kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

[rubygems/rubygems] Use IAM role to extract security-credentials for EC2 instance

Browse source 
https://github.com/rubygems/rubygems/commit/9a401646e1
This commit is contained in:
Alexander Pakulov 2019-08-21 15:19:10 -07:00 committed by Hiroshi SHIBATA
parent d219be4a1c
commit d84b9b6d0a
1 changed files with 13 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
lib/rubygems/s3_uri_signer.rb
View file

@ -150,16 +150,23 @@ class Gem::S3URISigner
require 'rubygems/request/connection_pools'
require 'json'
metadata_uri = URI(EC2_METADATA_CREDENTIALS)
@request_pool ||= create_request_pool(metadata_uri)
request = Gem::Request.new(metadata_uri, Net::HTTP::Get, nil, @request_pool)
iam_info = ec2_metadata_request(EC2_IAM_INFO)
# Expected format: arn:aws:iam::<id>:instance-profile/<role_name>
role_name = iam_info['InstanceProfileArn'].split('/')[1]
ec2_metadata_request(EC2_IAM_SECURITY_CREDENTIALS + role_name)
end
def ec2_metadata_request(url)
uri = URI(url)
@request_pool ||= create_request_pool(uri)
request = Gem::Request.new(uri, Net::HTTP::Get, nil, @request_pool)
response = request.fetch
case response
when Net::HTTPOK then
JSON.parse(response.body)
else
raise InstanceProfileError.new("Unable to fetch AWS credentials from #{metadata_uri}: #{response.message} #{response.code}")
raise InstanceProfileError.new("Unable to fetch AWS metadata from #{uri}: #{response.message} #{response.code}")
end
end
@ -170,6 +177,7 @@ class Gem::S3URISigner
end
BASE64_URI_TRANSLATE = { "+" => "%2B", "/" => "%2F", "=" => "%3D", "\n" => "" }.freeze
EC2_METADATA_CREDENTIALS = "http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance".freeze
EC2_IAM_INFO = "http://169.254.169.254/latest/meta-data/iam/info".freeze
EC2_IAM_SECURITY_CREDENTIALS = "http://169.254.169.254/latest/meta-data/iam/security-credentials/".freeze
end