forked from aws/amazon-ecs-agent
/
ec2_metadata_client.go
140 lines (120 loc) · 4.79 KB
/
ec2_metadata_client.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
// Copyright 2014-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License"). You may
// not use this file except in compliance with the License. A copy of the
// License is located at
//
// http://aws.amazon.com/apache2.0/
//
// or in the "license" file accompanying this file. This file is distributed
// on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
// express or implied. See the License for the specific language governing
// permissions and limitations under the License.
package ec2
import (
"encoding/json"
"errors"
"fmt"
"strings"
"time"
"github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/ec2metadata"
"github.com/aws/aws-sdk-go/aws/session"
)
const (
SecurityCrednetialsResource = "iam/security-credentials/"
InstanceIdentityDocumentResource = "instance-identity/document"
InstanceIdentityDocumentSignatureResource = "instance-identity/signature"
MacResource = "mac"
VPCIDResourceFormat = "network/interfaces/macs/%s/vpc-id"
SubnetIDResourceFormat = "network/interfaces/macs/%s/subnet-id"
)
const (
metadataRetries = 5
)
// RoleCredentials contains the information associated with an IAM role
type RoleCredentials struct {
Code string `json:"Code"`
LastUpdated time.Time `json:"LastUpdated"`
Type string `json:"Type"`
AccessKeyId string `json:"AccessKeyId"`
SecretAccessKey string `json:"SecretAccessKey"`
Token string `json:"Token"`
Expiration time.Time `json:"Expiration"`
}
type HttpClient interface {
GetMetadata(string) (string, error)
GetDynamicData(string) (string, error)
GetInstanceIdentityDocument() (ec2metadata.EC2InstanceIdentityDocument, error)
}
// EC2MetadataClient is the client used to get metadata from instance metadata service
type EC2MetadataClient interface {
DefaultCredentials() (*RoleCredentials, error)
GetMetadata(string) (string, error)
GetDynamicData(string) (string, error)
InstanceIdentityDocument() (ec2metadata.EC2InstanceIdentityDocument, error)
VPCID(mac string) (string, error)
SubnetID(mac string) (string, error)
PrimaryENIMAC() (string, error)
}
type ec2MetadataClientImpl struct {
client HttpClient
}
// NewEC2MetadataClient creates an ec2metadata client to retrieve metadata
func NewEC2MetadataClient(client HttpClient) EC2MetadataClient {
if client == nil {
return &ec2MetadataClientImpl{client: ec2metadata.New(session.New(), aws.NewConfig().WithMaxRetries(metadataRetries))}
} else {
return &ec2MetadataClientImpl{client: client}
}
}
// DefaultCredentials returns the credentials associated with the instance iam role
func (c *ec2MetadataClientImpl) DefaultCredentials() (*RoleCredentials, error) {
securityCredential, err := c.client.GetMetadata(SecurityCrednetialsResource)
if err != nil {
return nil, err
}
securityCredentialList := strings.Split(strings.TrimSpace(securityCredential), "\n")
if len(securityCredentialList) == 0 {
return nil, errors.New("No security credentials in response")
}
defaultCredentialName := securityCredentialList[0]
defaultCredentialStr, err := c.client.GetMetadata(SecurityCrednetialsResource + defaultCredentialName)
if err != nil {
return nil, err
}
var credential RoleCredentials
err = json.Unmarshal([]byte(defaultCredentialStr), &credential)
if err != nil {
return nil, err
}
return &credential, nil
}
// GetDynamicData returns the dynamic data with provided path from instance metadata
func (c *ec2MetadataClientImpl) GetDynamicData(path string) (string, error) {
return c.client.GetDynamicData(path)
}
// InstanceIdentityDocument returns instance identity documents
// http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html
func (c *ec2MetadataClientImpl) InstanceIdentityDocument() (ec2metadata.EC2InstanceIdentityDocument, error) {
return c.client.GetInstanceIdentityDocument()
}
// GetMetadata returns the metadata from instance metadata service specified by the path
func (c *ec2MetadataClientImpl) GetMetadata(path string) (string, error) {
return c.client.GetMetadata(path)
}
// PrimaryENIMAC returns the MAC address for the primary
// network interface of the instance
func (c *ec2MetadataClientImpl) PrimaryENIMAC() (string, error) {
return c.client.GetMetadata(MacResource)
}
// VPCID returns the VPC id for the network interface, given
// its mac address
func (c *ec2MetadataClientImpl) VPCID(mac string) (string, error) {
return c.client.GetMetadata(fmt.Sprintf(VPCIDResourceFormat, mac))
}
// SubnetID returns the subnet id for the network interface,
// given its mac address
func (c *ec2MetadataClientImpl) SubnetID(mac string) (string, error) {
return c.client.GetMetadata(fmt.Sprintf(SubnetIDResourceFormat, mac))
}