class LambdaVaultAuth::Vaulter
Internal class for Vault interactions
Constants
- DEFAULT_STS_URI
Attributes
auth_provider[R]
auth_role[R]
auth_token[R]
client[R]
expiration[R]
expiration_window[R]
renewal_window[R]
ttl[R]
Public Class Methods
new(env = ENV)
click to toggle source
# File lib/lambda_vault_auth.rb, line 19 def initialize(env = ENV) @client = new_client_from_environment(env) # TODO: Make the following configurable # Lifecycle of each token @expiration_window = 10 # seconds # should be at least the length of the lambda runtime @renewal_window = 300 # seconds end
Public Instance Methods
authenticate!()
click to toggle source
# File lib/lambda_vault_auth.rb, line 61 def authenticate! secret = client.auth.aws_iam(@auth_role, Aws::CredentialProviderChain.new.resolve, @auth_header, DEFAULT_STS_URI, login_route) warn secret.warnings unless secret.warnings.nil? or secret.warnings.empty? handle_token(secret) end
expired?()
click to toggle source
# File lib/lambda_vault_auth.rb, line 30 def expired? expiration.nil? ? true : expiration > Time.now + expiration_window end
handle_token(secret)
click to toggle source
create the required data to renew/validate populate the token on the client and hand that to the user
# File lib/lambda_vault_auth.rb, line 71 def handle_token(secret) @auth_token = secret.auth @ttl = secret.lease_duration @expiration = Time.now + ttl @client.token = @auth_token.client_token end
login_route()
click to toggle source
# File lib/lambda_vault_auth.rb, line 46 def login_route "/v1/auth/#{@auth_provider}/login" end
new_client_from_environment(env)
click to toggle source
# File lib/lambda_vault_auth.rb, line 50 def new_client_from_environment(env) addr = env.fetch('VAULT_ADDR') @auth_header = env['VAULT_AUTH_HEADER'] # may be nil @auth_provider = env.fetch('VAULT_AUTH_PROVIDER') @auth_role = env.fetch('VAULT_AUTH_ROLE') Vault::Client.new( address: addr ) end
renew!()
click to toggle source
# File lib/lambda_vault_auth.rb, line 42 def renew! handle_token(auth_token.renew_self(ttl)) end
renewable?()
click to toggle source
# File lib/lambda_vault_auth.rb, line 38 def renewable? auth_token&.renewable end
should_renew?()
click to toggle source
# File lib/lambda_vault_auth.rb, line 34 def should_renew? expiration.nil? ? true : Time.now + renewal_window > expiration end