Packages

aws_erlang

1.0.9
1.3.2 1.3.1 1.3.0 1.2.2 1.2.1 1.2.0 1.1.3 1.1.2 1.1.1 1.1.0 1.0.10 1.0.9 1.0.8 1.0.7 1.0.6 1.0.5 1.0.4 1.0.3 1.0.2 1.0.1 1.0.0 0.7.15 0.7.14 0.7.13 0.7.12 0.7.11 0.7.10 0.7.9 0.7.8 0.7.7 0.7.6 0.7.5 0.7.4 0.7.3 0.7.2 0.5.0 0.4.0 0.3.1 0.3.0 0.2.0 0.1.1 0.1.0 0.0.0

AWS clients for Erlang.

HexDocs

Current section

Files

Jump to
Readme
43 Versions
3 Dependencies
Dependants
Files
Activity
aws_erlang src aws_rds_iam_token.erl
Raw

src/aws_rds_iam_token.erl 

-module(aws_rds_iam_token).

-export([rds_token_create/4]).



-define(SIGNING_ID, <<"rds-db">>).

-define(EMPTY_PAYLOAD_HASH, <<"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855">>).



%%====================================================================

%% API

%%====================================================================

-spec rds_token_create(aws_client:aws_client(), binary(), non_neg_integer(), binary()) -> {ok, binary()}.

rds_token_create(Client, DBEndpoint, DBPort, DBUser) when is_map(Client) andalso

                                                is_binary(DBEndpoint) andalso

                                                is_integer(DBPort) andalso

                                                is_binary(DBUser) ->

  Method = <<"GET">>,

  QueryParams = [{<<"Action">>, <<"connect">>}, {<<"DBUser">>, DBUser}],

  Endpoint = <<"https://", DBEndpoint/binary, ":", (integer_to_binary(DBPort))/binary>>,

  Url = aws_request:add_query(Endpoint, QueryParams),

  AccessKeyID = aws_client:access_key_id(Client),

  SecurityToken = aws_client:token(Client),

  SecretAccessKey = aws_client:secret_access_key(Client),

  Region = aws_client:region(Client),

  Now = calendar:universal_time(),

  Options0 = [ {ttl, timer:minutes(15) div 1000} %% Time in seconds

             , {body_digest, ?EMPTY_PAYLOAD_HASH}

             , {uri_encode_path, false} %% We already encode in build_path/4

             ],

  Options = case SecurityToken of

    undefined ->

      Options0;

    _ ->

      [{session_token, hackney_url:urlencode(SecurityToken)} | Options0]

  end,

  <<"https://", SignedUrl/binary>> = aws_signature:sign_v4_query_params(AccessKeyID, SecretAccessKey, Region, ?SIGNING_ID, Now, Method, Url, Options),

  {ok, SignedUrl}.



%%====================================================================

%% Unit tests

%%====================================================================



-ifdef(TEST).



-include_lib("eunit/include/eunit.hrl").

-include_lib("hackney/include/hackney_lib.hrl").



fetch_auth_token_test() ->

  Client = aws_client:make_temporary_client(<<"AccessKeyID">>, <<"SecretAccessKey">>,

                                            <<"Token">>, <<"eu-west-1">>),

  {ok, Url} = rds_token_create(Client, <<"db_endpoint">>, 5432, <<"db_user">>),

  HackneyUrl = hackney_url:parse_url(Url),

  ParsedQs = hackney_url:parse_qs(HackneyUrl#hackney_url.qs),

  Credential = proplists:get_value(<<"X-Amz-Credential">>, ParsedQs),

  [AccessKeyId, _ShortDate, Region, Service, Request] = binary:split(Credential, <<"/">>, [global]),

  ?assertEqual(5432, HackneyUrl#hackney_url.port),

  ?assertEqual("db_endpoint", HackneyUrl#hackney_url.host),

  ?assertEqual(<<"">>, HackneyUrl#hackney_url.path),

  ?assertEqual(9, length(ParsedQs)),

  ?assertEqual(<<"AccessKeyID">>, AccessKeyId),

  ?assertEqual(<<"eu-west-1">>, Region),

  ?assertEqual(<<"rds-db">>, Service),

  ?assertEqual(<<"aws4_request">>, Request),

  ?assertEqual(<<"AWS4-HMAC-SHA256">>, proplists:get_value(<<"X-Amz-Algorithm">>, ParsedQs)),

  ?assertEqual(<<"900">>, proplists:get_value(<<"X-Amz-Expires">>, ParsedQs)),

  ?assertEqual(<<"Token">>, proplists:get_value(<<"X-Amz-Security-Token">>, ParsedQs)),

  ?assertEqual(<<"host">>, proplists:get_value(<<"X-Amz-SignedHeaders">>, ParsedQs)).



-endif.