Class: Dev::Aws::Credentials

Inherits:
Object
  • Object
show all
Defined in:
lib/firespring_dev_commands/aws/credentials.rb

Overview

Class contains methods for interacting with your Aws credentials

Constant Summary collapse

CONFIG_FILE =

The local file where temporary credentials are stored

"#{Dev::Aws::CONFIG_DIR}/credentials".freeze

Instance Method Summary collapse

Instance Method Details

#active?(profile = Dev::Aws::Profile.new.current) ⇒ Boolean

Whether or not the current credentials are still active

Returns:

  • (Boolean) 


35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
 
# File 'lib/firespring_dev_commands/aws/credentials.rb', line 35

def active?(profile = Dev::Aws::Profile.new.current)
  # If there is a metadata uri then we are in an AWS env - assume we are good
  return true if ENV.fetch('ECS_CONTAINER_METADATA_URI', nil)

  # Otherwise there should either be an aws config directory or access key configured
  return false unless File.exist?(Dev::Aws::CONFIG_DIR) || ENV.fetch('AWS_ACCESS_KEY_ID', nil)

  # TODO: I'd prefer to still validate creds if using a METADATA_URI
  # However this appears to require additional permissions which might not be present. Is there a better check here?
  # return false if !ENV.fetch('ECS_CONTAINER_METADATA_URI', nil) && !(File.exist?(Dev::Aws::CONFIG_DIR) || ENV.fetch('AWS_ACCESS_KEY_ID', nil))

  # Check for expired credentials
  begin
    ::Aws::STS::Client.new(profile:).get_caller_identity
  rescue
    return false
  end

  # Check for invalid credentials
  begin
    # TODO: Is there a better check we can do here?
    ::Aws::SSM::Client.new(profile:).describe_parameters(max_results: 1)
  rescue
    return false
  end

  # If the credentials are valid, make sure they are set in the ruby process environment for use later
  export!
  true
end

#base_setup! ⇒ Object

Setup base Aws credential settings



67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
 
# File 'lib/firespring_dev_commands/aws/credentials.rb', line 67

def base_setup!
  # Make the base config directory
  FileUtils.mkdir_p(Dev::Aws::CONFIG_DIR)

  puts
  puts 'Configuring default credential values'

  # Write access key / secret key in the credentials file
  credini = IniFile.new(filename: "#{Dev::Aws::CONFIG_DIR}/credentials", default: 'default')
  defaultini = credini['default']

  access_key_default = defaultini['aws_access_key_id']
  defaultini['aws_access_key_id'] = Dev::Common.new.ask('AWS Access Key ID', access_key_default)

  secret_key_default = defaultini['aws_secret_access_key']
  defaultini['aws_secret_access_key'] = Dev::Common.new.ask('AWS Secret Access Key', secret_key_default)

  credini.write
end

#export! ⇒ Object

Export our current credentials into the ruby environment



101
102
103
104
 
# File 'lib/firespring_dev_commands/aws/credentials.rb', line 101

def export!
  export_profile_credentials!
  export_container_credentials!
end

#export_container_credentials! ⇒ Object

Exports the credentials if there is an active credentials uri



107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'lib/firespring_dev_commands/aws/credentials.rb', line 107

def export_container_credentials!
  # If we already have creds defined, don't do anything
  return if ENV.fetch('AWS_ACCESS_KEY_ID', nil)

  # If a container credentials url is not present, don't do anything
  ecs_creds = ENV.fetch('AWS_CONTAINER_CREDENTIALS_RELATIVE_URI', nil)
  return unless ecs_creds

  # Otherwise query the local creds, parse the json response, and store in the environment
  response = Net::HTTP.get_response(URI.parse("http://169.254.170.2#{ecs_creds}"))
  raise 'Error getting container credentials' unless response.is_a?(Net::HTTPSuccess)

  creds = JSON.parse(response.body)
  ENV['AWS_ACCESS_KEY_ID'] = creds['AccessKeyId']
  ENV['AWS_SECRET_ACCESS_KEY'] = creds['SecretAccessKey']
  ENV['AWS_SESSION_TOKEN'] = creds['Token']
  ENV['AWS_DEFAULT_REGION'] = logged_in_region
end

#export_profile_credentials! ⇒ Object

Exports the credentials if there is a configured aws profile



127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
 
# File 'lib/firespring_dev_commands/aws/credentials.rb', line 127

def export_profile_credentials!
  # If we already have creds defined, don't do anything
  return if ENV.fetch('AWS_ACCESS_KEY_ID', nil)

  # If a profile config file is not present, don't do anything
  return unless File.exist?(CONFIG_FILE)

  # Otherwise load access key / secret key / session token from the credentials file into the environment
  credini = IniFile.new(filename: CONFIG_FILE, default: 'default')
  profile_credentials = credini[Dev::Aws::Profile.new.current]
  return unless profile_credentials

  ENV['AWS_ACCESS_KEY_ID'] = profile_credentials['aws_access_key_id']
  ENV['AWS_SECRET_ACCESS_KEY'] = profile_credentials['aws_secret_access_key']
  ENV['AWS_SESSION_TOKEN'] = profile_credentials['aws_session_token']
  ENV['AWS_DEFAULT_REGION'] = logged_in_region
end

#logged_in_account ⇒ Object

The account the profile is currently logged in to



15
16
17
 
# File 'lib/firespring_dev_commands/aws/credentials.rb', line 15

def 
  ::Aws::STS::Client.new.get_caller_identity.
end

#logged_in_arn ⇒ Object

The arn of the currently logged in identity



20
21
22
 
# File 'lib/firespring_dev_commands/aws/credentials.rb', line 20

def logged_in_arn
  ::Aws::STS::Client.new.get_caller_identity.arn
end

#logged_in_region ⇒ Object

The region associated with the current login



30
31
32
 
# File 'lib/firespring_dev_commands/aws/credentials.rb', line 30

def logged_in_region
  ::Aws::STS::Client.new.send(:config).region
end

#logged_in_role ⇒ Object

The role the current identity is using



25
26
27
 
# File 'lib/firespring_dev_commands/aws/credentials.rb', line 25

def logged_in_role
  logged_in_arn.split(%r{/})[1]
end

#write!(account, creds) ⇒ Object

Write Aws account specific settings to the credentials file



88
89
90
91
92
93
94
95
96
97
98
 
# File 'lib/firespring_dev_commands/aws/credentials.rb', line 88

def write!(, creds)
  # Write access key / secret key / session token in the credentials file
  credini = IniFile.new(filename: CONFIG_FILE, default: 'default')
  defaultini = credini[]

  defaultini['aws_access_key_id'] = creds.access_key_id
  defaultini['aws_secret_access_key'] = creds.secret_access_key
  defaultini['aws_session_token'] = creds.session_token

  credini.write
end