-
Notifications
You must be signed in to change notification settings - Fork 2
/
awscredswrap.go
121 lines (97 loc) · 2.76 KB
/
awscredswrap.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
package awscredswrap
import (
"os"
"os/exec"
"time"
"github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/credentials"
"github.com/aws/aws-sdk-go/aws/credentials/stscreds"
"github.com/aws/aws-sdk-go/aws/session"
)
type AwsCredsWrap struct {
Session *session.Session
Credentials credentials.Value
Region string
}
// New
func New() *AwsCredsWrap {
sess := newSession()
awsCredsWrap := &AwsCredsWrap{
Session: sess,
Region: *sess.Config.Region,
}
return awsCredsWrap
}
func (a *AwsCredsWrap) GetCredentials(roleArn, roleSessionName, mfaSerial string, durationSeconds time.Duration) (err error) {
creds := stscreds.NewCredentials(a.Session, roleArn, assumeRoleProvider(roleSessionName, mfaSerial, durationSeconds))
a.Credentials, err = creds.Get()
if err != nil {
return err
}
return nil
}
func (a *AwsCredsWrap) ExportEnvironments() []string {
s := []string{
"export AWS_ACCESS_KEY_ID='" + a.Credentials.AccessKeyID + "'",
"export AWS_SECRET_ACCESS_KEY='" + a.Credentials.SecretAccessKey + "'",
"export AWS_SESSION_TOKEN='" + a.Credentials.SessionToken + "'",
"export AWS_DEFAULT_REGION='" + a.Region + "'",
}
return s
}
func (a *AwsCredsWrap) ExecuteCommand(com string, args ...string) (err error) {
a.setEnvironments()
err = execCommand(com, args...)
return err
}
func newSession() (sess *session.Session) {
sess = session.Must(
session.NewSessionWithOptions(
session.Options{
SharedConfigState: session.SharedConfigEnable,
AssumeRoleTokenProvider: stscreds.StdinTokenProvider,
},
),
)
return sess
}
func assumeRoleProvider(roleSessionName, mfaSerial string, durationSeconds time.Duration) (f func(p *stscreds.AssumeRoleProvider)) {
f = func() (f func(p *stscreds.AssumeRoleProvider)) {
if mfaSerial != "" {
return func(p *stscreds.AssumeRoleProvider) {
p.RoleSessionName = roleSessionName
p.Duration = durationSeconds
p.SerialNumber = aws.String(mfaSerial)
p.TokenProvider = stscreds.StdinTokenProvider
}
} else {
return func(p *stscreds.AssumeRoleProvider) {
p.RoleSessionName = roleSessionName
p.Duration = durationSeconds
}
}
}()
return f
}
func (a *AwsCredsWrap) setEnvironments() {
os.Setenv("AWS_ACCESS_KEY_ID", a.Credentials.AccessKeyID)
os.Setenv("AWS_SECRET_ACCESS_KEY", a.Credentials.SecretAccessKey)
os.Setenv("AWS_SESSION_TOKEN", a.Credentials.SessionToken)
os.Setenv("AWS_DEFAULT_REGION", a.Region)
}
func execCommand(com string, args ...string) (err error) {
var command *exec.Cmd
if args != nil {
command = exec.Command(com, args...)
} else {
command = exec.Command(com)
}
command.Stdout = os.Stdout
command.Stderr = os.Stderr
command.Stdin = os.Stdin
if err = command.Start(); err != nil {
return err
}
command.Wait()
return nil
}