Golang aws.GetAuth函数代码示例

// Assume role uses the current server role to call STS and assume a different role if permitted
// Params:
//   roleArn - the requested role ARN (example: arn:aws:iam::11111111111:role/myrole )
//   sessionName - a name to associate with the current session. Use the service name +
//                 unique idenfitifier preferebly.
//   duration - the duration of the session in seconds. Must be between 900 and 3600
// Returns aws.Auth object that can be used with any of the existing goamz APIs
//
// Check http://goo.gl/M6uCu5 for more information
//
func AssumeRole(roleArn string, sessionName string, duration int) (*aws.Auth, error) {
	if duration < 900 || duration > 3600 {
		return nil, fmt.Errorf("Duration out of bounds")
	}

	//Try to get our local auth
	localAuth, err := aws.GetAuth("", "", "", time.Time{})
	if err != nil {
		return nil, err
	}

	stsClient := sts.New(localAuth, aws.Regions[util.GetAwsRegionName()])
	stsOptions := &sts.AssumeRoleParams{
		DurationSeconds: int(duration),
		RoleArn:         roleArn,
		RoleSessionName: sessionName,
	}

	//Try to assume role
	roleAuth, err := stsClient.AssumeRole(stsOptions)
	if err != nil {
		return nil, err
	}

	//Marshal the response into an aws.Auth object
	auth := aws.NewAuth(roleAuth.Credentials.AccessKeyId, roleAuth.Credentials.SecretAccessKey,
		roleAuth.Credentials.SessionToken, roleAuth.Credentials.Expiration)

	return auth, nil
}

func (s *S) TestGetAuthEnv(c *C) {
	os.Clearenv()
	os.Setenv("AWS_SECRET_ACCESS_KEY", "secret")
	os.Setenv("AWS_ACCESS_KEY_ID", "access")
	auth, err := aws.GetAuth("", "", "", time.Time{})
	c.Assert(err, IsNil)
	c.Assert(*auth, Equals, *aws.NewAuth("access", "secret", "", time.Time{}))
}

func (s *S) TestGetAuthEnv(c *gocheck.C) {
	os.Clearenv()
	os.Setenv("AWS_SECRET_ACCESS_KEY", "secret")
	os.Setenv("AWS_ACCESS_KEY_ID", "access")
	auth, err := aws.GetAuth("", "", "", time.Time{})
	c.Assert(err, gocheck.IsNil)
	c.Assert(auth, gocheck.Equals, aws.Auth{SecretKey: "secret", AccessKey: "access"})
}

func (pc *NodeController) getNodeAddEc2Action(c *gin.Context) {

	a, err := models.AccessMapper.FetchOne("ec2")
	if err != nil {
		panic(err)
	}

	if a == nil {

		c.HTML(http.StatusOK, "node_add_ec2.html", map[string]interface{}{})
		return
	}

	auth, err := aws.GetAuth(a.AccessKey, a.PrivateKey, "", time.Now().Add(time.Hour))
	if err != nil {
		panic(err)
	}

	var vpcs []ec2.VPC
	var securityGroups []ec2.SecurityGroupInfo
	region := c.Query("availability_zone")
	vpc := c.Query("vpc")
	securityGroup := c.Query("security_group")
	if region != "" {

		awsec2 := ec2.New(auth, aws.Regions[region])
		res, _ := awsec2.DescribeVpcs(nil, nil)

		if res != nil {
			vpcs = res.VPCs
		}

		if vpc != "" {
			if groups, _ := awsec2.SecurityGroups(nil, nil); groups != nil {
				for _, g := range groups.Groups {
					if g.VpcId == vpc {
						securityGroups = append(securityGroups, g)
					}
				}
			}
		}

	}

	log.Println("vpcs:", vpcs)

	c.HTML(http.StatusOK, "node_add_ec2.html", map[string]interface{}{
		"AccessKey":      a.AccessKey,
		"AWSRegions":     aws.Regions,
		"VPCs":           vpcs,
		"SecurityGroups": securityGroups,
		"query": map[string]interface{}{
			"availability_zone": region,
			"vpc":               vpc,
			"security_group":    securityGroup,
		},
	})
}

func (s *S) TestGetAuthStatic(c *C) {
	exptdate := time.Now().Add(time.Hour)
	auth, err := aws.GetAuth("access", "secret", "token", exptdate)
	c.Assert(err, IsNil)
	c.Assert(auth.AccessKey(), Equals, "access")
	c.Assert(auth.SecretKey(), Equals, "secret")
	c.Assert(auth.Token(), Equals, "token")
	c.Assert(auth.Expiration(), Equals, exptdate)
}

