|
| 1 | +// Copyright 2025 Google LLC |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +// [START auth_custom_credential_supplier_aws] |
| 16 | +const {AwsClient} = require('google-auth-library'); |
| 17 | +const {fromNodeProviderChain} = require('@aws-sdk/credential-providers'); |
| 18 | +const fs = require('fs'); |
| 19 | +const path = require('path'); |
| 20 | +const {STSClient} = require('@aws-sdk/client-sts'); |
| 21 | +const {Storage} = require('@google-cloud/storage'); |
| 22 | + |
| 23 | +/** |
| 24 | + * Custom AWS Security Credentials Supplier. |
| 25 | + * |
| 26 | + * This implementation resolves AWS credentials using the default Node provider |
| 27 | + * chain from the AWS SDK. This allows fetching credentials from environment |
| 28 | + * variables, shared credential files (~/.aws/credentials), or IAM roles |
| 29 | + * for service accounts (IRSA) in EKS, etc. |
| 30 | + */ |
| 31 | +class CustomAwsSupplier { |
| 32 | + constructor() { |
| 33 | + this.region = null; |
| 34 | + |
| 35 | + this.awsCredentialsProvider = fromNodeProviderChain(); |
| 36 | + } |
| 37 | + |
| 38 | + /** |
| 39 | + * Returns the AWS region. This is required for signing the AWS request. |
| 40 | + * It resolves the region automatically by using the default AWS region |
| 41 | + * provider chain, which searches for the region in the standard locations |
| 42 | + * (environment variables, AWS config file, etc.). |
| 43 | + */ |
| 44 | + async getAwsRegion(_context) { |
| 45 | + if (this.region) { |
| 46 | + return this.region; |
| 47 | + } |
| 48 | + |
| 49 | + const client = new STSClient({}); |
| 50 | + this.region = await client.config.region(); |
| 51 | + |
| 52 | + if (!this.region) { |
| 53 | + throw new Error( |
| 54 | + 'CustomAwsSupplier: Unable to resolve AWS region. Please set the AWS_REGION environment variable or configure it in your ~/.aws/config file.' |
| 55 | + ); |
| 56 | + } |
| 57 | + |
| 58 | + return this.region; |
| 59 | + } |
| 60 | + |
| 61 | + /** |
| 62 | + * Retrieves AWS security credentials using the AWS SDK's default provider chain. |
| 63 | + */ |
| 64 | + async getAwsSecurityCredentials(_context) { |
| 65 | + const awsCredentials = await this.awsCredentialsProvider(); |
| 66 | + |
| 67 | + if (!awsCredentials.accessKeyId || !awsCredentials.secretAccessKey) { |
| 68 | + throw new Error( |
| 69 | + 'Unable to resolve AWS credentials from the node provider chain. ' + |
| 70 | + 'Ensure your AWS CLI is configured, or AWS environment variables (like AWS_ACCESS_KEY_ID) are set.' |
| 71 | + ); |
| 72 | + } |
| 73 | + |
| 74 | + return { |
| 75 | + accessKeyId: awsCredentials.accessKeyId, |
| 76 | + secretAccessKey: awsCredentials.secretAccessKey, |
| 77 | + token: awsCredentials.sessionToken, |
| 78 | + }; |
| 79 | + } |
| 80 | +} |
| 81 | + |
| 82 | +/** |
| 83 | + * Authenticates with Google Cloud using AWS credentials and retrieves bucket metadata. |
| 84 | + * |
| 85 | + * @param {string} bucketName The name of the bucket to retrieve. |
| 86 | + * @param {string} audience The Workload Identity Pool audience. |
| 87 | + * @param {string} [impersonationUrl] Optional Service Account impersonation URL. |
| 88 | + */ |
| 89 | +async function authenticateWithAwsCredentials( |
| 90 | + bucketName, |
| 91 | + audience, |
| 92 | + impersonationUrl |
| 93 | +) { |
| 94 | + const customSupplier = new CustomAwsSupplier(); |
| 95 | + |
