From a4e5b5315e1f734d54fdaa53cda64ff6bd40f7a5 Mon Sep 17 00:00:00 2001 From: Administrator Date: Sat, 6 Jun 2020 01:17:40 +0900 Subject: [PATCH] add webidentity iam authentication --- S3/Config.py | 56 +++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 42 insertions(+), 14 deletions(-) diff --git a/S3/Config.py b/S3/Config.py index c99b9f206..6242fb347 100644 --- a/S3/Config.py +++ b/S3/Config.py @@ -15,6 +15,9 @@ import io import sys import json +import time +import urllib.parse +import xml.etree.cElementTree from . import Progress from .SortedDict import SortedDict try: @@ -268,23 +271,48 @@ def role_config(self): Get credentials from IAM authentication """ try: - conn = httplib.HTTPConnection(host='169.254.169.254', timeout = 2) - conn.request('GET', "/latest/meta-data/iam/security-credentials/") - resp = conn.getresponse() - files = resp.read() - if resp.status == 200 and len(files)>1: - conn.request('GET', "/latest/meta-data/iam/security-credentials/%s" % files.decode('utf-8')) - resp=conn.getresponse() - if resp.status == 200: - resp_content = config_unicodise(resp.read()) - creds=json.loads(resp_content) - Config().update_option('access_key', config_unicodise(creds['AccessKeyId'])) - Config().update_option('secret_key', config_unicodise(creds['SecretAccessKey'])) - Config().update_option('access_token', config_unicodise(creds['Token'])) + role_arn = os.environ.get('AWS_ROLE_ARN') + web_identity_token_file = os.environ.get('AWS_WEB_IDENTITY_TOKEN_FILE') + role_session_name = 'role-session-%s' % (int(time.time())) + if web_identity_token_file: + with open(web_identity_token_file) as f: + web_identity_token = f.read() + params = { + "Action": "AssumeRoleWithWebIdentity", + "Version": "2011-06-15", + "RoleArn": role_arn, + "RoleSessionName": role_session_name, + "WebIdentityToken": web_identity_token + } + conn = httplib.HTTPSConnection(host='sts.amazonaws.com', timeout = 2) + conn.request('POST', '/?' + urllib.parse.urlencode(params)) + resp = conn.getresponse() + files = resp.read() + if resp.status == 200 and len(files)>1: + creds = parse_xml_to_dict(files) + Config().update_option('access_key', creds['AssumeRoleWithWebIdentityResult']['Credentials']['AccessKeyId']) + Config().update_option('secret_key', creds['AssumeRoleWithWebIdentityResult']['Credentials']['SecretAccessKey']) + Config().update_option('access_token', creds['AssumeRoleWithWebIdentityResult']['Credentials']['SessionToken']) else: raise IOError else: - raise IOError + conn = httplib.HTTPConnection(host='169.254.169.254', timeout = 2) + conn.request('GET', "/latest/meta-data/iam/security-credentials/") + resp = conn.getresponse() + files = resp.read() + if resp.status == 200 and len(files)>1: + conn.request('GET', "/latest/meta-data/iam/security-credentials/%s" % files.decode('utf-8')) + resp=conn.getresponse() + if resp.status == 200: + resp_content = config_unicodise(resp.read()) + creds=json.loads(resp_content) + Config().update_option('access_key', config_unicodise(creds['AccessKeyId'])) + Config().update_option('secret_key', config_unicodise(creds['SecretAccessKey'])) + Config().update_option('access_token', config_unicodise(creds['Token'])) + else: + raise IOError + else: + raise IOError except: raise