func getBucket() (*s3.Bucket, error) {
	auth, err := aws.GetAuth(config.AWS_ACCESS_KEY, config.AWS_SECRET_KEY, "", time.Time{})
	if err != nil {
		return nil, err
	}

	conn := s3.New(auth, aws.Regions["eu-west-1"])
	b := conn.Bucket(config.BUCKET)
	return b, nil
}

func main() {
	kingpin.CommandLine.Help = "Docker container EC2 metadata service."
	kingpin.Parse()

	defer log.Flush()
	configureLogging(*verboseOpt)

	auth, err := aws.GetAuth("", "", "", time.Time{})

	if err != nil {
		panic(err)
	}

	containerService := NewContainerService(dockerClient(), *defaultRole, auth)

	// Proxy non-credentials requests to primary metadata service
	http.HandleFunc("/", logHandler(func(w http.ResponseWriter, r *http.Request) {
		match := credsRegex.FindStringSubmatch(r.URL.Path)
		if match != nil {
			handleCredentials(match[1], match[2], containerService, w, r)
			return
		}

		proxyReq, err := http.NewRequest(r.Method, fmt.Sprintf("%s%s", baseUrl, r.URL.Path), r.Body)

		if err != nil {
			log.Error("Error creating proxy http request: ", err)
			http.Error(w, "An unexpected error occurred communicating with Amazon", http.StatusInternalServerError)
			return
		}

		copyHeaders(proxyReq.Header, r.Header)
		resp, err := instanceServiceClient.RoundTrip(proxyReq)

		if err != nil {
			log.Error("Error forwarding request to EC2 metadata service: ", err)
			http.Error(w, "An unexpected error occurred communicating with Amazon", http.StatusInternalServerError)
			return
		}

		defer resp.Body.Close()

		copyHeaders(w.Header(), resp.Header)
		w.WriteHeader(resp.StatusCode)
		if _, err := io.Copy(w, resp.Body); err != nil {
			log.Warn("Error copying response content from EC2 metadata service: ", err)
		}
	}))

	log.Critical(http.ListenAndServe(*serverAddr, nil))
}

func main() {
	var opts struct {
		AWSAccess  string `long:"aws-access" env:"ACCESS_KEY" required:"true"`
		AWSSecret  string `long:"aws-secret" env:"SECRET_KEY" required:"true"`
		AWSRegion  string `long:"aws-region" env:"AWS_REGION" default:"us-east-1"`
		StatsDHost string `long:"statsd-host" env:"STATSD_HOST" default:"localhost:8125"`
		Verbose    bool   `long:"verbose" short:"v" env:"DEBUG" default:"false"`
	}

	godotenv.Load(".env")
	if _, err := flags.Parse(&opts); err != nil {
		log.Fatal("cannot parse command line arguments")
	}

	if opts.Verbose {
		log.SetLevel(log.DebugLevel)
	}

	statsdbuffer, err := getStatsdBuffer(opts.StatsDHost)
	if err != nil {
		log.Fatal("could not initialize statsd client")
	}
	statsdbuffer.Logger = log.StandardLogger()

	auth, err := aws.GetAuth(opts.AWSAccess, opts.AWSSecret, "", time.Now())
	if err != nil {
		log.WithField("error", err).Fatal("could not authenticate to aws")
	}

	region := aws.Regions[opts.AWSRegion]
	cw, err := cloudwatch.NewCloudWatch(auth, region.CloudWatchServicepoint)
	if err != nil {
		log.WithFields(log.Fields{
			"error":  err,
			"region": opts.AWSRegion,
		}).Fatal("could not open cloudwatch")
	}

	requests, err := getMetricRequests(cw)
	if err != nil {
		log.WithField("error", err).Fatal("could not build requests")
	}
	log.WithField("num_metrics", len(requests)).Info("built stats requests")

	ticker := time.NewTicker(time.Minute)
	for now := range ticker.C {
		goStats(cw, &requests, now, statsdbuffer)
	}
}

// Store messages to S3:
func StoreMessages(fileData []byte) error {

	// Something to compress the fileData into:
	var fileDataBytes bytes.Buffer
	gzFileData := gzip.NewWriter(&fileDataBytes)
	gzFileData.Write(fileData)
	gzFileData.Close()

	log.Infof("Storing %d bytes...", len(fileDataBytes.Bytes()))

	// Authenticate with AWS:
	awsAuth, err := aws.GetAuth("", "", "", time.Now())
	if err != nil {
		log.Criticalf("Unable to authenticate to AWS! (%s) ...\n", err)
		os.Exit(2)
	} else {
		log.Debugf("Authenticated to AWS")
	}

