139 lines
3.6 KiB
Go
139 lines
3.6 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package awsauth
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/hashicorp/go-hclog"
|
|
"github.com/hashicorp/go-secure-stdlib/awsutil"
|
|
"github.com/hashicorp/vault/api"
|
|
)
|
|
|
|
type CLIHandler struct{}
|
|
|
|
func (h *CLIHandler) Auth(c *api.Client, m map[string]string) (*api.Secret, error) {
|
|
mount, ok := m["mount"]
|
|
if !ok {
|
|
mount = "aws"
|
|
}
|
|
|
|
role, ok := m["role"]
|
|
if !ok {
|
|
role = ""
|
|
}
|
|
|
|
headerValue, ok := m["header_value"]
|
|
if !ok {
|
|
headerValue = ""
|
|
}
|
|
|
|
logVal, ok := m["log_level"]
|
|
if !ok {
|
|
logVal = "info"
|
|
}
|
|
level := hclog.LevelFromString(logVal)
|
|
if level == hclog.NoLevel {
|
|
return nil, fmt.Errorf("failed to parse 'log_level' value: %q", logVal)
|
|
}
|
|
hlogger := hclog.Default()
|
|
hlogger.SetLevel(level)
|
|
|
|
creds, err := awsutil.RetrieveCreds(m["aws_access_key_id"], m["aws_secret_access_key"], m["aws_security_token"], hlogger)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
region := m["region"]
|
|
switch region {
|
|
case "":
|
|
// The CLI has always defaulted to "us-east-1" if a region is not provided.
|
|
region = awsutil.DefaultRegion
|
|
case "auto":
|
|
// Beginning in 1.10 we also accept the "auto" value, which uses the region detection logic in
|
|
// awsutil.GetRegion() to determine the region. That behavior is triggered when region = "".
|
|
region = ""
|
|
}
|
|
|
|
loginData, err := awsutil.GenerateLoginData(creds, headerValue, region, hlogger)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if loginData == nil {
|
|
return nil, fmt.Errorf("got nil response from GenerateLoginData")
|
|
}
|
|
loginData["role"] = role
|
|
path := fmt.Sprintf("auth/%s/login", mount)
|
|
secret, err := c.Logical().Write(path, loginData)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if secret == nil {
|
|
return nil, fmt.Errorf("empty response from credential provider")
|
|
}
|
|
|
|
return secret, nil
|
|
}
|
|
|
|
func (h *CLIHandler) Help() string {
|
|
help := `
|
|
Usage: vault login -method=aws [CONFIG K=V...]
|
|
|
|
The AWS auth method allows users to authenticate with AWS IAM
|
|
credentials. The AWS IAM credentials, and optionally the AWS region, may be
|
|
specified in a number of ways, listed in order of precedence below:
|
|
|
|
1. Explicitly via the command line (not recommended)
|
|
|
|
2. Via the standard AWS environment variables (AWS_ACCESS_KEY, etc.)
|
|
|
|
3. Via the ~/.aws/credentials file
|
|
|
|
4. Via EC2 instance profile
|
|
|
|
Authenticate using locally stored credentials:
|
|
|
|
$ vault login -method=aws
|
|
|
|
Authenticate by passing keys:
|
|
|
|
$ vault login -method=aws aws_access_key_id=... aws_secret_access_key=...
|
|
|
|
Configuration:
|
|
|
|
aws_access_key_id=<string>
|
|
Explicit AWS access key ID
|
|
|
|
aws_secret_access_key=<string>
|
|
Explicit AWS secret access key
|
|
|
|
aws_security_token=<string>
|
|
Explicit AWS security token for temporary credentials
|
|
|
|
header_value=<string>
|
|
Value for the x-vault-aws-iam-server-id header in requests
|
|
|
|
mount=<string>
|
|
Path where the AWS credential method is mounted. This is usually provided
|
|
via the -path flag in the "vault login" command, but it can be specified
|
|
here as well. If specified here, it takes precedence over the value for
|
|
-path. The default value is "aws".
|
|
|
|
region=<string>
|
|
Explicit AWS region to reach out to for authentication request signing. A value
|
|
of "auto" enables auto-detection of region based on the precedence described above.
|
|
Defaults to "us-east-1" if not specified.
|
|
|
|
role=<string>
|
|
Name of the role to request a token against
|
|
|
|
log_level=<string>
|
|
Set logging level during AWS credential acquisition. Valid levels are
|
|
trace, debug, info, warn, error. Defaults to info.
|
|
`
|
|
|
|
return strings.TrimSpace(help)
|
|
}
|