Skip to content

Commit 179e1fe

Browse files
OmpragashOmpragash
authored
Update plugin.go
1 parent cfbaf3e commit 179e1fe

File tree

1 file changed

+83
-83
lines changed

1 file changed

+83
-83
lines changed

‎plugin.go‎

Lines changed: 83 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ type Plugin struct {
9999
// set externalID for assume role
100100
ExternalID string
101101

102-
// set OIDC ID Token to retrieve temporary credentials
102+
// set OIDC ID Token to retrieve temporary credentials
103103
IdToken string
104104
}
105105

@@ -280,8 +280,7 @@ func matchExtension(match string, stringMap map[string]string) string {
280280
return ""
281281
}
282282

283-
func assumeRole(roleArn, roleSessionName, externalID string) *credentials.Credentials {
284-
sess, _ := session.NewSession()
283+
func assumeRole(sess *session.Session, roleArn, roleSessionName, externalID string) *credentials.Credentials {
285284
client := sts.New(sess)
286285
duration := time.Hour * 1
287286
stsProvider := &stscreds.AssumeRoleProvider{
@@ -434,87 +433,88 @@ func (p *Plugin) downloadS3Objects(client *s3.S3, sourceDir string) error {
434433

435434
// createS3Client creates and returns an S3 client based on the plugin configuration
436435
func (p *Plugin) createS3Client() *s3.S3 {
437-
conf := &aws.Config{
438-
Region: aws.String(p.Region),
439-
Endpoint: &p.Endpoint,
440-
DisableSSL: aws.Bool(strings.HasPrefix(p.Endpoint, "http://")),
441-
S3ForcePathStyle: aws.Bool(p.PathStyle),
442-
}
443-
444-
// Set credentials before creating the session
445-
if p.Key != "" && p.Secret != "" {
446-
conf.Credentials = credentials.NewStaticCredentials(p.Key, p.Secret, "")
447-
} else if p.IdToken != "" && p.AssumeRole != "" {
448-
// Create a temporary session for assuming the role
449-
tempSess, err := session.NewSession(conf)
450-
if err != nil {
451-
log.Fatalf("failed to create temporary AWS session: %v", err)
452-
}
453-
454-
creds, err := assumeRoleWithWebIdentity(tempSess, p.AssumeRole, p.AssumeRoleSessionName, p.IdToken)
455-
if err != nil {
456-
log.Fatalf("failed to assume role with web identity: %v", err)
457-
}
458-
459-
// Update the credentials in the config
460-
conf.Credentials = creds
461-
} else if p.AssumeRole != "" {
462-
// Create a temporary session for assuming the role
463-
tempSess, err := session.NewSession(conf)
464-
if err != nil {
465-
log.Fatalf("failed to create temporary AWS session: %v", err)
466-
}
467-
468-
creds := assumeRole(p.AssumeRole, p.AssumeRoleSessionName, p.ExternalID)
469-
470-
// Update the credentials in the config
471-
conf.Credentials = creds
472-
} else {
473-
log.Warn("AWS Key and/or Secret not provided (falling back to EC2 instance profile or environment variables)")
474-
}
475-
476-
// Now create the session with the credentials
477-
sess, err := session.NewSession(conf)
478-
if err != nil {
479-
log.Fatalf("failed to create AWS session: %v", err)
480-
}
481-
482-
// Create the S3 client using the session
483-
client := s3.New(sess)
484-
485-
// Optionally assume another role if UserRoleArn is provided
486-
if len(p.UserRoleArn) > 0 {
487-
log.WithFields(log.Fields{
488-
"UserRoleArn": p.UserRoleArn,
489-
}).Info("Assuming user role ARN")
490-
491-
creds := stscreds.NewCredentials(sess, p.UserRoleArn)
492-
// Create a new session with the new credentials
493-
confWithUserRole := &aws.Config{
494-
Region: aws.String(p.Region),
495-
Credentials: creds,
496-
}
497-
sessWithUserRole, err := session.NewSession(confWithUserRole)
498-
if err != nil {
499-
log.Fatalf("failed to create AWS session with user role: %v", err)
500-
}
501-
502-
client = s3.New(sessWithUserRole)
503-
}
504-
505-
return client
436+
conf := &aws.Config{
437+
Region: aws.String(p.Region),
438+
Endpoint: &p.Endpoint,
439+
DisableSSL: aws.Bool(strings.HasPrefix(p.Endpoint, "http://")),
440+
S3ForcePathStyle: aws.Bool(p.PathStyle),
441+
}
442+
443+
// Set credentials before creating the session
444+
if p.Key != "" && p.Secret != "" {
445+
// Use static credentials
446+
conf.Credentials = credentials.NewStaticCredentials(p.Key, p.Secret, "")
447+
} else if p.IdToken != "" && p.AssumeRole != "" {
448+
// Assume role with web identity
449+
tempSess, err := session.NewSession(conf)
450+
if err != nil {
451+
log.Fatalf("failed to create temporary AWS session: %v", err)
452+
}
453+
454+
creds, err := assumeRoleWithWebIdentity(tempSess, p.AssumeRole, p.AssumeRoleSessionName, p.IdToken)
455+
if err != nil {
456+
log.Fatalf("failed to assume role with web identity: %v", err)
457+
}
458+
459+
// Update the credentials in the config
460+
conf.Credentials = creds
461+
} else if p.AssumeRole != "" {
462+
// Standard AssumeRole
463+
tempSess, err := session.NewSession(conf)
464+
if err != nil {
465+
log.Fatalf("failed to create temporary AWS session: %v", err)
466+
}
467+
468+
creds := assumeRole(tempSess, p.AssumeRole, p.AssumeRoleSessionName, p.ExternalID)
469+
470+
// Update the credentials in the config
471+
conf.Credentials = creds
472+
} else {
473+
log.Warn("AWS Key and/or Secret not provided (falling back to EC2 instance profile or environment variables)")
474+
}
475+
476+
// Now create the main session with the credentials
477+
sess, err := session.NewSession(conf)
478+
if err != nil {
479+
log.Fatalf("failed to create AWS session: %v", err)
480+
}
481+
482+
// Create the S3 client using the session
483+
client := s3.New(sess)
484+
485+
// Optionally assume another role if UserRoleArn is provided
486+
if len(p.UserRoleArn) > 0 {
487+
log.WithFields(log.Fields{
488+
"UserRoleArn": p.UserRoleArn,
489+
}).Info("Assuming user role ARN")
490+
491+
creds := stscreds.NewCredentials(sess, p.UserRoleArn)
492+
// Create a new session with the new credentials
493+
confWithUserRole := &aws.Config{
494+
Region: aws.String(p.Region),
495+
Credentials: creds,
496+
}
497+
sessWithUserRole, err := session.NewSession(confWithUserRole)
498+
if err != nil {
499+
log.Fatalf("failed to create AWS session with user role: %v", err)
500+
}
501+
502+
client = s3.New(sessWithUserRole)
503+
}
504+
505+
return client
506506
}
507507

