You are viewing documentation for version 3 of the AWS SDK for Ruby. Version 2 documentation can be found here.

Class: Aws::AssumeRoleWebIdentityCredentials

Inherits:
Object
  • Object
show all
Includes:
CredentialProvider
Defined in:
gems/aws-sdk-core/lib/aws-sdk-core/assume_role_web_identity_credentials.rb

Overview

An auto-refreshing credential provider that works by assuming a role via STS::Client#assume_role_with_web_identity.

role_credentials = Aws::AssumeRoleWebIdentityCredentials.new(
  client: Aws::STS::Client.new(...),
  role_arn: "linked::account::arn",
  web_identity_token_file: "/path/to/token/file",
  role_session_name: "session-name"
  ...
)
For full list of parameters accepted
@see Aws::STS::Client#assume_role_with_web_identity 

If you omit :client option, a new STS::Client object will be constructed.

Instance Attribute Summary collapse

Attributes included from CredentialProvider

#credentials

Instance Method Summary collapse

Methods included from CredentialProvider

#set?

Constructor Details

#initialize(options = {}) ⇒ AssumeRoleWebIdentityCredentials

Returns a new instance of AssumeRoleWebIdentityCredentials

Parameters:

  • options (Hash) (defaults to: {})

    a customizable set of options

Options Hash (options):

  • :role_arn (required, String)

    the IAM role to be assumed

  • :web_identity_token_file (required, String)

    absolute path to the file on disk containing OIDC token

  • :role_session_name (String)

    the IAM session name used to distinguish session, when not provided, base64 encoded UUID is generated as the session name

  • :client (STS::Client)


39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
# File 'gems/aws-sdk-core/lib/aws-sdk-core/assume_role_web_identity_credentials.rb', line 39

def initialize(options = {})
  client_opts = {}
  @assume_role_web_identity_params = {}
  @token_file = options.delete(:web_identity_token_file)
  options.each_pair do |key, value|
    if self.class.assume_role_web_identity_options.include?(key)
      @assume_role_web_identity_params[key] = value
    else
      client_opts[key] = value
    end
  end

  unless @assume_role_web_identity_params[:role_session_name]
    # not provided, generate encoded UUID as session name
    @assume_role_web_identity_params[:role_session_name] = _session_name
  end
  @client = client_opts[:client] || STS::Client.new(client_opts.merge(credentials: false))
  super
end

Instance Attribute Details

#clientSTS::Client (readonly)

Returns:



60
61
62
# File 'gems/aws-sdk-core/lib/aws-sdk-core/assume_role_web_identity_credentials.rb', line 60

def client
  @client
end