Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-05-25 12:27
📄 assume_role_provider.go /* Package stscreds are credential Providers to retrieve STS AWS credentials. STS provides multiple ways to retrieve credentials which can be used when making future AWS service API operation calls. The SDK will ensure that per instance of credentials.Credentials all requests to refresh the credentials will be synchronized. But, the SDK is unable to ensure synchronous usage of the AssumeRoleProvider if the value is shared between multiple Credentials, Sessions or service clients. # Assume Role To assume an IAM role using STS with the SDK you can create a new Credentials with the SDKs's stscreds package. // Initial credentials loaded from SDK's default credential chain. Such as // the environment, shared credentials (~/.aws/credentials), or EC2 Instance // Role. These credentials will be used to to make the STS Assume Role API. sess := session.Must(session.NewSession()) // Create the credentials from AssumeRoleProvider to assume the role // referenced by the "myRoleARN" ARN. creds := stscreds.NewCredentials(sess, "myRoleArn") // Create service client value configured for credentials // from assumed role. svc := s3.New(sess, &aws.Config{Credentials: creds}) # Assume Role with static MFA Token To assume an IAM role with a MFA token you can either specify a MFA token code directly or provide a function to prompt the user each time the credentials need to refresh the role's credentials. Specifying the TokenCode should be used for short lived operations that will not need to be refreshed, and when you do not want to have direct control over the user provides their MFA token. With TokenCode the AssumeRoleProvider will be not be able to refresh the role's credentials. // Create the credentials from AssumeRoleProvider to assume the role // referenced by the "myRoleARN" ARN using the MFA token code provided. creds := stscreds.NewCredentials(sess, "myRoleArn", func(p stscreds.AssumeRoleProvider) { p.SerialNumber = aws.String("myTokenSerialNumber") p.TokenCode = aws.String("00000000") }) // Create service client value configured for credentials // from assumed role. svc := s3.New(sess, &aws.Config{Credentials: creds}) # Assume Role with MFA Token Provider To assume an IAM role with MFA for longer running tasks where the credentials may need to be refreshed setting the TokenProvider field of AssumeRoleProvider will allow the credential provider to prompt for new MFA token code when the role's credentials need to be refreshed. The StdinTokenProvider function is available to prompt on stdin to retrieve the MFA token code from the user. You can also implement custom prompts by satisfing the TokenProvider function signature. Using StdinTokenProvider with multiple AssumeRoleProviders, or Credentials will have undesirable results as the StdinTokenProvider will not be synchronized. A single Credentials with an AssumeRoleProvider can be shared safely. // Create the credentials from AssumeRoleProvider to assume the role // referenced by the "myRoleARN" ARN. Prompting for MFA token from stdin. creds := stscreds.NewCredentials(sess, "myRoleArn", func(p stscreds.AssumeRoleProvider) { p.SerialNumber = aws.String("myTokenSerialNumber") p.TokenProvider = stscreds.StdinTokenProvider }) // Create service client value configured for credentials // from assumed role. svc := s3.New(sess, &aws.Config{Credentials: creds}) / package stscreds import ( "fmt" "os" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/client" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/internal/sdkrand" "github.com/aws/aws-sdk-go/service/sts" ) // StdinTokenProvider will prompt on stderr and read from stdin for a string value. // An error is returned if reading from stdin fails. // // Use this function to read MFA tokens from stdin. The function makes no attempt // to make atomic prompts from stdin across multiple gorouties. // // Using StdinTokenProvider with multiple AssumeRoleProviders, or Credentials will // have