|
2 | 2 | * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. |
3 | 3 | * SPDX-License-Identifier: Apache-2.0. |
4 | 4 | */ |
5 | | - |
6 | | - |
7 | 5 | #include <aws/core/auth/STSCredentialsProvider.h> |
8 | | -#include <aws/core/config/AWSProfileConfigLoader.h> |
9 | | -#include <aws/core/platform/Environment.h> |
10 | | -#include <aws/core/platform/FileSystem.h> |
11 | | -#include <aws/core/utils/logging/LogMacros.h> |
12 | | -#include <aws/core/utils/StringUtils.h> |
13 | | -#include <aws/core/utils/FileSystemUtils.h> |
14 | | -#include <aws/core/client/SpecifiedRetryableErrorsRetryStrategy.h> |
15 | | -#include <aws/core/utils/StringUtils.h> |
16 | | -#include <aws/core/utils/UUID.h> |
17 | | -#include <cstdlib> |
18 | | -#include <fstream> |
19 | | -#include <string.h> |
20 | | -#include <climits> |
21 | | - |
| 6 | +#include <aws/core/client/ClientConfiguration.h> |
| 7 | +#include <aws/core/Globals.h> |
| 8 | +#include <aws/crt/auth/Credentials.h> |
22 | 9 |
|
23 | | -using namespace Aws::Utils; |
24 | | -using namespace Aws::Utils::Logging; |
25 | | -using namespace Aws::Auth; |
26 | | -using namespace Aws::Internal; |
27 | | -using namespace Aws::FileSystem; |
28 | | -using namespace Aws::Client; |
29 | | -using Aws::Utils::Threading::ReaderLockGuard; |
30 | | -using Aws::Utils::Threading::WriterLockGuard; |
31 | | - |
32 | | -static const char STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG[] = "STSAssumeRoleWithWebIdentityCredentialsProvider"; |
33 | | -static const int STS_CREDENTIAL_PROVIDER_EXPIRATION_GRACE_PERIOD = 5 * 60 * 1000; // 5 Minutes. |
| 10 | +namespace { |
| 11 | +const char* STS_LOG_TAG = "STSAssumeRoleWebIdentityCredentialsProvider"; |
| 12 | +} |
34 | 13 |
|
35 | | -STSAssumeRoleWebIdentityCredentialsProvider::STSAssumeRoleWebIdentityCredentialsProvider(Aws::Client::ClientConfiguration::CredentialProviderConfiguration credentialsConfig): |
36 | | - m_initialized(false) |
| 14 | +STSAssumeRoleWebIdentityCredentialsProvider::STSAssumeRoleWebIdentityCredentialsProvider( |
| 15 | + Aws::Client::ClientConfiguration::CredentialProviderConfiguration credentialsConfig) |
| 16 | + : m_credentialsProvider(nullptr), m_providerFuturesTimeoutMs(credentialsConfig.stsCredentialsProviderConfig.retrieveCredentialsFutureTimeout) |
37 | 17 | { |
38 | | - m_roleArn = Aws::Environment::GetEnv("AWS_ROLE_ARN"); |
39 | | - m_tokenFile = Aws::Environment::GetEnv("AWS_WEB_IDENTITY_TOKEN_FILE"); |
40 | | - m_sessionName = Aws::Environment::GetEnv("AWS_ROLE_SESSION_NAME"); |
41 | | - |
42 | | - // check profile_config if either m_roleArn or m_tokenFile is not loaded from environment variable |
43 | | - // region source is not enforced, but we need it to construct sts endpoint, if we can't find from environment, we should check if it's set in config file. |
44 | | - if (m_roleArn.empty() || m_tokenFile.empty()) |
45 | | - { |
46 | | - auto profile = Aws::Config::GetCachedConfigProfile(credentialsConfig.profile); |
47 | | - // If either of these two were not found from environment, use whatever found for all three in config file |
48 | | - if (m_roleArn.empty() || m_tokenFile.empty()) |
49 | | - { |
50 | | - m_roleArn = profile.GetRoleArn(); |
51 | | - m_tokenFile = profile.GetValue("web_identity_token_file"); |
