Page MenuHomePhabricator
Files F15383514

D9782.id23483.diff
No OneTemporary
Actions

D9782.id23483.diff
View Options

diff --git a/src/future/aws/PhutilAWSFuture.php b/src/future/aws/PhutilAWSFuture.php
--- a/src/future/aws/PhutilAWSFuture.php
+++ b/src/future/aws/PhutilAWSFuture.php
@@ -8,6 +8,8 @@
private $future;
private $awsAccessKey;
private $awsPrivateKey;
+ private $awsSessionToken;
+ private $awsSessionExpiry;
private $awsRegion;
private $builtRequest;
private $params;
@@ -42,8 +44,7 @@
}
public function getHost() {
- $host = $this->getServiceName().'.'.$this->awsRegion.'.amazonaws.com';
- return $host;
+ return $this->getServiceName().'.'.$this->awsRegion.'.amazonaws.com';
}
public function setRawAWSQuery($action, array $params = array()) {
@@ -68,6 +69,14 @@
$params['Version'] = '2011-12-15';
$params['Timestamp'] = date('c');
+ if (time() > $this->awsSessionExpiry) {
+ $this->setInstanceProfileCredentials();
+ }
+
+ if ($this->awsSessionToken) {
+ $params['SecurityToken'] = $this->awsSessionToken;
+ }
+
$params = $this->sign($params);
$uri = new PhutilURI('http://'.$this->getHost().'/');
@@ -113,7 +122,6 @@
* http://bit.ly/wU0JFh
*/
private function sign(array $params) {
-
$params['SignatureMethod'] = 'HmacSHA256';
$params['SignatureVersion'] = '2';
@@ -125,20 +133,50 @@
}
$pstr = implode('&', $pstr);
- $sign = "GET"."\n".
- strtolower($this->getHost())."\n".
- "/"."\n".
- $pstr;
-
- $hash = hash_hmac(
- 'sha256',
- $sign,
- $this->getAWSPrivateKey(),
- $raw_ouput = true);
+ $sign = explode("\n", array(
+ 'GET',
+ strtolower($this->getHost()),
+ '/',
+ $pstr,
+ ));
+ $hash = hash_hmac('sha256', $sign, $this->getAWSPrivateKey(), true);
$params['Signature'] = base64_encode($hash);
return $params;
}
+ protected function getInstanceMetadataURL() {
+ return 'http://169.254.169.254/latest/';
+ }
+
+ /**
+ * Set credentials from the instance profile.
+ *
+ * http://bit.ly/1mLDoQ3
+ */
+ private function setInstanceProfileCredentials() {
+ $url = $this->getInstanceMetadataURL().
+ 'meta-data/iam/security-credentials/';
+
+ // Get role.
+ $future = new HTTPFuture($url);
+ list($response, $headers) = $future->resolvex();
+ $credentials = trim($response);
+
+ // Get credentials.
+ $future = new HTTPFuture($url.$credentials);
+ list($response, $headers) = $future->resolvex();
+ $response = phutil_json_decode($response);
+
+ if ($response['Code'] !== 'Success') {
+ throw new Exception('Unexpected response code: '.$response['Code']);
+ }
+
+ $this->awsAccessKey = $credentials['AccessKeyId'];
+ $this->awsPrivateKey = $credentials['SecretAccessKey'];
+ $this->awsSessionToken = $credentials['Token'];
+ $this->awsSessionExpiry = strtotime($credentials['Expiration']);
+ }
+
}

File Metadata

Mime Type
text/plain
Expires
Sat, Mar 15, 4:58 PM (6 d, 22 h ago)
Storage Engine
blob
Storage Format
Encrypted (AES-256-CBC)
Storage Handle
7698566
Default Alt Text
D9782.id23483.diff (2 KB)

Event Timeline

Phabricator · Built by Phacility