undesirable results as the StdinTokenProvider will not be synchronized. A // single Credentials with an AssumeRoleProvider can be shared safely // // Will wait forever until something is provided on the stdin. func StdinTokenProvider() (string, error) { var v string fmt.Fprintf(os.Stderr, "Assume Role MFA token code: ") _, err := fmt.Scanln(&v) return v, err } // ProviderName provides a name of AssumeRole provider const ProviderName = "AssumeRoleProvider" // AssumeRoler represents the minimal subset of the STS client API used by this provider. type AssumeRoler interface { AssumeRole(input sts.AssumeRoleInput) (sts.AssumeRoleOutput, error) } type assumeRolerWithContext interface { AssumeRoleWithContext(aws.Context, sts.AssumeRoleInput, ...request.Option) (sts.AssumeRoleOutput, error) } // DefaultDuration is the default amount of time in minutes that the credentials // will be valid for. var DefaultDuration = time.Duration(15) time.Minute // AssumeRoleProvider retrieves temporary credentials from the STS service, and // keeps track of their expiration time. // // This credential provider will be used by the SDKs default credential change // when shared configuration is enabled, and the shared config or shared credentials // file configure assume role. See Session docs for how to do this. // // AssumeRoleProvider does not provide any synchronization and it is not safe // to share this value across multiple Credentials, Sessions, or service clients // without also sharing the same Credentials instance. type AssumeRoleProvider struct { credentials.Expiry // STS client to make assume role request with. Client AssumeRoler // Role to be assumed. RoleARN string // Session name, if you wish to reuse the credentials elsewhere. RoleSessionName string // Optional, you can pass tag key-value pairs to your session. These tags are called session tags. Tags []sts.Tag // A list of keys for session tags that you want to set as transitive. // If you set a tag key as transitive, the corresponding key and value passes to subsequent sessions in a role chain. TransitiveTagKeys []string // Expiry duration of the STS credentials. Defaults to 15 minutes if not set. Duration time.Duration // Optional ExternalID to pass along, defaults to nil if not set. ExternalID string // The policy plain text must be 2048 bytes or shorter. However, an internal // conversion compresses it into a packed binary format with a separate limit. // The PackedPolicySize response element indicates by percentage how close to // the upper size limit the policy is, with 100% equaling the maximum allowed // size. Policy string // The ARNs of IAM managed policies you want to use as managed session policies. // The policies must exist in the same account as the role. // // This parameter is optional. You can provide up to 10 managed policy ARNs. // However, the plain text that you use for both inline and managed session // policies can't exceed 2,048 characters. // // An AWS conversion compresses the passed session policies and session tags // into a packed binary format that has a separate limit. Your request can fail // for this limit even if your plain text meets the other requirements. The // PackedPolicySize response element indicates by percentage how close the policies // and tags for your request are to the upper size limit. // // Passing policies to this operation returns new temporary credentials. The // resulting session's permissions are the intersection of the role's identity-based // policy and the session policies. You can use the role's temporary credentials // in subsequent AWS API calls to access resources in the account that owns // the role. You cannot use session policies to grant more permissions than // those allowed by the identity-based policy of the role that is being assumed. // For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) // in the IAM User Guide. PolicyArns []sts.PolicyDescriptorType // The identification number of the MFA device that is associated with the user // who is