	// Make a new S3 connection:
	log.Debugf("Connecting to AWS...")
	s3Connection := s3.New(awsAuth, aws.Regions[*awsRegion])

	// Make a bucket object:
	s3Bucket := s3Connection.Bucket(*s3Bucket)

	// Prepare arguments for the call to store messages on S3:
	contType := "text/plain"
	perm := s3.BucketOwnerFull
	options := &s3.Options{
		SSE:  false,
		Meta: nil,
	}

	// Build the filename we'll use for S3:
	fileName := fmt.Sprintf("%v.gz", FileName())

	// Upload the data:
	err = s3Bucket.Put(fileName, fileDataBytes.Bytes(), contType, perm, *options)
	if err != nil {
		log.Criticalf("Failed to put file (%v) on S3 (%v)", fileName, err)
		os.Exit(2)
	} else {
		log.Infof("Stored file (%v) on s3", fileName)
	}

	return nil
}

// Lookup the Route53 zone-id for the domain-name we were given:
func getRoute53ZoneId(domainName string) (string, error) {

	// Authenticate with AWS:
	awsAuth, err := aws.GetAuth("", "", "", time.Now())
	if err != nil {
		log.Criticalf("[dnsUpdater] Unable to authenticate to AWS! (%s)", err)
		return "", err

	} else {
		log.Debugf("[dnsUpdater] Authenticated to AWS")
	}

	// Make a new EC2 connection:
	log.Debugf("[dnsUpdater] Connecting to Route53 ...")
	route53Connection, err := route53.NewRoute53(awsAuth)
	if err != nil {
		log.Criticalf("[dnsUpdater] Unable to connect to Route53! (%s)", err)
		return "", err
	}

	// Submit the request:
	ListHostedZonesResponse, err := route53Connection.ListHostedZones("", 100)
	if err != nil {
		log.Criticalf("[dnsUpdater] Failed to make ListHostedZones call: %v", err)
		return "", err
	} else {
		log.Debugf("[dnsUpdater] Retreived %d DNS zones.", len(ListHostedZonesResponse.HostedZones))
	}

	// Go through the responses looking for our zone:
	for _, hostedZone := range ListHostedZonesResponse.HostedZones {
		// Compare the name to the one provided:
		if hostedZone.Name == domainName {
			log.Infof("[dnsUpdater] Found ID (%v) for domain (%v).", hostedZone.Id, domainName)

			// Split the zone-ID (because they tend to look like "/hostedzone/ZXJHAS123"):
			return strings.Split(hostedZone.Id, "/")[2], nil
			break
		}
	}

	log.Criticalf("[dnsUpdater] Couldn't find zone-ID for domain (%v)!", domainName)
	os.Exit(1)
	return "", errors.New(fmt.Sprintf("Couldn't find DNS-domain '%v' on your AWS account", domainName))

}

func testDynamodb() (bool, error) {

	auth, err := aws.GetAuth("test", "test", "test", time.Now())

	if err != nil {
		log.Panic(err)
	}

	ddb := dynamodb.Server{auth, local}

	tables, err := ddb.ListTables()

	if err != nil {
		return false, errors.New("DYNAMODB KO")
	}

	log.Printf("%v\n", tables)
	return true, nil
}

// GetLegacy ...
func (la *LegacyArguments) GetLegacy() (*Legacy, error) {
	// Create a "TEST" snapshot in order to work out which tables are active
	// Get a list of Keyspaces and Table Names (plus directories)
	// Walk through all the directories.
	auth, _ := aws.GetAuth(
		la.AwsAccessKey,
		la.AwsSecret,
		"",
		time.Now().AddDate(0, 0, 1))

	// Check the bucket exists.
	bucket := s3.New(auth, GetAwsRegion(la.AwsRegion)).Bucket(la.S3Bucket)
	_, err := bucket.List("/", "/", "", 1)
	if err != nil {
		return nil, err
	}

	streamAccess := s3gof3r.New("", s3gof3r.Keys{
		AccessKey:     la.AwsAccessKey,
		SecretKey:     la.AwsSecret,
		SecurityToken: "",
	})

	streamBucket := streamAccess.Bucket(la.S3Bucket)

	legacy := &Legacy{
		DataDirectories: make([]string, 0),
		S3Bucket:        bucket,
		S3StreamBucket:  streamBucket,
		LogDirectory:    la.LogDirectory,
		NewSnapshot:     la.NewSnapshot,
	}

	legacy.MachineName, _ = os.Hostname()
	legacy.DataDirectories = SplitAndTrim(la.DataDirectories, ",")
	legacy.ExcludeKeyspaces = SplitAndTrim(la.ExcludeKeyspaces, ",")

	return legacy, nil
}

func getService(service, region string) (*aws.Service, error) {

	reg, err := GetAWSRegion(region)
	if err != nil {
		return nil, err
	}

	var endpoint string
	switch service {
	case "cf":
		endpoint = reg.CloudFormationEndpoint
	case "ec2":
		endpoint = reg.EC2Endpoint
	case "iam":
		endpoint = reg.IAMEndpoint
	case "rds":
		endpoint = reg.RDSEndpoint.Endpoint
	default:
		return nil, fmt.Errorf("Service %s not implemented", service)
	}

