Skip to content

Commit d156f6e

Browse files
line0line0
committed
add support for passing an AWS.Credentials object via options.amazon.credentials
1 parent 559fcba commit d156f6e

File tree

4 files changed

+254
-16
lines changed

4 files changed

+254
-16
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ gulp.task('deploy', function() {
3838

3939
The code above would work as follows
4040
* Take the files sepcified by `gulp.src` and zip them on a file named `{ version }-{ timestamp }.zip` (i.e: `1.0.0-2016.04.08_13.26.32.zip`)
41-
* If amazon credentials (`accessKeyId`, `secretAccessKey`) are provided in the `amazon` object, set them on the `AWS.config.credentials`. If not provided, the default values from AWS CLI configuration will be used.
41+
* AWS credentials may be provided either in Form of a `accessKeyId` and `secretAccessKey` or a [`credentials` object](http://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Credentials.html). If no credentials are provided, the default values from AWS CLI configuration will be used.
4242
* Try to upload the zipped file to the bucket specified by `amazon.bucket`. If it fails because the bucket doesn't exist, try to create the bucket and then try to upload the zipped file again
4343
* Uploads the ziped files to the bucket on the path `{{ name }}/{{ filename }}` (i.e: `my-application/1.0.0-2016.04.08_13.26.32.zip`)
4444
* Creates a new version on the Application specified by `applicationName` with VersionLabel `{ version }-{ timestamp }` (i.e: `1.0.0-2016.04.08_13.26.32`)

‎package.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@
4343
"left-pad": "^1.1.1",
4444
"lodash": "^4.8.2",
4545
"plexer": "^1.0.1",
46-
"through2": "^2.0.1"
46+
"through2": "^2.0.1",
47+
"uuid": "^3.1.0"
4748
},
4849
"devDependencies": {
4950
"babel-cli": "^6.14.0",

‎src/plugin.js

Lines changed: 76 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
import { readFileSync } from 'fs'
1+
import { readFileSync, existsSync } from 'fs'
22
import { join } from 'path'
33
import { omit, isEqual } from 'lodash'
44
import { log as gulpLog, colors, PluginError } from 'gulp-util'
@@ -9,6 +9,43 @@ import AWS from 'aws-sdk'
99
import pad from 'left-pad'
1010
import { S3File, Bean } from './aws'
1111

12+
const credentialProviders = [
13+
{
14+
Ctor: AWS.Credentials,
15+
fields: [
16+
[ 'accessKeyId', 'secretAccessKey' ]
17+
]
18+
},
19+
{
20+
Ctor: AWS.SAMLCredentials,
21+
fields: [
22+
[ 'RoleArn', 'PrincipalArn', 'SAMLAssertion' ]
23+
]
24+
},
25+
{
26+
Ctor: AWS.CognitoIdentityCredentials,
27+
fields: [
28+
[ 'IdentityPoolId' ],
29+
[ 'IdentityId' ]
30+
]
31+
},
32+
{
33+
// we can only detect these if a custom profile is specified
34+
// but that is fine because shared ini file credentials using the default profile
35+
// are used by the AWS SDK when no credentials are specified
36+
Ctor: AWS.SharedIniFileCredentials,
37+
fields: [
38+
[ 'profile' ]
39+
]
40+
},
41+
{
42+
Ctor: AWS.TemporaryCredentials,
43+
fields: [
44+
[ 'SerialNumber', 'TokenCode' ],
45+
[ 'RoleArn' ]
46+
]
47+
}
48+
]
1249
const IS_TEST = process.env['NODE_ENV'] === 'test'
1350
const log = IS_TEST ? () => {} : gulpLog
1451

@@ -129,7 +166,7 @@ export async function deploy(opts, file, s3file, bean) {
129166
if (e.code !== 'NoSuchBucket')
130167
throw e
131168

132-
await s3file.create()
169+
await s3file.create(opts.region)
133170
await s3file.upload(file)
134171
}
135172

