aws

Documentation

Index

• Constants
• func GetAndReplaceReqBody(req *http.Request) ([]byte, error)
• func IsSignedByAWSSigV4(r *http.Request) bool
• func NewSigner(credentials *credentials.Credentials, signingServiceName string) *v4.Signer
• func VerifyAWSSignature(req *http.Request, credentials *credentials.Credentials) error
• type Role
• type Roles
  • func FilterAWSRoles(arns []string, accountID string) (result Roles)
  • func (roles Roles) FindRoleByARN(arn string) (Role, bool)
  • func (roles Roles) FindRolesByName(name string) (result Roles)
  • func (roles Roles) Sort()
• type SigV4
  • func ParseSigV4(header string) (*SigV4, error)

Constants

const (
	// AmazonSigV4AuthorizationPrefix is AWS Authorization prefix indicating that the request
	// was signed by AWS Signature Version 4.
	// https://github.com/aws/aws-sdk-go/blob/main/aws/signer/v4/v4.go#L83
	// https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html
	AmazonSigV4AuthorizationPrefix = "AWS4-HMAC-SHA256"

	// AmzDateTimeFormat is time format used in X-Amz-Date header.
	// https://github.com/aws/aws-sdk-go/blob/main/aws/signer/v4/v4.go#L84
	AmzDateTimeFormat = "20060102T150405Z"

	// AmzDateHeader is header name containing timestamp when signature was generated.
	// https://docs.aws.amazon.com/general/latest/gr/sigv4-date-handling.html
	AmzDateHeader = "X-Amz-Date"

	AuthorizationHeader = "Authorization"
)

Functions

func GetAndReplaceReqBody

func GetAndReplaceReqBody(req *http.Request) ([]byte, error)

GetAndReplaceReqBody returns the request and replace the drained body reader with io.NopCloser allowing for further body processing by http transport.

func IsSignedByAWSSigV4

func IsSignedByAWSSigV4(r *http.Request) bool

IsSignedByAWSSigV4 checks is the request was signed by AWS Signature Version 4 algorithm. https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html

func NewSigner

func NewSigner(credentials *credentials.Credentials, signingServiceName string) *v4.Signer

NewSigner creates a new V4 signer.

func VerifyAWSSignature

func VerifyAWSSignature(req *http.Request, credentials *credentials.Credentials) error

VerifyAWSSignature verifies the request signature ensuring that the request originates from tsh aws command execution AWS CLI signs the request with random generated credentials that are passed to LocalProxy by the AWSCredentials LocalProxyConfig configuration.

Types

type Role

type Role struct {
	// Name is the full role name with the entire path.
	Name string `json:"name"`
	// Display is the role display name.
	Display string `json:"display"`
	// ARN is the full role ARN.
	ARN string `json:"arn"`
}

Role describes an AWS IAM role for AWS console access.

type Roles

type Roles []Role

Roles is a slice of roles.

func FilterAWSRoles

func FilterAWSRoles(arns []string, accountID string) (result Roles)

FilterAWSRoles returns role ARNs from the provided list that belong to the specified AWS account ID.

If AWS account ID is empty, all roles are returned.

func (Roles) FindRoleByARN

func (roles Roles) FindRoleByARN(arn string) (Role, bool)

FindRoleByARN finds the role with the provided ARN.

func (Roles) FindRolesByName

func (roles Roles) FindRolesByName(name string) (result Roles)

FindRolesByName finds all roles matching the provided name.

func (Roles) Sort

func (roles Roles) Sort()

Sort sorts the roles by their display names.

type SigV4

type SigV4 struct {
	// KeyIS is an AWS access-key-id
	KeyID string
	// Date value is specified using YYYYMMDD format.
	Date string
	// Region is an AWS Region.
	Region string
	// Service is an AWS Service.
	Service string
	// SignedHeaders is a  list of request headers that you used to compute Signature.
	SignedHeaders []string
	// Signature is the 256-bit Signature of the request.
	Signature string
}

SigV4 contains parsed content of the AWS Authorization header.

func ParseSigV4

func ParseSigV4(header string) (*SigV4, error)

ParseSigV4 AWS SigV4 credentials string sections. AWS SigV4 header example: Authorization: AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20130524/us-east-1/s3/aws4_request, SignedHeaders=host;range;x-amz-date, Signature=fe5f80f77d5fa3beca038a248ff027d0445342fe2855ddc963176630326f1024