Documentation
¶
Overview ¶
Package clients provides AWS Config helpers for deriving AWS credentials from the environment. NOTE(tnthornton): much of this file is derived from https://github.com/crossplane-contrib/provider-upjet-aws/blob/main/internal/clients/provider_config.go Modifications were made to make it work in a more sensible way from a function, especially given there isn't a corresponding concept of a ProviderConfig for functions.
Index ¶
- Constants
- func CredentialsIDSecret(data []byte, profile string) (aws.Credentials, error)
- func GetAWSConfig(ctx context.Context, c client.Client, region string, ...) (*aws.Config, error)
- func GetAssumeRoleWithWebIdentityConfig(ctx context.Context, cfg *aws.Config, ...) (*aws.Config, error)
- func GetAssumeRoleWithWebIdentityConfigViaTokenRetriever(ctx context.Context, cfg *aws.Config, ...) (*aws.Config, error)
- func GetRoleChainConfig(ctx context.Context, fc v1alpha1.FunctionConfigSpec, cfg *aws.Config) (*aws.Config, error)
- func LateInitializeStringPtr(in *string, from *string) *string
- func SetAssumeRoleOptions(aro v1alpha1.AssumeRoleOptions) func(*stscreds.AssumeRoleOptions)
- func SetResolver(pc v1alpha1.FunctionConfigSpec, cfg *aws.Config) (*aws.Config, error)
- func SetWebIdentityRoleOptions(opts v1alpha1.AssumeRoleWithWebIdentityOptions) func(*stscreds.WebIdentityRoleOptions)
- func UseDefault(ctx context.Context, region string) (*aws.Config, error)
- func UseSecret(ctx context.Context, data []byte, profile, region string) (*aws.Config, error)
- func UseUpbound(ctx context.Context, region string, fc v1alpha1.FunctionConfigSpec) (*aws.Config, error)
- func UseWebIdentityToken(ctx context.Context, region string, fc v1alpha1.FunctionConfigSpec, ...) (*aws.Config, error)
Constants ¶
const ( URLConfigTypeStatic = "Static" URLConfigTypeDynamic = "Dynamic" URLConfigTypeAuto = "Auto" )
Endpoint URL configuration types.
const ( // DefaultSection for INI files. DefaultSection = ini.DefaultSection )
const GlobalRegion = "aws-global"
GlobalRegion is the region name used for AWS services that do not have a notion of region.
Variables ¶
This section is empty.
Functions ¶
func CredentialsIDSecret ¶
func CredentialsIDSecret(data []byte, profile string) (aws.Credentials, error)
CredentialsIDSecret retrieves AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY from the data which contains aws credentials under given profile Example: [default] aws_access_key_id = <YOUR_ACCESS_KEY_ID> aws_secret_access_key = <YOUR_SECRET_ACCESS_KEY>
func GetAWSConfig ¶
func GetAWSConfig(ctx context.Context, c client.Client, region string, fc *v1alpha1.FunctionConfig) (*aws.Config, error)
GetAWSConfig produces an AWS config from the specified v1alpha1.AWS that can be used to authenticate to AWS.
func GetAssumeRoleWithWebIdentityConfig ¶
func GetAssumeRoleWithWebIdentityConfig(ctx context.Context, cfg *aws.Config, webID v1alpha1.AssumeRoleWithWebIdentityOptions, tokenFile string) (*aws.Config, error)
GetAssumeRoleWithWebIdentityConfig returns an aws.Config capable of doing AssumeRoleWithWebIdentity.
func GetAssumeRoleWithWebIdentityConfigViaTokenRetriever ¶
func GetAssumeRoleWithWebIdentityConfigViaTokenRetriever(ctx context.Context, cfg *aws.Config, webID v1alpha1.AssumeRoleWithWebIdentityOptions, tokenRetriever stscreds.IdentityTokenRetriever) (*aws.Config, error)
GetAssumeRoleWithWebIdentityConfigViaTokenRetriever returns an aws.Config capable of doing AssumeRoleWithWebIdentity using the token obtained from the supplied stscreds.IdentityTokenRetriever.
func GetRoleChainConfig ¶
func GetRoleChainConfig(ctx context.Context, fc v1alpha1.FunctionConfigSpec, cfg *aws.Config) (*aws.Config, error)
GetRoleChainConfig returns an aws.Config capable of doing role chaining with AssumeRoleWithWebIdentity & AssumeRoles.
func LateInitializeStringPtr ¶
LateInitializeStringPtr returns in if it's non-nil, otherwise returns from which is the backup for the cases in is nil.
func SetAssumeRoleOptions ¶
func SetAssumeRoleOptions(aro v1alpha1.AssumeRoleOptions) func(*stscreds.AssumeRoleOptions)
SetAssumeRoleOptions sets options when Assuming an IAM Role
func SetResolver ¶
SetResolver parses annotations from the managed resource and returns a configuration accordingly.
func SetWebIdentityRoleOptions ¶
func SetWebIdentityRoleOptions(opts v1alpha1.AssumeRoleWithWebIdentityOptions) func(*stscreds.WebIdentityRoleOptions)
SetWebIdentityRoleOptions sets options when exchanging a WebIdentity Token for a Role
func UseDefault ¶
UseDefault loads the default AWS config with the specified region.
func UseUpbound ¶
func UseUpbound(ctx context.Context, region string, fc v1alpha1.FunctionConfigSpec) (*aws.Config, error)
UseUpbound calls sts.AssumeRoleWithWebIdentity using the configuration supplied in FunctionConfigSpec's credentials.assumeRoleWithWebIdentity and the identity supplied by the injected Upbound OIDC token. NOTE(hasheddan): this is the same functionality used for generic web identity token role assumption, but uses fields under Upbound in the FunctionConfigSpec and the dedicated Upbound token injection path.
func UseWebIdentityToken ¶
func UseWebIdentityToken(ctx context.Context, region string, fc v1alpha1.FunctionConfigSpec, kube client.Client) (*aws.Config, error)
UseWebIdentityToken calls sts.AssumeRoleWithWebIdentity using the configuration supplied in FunctionConfigSpec's spec.credentials.assumeRoleWithWebIdentity.
Types ¶
This section is empty.
Source Files