508508
func assumeRoleWithWebIdentity(sess *session.Session, roleArn, roleSessionName, idToken string) (*credentials.Credentials, error) {
509-
svc := sts.New(sess)
510-
input := &sts.AssumeRoleWithWebIdentityInput{
511-
RoleArn: aws.String(roleArn),
512-
RoleSessionName: aws.String(roleSessionName),
513-
WebIdentityToken: aws.String(idToken),
514-
}
515-
result, err := svc.AssumeRoleWithWebIdentity(input)
516-
if err != nil {
517-
log.Fatalf("failed to assume role with web identity: %v", err)
518-
}
519-
return credentials.NewStaticCredentials(*result.Credentials.AccessKeyId, *result.Credentials.SecretAccessKey, *result.Credentials.SessionToken), nil
509+
svc := sts.New(sess)
510+
input := &sts.AssumeRoleWithWebIdentityInput{
511+
RoleArn: aws.String(roleArn),
512+
RoleSessionName: aws.String(roleSessionName),
513+
WebIdentityToken: aws.String(idToken),
514+
}
515+
result, err := svc.AssumeRoleWithWebIdentity(input)
516+
if err != nil {
517+
log.Fatalf("failed to assume role with web identity: %v", err)
518+
}
519+
return credentials.NewStaticCredentials(*result.Credentials.AccessKeyId, *result.Credentials.SecretAccessKey, *result.Credentials.SessionToken), nil
520520
}

0 commit comments

Comments
 (0)