Class: Conjur::API::IAMAuthenticator

Inherits:
Object
  • Object
show all
Includes:
TokenExpiration
Defined in:
lib/conjur/api/authn_iam.rb

Overview

Authenticator that uses AWS IAM credentials to obtain Conjur access tokens. Signs an AWS STS GetCallerIdentity request with SigV4, then POSTs the resulting headers as JSON to the Conjur authn-iam endpoint.

Requires the aws-sdk-core gem (not bundled with conjur-api). Add gem 'aws-sdk-core' to your Gemfile to use this authenticator.

Constant Summary collapse

DEFAULT_SERVICE_ID = 
'prod'.freeze
DEFAULT_REGION = 
'us-east-1'.freeze
STS_GLOBAL_URL = 
'https://sts.amazonaws.com/?Action=GetCallerIdentity&Version=2011-06-15'.freeze
STS_REGIONAL_URL = 
'https://sts.%<region>s.amazonaws.com/?Action=GetCallerIdentity&Version=2011-06-15'.freeze
STS_GLOBAL_SIGNING_REGION = 
'us-east-1'.freeze

Constants included from TokenExpiration

TokenExpiration::TOKEN_STALE

Instance Attribute Summary collapse

Attributes included from TokenExpiration

#token_born

Instance Method Summary collapse

Methods included from TokenExpiration

#gettime, #needs_token_refresh?, #token_age, #update_token_born

Constructor Details

#initialize(account, service_id, identity, aws_region = DEFAULT_REGION) ⇒ IAMAuthenticator

Returns a new instance of IAMAuthenticator.



26
27
28
29
30
31
32
 
# File 'lib/conjur/api/authn_iam.rb', line 26

def initialize(, service_id, identity, aws_region = DEFAULT_REGION)
  @account    = 
  @service_id = service_id
  @identity   = identity
  @aws_region = aws_region
  update_token_born
end

Instance Attribute Details

#account ⇒ Object (readonly)

Returns the value of attribute account.



24
25
26
 
# File 'lib/conjur/api/authn_iam.rb', line 24

def 
  @account
end

#aws_region ⇒ Object (readonly)

Returns the value of attribute aws_region.



24
25
26
 
# File 'lib/conjur/api/authn_iam.rb', line 24

def aws_region
  @aws_region
end

#identity ⇒ Object (readonly)

Returns the value of attribute identity.



24
25
26
 
# File 'lib/conjur/api/authn_iam.rb', line 24

def identity
  @identity
end

#service_id ⇒ Object (readonly)

Returns the value of attribute service_id.



24
25
26
 
# File 'lib/conjur/api/authn_iam.rb', line 24

def service_id
  @service_id
end

Instance Method Details

#refresh_token ⇒ Object 



34
35
36
37
38
39
40
 
# File 'lib/conjur/api/authn_iam.rb', line 34

def refresh_token
  Conjur::API.authenticate_iam(identity, account: ,
                                         service_id: service_id,
                                         aws_region: aws_region).tap do
    update_token_born
  end
end