Skip to content

Commit c729e90

Browse files
author
kaiyan-sheng
committed
Allow role_arn work with access keys for AWS (#25446)
(cherry picked from commit 0f50230)
1 parent 8d792d1 commit c729e90

4 files changed

Lines changed: 55 additions & 37 deletions

File tree

‎CHANGELOG.next.asciidoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
152152
- Fix 'make setup' instructions for a new beat {pull}24944[24944]
153153
- Fix discovery of short-living and failing pods in Kubernetes autodiscover {issue}22718[22718] {pull}24742[24742]
154154
- Fix panic when overwriting metadata {pull}24741[24741]
155+
- Fix role_arn to work with access keys for AWS. {pull}25446[25446]
155156

156157
*Auditbeat*
157158

‎x-pack/libbeat/autodiscover/providers/aws/elb/provider.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,8 +63,6 @@ func AutodiscoverBuilder(
6363

6464
// Construct MetricSet with a full regions list if there is no region specified.
6565
if config.Regions == nil {
66-
// set default region to make initial aws api call
67-
awsCfg.Region = "us-west-1"
6866
svcEC2 := ec2.New(awscommon.EnrichAWSConfigWithEndpoint(
6967
config.AWSConfig.Endpoint, "ec2", awsCfg.Region, awsCfg))
7068

‎x-pack/libbeat/common/aws/credentials.go‎

Lines changed: 49 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -29,37 +29,53 @@ type ConfigAWS struct {
2929
}
3030

3131
// GetAWSCredentials function gets aws credentials from the config.
32-
// If access_key_id and secret_access_key are given, then use them as credentials.
33-
// If role_arn is given, assume the IAM role instead.
34-
// If none of the above is given, then load from aws config file. If credential_profile_name is not
35-
// given, then load default profile from the aws config file.
32+
// If access keys given, use them as credentials.
33+
// If access keys are not given, then load from AWS config file. If credential_profile_name is not
34+
// given, default profile will be used.
35+
// If role_arn is given, assume the IAM role either with access keys or default profile.
3636
func GetAWSCredentials(config ConfigAWS) (awssdk.Config, error) {
37-
logger := logp.NewLogger("get_aws_credentials")
38-
3937
// Check if accessKeyID or secretAccessKey or sessionToken is given from configuration
4038
if config.AccessKeyID != "" || config.SecretAccessKey != "" || config.SessionToken != "" {
41-
logger.Debug("Using access_key_id, secret_access_key and/or session_token for AWS credential")
42-
awsConfig := defaults.Config()
43-
awsCredentials := awssdk.Credentials{
44-
AccessKeyID: config.AccessKeyID,
45-
SecretAccessKey: config.SecretAccessKey,
46-
}
39+
return getAccessKeys(config), nil
40+
}
41+
return getSharedCredentialProfile(config)
42+
}
4743

48-
if config.SessionToken != "" {
49-
awsCredentials.SessionToken = config.SessionToken
50-
}
44+
func getAccessKeys(config ConfigAWS) awssdk.Config {
45+
logger := logp.NewLogger("getAccessKeys")
46+
awsConfig := defaults.Config()
47+
awsCredentials := awssdk.Credentials{
48+
AccessKeyID: config.AccessKeyID,
49+
SecretAccessKey: config.SecretAccessKey,
50+
}
5151

52-
awsConfig.Credentials = awssdk.StaticCredentialsProvider{
53-
Value: awsCredentials,
54-
}
55-
return awsConfig, nil
52+
if config.SessionToken != "" {
53+
awsCredentials.SessionToken = config.SessionToken
54+
}
55+
56+
awsConfig.Credentials = awssdk.StaticCredentialsProvider{
57+
Value: awsCredentials,
58+
}
59+
60+
// Set default region to make initial aws api call
61+
awsConfig.Region = "us-east-1"
62+
63+
// Assume IAM role if iam_role config parameter is given
64+
if config.RoleArn != "" {
65+
logger.Debug("Using role arn and access keys for AWS credential")
66+
return getRoleArn(config, awsConfig)
5667
}
5768

