diff options
| -rw-r--r-- | lib/rubygems/s3_uri_signer.rb | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/lib/rubygems/s3_uri_signer.rb b/lib/rubygems/s3_uri_signer.rb index 4caf07131f..ff9dde30ed 100644 --- a/lib/rubygems/s3_uri_signer.rb +++ b/lib/rubygems/s3_uri_signer.rb @@ -150,16 +150,23 @@ class Gem::S3URISigner require 'rubygems/request/connection_pools' require 'json' - metadata_uri = URI(EC2_METADATA_CREDENTIALS) - @request_pool ||= create_request_pool(metadata_uri) - request = Gem::Request.new(metadata_uri, Net::HTTP::Get, nil, @request_pool) + iam_info = ec2_metadata_request(EC2_IAM_INFO) + # Expected format: arn:aws:iam::<id>:instance-profile/<role_name> + role_name = iam_info['InstanceProfileArn'].split('/')[1] + ec2_metadata_request(EC2_IAM_SECURITY_CREDENTIALS + role_name) + end + + def ec2_metadata_request(url) + uri = URI(url) + @request_pool ||= create_request_pool(uri) + request = Gem::Request.new(uri, Net::HTTP::Get, nil, @request_pool) response = request.fetch case response when Net::HTTPOK then JSON.parse(response.body) else - raise InstanceProfileError.new("Unable to fetch AWS credentials from #{metadata_uri}: #{response.message} #{response.code}") + raise InstanceProfileError.new("Unable to fetch AWS metadata from #{uri}: #{response.message} #{response.code}") end end @@ -170,6 +177,7 @@ class Gem::S3URISigner end BASE64_URI_TRANSLATE = { "+" => "%2B", "/" => "%2F", "=" => "%3D", "\n" => "" }.freeze - EC2_METADATA_CREDENTIALS = "http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance".freeze + EC2_IAM_INFO = "http://169.254.169.254/latest/meta-data/iam/info".freeze + EC2_IAM_SECURITY_CREDENTIALS = "http://169.254.169.254/latest/meta-data/iam/security-credentials/".freeze end |