class Fog::AWS::STS::Real

Public Class Methods

new(options={}) click to toggle source

Initialize connection to STS

Notes

options parameter must include values for :aws_access_key_id and :aws_secret_access_key in order to create a connection

Examples

iam = STS.new(
 :aws_access_key_id => your_aws_access_key_id,
 :aws_secret_access_key => your_aws_secret_access_key
)

Parameters

  • options<~Hash> - config arguments for connection. Defaults to {}.

Returns

  • STS object with connection to AWS.

# File lib/fog/aws/sts.rb, line 74
def initialize(options={})
  require 'fog/core/parser'

  @use_iam_profile = options[:use_iam_profile]
  setup_credentials(options)
  @connection_options     = options[:connection_options] || {}

  @host       = options[:host]        || 'sts.amazonaws.com'
  @path       = options[:path]        || '/'
  @persistent = options[:persistent]  || false
  @port       = options[:port]        || 443
  @scheme     = options[:scheme]      || 'https'
  @connection = Fog::Connection.new("#{@scheme}://#{@host}:#{@port}#{@path}", @persistent, @connection_options)
end

Public Instance Methods

assume_role(role_session_name, role_arn, external_id=nil, policy=nil, duration=3600) click to toggle source

Assume Role

Parameters

  • role_session_name<~String> - An identifier for the assumed role.

  • role_arn<~String> - The ARN of the role the caller is assuming.

  • external_id<~String> - An optional unique identifier required by the assuming role's trust identity.

  • policy<~String> - An optional JSON policy document

  • duration<~Integer> - Duration (of seconds) for the assumed role credentials to be valid (default 3600)

Returns

  • response<~Excon::Response>:

    • body<~Hash>:

      • 'Arn'<~String>: The ARN of the assumed role/user

      • 'AccessKeyId'<~String>: The AWS access key of the temporary credentials for the assumed role

      • 'SecretAccessKey'<~String>: The AWS secret key of the temporary credentials for the assumed role

      • 'SessionToken'<~String>: The AWS session token of the temporary credentials for the assumed role

      • 'Expiration'<~Time>: The expiration time of the temporary credentials for the assumed role

See Also

docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html

# File lib/fog/aws/requests/sts/assume_role.rb, line 30
def assume_role(role_session_name, role_arn, external_id=nil, policy=nil, duration=3600)
  request({
    'Action'          => 'AssumeRole',
    'RoleSessionName' => role_session_name,
    'RoleArn'         => role_arn,
    'Policy'          => policy && Fog::JSON.encode(policy),
    'DurationSeconds' => duration,
    'ExternalId'      => external_id,
    :idempotent       => true,
    :parser           => Fog::Parsers::AWS::STS::AssumeRole.new
  })
end
get_federation_token(name, policy, duration=43200) click to toggle source
# File lib/fog/aws/requests/sts/get_federation_token.rb, line 8
def get_federation_token(name, policy, duration=43200)
  request({
    'Action'          => 'GetFederationToken',
    'Name'            => name,
    'Policy'          => Fog::JSON.encode(policy),
    'DurationSeconds' => duration,
    :idempotent       => true,
    :parser           => Fog::Parsers::AWS::STS::GetSessionToken.new
  })
end
get_session_token(duration=43200) click to toggle source
# File lib/fog/aws/requests/sts/get_session_token.rb, line 8
def get_session_token(duration=43200)
  request({
    'Action'          => 'GetSessionToken',
    'DurationSeconds' => duration,
    :idempotent       => true,
    :parser           => Fog::Parsers::AWS::STS::GetSessionToken.new
  })
end
reload() click to toggle source
# File lib/fog/aws/sts.rb, line 89
def reload
  @connection.reset
end

Private Instance Methods

request(params) click to toggle source
# File lib/fog/aws/sts.rb, line 103
def request(params)
  idempotent  = params.delete(:idempotent)
  parser      = params.delete(:parser)

  body = Fog::AWS.signed_params(
    params,
    {
      :aws_access_key_id  => @aws_access_key_id,
      :aws_session_token  => @aws_session_token,
      :hmac               => @hmac,
      :host               => @host,
      :path               => @path,
      :port               => @port,
      :version            => '2011-06-15'
    }
  )

  begin
    @connection.request({
      :body       => body,
      :expects    => 200,
      :idempotent => idempotent,
      :headers    => { 'Content-Type' => 'application/x-www-form-urlencoded' },
      :host       => @host,
      :method     => 'POST',
      :parser     => parser
    })
  rescue Excon::Errors::HTTPStatusError => error
    match = Fog::AWS::Errors.match_error(error)
    raise if match.empty?
    raise case match[:code]
          when 'EntityAlreadyExists', 'KeyPairMismatch', 'LimitExceeded', 'MalformedCertificate', 'ValidationError'
            Fog::AWS::STS.const_get(match[:code]).slurp(error, match[:message])
          else
            Fog::AWS::STS::Error.slurp(error, "#{match[:code]} => #{match[:message]}")
          end
  end

end
setup_credentials(options) click to toggle source
# File lib/fog/aws/sts.rb, line 95
def setup_credentials(options)
  @aws_access_key_id      = options[:aws_access_key_id]
  @aws_secret_access_key  = options[:aws_secret_access_key]
  @aws_session_token      = options[:aws_session_token]
  @aws_credentials_expire_at = options[:aws_credentials_expire_at]
  @hmac = Fog::HMAC.new('sha256', @aws_secret_access_key)
end