mirror of
https://github.com/plantroon/acme.sh.git
synced 2024-12-22 21:21:42 +00:00
Merge pull request #1292 from mal/aws-use-instance-role
Let AWS DNS API driver pull creds from instance metadata
This commit is contained in:
commit
22d827adf1
@ -21,6 +21,11 @@ dns_aws_add() {
|
|||||||
|
|
||||||
AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-$(_readaccountconf_mutable AWS_ACCESS_KEY_ID)}"
|
AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-$(_readaccountconf_mutable AWS_ACCESS_KEY_ID)}"
|
||||||
AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-$(_readaccountconf_mutable AWS_SECRET_ACCESS_KEY)}"
|
AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-$(_readaccountconf_mutable AWS_SECRET_ACCESS_KEY)}"
|
||||||
|
|
||||||
|
if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
|
||||||
|
_use_instance_role
|
||||||
|
fi
|
||||||
|
|
||||||
if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
|
if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
|
||||||
AWS_ACCESS_KEY_ID=""
|
AWS_ACCESS_KEY_ID=""
|
||||||
AWS_SECRET_ACCESS_KEY=""
|
AWS_SECRET_ACCESS_KEY=""
|
||||||
@ -29,9 +34,11 @@ dns_aws_add() {
|
|||||||
return 1
|
return 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
#save for future use
|
#save for future use, unless using a role which will be fetched as needed
|
||||||
|
if [ -z "$_using_role" ]; then
|
||||||
_saveaccountconf_mutable AWS_ACCESS_KEY_ID "$AWS_ACCESS_KEY_ID"
|
_saveaccountconf_mutable AWS_ACCESS_KEY_ID "$AWS_ACCESS_KEY_ID"
|
||||||
_saveaccountconf_mutable AWS_SECRET_ACCESS_KEY "$AWS_SECRET_ACCESS_KEY"
|
_saveaccountconf_mutable AWS_SECRET_ACCESS_KEY "$AWS_SECRET_ACCESS_KEY"
|
||||||
|
fi
|
||||||
|
|
||||||
_debug "First detect the root zone"
|
_debug "First detect the root zone"
|
||||||
if ! _get_root "$fulldomain"; then
|
if ! _get_root "$fulldomain"; then
|
||||||
@ -78,6 +85,11 @@ dns_aws_rm() {
|
|||||||
|
|
||||||
AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-$(_readaccountconf_mutable AWS_ACCESS_KEY_ID)}"
|
AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-$(_readaccountconf_mutable AWS_ACCESS_KEY_ID)}"
|
||||||
AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-$(_readaccountconf_mutable AWS_SECRET_ACCESS_KEY)}"
|
AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-$(_readaccountconf_mutable AWS_SECRET_ACCESS_KEY)}"
|
||||||
|
|
||||||
|
if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
|
||||||
|
_use_instance_role
|
||||||
|
fi
|
||||||
|
|
||||||
_debug "First detect the root zone"
|
_debug "First detect the root zone"
|
||||||
if ! _get_root "$fulldomain"; then
|
if ! _get_root "$fulldomain"; then
|
||||||
_err "invalid domain"
|
_err "invalid domain"
|
||||||
@ -162,6 +174,37 @@ _get_root() {
|
|||||||
return 1
|
return 1
|
||||||
}
|
}
|
||||||
|
|
||||||
|
_use_instance_role() {
|
||||||
|
_url="http://169.254.169.254/latest/meta-data/iam/security-credentials/"
|
||||||
|
_debug "_url" "$_url"
|
||||||
|
if ! _get "$_url" true 1 | _head_n 1 | grep -Fq 200; then
|
||||||
|
_err "Unable to fetch IAM role from AWS instance metadata."
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
_aws_role=$(_get "$_url" "" 1)
|
||||||
|
_debug "_aws_role" "$_aws_role"
|
||||||
|
_aws_creds="$(
|
||||||
|
_get "$_url$_aws_role" "" 1 \
|
||||||
|
| _normalizeJson \
|
||||||
|
| tr '{,}' '\n' \
|
||||||
|
| while read -r _line; do
|
||||||
|
_key="$(echo "${_line%%:*}" | tr -d '"')"
|
||||||
|
_value="${_line#*:}"
|
||||||
|
_debug3 "_key" "$_key"
|
||||||
|
_secure_debug3 "_value" "$_value"
|
||||||
|
case "$_key" in
|
||||||
|
AccessKeyId) echo "AWS_ACCESS_KEY_ID=$_value" ;;
|
||||||
|
SecretAccessKey) echo "AWS_SECRET_ACCESS_KEY=$_value" ;;
|
||||||
|
Token) echo "AWS_SESSION_TOKEN=$_value" ;;
|
||||||
|
esac
|
||||||
|
done \
|
||||||
|
| paste -sd' ' -
|
||||||
|
)"
|
||||||
|
_secure_debug "_aws_creds" "$_aws_creds"
|
||||||
|
eval "$_aws_creds"
|
||||||
|
_using_role=true
|
||||||
|
}
|
||||||
|
|
||||||
#method uri qstr data
|
#method uri qstr data
|
||||||
aws_rest() {
|
aws_rest() {
|
||||||
mtd="$1"
|
mtd="$1"
|
||||||
|
Loading…
Reference in New Issue
Block a user