@softchef/cdk-iot-device-management
Version:
IoT device management is composed of things, thing types, thing groups, jobs, files API services. The constructs can be used independently, that are based on full-managed service to create an API Gateway & Lambda function.
94 lines (93 loc) • 3.73 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.fromInstanceMetadata = void 0;
const property_provider_1 = require("@aws-sdk/property-provider");
const httpRequest_1 = require("./remoteProvider/httpRequest");
const ImdsCredentials_1 = require("./remoteProvider/ImdsCredentials");
const RemoteProviderInit_1 = require("./remoteProvider/RemoteProviderInit");
const retry_1 = require("./remoteProvider/retry");
const getInstanceMetadataEndpoint_1 = require("./utils/getInstanceMetadataEndpoint");
const IMDS_PATH = "/latest/meta-data/iam/security-credentials/";
const IMDS_TOKEN_PATH = "/latest/api/token";
const fromInstanceMetadata = (init = {}) => {
let disableFetchToken = false;
const { timeout, maxRetries } = RemoteProviderInit_1.providerConfigFromInit(init);
const getCredentials = async (maxRetries, options) => {
const profile = (await retry_1.retry(async () => {
let profile;
try {
profile = await getProfile(options);
}
catch (err) {
if (err.statusCode === 401) {
disableFetchToken = false;
}
throw err;
}
return profile;
}, maxRetries)).trim();
return retry_1.retry(async () => {
let creds;
try {
creds = await getCredentialsFromProfile(profile, options);
}
catch (err) {
if (err.statusCode === 401) {
disableFetchToken = false;
}
throw err;
}
return creds;
}, maxRetries);
};
return async () => {
const endpoint = await getInstanceMetadataEndpoint_1.getInstanceMetadataEndpoint();
if (disableFetchToken) {
return getCredentials(maxRetries, { ...endpoint, timeout });
}
else {
let token;
try {
token = (await getMetadataToken({ ...endpoint, timeout })).toString();
}
catch (error) {
if ((error === null || error === void 0 ? void 0 : error.statusCode) === 400) {
throw Object.assign(error, {
message: "EC2 Metadata token request returned error",
});
}
else if (error.message === "TimeoutError" || [403, 404, 405].includes(error.statusCode)) {
disableFetchToken = true;
}
return getCredentials(maxRetries, { ...endpoint, timeout });
}
return getCredentials(maxRetries, {
...endpoint,
headers: {
"x-aws-ec2-metadata-token": token,
},
timeout,
});
}
};
};
exports.fromInstanceMetadata = fromInstanceMetadata;
const getMetadataToken = async (options) => httpRequest_1.httpRequest({
...options,
path: IMDS_TOKEN_PATH,
method: "PUT",
headers: {
"x-aws-ec2-metadata-token-ttl-seconds": "21600",
},
});
const getProfile = async (options) => (await httpRequest_1.httpRequest({ ...options, path: IMDS_PATH })).toString();
const getCredentialsFromProfile = async (profile, options) => {
const credsResponse = JSON.parse((await httpRequest_1.httpRequest({
...options,
path: IMDS_PATH + profile,
})).toString());
if (!ImdsCredentials_1.isImdsCredentials(credsResponse)) {
throw new property_provider_1.CredentialsProviderError("Invalid response received from instance metadata service.");
}
return ImdsCredentials_1.fromImdsCredentials(credsResponse);
};