Skip to content

add region option to AwsAssumeRoleCredentialsProvider #697

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

add region option to AwsAssumeRoleCredentialsProvider #697

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 26 additions & 17 deletions ...nnect-s3/src/main/java/io/confluent/connect/s3/auth/AwsAssumeRoleCredentialsProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ public class AwsAssumeRoleCredentialsProvider implements AWSCredentialsProvider,
public static final String ROLE_EXTERNAL_ID_CONFIG = "sts.role.external.id";
public static final String ROLE_ARN_CONFIG = "sts.role.arn";
public static final String ROLE_SESSION_NAME_CONFIG = "sts.role.session.name";
public static final String STS_REGION_CONFIG = "sts.region";

private static final ConfigDef STS_CONFIG_DEF = new ConfigDef()
.define(
Expand All @@ -59,11 +60,18 @@ public class AwsAssumeRoleCredentialsProvider implements AWSCredentialsProvider,
ConfigDef.Type.STRING,
ConfigDef.Importance.HIGH,
"Role session name to use when starting a session"
).define(
STS_REGION_CONFIG,
ConfigDef.Type.STRING,
"",
ConfigDef.Importance.MEDIUM,
"Region of STS service. If not specified, uses a default region selector."
);

private String roleArn;
private String roleExternalId;
private String roleSessionName;
private String region;

private BasicAWSCredentials basicCredentials;

Expand All @@ -77,28 +85,29 @@ public void configure(Map<String, ?> configs) {
roleArn = config.getString(ROLE_ARN_CONFIG);
roleExternalId = config.getString(ROLE_EXTERNAL_ID_CONFIG);
roleSessionName = config.getString(ROLE_SESSION_NAME_CONFIG);
region = config.getString(STS_REGION_CONFIG);
final String accessKeyId = (String) configs.get(AWS_ACCESS_KEY_ID_CONFIG);
final String secretKey = (String) configs.get(AWS_SECRET_ACCESS_KEY_CONFIG);

// default sts client will internally use default credentials chain provider
AWSSecurityTokenServiceClientBuilder stsClientBuilder = AWSSecurityTokenServiceClientBuilder
.standard();
if (StringUtils.isNotBlank(region)) {
stsClientBuilder = stsClientBuilder.withRegion(region);
}

// Use explicit access key and secret if set
if (StringUtils.isNotBlank(accessKeyId) && StringUtils.isNotBlank(secretKey)) {
basicCredentials = new BasicAWSCredentials(accessKeyId, secretKey);
stsCredentialProvider = new STSAssumeRoleSessionCredentialsProvider
.Builder(roleArn, roleSessionName)
.withStsClient(AWSSecurityTokenServiceClientBuilder
.standard()
.withCredentials(new AWSStaticCredentialsProvider(basicCredentials)).build()
)
.withExternalId(roleExternalId)
.build();
} else {
basicCredentials = null;
stsCredentialProvider = new STSAssumeRoleSessionCredentialsProvider
.Builder(roleArn, roleSessionName)
// default sts client will internally use default credentials chain provider
// https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.html#credentials-default
.withStsClient(AWSSecurityTokenServiceClientBuilder.defaultClient())
.withExternalId(roleExternalId)
.build();
stsClientBuilder = stsClientBuilder
.withCredentials(new AWSStaticCredentialsProvider(basicCredentials));
}

stsCredentialProvider = new STSAssumeRoleSessionCredentialsProvider
.Builder(roleArn, roleSessionName)
.withStsClient(stsClientBuilder.build())
.withExternalId(roleExternalId)
.build();
}

@Override
Expand Down
4 changes: 4 additions & 0 deletions kafka-connect-s3/src/test/java/io/confluent/connect/s3/S3SinkConnectorConfigTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,6 +255,10 @@ public void testConfigurableAwsAssumeRoleCredentialsProvider() {
configPrefix.concat(AwsAssumeRoleCredentialsProvider.ROLE_EXTERNAL_ID_CONFIG),
"my-external-id"
);
properties.put(
configPrefix.concat(AwsAssumeRoleCredentialsProvider.STS_REGION_CONFIG),
"us-west-2"
);
connectorConfig = new S3SinkConnectorConfig(properties);

AwsAssumeRoleCredentialsProvider credentialsProvider =
Expand Down