Exemple #1
0
// Assume role uses the current server role to call STS and assume a different role if permitted
// Params:
//   roleArn - the requested role ARN (example: arn:aws:iam::11111111111:role/myrole )
//   sessionName - a name to associate with the current session. Use the service name +
//                 unique idenfitifier preferebly.
//   duration - the duration of the session in seconds. Must be between 900 and 3600
// Returns aws.Auth object that can be used with any of the existing goamz APIs
//
// Check http://goo.gl/M6uCu5 for more information
//
func AssumeRole(roleArn string, sessionName string, duration int) (*aws.Auth, error) {
	if duration < 900 || duration > 3600 {
		return nil, fmt.Errorf("Duration out of bounds")
	}

	//Try to get our local auth
	localAuth, err := aws.GetAuth("", "", "", time.Time{})
	if err != nil {
		return nil, err
	}

	stsClient := sts.New(localAuth, aws.Regions[util.GetAwsRegionName()])
	stsOptions := &sts.AssumeRoleParams{
		DurationSeconds: int(duration),
		RoleArn:         roleArn,
		RoleSessionName: sessionName,
	}

	//Try to assume role
	roleAuth, err := stsClient.AssumeRole(stsOptions)
	if err != nil {
		return nil, err
	}

	//Marshal the response into an aws.Auth object
	auth := aws.NewAuth(roleAuth.Credentials.AccessKeyId, roleAuth.Credentials.SecretAccessKey,
		roleAuth.Credentials.SessionToken, roleAuth.Credentials.Expiration)

	return auth, nil
}
Exemple #2
0
func hostName(role string) string {
	region := util.GetAwsRegionName()
	env := util.GetEnvironmentName()
	return fmt.Sprintf("%s.%s.%s.%s.%s", role, region, scope, env, domain)
}