@@ -191,8 +228,43 @@ export function buildOptions(opts) {
191228
if (!options.amazon)
192229
throw new PluginError(PLUGIN_NAME, 'No amazon config provided')
193230

194-
// if keys are provided, create new credentials, otherwise defaults will be used
195-
if (options.amazon.accessKeyId && options.amazon.secretAccessKey) {
231+
if (options.amazon.credentials !== undefined) {
232+
const creds = options.amazon.credentials
233+
const credsType = typeof(creds)
234+
235+
if (credsType === 'string') {
236+
// if the credentials are of type string, assume the user is specifying
237+
// an environment variable name prefix
238+
AWS.config.credentials = existsSync(creds) ? new AWS.FileSystemCredentials(creds)
239+
: new AWS.EnvironmentCredentials(creds)
240+
} else if (credsType !== 'object') {
241+
// otherwise the credentials must be an object
242+
throw new PluginError(PLUGIN_NAME, `Amazon credentials must be an object, got a '${typeof(creds)}'.`)
243+
} else if (creds.constructor.name === 'Credentials' ||
244+
typeof(creds.constructor.__super__) === 'function' &&
245+
creds.constructor.__super__.name === 'Credentials') {
246+
// support pre-build objects of or inheriting the AWS.Credentials class
247+
AWS.config.credentials = creds
248+
} else {
249+
// otherwise try to find a matching provider for the supplied credentials object
250+
const provider = credentialProviders.find(prov =>
251+
prov.fields.find(fields =>
252+
fields.every(field => creds[field] !== undefined)
253+
)
254+
)
255+
if (provider === undefined)
256+
throw new PluginError(PLUGIN_NAME, `Could not find a matching AWS credentials provider for the supplied credentials object.`)
257+
258+
try {
259+
AWS.config.credentials = new provider.Ctor(creds)
260+
} catch(err) {
261+
throw new PluginError(PLUGIN_NAME, `An error occured while trying to construct AWS.${provider.Ctor.name} from supplied credentials object: ${err}`)
262+
}
263+
}
264+
} else if (options.amazon.accessKeyId && options.amazon.secretAccessKey) {
265+
// legacy support for the access key id and secret access key
266+
// passed in directly via the options.amazon object
267+
log('options.amazon.accessKeyId and options.amazon.secretAccessKey are deprecated and will be removed in a future version. Use options.amazon.credentials instead.')
196268
AWS.config.credentials = new AWS.Credentials({
197269
accessKeyId: opts.amazon.accessKeyId,
198270
secretAccessKey: opts.amazon.secretAccessKey

‎test/test.js

Lines changed: 175 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
11
/* eslint require-jsdoc: "off", new-cap: "off", no-invalid-this: "off" */
2-
import { readFileSync } from 'fs'
2+
import { readFileSync, writeFileSync, unlinkSync } from 'fs'
33
import should from 'should'
44
import { spy, stub } from 'sinon'
55
import AWS from 'aws-sdk'
66
import { File } from 'gulp-util'
77
import { S3File, Bean } from '../src/aws'
88
import * as plugin from '../src/plugin'
99
import gulpEbDeploy from '../src'
10+
import os from 'os'
11+
import uuidv4 from 'uuid/v4'
12+
import path from 'path'
1013