52 | | - m_sessionName = profile.GetValue("role_session_name"); |
53 | | - } |
54 | | - } |
55 | | - |
56 | | - if (m_tokenFile.empty()) |
57 | | - { |
58 | | - AWS_LOGSTREAM_WARN(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, "Token file must be specified to use STS AssumeRole web identity creds provider."); |
59 | | - return; // No need to do further constructing |
| 18 | + Aws::Crt::Auth::CredentialsProviderSTSWebIdentityConfig stsConfig{}; |
| 19 | + stsConfig.Bootstrap = GetDefaultClientBootstrap(); |
| 20 | + Aws::Crt::Io::TlsContextOptions tlsCtxOptions = Aws::Crt::Io::TlsContextOptions::InitDefaultClient(); |
| 21 | + const Aws::Crt::Io::TlsContext tlsContext(tlsCtxOptions, Aws::Crt::Io::TlsMode::CLIENT); |
| 22 | + stsConfig.TlsCtx = tlsContext; |
| 23 | + stsConfig.Region = credentialsConfig.region; |
| 24 | + stsConfig.TokenFilePath = credentialsConfig.stsCredentialsProviderConfig.tokenFilePath; |
| 25 | + stsConfig.RoleArn = credentialsConfig.stsCredentialsProviderConfig.roleArn; |
| 26 | + stsConfig.SessionName = [&credentialsConfig]() -> Aws::String { |
| 27 | + if (!credentialsConfig.stsCredentialsProviderConfig.sessionName.empty()) { |
| 28 | + return credentialsConfig.stsCredentialsProviderConfig.sessionName; |
60 | 29 | } |
61 | | - else |
62 | | - { |
63 | | - AWS_LOGSTREAM_DEBUG(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, "Resolved token_file from profile_config or environment variable to be " << m_tokenFile); |
64 | | - } |
65 | | - |
66 | | - if (m_roleArn.empty()) |
67 | | - { |
68 | | - AWS_LOGSTREAM_WARN(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, "RoleArn must be specified to use STS AssumeRole web identity creds provider."); |
69 | | - return; // No need to do further constructing |
70 | | - } |
71 | | - else |
72 | | - { |
73 | | - AWS_LOGSTREAM_DEBUG(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, "Resolved role_arn from profile_config or environment variable to be " << m_roleArn); |
74 | | - } |
75 | | - |
76 | | - if (m_sessionName.empty()) |
77 | | - { |
78 | | - m_sessionName = Aws::Utils::UUID::PseudoRandomUUID(); |
79 | | - } |
80 | | - else |
81 | | - { |
82 | | - AWS_LOGSTREAM_DEBUG(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, "Resolved session_name from profile_config or environment variable to be " << m_sessionName); |
83 | | - } |
84 | | - |
85 | | - Aws::Client::ClientConfiguration config; |
86 | | - config.scheme = Aws::Http::Scheme::HTTPS; |
87 | | - config.region = credentialsConfig.region; |
88 | | - Aws::Vector<Aws::String> retryableErrors; |
89 | | - retryableErrors.push_back("IDPCommunicationError"); |
90 | | - retryableErrors.push_back("InvalidIdentityToken"); |
91 | | - |
92 | | - config.retryStrategy = Aws::MakeShared<SpecifiedRetryableErrorsRetryStrategy>(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, retryableErrors, 3/*maxRetries*/); |
93 | | - |
94 | | - m_client = Aws::MakeUnique<Aws::Internal::STSCredentialsClient>(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, config); |
95 | | - m_initialized = true; |
96 | | - AWS_LOGSTREAM_INFO(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, "Creating STS AssumeRole with web identity creds provider."); |
| 30 | + return UUID::RandomUUID(); |
| 31 | + }(); |
