Examples with AssumeRoleRequest com.amazonaws.services.securitytoken.model.AssumeRoleRequest used on opensource projects

Example 6 with AssumeRoleRequest

use of com.amazonaws.services.securitytoken.model.AssumeRoleRequest in project athenz by yahoo.

the class CloudStoreTest method testGetAssumeRoleRequest.

@Test
public void testGetAssumeRoleRequest() {
    CloudStore store = new CloudStore();
    AssumeRoleRequest req = store.getAssumeRoleRequest("1234", "admin", null, null);
    assertEquals("arn:aws:iam::1234:role/admin", req.getRoleArn());
    assertEquals("athenz-zts-service", req.getRoleSessionName());
    assertNull(req.getDurationSeconds());
    assertNull(req.getExternalId());
    req = store.getAssumeRoleRequest("12345", "adminuser", 101, "external");
    assertEquals("arn:aws:iam::12345:role/adminuser", req.getRoleArn());
    assertEquals("athenz-zts-service", req.getRoleSessionName());
    assertEquals(Integer.valueOf(101), req.getDurationSeconds());
    assertEquals("external", req.getExternalId());
    store.close();
}

Example 7 with AssumeRoleRequest

use of com.amazonaws.services.securitytoken.model.AssumeRoleRequest in project athenz by yahoo.

the class CloudStore method getAssumeRoleRequest.

AssumeRoleRequest getAssumeRoleRequest(String account, String roleName, Integer durationSeconds, String externalId) {
    // assume the target role to get the credentials for the client
    // aws format is arn:aws:iam::<account-id>:role/<role-name>
    final String arn = "arn:aws:iam::" + account + ":role/" + roleName;
    AssumeRoleRequest req = new AssumeRoleRequest();
    req.setRoleArn(arn);
    // for role session name AWS has a limit on length: 64
    // so we need to make sure our session is shorter than that
    req.setRoleSessionName(AWS_ROLE_SESSION_NAME);
    if (durationSeconds != null && durationSeconds > 0) {
        req.setDurationSeconds(durationSeconds);
    }
    if (externalId != null && !externalId.isEmpty()) {
        req.setExternalId(externalId);
    }
    return req;
}

Example 8 with AssumeRoleRequest

use of com.amazonaws.services.securitytoken.model.AssumeRoleRequest in project athenz by yahoo.

the class CloudStore method assumeAWSRole.

public AWSTemporaryCredentials assumeAWSRole(String account, String roleName, String principal, Integer durationSeconds, String externalId, StringBuilder errorMessage) {
    if (!awsEnabled) {
        throw new ResourceException(ResourceException.INTERNAL_SERVER_ERROR, "AWS Support not enabled");
    }
    // first check to see if we already have the temp creds cached
    final String cacheKey = getCacheKey(account, roleName, principal, durationSeconds, externalId);
    AWSTemporaryCredentials tempCreds = getCachedCreds(cacheKey, durationSeconds);
    if (tempCreds != null) {
        return tempCreds;
    }
    if (isFailedTempCredsRequest(cacheKey)) {
        errorMessage.append("Cached invalid request. Retry operation after ").append(invalidCacheTimeout).append(" seconds.");
        return null;
    }
    AssumeRoleRequest req = getAssumeRoleRequest(account, roleName, durationSeconds, externalId);
    try {
        AWSSecurityTokenService client = getTokenServiceClient();
        AssumeRoleResult res = client.assumeRole(req);
        Credentials awsCreds = res.getCredentials();
        tempCreds = new AWSTemporaryCredentials().setAccessKeyId(awsCreds.getAccessKeyId()).setSecretAccessKey(awsCreds.getSecretAccessKey()).setSessionToken(awsCreds.getSessionToken()).setExpiration(Timestamp.fromMillis(awsCreds.getExpiration().getTime()));
    } catch (AmazonServiceException ex) {
        LOGGER.error("CloudStore: assumeAWSRole - unable to assume role: {}, error: {}, status code: {}", req.getRoleArn(), ex.getMessage(), ex.getStatusCode());
        if (ex.getStatusCode() == ResourceException.FORBIDDEN) {
            putInvalidCacheCreds(cacheKey);
        }
        errorMessage.append(ex.getErrorMessage());
        return null;
    } catch (Exception ex) {
        LOGGER.error("CloudStore: assumeAWSRole - unable to assume role: {}, error: {}", req.getRoleArn(), ex.getMessage());
        errorMessage.append(ex.getMessage());
        return null;
    }
    putCacheCreds(cacheKey, tempCreds);
    return tempCreds;
}

