Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support assume role external ID in STSProfileCredentialsProvider. #2839

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Support assume role external ID in STSProfileCredentialsProvider. #2839

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3bf05b6
Support assume role external ID in `STSProfileCredentialsProvider`.
teo-tsirpanis Jan 26, 2024
0c0b01a
Ignore the `.vs` folder.
teo-tsirpanis Jan 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ Release
*#
*.iml
tags
.vs
.vscode

# CI Artifacts
Expand Down
7 changes: 6 additions & 1 deletion ...-identity-management/include/aws/identity-management/auth/STSProfileCredentialsProvider.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,8 +67,13 @@ namespace Aws
* Returns the assumed role credentials or empty credentials on error.
*/
AWSCredentials GetCredentialsFromSTS(const AWSCredentials& credentials, const Aws::String& roleARN);
/**
* Assumes a role given its ARN. Communication with STS is done through the provided credentials.
* Returns the assumed role credentials or empty credentials on error.
*/
AWSCredentials GetCredentialsFromSTS(const AWSCredentials& credentials, const Aws::String& roleARN, const Aws::String& externalId);
private:
AWSCredentials GetCredentialsFromSTSInternal(const Aws::String& roleArn, Aws::STS::STSClient* client);
AWSCredentials GetCredentialsFromSTSInternal(const Aws::String& roleArn, const Aws::String& externalId, Aws::STS::STSClient* client);

Aws::String m_profileName;
AWSCredentials m_credentials;
Expand Down
20 changes: 15 additions & 5 deletions src/aws-cpp-sdk-identity-management/source/auth/STSProfileCredentialsProvider.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -294,8 +294,9 @@ void STSProfileCredentialsProvider::Reload()
}

// get the role arn from the profile at the top of the stack (which hasn't been popped out yet)
const auto arn = sourceProfiles.back()->second.GetRoleArn();
const auto& assumedCreds = GetCredentialsFromSTS(stsCreds, arn);
const auto& arn = sourceProfiles.back()->second.GetRoleArn();
const auto& externalId = sourceProfiles.back()->second.GetExternalId();
const auto& assumedCreds = GetCredentialsFromSTS(stsCreds, arn, externalId);
sourceProfiles.back()->second.SetCredentials(assumedCreds);
}

Expand All @@ -309,14 +310,18 @@ void STSProfileCredentialsProvider::Reload()
AWSCredentialsProvider::Reload();
}

AWSCredentials STSProfileCredentialsProvider::GetCredentialsFromSTSInternal(const Aws::String& roleArn, Aws::STS::STSClient* client)
AWSCredentials STSProfileCredentialsProvider::GetCredentialsFromSTSInternal(const Aws::String& roleArn, const Aws::String& externalId, Aws::STS::STSClient* client)
{
using namespace Aws::STS::Model;
AssumeRoleRequest assumeRoleRequest;
assumeRoleRequest
.WithRoleArn(roleArn)
.WithRoleSessionName(Aws::Utils::UUID::PseudoRandomUUID())
.WithDurationSeconds(static_cast<int>(std::chrono::seconds(m_duration).count()));
if (!externalId.empty())
{
assumeRoleRequest.SetExternalId(externalId);
}
auto outcome = client->AssumeRole(assumeRoleRequest);
if (outcome.IsSuccess())
{
Expand All @@ -334,12 +339,17 @@ AWSCredentials STSProfileCredentialsProvider::GetCredentialsFromSTSInternal(cons
}

AWSCredentials STSProfileCredentialsProvider::GetCredentialsFromSTS(const AWSCredentials& credentials, const Aws::String& roleArn)
{
return GetCredentialsFromSTS(credentials, roleArn, "");
}

AWSCredentials STSProfileCredentialsProvider::GetCredentialsFromSTS(const AWSCredentials& credentials, const Aws::String& roleArn, const Aws::String& externalId)
{
using namespace Aws::STS::Model;
if (m_stsClientFactory) {
return GetCredentialsFromSTSInternal(roleArn, m_stsClientFactory(credentials));
return GetCredentialsFromSTSInternal(roleArn, externalId m_stsClientFactory(credentials));
}

Aws::STS::STSClient stsClient {credentials};
return GetCredentialsFromSTSInternal(roleArn, &stsClient);
return GetCredentialsFromSTSInternal(roleArn, externalId, &stsClient);
}