浏览代码

HUE-4935 [aws] Enable support for AWS security token

Jenny Kim 9 年之前
父节点
当前提交
6e91f195a8

+ 7 - 0
desktop/conf.dist/hue.ini

@@ -1253,6 +1253,13 @@
       # AWS credentials
       ## access_key_id=
       ## secret_access_key=
+      ## security_token=
+
+      # Execute this script to produce the AWS access key ID.
+      ## access_key_id_script=/path/access_key_id.sh
+
+      # Execute this script to produce the AWS secret access key.
+      ## secret_access_key_script=/path/secret_access_key.sh
 
       # Allow to use either environment variables or
       # EC2 InstanceProfile to retrieve AWS credentials.

+ 7 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -1257,6 +1257,13 @@
       # AWS credentials
       ## access_key_id=
       ## secret_access_key=
+      ## security_token=
+
+      # Execute this script to produce the AWS access key ID.
+      ## access_key_id_script=/path/access_key_id.sh
+
+      # Execute this script to produce the AWS secret access key.
+      ## secret_access_key_script=/path/secret_access_key.sh
 
       # Allow to use either environment variables or
       # EC2 InstanceProfile to retrieve AWS credentials.

+ 7 - 2
desktop/libs/aws/src/aws/client.py

@@ -25,9 +25,11 @@ HTTP_SOCKET_TIMEOUT_S = 60
 
 
 class Client(object):
-  def __init__(self, aws_access_key_id=None, aws_secret_access_key=None, region=None, timeout=HTTP_SOCKET_TIMEOUT_S):
+  def __init__(self, aws_access_key_id=None, aws_secret_access_key=None, aws_security_token=None, region=None,
+               timeout=HTTP_SOCKET_TIMEOUT_S):
     self._access_key_id = aws_access_key_id
     self._secret_access_key = aws_secret_access_key
+    self._security_token = aws_security_token
     self._region = region.lower() if region else get_default_region()
     self._timeout = timeout
 
@@ -38,6 +40,7 @@ class Client(object):
   def from_config(cls, conf):
     access_key_id = conf.ACCESS_KEY_ID.get()
     secret_access_key = conf.SECRET_ACCESS_KEY.get()
+    security_token = conf.SECURITY_TOKEN.get()
     env_cred_allowed = conf.ALLOW_ENVIRONMENT_CREDENTIALS.get()
 
     if None in (access_key_id, secret_access_key) and not env_cred_allowed:
@@ -46,13 +49,15 @@ class Client(object):
     return cls(
       aws_access_key_id=access_key_id,
       aws_secret_access_key=secret_access_key,
+      aws_security_token=security_token,
       region=conf.REGION.get()
     )
 
   def get_s3_connection(self):
     connection = boto.s3.connect_to_region(self._region,
                                            aws_access_key_id=self._access_key_id,
-                                           aws_secret_access_key=self._secret_access_key)
+                                           aws_secret_access_key=self._secret_access_key,
+                                           security_token=self._security_token)
     if connection is None:
       raise ValueError('Can not construct S3 Connection for region %s' % self._region)
     return connection

+ 7 - 1
desktop/libs/aws/src/aws/conf.py

@@ -73,7 +73,13 @@ AWS_ACCOUNTS = UnspecifiedConfigSection(
         default=None,
         private=True,
         type=coerce_password_from_script,
-        help=_("Execute this script to produce the AWS secret access key.")),
+        help=_("Execute this script to produce the AWS secret access key.")
+      ),
+      SECURITY_TOKEN=Config(
+        key='security_token',
+        type=str,
+        private=True,
+      ),
       ALLOW_ENVIRONMENT_CREDENTIALS=Config(
         help='Allow to use environment sources of credentials (environment variables, EC2 profile).',
         key='allow_environment_credentials',