Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update task IAM role model to support Single Region Accounts #4039

Merged
merged 2 commits into from
Nov 27, 2023
Merged

Update task IAM role model to support Single Region Accounts #4039

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9e6debf
Update task IAM role model
Yiyuanzzz Nov 16, 2023
3950a21
Merge branch 'feature/single-region-accounts' into SRA
Yiyuanzzz Nov 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion agent/vendor/github.com/aws/amazon-ecs-agent/ecs-agent/credentials/manager.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 6 additions & 6 deletions .../vendor/github.com/aws/amazon-ecs-agent/ecs-agent/tmds/handlers/v1/credentials_handler.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 5 additions & 2 deletions ecs-agent/acs/session/session_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,8 @@ const (
"expiration": "2016-03-25T06:17:19.318+0000",
"roleArn": "r1",
"secretAccessKey": "secretAccessKey",
"sessionToken": "token"
"sessionToken": "token",
"credentialScope": "scope"
},
"version": "3",
"volumes": [],
Expand Down Expand Up @@ -125,7 +126,8 @@ const (
"expiration": "later",
"roleArn": "r1",
"secretAccessKey": "newskid",
"sessionToken": "newstkn"
"sessionToken": "newstkn",
"credentialScope": "cdsp"
}
}
}
Expand Down Expand Up @@ -976,6 +978,7 @@ func TestStartSessionHandlesRefreshCredentialsMessages(t *testing.T) {
SessionToken: "newstkn",
Expiration: "later",
CredentialsID: credentialsIdInRefreshMessage,
CredentialScope: "cdsp",
RoleType: rolecredentials.ApplicationRoleType,
},
}
Expand Down
4 changes: 3 additions & 1 deletion ecs-agent/credentials/manager.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,8 @@ type IAMRoleCredentials struct {
// Expiration is a string instead of a timestamp. This is to avoid any loss of context
// while marshalling/unmarshalling this field in the agent. The agent just echo's
// whatever is sent by the backend.
Expiration string `json:"Expiration"`
Expiration string `json:"Expiration"`
CredentialScope string `json:"CredentialScope"`
// RoleType distinguishes between TaskRole and ExecutionRole for the
// credentials that are sent from the backend
RoleType string `json:"-"`
Expand Down Expand Up @@ -100,6 +101,7 @@ func IAMRoleCredentialsFromACS(roleCredentials *ecsacs.IAMRoleCredentials, roleT
AccessKeyID: aws.StringValue(roleCredentials.AccessKeyId),
SecretAccessKey: aws.StringValue(roleCredentials.SecretAccessKey),
Expiration: aws.StringValue(roleCredentials.Expiration),
CredentialScope: aws.StringValue(roleCredentials.CredentialScope),
RoleType: roleType,
}
}
Expand Down
6 changes: 6 additions & 0 deletions ecs-agent/credentials/manager_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ func TestIAMRoleCredentialsFromACS(t *testing.T) {
RoleArn: aws.String("roleArn"),
SecretAccessKey: aws.String("OhhSecret"),
SessionToken: aws.String("sessionToken"),
CredentialScope: aws.String("credentialScope"),
}

roleType := "roleType"
Expand All @@ -47,6 +48,7 @@ func TestIAMRoleCredentialsFromACS(t *testing.T) {
RoleArn: "roleArn",
SecretAccessKey: "OhhSecret",
SessionToken: "sessionToken",
CredentialScope: "credentialScope",
RoleType: "roleType",
}
assert.Equal(t, credentials, expectedCredentials, "Mismatch between expected and constructed credentials")
Expand Down Expand Up @@ -99,6 +101,7 @@ func TestSetAndGetTaskCredentialsHappyPath(t *testing.T) {
SessionToken: "stkn",
Expiration: "ts",
CredentialsID: "cid1",
CredentialScope: "cdsp",
},
}

