Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
22d827ad
Unverified
Commit
22d827ad
authored
Feb 21, 2018
by
neil
Committed by
GitHub
Feb 21, 2018
Browse files
Merge pull request #1292 from mal/aws-use-instance-role
Let AWS DNS API driver pull creds from instance metadata
parents
d3de50e0
759f4f2c
Changes
1
Hide whitespace changes
Inline
Side-by-side
dnsapi/dns_aws.sh
View file @
22d827ad
...
@@ -21,6 +21,11 @@ dns_aws_add() {
...
@@ -21,6 +21,11 @@ dns_aws_add() {
AWS_ACCESS_KEY_ID
=
"
${
AWS_ACCESS_KEY_ID
:-
$(
_readaccountconf_mutable AWS_ACCESS_KEY_ID
)
}
"
AWS_ACCESS_KEY_ID
=
"
${
AWS_ACCESS_KEY_ID
:-
$(
_readaccountconf_mutable AWS_ACCESS_KEY_ID
)
}
"
AWS_SECRET_ACCESS_KEY
=
"
${
AWS_SECRET_ACCESS_KEY
:-
$(
_readaccountconf_mutable AWS_SECRET_ACCESS_KEY
)
}
"
AWS_SECRET_ACCESS_KEY
=
"
${
AWS_SECRET_ACCESS_KEY
:-
$(
_readaccountconf_mutable AWS_SECRET_ACCESS_KEY
)
}
"
if
[
-z
"
$AWS_ACCESS_KEY_ID
"
]
||
[
-z
"
$AWS_SECRET_ACCESS_KEY
"
]
;
then
_use_instance_role
fi
if
[
-z
"
$AWS_ACCESS_KEY_ID
"
]
||
[
-z
"
$AWS_SECRET_ACCESS_KEY
"
]
;
then
if
[
-z
"
$AWS_ACCESS_KEY_ID
"
]
||
[
-z
"
$AWS_SECRET_ACCESS_KEY
"
]
;
then
AWS_ACCESS_KEY_ID
=
""
AWS_ACCESS_KEY_ID
=
""
AWS_SECRET_ACCESS_KEY
=
""
AWS_SECRET_ACCESS_KEY
=
""
...
@@ -29,9 +34,11 @@ dns_aws_add() {
...
@@ -29,9 +34,11 @@ dns_aws_add() {
return
1
return
1
fi
fi
#save for future use
#save for future use, unless using a role which will be fetched as needed
_saveaccountconf_mutable AWS_ACCESS_KEY_ID
"
$AWS_ACCESS_KEY_ID
"
if
[
-z
"
$_using_role
"
]
;
then
_saveaccountconf_mutable AWS_SECRET_ACCESS_KEY
"
$AWS_SECRET_ACCESS_KEY
"
_saveaccountconf_mutable AWS_ACCESS_KEY_ID
"
$AWS_ACCESS_KEY_ID
"
_saveaccountconf_mutable AWS_SECRET_ACCESS_KEY
"
$AWS_SECRET_ACCESS_KEY
"
fi
_debug
"First detect the root zone"
_debug
"First detect the root zone"
if
!
_get_root
"
$fulldomain
"
;
then
if
!
_get_root
"
$fulldomain
"
;
then
...
@@ -78,6 +85,11 @@ dns_aws_rm() {
...
@@ -78,6 +85,11 @@ dns_aws_rm() {
AWS_ACCESS_KEY_ID
=
"
${
AWS_ACCESS_KEY_ID
:-
$(
_readaccountconf_mutable AWS_ACCESS_KEY_ID
)
}
"
AWS_ACCESS_KEY_ID
=
"
${
AWS_ACCESS_KEY_ID
:-
$(
_readaccountconf_mutable AWS_ACCESS_KEY_ID
)
}
"
AWS_SECRET_ACCESS_KEY
=
"
${
AWS_SECRET_ACCESS_KEY
:-
$(
_readaccountconf_mutable AWS_SECRET_ACCESS_KEY
)
}
"
AWS_SECRET_ACCESS_KEY
=
"
${
AWS_SECRET_ACCESS_KEY
:-
$(
_readaccountconf_mutable AWS_SECRET_ACCESS_KEY
)
}
"
if
[
-z
"
$AWS_ACCESS_KEY_ID
"
]
||
[
-z
"
$AWS_SECRET_ACCESS_KEY
"
]
;
then
_use_instance_role
fi
_debug
"First detect the root zone"
_debug
"First detect the root zone"
if
!
_get_root
"
$fulldomain
"
;
then
if
!
_get_root
"
$fulldomain
"
;
then
_err
"invalid domain"
_err
"invalid domain"
...
@@ -162,6 +174,37 @@ _get_root() {
...
@@ -162,6 +174,37 @@ _get_root() {
return
1
return
1
}
}
_use_instance_role
()
{
_url
=
"http://169.254.169.254/latest/meta-data/iam/security-credentials/"
_debug
"_url"
"
$_url
"
if
!
_get
"
$_url
"
true
1 | _head_n 1 |
grep
-Fq
200
;
then
_err
"Unable to fetch IAM role from AWS instance metadata."
return
fi
_aws_role
=
$(
_get
"
$_url
"
""
1
)
_debug
"_aws_role"
"
$_aws_role
"
_aws_creds
=
"
$(
_get
"
$_url$_aws_role
"
""
1
\
| _normalizeJson
\
|
tr
'{,}'
'\n'
\
|
while
read
-r
_line
;
do
_key
=
"
$(
echo
"
${
_line
%%
:
*
}
"
|
tr
-d
'"'
)
"
_value
=
"
${
_line
#*
:
}
"
_debug3
"_key"
"
$_key
"
_secure_debug3
"_value"
"
$_value
"
case
"
$_key
"
in
AccessKeyId
)
echo
"AWS_ACCESS_KEY_ID=
$_value
"
;;
SecretAccessKey
)
echo
"AWS_SECRET_ACCESS_KEY=
$_value
"
;;
Token
)
echo
"AWS_SESSION_TOKEN=
$_value
"
;;
esac
done
\
|
paste
-sd
' '
-
)
"
_secure_debug
"_aws_creds"
"
$_aws_creds
"
eval
"
$_aws_creds
"
_using_role
=
true
}
#method uri qstr data
#method uri qstr data
aws_rest
()
{
aws_rest
()
{
mtd
=
"
$1
"
mtd
=
"
$1
"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment