@@ -127,10 +127,12 @@ func (f tokenFetcher) FetchToken(ctx credentials.Context) ([]byte, error) {
127
127
// TODO: See if this lint error should be ignored
128
128
return []byte (f ), nil //nolint: nilerr
129
129
}
130
+
130
131
token , err := os .ReadFile (string (f ))
131
132
if err != nil {
132
133
return nil , errors .WithStackTrace (err )
133
134
}
135
+
134
136
return token , nil
135
137
}
136
138
@@ -140,13 +142,16 @@ func getWebIdentityCredentialsFromIAMRoleOptions(sess *session.Session, iamRoleO
140
142
// Set a unique session name in the same way it is done in the SDK
141
143
roleSessionName = strconv .FormatInt (time .Now ().UTC ().UnixNano (), 10 )
142
144
}
145
+
143
146
svc := sts .New (sess )
144
147
p := stscreds .NewWebIdentityRoleProviderWithOptions (svc , iamRoleOptions .RoleARN , roleSessionName , tokenFetcher (iamRoleOptions .WebIdentityToken ))
148
+
145
149
if iamRoleOptions .AssumeRoleDuration > 0 {
146
150
p .Duration = time .Second * time .Duration (iamRoleOptions .AssumeRoleDuration )
147
151
} else {
148
152
p .Duration = time .Second * time .Duration (options .DefaultIAMAssumeRoleDuration )
149
153
}
154
+
150
155
return credentials .NewCredentials (p )
151
156
}
152
157
@@ -157,10 +162,12 @@ func getSTSCredentialsFromIAMRoleOptions(sess *session.Session, iamRoleOptions o
157
162
} else {
158
163
p .Duration = time .Second * time .Duration (options .DefaultIAMAssumeRoleDuration )
159
164
}
165
+
160
166
if iamRoleOptions .AssumeRoleSessionName != "" {
161
167
p .RoleSessionName = iamRoleOptions .AssumeRoleSessionName
162
168
}
163
169
})
170
+
164
171
return stscreds .NewCredentials (sess , iamRoleOptions .RoleARN , optFns ... )
165
172
}
166
173
@@ -174,6 +181,7 @@ func getCredentialsFromEnvs(opts *options.TerragruntOptions) *credentials.Creden
174
181
if accessKeyID == "" || secretAccessKey == "" {
175
182
return nil
176
183
}
184
+
177
185
return credentials .NewStaticCredentials (accessKeyID , secretAccessKey , sessionToken )
178
186
}
179
187
@@ -185,15 +193,21 @@ func getCredentialsFromEnvs(opts *options.TerragruntOptions) *credentials.Creden
185
193
// Note that if the AwsSessionConfig object is null, this will return default session credentials using the default
186
194
// credentials chain of the AWS SDK.
187
195
func CreateAwsSession (config * AwsSessionConfig , terragruntOptions * options.TerragruntOptions ) (* session.Session , error ) {
188
- var sess * session.Session
189
- var err error
196
+ var (
197
+ sess * session.Session
198
+ err error
199
+ )
200
+
190
201
if config == nil {
191
202
sessionOptions := session.Options {SharedConfigState : session .SharedConfigEnable }
203
+
192
204
sess , err = session .NewSessionWithOptions (sessionOptions )
193
205
if err != nil {
194
206
return nil , errors .WithStackTrace (err )
195
207
}
208
+
196
209
sess .Handlers .Build .PushFrontNamed (addUserAgent )
210
+
197
211
if terragruntOptions .IAMRoleOptions .RoleARN != "" {
198
212
if terragruntOptions .IAMRoleOptions .WebIdentityToken != "" {
199
213
terragruntOptions .Logger .Debugf ("Assuming role %s using WebIdentity token" , terragruntOptions .IAMRoleOptions .RoleARN )
@@ -227,6 +241,7 @@ func CreateAwsSession(config *AwsSessionConfig, terragruntOptions *options.Terra
227
241
// Make API calls to AWS to assume the IAM role specified and return the temporary AWS credentials to use that role
228
242
func AssumeIamRole (iamRoleOpts options.IAMRoleOptions ) (* sts.Credentials , error ) {
229
243
sessionOptions := session.Options {SharedConfigState : session .SharedConfigEnable }
244
+
230
245
sess , err := session .NewSessionWithOptions (sessionOptions )
231
246
if err != nil {
232
247
return nil , errors .WithStackTrace (err )
@@ -281,8 +296,10 @@ func AssumeIamRole(iamRoleOpts options.IAMRoleOptions) (*sts.Credentials, error)
281
296
if err != nil {
282
297
return nil , errors .WithStackTrace (err )
283
298
}
299
+
284
300
token = string (tb )
285
301
}
302
+
286
303
input := sts.AssumeRoleWithWebIdentityInput {
287
304
RoleArn : aws .String (iamRoleOpts .RoleARN ),
288
305
RoleSessionName : aws .String (sessionName ),
@@ -297,6 +314,7 @@ func AssumeIamRole(iamRoleOpts options.IAMRoleOptions) (*sts.Credentials, error)
297
314
if err := req .Send (); err != nil {
298
315
return nil , errors .WithStackTrace (err )
299
316
}
317
+
300
318
return resp .Credentials , nil
301
319
}
302
320
@@ -333,6 +351,7 @@ func GetAWSPartition(config *AwsSessionConfig, terragruntOptions *options.Terrag
333
351
if err != nil {
334
352
return "" , errors .WithStackTrace (err )
335
353
}
354
+
336
355
return arn .Partition , nil
337
356
}
338
357
0 commit comments