Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
22d827ad
Unverified
Commit
22d827ad
authored
Feb 21, 2018
by
neil
Committed by
GitHub
Feb 21, 2018
Browse files
Merge pull request #1292 from mal/aws-use-instance-role
Let AWS DNS API driver pull creds from instance metadata
parents
d3de50e0
759f4f2c
Changes
1
Show whitespace changes
Inline
Side-by-side
dnsapi/dns_aws.sh
View file @
22d827ad
...
...
@@ -21,6 +21,11 @@ dns_aws_add() {
AWS_ACCESS_KEY_ID
=
"
${
AWS_ACCESS_KEY_ID
:-
$(
_readaccountconf_mutable AWS_ACCESS_KEY_ID
)
}
"
AWS_SECRET_ACCESS_KEY
=
"
${
AWS_SECRET_ACCESS_KEY
:-
$(
_readaccountconf_mutable AWS_SECRET_ACCESS_KEY
)
}
"
if
[
-z
"
$AWS_ACCESS_KEY_ID
"
]
||
[
-z
"
$AWS_SECRET_ACCESS_KEY
"
]
;
then
_use_instance_role
fi
if
[
-z
"
$AWS_ACCESS_KEY_ID
"
]
||
[
-z
"
$AWS_SECRET_ACCESS_KEY
"
]
;
then
AWS_ACCESS_KEY_ID
=
""
AWS_SECRET_ACCESS_KEY
=
""
...
...
@@ -29,9 +34,11 @@ dns_aws_add() {
return
1
fi
#save for future use
#save for future use, unless using a role which will be fetched as needed
if
[
-z
"
$_using_role
"
]
;
then
_saveaccountconf_mutable AWS_ACCESS_KEY_ID
"
$AWS_ACCESS_KEY_ID
"
_saveaccountconf_mutable AWS_SECRET_ACCESS_KEY
"
$AWS_SECRET_ACCESS_KEY
"
fi
_debug
"First detect the root zone"
if
!
_get_root
"
$fulldomain
"
;
then
...
...
@@ -78,6 +85,11 @@ dns_aws_rm() {
AWS_ACCESS_KEY_ID
=
"
${
AWS_ACCESS_KEY_ID
:-
$(
_readaccountconf_mutable AWS_ACCESS_KEY_ID
)
}
"
AWS_SECRET_ACCESS_KEY
=
"
${
AWS_SECRET_ACCESS_KEY
:-
$(
_readaccountconf_mutable AWS_SECRET_ACCESS_KEY
)
}
"
if
[
-z
"
$AWS_ACCESS_KEY_ID
"
]
||
[
-z
"
$AWS_SECRET_ACCESS_KEY
"
]
;
then
_use_instance_role
fi
_debug
"First detect the root zone"
if
!
_get_root
"
$fulldomain
"
;
then
_err
"invalid domain"
...
...
@@ -162,6 +174,37 @@ _get_root() {
return
1
}
_use_instance_role
()
{
_url
=
"http://169.254.169.254/latest/meta-data/iam/security-credentials/"
_debug
"_url"
"
$_url
"
if
!
_get
"
$_url
"
true
1 | _head_n 1 |
grep
-Fq
200
;
then
_err
"Unable to fetch IAM role from AWS instance metadata."
return
fi
_aws_role
=
$(
_get
"
$_url
"
""
1
)
_debug
"_aws_role"
"
$_aws_role
"
_aws_creds
=
"
$(
_get
"
$_url$_aws_role
"
""
1
\
| _normalizeJson
\
|
tr
'{,}'
'\n'
\
|
while
read
-r
_line
;
do
_key
=
"
$(
echo
"
${
_line
%%
:
*
}
"
|
tr
-d
'"'
)
"
_value
=
"
${
_line
#*
:
}
"
_debug3
"_key"
"
$_key
"
_secure_debug3
"_value"
"
$_value
"
case
"
$_key
"
in
AccessKeyId
)
echo
"AWS_ACCESS_KEY_ID=
$_value
"
;;
SecretAccessKey
)
echo
"AWS_SECRET_ACCESS_KEY=
$_value
"
;;
Token
)
echo
"AWS_SESSION_TOKEN=
$_value
"
;;
esac
done
\
|
paste
-sd
' '
-
)
"
_secure_debug
"_aws_creds"
"
$_aws_creds
"
eval
"
$_aws_creds
"
_using_role
=
true
}
#method uri qstr data
aws_rest
()
{
mtd
=
"
$1
"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment