class LambdaVaultAuth::Vaulter

Internal class for Vault interactions

Constants

DEFAULT_STS_URI

Attributes

auth_provider[R]
auth_role[R]
auth_token[R]
client[R]
expiration[R]
expiration_window[R]
renewal_window[R]
ttl[R]

Public Class Methods

new(env = ENV) click to toggle source
# File lib/lambda_vault_auth.rb, line 19
def initialize(env = ENV)
  @client = new_client_from_environment(env)

  # TODO: Make the following configurable
  # Lifecycle of each token
  @expiration_window = 10 # seconds

  # should be at least the length of the lambda runtime
  @renewal_window = 300 # seconds
end

Public Instance Methods

authenticate!() click to toggle source
# File lib/lambda_vault_auth.rb, line 61
def authenticate!
  secret = client.auth.aws_iam(@auth_role, Aws::CredentialProviderChain.new.resolve, @auth_header, DEFAULT_STS_URI, login_route)

  warn secret.warnings unless secret.warnings.nil? or secret.warnings.empty?

  handle_token(secret)
end
expired?() click to toggle source
# File lib/lambda_vault_auth.rb, line 30
def expired?
  expiration.nil? ? true : expiration > Time.now + expiration_window
end
handle_token(secret) click to toggle source

create the required data to renew/validate populate the token on the client and hand that to the user

# File lib/lambda_vault_auth.rb, line 71
def handle_token(secret)
  @auth_token = secret.auth
  @ttl = secret.lease_duration
  @expiration = Time.now + ttl
  @client.token = @auth_token.client_token
end
login_route() click to toggle source
# File lib/lambda_vault_auth.rb, line 46
def login_route
  "/v1/auth/#{@auth_provider}/login"
end
new_client_from_environment(env) click to toggle source
# File lib/lambda_vault_auth.rb, line 50
def new_client_from_environment(env)
  addr = env.fetch('VAULT_ADDR')
  @auth_header = env['VAULT_AUTH_HEADER'] # may be nil
  @auth_provider = env.fetch('VAULT_AUTH_PROVIDER')
  @auth_role = env.fetch('VAULT_AUTH_ROLE')

  Vault::Client.new(
    address: addr
  )
end
renew!() click to toggle source
# File lib/lambda_vault_auth.rb, line 42
def renew!
  handle_token(auth_token.renew_self(ttl))
end
renewable?() click to toggle source
# File lib/lambda_vault_auth.rb, line 38
def renewable?
  auth_token&.renewable
end
should_renew?() click to toggle source
# File lib/lambda_vault_auth.rb, line 34
def should_renew?
  expiration.nil? ? true : Time.now + renewal_window > expiration
end