-
Notifications
You must be signed in to change notification settings - Fork 613
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #3980 from timj-hh/fe_creds
Move remaining credentials module to shared library
- Loading branch information
Showing
36 changed files
with
1,893 additions
and
17 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
11 changes: 7 additions & 4 deletions
11
...ials/instancecreds/instancecreds_linux.go → ...ials/instancecreds/instancecreds_linux.go
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
File renamed without changes.
11 changes: 7 additions & 4 deletions
11
...ls/instancecreds/instancecreds_windows.go → ...ls/instancecreds/instancecreds_windows.go
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
File renamed without changes.
File renamed without changes.
File renamed without changes.
9 changes: 5 additions & 4 deletions
9
...s/rotating_shared_credentials_provider.go → ...s/rotating_shared_credentials_provider.go
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"). You may | ||
| // not use this file except in compliance with the License. A copy of the | ||
| // License is located at | ||
| // | ||
| // http://aws.amazon.com/apache2.0/ | ||
| // | ||
| // or in the "license" file accompanying this file. This file is distributed | ||
| // on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either | ||
| // express or implied. See the License for the specific language governing | ||
| // permissions and limitations under the License. | ||
|
|
||
| package instancecreds | ||
|
|
||
| import ( | ||
| "sync" | ||
|
|
||
| "github.com/aws/aws-sdk-go/aws/credentials" | ||
| ) | ||
|
|
||
| var ( | ||
| credentialChain *credentials.Credentials | ||
| mu sync.Mutex | ||
| ) |
55 changes: 55 additions & 0 deletions
55
ecs-agent/credentials/instancecreds/instancecreds_linux.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| //go:build linux | ||
|
|
||
| // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"). You may | ||
| // not use this file except in compliance with the License. A copy of the | ||
| // License is located at | ||
| // | ||
| // http://aws.amazon.com/apache2.0/ | ||
| // | ||
| // or in the "license" file accompanying this file. This file is distributed | ||
| // on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either | ||
| // express or implied. See the License for the specific language governing | ||
| // permissions and limitations under the License. | ||
|
|
||
| package instancecreds | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "github.com/aws/amazon-ecs-agent/ecs-agent/credentials/providers" | ||
| "github.com/aws/amazon-ecs-agent/ecs-agent/logger" | ||
|
|
||
| "github.com/aws/aws-sdk-go/aws/credentials" | ||
| "github.com/aws/aws-sdk-go/aws/defaults" | ||
| ) | ||
|
|
||
| // GetCredentials returns the instance credentials chain. This is the default chain | ||
| // credentials plus the "rotating shared credentials provider", so credentials will | ||
| // be checked in this order: | ||
| // 1. Env vars (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY). | ||
| // 2. Shared credentials file (https://docs.aws.amazon.com/ses/latest/DeveloperGuide/create-shared-credentials-file.html) (file at ~/.aws/credentials containing access key id and secret access key). | ||
| // 3. EC2 role credentials. This is an IAM role that the user specifies when they launch their EC2 container instance (ie ecsInstanceRole (https://docs.aws.amazon.com/AmazonECS/latest/developerguide/instance_IAM_role.html)). | ||
| // 4. Rotating shared credentials file located at /rotatingcreds/credentials | ||
| func GetCredentials(isExternal bool) *credentials.Credentials { | ||
| mu.Lock() | ||
| if credentialChain == nil { | ||
| credProviders := defaults.CredProviders(defaults.Config(), defaults.Handlers()) | ||
| credProviders = append(credProviders, providers.NewRotatingSharedCredentialsProvider()) | ||
| credentialChain = credentials.NewCredentials(&credentials.ChainProvider{ | ||
| VerboseErrors: false, | ||
| Providers: credProviders, | ||
| }) | ||
| } | ||
| mu.Unlock() | ||
|
|
||
| // credentials.Credentials is concurrency-safe, so lock not needed here | ||
| v, err := credentialChain.Get() | ||
| if err != nil { | ||
| logger.Error(fmt.Sprintf("Error getting ECS instance credentials from default chain: %s", err)) | ||
| } else { | ||
| logger.Info(fmt.Sprintf("Successfully got ECS instance credentials from provider: %s", v.ProviderName)) | ||
| } | ||
| return credentialChain | ||
| } |
File renamed without changes.
