1 // 2 // Copyright 2020 gRPC authors. 3 // 4 // Licensed under the Apache License, Version 2.0 (the "License"); 5 // you may not use this file except in compliance with the License. 6 // You may obtain a copy of the License at 7 // 8 // http://www.apache.org/licenses/LICENSE-2.0 9 // 10 // Unless required by applicable law or agreed to in writing, software 11 // distributed under the License is distributed on an "AS IS" BASIS, 12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 // See the License for the specific language governing permissions and 14 // limitations under the License. 15 // 16 17 #ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H 18 #define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H 19 20 #include <grpc/support/port_platform.h> 21 22 #include <functional> 23 #include <memory> 24 #include <string> 25 #include <vector> 26 27 #include "absl/strings/string_view.h" 28 #include "src/core/lib/iomgr/error.h" 29 #include "src/core/lib/security/credentials/external/aws_request_signer.h" 30 #include "src/core/lib/security/credentials/external/external_account_credentials.h" 31 #include "src/core/util/http_client/httpcli.h" 32 #include "src/core/util/http_client/parser.h" 33 #include "src/core/util/orphanable.h" 34 #include "src/core/util/ref_counted_ptr.h" 35 36 namespace grpc_core { 37 38 class AwsExternalAccountCredentials final : public ExternalAccountCredentials { 39 public: 40 static absl::StatusOr<RefCountedPtr<AwsExternalAccountCredentials>> Create( 41 Options options, std::vector<std::string> scopes, 42 std::shared_ptr<grpc_event_engine::experimental::EventEngine> 43 event_engine = nullptr); 44 45 AwsExternalAccountCredentials( 46 Options options, std::vector<std::string> scopes, 47 std::shared_ptr<grpc_event_engine::experimental::EventEngine> 48 event_engine, 49 grpc_error_handle* error); 50 51 std::string debug_string() override; 52 53 static UniqueTypeName Type(); 54 type()55 UniqueTypeName type() const override { return Type(); } 56 57 private: 58 // A FetchBody impl that itself performs a sequence of FetchBody operations. 59 class AwsFetchBody : public FetchBody { 60 public: 61 AwsFetchBody(absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done, 62 AwsExternalAccountCredentials* creds, Timestamp deadline); 63 64 private: 65 void Shutdown() override; 66 67 void AsyncFinish(absl::StatusOr<std::string> result); 68 bool MaybeFail(absl::Status status) ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_); 69 70 void Start(); 71 void RetrieveImdsV2SessionToken() ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_); 72 void RetrieveRegion() ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_); 73 void RetrieveRoleName() ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_); 74 void RetrieveSigningKeys() ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_); 75 void OnRetrieveSigningKeys(std::string result) 76 ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_); 77 void BuildSubjectToken() ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_); 78 79 void AddMetadataRequestHeaders(grpc_http_request* request); 80 81 AwsExternalAccountCredentials* creds_; 82 Timestamp deadline_; 83 84 Mutex mu_; 85 OrphanablePtr<FetchBody> fetch_body_ ABSL_GUARDED_BY(&mu_); 86 87 // Information required by request signer 88 std::string region_; 89 std::string role_name_; 90 std::string access_key_id_; 91 std::string secret_access_key_; 92 std::string token_; 93 std::string imdsv2_session_token_; 94 }; 95 96 OrphanablePtr<FetchBody> RetrieveSubjectToken( 97 Timestamp deadline, 98 absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done) override; 99 100 absl::string_view CredentialSourceType() override; 101 102 std::string audience_; 103 104 // Fields of credential source 105 std::string region_url_; 106 std::string url_; 107 std::string regional_cred_verification_url_; 108 std::string imdsv2_session_token_url_; 109 110 // These fields are set on the first fetch attempt and cached after that. 111 std::unique_ptr<AwsRequestSigner> signer_; 112 std::string cred_verification_url_; 113 }; 114 115 } // namespace grpc_core 116 117 #endif // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H 118