making the AssumeRole call. Specify this value if the trust policy // of the role being assumed includes a condition that requires MFA authentication. // The value is either the serial number for a hardware device (such as GAHT12345678) // or an Amazon Resource Name (ARN) for a virtual device (such as arn:aws:iam::123456789012:mfa/user). SerialNumber string // The SourceIdentity which is used to identity a persistent identity through the whole session. // For more details see https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html SourceIdentity string // The value provided by the MFA device, if the trust policy of the role being // assumed requires MFA (that is, if the policy includes a condition that tests // for MFA). If the role being assumed requires MFA and if the TokenCode value // is missing or expired, the AssumeRole call returns an "access denied" error. // // If SerialNumber is set and neither TokenCode nor TokenProvider are also // set an error will be returned. TokenCode string // Async method of providing MFA token code for assuming an IAM role with MFA. // The value returned by the function will be used as the TokenCode in the Retrieve // call. See StdinTokenProvider for a provider that prompts and reads from stdin. // // This token provider will be called when ever the assumed role's // credentials need to be refreshed when SerialNumber is also set and // TokenCode is not set. // // If both TokenCode and TokenProvider is set, TokenProvider will be used and // TokenCode is ignored. TokenProvider func() (string, error) // ExpiryWindow will allow the credentials to trigger refreshing prior to // the credentials actually expiring. This is beneficial so race conditions // with expiring credentials do not cause request to fail unexpectedly // due to ExpiredTokenException exceptions. // // So a ExpiryWindow of 10s would cause calls to IsExpired() to return true // 10 seconds before the credentials are actually expired. // // If ExpiryWindow is 0 or less it will be ignored. ExpiryWindow time.Duration // MaxJitterFrac reduces the effective Duration of each credential requested // by a random percentage between 0 and MaxJitterFraction. MaxJitterFrac must // have a value between 0 and 1. Any other value may lead to expected behavior. // With a MaxJitterFrac value of 0, default) will no jitter will be used. // // For example, with a Duration of 30m and a MaxJitterFrac of 0.1, the // AssumeRole call will be made with an arbitrary Duration between 27m and // 30m. // // MaxJitterFrac should not be negative. MaxJitterFrac float64 } // NewCredentials returns a pointer to a new Credentials value wrapping the // AssumeRoleProvider. The credentials will expire every 15 minutes and the // role will be named after a nanosecond timestamp of this operation. The // Credentials value will attempt to refresh the credentials using the provider // when Credentials.Get is called, if the cached credentials are expiring. // // Takes a Config provider to create the STS client. The ConfigProvider is // satisfied by the session.Session type. // // It is safe to share the returned Credentials with multiple Sessions and // service clients. All access to the credentials and refreshing them // will be synchronized. func NewCredentials(c client.ConfigProvider, roleARN string, options ...func(AssumeRoleProvider)) credentials.Credentials { p := &AssumeRoleProvider{ Client: sts.New(c), RoleARN: roleARN, Duration: DefaultDuration, } for _, option := range options { option(p) } return credentials.NewCredentials(p) } // NewCredentialsWithClient returns a pointer to a new Credentials value wrapping the // AssumeRoleProvider. The credentials will expire every 15 minutes and the // role will be named after a nanosecond timestamp of this operation. The // Credentials value will attempt to refresh the credentials using the provider // when Credentials.Get is called, if the cached credentials are expiring. // // Takes an AssumeRoler which can be satisfied by the STS client. // // It is