class AwsMfa::CredentialsLoader

Attributes

mydrive_credentials_cache_dir[R]

Public Class Methods

new(mydrive_credentials_cache_dir, expiration_buffer_minutes: 0) click to toggle source
# File lib/aws_mfa/credentials_loader.rb, line 9
def initialize(mydrive_credentials_cache_dir, expiration_buffer_minutes: 0)
  @mydrive_credentials_cache_dir = mydrive_credentials_cache_dir
  @expiration_buffer_seconds = expiration_buffer_minutes * 60
end

Public Instance Methods

load_credentials(profile_config) click to toggle source
# File lib/aws_mfa/credentials_loader.rb, line 14
def load_credentials(profile_config)
  credentials_file = File.join(mydrive_credentials_cache_dir, build_credentials_file_name(profile_config))

  if File.readable?(credentials_file) && !token_expired?(credentials_file)
    credentials = File.read(credentials_file)
  else
    credentials = load_credentials_from_aws(profile_config)
    write_credentials_to_file(credentials_file, credentials)
  end

  JSON.parse(credentials).fetch('Credentials')
end

Private Instance Methods

build_credentials_command(profile_config, token_code) click to toggle source
# File lib/aws_mfa/credentials_loader.rb, line 64
def build_credentials_command(profile_config, token_code)
  username = profile_config.mfa_serial.split("/").last
  "aws --profile #{profile_config.source_profile} --region eu-west-1 --output json sts assume-role " \
  "--duration-seconds #{duration_seconds} --role-arn #{profile_config.role_arn} " \
  "--role-session-name #{username} --serial-number #{profile_config.mfa_serial} --token-code #{token_code}"
end
build_credentials_file_name(profile_config) click to toggle source
# File lib/aws_mfa/credentials_loader.rb, line 31
def build_credentials_file_name(profile_config)
  source_profile = profile_config.source_profile || profile_config.profile
  "#{source_profile}_#{profile_config.profile}_mfa_credentials"
end
duration_seconds() click to toggle source
# File lib/aws_mfa/credentials_loader.rb, line 71
def duration_seconds
  ENV['MYDRIVE_MFA_DURATION'] || 3600
end
load_credentials_from_aws(profile_config) click to toggle source
# File lib/aws_mfa/credentials_loader.rb, line 42
def load_credentials_from_aws(profile_config)
  token_code = request_code_from_user
  credentials_command = build_credentials_command(profile_config, token_code)
  result = AwsMfa::ShellCommand.new(credentials_command).call
  if result.success?
    result.output
  else
    raise Errors::InvalidCode, 'There was a problem validating the MFA code with AWS'
  end
end
request_code_from_user() click to toggle source
# File lib/aws_mfa/credentials_loader.rb, line 57
def request_code_from_user
  puts 'Enter the 6-digit code from your MFA device:'
  code = STDIN.noecho(&:gets).chomp
  raise Errors::InvalidCode, 'That is an invalid MFA code' unless code =~ /^\d{6}$/
  code
end
token_expired?(credentials_file) click to toggle source
# File lib/aws_mfa/credentials_loader.rb, line 36
def token_expired?(credentials_file)
  credentials_file_content = JSON.parse(File.read(credentials_file))
  expiration_time = Time.parse(credentials_file_content["Credentials"]["Expiration"])
  Time.now.to_i + @expiration_buffer_seconds >= expiration_time.to_i
end
write_credentials_to_file(credentials_file, credentials) click to toggle source
# File lib/aws_mfa/credentials_loader.rb, line 53
def write_credentials_to_file(credentials_file, credentials)
  File.open(credentials_file, 'w') { |file| file.write(credentials) }
end