Skip to content

Commit ad5fe25

Browse files
shawnhankimdekobon
shawnhankim
authored and
dekobon
committed
add session token without IAM policy
fix: doc of getting started with session token fix: temporary session token fix: find session token in the env variables fix: add S3_SESSION_TOKEN in the docker-entrypoind.d fix: docs of getting started with session token fix: check if session token presents
1 parent 554af8d commit ad5fe25

File tree

8 files changed

+31
-9
lines changed

8 files changed

+31
-9
lines changed

‎common/docker-entrypoint.d/00-check-for-required-env.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,10 @@ else
5252
required+=("S3_ACCESS_KEY_ID" "S3_SECRET_KEY")
5353
fi
5454

55+
if [[ -v S3_SESSION_TOKEN ]]; then
56+
echo "S3 Session token present"
57+
fi
58+
5559
for name in ${required[@]}; do
5660
if [[ ! -v name ]]; then
5761
>&2 echo "Required ${name} environment variable missing"

‎common/etc/nginx/include/s3gateway.js‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -236,11 +236,13 @@ function _writeCredentialsToFile(credentials) {
236236
* @returns {undefined|{accessKeyId: (string), secretAccessKey: (string), sessionToken: (string|null), expiration: (string|null)}} AWS instance profile credentials or undefined
237237
*/
238238
function readCredentials(r) {
239-
if (process.env['S3_ACCESS_KEY_ID'] && process.env['S3_SECRET_KEY']) {
239+
if ('S3_ACCESS_KEY_ID' in process.env && 'S3_SECRET_KEY' in process.env) {
240+
const sessionToken = 'S3_SESSION_TOKEN' in process.env ?
241+
process.env['S3_SESSION_TOKEN'] : null;
240242
return {
241243
accessKeyId: process.env['S3_ACCESS_KEY_ID'],
242244
secretAccessKey: process.env['S3_SECRET_KEY'],
243-
sessionToken: null,
245+
sessionToken: sessionToken,
244246
expiration: null
245247
};
246248
}

‎common/etc/nginx/nginx.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ load_module modules/ngx_http_xslt_filter_module.so;
1111
# Preserve S3 environment variables for worker threads
1212
env S3_ACCESS_KEY_ID;
1313
env S3_SECRET_KEY;
14+
env S3_SESSION_TOKEN;
1415
env S3_BUCKET_NAME;
1516
env S3_SERVER;
1617
env S3_SERVER_PORT;

‎docs/getting_started.md‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ running as a Container or as a Systemd service.
1919
| `AWS_SIGS_VERSION` | Yes | 2, 4 | | AWS Signatures API version |
2020
| `S3_ACCESS_KEY_ID` | Yes | | | Access key |
2121
| `S3_SECRET_KEY` | Yes | | | Secret access key |
22+
| `S3_SESSION_TOKEN` | No | | | Session token. |
2223
| `S3_BUCKET_NAME` | Yes | | | Name of S3 bucket to proxy requests to |
2324
| `S3_REGION` | Yes | | | Region associated with API |
2425
| `S3_SERVER_PORT` | Yes | | | SSL/TLS port to connect to |
@@ -39,7 +40,7 @@ running as a Container or as a Systemd service.
3940

4041

4142
If you are using [AWS instance profile credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html),
42-
you will need to omit the `S3_ACCESS_KEY_ID` and `S3_SECRET_KEY` variables from
43+
you will need to omit the `S3_ACCESS_KEY_ID`, `S3_SECRET_KEY` and `S3_SESSION_TOKEN` variables from
4344
the configuration.
4445

4546
When running with Docker, the above environment variables can be set in a file
@@ -210,8 +211,8 @@ docker run --env-file ./settings --publish 80:80 --name nginx-plus-s3-gateway \
210211
allow you to assign a role to a compute so that other AWS services can trust
211212
the instance without having to store authentication keys in the compute
212213
instance. This is useful for the gateway because it allows us to run the
213-
gateway without storing an unchanging `S3_ACCESS_KEY_ID` and `S3_SECRET_KEY`
214-
in a file on disk or in an easily read environment variable.
214+
gateway without storing an unchanging `S3_ACCESS_KEY_ID`, `S3_SECRET_KEY` and
215+
`S3_SESSION_TOKEN` in a file on disk or in an easily read environment variable.
215216

216217
Instance profiles work by providing credentials to the instance via the
217218
[AWS Metadata API](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html).
@@ -224,7 +225,7 @@ Following the [AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/User
224225
we can create a IAM role and launch an instance associated with it. On that
225226
instance, if we run the gateway as a Systemd service there are no additional
226227
steps. We just run the install script without specifying the
227-
`S3_ACCESS_KEY_ID` and `S3_SECRET_KEY` environment variables.
228+
`S3_ACCESS_KEY_ID`, `S3_SECRET_KEY` and `S3_SESSION_TOKEN` environment variables.
228229

229230
However, if we want to run the gateway as a container instance on that
230231
EC2 instance, then we will need to run the following command using the AWS
@@ -236,7 +237,7 @@ aws ec2 modify-instance-metadata-options --instance-id <instance id> \
236237
```
237238

238239
After that has been run we can start the container normally and omit the
239-
`S3_ACCESS_KEY_ID` and `S3_SECRET_KEY` environment variables.
240+
`S3_ACCESS_KEY_ID`, `S3_SECRET_KEY` and `S3_SESSION_TOKEN` environment variables.
240241

241242
### Running in ECS with an IAM Policy
242243

@@ -370,4 +371,4 @@ error_page 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 4
370371
```
371372

372373
### Error `403 Access Denied` for AWS Accounts with MFA Enabled
373-
The REST authentication method used in this container does not work with AWS IAM roles that have MFA enabled for authentication. Please use AWS IAM role credentials that do not have MFA enabled.
374+
The REST authentication method used in this container does not work with AWS IAM roles that have MFA enabled for authentication. Please use AWS IAM role credentials that do not have MFA enabled.

