Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added configuration parameter to support non-default STS API Endpoint. #186

Merged
merged 3 commits into from
Oct 10, 2019
Merged

Added configuration parameter to support non-default STS API Endpoint. #186

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
60e6e9c
added sts endpoint url parameter to support regional endpoints
sbruggeman Sep 19, 2019
8f50191
updated readme to include documentation for new sts_endpoint_url conf…
sbruggeman Sep 20, 2019
3f4e2d3
modified sts client to support using sts endpoint url and sts proxy t…
sbruggeman Sep 30, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,6 +177,10 @@ Proxy url for proxying requests to amazon sts service api. This needs to be set
It should be added to assume_role_credentials configuration stanza in the next format:
sts_http_proxy http://[username:password]@hostname:port

**sts_endpoint_url**

STS API endpoint url. This can be used to override the default global STS API endpoint of sts.amazonaws.com. Using regional endpoints may be preferred to reduce latency, and are required if utilizing a PrivateLink VPC Endpoint for STS API calls.

### instance_profile_credentials

Retrieve temporary security credentials via HTTP request. This is useful on EC2 instance.
Expand Down
15 changes: 12 additions & 3 deletions lib/fluent/plugin/kinesis_helper/client.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,8 @@ module ClientParams
config_param :external_id, :string, default: nil, secret: true
desc "A http proxy url for requests to aws sts service"
config_param :sts_http_proxy, :string, default: nil, secret: true
desc "A URL for a regional STS API endpoint, the default is global"
config_param :sts_endpoint_url, :string, default: nil
end
config_section :instance_profile_credentials, multi: false do
desc "Number of times to retry when retrieving credentials"
Expand Down Expand Up @@ -125,12 +127,19 @@ def setup_credentials
credentials_options[:policy] = c.policy if c.policy
credentials_options[:duration_seconds] = c.duration_seconds if c.duration_seconds
credentials_options[:external_id] = c.external_id if c.external_id
if c.sts_http_proxy and @region
credentials_options[:sts_endpoint_url] = c.sts_endpoint_url if c.sts_endpoint_url
if c.sts_http_proxy and c.sts_endpoint_url
credentials_options[:client] = Aws::STS::Client.new(http_proxy: c.sts_http_proxy, endpoint: c.sts_endpoint_url)
elsif c.sts_http_proxy and @region
credentials_options[:client] = Aws::STS::Client.new(region: @region, http_proxy: c.sts_http_proxy)
elsif @region
credentials_options[:client] = Aws::STS::Client.new(region: @region)
elsif @region and c.sts_endpoint_url
credentials_options[:client] = Aws::STS::Client.new(region: @region, endpoint: c.sts_endpoint_url)
elsif c.sts_http_proxy
credentials_options[:client] = Aws::STS::Client.new(http_proxy: c.sts_http_proxy)
elsif c.sts_endpoint_url
credentials_options[:client] = Aws::STS::Client.new(endpoint: c.sts_endpoint_url)
elsif @region
credentials_options[:client] = Aws::STS::Client.new(region: @region)
end
options[:credentials] = Aws::AssumeRoleCredentials.new(credentials_options)
when @instance_profile_credentials
Expand Down