2
2
3
3
module Mysql2
4
4
# Generates and caches AWS IAM Authentication tokens to use in place of MySQL user passwords
5
- class AwsTokenAuth
5
+ class AwsIamAuth
6
6
include Singleton
7
+ attr_reader :mutex
8
+ attr_accessor :passwords
7
9
8
10
# Tokens are valid for up to 15 minutes.
9
11
# We will assume ours expire in 14 minutes to be safe.
@@ -23,23 +25,24 @@ def initialize
23
25
# :password is the token value
24
26
# :expires_at is (just before) the token was generated plus 14 minutes
25
27
@passwords = { }
26
- @generator = Aws ::RDS ::AuthTokenGenerator . new
28
+ instance_credentials = Aws ::InstanceProfileCredentials . new
29
+ @generator = Aws ::RDS ::AuthTokenGenerator . new ( :credentials => instance_credentials )
27
30
end
28
31
29
32
def password ( user , host , port , opts )
30
33
params = to_params ( user , host , port , opts )
31
34
key = key_from_params ( params )
32
35
passwd = nil
33
- AwsTokenAuth . instance . mutex . synchronize do
36
+ AwsIamAuth . instance . mutex . synchronize do
34
37
begin
35
- passwd = @passwords [ key ] [ :password ] if @passwords [ key ] [ :password ] && Time . now . utc < @passwords [ key ] [ :expires_at ]
38
+ passwd = @passwords [ key ] [ :password ] if @passwords . dig ( key , :password ) && Time . now . utc < @passwords . dig ( key , :expires_at )
36
39
rescue KeyError
37
40
passwd = nil
38
41
end
39
42
end
40
43
return passwd unless passwd . nil?
41
44
42
- AwsTokenAuth . instance . mutex . synchronize do
45
+ AwsIamAuth . instance . mutex . synchronize do
43
46
@passwords [ key ] = { }
44
47
@passwords [ key ] [ :expires_at ] = Time . now . utc + TOKEN_EXPIRES_IN
45
48
@passwords [ key ] [ :password ] = password_from_iam ( params )
0 commit comments