miasma-aws 0.1.14 → 0.1.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 73b61343ba58ba168a4374d7a27ebccf03be0755
-  data.tar.gz: 4a0890aae5f14b0fe5199aca62993698f92b7404
+  metadata.gz: 9ddfd1e74d80ada8575393aabf92009624191fa0
+  data.tar.gz: 3733de905ea6752c7118a0ac36091da340a6bff6
 SHA512:
-  metadata.gz: 8760d6337a22a3575ae9f95aa4a658b84138c790fa933250630b48791630223de8d0cfbc0ca1ae792da71c66d4b83c5507a31b88f779bdaaebfa73d3145c71ff
-  data.tar.gz: 61df3b1d4b30f7500bba01565bb0158276cafcb8d4b0ae4bd500a68a495168d1cd32c9571f157c92c89c3d9f39f291f83135869ad48e93912a3e20e3c5bfa1f6
+  metadata.gz: f5ae40e62e7d0aee7d2ca6c260f3fe99d54f85d9760701d8f71cd5b4d7bd5b9bf8017b1a467b8e392e8933dd574b0a08fab46a71090cf5f0db99a41ae59226b1
+  data.tar.gz: a7a9320181bd4079068ba19a0cfe434d3aaf141a81251ad71a06132957bf65f74d2a66f0de3f7f5dd66b208045171063425adeaa07c99d70585df981833443ec

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## v0.1.16
+* Add new `aws_sts_token` attribute for credentials
+* Automatically include STS token on requests if available
+* Add support for assuming roles via STS
+
 ## v0.1.14
 * Fix checksum generation on multi-part uploads
 * Fix paginated fetching of bucket objects

data/README.md

@@ -2,6 +2,48 @@
 
 AWS API plugin for the miasma cloud library
 
+## Supported credential attributes:
+
+Supported attributes used in the credentials section of API
+configurations:
+
+```ruby
+Miasma.api(
+  :type => :storage,
+  :provider => :aws,
+  :credentials => {
+    ...
+  }
+)
+```
+
+### Common general use attributes
+
+* `aws_access_key_id` - User access key ID
+* `aws_secret_access_key` - User secret access key
+* `aws_region` - Region to connect
+
+### Profile related attributes
+
+* `aws_profile_name` - Use credentials/configuration from profile name
+* `aws_credentials_file` - Specify custom credentials file
+* `aws_config_file` - Specify custom configuration file
+
+### Secure Token Service related:
+
+* `aws_sts_token` - Set STS token to use with current key ID and secret
+* `aws_sts_role_arn` - Assume role
+* `aws_external_id` - Provide an external ID when assuming role
+* `aws_sts_role_session_name` - Provide custom session name when assuming role
+
+### S3 related attributes
+
+* `aws_bucket_region` - Override current `aws_region` for bucket
+
+### Other attributes
+
+* `aws_host` - Use custom DNS endpoint for API requests
+
 ## Current support matrix
 
 |Model         |Create|Read|Update|Delete|

data/lib/miasma/contrib/aws.rb

@@ -6,6 +6,9 @@ require 'openssl'
 
 module Miasma
   module Contrib
+    module Aws
+      autoload :Api, 'miasma-aws/api'
+    end
     # Core API for AWS access
     class AwsApiCore
 
@@ -328,6 +331,10 @@ module Miasma
         def self.included(klass)
           klass.class_eval do
             attribute :aws_profile_name, String, :default => 'default'
+            attribute :aws_sts_token, String
+            attribute :aws_sts_role_arn, String
+            attribute :aws_sts_external_id, String
+            attribute :aws_sts_role_session_name, String
             attribute :aws_credentials_file, String, :required => true, :default => File.join(Dir.home, '.aws/credentials')
             attribute :aws_config_file, String, :required => true, :default => File.join(Dir.home, '.aws/config')
             attribute :aws_access_key_id, String, :required => true
@@ -377,6 +384,33 @@ module Miasma
               ).merge(creds)
             )
           end
+          if(creds[:aws_sts_role_arn])
+            sts_assume_role!(creds)
+          end
+          true
+        end
+
+        # Assume requested role and replace key id and secret
+        #
+        # @param creds [Hash]
+        # @return [TrueClass]
+        def sts_assume_role!(creds)
+          unless(creds[:aws_access_key_id_original])
+            creds[:aws_access_key_id_original] = creds[:aws_access_key_id]
+            creds[:aws_secret_access_key_original] = creds[:aws_secret_access_key]
+          end
+          sts = Miasma::Contrib::Aws::Api::Sts.new(
+            :aws_access_key_id => creds[:aws_access_key_id_original],
+            :aws_secret_access_key => creds[:aws_secret_access_key_original],
+            :aws_region => creds.fetch(:aws_sts_region, 'us-east-1'),
+            :aws_credentials_file => creds.fetch(:aws_credentials_file, aws_credentials_file),
+            :aws_config_file => creds.fetch(:aws_config_file, aws_config_file),
+            :aws_profile_name => creds[:aws_profile_name],
+            :aws_host => creds[:aws_host]
+          )
+          role_info = sts.assume_role(creds[:aws_sts_role_arn])
+          creds.merge!(role_info)
+          true
         end
 
