module Fog::AWS::CredentialFetcher::ServiceMethods
Public Instance Methods
fetch_credentials(options)
click to toggle source
Calls superclass method
# File lib/fog/aws/credential_fetcher.rb, line 13 def fetch_credentials(options) if options[:use_iam_profile] && Fog.mocking? return Fog::AWS::Compute::Mock.data[:iam_role_based_creds] end if options[:use_iam_profile] begin role_data = nil region = options[:region] if ENV["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"] connection = options[:connection] || Excon.new(CONTAINER_CREDENTIALS_HOST) credential_path = options[:credential_path] || ENV["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"] role_data = connection.get(:path => credential_path, :idempotent => true, :expects => 200).body if region.nil? connection = options[:metadata_connection] || Excon.new(INSTANCE_METADATA_HOST) token_header = fetch_credentials_token_header(connection, options[:disable_imds_v2]) region = connection.get(:path => INSTANCE_METADATA_AZ, :idempotent => true, :expects => 200, :headers => token_header).body[0..-2] end else connection = options[:connection] || Excon.new(INSTANCE_METADATA_HOST) token_header = fetch_credentials_token_header(connection, options[:disable_imds_v2]) role_name = connection.get(:path => INSTANCE_METADATA_PATH, :idempotent => true, :expects => 200, :headers => token_header).body role_data = connection.get(:path => INSTANCE_METADATA_PATH+role_name, :idempotent => true, :expects => 200, :headers => token_header).body region ||= connection.get(:path => INSTANCE_METADATA_AZ, :idempotent => true, :expects => 200, :headers => token_header).body[0..-2] end session = Fog::JSON.decode(role_data) credentials = {} credentials[:aws_access_key_id] = session['AccessKeyId'] credentials[:aws_secret_access_key] = session['SecretAccessKey'] credentials[:aws_session_token] = session['Token'] credentials[:aws_credentials_expire_at] = Time.xmlschema session['Expiration'] # set region by default to the one the instance is in. credentials[:region] = region #these indicate the metadata service is unavailable or has no profile setup credentials rescue Excon::Error => e Fog::Logger.warning("Unable to fetch credentials: #{e.message}") super end else super end end
fetch_credentials_token_header(connection, disable_imds_v2)
click to toggle source
# File lib/fog/aws/credential_fetcher.rb, line 60 def fetch_credentials_token_header(connection, disable_imds_v2) return nil if disable_imds_v2 token = connection.put( :path => INSTANCE_METADATA_TOKEN, :idempotent => true, :expects => 200, :retry_interval => 1, :retry_limit => 3, :read_timeout => 1, :write_timeout => 1, :connect_timeout => 1, :headers => { "X-aws-ec2-metadata-token-ttl-seconds" => "300" } ).body { "X-aws-ec2-metadata-token" => token } rescue Excon::Error nil end