1114
describe('Gulp plugin', () => {
1215
let file
@@ -539,7 +542,26 @@ describe('Gulp plugin', () => {
539542
}
540543
AWS.config.credentials = null
541544
})
542-
it('updates AWS.config.credentials with the provided values', () => {
545+
546+
it('sets AWS.config with signatureVersion v4 by default', () => {
547+
spy(AWS, 'Credentials')
548+
buildOptions({
549+
amazon: {}
550+
})
551+
AWS.config.signatureVersion.should.be.equal('v4')
552+
})
553+
554+
it('allows to set a signatureVersion for AWS.config', () => {
555+
spy(AWS, 'Credentials')
556+
buildOptions({
557+
amazon: {
558+
signatureVersion: 'v2'
559+
}
560+
})
561+
AWS.config.signatureVersion.should.be.equal('v2')
562+
})
563+
564+
it('updates AWS.config.credentials with legacy values', () => {
543565
spy(AWS, 'Credentials')
544566
buildOptions({
545567
amazon: {
@@ -548,26 +570,127 @@ describe('Gulp plugin', () => {
548570
}
549571
})
550572
AWS.Credentials.calledOnce.should.be.true()
573+
AWS.config.credentials.should.be.instanceOf(AWS.Credentials)
551574
AWS.config.credentials.accessKeyId.should.be.equal('__accessKeyId')
552575
AWS.config.credentials.secretAccessKey.should.be.equal('__secretAccessKey')
553576
})
554577

555-
it('sets AWS.config with signatureVersion v4 by default', () => {
556-
spy(AWS, 'Credentials')
578+
it('updates AWS.config.credentials with access key id and secret access key.', () => {
557579
buildOptions({
558-
amazon: {}
580+
amazon: {
581+
credentials: {
582+
accessKeyId: '__accessKeyId',
583+
secretAccessKey: '__secretAccessKey'
584+
}
585+
}
559586
})
560-
AWS.config.signatureVersion.should.be.equal('v4')
587+
AWS.config.credentials.should.be.instanceOf(AWS.Credentials)
588+
AWS.config.credentials.accessKeyId.should.be.equal('__accessKeyId')
589+
AWS.config.credentials.secretAccessKey.should.be.equal('__secretAccessKey')
561590
})
562591

563-
it('allows to set a signatureVersion for AWS.config', () => {
564-
spy(AWS, 'Credentials')
592+
it('updates AWS.config.credentials with SAML credentials.', () => {
565593
buildOptions({
566594
amazon: {
567-
signatureVersion: 'v2'
595+
credentials: {
596+
RoleArn: '__roleArn',
597+
PrincipalArn: '__principalArn',
598+
SAMLAssertion: '__samlAssertion'
599+
}
568600
}
569601
})
570-
AWS.config.signatureVersion.should.be.equal('v2')
602+
AWS.config.credentials.should.be.instanceOf(AWS.SAMLCredentials)
603+
AWS.config.credentials.params.RoleArn.should.be.equal('__roleArn')
604+
AWS.config.credentials.params.PrincipalArn.should.be.equal('__principalArn')
605+
AWS.config.credentials.params.SAMLAssertion.should.be.equal('__samlAssertion')
606+
})
607+
608+
it('updates AWS.config.credentials with MFA temporary credentials.', () => {
609+
AWS.config.credentials = new AWS.Credentials()
610+
buildOptions({
611+
amazon: {
612+
credentials: {
613+
SerialNumber: '__serialNumber',
614+
TokenCode: '__tokenCode'
615+
}
616+
}
617+
})
618+
AWS.config.credentials.should.be.instanceOf(AWS.TemporaryCredentials)
619+
AWS.config.credentials.params.SerialNumber.should.be.equal('__serialNumber')
620+
AWS.config.credentials.params.TokenCode.should.be.equal('__tokenCode')
621+
})
622+
623+
it('updates AWS.config.credentials with IAM role temporary credentials.', () => {
624+
AWS.config.credentials = new AWS.Credentials()
625+
buildOptions({
626+
amazon: {
627+
credentials: {
628+
RoleArn: '__roleArn'
629+
}
630+
}
631+
})
632+
AWS.config.credentials.should.be.instanceOf(AWS.TemporaryCredentials)
633+
AWS.config.credentials.params.RoleArn.should.be.equal('__roleArn')
634+
})
635+
636+
it('updates AWS.config.credentials with Cognito identity ID credentials.', () => {
637+
buildOptions({
638+
amazon: {
639+
credentials: {
640+
IdentityId: '__indentityId'
641+
}
642+
}
643+
})
644+
AWS.config.credentials.should.be.instanceOf(AWS.CognitoIdentityCredentials)
645+
AWS.config.credentials.params.IdentityId.should.be.equal('__indentityId')
646+
})
647+
648+
it('updates AWS.config.credentials with Cognito identity pool ID credentials.', () => {
649+
buildOptions({
650+
amazon: {
651+
credentials: {
652+
IdentityPoolId: '__indentityPoolId'
653+
}
654+
}
655+
})
656+
AWS.config.credentials.should.be.instanceOf(AWS.CognitoIdentityCredentials)
657+
AWS.config.credentials.params.IdentityPoolId.should.be.equal('__indentityPoolId')
658+
})
659+
660+
it('updates AWS.config.credentials with an environment credential prefix.', () => {
661+
process.env.__envPrefix_ACCESS_KEY_ID = '__accessKeyId'
662+
process.env.__envPrefix_SECRET_ACCESS_KEY = '__secretAccessKey'
663+
664+
buildOptions({
665+
amazon: {
666+
credentials: '__envPrefix'
667+
}
668+
})
669+
AWS.config.credentials.should.be.instanceOf(AWS.EnvironmentCredentials)
670+
AWS.config.credentials.accessKeyId.should.be.equal('__accessKeyId')
671+
AWS.config.credentials.secretAccessKey.should.be.equal('__secretAccessKey')
672+
673+
process.env.__envPrefix_ACCESS_KEY_ID = ''
674+
process.env.__envPrefix_SECRET_ACCESS_KEY = ''
675+
})
676+
677+
it('updates AWS.config.credentials with credentials loaded from a credential file', () => {
678+
const fileName = path.join(os.tmpdir(), `credentials-${uuidv4()}.json`)
679+
writeFileSync(fileName, JSON.stringify({
680+
accessKeyId: '__accessKeyId',
681+
secretAccessKey: '__secretAccessKey'
682+
}))
683+
684+
buildOptions({
685+
amazon: {
686+
credentials: fileName
687+
}
688+
})
689+
unlinkSync(fileName)
690+
691+
AWS.config.credentials.should.be.instanceOf(AWS.FileSystemCredentials)
692+
AWS.config.credentials.accessKeyId.should.be.equal('__accessKeyId')
693+
AWS.config.credentials.secretAccessKey.should.be.equal('__secretAccessKey')
571694
})
572695