	// only get the creds from the env for now
	auth, err := aws.GetAuth("", "", "", time.Now())
	if err != nil {
		return nil, err
	}

	serviceInfo := aws.ServiceInfo{
		Endpoint: endpoint,
		Signer:   aws.V2Signature,
	}

	svc, err := aws.NewService(auth, serviceInfo)
	if err != nil {
		return nil, err
	}
	return svc, nil
}

func NewAnnouncer() (sk *Announcer, err error) {
	sk = &Announcer{}
	b, err := aws.GetMetaData("placement/availability-zone")
	if err != nil {
		return nil, err
	}
	sk.RegionId = string(b[:len(b)-1])
	b, err = aws.GetMetaData("instance-id")
	if err != nil {
		return nil, err
	}
	sk.InstanceId = string(b)

	if sk.RegionId == "" {
		sk.RegionId = aws.USEast.Name
	}
	auth, err := aws.GetAuth("", "", "", time.Time{})
	if err != nil {
		return nil, err
	}
	sk.elb = elb.New(auth, aws.Regions[sk.RegionId])
	return
}

func (pc *NodeController) postNodeAddEc2Action(c *gin.Context) {

	var form models.EC2NodeCreateForm
	if err := c.Bind(&form); err != nil {
		c.AbortWithStatus(http.StatusBadRequest)
		return
	}

	if err := form.Validate(); err != nil {
		c.Redirect(http.StatusFound, c.Request.Referer())
		return
	}

	a, err := models.AccessMapper.FetchOne("ec2")
	if err != nil {
		panic(err)
	}

	if a == nil {
		c.Redirect(http.StatusFound, c.Request.Referer())
		return
	}

	basicAuth := env.Get("BASIC_AUTH")
	if auth := env.Get("BASIC_AUTH"); auth != "" {
		basicAuth = "-u " + auth + " "
	}

	auth, err := aws.GetAuth(a.AccessKey, a.PrivateKey, "", time.Now().Add(time.Hour))
	if err != nil {
		panic(err)
	}
	awsec2 := ec2.New(auth, aws.Regions[form.AvailabilityZone])
	// Create public key
	// Waiting for merge pull request https://github.com/goamz/goamz/pull/111
	// {
	// key, err := ssh.GetPublicKey()
	// 	if err != nil {
	// 		panic(err)
	// 	}
	// 	if _, err := awsec2.ImportKeyPair(&ImportKeyPairOptions{
	// 		KeyName:           "karhu",
	// 		PublicKeyMaterial: string(key),
	// 	}); err != nil {
	// 		panic(err)
	// 	}
	// }

	if _, err := awsec2.RunInstances(&ec2.RunInstancesOptions{
		ImageId:        "ami-e31a6594",
		MinCount:       1,
		MaxCount:       0,
		KeyName:        "karhu",
		InstanceType:   form.InstanceType,
		SecurityGroups: []ec2.SecurityGroup{{Id: form.SecurityGroup}},
		// KernelId               :  string
		// RamdiskId              :  string
		UserData: []byte(fmt.Sprintf(`#!/bin/bash
sudo apt-get update && \
sudo apt-get install -y curl && \
curl %s"%s/api/nodes/register.sh?monit=1&ssh_port=22" | sudo -i -u admin bash`, basicAuth, env.Get("PUBLIC_HOST"))),
		AvailabilityZone: "eu-west-1c", // Waiting for https://github.com/goamz/goamz/pull/112
		// PlacementGroupName     :  string
		Tenancy:    "default",
		Monitoring: form.Monitoring == "on",
		SubnetId:   "subnet-425a4f27", // Waiting for https://github.com/goamz/goamz/pull/112
		// DisableAPITermination  :  bool
		// ShutdownBehavior       :  string
		// PrivateIPAddress       :  string
		// IamInstanceProfile      : IamInstanceProfile
		// BlockDevices            : []BlockDeviceMapping
		// EbsOptimized            : bool
		// AssociatePublicIpAddress :bool
	}); err != nil {
		panic(err)
	}

	c.Redirect(http.StatusFound, "/nodes")
}