SpringCloud/spring-cloud-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add support to override endpointUri for AWS IAM Authentication.

Browse Source 
We now allow setting the AWS IAM Endpoint URI to adjust for various AWS regions.

Closes gh-346.
This commit is contained in:
Mark Paluch
2019-08-14 10:19:44 +02:00
parent ff3de271ec
commit 6b041b4df3
3 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/src/main/asciidoc/spring-cloud-vault.adoc
View File

@@ -357,12 +357,14 @@ spring.cloud.vault:
role: my-dev-role
aws-path: aws
server-id: some.server.name
endpoint-uri: https://sts.eu-central-1.amazonaws.com
----
====
* `role` sets the name of the role against which the login is being attempted. This should be bound to your IAM role. If one is not supplied then the friendly name of the current IAM user will be used as the vault role.
* `aws-path` sets the path of the AWS mount to use
* `server-id` sets the value to use for the `X-Vault-AWS-IAM-Server-ID` header preventing certain types of replay attacks.
* `endpoint-uri` sets the value to use for the AWS STS API used for the `iam_request_url` parameter.
AWS-IAM requires the AWS Java SDK dependency (`com.amazonaws:aws-java-sdk-core`)
as the authentication implementation uses AWS SDK types for credentials and request signing.

6
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2017-2018 the original author or authors.
* Copyright 2017-2019 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -295,6 +295,10 @@ class ClientAuthenticationFactory {
builder.serverName(awsIam.getServerName());
}
if (awsIam.getEndpointUri() != null) {
builder.endpointUri(awsIam.getEndpointUri());
}
builder.path(awsIam.getAwsPath()) //
.credentialsProvider(credentialsProvider);

18
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2016-2018 the original author or authors.
* Copyright 2016-2019 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
package org.springframework.cloud.vault.config;
import java.net.URI;
import java.time.Duration;
import javax.validation.constraints.NotEmpty;
@@ -563,6 +564,13 @@ public class VaultProperties implements EnvironmentAware {
*/
private String serverName;
/**
* STS server URI.
*
* @since 2.2
*/
private URI endpointUri;
public String getAwsPath() {
return this.awsPath;
}
@@ -587,6 +595,14 @@ public class VaultProperties implements EnvironmentAware {
this.serverName = serverName;
}
public URI getEndpointUri() {
return this.endpointUri;
}
public void setEndpointUri(URI endpointUri) {
this.endpointUri = endpointUri;
}
}
/**