Expand All @@ -118,6 +121,7 @@ func TestSetAndGetTaskCredentialsHappyPath(t *testing.T) {
SessionToken: "stkn2",
Expiration: "ts2",
CredentialsID: "cid1",
CredentialScope: "cdsp",
},
}
err = manager.SetTaskCredentials(&updatedCredentials)
Expand All @@ -138,6 +142,7 @@ func TestGenerateCredentialsEndpointRelativeURI(t *testing.T) {
SessionToken: "stkn",
Expiration: "ts",
CredentialsID: "cid1",
CredentialScope: "cdsp",
}
generatedURI := credentials.GenerateCredentialsEndpointRelativeURI()
expectedURI := fmt.Sprintf(credentialsEndpointRelativeURIFormat, CredentialsPath, "cid1")
Expand All @@ -157,6 +162,7 @@ func TestRemoveExistingCredentials(t *testing.T) {
SessionToken: "stkn",
Expiration: "ts",
CredentialsID: "cid1",
CredentialScope: "cdsp",
},
}
err := manager.SetTaskCredentials(&credentials)
Expand Down
2 changes: 2 additions & 0 deletions ecs-agent/tmds/handlers/credentials_handler_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -268,6 +268,7 @@ func testCredentialsHandlerSuccess(t *testing.T, makePath MakePath, makeHandler
SecretAccessKey: "secret_access_key",
SessionToken: "session_token",
Expiration: "expiration",
CredentialScope: "credential_scope",
RoleType: credentials.ApplicationRoleType,
}

Expand All @@ -278,6 +279,7 @@ func testCredentialsHandlerSuccess(t *testing.T, makePath MakePath, makeHandler
SecretAccessKey: "secret_access_key",
SessionToken: "session_token",
Expiration: "expiration",
CredentialScope: "credential_scope",
}

auditLogger.EXPECT().Log(
Expand Down
12 changes: 6 additions & 6 deletions ecs-agent/tmds/handlers/v1/credentials_handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,14 +125,14 @@ func processCredentialsRequest(
return nil, "", "", msg, errors.New(errText)
}

seelog.Infof("Processing credential request, credentialType=%s taskARN=%s",
credentials.IAMRoleCredentials.RoleType, credentials.ARN)
seelog.Infof("Processing credential request, credentialType=%s taskARN=%s credentialScope=%s",
credentials.IAMRoleCredentials.RoleType, credentials.ARN, credentials.IAMRoleCredentials.CredentialScope)

if utils.ZeroOrNil(credentials.ARN) && utils.ZeroOrNil(credentials.IAMRoleCredentials) {
// This can happen when the agent is restarted and is reconciling its state.
errText := errPrefix + "Credentials uninitialized for ID"
seelog.Errorf("Error processing credential request credentialType=%s taskARN=%s: %s",
credentials.IAMRoleCredentials.RoleType, credentials.ARN, errText)
seelog.Errorf("Error processing credential request credentialType=%s taskARN=%s credentialScope=%s: %s",
credentials.IAMRoleCredentials.RoleType, credentials.ARN, credentials.IAMRoleCredentials.CredentialScope, errText)
msg := &handlersutils.ErrorMessage{
Code: ErrCredentialsUninitialized,
Message: errText,
Expand All @@ -144,8 +144,8 @@ func processCredentialsRequest(
credentialsJSON, err := json.Marshal(credentials.IAMRoleCredentials)
if err != nil {
errText := errPrefix + "Error marshaling credentials"
seelog.Errorf("Error processing credential request credentialType=%s taskARN=%s: %s",
credentials.IAMRoleCredentials.RoleType, credentials.ARN, errText)
seelog.Errorf("Error processing credential request credentialType=%s taskARN=%s credentialScope=%s: %s",
danehlim marked this conversation as resolved.
Show resolved Hide resolved
credentials.IAMRoleCredentials.RoleType, credentials.ARN, credentials.IAMRoleCredentials.CredentialScope, errText)
msg := &handlersutils.ErrorMessage{
Code: ErrInternalServer,
Message: "Internal server error",
Expand Down