logstash-integration-aws 7.1.8-java → 7.2.1-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66108a18e73b5e988bded6e5de34f8a9eb914218c6f1d27f7a3be9cf57763396
-  data.tar.gz: 11a2a73eaa92dd70459940a6f0ea5067dfd2089e7ab5cf2bd5c5ed903a21fbfd
+  metadata.gz: 59fe4b9ba4e518e9e3c4250c3c7a917e487bdfc497b0dad6c540ca5ee46a3bf4
+  data.tar.gz: 73ca6bdfc8f1fb520a6cb5e2d4ec8cc95ed7424691a0fa334d5f1e2ad73bb820
 SHA512:
-  metadata.gz: e3f3b447382601f2437c51acd92772eb0c12d7397d4cd8d4cfb47d664bee6e53a0bf14d76f7434a691526fd9f7c4786c508c45851f5fd057fe8a4802cb3c23d7
-  data.tar.gz: 55fc854162afe32be6f17f5393d50154624c411b5b9fcdd1386e42b9c212b86c56f0fe658a9b01f854fa5c101726f0d1bef7ad6534f4593d431e47dd57b5677a
+  metadata.gz: 496898911cec880f3f9b599d971f7a96990891244d519fd66e4654f98610bc60c9f85fb1acf698413c7596466f75675e3365ed24a1751e90964345b8b865e040
+  data.tar.gz: e75cfd12e307ce628a58359610c14bd461845f69bd1e6f7cf308838033d0d04c7936fc2adaccd69119705faaf62a8421aab262862cfb176eee40836b28533dce

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 7.2.1
+  - [DOC] Remove unneeded content and links in SNS and CloudWatch [#54](https://github.com/logstash-plugins/logstash-integration-aws/pull/54)
+
+## 7.2.0
+  - Added an option `web_identity_token_file` to support IRSA (IAM Roles for Service Accounts) [#52](https://github.com/logstash-plugins/logstash-integration-aws/pull/52)
+  
 ## 7.1.8
   - adding all supported storage classes for s3 output [#49](https://github.com/logstash-plugins/logstash-integration-aws/pull/49)
 

data/VERSION

@@ -1 +1 @@
-7.1.8
+7.2.1

data/docs/input-cloudwatch.asciidoc

@@ -127,6 +127,7 @@ This plugin supports the following configuration options plus the <<plugins-{typ
 | <<plugins-{type}s-{plugin}-statistics>> |<<array,array>>|No
 | <<plugins-{type}s-{plugin}-use_aws_bundled_ca>> |<<boolean,boolean>>|No
 | <<plugins-{type}s-{plugin}-use_ssl>> |<<boolean,boolean>>|No
+| <<plugins-{type}s-{plugin}-web_identity_token_file>> |<<string,string>>|No
 |=======================================================================
 
 Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
@@ -323,6 +324,17 @@ require 'aws-sdk' will load v2 classes.
 Should we require (true) or disable (false) using SSL for communicating with the AWS API
 The AWS SDK for Ruby defaults to SSL so we preserve that
 
+[id="plugins-{type}s-{plugin}-web_identity_token_file"]
+===== `web_identity_token_file`
+
+* Value type is <<string,string>>
+
+Absolute path to the file on disk containing OIDC token for https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html[IRSA].
+Set the path to `"/var/run/secrets/eks.amazonaws.com/serviceaccount/token"` when using Amazon EKS.
+If specified, <<plugins-{type}s-{plugin}-role_arn>> must not be empty.
+
+For the details of setting up IAM roles and Kubernetes service accounts, check out https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html[userguide]
+
 
 [id="plugins-{type}s-{plugin}-common-options"]
 include::{include_path}/{type}.asciidoc[]

data/docs/input-s3.asciidoc

@@ -80,6 +80,7 @@ This plugin supports the following configuration options plus the <<plugins-{typ
 | <<plugins-{type}s-{plugin}-temporary_directory>> |<<string,string>>|No
 | <<plugins-{type}s-{plugin}-use_aws_bundled_ca>> |<<boolean,boolean>>|No
 | <<plugins-{type}s-{plugin}-watch_for_new_files>> |<<boolean,boolean>>|No
+| <<plugins-{type}s-{plugin}-web_identity_token_file>> |<<string,string>>|No
 |=======================================================================
 
 Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
@@ -351,6 +352,17 @@ you can set this to `true`.
 Whether or not to watch for new files.
 Disabling this option causes the input to close itself after processing the files from a single listing.
 
