Class: Aws::AssumeRoleWebIdentityCredentials

Inherits:
Object
  • Object
show all
Includes:
CredentialProvider, RefreshingCredentials
Defined in:
lib/aws-sdk-core/assume_role_web_identity_credentials.rb

Overview

An auto-refreshing credential provider that assumes a role via STS::Client#assume_role_with_web_identity.

role_credentials = Aws::AssumeRoleWebIdentityCredentials.new(
  client: Aws::STS::Client.new(...),
  role_arn: "linked::account::arn",
  web_identity_token_file: "/path/to/token/file",
  role_session_name: "session-name"
  ...
)
ec2 = Aws::EC2::Client.new(credentials: role_credentials)

If you omit ‘:client` option, a new STS::Client object will be constructed with additional options that were provided.

See Also:

Constant Summary

Constants included from RefreshingCredentials

RefreshingCredentials::ASYNC_EXPIRATION_LENGTH, RefreshingCredentials::CLIENT_EXCLUDE_OPTIONS, RefreshingCredentials::SYNC_EXPIRATION_LENGTH

Instance Attribute Summary collapse

Attributes included from CredentialProvider

#credentials, #expiration

Class Method Summary collapse

Instance Method Summary collapse

Methods included from RefreshingCredentials

#credentials, #refresh!

Methods included from CredentialProvider

#set?

Constructor Details

#initialize(options = {}) ⇒ AssumeRoleWebIdentityCredentials

Returns a new instance of AssumeRoleWebIdentityCredentials.

Parameters:

  • options (Hash) (defaults to: {})

Options Hash (options):

  • :role_arn (required, String) —

    the IAM role to be assumed

  • :web_identity_token_file (required, String) —

    absolute path to the file on disk containing OIDC token

  • :role_session_name (String) —

    the IAM session name used to distinguish session, when not provided, base64 encoded UUID is generated as the session name

  • :client (STS::Client)
  • before_refresh (Callable) —

    Proc called before credentials are refreshed. ‘before_refresh` is called with an instance of this object when AWS credentials are required and need to be refreshed.



46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
 
# File 'lib/aws-sdk-core/assume_role_web_identity_credentials.rb', line 46

def initialize(options = {})
  client_opts = {}
  @assume_role_web_identity_params = {}
  @token_file = options.delete(:web_identity_token_file)
  @async_refresh = true
  options.each_pair do |key, value|
    if self.class.assume_role_web_identity_options.include?(key)
      @assume_role_web_identity_params[key] = value
    elsif !CLIENT_EXCLUDE_OPTIONS.include?(key)
      client_opts[key] = value
    end
  end

  unless @assume_role_web_identity_params[:role_session_name]
    # not provided, generate encoded UUID as session name
    @assume_role_web_identity_params[:role_session_name] = _session_name
  end
  @client = client_opts[:client] || STS::Client.new(client_opts.merge(credentials: nil))
  super
end

Instance Attribute Details

#client ⇒ STS::Client (readonly)

Returns:



68
69
70
 
# File 'lib/aws-sdk-core/assume_role_web_identity_credentials.rb', line 68

def client
  @client
end

Class Method Details

.assume_role_web_identity_options ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future. 



106
107
108
109
110
111
 
# File 'lib/aws-sdk-core/assume_role_web_identity_credentials.rb', line 106

def assume_role_web_identity_options
  @arwio ||= begin
    input = Aws::STS::Client.api.operation(:assume_role_with_web_identity).input
    Set.new(input.shape.member_names)
  end
end