69+
logger.Debug("Using access keys for AWS credential")
70+
return awsConfig
71+
}
72+
73+
func getSharedCredentialProfile(config ConfigAWS) (awssdk.Config, error) {
5874
// If accessKeyID, secretAccessKey or sessionToken is not given, iam_role is not given, then load from default config
5975
// Please see https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html
6076
// with more details.
6177
// If credential_profile_name is empty, then default profile is used.
62-
logger.Debug("Using shared credential profile for AWS credential")
78+
logger := logp.NewLogger("getSharedCredentialProfile")
6379
var options []external.Config
6480
if config.ProfileName != "" {
6581
options = append(options, external.WithSharedConfigProfile(config.ProfileName))
@@ -78,16 +94,24 @@ func GetAWSCredentials(config ConfigAWS) (awssdk.Config, error) {
7894
return awsConfig, errors.Wrap(err, "external.LoadDefaultAWSConfig failed with shared credential profile given")
7995
}
8096

81-
if config.RoleArn == "" {
82-
return awsConfig, nil
83-
}
97+
// Set default region to make initial aws api call
98+
awsConfig.Region = "us-east-1"
8499

85100
// Assume IAM role if iam_role config parameter is given
86-
logger.Debug("Using role_arn for AWS credential")
101+
if config.RoleArn != "" {
102+
logger.Debug("Using role arn and shared credential profile for AWS credential")
103+
return getRoleArn(config, awsConfig), nil
104+
}
105+
106+
logger.Debug("Using shared credential profile for AWS credential")
107+
return awsConfig, nil
108+
}
109+
110+
func getRoleArn(config ConfigAWS, awsConfig awssdk.Config) awssdk.Config {
87111
stsSvc := sts.New(awsConfig)
88112
stsCredProvider := stscreds.NewAssumeRoleProvider(stsSvc, config.RoleArn)
89113
awsConfig.Credentials = stsCredProvider
90-
return awsConfig, nil
114+
return awsConfig
91115
}
92116

93117
// EnrichAWSConfigWithEndpoint function enabled endpoint resolver for AWS

‎x-pack/libbeat/docs/aws-credentials-config.asciidoc‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -56,12 +56,6 @@ AWS_SECRET_ACCESS_KEY=abcd
5656
$ docker run --env-file env.list -d --name=metricbeat --user=root --volume="$(pwd)/metricbeat.aws.yml:/usr/share/metricbeat/metricbeat.yml:ro" docker.elastic.co/beats/metricbeat:7.11.1 metricbeat -e -E cloud.auth=elastic:1234 -E cloud.id=test-aws:1234
5757
----
5858

59-
* Use `role_arn`
60-
61-
If `access_key_id` and `secret_access_key` are not given, then {beatname_lc} will
62-
check for `role_arn`. `role_arn` is used to specify which AWS IAM role to assume
63-
for generating temporary credentials.
64-
6559
* Use `credential_profile_name` and/or `shared_credential_file`
6660

6761
If `access_key_id`, `secret_access_key` and `role_arn` are all not given, then
@@ -80,10 +74,11 @@ for more details.
8074

8175
* Use `role_arn`
8276

83-
If `access_key_id` and `secret_access_key`, `credential_profile_name` and/or
84-
`shared_credential_file` are not given, then {beatname_lc} will check for
85-
`role_arn`. `role_arn` is used to specify which AWS IAM role to assume
86-
for generating temporary credentials.
77+
`role_arn` is used to specify which AWS IAM role to assume for generating
78+
temporary credentials. If `role_arn` is given, {beatname_lc} will check if
79+
access keys are given. If not, {beatname_lc} will check for credential profile
80+
name. If neither is given, default credential profile will be used. Please make
81+
sure credentials are given under either a credential profile or access keys.
8782

8883
If running on Docker, the credential file needs to be provided via a volume
8984
mount. For example, with Metricbeat:

0 commit comments

Comments
 (0)