diff --git a/cli/exec.go b/cli/exec.go index 47f7f4c54..2ab035c19 100644 --- a/cli/exec.go +++ b/cli/exec.go @@ -22,18 +22,19 @@ import ( ) type ExecCommandInput struct { - ProfileName string - Command string - Args []string - StartEc2Server bool - StartEcsServer bool - Lazy bool - JSONDeprecated bool - Config vault.ProfileConfig - SessionDuration time.Duration - NoSession bool - UseStdout bool - ShowHelpMessages bool + ProfileName string + Command string + Args []string + StartEc2Server bool + StartEcsServer bool + ServerListenAddress string + Lazy bool + JSONDeprecated bool + Config vault.ProfileConfig + SessionDuration time.Duration + NoSession bool + UseStdout bool + ShowHelpMessages bool } func (input ExecCommandInput) validate() error { @@ -100,6 +101,10 @@ func ConfigureExecCommand(app *kingpin.Application, a *AwsVault) { cmd.Flag("ecs-server", "Run a ECS credential server in the background for credentials (the SDK or app must support AWS_CONTAINER_CREDENTIALS_FULL_URI)"). BoolVar(&input.StartEcsServer) + + cmd.Flag("listen-address", "Define which host the server should run listen. Defaults to 127.0.0.1"). + Default("127.0.0.1"). + StringVar(&input.ServerListenAddress) cmd.Flag("lazy", "When using --ecs-server, lazily fetch credentials"). BoolVar(&input.Lazy) @@ -202,7 +207,7 @@ func ExecCommand(input ExecCommandInput, f *vault.ConfigFile, keyring keyring.Ke printHelpMessage(subshellHelp, input.ShowHelpMessages) } else if input.StartEcsServer { printHelpMessage("Starting a local ECS credential server; your app's AWS sdk must support AWS_CONTAINER_CREDENTIALS_FULL_URI.", input.ShowHelpMessages) - if err = startEcsServerAndSetEnv(credsProvider, config, input.Lazy, &cmdEnv); err != nil { + if err = startEcsServerAndSetEnv(credsProvider, config, input.Lazy, input.ServerListenAddress, &cmdEnv); err != nil { return 0, err } printHelpMessage(subshellHelp, input.ShowHelpMessages) @@ -260,8 +265,8 @@ func createEnv(profileName string, region string) environ { return env } -func startEcsServerAndSetEnv(credsProvider aws.CredentialsProvider, config *vault.ProfileConfig, lazy bool, cmdEnv *environ) error { - ecsServer, err := server.NewEcsServer(context.TODO(), credsProvider, config, "", 0, lazy) +func startEcsServerAndSetEnv(credsProvider aws.CredentialsProvider, config *vault.ProfileConfig, lazy bool, listenAddress string, cmdEnv *environ) error { + ecsServer, err := server.NewEcsServer(context.TODO(), credsProvider, config, "", 0, lazy, listenAddress) if err != nil { return err } diff --git a/server/ecsserver.go b/server/ecsserver.go index 488d3f767..fd77f4e90 100644 --- a/server/ecsserver.go +++ b/server/ecsserver.go @@ -66,8 +66,8 @@ type EcsServer struct { config *vault.ProfileConfig } -func NewEcsServer(ctx context.Context, baseCredsProvider aws.CredentialsProvider, config *vault.ProfileConfig, authToken string, port int, lazyLoadBaseCreds bool) (*EcsServer, error) { - listener, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", port)) +func NewEcsServer(ctx context.Context, baseCredsProvider aws.CredentialsProvider, config *vault.ProfileConfig, authToken string, port int, lazyLoadBaseCreds bool, serverListenAddress string) (*EcsServer, error) { + listener, err := net.Listen("tcp4", fmt.Sprintf("%s:%d", serverListenAddress, port)) if err != nil { return nil, err }