|
| 1 | +package metadata |
| 2 | + |
| 3 | +import ( |
| 4 | + "encoding/json" |
| 5 | + "fmt" |
| 6 | + "github.com/aws/aws-sdk-go/aws/credentials" |
| 7 | + simple_logger "github.com/mmmorris1975/simple-logger" |
| 8 | + "net" |
| 9 | + "net/http" |
| 10 | + "net/url" |
| 11 | + "time" |
| 12 | +) |
| 13 | + |
| 14 | +const ( |
| 15 | + // EcsCredentialsPath is the URL path used to retrieve the credentials |
| 16 | + EcsCredentialsPath = "/credentials" |
| 17 | +) |
| 18 | + |
| 19 | +// EcsMetadataInput contains the options available for customizing the behavior of the ECS Metadata Service |
| 20 | +type EcsMetadataInput struct { |
| 21 | + // Credentials is the AWS credentials.Credentials object used to fetch the credentials. This allows us to have |
| 22 | + // the service return role credentials, or session credentials (in case the caller's code does its own role management) |
| 23 | + Credentials *credentials.Credentials |
| 24 | + // Logger is the logging object to configure for the service. If not provided, a standard logger is configured. |
| 25 | + Logger *simple_logger.Logger |
| 26 | +} |
| 27 | + |
| 28 | +// EcsMetadataService is the object encapsulating the details of the service |
| 29 | +type EcsMetadataService struct { |
| 30 | + // Url is the fully-formed URL to use for retrieving credentials from the service |
| 31 | + Url *url.URL |
| 32 | + lsnr net.Listener |
| 33 | +} |
| 34 | + |
| 35 | +// NewEcsMetadataService creates a new EcsMetadataService object using the provided EcsMetadataInput options. |
| 36 | +func NewEcsMetadataService(opts *EcsMetadataInput) (*EcsMetadataService, error) { |
| 37 | + cred = opts.Credentials |
| 38 | + log = opts.Logger |
| 39 | + if log == nil { |
| 40 | + log = simple_logger.StdLogger |
| 41 | + } |
| 42 | + |
| 43 | + s := new(EcsMetadataService) |
| 44 | + |
| 45 | + // The SDK seems to only support listening on "localhost" and 127.0.0.1, not the ::1 IPv6 loopback, try not to be clever |
| 46 | + l, err := net.Listen("tcp", "127.0.0.1:0") |
| 47 | + if err != nil { |
| 48 | + return nil, err |
| 49 | + } |
| 50 | + s.lsnr = l |
| 51 | + |
| 52 | + u, err := url.Parse(fmt.Sprintf("http://%s%s", l.Addr(), EcsCredentialsPath)) |
| 53 | + if err != nil { |
| 54 | + return nil, err |
| 55 | + } |
| 56 | + s.Url = u |
| 57 | + |
| 58 | + return s, nil |
| 59 | +} |
| 60 | + |
| 61 | +// Run starts the HTTP server used to fetch credentials. The HTTP server will listen on the loopback address on a |
| 62 | +// randomly chosen port. |
| 63 | +func (s *EcsMetadataService) Run() { |
| 64 | + http.HandleFunc(EcsCredentialsPath, ecsHandler) |
| 65 | + if err := http.Serve(s.lsnr, nil); err != nil { |
| 66 | + log.Error(err) |
| 67 | + } |
| 68 | +} |
| 69 | + |
| 70 | +func ecsHandler(w http.ResponseWriter, r *http.Request) { |
| 71 | + var rc = http.StatusOK |
| 72 | + |
| 73 | + v, err := cred.Get() |
| 74 | + if err != nil { |
| 75 | + rc = http.StatusInternalServerError |
| 76 | + j, err := json.Marshal(&ecsCredentialError{Code: string(rc), Message: err.Error()}) |
| 77 | + if err != nil { |
| 78 | + log.Warnf("error converting error message to json: %v", err) |
| 79 | + } |
| 80 | + |
| 81 | + w.WriteHeader(rc) |
| 82 | + w.Write(j) |
| 83 | + return |
| 84 | + } |
| 85 | + |
| 86 | + e, err := cred.ExpiresAt() |
| 87 | + if err != nil { |
| 88 | + e = time.Now() |
| 89 | + } |
| 90 | + |
| 91 | + c := ecsCredentials{ |
| 92 | + AccessKeyId: v.AccessKeyID, |
| 93 | + SecretAccessKey: v.SecretAccessKey, |
| 94 | + Token: v.SessionToken, |
| 95 | + Expiration: e.UTC().Format(time.RFC3339), |
| 96 | + } |
| 97 | + log.Debugf("ECS endpoint credentials: %+v", c) |
| 98 | + |
| 99 | + j, err := json.Marshal(&c) |
| 100 | + if err != nil { |
| 101 | + log.Warnf("error converting credentials to json: %v", err) |
| 102 | + } |
| 103 | + |
| 104 | + w.WriteHeader(rc) |
| 105 | + w.Write(j) |
| 106 | +} |
| 107 | + |
| 108 | +type ecsCredentialError struct { |
| 109 | + Code string `json:"code"` |
| 110 | + Message string `json:"message"` |
| 111 | +} |
| 112 | + |
| 113 | +type ecsCredentials struct { |
| 114 | + AccessKeyId string |
| 115 | + SecretAccessKey string |
| 116 | + Token string |
| 117 | + Expiration string |
| 118 | +} |
0 commit comments