1/*
2 * Copyright 2010-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License").
5 * You may not use this file except in compliance with the License.
6 * A copy of the License is located at
7 *
8 * http://aws.amazon.com/apache2.0
9 *
10 * or in the "license" file accompanying this file. This file is distributed
11 * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12 * express or implied. See the License for the specific language governing
13 * permissions and limitations under the License.
14 */
15
16#include <aws/core/auth/AWSCredentialsProviderChain.h>
17#include <aws/core/auth/STSCredentialsProvider.h>
18#include <aws/core/platform/Environment.h>
19#include <aws/core/utils/memory/AWSMemory.h>
20#include <aws/core/utils/StringUtils.h>
21#include <aws/core/utils/logging/LogMacros.h>
22
23using namespace Aws::Auth;
24
25static const char AWS_ECS_CONTAINER_CREDENTIALS_RELATIVE_URI[] = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI";
26static const char AWS_ECS_CONTAINER_CREDENTIALS_FULL_URI[] = "AWS_CONTAINER_CREDENTIALS_FULL_URI";
27static const char AWS_ECS_CONTAINER_AUTHORIZATION_TOKEN[] = "AWS_CONTAINER_AUTHORIZATION_TOKEN";
28static const char AWS_EC2_METADATA_DISABLED[] = "AWS_EC2_METADATA_DISABLED";
29static const char DefaultCredentialsProviderChainTag[] = "DefaultAWSCredentialsProviderChain";
30
31AWSCredentials AWSCredentialsProviderChain::GetAWSCredentials()
32{
33 for (auto&& credentialsProvider : m_providerChain)
34 {
35 AWSCredentials credentials = credentialsProvider->GetAWSCredentials();
36 if (!credentials.GetAWSAccessKeyId().empty() && !credentials.GetAWSSecretKey().empty())
37 {
38 return credentials;
39 }
40 }
41
42 return AWSCredentials();
43}
44
45DefaultAWSCredentialsProviderChain::DefaultAWSCredentialsProviderChain() : AWSCredentialsProviderChain()
46{
47 AddProvider(Aws::MakeShared<EnvironmentAWSCredentialsProvider>(DefaultCredentialsProviderChainTag));
48 AddProvider(Aws::MakeShared<ProfileConfigFileAWSCredentialsProvider>(DefaultCredentialsProviderChainTag));
49 AddProvider(Aws::MakeShared<STSAssumeRoleWebIdentityCredentialsProvider>(DefaultCredentialsProviderChainTag));
50
51 //ECS TaskRole Credentials only available when ENVIRONMENT VARIABLE is set
52 const auto relativeUri = Aws::Environment::GetEnv(AWS_ECS_CONTAINER_CREDENTIALS_RELATIVE_URI);
53 AWS_LOGSTREAM_DEBUG(DefaultCredentialsProviderChainTag, "The environment variable value " << AWS_ECS_CONTAINER_CREDENTIALS_RELATIVE_URI
54 << " is " << relativeUri);
55
56 const auto absoluteUri = Aws::Environment::GetEnv(AWS_ECS_CONTAINER_CREDENTIALS_FULL_URI);
57 AWS_LOGSTREAM_DEBUG(DefaultCredentialsProviderChainTag, "The environment variable value " << AWS_ECS_CONTAINER_CREDENTIALS_FULL_URI
58 << " is " << absoluteUri);
59
60 const auto ec2MetadataDisabled = Aws::Environment::GetEnv(AWS_EC2_METADATA_DISABLED);
61 AWS_LOGSTREAM_DEBUG(DefaultCredentialsProviderChainTag, "The environment variable value " << AWS_EC2_METADATA_DISABLED
62 << " is " << ec2MetadataDisabled);
63
64 if (!relativeUri.empty())
65 {
66 AddProvider(Aws::MakeShared<TaskRoleCredentialsProvider>(DefaultCredentialsProviderChainTag, relativeUri.c_str()));
67 AWS_LOGSTREAM_INFO(DefaultCredentialsProviderChainTag, "Added ECS metadata service credentials provider with relative path: ["
68 << relativeUri << "] to the provider chain.");
69 }
70 else if (!absoluteUri.empty())
71 {
72 const auto token = Aws::Environment::GetEnv(AWS_ECS_CONTAINER_AUTHORIZATION_TOKEN);
73 AddProvider(Aws::MakeShared<TaskRoleCredentialsProvider>(DefaultCredentialsProviderChainTag,
74 absoluteUri.c_str(), token.c_str()));
75
76 //DO NOT log the value of the authorization token for security purposes.
77 AWS_LOGSTREAM_INFO(DefaultCredentialsProviderChainTag, "Added ECS credentials provider with URI: ["
78 << absoluteUri << "] to the provider chain with a" << (token.empty() ? "n empty " : " non-empty ")
79 << "authorization token.");
80 }
81 else if (Aws::Utils::StringUtils::ToLower(ec2MetadataDisabled.c_str()) != "true")
82 {
83 AddProvider(Aws::MakeShared<InstanceProfileCredentialsProvider>(DefaultCredentialsProviderChainTag));
84 AWS_LOGSTREAM_INFO(DefaultCredentialsProviderChainTag, "Added EC2 metadata service credentials provider to the provider chain.");
85 }
86}
87