Example 9 with AssumeRoleRequest

use of com.amazonaws.services.securitytoken.model.AssumeRoleRequest in project photon-model by vmware.

the class AWSUtils method getArnSessionCredentialsAsync.

/**
 * Authenticates and returns a DeferredResult set of session credentials for a valid ARN that
 * authorizes this system's account ID (validated through
 * {@link #AWS_MASTER_ACCOUNT_ACCESS_KEY_PROPERTY} and
 * {@link #AWS_MASTER_ACCOUNT_SECRET_KEY_PROPERTY}) and the externalId parameter.
 *
 * If the system properties are unset, then this call will automatically fail.
 *
 * @param arn The Amazon Resource Name to validate.
 * @param externalId The external ID this ARN has authorized.
 * @param region The region to validate within.
 * @param executorService The executor service to issue the request.
 */
public static DeferredResult<Credentials> getArnSessionCredentialsAsync(String arn, String externalId, String region, ExecutorService executorService) {
    AWSCredentialsProvider serviceAwsCredentials;
    try {
        serviceAwsCredentials = new AWSStaticCredentialsProvider(new BasicAWSCredentials(AWS_MASTER_ACCOUNT_ACCESS_KEY, AWS_MASTER_ACCOUNT_SECRET_KEY));
    } catch (Throwable t) {
        return DeferredResult.failed(t);
    }
    AWSSecurityTokenServiceAsync awsSecurityTokenServiceAsync = AWSSecurityTokenServiceAsyncClientBuilder.standard().withRegion(region).withCredentials(serviceAwsCredentials).withExecutorFactory(() -> executorService).build();
    AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest().withRoleArn(arn).withRoleSessionName(UUID.randomUUID().toString()).withDurationSeconds(getArnSessionDurationSeconds()).withExternalId(externalId);
    DeferredResult<AssumeRoleResult> r = new DeferredResult<>();
    OperationContext operationContext = OperationContext.getOperationContext();
    awsSecurityTokenServiceAsync.assumeRoleAsync(assumeRoleRequest, new AsyncHandler<AssumeRoleRequest, AssumeRoleResult>() {

        @Override
        public void onSuccess(AssumeRoleRequest request, AssumeRoleResult result) {
            OperationContext.restoreOperationContext(operationContext);
            r.complete(result);
        }

        @Override
        public void onError(Exception ex) {
            OperationContext.restoreOperationContext(operationContext);
            r.fail(ex);
        }
    });
    return r.thenApply(AssumeRoleResult::getCredentials);
}

Example 10 with AssumeRoleRequest

use of com.amazonaws.services.securitytoken.model.AssumeRoleRequest in project cloudbreak by hortonworks.

the class AwsSessionCredentialClient method retrieveSessionCredentials.

public BasicSessionCredentials retrieveSessionCredentials(AwsCredentialView awsCredential) {
    LOGGER.debug("retrieving session credential");
    AWSSecurityTokenServiceClient client = awsSecurityTokenServiceClient();
    AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest().withDurationSeconds(DEFAULT_SESSION_CREDENTIALS_DURATION).withExternalId(externalId).withRoleArn(awsCredential.getRoleArn()).withRoleSessionName("hadoop-provisioning");
    AssumeRoleResult result = client.assumeRole(assumeRoleRequest);
    return new BasicSessionCredentials(result.getCredentials().getAccessKeyId(), result.getCredentials().getSecretAccessKey(), result.getCredentials().getSessionToken());
}