Add IAM EC2 auth

lib/vault/api/auth.rb

@@ -197,20 +197,14 @@ def aws_ec2(role, pkcs7, nonce = nil)
     # @param [CredentialProvider] credentials_provider
     #   https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CredentialProvider.html
     # @param [String] iam_auth_header_value optional
-    #   As of Jan 2018, Vault will accept ANY or NO header, but this is subject to change and should not be relied upon
+    #   As of Jan 2018, Vault will accept ANY or NO header if none is configured by the Vault server admin
     # @param [String] sts_endpoint optional
     #   https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html
     # @return [Secret]
     def aws_iam(role, credentials_provider, iam_auth_header_value = nil, sts_endpoint = 'https://sts.amazonaws.com')
       require "aws-sigv4"
       require "base64"
 
-      # STS in the China (Beijing) region (cn-north-1) is sts.cn-north-1.amazonaws.com.cn
-      # Take care changing below regex with that edge case in mind
-      valid_sts_endpoint = %r{https:\/\/sts.?(.*).amazonaws.com}.match(sts_endpoint)
-      raise "Unable to parse STS endpoint #{sts_endpoint}" unless valid_sts_endpoint
-      region = valid_sts_endpoint[1].empty? ? 'us-east-1' : valid_sts_endpoint[1]
-
       request_body   = 'Action=GetCallerIdentity&Version=2011-06-15'
       request_method = 'POST'
 
@@ -223,7 +217,7 @@ def aws_iam(role, credentials_provider, iam_auth_header_value = nil, sts_endpoin
 
       sig4_headers = Aws::Sigv4::Signer.new(
         service: 'sts',
-        region: region,
+        region: region_from_sts_endpoint(sts_endpoint),
         credentials_provider: credentials_provider
       ).sign_request(
         http_method: request_method,
@@ -275,5 +269,21 @@ def tls(pem = nil, path = 'cert')
       client.token = secret.auth.client_token
       return secret
     end
+
+    private
+
+    # Parse an AWS region from a STS endpoint
+    # STS in the China (Beijing) region (cn-north-1) is sts.cn-north-1.amazonaws.com.cn
+    # Take care changing below regex with that edge case in mind
+    #
+    # @param [String] sts_endpoint
+    #   The raw pem contents to use for the login procedure.
+    #
+    # @return [String] aws region
+    def region_from_sts_endpoint(sts_endpoint)
+      valid_sts_endpoint = %r{https:\/\/sts\.?(.*).amazonaws.com}.match(sts_endpoint)
+      raise "Unable to parse STS endpoint #{sts_endpoint}" unless valid_sts_endpoint
+      valid_sts_endpoint[1].empty? ? 'us-east-1' : valid_sts_endpoint[1]
+    end
   end
 end

spec/integration/api/auth_spec.rb

@@ -216,6 +216,7 @@ module Vault
     describe "#aws_iam" do
       before(:context) do
         vault_test_client.sys.enable_auth("aws", "aws", nil)
+        vault_test_client.sys.put_auth_tune("aws", "iam_server_id_header_value" => "iam_header_canary")
       end
 
       after(:context) do
@@ -243,7 +244,7 @@ module Vault
             service: 'sts', region: 'cn-north-1', credentials_provider: credentials_provider
           ).and_call_original
         )
-        subject.auth.aws_iam('yabba', credentials_provider, 'canary_header', 'https://sts.cn-north-1.amazonaws.com.cn')
+        subject.auth.aws_iam('yabba', credentials_provider, 'iam_header_canary', 'https://sts.cn-north-1.amazonaws.com.cn')
       end
     end
   end

spec/unit/auth_spec.rb

@@ -0,0 +1,30 @@
+require "spec_helper"
+
+module Vault
+  describe Authenticate do
+    let(:auth) { Authenticate.new(client: nil) }
+    describe "#region_from_sts_endpoint" do
+      subject { auth.send(:region_from_sts_endpoint, sts_endpoint) }
+
+      context 'with a china endpoint' do
+        let(:sts_endpoint) { "https://sts.cn-north-1.amazonaws.com.cn" }
+        it { is_expected.to eq 'cn-north-1' }
+      end
+
+      context 'with a GovCloud endpoint' do
+        let(:sts_endpoint) { "https://sts.us-gov-west-1.amazonaws.com" }
+        it { is_expected.to eq 'us-gov-west-1' }
+      end
+
+      context 'with no regional endpoint' do
+        let(:sts_endpoint) { "https://sts.amazonaws.com" }
+        it { is_expected.to eq 'us-east-1' }
+      end
+
+      context 'with a malformed url' do
+        let(:sts_endpoint) { "https:sts.amazonaws.com" }
+        it { expect { subject }.to raise_exception(StandardError, "Unable to parse STS endpoint https:sts.amazonaws.com") }
+      end
+    end
+  end
+end