‎settings.example‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
S3_BUCKET_NAME=my-bucket
22
S3_ACCESS_KEY_ID=ZZZZZZZZZZZZZZZZZZZZ
33
S3_SECRET_KEY=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
4+
S3_SESSION_TOKEN=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
45
S3_SERVER=s3-us-east-1.amazonaws.com
56
S3_SERVER_PORT=443
67
S3_SERVER_PROTO=https

‎standalone_ubuntu_oss_install.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,10 @@ else
4444
uses_iam_creds=0
4545
fi
4646

47+
if [[ -v S3_SESSION_TOKEN ]]; then
48+
echo "S3 Session token present"
49+
fi
50+
4751
for name in ${required[@]}; do
4852
if [ -z ${!name+x} ]; then
4953
>&2 echo "Required ${name} environment variable missing"
@@ -182,6 +186,8 @@ if [ $uses_iam_creds -eq 0 ]; then
182186
S3_ACCESS_KEY_ID=${S3_ACCESS_KEY_ID}
183187
# AWS Secret access key
184188
S3_SECRET_KEY=${S3_SECRET_KEY}
189+
# AWS Session Token
190+
S3_SESSION_TOKEN=${S3_SESSION_TOKEN}
185191
EOF
186192
fi
187193

@@ -281,6 +287,7 @@ if [ $uses_iam_creds -eq 0 ]; then
281287
cat >> "/etc/nginx/environment" << EOF
282288
env S3_ACCESS_KEY_ID;
283289
env S3_SECRET_KEY;
290+
env S3_SESSION_TOKEN;
284291
EOF
285292
fi
286293

‎test.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -276,6 +276,7 @@ MSYS_NO_PATHCONV=1 "${docker_cmd}" run \
276276
-e "S3_STYLE=virtual" \
277277
-e "S3_ACCESS_KEY_ID=unit_test" \
278278
-e "S3_SECRET_KEY=unit_test" \
279+
-e "S3_SESSION_TOKEN=unit_test" \
279280
-e "S3_BUCKET_NAME=unit_test" \
280281
-e "S3_SERVER=unit_test" \
281282
-e "S3_SERVER_PROTO=https" \

‎test/unit/s3gateway_test.js‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -373,6 +373,7 @@ function testReadCredentialsWithAccessAndSecretKeySet() {
373373
let r = {};
374374
process.env['S3_ACCESS_KEY_ID'] = 'SOME_ACCESS_KEY';
375375
process.env['S3_SECRET_KEY'] = 'SOME_SECRET_KEY';
376+
process.env['S3_SESSION_TOKEN'] = 'SOME_SESSION_TOKEN';
376377

377378
try {
378379
var credentials = s3gateway.readCredentials(r);
@@ -382,7 +383,7 @@ function testReadCredentialsWithAccessAndSecretKeySet() {
382383
if (credentials.secretAccessKey !== process.env['S3_SECRET_KEY']) {
383384
throw 'static credentials do not match returned value [secretAccessKey]';
384385
}
385-
if (credentials.sessionToken !== null) {
386+
if (credentials.sessionToken !== process.env['S3_SESSION_TOKEN']) {
386387
throw 'static credentials do not match returned value [sessionToken]';
387388
}
388389
if (credentials.expiration !== null) {
@@ -392,6 +393,7 @@ function testReadCredentialsWithAccessAndSecretKeySet() {
392393
} finally {
393394
delete process.env.S3_ACCESS_KEY_ID;
394395
delete process.env.S3_SECRET_KEY;
396+
delete process.env.S3_SESSION_TOKEN;
395397
}
396398
}
397399

@@ -471,8 +473,10 @@ function testReadAndWriteCredentialsFromKeyValStore() {
471473

472474
let accessKeyId = process.env['S3_ACCESS_KEY_ID'];
473475
let secretKey = process.env['S3_SECRET_KEY'];
476+
let sessionToken = process.env['S3_SESSION_TOKEN'];
474477
delete process.env.S3_ACCESS_KEY_ID;
475478
delete process.env.S3_SECRET_KEY;
479+
delete process.env.S3_SESSION_TOKEN
476480

477481
try {
478482
let r = {
@@ -500,6 +504,7 @@ function testReadAndWriteCredentialsFromKeyValStore() {
500504
} finally {
501505
process.env['S3_ACCESS_KEY_ID'] = accessKeyId;
502506
process.env['S3_SECRET_KEY'] = secretKey;
507+
process.env['S3_SESSION_TOKEN'] = sessionToken;
503508
}
504509
}
505510

0 commit comments

Comments
 (0)