From 6b041b4df347cb4b36ca3c8a36fa239ed6d3a9e0 Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Wed, 14 Aug 2019 10:19:44 +0200 Subject: [PATCH] Add support to override endpointUri for AWS IAM Authentication. We now allow setting the AWS IAM Endpoint URI to adjust for various AWS regions. Closes gh-346. --- docs/src/main/asciidoc/spring-cloud-vault.adoc | 2 ++ .../config/ClientAuthenticationFactory.java | 6 +++++- .../cloud/vault/config/VaultProperties.java | 18 +++++++++++++++++- 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/docs/src/main/asciidoc/spring-cloud-vault.adoc b/docs/src/main/asciidoc/spring-cloud-vault.adoc index 8178c201..f5cf6531 100644 --- a/docs/src/main/asciidoc/spring-cloud-vault.adoc +++ b/docs/src/main/asciidoc/spring-cloud-vault.adoc @@ -357,12 +357,14 @@ spring.cloud.vault: role: my-dev-role aws-path: aws server-id: some.server.name + endpoint-uri: https://sts.eu-central-1.amazonaws.com ---- ==== * `role` sets the name of the role against which the login is being attempted. This should be bound to your IAM role. If one is not supplied then the friendly name of the current IAM user will be used as the vault role. * `aws-path` sets the path of the AWS mount to use * `server-id` sets the value to use for the `X-Vault-AWS-IAM-Server-ID` header preventing certain types of replay attacks. +* `endpoint-uri` sets the value to use for the AWS STS API used for the `iam_request_url` parameter. AWS-IAM requires the AWS Java SDK dependency (`com.amazonaws:aws-java-sdk-core`) as the authentication implementation uses AWS SDK types for credentials and request signing. diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java index f7b8d341..97c5ab9a 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java @@ -1,5 +1,5 @@ /* - * Copyright 2017-2018 the original author or authors. + * Copyright 2017-2019 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -295,6 +295,10 @@ class ClientAuthenticationFactory { builder.serverName(awsIam.getServerName()); } + if (awsIam.getEndpointUri() != null) { + builder.endpointUri(awsIam.getEndpointUri()); + } + builder.path(awsIam.getAwsPath()) // .credentialsProvider(credentialsProvider); diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java index ecb55340..5d9cebbb 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java @@ -1,5 +1,5 @@ /* - * Copyright 2016-2018 the original author or authors. + * Copyright 2016-2019 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -16,6 +16,7 @@ package org.springframework.cloud.vault.config; +import java.net.URI; import java.time.Duration; import javax.validation.constraints.NotEmpty; @@ -563,6 +564,13 @@ public class VaultProperties implements EnvironmentAware { */ private String serverName; + /** + * STS server URI. + * + * @since 2.2 + */ + private URI endpointUri; + public String getAwsPath() { return this.awsPath; } @@ -587,6 +595,14 @@ public class VaultProperties implements EnvironmentAware { this.serverName = serverName; } + public URI getEndpointUri() { + return this.endpointUri; + } + + public void setEndpointUri(URI endpointUri) { + this.endpointUri = endpointUri; + } + } /**