+[id="plugins-{type}s-{plugin}-web_identity_token_file"]
+===== `web_identity_token_file`
+
+  * Value type is <<string,string>>
+
+Absolute path to the file on disk containing OIDC token for https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html[IRSA].
+Set the path to `"/var/run/secrets/eks.amazonaws.com/serviceaccount/token"` when using Amazon EKS.
+If specified, <<plugins-{type}s-{plugin}-role_arn>> must not be empty.
+
+For the details of setting up IAM roles and Kubernetes service accounts, check out https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html[userguide]
+
 [id="plugins-{type}s-{plugin}-common-options"]
 include::{include_path}/{type}.asciidoc[]
 

data/docs/input-sqs.asciidoc

@@ -103,6 +103,7 @@ This plugin supports the following configuration options plus the <<plugins-{typ
 | <<plugins-{type}s-{plugin}-session_token>> |<<string,string>>|No
 | <<plugins-{type}s-{plugin}-threads>> |<<number,number>>|No
 | <<plugins-{type}s-{plugin}-use_aws_bundled_ca>> |<<boolean,boolean>>|No
+| <<plugins-{type}s-{plugin}-web_identity_token_file>> |<<string,string>>|No
 |=======================================================================
 
 Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
@@ -289,6 +290,17 @@ Use bundled CA certificates that ship with AWS SDK to verify SSL peer certificat
 For cases where the default certificates are unavailable, e.g. Windows,
 you can set this to `true`.
 
+[id="plugins-{type}s-{plugin}-web_identity_token_file"]
+===== `web_identity_token_file`
+
+* Value type is <<string,string>>
+
+Absolute path to the file on disk containing OIDC token for https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html[IRSA].
+Set the path to `"/var/run/secrets/eks.amazonaws.com/serviceaccount/token"` when using Amazon EKS.
+If specified, <<plugins-{type}s-{plugin}-role_arn>> must not be empty.
+
+For the details of setting up IAM roles and Kubernetes service accounts, check out https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html[userguide]
+
 
 [id="plugins-{type}s-{plugin}-common-options"]
 include::{include_path}/{type}.asciidoc[]

data/docs/output-cloudwatch.asciidoc

@@ -325,7 +325,6 @@ If provided, this must be a string which can be converted to a float, for exampl
 If you set this option you should probably set the `unit` option along with it
 
 
-
 [id="plugins-{type}s-{plugin}-common-options"]
 include::{include_path}/{type}.asciidoc[]
 

data/docs/output-s3.asciidoc

@@ -115,6 +115,7 @@ This plugin supports the following configuration options plus the <<plugins-{typ
 | <<plugins-{type}s-{plugin}-upload_workers_count>> |<<number,number>>|No
 | <<plugins-{type}s-{plugin}-use_aws_bundled_ca>> |<<boolean,boolean>>|No
 | <<plugins-{type}s-{plugin}-validate_credentials_on_root_bucket>> |<<boolean,boolean>>|No
+| <<plugins-{type}s-{plugin}-web_identity_token_file>> |<<string,string>>|No
 |=======================================================================
 
 Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
@@ -447,6 +448,18 @@ full access to write logs.
 In some circumstances, you need more granular permissions on the subfolder. This
 allows you to disable the check at startup.
 
+[id="plugins-{type}s-{plugin}-web_identity_token_file"]
+===== `web_identity_token_file`
+
+* Value type is <<string,string>>
+
+Absolute path to the file on disk containing OIDC token for https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html[IRSA].
+Set the path to `"/var/run/secrets/eks.amazonaws.com/serviceaccount/token"` when using Amazon EKS.
+If specified, <<plugins-{type}s-{plugin}-role_arn>> must not be empty.
+
+For the details of setting up IAM roles and Kubernetes service accounts, check out https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html[https://docs.aws.amazon.com/eks/latest/userguide/pod-configuration.html[userguide]
+
+
 [id="plugins-{type}s-{plugin}-common-options"]
 include::{include_path}/{type}.asciidoc[]
 

data/docs/output-sqs.asciidoc

@@ -98,6 +98,7 @@ This plugin supports the following configuration options plus the <<plugins-{typ
 | <<plugins-{type}s-{plugin}-secret_access_key>> |<<string,string>>|No
 | <<plugins-{type}s-{plugin}-session_token>> |<<string,string>>|No
 | <<plugins-{type}s-{plugin}-use_aws_bundled_ca>> |<<boolean,boolean>>|No
+| <<plugins-{type}s-{plugin}-web_identity_token_file>> |<<string,string>>|No
 |=======================================================================
 
 Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
@@ -245,6 +246,18 @@ Use bundled CA certificates that ship with AWS SDK to verify SSL peer certificat
 For cases where the default certificates are unavailable, e.g. Windows,
 you can set this to `true`.
 
