Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
c17c47f1
Unverified
Commit
c17c47f1
authored
Feb 23, 2018
by
neil
Committed by
GitHub
Feb 23, 2018
Browse files
Merge pull request #1300 from mal/aws-use-container-role
Pull AWS creds from container role
parents
e58d19b4
f49f55f4
Changes
1
Hide whitespace changes
Inline
Side-by-side
dnsapi/dns_aws.sh
View file @
c17c47f1
...
@@ -23,7 +23,7 @@ dns_aws_add() {
...
@@ -23,7 +23,7 @@ dns_aws_add() {
AWS_SECRET_ACCESS_KEY
=
"
${
AWS_SECRET_ACCESS_KEY
:-
$(
_readaccountconf_mutable AWS_SECRET_ACCESS_KEY
)
}
"
AWS_SECRET_ACCESS_KEY
=
"
${
AWS_SECRET_ACCESS_KEY
:-
$(
_readaccountconf_mutable AWS_SECRET_ACCESS_KEY
)
}
"
if
[
-z
"
$AWS_ACCESS_KEY_ID
"
]
||
[
-z
"
$AWS_SECRET_ACCESS_KEY
"
]
;
then
if
[
-z
"
$AWS_ACCESS_KEY_ID
"
]
||
[
-z
"
$AWS_SECRET_ACCESS_KEY
"
]
;
then
_use_instance_role
_use_container_role
||
_use_instance_role
fi
fi
if
[
-z
"
$AWS_ACCESS_KEY_ID
"
]
||
[
-z
"
$AWS_SECRET_ACCESS_KEY
"
]
;
then
if
[
-z
"
$AWS_ACCESS_KEY_ID
"
]
||
[
-z
"
$AWS_SECRET_ACCESS_KEY
"
]
;
then
...
@@ -87,7 +87,7 @@ dns_aws_rm() {
...
@@ -87,7 +87,7 @@ dns_aws_rm() {
AWS_SECRET_ACCESS_KEY
=
"
${
AWS_SECRET_ACCESS_KEY
:-
$(
_readaccountconf_mutable AWS_SECRET_ACCESS_KEY
)
}
"
AWS_SECRET_ACCESS_KEY
=
"
${
AWS_SECRET_ACCESS_KEY
:-
$(
_readaccountconf_mutable AWS_SECRET_ACCESS_KEY
)
}
"
if
[
-z
"
$AWS_ACCESS_KEY_ID
"
]
||
[
-z
"
$AWS_SECRET_ACCESS_KEY
"
]
;
then
if
[
-z
"
$AWS_ACCESS_KEY_ID
"
]
||
[
-z
"
$AWS_SECRET_ACCESS_KEY
"
]
;
then
_use_instance_role
_use_container_role
||
_use_instance_role
fi
fi
_debug
"First detect the root zone"
_debug
"First detect the root zone"
...
@@ -174,17 +174,30 @@ _get_root() {
...
@@ -174,17 +174,30 @@ _get_root() {
return
1
return
1
}
}
_use_container_role
()
{
# automatically set if running inside ECS
if
[
-z
"
$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
"
]
;
then
_debug
"No ECS environment variable detected"
return
1
fi
_use_metadata
"169.254.170.2
$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
"
}
_use_instance_role
()
{
_use_instance_role
()
{
_url
=
"http://169.254.169.254/latest/meta-data/iam/security-credentials/"
_url
=
"http://169.254.169.254/latest/meta-data/iam/security-credentials/"
_debug
"_url"
"
$_url
"
_debug
"_url"
"
$_url
"
if
!
_get
"
$_url
"
true
1 | _head_n 1 |
grep
-Fq
200
;
then
if
!
_get
"
$_url
"
true
1 | _head_n 1 |
grep
-Fq
200
;
then
_
err
"Unable to fetch IAM role from
AWS
instance metadata
.
"
_
debug
"Unable to fetch IAM role from instance metadata"
return
return
1
fi
fi
_aws_role
=
$(
_get
"
$_url
"
""
1
)
_aws_role
=
$(
_get
"
$_url
"
""
1
)
_debug
"_aws_role"
"
$_aws_role
"
_debug
"_aws_role"
"
$_aws_role
"
_use_metadata
"
$_url$_aws_role
"
}
_use_metadata
()
{
_aws_creds
=
"
$(
_aws_creds
=
"
$(
_get
"
$
_url$_aws_role
"
""
1
\
_get
"
$
1
"
""
1
\
| _normalizeJson
\
| _normalizeJson
\
|
tr
'{,}'
'\n'
\
|
tr
'{,}'
'\n'
\
|
while
read
-r
_line
;
do
|
while
read
-r
_line
;
do
...
@@ -201,6 +214,11 @@ _use_instance_role() {
...
@@ -201,6 +214,11 @@ _use_instance_role() {
|
paste
-sd
' '
-
|
paste
-sd
' '
-
)
"
)
"
_secure_debug
"_aws_creds"
"
$_aws_creds
"
_secure_debug
"_aws_creds"
"
$_aws_creds
"
if
[
-z
"
$_aws_creds
"
]
;
then
return
1
fi
eval
"
$_aws_creds
"
eval
"
$_aws_creds
"
_using_role
=
true
_using_role
=
true
}
}
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment