diff options
author | Alexander Pakulov <apakulov@stripe.com> | 2019-08-21 15:19:10 -0700 |
---|---|---|
committer | Hiroshi SHIBATA <hsbt@ruby-lang.org> | 2019-09-05 18:41:58 +0900 |
commit | d84b9b6d0a938cec9f0c1266702d9c4aecc0423a (patch) | |
tree | a5179f7b5017cbaf329e90982071c92fd142bd7d /lib/rubygems | |
parent | d219be4a1c237356670ebafd415e983433362e72 (diff) | |
download | ruby-d84b9b6d0a938cec9f0c1266702d9c4aecc0423a.tar.gz |
[rubygems/rubygems] Use IAM role to extract security-credentials for EC2 instance
https://github.com/rubygems/rubygems/commit/9a401646e1
Diffstat (limited to 'lib/rubygems')
-rw-r--r-- | lib/rubygems/s3_uri_signer.rb | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/lib/rubygems/s3_uri_signer.rb b/lib/rubygems/s3_uri_signer.rb index 4caf07131f..ff9dde30ed 100644 --- a/lib/rubygems/s3_uri_signer.rb +++ b/lib/rubygems/s3_uri_signer.rb @@ -150,16 +150,23 @@ class Gem::S3URISigner require 'rubygems/request/connection_pools' require 'json' - metadata_uri = URI(EC2_METADATA_CREDENTIALS) - @request_pool ||= create_request_pool(metadata_uri) - request = Gem::Request.new(metadata_uri, Net::HTTP::Get, nil, @request_pool) + iam_info = ec2_metadata_request(EC2_IAM_INFO) + # Expected format: arn:aws:iam::<id>:instance-profile/<role_name> + role_name = iam_info['InstanceProfileArn'].split('/')[1] + ec2_metadata_request(EC2_IAM_SECURITY_CREDENTIALS + role_name) + end + + def ec2_metadata_request(url) + uri = URI(url) + @request_pool ||= create_request_pool(uri) + request = Gem::Request.new(uri, Net::HTTP::Get, nil, @request_pool) response = request.fetch case response when Net::HTTPOK then JSON.parse(response.body) else - raise InstanceProfileError.new("Unable to fetch AWS credentials from #{metadata_uri}: #{response.message} #{response.code}") + raise InstanceProfileError.new("Unable to fetch AWS metadata from #{uri}: #{response.message} #{response.code}") end end @@ -170,6 +177,7 @@ class Gem::S3URISigner end BASE64_URI_TRANSLATE = { "+" => "%2B", "/" => "%2F", "=" => "%3D", "\n" => "" }.freeze - EC2_METADATA_CREDENTIALS = "http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance".freeze + EC2_IAM_INFO = "http://169.254.169.254/latest/meta-data/iam/info".freeze + EC2_IAM_SECURITY_CREDENTIALS = "http://169.254.169.254/latest/meta-data/iam/security-credentials/".freeze end |