| 32 | + m_credentialsProvider = Aws::Crt::Auth::CredentialsProvider::CreateCredentialsProviderSTSWebIdentity(stsConfig); |
97 | 33 | } |
98 | 34 |
|
99 | | -Aws::String LegacyGetRegion() { |
100 | | - auto region = Aws::Environment::GetEnv("AWS_DEFAULT_REGION"); |
101 | | - if (region.empty()) { |
| 35 | +Aws::String GetLegacySettingFromEnvOrProfile(const Aws::String& envVar, |
| 36 | + std::function<Aws::String (Aws::Config::Profile)> profileFetchFunction) |
| 37 | +{ |
| 38 | + auto value = Aws::Environment::GetEnv(envVar.c_str()); |
| 39 | + if (value.empty()) { |
102 | 40 | auto profile = Aws::Config::GetCachedConfigProfile(Aws::Auth::GetConfigProfileName()); |
103 | | - region = profile.GetRegion(); |
| 41 | + value = profileFetchFunction(profile); |
104 | 42 | } |
105 | | - return region; |
| 43 | + return value; |
106 | 44 | } |
107 | 45 |
|
108 | 46 | STSAssumeRoleWebIdentityCredentialsProvider::STSAssumeRoleWebIdentityCredentialsProvider() |
109 | 47 | : STSAssumeRoleWebIdentityCredentialsProvider( |
110 | | - Aws::Client::ClientConfiguration::CredentialProviderConfiguration{Aws::Auth::GetConfigProfileName(), LegacyGetRegion(), {}}) {} |
111 | | - |
112 | | -AWSCredentials STSAssumeRoleWebIdentityCredentialsProvider::GetAWSCredentials() |
113 | | -{ |
114 | | - // A valid client means required information like role arn and token file were constructed correctly. |
115 | | - // We can use this provider to load creds, otherwise, we can just return empty creds. |
116 | | - if (!m_initialized) |
117 | | - { |
118 | | - return Aws::Auth::AWSCredentials(); |
119 | | - } |
120 | | - RefreshIfExpired(); |
121 | | - ReaderLockGuard guard(m_reloadLock); |
122 | | - return m_credentials; |
123 | | -} |
124 | | - |
125 | | -void STSAssumeRoleWebIdentityCredentialsProvider::Reload() |
126 | | -{ |
127 | | - AWS_LOGSTREAM_INFO(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, "Credentials have expired, attempting to renew from STS."); |
128 | | - |
129 | | - Aws::IFStream tokenFile(m_tokenFile.c_str()); |
130 | | - if(tokenFile) |
131 | | - { |
132 | | - Aws::String token((std::istreambuf_iterator<char>(tokenFile)), std::istreambuf_iterator<char>()); |
133 | | - m_token = token; |
134 | | - } |
135 | | - else |
136 | | - { |
137 | | - AWS_LOGSTREAM_ERROR(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, "Can't open token file: " << m_tokenFile); |
138 | | - return; |
139 | | - } |
140 | | - STSCredentialsClient::STSAssumeRoleWithWebIdentityRequest request {m_sessionName, m_roleArn, m_token}; |
141 | | - |
142 | | - auto result = m_client->GetAssumeRoleWithWebIdentityCredentials(request); |
143 | | - AWS_LOGSTREAM_TRACE(STS_ASSUME_ROLE_WEB_IDENTITY_LOG_TAG, "Successfully retrieved credentials with AWS_ACCESS_KEY: " << result.creds.GetAWSAccessKeyId()); |
144 | | - m_credentials = result.creds; |
145 | | -} |
| 48 | + Aws::Client::ClientConfiguration::CredentialProviderConfiguration{ |
| 49 | + Aws::Auth::GetConfigProfileName(), |
| 50 | + GetLegacySettingFromEnvOrProfile("AWS_DEFAULT_REGION", |
| 51 | + [](const Aws::Config::Profile& profile) -> Aws::String { return profile.GetRegion(); }), |
| 52 | + {}, |
| 53 | + { |
| 54 | + GetLegacySettingFromEnvOrProfile("AWS_ROLE_ARN", |