| 96 | + const clientOptions = { |
| 97 | + audience: audience, |
| 98 | + subject_token_type: 'urn:ietf:params:aws:token-type:aws4_request', |
| 99 | + service_account_impersonation_url: impersonationUrl, |
| 100 | + aws_security_credentials_supplier: customSupplier, |
| 101 | + }; |
| 102 | + |
| 103 | + const authClient = new AwsClient(clientOptions); |
| 104 | + |
| 105 | + const storage = new Storage({ |
| 106 | + authClient: authClient, |
| 107 | + }); |
| 108 | + |
| 109 | + const [metadata] = await storage.bucket(bucketName).getMetadata(); |
| 110 | + return metadata; |
| 111 | +} |
| 112 | +// [END auth_custom_credential_supplier_aws] |
| 113 | + |
| 114 | +/** |
| 115 | + * If a local secrets file is present, load it into the process environment. |
| 116 | + * This is a "just-in-time" configuration for local development. These |
| 117 | + * variables are only set for the current process. |
| 118 | + */ |
| 119 | +function loadConfigFromFile() { |
| 120 | + const secretsPath = path.resolve( |
| 121 | + __dirname, |
| 122 | + 'custom-credentials-aws-secrets.json' |
| 123 | + ); |
| 124 | + if (!fs.existsSync(secretsPath)) return; |
| 125 | + |
| 126 | + try { |
| 127 | + const secrets = JSON.parse(fs.readFileSync(secretsPath, 'utf8')); |
| 128 | + |
| 129 | + const envMap = { |
| 130 | + aws_access_key_id: 'AWS_ACCESS_KEY_ID', |
| 131 | + aws_secret_access_key: 'AWS_SECRET_ACCESS_KEY', |
| 132 | + aws_region: 'AWS_REGION', |
| 133 | + gcp_workload_audience: 'GCP_WORKLOAD_AUDIENCE', |
| 134 | + gcs_bucket_name: 'GCS_BUCKET_NAME', |
| 135 | + gcp_service_account_impersonation_url: |
| 136 | + 'GCP_SERVICE_ACCOUNT_IMPERSONATION_URL', |
| 137 | + }; |
| 138 | + |
| 139 | + for (const [jsonKey, envKey] of Object.entries(envMap)) { |
| 140 | + if (secrets[jsonKey]) { |
| 141 | + process.env[envKey] = secrets[jsonKey]; |
| 142 | + } |
| 143 | + } |
| 144 | + } catch (error) { |
| 145 | + console.error(`Error reading secrets file: ${error.message}`); |
| 146 | + } |
| 147 | +} |
| 148 | + |
| 149 | +async function main() { |
| 150 | + loadConfigFromFile(); |
| 151 | + |
| 152 | + const gcpAudience = process.env.GCP_WORKLOAD_AUDIENCE; |
| 153 | + const saImpersonationUrl = process.env.GCP_SERVICE_ACCOUNT_IMPERSONATION_URL; |
| 154 | + const gcsBucketName = process.env.GCS_BUCKET_NAME; |
| 155 | + |
| 156 | + if (!gcpAudience || !gcsBucketName) { |
| 157 | + throw new Error( |
| 158 | + 'Missing required configuration. Please provide it in a ' + |
| 159 | + 'secrets.json file or as environment variables: ' + |
| 160 | + 'GCP_WORKLOAD_AUDIENCE, GCS_BUCKET_NAME' |
| 161 | + ); |
| 162 | + } |
| 163 | + |
| 164 | + try { |
| 165 | + console.log(`Retrieving metadata for bucket: ${gcsBucketName}...`); |
| 166 | + const bucketMetadata = await authenticateWithAwsCredentials( |
| 167 | + gcsBucketName, |
| 168 | + gcpAudience, |
| 169 | + saImpersonationUrl |
| 170 | + ); |
| 171 | + console.log('\n--- SUCCESS! ---'); |
| 172 | + console.log('Bucket Metadata:', JSON.stringify(bucketMetadata, null, 2)); |
| 173 | + } catch (error) { |
| 174 | + console.error('\n--- FAILED ---'); |
| 175 | + console.error(error.message || error); |
| 176 | + process.exitCode = 1; |
| 177 | + } |
| 178 | +} |
| 179 | + |
| 180 | +if (require.main === module) { |
| 181 | + main(); |
| 182 | +} |
| 183 | + |
| 184 | +exports.authenticateWithAwsCredentials = authenticateWithAwsCredentials; |
0 commit comments