Package org.springframework.vault.authentication

Class AwsIamAuthentication

java.lang.Object

org.springframework.vault.authentication.AwsIamAuthentication

All Implemented Interfaces:

AuthenticationStepsFactory, ClientAuthentication

public class AwsIamAuthentication
extends Object
implements ClientAuthentication, AuthenticationStepsFactory

AWS IAM authentication using signed HTTP requests to query the current identity.

AWS IAM authentication creates a signed HTTP request that is executed by Vault to get the identity of the signer using AWS STS GetCallerIdentity. A signature requires AwsCredentials to calculate the signature.

This authentication requires AWS' Java SDK to sign request parameters and calculate the signature key. Using an appropriate AwsCredentialsProvider allows authentication within AWS-EC2 instances with an assigned profile, within ECS and Lambda instances.

Since:

1.1

Author:

Mark Paluch

See Also:

• AwsIamAuthenticationOptions
• AwsCredentialsProvider
• RestOperations
• Auth Backend: aws (IAM)
• AWS: GetCallerIdentity

Constructor Summary

Constructors

Constructor	Description
AwsIamAuthentication(AwsIamAuthenticationOptions options, RestOperations vaultRestOperations)	Create a new AwsIamAuthentication specifying AwsIamAuthenticationOptions, a Vault and an AWS-Metadata-specific RestOperations.

Method Summary

Modifier and Type	Method	Description
static AuthenticationSteps	createAuthenticationSteps(AwsIamAuthenticationOptions options)	Creates a AuthenticationSteps for AWS-IAM authentication given AwsIamAuthenticationOptions.
protected static AuthenticationSteps	createAuthenticationSteps(AwsIamAuthenticationOptions options, software.amazon.awssdk.auth.credentials.AwsCredentials credentials, software.amazon.awssdk.regions.Region region)
protected static Map<String,String>	createRequestBody(AwsIamAuthenticationOptions options)	Create the request body to perform a Vault login using the AWS-IAM authentication method.
AuthenticationSteps	getAuthenticationSteps()	Get the AuthenticationSteps describing an authentication flow.
VaultToken	login()	Return a VaultToken.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AwsIamAuthentication

public AwsIamAuthentication(AwsIamAuthenticationOptions options,
 RestOperations vaultRestOperations)

Create a new AwsIamAuthentication specifying AwsIamAuthenticationOptions, a Vault and an AWS-Metadata-specific RestOperations.

Parameters:

options - must not be null.

vaultRestOperations - must not be null.

Method Details

createAuthenticationSteps

public static AuthenticationSteps createAuthenticationSteps(AwsIamAuthenticationOptions options)

Creates a AuthenticationSteps for AWS-IAM authentication given AwsIamAuthenticationOptions. The resulting AuthenticationSteps reuse eagerly-fetched AwsCredentials to prevent blocking I/O during authentication.

Parameters:

options - must not be null.

Returns:

AuthenticationSteps for AWS-IAM authentication.

Since:

2.2

createAuthenticationSteps

protected static AuthenticationSteps createAuthenticationSteps(AwsIamAuthenticationOptions options,
 software.amazon.awssdk.auth.credentials.AwsCredentials credentials,
 software.amazon.awssdk.regions.Region region)

login

public VaultToken login()
                 throws VaultException

Description copied from interface: ClientAuthentication

Return a VaultToken. This method can optionally log into Vault to obtain a token.

Specified by:

login in interface ClientAuthentication

Returns:

a VaultToken.

Throws:

VaultException

getAuthenticationSteps

public AuthenticationSteps getAuthenticationSteps()

Description copied from interface: AuthenticationStepsFactory

Get the AuthenticationSteps describing an authentication flow.

Specified by:

getAuthenticationSteps in interface AuthenticationStepsFactory

Returns:

the AuthenticationSteps describing an authentication flow.

createRequestBody

protected static Map<String,String> createRequestBody(AwsIamAuthenticationOptions options)

Create the request body to perform a Vault login using the AWS-IAM authentication method.

Parameters:

options - must not be null.

Returns:

the map containing body key-value pairs.