+[id="plugins-{type}s-{plugin}-web_identity_token_file"]
+===== `web_identity_token_file`
+
+* Value type is <<string,string>>
+
+Absolute path to the file on disk containing OIDC token for https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html[IRSA].
+Set the path to `"/var/run/secrets/eks.amazonaws.com/serviceaccount/token"` when using Amazon EKS.
+If specified, <<plugins-{type}s-{plugin}-role_arn>> must not be empty.
+
+For the details of setting up IAM roles and Kubernetes service accounts, check out https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html[userguide]
+
+
 [id="plugins-{type}s-{plugin}-common-options"]
 include::{include_path}/{type}.asciidoc[]
 

data/lib/logstash/plugin_mixins/aws_config/generic.rb

@@ -57,5 +57,11 @@ module LogStash::PluginMixins::AwsConfig::Generic
     # you can use the bundled ca certificate provided by AWS SDK
     # by setting `use_aws_bundled_ca` to true
     config :use_aws_bundled_ca, :validate => :boolean, :default => false
+
+    # Absolute path to the file on disk containing OIDC token for IRSA
+    # In AWS EKS, this should be set to "/var/run/secrets/eks.amazonaws.com/serviceaccount/token",
+    # the default location where EKS projects the token.
+    # `role_arn` must be configured when `web_identity_token_file` is used
+    config :web_identity_token_file, :validate => :string
   end
 end

data/lib/logstash/plugin_mixins/aws_config/v2.rb

@@ -2,9 +2,18 @@
 require "logstash/plugin_mixins/aws_config/generic"
 
 module LogStash::PluginMixins::AwsConfig::V2
+  module RegisterInterceptor
+    # check aws config before plugin.register()
+    def register
+      check_aws_generic_config!
+      super
+    end
+  end
+
   def self.included(base)
     base.extend(self)
     base.send(:include, LogStash::PluginMixins::AwsConfig::Generic)
+    base.prepend(RegisterInterceptor)
   end
 
   public
@@ -67,19 +76,24 @@ module LogStash::PluginMixins::AwsConfig::V2
   alias credentials aws_credentials
 
   def assume_role(opts = {})
-    unless opts.key?(:credentials)
-      credentials = aws_credentials
-      opts[:credentials] = credentials if credentials
-    end
+    creds = aws_credentials
+    opts[:credentials] = creds if creds
 
     # for a regional endpoint :region is always required by AWS
     opts[:region] = @region
 
-    Aws::AssumeRoleCredentials.new(
-        :client => Aws::STS::Client.new(opts),
-        :role_arn => @role_arn,
-        :role_session_name => @role_session_name
-    )
+    role_credentials_opts = {
+      client: Aws::STS::Client.new(opts),
+      role_arn: @role_arn,
+      role_session_name: @role_session_name
+    }
+
+    if @web_identity_token_file
+      role_credentials_opts[:web_identity_token_file] = @web_identity_token_file
+      Aws::AssumeRoleWebIdentityCredentials.new(role_credentials_opts)
+    else
+      Aws::AssumeRoleCredentials.new(role_credentials_opts)
+    end
   end
 
   def symbolize_keys_and_cast_true_false(hash)
@@ -97,4 +111,7 @@ module LogStash::PluginMixins::AwsConfig::V2
     end
   end
 
+  def check_aws_generic_config!
+    raise LogStash::ConfigurationError, "`role_arn` must be set when using `web_identity_token_file`" if @web_identity_token_file && (@role_arn.nil? || @role_arn.empty?)
+  end
 end

data/lib/logstash-integration-aws_jars.rb

@@ -1,4 +1,4 @@
 # AUTOGENERATED BY THE GRADLE SCRIPT. DO NOT EDIT.
 
 require 'jar_dependencies'
-require_jar('org.logstash.plugins.integration.aws', 'logstash-integration-aws', '7.1.8')
+require_jar('org.logstash.plugins.integration.aws', 'logstash-integration-aws', '7.2.1')

data/spec/outputs/s3_spec.rb

@@ -211,7 +211,7 @@ describe LogStash::Outputs::S3 do
     context 'us-east-1' do
       let(:region) { 'us-east-1' }
       it "sets endpoint" do
-        expect( subject.send(:bucket_resource).client.config.endpoint.to_s ).to eql 'https://s3.us-east-1.amazonaws.com'
+        expect( subject.send(:bucket_resource).client.config.endpoint.to_s ).to eql 'https://s3.amazonaws.com'
       end
     end
 

data/spec/plugin_mixin/aws_config_spec.rb

@@ -6,6 +6,7 @@ require 'timecop'
 class DummyInputAwsConfigV2 < LogStash::Inputs::Base
   include LogStash::PluginMixins::AwsConfig::V2
 
