awsutil

Documentation

Index

• Constants
• func AssumeRole(stsClient stscreds.AssumeRoleAPIClient, roleSessionName string, roleArn string, ...) (aws.Credentials, error)
• func AssumeRoleSequence(seedClient stscreds.AssumeRoleAPIClient, ...) (aws.Credentials, error)
• func AssumeRoleWithJWT(jwt string, roleArn string, ...) (aws.Credentials, error)
• func GetConsoleURL(signinToken string, region string, sessionDurationMinutes int) (*url.URL, error)
• func StsClient(proxyURL *string) (*sts.Client, error)
• type AWSFederatedSessionData
• type AWSSigninTokenResponse
  • func GetSigninToken(awsCredentials aws.Credentials, region string) (*AWSSigninTokenResponse, error)
• type Condition
• type IPAddress
• type IdentityTokenValue
  • func (j IdentityTokenValue) GetIdentityToken() ([]byte, error)
• type PolicyDocument
  • func NewPolicyDocument(version string, statements []PolicyStatement) PolicyDocument
  • func (p PolicyDocument) BuildPolicyWithRestrictedIP(ipAddress IPAddress) (PolicyDocument, error)
  • func (p PolicyDocument) String() string
• type PolicyDocumentInterface
• type PolicyStatement
  • func NewPolicyStatement(sid string, affect string, action []string) PolicyStatement
  • func (ps PolicyStatement) AddCondition(condition *Condition) PolicyStatement
  • func (ps PolicyStatement) AddResource(resource *string) PolicyStatement
• type RoleArnSession
• type STSClientProviderFunc

Constants

const (
	AwsFederatedSigninEndpointTemplate = "https://%v.signin.aws.amazon.com/federation"
	AwsConsoleURLTemplate              = "https://%v.console.aws.amazon.com/"
	DefaultIssuer                      = "Red Hat SRE"
)

const (
	PolicyVersion = "2012-10-17"
)

Functions

func AssumeRole

func AssumeRole(
	stsClient stscreds.AssumeRoleAPIClient,
	roleSessionName string,
	roleArn string,
	inlinePolicy *PolicyDocument,
	policyARNs []types.PolicyDescriptorType,
) (aws.Credentials, error)

func AssumeRoleSequence

func AssumeRoleSequence(
	seedClient stscreds.AssumeRoleAPIClient,
	roleArnSessionSequence []RoleArnSession,
	proxyURL *string,
	stsClientProviderFunc STSClientProviderFunc,
) (aws.Credentials, error)

func AssumeRoleWithJWT

func AssumeRoleWithJWT(jwt string, roleArn string, stsClient stscreds.AssumeRoleWithWebIdentityAPIClient) (aws.Credentials, error)

func GetConsoleURL

func GetConsoleURL(signinToken string, region string, sessionDurationMinutes int) (*url.URL, error)

func StsClient

func StsClient(proxyURL *string) (*sts.Client, error)

Returns a new stsclient, proxy is optional.

Types

type AWSFederatedSessionData

type AWSFederatedSessionData struct {
	SessionID    string `json:"sessionId"`
	SessionKey   string `json:"sessionKey"`
	SessionToken string `json:"sessionToken"`
}

type AWSSigninTokenResponse

type AWSSigninTokenResponse struct {
	SigninToken string
}

func GetSigninToken

func GetSigninToken(awsCredentials aws.Credentials, region string) (*AWSSigninTokenResponse, error)

type Condition

type Condition struct {
	//nolint NotIpAddress is required from AWS Policy
	NotIpAddress IPAddress `json:"NotIpAddress"`
}

type IPAddress

type IPAddress struct {
	//nolint SourceIp is required from AWS Policy
	SourceIp []string `json:"aws:SourceIp"`
}

type IdentityTokenValue

type IdentityTokenValue string

IdentityTokenValue is for retrieving an identity token from the given file name

func (IdentityTokenValue) GetIdentityToken

func (j IdentityTokenValue) GetIdentityToken() ([]byte, error)

GetIdentityToken retrieves the JWT token from the file and returns the contents as a []byte

type PolicyDocument

type PolicyDocument struct {
	Version   string            `json:"Version"`
	Statement []PolicyStatement `json:"Statement"`
}

func NewPolicyDocument

func NewPolicyDocument(version string, statements []PolicyStatement) PolicyDocument

func (PolicyDocument) BuildPolicyWithRestrictedIP

func (p PolicyDocument) BuildPolicyWithRestrictedIP(ipAddress IPAddress) (PolicyDocument, error)

func (PolicyDocument) String

func (p PolicyDocument) String() string

type PolicyDocumentInterface

type PolicyDocumentInterface interface {
	String() (string, error)
	BuildPolicyWithRestrictedIP(ipAddress IPAddress) (PolicyDocument, error)
}

type PolicyStatement

type PolicyStatement struct {
	Sid       string            `json:"Sid"`        // Statement ID
	Effect    string            `json:"Effect"`     // Allow or Deny
	Action    []string          `json:"Action"`     // allowed or denied action
	Principal map[string]string `json:",omitempty"` // principal that is allowed or denied
	Resource  *string           `json:",omitempty"` // object or objects that the statement covers
	Condition *Condition        `json:",omitempty"` // conditions for when a policy is in effect
}

func NewPolicyStatement

func NewPolicyStatement(sid string, affect string, action []string) PolicyStatement

func (PolicyStatement) AddCondition

func (ps PolicyStatement) AddCondition(condition *Condition) PolicyStatement

func (PolicyStatement) AddResource

func (ps PolicyStatement) AddResource(resource *string) PolicyStatement

type RoleArnSession

type RoleArnSession struct {
	Name            string
	RoleSessionName string
	RoleArn         string
	IsCustomerRole  bool
	Policy          *PolicyDocument
	PolicyARNs      []types.PolicyDescriptorType
}

type STSClientProviderFunc

type STSClientProviderFunc func(optFns ...func(*config.LoadOptions) error) (stscreds.AssumeRoleAPIClient, error)

var DefaultSTSClientProviderFunc STSClientProviderFunc = func(optnFns ...func(options *config.LoadOptions) error) (stscreds.AssumeRoleAPIClient, error) {
	cfg, err := config.LoadDefaultConfig(context.TODO(), optnFns...)
	if err != nil {
		return nil, fmt.Errorf("failed to load default AWS config: %w", err)
	}
	return sts.NewFromConfig(cfg), nil
}