         # Load configuration from the AWS configuration file
@@ -455,6 +489,9 @@ module Miasma
           if(self.class::API_VERSION)
             if(options[:form])
               options.set(:form, 'Version', self.class::API_VERSION)
+              if(aws_sts_token)
+                options.set(:form, 'SecurityToken', aws_sts_token)
+              end
             else
               options[:params] = options.fetch(
                 :params, Smash.new
@@ -463,6 +500,9 @@ module Miasma
                   'Version' => self.class::API_VERSION
                 )
               )
+              if(aws_sts_token)
+                options.set(:params, 'SecurityToken', aws_sts_token)
+              end
             end
           end
           update_request(connection, options)

data/lib/miasma-aws/api/sts.rb

@@ -0,0 +1,52 @@
+require 'miasma'
+
+module Miasma
+  module Contrib
+    module Aws
+      module Api
+        class Sts < Miasma::Types::Api
+
+          # Service name of the API
+          API_SERVICE = 'sts'
+          # Supported version of the AutoScaling API
+          API_VERSION = '2011-06-15'
+
+          include Contrib::AwsApiCore::ApiCommon
+          include Contrib::AwsApiCore::RequestUtils
+
+          # Assume new role
+          #
+          # @param role_arn [String] IAM Role ARN
+          # @param args [Hash]
+          # @option args [String] :external_id
+          # @option args [String] :session_name
+          # @return [Hash]
+          def assume_role(role_arn, args={})
+            req_params = Smash.new.tap do |params|
+              params['Action'] = 'AssumeRole'
+              params['RoleArn'] = role_arn
+              params['RoleSessionName'] = args.fetch(
+                :session_name,
+                SecureRandom.uuid.tr('-', '')
+              )
+              params['ExternalId'] = args[:external_id] if args[:external_id]
+            end
+            result = request(
+              :path => '/',
+              :params => req_params
+            ).get(:body, 'AssumeRoleResponse', 'AssumeRoleResult')
+            Smash.new(
+              :aws_sts_token => result.get('Credentials', 'SessionToken'),
+              :aws_secret_access_key => result.get('Credentials', 'SecretAccessKey'),
+              :aws_access_key_id => result.get('Credentials', 'AccessKeyId'),
+              :aws_sts_token_expires => Time.parse(result.get('Credentials', 'Expiration')),
+              :aws_sts_assumed_role_arn => result.get('AssumedRoleUser', 'Arn'),
+              :aws_sts_assumed_role_id => result.get('AssumedRoleUser', 'AssumedRoleId')
+            )
+          end
+
+        end
+      end
+    end
+  end
+end

data/lib/miasma-aws/api.rb

@@ -0,0 +1,11 @@
+require 'miasma'
+
+module Miasma
+  module Contrib
+    module Aws
+      module Api
+        autoload :Sts, 'miasma-aws/api/sts'
+      end
+    end
+  end
+end

data/lib/miasma-aws/version.rb

@@ -1,4 +1,4 @@
 module MiasmaAws
   # Current library version
-  VERSION = Gem::Version.new('0.1.14')
+  VERSION = Gem::Version.new('0.1.16')
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: miasma-aws
 version: !ruby/object:Gem::Version
-  version: 0.1.14
+  version: 0.1.16
 platform: ruby
 authors:
 - Chris Roberts
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-05-22 00:00:00.000000000 Z
+date: 2015-06-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: miasma
@@ -104,6 +104,8 @@ files:
 - LICENSE
 - README.md
 - lib/miasma-aws.rb
+- lib/miasma-aws/api.rb
+- lib/miasma-aws/api/sts.rb
 - lib/miasma-aws/version.rb
 - lib/miasma/contrib/aws.rb
 - lib/miasma/contrib/aws/auto_scale.rb