From 3213f3ab33e4c03c28296c5988471c5dd75b97f6 Mon Sep 17 00:00:00 2001
From: Gijsbert van Renswoude <gbvanrenswoude@gmail.com>
Date: Fri, 26 Jan 2018 15:38:58 +0100
Subject: [PATCH 1/4] Update check

---
 bin/check | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/bin/check b/bin/check
index 64dadfb..2df3b24 100755
--- a/bin/check
+++ b/bin/check
@@ -6,10 +6,18 @@ cat | jq . <&0 > /tmp/input
 
 AMI=$(jq -r '.version.ami // empty' /tmp/input)
 
-export AWS_ACCESS_KEY_ID=$(jq -r '.source.aws_access_key_id // empty' /tmp/input)
-export AWS_SECRET_ACCESS_KEY=$(jq -r '.source.aws_secret_access_key // empty' /tmp/input)
+export ROLE_ID=$(jq -r '.source.role_id // empty' /tmp/input)
+export ACCOUNT_ID=$(jq -r '.source.account_id // empty' /tmp/input)
 export AWS_DEFAULT_REGION=$(jq -r '.source.region // empty' /tmp/input)
 
+if [ ! -z "ACCOUNT_ID" ] && [ ! -z "ROLE_ID" ]; then
+  export temp_credentials=$(aws sts assume-role --role-arn arn:aws:iam::$ACCOUNT_ID:role/$ROLE_ID --role-session-name cc-ami-resource-session)
+  export AWS_ACCESS_KEY_ID=$(echo ${temp_credentials} | jq -r '.Credentials.AccessKeyId') AWS_SESSION_TOKEN=$(echo ${temp_credentials} | jq -r '.Credentials.SessionToken') AWS_SECRET_ACCESS_KEY=$(echo ${temp_credentials} | jq -r ' .Credentials.SecretAccessKey') AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION
+else
+  export AWS_ACCESS_KEY_ID=$(jq -r '.source.aws_access_key_id // empty' /tmp/input)
+  export AWS_SECRET_ACCESS_KEY=$(jq -r '.source.aws_secret_access_key // empty' /tmp/input)
+fi
+
 # remove any empty credentials vars so the AWS client will try instance profiles
 if [ -z "$AWS_ACCESS_KEY_ID" ]; then
   unset AWS_ACCESS_KEY_ID

From e3c149ce62da9b5579adcad32c71a81ea66541a9 Mon Sep 17 00:00:00 2001
From: Gijsbert van Renswoude <gbvanrenswoude@gmail.com>
Date: Fri, 26 Jan 2018 15:39:25 +0100
Subject: [PATCH 2/4] Update in

---
 bin/in | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/bin/in b/bin/in
index c5c57f4..1734317 100755
--- a/bin/in
+++ b/bin/in
@@ -8,10 +8,19 @@ DEST="$1"
 
 AMI=$(jq -r '.version.ami // empty' /tmp/input)
 
-export AWS_ACCESS_KEY_ID=$(jq -r '.source.aws_access_key_id // empty' /tmp/input)
-export AWS_SECRET_ACCESS_KEY=$(jq -r '.source.aws_secret_access_key // empty' /tmp/input)
+
+export ROLE_ID=$(jq -r '.source.role_id // empty' /tmp/input)
+export ACCOUNT_ID=$(jq -r '.source.account_id // empty' /tmp/input)
 export AWS_DEFAULT_REGION=$(jq -r '.source.region // empty' /tmp/input)
 
+if [ ! -z "ACCOUNT_ID" ] && [ ! -z "ROLE_ID" ]; then
+  export temp_credentials=$(aws sts assume-role --role-arn arn:aws:iam::$ACCOUNT_ID:role/$ROLE_ID --role-session-name cc-ami-resource-session)
+  export AWS_ACCESS_KEY_ID=$(echo ${temp_credentials} | jq -r '.Credentials.AccessKeyId') AWS_SESSION_TOKEN=$(echo ${temp_credentials} | jq -r '.Credentials.SessionToken') AWS_SECRET_ACCESS_KEY=$(echo ${temp_credentials} | jq -r ' .Credentials.SecretAccessKey') AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION
+else
+  export AWS_ACCESS_KEY_ID=$(jq -r '.source.aws_access_key_id // empty' /tmp/input)
+  export AWS_SECRET_ACCESS_KEY=$(jq -r '.source.aws_secret_access_key // empty' /tmp/input)
+fi
+
 # remove any empty credentials vars so the AWS client will try instance profiles
 if [ -z "$AWS_ACCESS_KEY_ID" ]; then
   unset AWS_ACCESS_KEY_ID

From 98f9519a391e176e59f53b6a9b09eea345e76769 Mon Sep 17 00:00:00 2001
From: Gijsbert van Renswoude <gbvanrenswoude@gmail.com>
Date: Fri, 26 Jan 2018 15:40:31 +0100
Subject: [PATCH 3/4] Added cross-account ami lookup possibility

---
 README.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/README.md b/README.md
index 4c4014d..a555788 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,16 @@ A Concourse CI resource to check for new Amazon Machine Images (AMI).
 
 ## Source Configuration
 
+If you want to assume a role and lookup an AMI in another account, use:
+
+- `role_id`: Your AWS role to assume. Make sure concourse can assume this role.
+
+- `account_id`: The AWS account ID where you want to look up the AMI.
+
+Note: both needs to be set.
+
+Else, use:
+
 - `aws_access_key_id`: Your AWS access key ID.
 
 - `aws_secret_access_key`: Your AWS secret access key. 

From 38871a32c26db91c1566f6b003b93e2b4925f853 Mon Sep 17 00:00:00 2001
From: Gijsbert van Renswoude <gbvanrenswoude@gmail.com>
Date: Fri, 26 Jan 2018 15:42:50 +0100
Subject: [PATCH 4/4] Update README.md

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index a555788..19f0b6b 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ A Concourse CI resource to check for new Amazon Machine Images (AMI).
 
 If you want to assume a role and lookup an AMI in another account, use:
 
-- `role_id`: Your AWS role to assume. Make sure concourse can assume this role.
+- `role_id`: Your AWS role to assume. Make sure your concourse worker can assume this role.
 
 - `account_id`: The AWS account ID where you want to look up the AMI.