[default]
credential_process = /command/to/call

// Initialize a session to load credentials.
sess, _ := session.NewSession(&aws.Config{
    Region: aws.String("us-east-1")},
)

// Create S3 service client to use the credentials.
svc := s3.New(sess)

// Create credentials using the ProcessProvider.
creds := processcreds.NewCredentials("/path/to/command")

// Create service client value configured for credentials.
svc := s3.New(sess, &aws.Config{Credentials: creds})

// Create credentials using the ProcessProvider.
creds := processcreds.NewCredentialsTimeout(
    "/path/to/command",
    time.Duration(500) * time.Millisecond)

creds := processcreds.NewCredentials(
    "/path/to/command",
    func(opt *ProcessProvider) {
        opt.Timeout = time.Duration(2) * time.Minute
        opt.Duration = time.Duration(60) * time.Minute
        opt.MaxBufSize = 2048
    })

// Create an exec.Cmd
myCommand := exec.Command("/path/to/command")

// Create credentials using your exec.Cmd and custom timeout
creds := processcreds.NewCredentialsCommand(
	myCommand,
	func(opt *processcreds.ProcessProvider) {
		opt.Timeout = time.Duration(1) * time.Second
	})

Constants ¶

const (
    // ProviderName is the name this credentials provider will label any
    // returned credentials Value with.
    ProviderName = `ProcessProvider`

    // ErrCodeProcessProviderParse error parsing process output
    ErrCodeProcessProviderParse = "ProcessProviderParseError"

    // ErrCodeProcessProviderVersion version error in output
    ErrCodeProcessProviderVersion = "ProcessProviderVersionError"

    // ErrCodeProcessProviderRequired required attribute missing in output
    ErrCodeProcessProviderRequired = "ProcessProviderRequiredError"

    // ErrCodeProcessProviderExecution execution of command failed
    ErrCodeProcessProviderExecution = "ProcessProviderExecutionError"

    // DefaultDuration is the default amount of time in minutes that the
    // credentials will be valid for.
    DefaultDuration = time.Duration(15) * time.Minute

    // DefaultBufSize limits buffer size from growing to an enormous
    // amount due to a faulty process.
    DefaultBufSize = int(8 * sdkio.KibiByte)

    // DefaultTimeout default limit on time a process can run.
    DefaultTimeout = time.Duration(1) * time.Minute
)

func NewCredentials ¶

func NewCredentials(command string, options ...func(*ProcessProvider)) *credentials.Credentials

NewCredentials returns a pointer to a new Credentials object wrapping the ProcessProvider. The credentials will expire every 15 minutes by default.

func NewCredentialsCommand ¶

func NewCredentialsCommand(command *exec.Cmd, options ...func(*ProcessProvider)) *credentials.Credentials

NewCredentialsCommand returns a pointer to a new Credentials object with the specified command, and default timeout, duration and max buffer size.

func NewCredentialsTimeout ¶

func NewCredentialsTimeout(command string, timeout time.Duration) *credentials.Credentials

NewCredentialsTimeout returns a pointer to a new Credentials object with the specified command and timeout, and default duration and max buffer size.

type CredentialProcessResponse ¶

type CredentialProcessResponse struct {
    // As of this writing, the Version key must be set to 1. This might
    // increment over time as the structure evolves.
    Version int

    // The access key ID that identifies the temporary security credentials.
    AccessKeyID string `json:"AccessKeyId"`

    // The secret access key that can be used to sign requests.
    SecretAccessKey string

    // The token that users must pass to the service API to use the temporary credentials.
    SessionToken string

    // The date on which the current credentials expire.
    Expiration *time.Time
}

A CredentialProcessResponse is the AWS credentials format that must be returned when executing an external credential_process.

type ProcessProvider ¶

type ProcessProvider struct {
    credentials.Expiry

    // Expiry duration of the credentials. Defaults to 15 minutes if not set.
    Duration time.Duration

    // ExpiryWindow will allow the credentials to trigger refreshing prior to
    // the credentials actually expiring. This is beneficial so race conditions
    // with expiring credentials do not cause request to fail unexpectedly
    // due to ExpiredTokenException exceptions.
    //
    // So a ExpiryWindow of 10s would cause calls to IsExpired() to return true
    // 10 seconds before the credentials are actually expired.
    //
    // If ExpiryWindow is 0 or less it will be ignored.
    ExpiryWindow time.Duration

    // MaxBufSize limits memory usage from growing to an enormous
    // amount due to a faulty process.
    MaxBufSize int

    // Timeout limits the time a process can run.
    Timeout time.Duration
    // contains filtered or unexported fields
}

ProcessProvider satisfies the credentials.Provider interface, and is a client to retrieve credentials from a process.

func (*ProcessProvider) IsExpired ¶

func (p *ProcessProvider) IsExpired() bool

IsExpired returns true if the credentials retrieved are expired, or not yet retrieved.

func (*ProcessProvider) Retrieve ¶

func (p *ProcessProvider) Retrieve() (credentials.Value, error)

Retrieve executes the 'credential_process' and returns the credentials.