Class: Aws::AssumeRoleCredentials

Inherits:
Object
  • Object
show all
Includes:
CredentialProvider, RefreshingCredentials
Defined in:
gems/aws-sdk-core/lib/aws-sdk-core/assume_role_credentials.rb

Overview

An auto-refreshing credential provider that assumes a role via STS::Client#assume_role.

role_credentials = Aws::AssumeRoleCredentials.new(
  client: Aws::STS::Client.new(sts_options),
  role_arn: "linked::account::arn",
  role_session_name: "session-name"
)
ec2 = Aws::EC2::Client.new(credentials: role_credentials)

If you omit :client option, a new STS::Client object will be constructed with additional options that were provided.

See Also:

Constant Summary

Constants included from RefreshingCredentials

RefreshingCredentials::ASYNC_EXPIRATION_LENGTH, RefreshingCredentials::CLIENT_EXCLUDE_OPTIONS, RefreshingCredentials::SYNC_EXPIRATION_LENGTH

Instance Attribute Summary collapse

Attributes included from CredentialProvider

#credentials, #expiration

Instance Method Summary collapse

Methods included from RefreshingCredentials

#credentials, #refresh!

Methods included from CredentialProvider

#set?

Constructor Details

#initialize(options = {}) ⇒ AssumeRoleCredentials

Returns a new instance of AssumeRoleCredentials.

Examples:

Tokens can be refreshed using a Proc.

before_refresh = Proc.new do |assume_role_credentials|
  assume_role_credentials.assume_role_params['token_code'] = update_token
end

Parameters:

  • options (Hash) (defaults to: {}) —

    a customizable set of options

Options Hash (options):

  • :role_arn (required, String)
  • :role_session_name (required, String)
  • :policy (String)
  • :duration_seconds (Integer)
  • :external_id (String)
  • :client (STS::Client)
  • :before_refresh (Proc) —

    A Proc called before credentials are refreshed. Useful for updating tokens. :before_refresh is called when AWS credentials are required and need to be refreshed. See the example in this doc.



41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
 
# File 'gems/aws-sdk-core/lib/aws-sdk-core/assume_role_credentials.rb', line 41

def initialize(options = {})
  client_opts = {}
  @assume_role_params = {}
  options.each_pair do |key, value|
    if self.class.assume_role_options.include?(key)
      @assume_role_params[key] = value
    elsif !CLIENT_EXCLUDE_OPTIONS.include?(key)
      client_opts[key] = value
    end
  end
  @client = client_opts[:client] || STS::Client.new(client_opts)
  @async_refresh = true
  @metrics = ['CREDENTIALS_STS_ASSUME_ROLE']
  super
end

Instance Attribute Details

#assume_role_params ⇒ Hash (readonly)

Returns:

  • (Hash) 


61
62
63
 
# File 'gems/aws-sdk-core/lib/aws-sdk-core/assume_role_credentials.rb', line 61

def assume_role_params
  @assume_role_params
end

#client ⇒ STS::Client (readonly)

Returns:



58
59
60
 
# File 'gems/aws-sdk-core/lib/aws-sdk-core/assume_role_credentials.rb', line 58

def client
  @client
end