Skip to content

Commit b3259bc

Browse files
SevenEarthSevenEarth
committed
add
1 parent f497569 commit b3259bc

File tree

1 file changed

+125
-14
lines changed

1 file changed

+125
-14
lines changed

‎tencentcloud/provider.go

Lines changed: 125 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -123,11 +123,14 @@ const (
123123
PROVIDER_DOMAIN = "TENCENTCLOUD_DOMAIN"
124124
//internal version: replace envYunti begin, please do not modify this annotation and refrain from inserting any code between the beginning and end lines of the annotation.
125125
//internal version: replace envYunti end, please do not modify this annotation and refrain from inserting any code between the beginning and end lines of the annotation.
126-
PROVIDER_ASSUME_ROLE_ARN = "TENCENTCLOUD_ASSUME_ROLE_ARN"
127-
PROVIDER_ASSUME_ROLE_SESSION_NAME = "TENCENTCLOUD_ASSUME_ROLE_SESSION_NAME"
128-
PROVIDER_ASSUME_ROLE_SESSION_DURATION = "TENCENTCLOUD_ASSUME_ROLE_SESSION_DURATION"
129-
PROVIDER_SHARED_CREDENTIALS_DIR = "TENCENTCLOUD_SHARED_CREDENTIALS_DIR"
130-
PROVIDER_PROFILE = "TENCENTCLOUD_PROFILE"
126+
PROVIDER_ASSUME_ROLE_ARN = "TENCENTCLOUD_ASSUME_ROLE_ARN"
127+
PROVIDER_ASSUME_ROLE_SESSION_NAME = "TENCENTCLOUD_ASSUME_ROLE_SESSION_NAME"
128+
PROVIDER_ASSUME_ROLE_SESSION_DURATION = "TENCENTCLOUD_ASSUME_ROLE_SESSION_DURATION"
129+
PROVIDER_ASSUME_ROLE_SAML_ASSERTION = "TENCENTCLOUD_ASSUME_ROLE_SAML_ASSERTION"
130+
PROVIDER_ASSUME_ROLE_PRINCIPAL_ARN = "TENCENTCLOUD_ASSUME_ROLE_PRINCIPAL_ARN"
131+
PROVIDER_ASSUME_ROLE_WEB_IDENTITY_TOKEN = "TENCENTCLOUD_ASSUME_ROLE_WEB_IDENTITY_TOKEN"
132+
PROVIDER_SHARED_CREDENTIALS_DIR = "TENCENTCLOUD_SHARED_CREDENTIALS_DIR"
133+
PROVIDER_PROFILE = "TENCENTCLOUD_PROFILE"
131134
)
132135

133136
const (
@@ -195,7 +198,7 @@ func Provider() *schema.Provider {
195198
//internal version: replace enableBpass begin, please do not modify this annotation and refrain from inserting any code between the beginning and end lines of the annotation.
196199
//internal version: replace enableBpass end, please do not modify this annotation and refrain from inserting any code between the beginning and end lines of the annotation.
197200
"assume_role": {
198-
Type: schema.TypeSet,
201+
Type: schema.TypeList,
199202
Optional: true,
200203
MaxItems: 1,
201204
Description: "The `assume_role` block. If provided, terraform will attempt to assume this role using the supplied credentials.",
@@ -230,6 +233,29 @@ func Provider() *schema.Provider {
230233
Optional: true,
231234
Description: "A more restrictive policy when making the AssumeRole call. Its content must not contains `principal` elements. Notice: more syntax references, please refer to: [policies syntax logic](https://intl.cloud.tencent.com/document/product/598/10603).",
232235
},
236+
"saml_assertion": {
237+
Type: schema.TypeString,
238+
Optional: true,
239+
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_SAML_ASSERTION, nil),
240+
ConflictsWith: []string{"assume_role.0.web_identity_token"},
241+
RequiredWith: []string{"assume_role.0.principal_arn"},
242+
Description: "SAML assertion information encoded in base64. And it can't be used with `web_identity_token` together.",
243+
},
244+
"principal_arn": {
245+
Type: schema.TypeString,
246+
Optional: true,
247+
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_PRINCIPAL_ARN, nil),
248+
ConflictsWith: []string{"assume_role.0.web_identity_token"},
249+
RequiredWith: []string{"assume_role.0.saml_assertion"},
250+
Description: "Player Access Description Name. And it can't be used with `web_identity_token` together.",
251+
},
252+
"web_identity_token": {
253+
Type: schema.TypeString,
254+
Optional: true,
255+
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_WEB_IDENTITY_TOKEN, nil),
256+
ConflictsWith: []string{"assume_role.0.saml_assertion", "assume_role.0.principal_arn"},
257+
Description: "OIDC token issued by IdP. And it can't be used with `saml_assertion` or `principal_arn` together.",
258+
},
233259
},
234260
},
235261
},
@@ -2061,10 +2087,13 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
20612087
}
20622088

