org.springframework.vault.authentication

Class AwsIamAuthentication

java.lang.Object

org.springframework.vault.authentication.AwsIamAuthentication

All Implemented Interfaces:

AuthenticationStepsFactory, ClientAuthentication

public class AwsIamAuthentication
extends Object
implements ClientAuthentication, AuthenticationStepsFactory

AWS IAM authentication using signed HTTP requests to query the current identity.

AWS IAM authentication creates a signed HTTP request that is executed by Vault to get the identity of the signer using AWS STS GetCallerIdentity. A signature requires AWSCredentials to calculate the signature.

This authentication requires AWS' Java SDK to sign request parameters and calculate the signature key. Using an appropriate AWSCredentialsProvider allows authentication within AWS-EC2 instances with an assigned profile, within ECS and Lambda instances.

Since:

1.1

Author:

Mark Paluch

See Also:

AwsIamAuthenticationOptions, AWSCredentialsProvider, RestOperations, Auth Backend: aws (IAM), AWS: GetCallerIdentity

Constructor Summary

Constructors

Constructor and Description
AwsIamAuthentication(AwsIamAuthenticationOptions options, RestOperations vaultRestOperations) Create a new AwsIamAuthentication specifying AwsIamAuthenticationOptions, a Vault and an AWS-Metadata-specific RestOperations.

Method Summary

Modifier and Type	Method and Description
static AuthenticationSteps	createAuthenticationSteps(AwsIamAuthenticationOptions options) Creates a AuthenticationSteps for AWS-IAM authentication given AwsIamAuthenticationOptions.
protected static AuthenticationSteps	createAuthenticationSteps(AwsIamAuthenticationOptions options, com.amazonaws.auth.AWSCredentials credentials)
protected static Map<String,String>	createRequestBody(AwsIamAuthenticationOptions options) Create the request body to perform a Vault login using the AWS-IAM authentication method.
AuthenticationSteps	getAuthenticationSteps() Get the AuthenticationSteps describing an authentication flow.
VaultToken	login() Return a VaultToken.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AwsIamAuthentication

public AwsIamAuthentication(AwsIamAuthenticationOptions options,
                            RestOperations vaultRestOperations)

Create a new AwsIamAuthentication specifying AwsIamAuthenticationOptions, a Vault and an AWS-Metadata-specific RestOperations.

Parameters:

options - must not be null.

vaultRestOperations - must not be null.

Method Detail

createAuthenticationSteps

public static AuthenticationSteps createAuthenticationSteps(AwsIamAuthenticationOptions options)

Creates a AuthenticationSteps for AWS-IAM authentication given AwsIamAuthenticationOptions. The resulting AuthenticationSteps reuse eagerly-fetched AWSCredentials to prevent blocking I/O during authentication.

Parameters:

options - must not be null.

Returns:

AuthenticationSteps for AWS-IAM authentication.

Since:

2.2

createAuthenticationSteps

protected static AuthenticationSteps createAuthenticationSteps(AwsIamAuthenticationOptions options,
                                                               com.amazonaws.auth.AWSCredentials credentials)

login

public VaultToken login()
                 throws VaultException

Description copied from interface: ClientAuthentication

Return a VaultToken. This method can optionally log into Vault to obtain a token.

Specified by:

login in interface ClientAuthentication

Returns:

a VaultToken.

Throws:

VaultException

getAuthenticationSteps

public AuthenticationSteps getAuthenticationSteps()

Description copied from interface: AuthenticationStepsFactory

Get the AuthenticationSteps describing an authentication flow.

Specified by:

getAuthenticationSteps in interface AuthenticationStepsFactory

Returns:

the AuthenticationSteps describing an authentication flow.

createRequestBody

protected static Map<String,String> createRequestBody(AwsIamAuthenticationOptions options)

Create the request body to perform a Vault login using the AWS-IAM authentication method.

Parameters:

options - must not be null.

Returns:

the map containing body key-value pairs.