Class: Aws::AssumeRoleWebIdentityCredentials

Inherits:
Object
  • Object
show all
Includes:
CredentialProvider
Defined in:
gems/aws-sdk-core/lib/aws-sdk-core/assume_role_web_identity_credentials.rb

Overview

An auto-refreshing credential provider that assumes a role via STS::Client#assume_role_with_web_identity.

role_credentials = Aws::AssumeRoleWebIdentityCredentials.new(
  client: Aws::STS::Client.new(...),
  role_arn: "linked::account::arn",
  web_identity_token_file: "/path/to/token/file",
  role_session_name: "session-name"
  ...
)
ec2 = Aws::EC2::Client.new(credentials: role_credentials)

If you omit :client option, a new STS::Client object will be constructed with additional options that were provided.

See Also:

Instance Attribute Summary collapse

Attributes included from CredentialProvider

#credentials, #expiration

Instance Method Summary collapse

Methods included from CredentialProvider

#set?

Constructor Details

#initialize(options = {}) ⇒ AssumeRoleWebIdentityCredentials

Returns a new instance of AssumeRoleWebIdentityCredentials.

Parameters:

  • options (Hash) (defaults to: {})

Options Hash (options):

  • :role_arn (required, String) —

    the IAM role to be assumed

  • :web_identity_token_file (required, String) —

    absolute path to the file on disk containing OIDC token

  • :role_session_name (String) —

    the IAM session name used to distinguish session, when not provided, base64 encoded UUID is generated as the session name

  • :client (STS::Client)
  • before_refresh (Callable) —

    Proc called before credentials are refreshed. before_refresh is called with an instance of this object when AWS credentials are required and need to be refreshed.



46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
 
# File 'gems/aws-sdk-core/lib/aws-sdk-core/assume_role_web_identity_credentials.rb', line 46

def initialize(options = {})
  client_opts = {}
  @assume_role_web_identity_params = {}
  @token_file = options.delete(:web_identity_token_file)
  @async_refresh = true
  options.each_pair do |key, value|
    if self.class.assume_role_web_identity_options.include?(key)
      @assume_role_web_identity_params[key] = value
    elsif !CLIENT_EXCLUDE_OPTIONS.include?(key)
      client_opts[key] = value
    end
  end

  unless @assume_role_web_identity_params[:role_session_name]
    # not provided, generate encoded UUID as session name
    @assume_role_web_identity_params[:role_session_name] = _session_name
  end
  @client = client_opts[:client] || STS::Client.new(client_opts.merge(credentials: false))
  super
end

Instance Attribute Details

#client ⇒ STS::Client (readonly)

Returns:



68
69
70
 
# File 'gems/aws-sdk-core/lib/aws-sdk-core/assume_role_web_identity_credentials.rb', line 68

def client
  @client
end