20632089
var (
2064-
assumeRoleArn string
2065-
assumeRoleSessionName string
2066-
assumeRoleSessionDuration int
2067-
assumeRolePolicy string
2090+
assumeRoleArn string
2091+
assumeRoleSessionName string
2092+
assumeRoleSessionDuration int
2093+
assumeRolePolicy string
2094+
assumeRoleSamlAssertion string
2095+
assumeRolePrincipalArn string
2096+
assumeRoleWebIdentityToken string
20682097
)
20692098

20702099
// get assume role from credential
@@ -2099,25 +2128,57 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
20992128
assumeRoleSessionDuration = 7200
21002129
}
21012130

2102-
_ = genClientWithSTS(&tcClient, envRoleArn, envSessionName, assumeRoleSessionDuration, "")
2131+
envSamlAssertion := os.Getenv(PROVIDER_ASSUME_ROLE_SAML_ASSERTION)
2132+
envPrincipalArn := os.Getenv(PROVIDER_ASSUME_ROLE_PRINCIPAL_ARN)
2133+
envWebIdentityToken := os.Getenv(PROVIDER_ASSUME_ROLE_WEB_IDENTITY_TOKEN)
2134+
2135+
if envSamlAssertion == "" && envPrincipalArn == "" && envWebIdentityToken == "" {
2136+
// use assume role
2137+
_ = genClientWithSTS(&tcClient, envRoleArn, envSessionName, assumeRoleSessionDuration, "")
2138+
} else if envSamlAssertion != "" && envPrincipalArn != "" {
2139+
// use assume role with saml
2140+
_ = genClientWithSamlSTS(&tcClient, envRoleArn, envSessionName, assumeRoleSessionDuration, envSamlAssertion, envPrincipalArn)
2141+
} else if envWebIdentityToken != "" {
2142+
// use assume role with oidc
2143+
_ = genClientWithOidcSTS(&tcClient, envRoleArn, envSessionName, assumeRoleSessionDuration, envWebIdentityToken)
2144+
} else {
2145+
return nil, fmt.Errorf("get `assume_role` from env error.\n")
2146+
}
21032147
}
21042148

21052149
// get assume role from tf
21062150
if v, ok := d.GetOk("assume_role"); ok {
2107-
assumeRoleList := v.(*schema.Set).List()
2151+
assumeRoleList := v.([]interface{})
21082152
if len(assumeRoleList) == 1 {
2153+
// assume role
21092154
assumeRole := assumeRoleList[0].(map[string]interface{})
21102155
assumeRoleArn = assumeRole["role_arn"].(string)
21112156
assumeRoleSessionName = assumeRole["session_name"].(string)
21122157
assumeRoleSessionDuration = assumeRole["session_duration"].(int)
21132158
assumeRolePolicy = assumeRole["policy"].(string)
2159+
// saml
2160+
assumeRoleSamlAssertion = assumeRole["saml_assertion"].(string)
2161+
assumeRolePrincipalArn = assumeRole["principal_arn"].(string)
2162+
// oidc
2163+
assumeRoleWebIdentityToken = assumeRole["web_identity_token"].(string)
21142164