safe to share the returned Credentials with multiple Sessions and // service clients. All access to the credentials and refreshing them // will be synchronized. func NewCredentialsWithClient(svc AssumeRoler, roleARN string, options ...func(AssumeRoleProvider)) credentials.Credentials { p := &AssumeRoleProvider{ Client: svc, RoleARN: roleARN, Duration: DefaultDuration, } for _, option := range options { option(p) } return credentials.NewCredentials(p) } // Retrieve generates a new set of temporary credentials using STS. func (p AssumeRoleProvider) Retrieve() (credentials.Value, error) { return p.RetrieveWithContext(aws.BackgroundContext()) } // RetrieveWithContext generates a new set of temporary credentials using STS. func (p AssumeRoleProvider) RetrieveWithContext(ctx credentials.Context) (credentials.Value, error) { // Apply defaults where parameters are not set. if p.RoleSessionName == "" { // Try to work out a role name that will hopefully end up unique. p.RoleSessionName = fmt.Sprintf("%d", time.Now().UTC().UnixNano()) } if p.Duration == 0 { // Expire as often as AWS permits. p.Duration = DefaultDuration } jitter := time.Duration(sdkrand.SeededRand.Float64() * p.MaxJitterFrac * float64(p.Duration)) input := &sts.AssumeRoleInput{ DurationSeconds: aws.Int64(int64((p.Duration - jitter) / time.Second)), RoleArn: aws.String(p.RoleARN), RoleSessionName: aws.String(p.RoleSessionName), ExternalId: p.ExternalID, Tags: p.Tags, PolicyArns: p.PolicyArns, TransitiveTagKeys: p.TransitiveTagKeys, SourceIdentity: p.SourceIdentity, } if p.Policy != nil { input.Policy = p.Policy } if p.SerialNumber != nil { if p.TokenCode != nil { input.SerialNumber = p.SerialNumber input.TokenCode = p.TokenCode } else if p.TokenProvider != nil { input.SerialNumber = p.SerialNumber code, err := p.TokenProvider() if err != nil { return credentials.Value{ProviderName: ProviderName}, err } input.TokenCode = aws.String(code) } else { return credentials.Value{ProviderName: ProviderName}, awserr.New("AssumeRoleTokenNotAvailable", "assume role with MFA enabled, but neither TokenCode nor TokenProvider are set", nil) } } var roleOutput sts.AssumeRoleOutput var err error if c, ok := p.Client.(assumeRolerWithContext); ok { roleOutput, err = c.AssumeRoleWithContext(ctx, input) } else { roleOutput, err = p.Client.AssumeRole(input) } if err != nil { return credentials.Value{ProviderName: ProviderName}, err } // We will proactively generate new credentials before they expire. p.SetExpiration(roleOutput.Credentials.Expiration, p.ExpiryWindow) return credentials.Value{ AccessKeyID: roleOutput.Credentials.AccessKeyId, SecretAccessKey: roleOutput.Credentials.SecretAccessKey, SessionToken: *roleOutput.Credentials.SessionToken, ProviderName: ProviderName, }, nil }	15.05 KB	2025-05-25 12:27
📄 assume_role_provider_test.go package stscreds import ( "fmt" "testing" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/service/sts" ) type stubSTS struct { TestInput func(sts.AssumeRoleInput) } func (s stubSTS) AssumeRole(input sts.AssumeRoleInput) (sts.AssumeRoleOutput, error) { if s.TestInput != nil { s.TestInput(input) } expiry := time.Now().Add(60 * time.Minute) return &sts.AssumeRoleOutput{ Credentials: &sts.Credentials{ // Just reflect the role arn to the provider. AccessKeyId: input.RoleArn, SecretAccessKey: aws.String("assumedSecretAccessKey"), SessionToken: aws.String("assumedSessionToken"), Expiration: &expiry, }, }, nil } type stubSTSWithContext struct { stubSTS called chan struct{} } func (s stubSTSWithContext) AssumeRoleWithContext(context credentials.Context, input sts.AssumeRoleInput, option ...request.Option) (sts.AssumeRoleOutput, error) { <-s.called return s.stubSTS.AssumeRole(input) } func TestAssumeRoleProvider(t testing.T) { stub := &stubSTS{} p := &AssumeRoleProvider{ Client: stub, RoleARN: "roleARN", } creds, err := p.Retrieve() if err != nil { t.Errorf("expect nil, got %v", err) } if e, a := "roleARN", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "assumedSecretAccessKey", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "assumedSessionToken", creds.SessionToken; e != a { t.Errorf("expect %v, got %v", e, a) } } func TestAssumeRoleProvider_WithTokenCode(t testing.T) { stub := &stubSTS{ TestInput: func(in sts.AssumeRoleInput) { if e, a := "0123456789", in.SerialNumber; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "code", in.TokenCode; e != a { t.Errorf("expect %v, got %v", e, a) } }, } p := &AssumeRoleProvider{ Client: stub, RoleARN: "roleARN", SerialNumber: aws.String("0123456789"), TokenCode: aws.String("code"), } creds, err := p.Retrieve() if err != nil { t.Errorf("expect nil, got %v", err) } if e, a := "roleARN", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "assumedSecretAccessKey", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "assumedSessionToken", creds.SessionToken; e != a { t.Errorf("expect %v, got %v", e, a) } } func TestAssumeRoleProvider_WithTokenProvider(t testing.T) { stub := &stubSTS{ TestInput: func(in sts.AssumeRoleInput) { if e, a := "0123456789", in.SerialNumber; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "code", in.TokenCode; e != a { t.Errorf("expect %v, got %v", e, a) } }, } p := &AssumeRoleProvider{ Client: stub, RoleARN: "roleARN", SerialNumber: aws.String("0123456789"), TokenProvider: func() (string, error) { return "code", nil }, } creds, err := p.Retrieve() if err != nil { t.Errorf("expect nil, got %v", err) } if e, a := "roleARN", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "assumedSecretAccessKey", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "assumedSessionToken", creds.SessionToken; e != a { t.Errorf("expect %v, got %v", e, a) } } func TestAssumeRoleProvider_WithTokenProviderError(t testing.T) { stub := &stubSTS{ TestInput: func(in sts.AssumeRoleInput) { t.Errorf("API request should not of been called") }, } p := &AssumeRoleProvider{ Client: stub, RoleARN: "roleARN", SerialNumber: aws.String("0123456789"), TokenProvider: func() (string, error) { return "", fmt.Errorf("error occurred") }, } creds, err := p.Retrieve() if err == nil { t.Errorf("expect error") } if v := creds.AccessKeyID; len(v) != 0 { t.Errorf("expect empty, got %v", v) } if v := creds.SecretAccessKey; len(v) != 0 { t.Errorf("expect empty, got %v", v) } if v := creds.SessionToken; len(v) != 0 { t.Errorf("expect empty, got %v", v) } } func TestAssumeRoleProvider_MFAWithNoToken(t testing.T) { stub := &stubSTS{ TestInput: func(in sts.AssumeRoleInput) { t.Errorf("API request should not of been called") }, } p := &AssumeRoleProvider{ Client: stub, RoleARN: "roleARN", SerialNumber: aws.String("0123456789"), } creds, err := p.Retrieve() if err == nil { t.Errorf("expect error") } if v := creds.AccessKeyID; len(v) != 0 { t.Errorf("expect empty, got %v", v) } if v := creds.SecretAccessKey; len(v) != 0 { t.Errorf("expect empty, got %v", v) } if v := creds.SessionToken; len(v) != 0 { t.Errorf("expect empty, got %v", v) } } func BenchmarkAssumeRoleProvider(b testing.B) { stub := &stubSTS{} p := &AssumeRoleProvider{ Client: stub, RoleARN: "roleARN", } b.ResetTimer() for i := 0; i < b.N; i++ { if _, err := p.Retrieve(); err != nil { b.Fatal(err) } } } func TestAssumeRoleProvider_WithTags(t testing.T) { stub := &stubSTS{ TestInput: func(in sts.AssumeRoleInput) { if in.TransitiveTagKeys[0] != "TagName" { t.Errorf("TransitiveTagKeys not passed along") } if in.Tags[0].Key != "TagName" \|\| in.Tags[0].Value != "TagValue" { t.Errorf("Tags not passed along") } }, } p := &AssumeRoleProvider{ Client: stub, RoleARN: "roleARN", Tags: []sts.Tag{ { Key: aws.String("TagName"), Value: aws.String("TagValue"), }, }, TransitiveTagKeys: []string{aws.String("TagName")}, } _, err := p.Retrieve() if err != nil { t.Errorf("expect error") } } func TestAssumeRoleProvider_RetrieveWithContext(t *testing.T) { stub := &stubSTSWithContext{ called: make(chan struct{}), } p := &AssumeRoleProvider{ Client: stub, RoleARN: "roleARN", } go func() { stub.called <- struct{}{} }() creds, err := p.RetrieveWithContext(aws.BackgroundContext()) if err != nil { t.Errorf("expect nil, got %v", err) } if e, a := "roleARN", creds.AccessKeyID; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "assumedSecretAccessKey", creds.SecretAccessKey; e != a { t.Errorf("expect %v, got %v", e, a) } if e, a := "assumedSessionToken", creds.SessionToken; e != a { t.Errorf("expect %v, got %v", e, a) } }	6.18 KB	2025-05-25 12:27
