jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud/aws/VespaAwsCredentialsProvider.java


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.

package com.yahoo.jdisc.cloud.aws;

import com.amazonaws.auth.AWSCredentials;
import com.amazonaws.auth.AWSCredentialsProvider;
import com.amazonaws.auth.AWSSessionCredentials;
import com.amazonaws.auth.BasicSessionCredentials;
import com.yahoo.slime.Cursor;
import com.yahoo.slime.Slime;
import com.yahoo.slime.SlimeUtils;

import java.io.IOException;
import java.io.UncheckedIOException;
import java.nio.file.Files;
import java.nio.file.NoSuchFileException;
import java.nio.file.Path;
import java.util.concurrent.atomic.AtomicReference;

public class VespaAwsCredentialsProvider implements AWSCredentialsProvider {

    private static final String DEFAULT_CREDENTIALS_PATH = "/opt/vespa/var/vespa/aws/credentials.json";
    // TODO (freva): Remove when host-admin writes to the new path above
    private static final String DEFAULT_CREDENTIALS_PATH_OLD = "/opt/vespa/var/container-data/opt/vespa/conf/vespa/credentials.json";

    private final AtomicReference<AWSCredentials> credentials = new AtomicReference<>();
    private final Path credentialsPath;
    private final Path credentialsPathOld;


    public VespaAwsCredentialsProvider() {
        this.credentialsPath = Path.of(DEFAULT_CREDENTIALS_PATH);
        this.credentialsPathOld = Path.of(DEFAULT_CREDENTIALS_PATH_OLD);
        refresh();
    }

    @Override
    public AWSCredentials getCredentials() {
        return credentials.get();
    }

    @Override
    public void refresh() {
        try {
            credentials.set(readCredentials());
        } catch (Exception e) {
            throw new RuntimeException("Unable to get credentials in " + credentialsPath.toString(), e);
        }
    }

    private AWSSessionCredentials readCredentials() {
        try {
            Slime slime;
            try {
                slime = SlimeUtils.jsonToSlime(Files.readAllBytes(credentialsPath));
            } catch (NoSuchFileException ignored) {
                slime = SlimeUtils.jsonToSlime(Files.readAllBytes(credentialsPathOld));
            }
            Cursor cursor = slime.get();
            String accessKey = cursor.field("awsAccessKey").asString();
            String secretKey = cursor.field("awsSecretKey").asString();
            String sessionToken = cursor.field("sessionToken").asString();
            return new BasicSessionCredentials(accessKey, secretKey, sessionToken);
        } catch (IOException e) {
            throw new UncheckedIOException(e);
        }
    }
}