vax

README

vax

Vax is a Golang AWS credentials provider using the Hashicorp Vault AWS secret engine.

Vax pulls STS credentials from the configured path, and passes them back to an AWS SDK credentials object by implementing the credentials.Provider interface.

Usage

This example assumes you wish to pull credentials from a role named myrole in an AWS secrets engine mounted at aws, and that you have set the env vars VAULT_ADDR and VAULT_TOKEN with the appropriate values:

package main

import (
	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/credentials"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/sts"
	"github.com/daveadams/vax"
	"log"
)

const (
    SecretsEngineMount = "aws"
    EngineRoleName     = "myrole"
)

func main() {
    stsSvc := sts.New(session.Must(session.NewSession()), &aws.Config{
        Credentials: vax.NewVaultProviderCredentials(SecretsEngineMount, EngineRoleName),
    })

    resp, err := stsSvc.GetCallerIdentity(&sts.GetCallerIdentityInput{})
    if err != nil {
        log.Fatalf("ERROR: %s", err)
    }

    log.Printf("Hello, %s from account %s\n", *resp.Arn, *resp.Account)
}

The provider will seamlessly request new credentials from the provider whenever they expire. So long as the Vault session tied to the Vault token itself does not expire, the credentials should continue to be valid.

License

This software is public domain. No rights are reserved. See LICENSE for more information.

Documentation

Overview

Vax is a Golang AWS credentials provider using the Hashicorp Vault AWS secret engine.

Index

• func NewVaultProviderCredentials(enginePath string, roleName string) *credentials.Credentials
• type VaultProvider
  • func NewVaultProvider(enginePath string, roleName string) *VaultProvider
  • func (vp *VaultProvider) Retrieve() (credentials.Value, error)

Functions

func NewVaultProviderCredentials

func NewVaultProviderCredentials(enginePath string, roleName string) *credentials.Credentials

An extra shortcut to avoid needing to import credentials into your source file or call nested functions. Call this to return a new Credentials object using the VaultProvider.

Types

type VaultProvider

type VaultProvider struct {
	// The full Vault API path to the STS credentials endpoint.
	StsCredsPath string

	// The TTL of the STS credentials in the form of a Go duration string.
	TTL string

	// The `vault.Client` object used to interact with Vault.
	VaultClient *vault.Client

	// compose with credentials.Expiry to get free IsExpired()
	credentials.Expiry
	// contains filtered or unexported fields
}

The VaultProvider object implements the AWS SDK `credentials.Provider` interface. Use the `NewVaultProvider` function to construct the object with default settings, or if you need to configure the `vault.Client` object, TTL, or path yourself, you can build the object by hand.

func NewVaultProvider

func NewVaultProvider(enginePath string, roleName string) *VaultProvider

Creates a new VaultProvider. Supply the path where the AWS secrets engine is mounted as well as the role name to fetch from. The VaultProvider is initialized with a default client, which uses the VAULT_ADDR and VAULT_TOKEN environment variables to configure itself. This also sets a default TTL of 30 minutes for the credentials' lifetime.

func (*VaultProvider) Retrieve

func (vp *VaultProvider) Retrieve() (credentials.Value, error)

Implements the Retrieve() function for the AWS SDK credentials.Provider interface.