AWS S3 Use IAM Cretendials when possible.

Author: ggallotti

gxexternalproviders/src/main/java/com/genexus/db/driver/ExternalProviderS3.java

@@ -1,5 +1,6 @@
 package com.genexus.db.driver;
 
+import com.amazonaws.auth.*;
 import com.amazonaws.client.builder.AwsClientBuilder;
 import com.amazonaws.services.s3.model.*;
 import com.amazonaws.services.s3.AmazonS3ClientBuilder;
@@ -14,9 +15,7 @@
 import java.io.File;
 import java.io.InputStream;
 import java.io.ByteArrayInputStream;
-import com.amazonaws.auth.AWSCredentials;
-import com.amazonaws.auth.BasicAWSCredentials;
-import com.amazonaws.auth.AWSStaticCredentialsProvider;
+
 import com.amazonaws.services.s3.AmazonS3;
 import com.amazonaws.services.s3.AmazonS3Client;
 import com.amazonaws.util.IOUtils;
@@ -41,6 +40,7 @@ public class ExternalProviderS3 extends ExternalProviderBase implements External
 	static final String STORAGE_ENDPOINT = "ENDPOINT";
 	static final String BUCKET = "BUCKET_NAME";
 	static final String REGION = "REGION";
+	static final String USE_IAM = "USE_IAM";
 
 	//Keep it for compatibility reasons
 	@Deprecated
@@ -90,8 +90,8 @@ public ExternalProviderS3(GXService providerService) throws Exception{
     }
 
 	private void initialize() throws Exception{
-		String accessKey = getEncryptedPropertyValue(ACCESS_KEY, ACCESS_KEY_ID_DEPRECATED);
-		String secretKey = getEncryptedPropertyValue(SECRET_ACCESS_KEY, SECRET_ACCESS_KEY_DEPRECATED);
+		String accessKey = getEncryptedPropertyValue(ACCESS_KEY, ACCESS_KEY_ID_DEPRECATED, "");
+		String secretKey = getEncryptedPropertyValue(SECRET_ACCESS_KEY, SECRET_ACCESS_KEY_DEPRECATED, "");
 		String bucket = getEncryptedPropertyValue(BUCKET, BUCKET_DEPRECATED);
 		String folder = getPropertyValue(FOLDER, FOLDER_DEPRECATED, "");
 		String region = getPropertyValue(REGION, REGION_DEPRECATED, DEFAULT_REGION);
@@ -109,19 +109,28 @@ private void initialize() throws Exception{
 			if (region.length() == 0) {
 				region = DEFAULT_REGION;
 			}
+
 			this.bucket = bucket;
 			this.folder = folder;
-			this.client = buildS3Client(accessKey, secretKey, endpointValue, region);
 
+			this.client = buildS3Client(accessKey, secretKey, endpointValue, region);
 			bucketExists();
 			ensureFolder(folder);
 		}
 	}
 
 	private AmazonS3 buildS3Client(String accessKey, String secretKey, String endpoint, String region) {
 		AmazonS3 s3Client;
-		AWSCredentials credentials = new BasicAWSCredentials(accessKey, secretKey);
-		AmazonS3ClientBuilder builder = AmazonS3ClientBuilder.standard().withCredentials(new AWSStaticCredentialsProvider(credentials));
+
+		boolean bUseIAM = !getPropertyValue(USE_IAM, "", "").isEmpty() || (accessKey.equals("") && secretKey.equals(""));
+
+		AmazonS3ClientBuilder builder = bUseIAM ?
+							AmazonS3ClientBuilder.standard():
+							AmazonS3ClientBuilder.standard().withCredentials(new AWSStaticCredentialsProvider(new BasicAWSCredentials(accessKey, secretKey)));
+
+		if (bUseIAM) {
+			logger.debug("Using IAM Credentials");
+		}
 
 		if (endpoint.length() > 0 && !endpoint.contains(".amazonaws.com")) {
 			pathStyleUrls = true;