_version: !ruby/object:Gem::Requirement
123
111
  requirements:
124
112
  - - ">="
125
113
  - !ruby/object:Gem::Version
126
114
  version: '0'
127
115
  requirements: []
128
- rubygems_version: 3.6.2
116
+ rubygems_version: 4.0.6
129
117
  specification_version: 4
130
118
  summary: Idiomatic way to create DSL openSearch definitions
131
119
  test_files: []