Examples with GetCallerIdentityResult com.amazonaws.services.securitytoken.model.GetCallerIdentityResult used on opensource projects

Example 1 with GetCallerIdentityResult

use of com.amazonaws.services.securitytoken.model.GetCallerIdentityResult in project athenz by yahoo.

the class InstanceAWSProviderTest method testVerifyInstanceIdentity.

@Test
public void testVerifyInstanceIdentity() {
    MockInstanceAWSProvider provider = new MockInstanceAWSProvider();
    provider.setIdentitySuper(true);
    AWSSecurityTokenServiceClient mockClient = Mockito.mock(AWSSecurityTokenServiceClient.class);
    GetCallerIdentityResult result = Mockito.mock(GetCallerIdentityResult.class);
    Mockito.when(result.getArn()).thenReturn("arn:aws:sts::1234:assumed-role/athenz.service/athenz.service");
    Mockito.when(mockClient.getCallerIdentity(ArgumentMatchers.any())).thenReturn(result);
    provider.setStsClient(mockClient);
    AWSAttestationData info = new AWSAttestationData();
    info.setRole("athenz.service");
    assertTrue(provider.verifyInstanceIdentity(info, "1234"));
}

Example 2 with GetCallerIdentityResult

use of com.amazonaws.services.securitytoken.model.GetCallerIdentityResult in project athenz by yahoo.

the class InstanceAWSProviderTest method testVerifyInstanceIdentityARNMismatch.

@Test
public void testVerifyInstanceIdentityARNMismatch() {
    MockInstanceAWSProvider provider = new MockInstanceAWSProvider();
    provider.setIdentitySuper(true);
    AWSSecurityTokenServiceClient mockClient = Mockito.mock(AWSSecurityTokenServiceClient.class);
    GetCallerIdentityResult result = Mockito.mock(GetCallerIdentityResult.class);
    Mockito.when(result.getArn()).thenReturn("arn:aws:sts::1235:assumed-role/athenz.service/athenz.service");
    Mockito.when(mockClient.getCallerIdentity(ArgumentMatchers.any())).thenReturn(result);
    provider.setStsClient(mockClient);
    AWSAttestationData info = new AWSAttestationData();
    info.setRole("athenz.service");
    assertFalse(provider.verifyInstanceIdentity(info, "1234"));
}

Example 3 with GetCallerIdentityResult

use of com.amazonaws.services.securitytoken.model.GetCallerIdentityResult in project athenz by yahoo.

the class InstanceAWSProvider method verifyInstanceIdentity.

boolean verifyInstanceIdentity(AWSAttestationData info, final String awsAccount) {
    GetCallerIdentityRequest req = new GetCallerIdentityRequest();
    try {
        AWSSecurityTokenService client = getInstanceClient(info);
        if (client == null) {
            LOGGER.error("verifyInstanceIdentity - unable to get AWS STS client object");
            return false;
        }
        GetCallerIdentityResult res = client.getCallerIdentity(req);
        if (res == null) {
            LOGGER.error("verifyInstanceIdentity - unable to get caller identity");
            return false;
        }
        String arn = "arn:aws:sts::" + awsAccount + ":assumed-role/" + info.getRole() + "/";
        if (!res.getArn().startsWith(arn)) {
            LOGGER.error("verifyInstanceIdentity - ARN mismatch - request: {} caller-idenity: {}", arn, res.getArn());
            return false;
        }
        return true;
    } catch (Exception ex) {
        LOGGER.error("CloudStore: verifyInstanceIdentity - unable get caller identity: {}", ex.getMessage());
        return false;
    }
}