| 55 | + [](const Aws::Config::Profile& profile) -> Aws::String { return profile.GetRoleArn(); }), |
| 56 | + GetLegacySettingFromEnvOrProfile("AWS_ROLE_SESSION_NAME", |
| 57 | + [](const Aws::Config::Profile& profile) -> Aws::String { return profile.GetValue("role_session_name"); }), |
| 58 | + GetLegacySettingFromEnvOrProfile("AWS_WEB_IDENTITY_TOKEN_FILE", |
| 59 | + [](const Aws::Config::Profile& profile) -> Aws::String { return profile.GetValue("web_identity_token_file"); }) |
| 60 | + }}) |
| 61 | +{} |
| 62 | + |
| 63 | +STSAssumeRoleWebIdentityCredentialsProvider::~STSAssumeRoleWebIdentityCredentialsProvider() = default; |
| 64 | + |
| 65 | +AWSCredentials STSAssumeRoleWebIdentityCredentialsProvider::GetAWSCredentials() { |
| 66 | + AWSCredentials credentials{}; |
| 67 | + auto refreshDone = false; |
| 68 | + m_credentialsProvider->GetCredentials( |
| 69 | + [ this, &credentials, &refreshDone](std::shared_ptr<Aws::Crt::Auth::Credentials> crtCredentials, int errorCode) -> void { |
| 70 | + { |
| 71 | + const std::unique_lock<std::mutex> lock{m_refreshMutex}; |
| 72 | + if (errorCode != AWS_ERROR_SUCCESS) { |
| 73 | + AWS_LOGSTREAM_ERROR(STS_LOG_TAG, "Failed to get credentials from STS: " << errorCode); |
| 74 | + } else { |
| 75 | + const auto accountIdCursor = crtCredentials->GetAccessKeyId(); |
| 76 | + credentials.SetAWSAccessKeyId({reinterpret_cast<char*>(accountIdCursor.ptr), accountIdCursor.len}); |
| 77 | + const auto secretKeuCursor = crtCredentials->GetSecretAccessKey(); |
| 78 | + credentials.SetAWSSecretKey({reinterpret_cast<char*>(secretKeuCursor.ptr), secretKeuCursor.len}); |
| 79 | + const auto expiration = crtCredentials->GetExpirationTimepointInSeconds(); |
| 80 | + credentials.SetExpiration(DateTime{static_cast<double>(expiration)}); |
| 81 | + const auto sessionTokenCursor = crtCredentials->GetSessionToken(); |
| 82 | + credentials.SetSessionToken({reinterpret_cast<char*>(sessionTokenCursor.ptr), sessionTokenCursor.len}); |
| 83 | + } |
| 84 | + refreshDone = true; |
| 85 | + } |
| 86 | + m_refreshSignal.notify_one(); |
| 87 | + }); |
146 | 88 |
|
147 | | -bool STSAssumeRoleWebIdentityCredentialsProvider::ExpiresSoon() const |
148 | | -{ |
149 | | - return ((m_credentials.GetExpiration() - Aws::Utils::DateTime::Now()).count() < STS_CREDENTIAL_PROVIDER_EXPIRATION_GRACE_PERIOD); |
| 89 | + std::unique_lock<std::mutex> lock{m_refreshMutex}; |
| 90 | + m_refreshSignal.wait_for(lock, m_providerFuturesTimeoutMs, [&refreshDone]() -> bool { return refreshDone; }); |
| 91 | + return credentials; |
150 | 92 | } |
151 | 93 |
|
152 | | -void STSAssumeRoleWebIdentityCredentialsProvider::RefreshIfExpired() |
153 | | -{ |
154 | | - ReaderLockGuard guard(m_reloadLock); |
155 | | - if (!m_credentials.IsEmpty() && !ExpiresSoon()) |
156 | | - { |
157 | | - return; |
158 | | - } |
159 | | - |
160 | | - guard.UpgradeToWriterLock(); |
161 | | - if (!m_credentials.IsExpiredOrEmpty() && !ExpiresSoon()) // double-checked lock to avoid refreshing twice |
162 | | - { |
163 | | - return; |
164 | | - } |
165 | | - |
166 | | - Reload(); |
| 94 | +void STSAssumeRoleWebIdentityCredentialsProvider::Reload() { |
| 95 | + AWS_LOGSTREAM_DEBUG(STS_LOG_TAG, "Calling reload on STSCredentialsProvider is a no-op and no longer in the call path"); |
167 | 96 | } |
0 commit comments