32 changes: 32 additions & 0 deletions
32
ecs-agent/credentials/instancecreds/instancecreds_unsupported.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| //go:build !linux && !windows | ||
| // +build !linux,!windows | ||
|
|
||
| // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"). You may | ||
| // not use this file except in compliance with the License. A copy of the | ||
| // License is located at | ||
| // | ||
| // http://aws.amazon.com/apache2.0/ | ||
| // | ||
| // or in the "license" file accompanying this file. This file is distributed | ||
| // on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either | ||
| // express or implied. See the License for the specific language governing | ||
| // permissions and limitations under the License. | ||
|
|
||
| package instancecreds | ||
|
|
||
| import ( | ||
| "github.com/aws/aws-sdk-go/aws/credentials" | ||
| ) | ||
|
|
||
| // GetCredentials returns the instance credentials chain. This is the default chain | ||
| // credentials plus the "rotating shared credentials provider", so credentials will | ||
| // be checked in this order: | ||
| // 1. Env vars (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY). | ||
| // 2. Shared credentials file (https://docs.aws.amazon.com/ses/latest/DeveloperGuide/create-shared-credentials-file.html) (file at ~/.aws/credentials containing access key id and secret access key). | ||
| // 3. EC2 role credentials. This is an IAM role that the user specifies when they launch their EC2 container instance (ie ecsInstanceRole (https://docs.aws.amazon.com/AmazonECS/latest/developerguide/instance_IAM_role.html)). | ||
| // 4. Rotating shared credentials file located at /rotatingcreds/credentials | ||
| func GetCredentials(isExternal bool) *credentials.Credentials { | ||
| return nil | ||
| } |
72 changes: 72 additions & 0 deletions
72
ecs-agent/credentials/instancecreds/instancecreds_windows.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| //go:build windows | ||
|
|
||
| // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"). You may | ||
| // not use this file except in compliance with the License. A copy of the | ||
| // License is located at | ||
| // | ||
| // http://aws.amazon.com/apache2.0/ | ||
| // | ||
| // or in the "license" file accompanying this file. This file is distributed | ||
| // on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either | ||
| // express or implied. See the License for the specific language governing | ||
| // permissions and limitations under the License. | ||
|
|
||
| package instancecreds | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "github.com/aws/amazon-ecs-agent/ecs-agent/credentials/providers" | ||
| "github.com/aws/amazon-ecs-agent/ecs-agent/logger" | ||
|
|
||
| "github.com/aws/aws-sdk-go/aws/credentials" | ||
| "github.com/aws/aws-sdk-go/aws/defaults" | ||
| ) | ||
|
|
||
| // GetCredentials returns the instance credentials chain. This is the default chain | ||
| // credentials plus the "rotating shared credentials provider", so credentials will | ||
| // be checked in this order: | ||
| // | ||
| // 1. Env vars (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY). | ||
| // | ||
| // 2. Shared credentials file (https://docs.aws.amazon.com/ses/latest/DeveloperGuide/create-shared-credentials-file.html) (file at ~/.aws/credentials containing access key id and secret access key). | ||
| // | ||
| // 3. EC2 role credentials. This is an IAM role that the user specifies when they launch their EC2 container instance (ie ecsInstanceRole (https://docs.aws.amazon.com/AmazonECS/latest/developerguide/instance_IAM_role.html)). | ||
| // | ||
| // 4. Rotating shared credentials file located at /rotatingcreds/credentials | ||
| // | ||
| // The default credential chain provided by the SDK includes: | ||
| // * EnvProvider | ||
| // * SharedCredentialsProvider | ||
| // * RemoteCredProvider (EC2RoleProvider) | ||
| // | ||
| // In the case of ECS-A on Windows, the `SharedCredentialsProvider` takes | ||
| // precedence over the `RotatingSharedCredentialsProvider` and this results | ||
| // in the credentials not being refreshed. To mitigate this issue, we will | ||
| // reorder the credential chain and ensure that `RotatingSharedCredentialsProvider` | ||
| // takes precedence over the `SharedCredentialsProvider` for ECS-A. | ||
| func GetCredentials(isExternal bool) *credentials.Credentials { | ||
| mu.Lock() | ||
| credProviders := defaults.CredProviders(defaults.Config(), defaults.Handlers()) | ||
| if isExternal { | ||
| credProviders = append(credProviders[:1], append([]credentials.Provider{providers.NewRotatingSharedCredentialsProvider()}, credProviders[1:]...)...) | ||
| } else { | ||
| credProviders = append(credProviders, providers.NewRotatingSharedCredentialsProvider()) | ||
| } | ||
| credentialChain = credentials.NewCredentials(&credentials.ChainProvider{ | ||
| VerboseErrors: false, | ||
| Providers: credProviders, | ||
| }) | ||
| mu.Unlock() | ||
|
|
||
| // credentials.Credentials is concurrency-safe, so lock not needed here | ||
| v, err := credentialChain.Get() | ||
| if err != nil { | ||
| logger.Error(fmt.Sprintf("Error getting ECS instance credentials from default chain: %s", err)) | ||
| } else { | ||
| logger.Info(fmt.Sprintf("Successfully got ECS instance credentials from provider: %s", v.ProviderName)) | ||
| } | ||
| return credentialChain | ||
| } |
22 changes: 22 additions & 0 deletions
22
ecs-agent/credentials/providers/credentials_filename_linux.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| //go:build linux | ||
|
|
||
| // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"). You may | ||
| // not use this file except in compliance with the License. A copy of the | ||
| // License is located at | ||
| // | ||
| // http://aws.amazon.com/apache2.0/ | ||
| // | ||
| // or in the "license" file accompanying this file. This file is distributed | ||
| // on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either | ||
| // express or implied. See the License for the specific language governing | ||
| // permissions and limitations under the License. | ||
|
|
||
| package providers | ||
|
|
||
| const ( | ||
| // defaultRotatingCredentialsFilename is the default location of the credentials file | ||
| // for RotatingSharedCredentialsProvider. | ||
| defaultRotatingCredentialsFilename = "/rotatingcreds/credentials" | ||
| ) |
23 changes: 23 additions & 0 deletions
23
ecs-agent/credentials/providers/credentials_filename_unsupported.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| //go:build !linux && !windows | ||
| // +build !linux,!windows | ||
|
|
||
| // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"). You may | ||
| // not use this file except in compliance with the License. A copy of the | ||
| // License is located at | ||
| // | ||
| // http://aws.amazon.com/apache2.0/ | ||
| // | ||
| // or in the "license" file accompanying this file. This file is distributed | ||
| // on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either | ||
| // express or implied. See the License for the specific language governing | ||
| // permissions and limitations under the License. | ||
|
|
||
| package providers | ||
|
|
||
| const ( | ||
| // defaultRotatingCredentialsFilename is the default location of the credentials file | ||
| // for RotatingSharedCredentialsProvider. | ||
| defaultRotatingCredentialsFilename = "/unsupported/rotatingcreds/credentials" | ||
| ) |
Oops, something went wrong.