📁 testdata	-	2025-05-25 12:27
📄 web_identity_provider.go package stscreds import ( "fmt" "io/ioutil" "strconv" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/client" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/service/sts" "github.com/aws/aws-sdk-go/service/sts/stsiface" ) const ( // ErrCodeWebIdentity will be used as an error code when constructing // a new error to be returned during session creation or retrieval. ErrCodeWebIdentity = "WebIdentityErr" // WebIdentityProviderName is the web identity provider name WebIdentityProviderName = "WebIdentityCredentials" ) // now is used to return a time.Time object representing // the current time. This can be used to easily test and // compare test values. var now = time.Now // TokenFetcher should return WebIdentity token bytes or an error type TokenFetcher interface { FetchToken(credentials.Context) ([]byte, error) } // FetchTokenPath is a path to a WebIdentity token file type FetchTokenPath string // FetchToken returns a token by reading from the filesystem func (f FetchTokenPath) FetchToken(ctx credentials.Context) ([]byte, error) { data, err := ioutil.ReadFile(string(f)) if err != nil { errMsg := fmt.Sprintf("unable to read file at %s", f) return nil, awserr.New(ErrCodeWebIdentity, errMsg, err) } return data, nil } // WebIdentityRoleProvider is used to retrieve credentials using // an OIDC token. type WebIdentityRoleProvider struct { credentials.Expiry // The policy ARNs to use with the web identity assumed role. PolicyArns []sts.PolicyDescriptorType // Duration the STS credentials will be valid for. Truncated to seconds. // If unset, the assumed role will use AssumeRoleWithWebIdentity's default // expiry duration. See // https://docs.aws.amazon.com/sdk-for-go/api/service/sts/#STS.AssumeRoleWithWebIdentity // for more information. Duration time.Duration // The amount of time the credentials will be refreshed before they expire. // This is useful refresh credentials before they expire to reduce risk of // using credentials as they expire. If unset, will default to no expiry // window. ExpiryWindow time.Duration client stsiface.STSAPI tokenFetcher TokenFetcher roleARN string roleSessionName string } // NewWebIdentityCredentials will return a new set of credentials with a given // configuration, role arn, and token file path. // // Deprecated: Use NewWebIdentityRoleProviderWithOptions for flexible // functional options, and wrap with credentials.NewCredentials helper. func NewWebIdentityCredentials(c client.ConfigProvider, roleARN, roleSessionName, path string) credentials.Credentials { svc := sts.New(c) p := NewWebIdentityRoleProvider(svc, roleARN, roleSessionName, path) return credentials.NewCredentials(p) } // NewWebIdentityRoleProvider will return a new WebIdentityRoleProvider with the // provided stsiface.STSAPI // // Deprecated: Use NewWebIdentityRoleProviderWithOptions for flexible // functional options. func NewWebIdentityRoleProvider(svc stsiface.STSAPI, roleARN, roleSessionName, path string) WebIdentityRoleProvider { return NewWebIdentityRoleProviderWithOptions(svc, roleARN, roleSessionName, FetchTokenPath(path)) } // NewWebIdentityRoleProviderWithToken will return a new WebIdentityRoleProvider with the // provided stsiface.STSAPI and a TokenFetcher // // Deprecated: Use NewWebIdentityRoleProviderWithOptions for flexible // functional options. func NewWebIdentityRoleProviderWithToken(svc stsiface.STSAPI, roleARN, roleSessionName string, tokenFetcher TokenFetcher) WebIdentityRoleProvider { return NewWebIdentityRoleProviderWithOptions(svc, roleARN, roleSessionName, tokenFetcher) } // NewWebIdentityRoleProviderWithOptions will return an