573696
it('does not update AWS.config.credentials if no access parameters were specified', () => {
@@ -578,6 +701,48 @@ describe('Gulp plugin', () => {
578701
AWS.Credentials.called.should.be.false()
579702
should(AWS.config.credentials).be.null()
580703
})
704+
705+
it('updates AWS.config.credentials with a Credentials object', () => {
706+
spy(AWS, 'Credentials')
707+
const credentials = new AWS.Credentials()
708+
buildOptions({
709+
amazon: {
710+
credentials: credentials
711+
}
712+
})
713+
AWS.Credentials.calledOnce.should.be.true()
714+
AWS.config.credentials.should.be.equal(credentials)
715+
})
716+
717+
it('throws an error when provided credentials are not a string or object', () => {
718+
(() => buildOptions({
719+
amazon: {
720+
credentials: 0
721+
}
722+
})).should.throw()
723+
})
724+
725+
it('throws an error when no matching credential provider is found', () => {
726+
(() => buildOptions({
727+
amazon: {
728+
credentials: {
729+
unknown: '__unknown'
730+
}
731+
}
732+
})).should.throw()
733+
})
734+
735+
it('rethrows an error thrown in the an AWS credentials constructor', () => {
736+
// temporary credentials missing master credentials
737+
(() => buildOptions({
738+
amazon: {
739+
credentials: {
740+
SerialNumber: '__serialNumber',
741+
TokenCode: '__tokenCode'
742+
}
743+
}
744+
})).should.throw()
745+
})
581746
})
582747

583748
describe('gulpEbDeploy', () => {

0 commit comments

Comments
 (0)