class Fog::AWS::STS::Real
Public Class Methods
Initialize connection to STS
Notes¶ ↑
options parameter must include values for :aws_access_key_id and :aws_secret_access_key in order to create a connection
Examples¶ ↑
iam = STS.new( :aws_access_key_id => your_aws_access_key_id, :aws_secret_access_key => your_aws_secret_access_key )
Parameters¶ ↑
-
options<~Hash> - config arguments for connection. Defaults to {}.
Returns¶ ↑
-
STS object with connection to AWS.
# File lib/fog/aws/sts.rb, line 74 def initialize(options={}) require 'fog/core/parser' @use_iam_profile = options[:use_iam_profile] setup_credentials(options) @connection_options = options[:connection_options] || {} @host = options[:host] || 'sts.amazonaws.com' @path = options[:path] || '/' @persistent = options[:persistent] || false @port = options[:port] || 443 @scheme = options[:scheme] || 'https' @connection = Fog::XML::Connection.new("#{@scheme}://#{@host}:#{@port}#{@path}", @persistent, @connection_options) end
Public Instance Methods
Assume Role
Parameters¶ ↑
-
role_session_name<~String> - An identifier for the assumed role.
-
role_arn<~String> - The ARN of the role the caller is assuming.
-
external_id<~String> - An optional unique identifier required by the assuming role's trust identity.
-
policy<~String> - An optional JSON policy document
-
duration<~Integer> - Duration (of seconds) for the assumed role credentials to be valid (default 3600)
Returns¶ ↑
-
response<~Excon::Response>:
-
body<~Hash>:
-
'Arn'<~String>: The ARN of the assumed role/user
-
'AccessKeyId'<~String>: The AWS access key of the temporary credentials for the assumed role
-
'SecretAccessKey'<~String>: The AWS secret key of the temporary credentials for the assumed role
-
'SessionToken'<~String>: The AWS session token of the temporary credentials for the assumed role
-
'Expiration'<~Time>: The expiration time of the temporary credentials for the assumed role
-
-
See Also¶ ↑
docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
# File lib/fog/aws/requests/sts/assume_role.rb, line 29 def assume_role(role_session_name, role_arn, external_id=nil, policy=nil, duration=3600) request({ 'Action' => 'AssumeRole', 'RoleSessionName' => role_session_name, 'RoleArn' => role_arn, 'Policy' => policy && Fog::JSON.encode(policy), 'DurationSeconds' => duration, 'ExternalId' => external_id, :idempotent => true, :parser => Fog::Parsers::AWS::STS::AssumeRole.new }) end
Get federation token
Parameters¶ ↑
-
name<~String>: The name of the federated user.
Minimum length of 2. Maximum length of 32.
-
policy<~String>: Optional policy that specifies the permissions
that are granted to the federated user Minimum length of 1. Maximum length of 2048.
-
duration<~Integer>: Optional duration, in seconds, that the session
should last.
Returns¶ ↑
-
response<~Excon::Response>:
-
body<~Hash>:
-
'SessionToken'<~String> -
-
'SecretAccessKey'<~String> -
-
'Expiration'<~String> -
-
'AccessKeyId'<~String> -
-
'Arn'<~String> -
-
'FederatedUserId'<~String> -
-
'PackedPolicySize'<~String> -
-
'RequestId'<~String> - Id of the request
-
-
See Also¶ ↑
docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html
# File lib/fog/aws/requests/sts/get_federation_token.rb, line 32 def get_federation_token(name, policy, duration=43200) request({ 'Action' => 'GetFederationToken', 'Name' => name, 'Policy' => Fog::JSON.encode(policy), 'DurationSeconds' => duration, :idempotent => true, :parser => Fog::Parsers::AWS::STS::GetSessionToken.new }) end
# File lib/fog/aws/requests/sts/get_session_token.rb, line 7 def get_session_token(duration=43200) request({ 'Action' => 'GetSessionToken', 'DurationSeconds' => duration, :idempotent => true, :parser => Fog::Parsers::AWS::STS::GetSessionToken.new }) end
# File lib/fog/aws/sts.rb, line 89 def reload @connection.reset end
Private Instance Methods
# File lib/fog/aws/sts.rb, line 103 def request(params) idempotent = params.delete(:idempotent) parser = params.delete(:parser) body = Fog::AWS.signed_params( params, { :aws_access_key_id => @aws_access_key_id, :aws_session_token => @aws_session_token, :hmac => @hmac, :host => @host, :path => @path, :port => @port, :version => '2011-06-15' } ) begin @connection.request({ :body => body, :expects => 200, :idempotent => idempotent, :headers => { 'Content-Type' => 'application/x-www-form-urlencoded' }, :method => 'POST', :parser => parser }) rescue Excon::Errors::HTTPStatusError => error match = Fog::AWS::Errors.match_error(error) raise if match.empty? raise case match[:code] when 'EntityAlreadyExists', 'KeyPairMismatch', 'LimitExceeded', 'MalformedCertificate', 'ValidationError' Fog::AWS::STS.const_get(match[:code]).slurp(error, match[:message]) else Fog::AWS::STS::Error.slurp(error, "#{match[:code]} => #{match[:message]}") end end end
# File lib/fog/aws/sts.rb, line 95 def setup_credentials(options) @aws_access_key_id = options[:aws_access_key_id] @aws_secret_access_key = options[:aws_secret_access_key] @aws_session_token = options[:aws_session_token] @aws_credentials_expire_at = options[:aws_credentials_expire_at] @hmac = Fog::HMAC.new('sha256', @aws_secret_access_key) end