initialize // WebIdentityRoleProvider with the provided stsiface.STSAPI, role ARN, and a // TokenFetcher. Additional options can be provided as functional options. // // TokenFetcher is the implementation that will retrieve the JWT token from to // assume the role with. Use the provided FetchTokenPath implementation to // retrieve the JWT token using a file system path. func NewWebIdentityRoleProviderWithOptions(svc stsiface.STSAPI, roleARN, roleSessionName string, tokenFetcher TokenFetcher, optFns ...func(WebIdentityRoleProvider)) WebIdentityRoleProvider { p := WebIdentityRoleProvider{ client: svc, tokenFetcher: tokenFetcher, roleARN: roleARN, roleSessionName: roleSessionName, } for _, fn := range optFns { fn(&p) } return &p } // Retrieve will attempt to assume a role from a token which is located at // 'WebIdentityTokenFilePath' specified destination and if that is empty an // error will be returned. func (p WebIdentityRoleProvider) Retrieve() (credentials.Value, error) { return p.RetrieveWithContext(aws.BackgroundContext()) } // RetrieveWithContext will attempt to assume a role from a token which is // located at 'WebIdentityTokenFilePath' specified destination and if that is // empty an error will be returned. func (p WebIdentityRoleProvider) RetrieveWithContext(ctx credentials.Context) (credentials.Value, error) { b, err := p.tokenFetcher.FetchToken(ctx) if err != nil { return credentials.Value{}, awserr.New(ErrCodeWebIdentity, "failed fetching WebIdentity token: ", err) } sessionName := p.roleSessionName if len(sessionName) == 0 { // session name is used to uniquely identify a session. This simply // uses unix time in nanoseconds to uniquely identify sessions. sessionName = strconv.FormatInt(now().UnixNano(), 10) } var duration *int64 if p.Duration != 0 { duration = aws.Int64(int64(p.Duration / time.Second)) } req, resp := p.client.AssumeRoleWithWebIdentityRequest(&sts.AssumeRoleWithWebIdentityInput{ PolicyArns: p.PolicyArns, RoleArn: &p.roleARN, RoleSessionName: &sessionName, WebIdentityToken: aws.String(string(b)), DurationSeconds: duration, }) req.SetContext(ctx) // InvalidIdentityToken error is a temporary error that can occur // when assuming an Role with a JWT web identity token. req.RetryErrorCodes = append(req.RetryErrorCodes, sts.ErrCodeInvalidIdentityTokenException) if err := req.Send(); err != nil { return credentials.Value{}, awserr.New(ErrCodeWebIdentity, "failed to retrieve credentials", err) } p.SetExpiration(aws.TimeValue(resp.Credentials.Expiration), p.ExpiryWindow) value := credentials.Value{ AccessKeyID: aws.StringValue(resp.Credentials.AccessKeyId), SecretAccessKey: aws.StringValue(resp.Credentials.SecretAccessKey), SessionToken: aws.StringValue(resp.Credentials.SessionToken), ProviderName: WebIdentityProviderName, } return value, nil }	6.55 KB	2025-05-25 12:27
📄 web_identity_provider_test.go //go:build go1.7 // +build go1.7 package stscreds import ( "fmt" "net/http" "reflect" "strings" "testing" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/client" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/service/sts" "github.com/aws/aws-sdk-go/service/sts/stsiface" ) func TestWebIdentityProviderRetrieve(t testing.T) { cases := map[string]struct { roleARN string tokenPath string sessionName string newClient func(t testing.T) stsiface.STSAPI duration time.Duration expectedError string expectedCredValue credentials.Value }{ "session name case": { roleARN: "arn01234567890123456789", tokenPath: "testdata/token.jwt", sessionName: "foo", newClient: func(t testing.T) stsiface.STSAPI { return mockAssumeRoleWithWebIdentityClient{ t: t, doRequest: func(t testing.T, input sts.AssumeRoleWithWebIdentityInput) ( sts.AssumeRoleWithWebIdentityOutput, error, ) { if e, a := "foo", input.RoleSessionName; e != a { t.Errorf("expected %v, but received %v", e, a) } if input.DurationSeconds != nil { t.Errorf("expect no duration, got %v", input.DurationSeconds) } return &sts.AssumeRoleWithWebIdentityOutput{ Credentials: &sts.Credentials{ Expiration: