Skip to content

Enable cross account lookup for AMIs #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gbvanrenswoude wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Enable cross account lookup for AMIs #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3213f3a
Update check
gbvanrenswoude Jan 26, 2018
e3c149c
Update in
gbvanrenswoude Jan 26, 2018
98f9519
Added cross-account ami lookup possibility
gbvanrenswoude Jan 26, 2018
38871a3
Update README.md
gbvanrenswoude Jan 26, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,16 @@ A Concourse CI resource to check for new Amazon Machine Images (AMI).

## Source Configuration

If you want to assume a role and lookup an AMI in another account, use:

- `role_id`: Your AWS role to assume. Make sure your concourse worker can assume this role.

- `account_id`: The AWS account ID where you want to look up the AMI.

Note: both needs to be set.

Else, use:

- `aws_access_key_id`: Your AWS access key ID.

- `aws_secret_access_key`: Your AWS secret access key.
Expand Down
12 changes: 10 additions & 2 deletions bin/check
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,18 @@ cat | jq . <&0 > /tmp/input

AMI=$(jq -r '.version.ami // empty' /tmp/input)

export AWS_ACCESS_KEY_ID=$(jq -r '.source.aws_access_key_id // empty' /tmp/input)
export AWS_SECRET_ACCESS_KEY=$(jq -r '.source.aws_secret_access_key // empty' /tmp/input)
export ROLE_ID=$(jq -r '.source.role_id // empty' /tmp/input)
export ACCOUNT_ID=$(jq -r '.source.account_id // empty' /tmp/input)
export AWS_DEFAULT_REGION=$(jq -r '.source.region // empty' /tmp/input)

if [ ! -z "ACCOUNT_ID" ] && [ ! -z "ROLE_ID" ]; then
export temp_credentials=$(aws sts assume-role --role-arn arn:aws:iam::$ACCOUNT_ID:role/$ROLE_ID --role-session-name cc-ami-resource-session)
export AWS_ACCESS_KEY_ID=$(echo ${temp_credentials} | jq -r '.Credentials.AccessKeyId') AWS_SESSION_TOKEN=$(echo ${temp_credentials} | jq -r '.Credentials.SessionToken') AWS_SECRET_ACCESS_KEY=$(echo ${temp_credentials} | jq -r ' .Credentials.SecretAccessKey') AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION
else
export AWS_ACCESS_KEY_ID=$(jq -r '.source.aws_access_key_id // empty' /tmp/input)
export AWS_SECRET_ACCESS_KEY=$(jq -r '.source.aws_secret_access_key // empty' /tmp/input)
fi

# remove any empty credentials vars so the AWS client will try instance profiles
if [ -z "$AWS_ACCESS_KEY_ID" ]; then
unset AWS_ACCESS_KEY_ID
Expand Down
13 changes: 11 additions & 2 deletions bin/in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,19 @@ DEST="$1"

AMI=$(jq -r '.version.ami // empty' /tmp/input)

export AWS_ACCESS_KEY_ID=$(jq -r '.source.aws_access_key_id // empty' /tmp/input)
export AWS_SECRET_ACCESS_KEY=$(jq -r '.source.aws_secret_access_key // empty' /tmp/input)

export ROLE_ID=$(jq -r '.source.role_id // empty' /tmp/input)
export ACCOUNT_ID=$(jq -r '.source.account_id // empty' /tmp/input)
export AWS_DEFAULT_REGION=$(jq -r '.source.region // empty' /tmp/input)

if [ ! -z "ACCOUNT_ID" ] && [ ! -z "ROLE_ID" ]; then
export temp_credentials=$(aws sts assume-role --role-arn arn:aws:iam::$ACCOUNT_ID:role/$ROLE_ID --role-session-name cc-ami-resource-session)
export AWS_ACCESS_KEY_ID=$(echo ${temp_credentials} | jq -r '.Credentials.AccessKeyId') AWS_SESSION_TOKEN=$(echo ${temp_credentials} | jq -r '.Credentials.SessionToken') AWS_SECRET_ACCESS_KEY=$(echo ${temp_credentials} | jq -r ' .Credentials.SecretAccessKey') AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION
else
export AWS_ACCESS_KEY_ID=$(jq -r '.source.aws_access_key_id // empty' /tmp/input)
export AWS_SECRET_ACCESS_KEY=$(jq -r '.source.aws_secret_access_key // empty' /tmp/input)
fi

# remove any empty credentials vars so the AWS client will try instance profiles
if [ -z "$AWS_ACCESS_KEY_ID" ]; then
unset AWS_ACCESS_KEY_ID
Expand Down