+  def register; end
   def aws_service_endpoint(region)
     { :dummy_input_aws_config_region => "#{region}.awswebservice.local" }
   end
@@ -13,6 +14,7 @@ end
 
 class DummyInputAwsConfigV2NoRegionMethod < LogStash::Inputs::Base
   include LogStash::PluginMixins::AwsConfig::V2
+  def register; end
 end
 
 describe LogStash::PluginMixins::AwsConfig::V2 do
@@ -87,6 +89,7 @@ describe LogStash::PluginMixins::AwsConfig::V2 do
               new_temp_credentials
             end
           }
+          allow_any_instance_of(Aws::AssumeRoleCredentials).to receive(:parse_account_id).with(any_args).and_return(nil)
         end
 
         it 'supports passing role_arn' do
@@ -233,4 +236,24 @@ describe LogStash::PluginMixins::AwsConfig::V2 do
     end
   end
 
+  describe "validate config" do
+    context "setup IRSA" do
+      let(:settings) { {"web_identity_token_file" => "/path/to/token_file"} }
+
+      context "web_identity_token_file and role_arn are set" do
+        let(:settings) { super().merge("role_arn" => 'arn:aws:iam::111122223333:role/a-role',) }
+
+        it "passes validation" do
+          expect{ DummyInputAwsConfigV2.new(settings).register }.to_not raise_error
+        end
+      end
+
+      context "only web_identity_token_file is set" do
+        it "fails validation" do
+          expect{ DummyInputAwsConfigV2.new(settings).register }.to raise_error(LogStash::ConfigurationError, /`role_arn` must be set/)
+        end
+      end
+    end
+  end
+
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-integration-aws
 version: !ruby/object:Gem::Version
-  version: 7.1.8
+  version: 7.2.1
 platform: java
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-07-26 00:00:00.000000000 Z
+date: 2025-02-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -20,8 +20,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2.99'
   name: logstash-core-plugin-api
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -37,8 +37,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: concurrent-ruby
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -51,8 +51,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: logstash-codec-json
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -65,8 +65,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: logstash-codec-plain
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -79,8 +79,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 3.0.9
   name: rufus-scheduler
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -93,8 +93,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 0.0.22
   name: stud
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
@@ -107,8 +107,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: rexml
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -121,8 +121,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '3'
   name: aws-sdk-core
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
@@ -135,8 +135,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: aws-sdk-s3
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -149,8 +149,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: aws-sdk-sqs
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -163,8 +163,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: aws-sdk-sns
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -177,8 +177,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: aws-sdk-cloudwatch
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -191,8 +191,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: aws-sdk-cloudfront
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -205,8 +205,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: aws-sdk-resourcegroups
-  prerelease: false
   type: :runtime
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -219,8 +219,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: logstash-codec-json_lines
-  prerelease: false
   type: :development
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -233,8 +233,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: logstash-codec-multiline
-  prerelease: false
   type: :development
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -247,8 +247,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: logstash-codec-json
-  prerelease: false
   type: :development
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -261,8 +261,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: logstash-codec-line
-  prerelease: false
   type: :development
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -275,8 +275,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: logstash-devutils
-  prerelease: false
   type: :development
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -289,8 +289,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: logstash-input-generator
-  prerelease: false
   type: :development
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -303,8 +303,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
   name: timecop
-  prerelease: false
   type: :development
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -408,7 +408,7 @@ files:
 - spec/spec_helper.rb
 - spec/support/helpers.rb
 - spec/unit/outputs/sqs_spec.rb
-- vendor/jar-dependencies/org/logstash/plugins/integration/aws/logstash-integration-aws/7.1.8/logstash-integration-aws-7.1.8.jar
+- vendor/jar-dependencies/org/logstash/plugins/integration/aws/logstash-integration-aws/7.2.1/logstash-integration-aws-7.2.1.jar
 homepage: http://www.elastic.co/guide/en/logstash/current/index.html
 licenses:
 - Apache-2.0
@@ -432,7 +432,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.33
+rubygems_version: 3.3.26
 signing_key:
 specification_version: 4
 summary: Collection of Logstash plugins that integrate with AWS