aws.Time(time.Now()), AccessKeyId: aws.String("access-key-id"), SecretAccessKey: aws.String("secret-access-key"), SessionToken: aws.String("session-token"), }, }, nil }, } }, expectedCredValue: credentials.Value{ AccessKeyID: "access-key-id", SecretAccessKey: "secret-access-key", SessionToken: "session-token", ProviderName: WebIdentityProviderName, }, }, "with duration": { roleARN: "arn01234567890123456789", tokenPath: "testdata/token.jwt", sessionName: "foo", duration: 15 * time.Minute, newClient: func(t testing.T) stsiface.STSAPI { return mockAssumeRoleWithWebIdentityClient{ t: t, doRequest: func(t testing.T, input sts.AssumeRoleWithWebIdentityInput) ( sts.AssumeRoleWithWebIdentityOutput, error, ) { if e, a := int64((15time.Minute)/time.Second), input.DurationSeconds; e != a { t.Errorf("expect %v duration, got %v", e, a) } return &sts.AssumeRoleWithWebIdentityOutput{ Credentials: &sts.Credentials{ Expiration: aws.Time(time.Now()), AccessKeyId: aws.String("access-key-id"), SecretAccessKey: aws.String("secret-access-key"), SessionToken: aws.String("session-token"), }, }, nil }, } }, expectedCredValue: credentials.Value{ AccessKeyID: "access-key-id", SecretAccessKey: "secret-access-key", SessionToken: "session-token", ProviderName: WebIdentityProviderName, }, }, } for name, c := range cases { t.Run(name, func(t testing.T) { p := NewWebIdentityRoleProvider(c.newClient(t), c.roleARN, c.sessionName, c.tokenPath) p.Duration = c.duration credValue, err := p.Retrieve() if len(c.expectedError) != 0 { if err == nil { t.Fatalf("expect error, got none") } if e, a := c.expectedError, err.Error(); !strings.Contains(a, e) { t.Fatalf("expect error to contain %v, got %v", e, a) } return } if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := c.expectedCredValue, credValue; !reflect.DeepEqual(e, a) { t.Errorf("expected %v, but received %v", e, a) } }) } } type mockAssumeRoleWithWebIdentityClient struct { stsiface.STSAPI t testing.T doRequest func(testing.T, sts.AssumeRoleWithWebIdentityInput) (sts.AssumeRoleWithWebIdentityOutput, error) } func (c mockAssumeRoleWithWebIdentityClient) AssumeRoleWithWebIdentityRequest(input sts.AssumeRoleWithWebIdentityInput) ( request.Request, sts.AssumeRoleWithWebIdentityOutput, ) { output, err := c.doRequest(c.t, input) req := &request.Request{ HTTPRequest: &http.Request{}, Retryer: client.DefaultRetryer{}, } req.Handlers.Send.PushBack(func(r request.Request) { r.HTTPResponse = &http.Response{} r.Data = output r.Error = err var found bool for _, retryCode := range req.RetryErrorCodes { if retryCode == sts.ErrCodeInvalidIdentityTokenException { found = true break } } if !found { c.t.Errorf("expect ErrCodeInvalidIdentityTokenException error code to be retry-able") } }) return req, output } func TestNewWebIdentityRoleProviderWithOptions(t testing.T) { const roleARN = "a-role-arn" const roleSessionName = "a-session-name" cases := map[string]struct { options []func(WebIdentityRoleProvider) expect WebIdentityRoleProvider }{ "no options": { expect: WebIdentityRoleProvider{ client: stubClient{}, tokenFetcher: stubTokenFetcher{}, roleARN: roleARN, roleSessionName: roleSessionName, }, }, "with options": { options: []func(WebIdentityRoleProvider){ func(o WebIdentityRoleProvider) { o.Duration = 10 time.Minute o.ExpiryWindow = time.Minute }, }, expect: WebIdentityRoleProvider{ client: stubClient{}, tokenFetcher: stubTokenFetcher{}, roleARN: roleARN, roleSessionName: roleSessionName, Duration: 10 * time.Minute, ExpiryWindow: time.Minute, }, }, } for name, c := range cases { t.Run(name, func(t testing.T) { p := NewWebIdentityRoleProviderWithOptions( stubClient{}, roleARN, roleSessionName, stubTokenFetcher{}, c.options...) if !reflect.DeepEqual(c.expect, p) { t.Errorf("expect:\n%v\nactual:\n%v", c.expect, *p) } }) } } type stubClient struct { stsiface.STSAPI } type stubTokenFetcher struct{} func (stubTokenFetcher) FetchToken(credentials.Context) ([]byte, error) { return nil, fmt.Errorf("stubTokenFetcher should not be called") }	5.92 KB	2025-05-25 12:27

Terminal