2115-
_ = genClientWithSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRolePolicy)
2165+
if assumeRoleSamlAssertion == "" && assumeRolePrincipalArn == "" && assumeRoleWebIdentityToken == "" {
2166+
// use assume role
2167+
_ = genClientWithSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRolePolicy)
2168+
} else if assumeRoleSamlAssertion != "" && assumeRolePrincipalArn != "" {
2169+
// use assume role with saml
2170+
_ = genClientWithSamlSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRoleSamlAssertion, assumeRolePrincipalArn)
2171+
} else if assumeRoleWebIdentityToken != "" {
2172+
// use assume role with oidc
2173+
_ = genClientWithOidcSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRoleWebIdentityToken)
2174+
} else {
2175+
return nil, fmt.Errorf("get `assume_role` params error.\n")
2176+
}
21162177
}
21172178
}
21182179

21192180
if secretId == "" || secretKey == "" {
2120-
return nil, fmt.Errorf("Please set your `secret_id` and `secret_key`.")
2181+
return nil, fmt.Errorf("Please set your `secret_id` and `secret_key`.\n")
21212182
}
21222183

21232184
return &tcClient, nil
@@ -2149,6 +2210,56 @@ func genClientWithSTS(tcClient *TencentCloudClient, assumeRoleArn, assumeRoleSes
21492210
return nil
21502211
}
21512212

2213+
func genClientWithSamlSTS(tcClient *TencentCloudClient, assumeRoleArn, assumeRoleSessionName string, assumeRoleSessionDuration int, assumeRoleSamlAssertion, assumeRolePrincipalArn string) error {
2214+
// applying STS credentials
2215+
request := sdksts.NewAssumeRoleWithSAMLRequest()
2216+
request.RoleArn = helper.String(assumeRoleArn)
2217+
request.RoleSessionName = helper.String(assumeRoleSessionName)
2218+
request.DurationSeconds = helper.IntUint64(assumeRoleSessionDuration)
2219+
request.SAMLAssertion = helper.String(assumeRoleSamlAssertion)
2220+
request.PrincipalArn = helper.String(assumeRolePrincipalArn)
2221+
2222+
ratelimit.Check(request.GetAction())
2223+
response, err := tcClient.apiV3Conn.UseStsClient().AssumeRoleWithSAML(request)
2224+
if err != nil {
2225+
return err
2226+
}
2227+
2228+
// using STS credentials
2229+
tcClient.apiV3Conn.Credential = sdkcommon.NewTokenCredential(
2230+
*response.Response.Credentials.TmpSecretId,
2231+
*response.Response.Credentials.TmpSecretKey,
2232+
*response.Response.Credentials.Token,
2233+
)
2234+
2235+
return nil
2236+
}
2237+
2238+
func genClientWithOidcSTS(tcClient *TencentCloudClient, assumeRoleArn, assumeRoleSessionName string, assumeRoleSessionDuration int, assumeRolePolicy string) error {
2239+
// applying STS credentials
2240+
request := sdksts.NewAssumeRoleWithWebIdentityRequest()
2241+
request.ProviderId = helper.String("OIDC")
2242+
request.RoleArn = helper.String(assumeRoleArn)
2243+
request.RoleSessionName = helper.String(assumeRoleSessionName)
2244+
request.DurationSeconds = helper.IntInt64(assumeRoleSessionDuration)
2245+
request.WebIdentityToken = helper.String(assumeRolePolicy)
2246+
2247+
ratelimit.Check(request.GetAction())
2248+
response, err := tcClient.apiV3Conn.UseStsClient().AssumeRoleWithWebIdentity(request)
2249+
if err != nil {
2250+
return err
2251+
}
2252+
2253+
// using STS credentials
2254+
tcClient.apiV3Conn.Credential = sdkcommon.NewTokenCredential(
2255+
*response.Response.Credentials.TmpSecretId,
2256+
*response.Response.Credentials.TmpSecretKey,
2257+
*response.Response.Credentials.Token,
2258+
)
2259+
2260+
return nil
2261+
}
2262+
21522263
var providerConfig map[string]interface{}
21532264

21542265
func getConfigFromProfile(d *schema.ResourceData, ProfileKey string) (interface{}, error) {

0 commit comments

Comments
 (0)