Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix sts credentials reusage #222

Closed
wants to merge 5 commits into from
Closed

Fix sts credentials reusage #222

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
364d30a
- Fix STS credentials reusage.
dsumsky-infor Nov 3, 2016
1785e66
Merge branch 'master' into fix-sts-credentials-reusage
dsumsky-infor Nov 3, 2016
c913b26
Added cred logging message which I deleted by mistake.
dsumsky-infor Nov 3, 2016
15b9b5a
Merge branch 'develop' into fix-sts-credentials-reusage
dsumsky Nov 3, 2016
14e80af
Merge branch 'develop' into fix-sts-credentials-reusage
jantman Nov 10, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 14 additions & 2 deletions awslimitchecker/connectable.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@ def __init__(self, creds_dict):
self.expiration = creds_dict['Credentials']['Expiration']
self.assumed_role_id = creds_dict['AssumedRoleUser']['AssumedRoleId']
self.assumed_role_arn = creds_dict['AssumedRoleUser']['Arn']
self.account_id = creds_dict['account_id']


class Connectable(object):
Expand Down Expand Up @@ -93,8 +94,15 @@ def _boto3_connection_kwargs(self):
self.region)
Connectable.credentials = self._get_sts_token()
else:
logger.debug("Reusing previous STS credentials for account %s",
self.account_id)
if self.account_id == Connectable.credentials.account_id:
logger.debug("Reusing previous STS credentials for account %s",
self.account_id)
else:
logger.debug("Previous STS credentials are for account %s", Connectable.credentials.account_id)
logger.debug("Connecting for account %s role '%s' with STS "
"(region: %s)", self.account_id, self.account_role,
self.region)
Connectable.credentials = self._get_sts_token()
kwargs['aws_access_key_id'] = Connectable.credentials.access_key
kwargs['aws_secret_access_key'] = Connectable.credentials.secret_key
kwargs['aws_session_token'] = Connectable.credentials.session_token
Expand Down Expand Up @@ -167,7 +175,11 @@ def _get_sts_token(self):
if self.mfa_token is not None:
assume_kwargs['TokenCode'] = self.mfa_token
role = sts.assume_role(**assume_kwargs)

role['account_id'] = self.account_id

creds = ConnectableCredentials(role)

logger.debug("Got STS credentials for role; access_key_id=%s",
creds.access_key)
return creds