cdk-ssm-secure-iam-access-key
Version:
Creates an IAM Access Key for a provided IAM User and stores the result in an SSM SecureString Parameter
57 lines (56 loc) • 2.81 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.resolveSSOCredentials = void 0;
const client_sso_1 = require("@aws-sdk/client-sso");
const token_providers_1 = require("@aws-sdk/token-providers");
const property_provider_1 = require("@smithy/property-provider");
const shared_ini_file_loader_1 = require("@smithy/shared-ini-file-loader");
const SHOULD_FAIL_CREDENTIAL_CHAIN = false;
const resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, profile, }) => {
var _a;
let token;
const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
if (ssoSession) {
try {
const _token = await (0, token_providers_1.fromSso)({ profile })();
token = {
accessToken: _token.token,
expiresAt: new Date(_token.expiration).toISOString(),
};
}
catch (e) {
throw new property_provider_1.CredentialsProviderError(e.message, SHOULD_FAIL_CREDENTIAL_CHAIN);
}
}
else {
try {
token = await (0, shared_ini_file_loader_1.getSSOTokenFromFile)(ssoStartUrl);
}
catch (e) {
throw new property_provider_1.CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, SHOULD_FAIL_CREDENTIAL_CHAIN);
}
}
if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {
throw new property_provider_1.CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, SHOULD_FAIL_CREDENTIAL_CHAIN);
}
const { accessToken } = token;
const sso = ssoClient || new client_sso_1.SSOClient({ region: ssoRegion });
let ssoResp;
try {
ssoResp = await sso.send(new client_sso_1.GetRoleCredentialsCommand({
accountId: ssoAccountId,
roleName: ssoRoleName,
accessToken,
}));
}
catch (e) {
throw property_provider_1.CredentialsProviderError.from(e, SHOULD_FAIL_CREDENTIAL_CHAIN);
}
const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration } = {} } = ssoResp;
const credentialScope = (_a = ssoResp === null || ssoResp === void 0 ? void 0 : ssoResp.roleCredentials) === null || _a === void 0 ? void 0 : _a.credentialScope;
if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
throw new property_provider_1.CredentialsProviderError("SSO returns an invalid temporary credential.", SHOULD_FAIL_CREDENTIAL_CHAIN);
}
return { accessKeyId, secretAccessKey, sessionToken, expiration: new Date(expiration), credentialScope };
};
exports.resolveSSOCredentials = resolveSSOCredentials;