client.py 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245
  1. from functools import wraps
  2. from alibabacloud_credentials_api import ICredentialsProvider
  3. from alibabacloud_credentials import credentials
  4. from alibabacloud_credentials.exceptions import CredentialException
  5. from alibabacloud_credentials.models import Config, CredentialModel
  6. from alibabacloud_credentials.http import HttpOptions
  7. from alibabacloud_credentials.provider import (StaticAKCredentialsProvider,
  8. StaticSTSCredentialsProvider,
  9. RamRoleArnCredentialsProvider,
  10. OIDCRoleArnCredentialsProvider,
  11. RsaKeyPairCredentialsProvider,
  12. EcsRamRoleCredentialsProvider,
  13. URLCredentialsProvider,
  14. DefaultCredentialsProvider)
  15. from alibabacloud_credentials.utils import auth_constant as ac
  16. from Tea.decorators import deprecated
  17. def attribute_error_return_none(f):
  18. @wraps(f)
  19. def i(*args, **kwargs):
  20. try:
  21. return f(*args, **kwargs)
  22. except AttributeError:
  23. return
  24. return i
  25. class _CredentialsProviderWrap:
  26. def __init__(self,
  27. *,
  28. type_name: str = None,
  29. provider: ICredentialsProvider = None):
  30. self.type_name = type_name
  31. self.provider = provider
  32. def get_access_key_id(self) -> str:
  33. credential = self.provider.get_credentials()
  34. return credential.get_access_key_id()
  35. async def get_access_key_id_async(self) -> str:
  36. credential = await self.provider.get_credentials_async()
  37. return credential.get_access_key_id()
  38. def get_access_key_secret(self) -> str:
  39. credential = self.provider.get_credentials()
  40. return credential.get_access_key_secret()
  41. async def get_access_key_secret_async(self) -> str:
  42. credential = await self.provider.get_credentials_async()
  43. return credential.get_access_key_secret()
  44. def get_security_token(self):
  45. credential = self.provider.get_credentials()
  46. return credential.get_security_token()
  47. async def get_security_token_async(self):
  48. credential = await self.provider.get_credentials_async()
  49. return credential.get_security_token()
  50. def get_credential(self) -> CredentialModel:
  51. credential = self.provider.get_credentials()
  52. return CredentialModel(
  53. access_key_id=credential.get_access_key_id(),
  54. access_key_secret=credential.get_access_key_secret(),
  55. security_token=credential.get_security_token(),
  56. type=self.type_name,
  57. provider_name=credential.get_provider_name(),
  58. )
  59. async def get_credential_async(self) -> CredentialModel:
  60. credential = await self.provider.get_credentials_async()
  61. return CredentialModel(
  62. access_key_id=credential.get_access_key_id(),
  63. access_key_secret=credential.get_access_key_secret(),
  64. security_token=credential.get_security_token(),
  65. type=self.type_name,
  66. provider_name=credential.get_provider_name(),
  67. )
  68. def get_type(self) -> str:
  69. return self.type_name
  70. class Client:
  71. cloud_credential = None
  72. def __init__(self,
  73. config: Config = None,
  74. provider: ICredentialsProvider = None):
  75. if provider is not None:
  76. self.cloud_credential = _CredentialsProviderWrap(type_name=provider.get_provider_name(), provider=provider)
  77. elif config is None:
  78. provider = DefaultCredentialsProvider()
  79. self.cloud_credential = _CredentialsProviderWrap(type_name='default', provider=provider)
  80. else:
  81. self.cloud_credential = Client.get_credentials(config)
  82. def get_credential(self) -> CredentialModel:
  83. """
  84. Get credential
  85. @return: the whole credential
  86. """
  87. return self.cloud_credential.get_credential()
  88. async def get_credential_async(self) -> CredentialModel:
  89. """
  90. Get credential
  91. @return: the whole credential
  92. """
  93. return await self.cloud_credential.get_credential_async()
  94. @staticmethod
  95. def get_credentials(config):
  96. if config.type == ac.ACCESS_KEY:
  97. provider = StaticAKCredentialsProvider(
  98. access_key_id=config.access_key_id,
  99. access_key_secret=config.access_key_secret,
  100. )
  101. return _CredentialsProviderWrap(type_name='access_key', provider=provider)
  102. elif config.type == ac.STS:
  103. provider = StaticSTSCredentialsProvider(
  104. access_key_id=config.access_key_id,
  105. access_key_secret=config.access_key_secret,
  106. security_token=config.security_token,
  107. )
  108. return _CredentialsProviderWrap(type_name='sts', provider=provider)
  109. elif config.type == ac.BEARER:
  110. return credentials.BearerTokenCredential(config.bearer_token)
  111. elif config.type == ac.ECS_RAM_ROLE:
  112. provider = EcsRamRoleCredentialsProvider(
  113. role_name=config.role_name,
  114. disable_imds_v1=config.disable_imds_v1,
  115. http_options=HttpOptions(
  116. read_timeout=config.timeout,
  117. connect_timeout=config.connect_timeout,
  118. proxy=config.proxy,
  119. ),
  120. )
  121. return _CredentialsProviderWrap(type_name='ecs_ram_role', provider=provider)
  122. elif config.type == ac.CREDENTIALS_URI:
  123. provider = URLCredentialsProvider(
  124. uri=config.credentials_uri,
  125. http_options=HttpOptions(
  126. read_timeout=config.timeout,
  127. connect_timeout=config.connect_timeout,
  128. proxy=config.proxy,
  129. ),
  130. )
  131. return _CredentialsProviderWrap(type_name='credentials_uri', provider=provider)
  132. elif config.type == ac.RAM_ROLE_ARN:
  133. if config.security_token is not None and config.security_token != '':
  134. previous_provider = StaticSTSCredentialsProvider(
  135. access_key_id=config.access_key_id,
  136. access_key_secret=config.access_key_secret,
  137. security_token=config.security_token,
  138. )
  139. else:
  140. previous_provider = StaticAKCredentialsProvider(
  141. access_key_id=config.access_key_id,
  142. access_key_secret=config.access_key_secret,
  143. )
  144. provider = RamRoleArnCredentialsProvider(
  145. credentials_provider=previous_provider,
  146. role_arn=config.role_arn,
  147. role_session_name=config.role_session_name,
  148. duration_seconds=config.role_session_expiration,
  149. policy=config.policy,
  150. external_id=config.external_id,
  151. sts_endpoint=config.sts_endpoint,
  152. http_options=HttpOptions(
  153. read_timeout=config.timeout,
  154. connect_timeout=config.connect_timeout,
  155. proxy=config.proxy,
  156. ),
  157. )
  158. return _CredentialsProviderWrap(type_name='ram_role_arn', provider=provider)
  159. elif config.type == ac.RSA_KEY_PAIR:
  160. provider = RsaKeyPairCredentialsProvider(
  161. public_key_id=config.public_key_id,
  162. private_key_file=config.private_key_file,
  163. duration_seconds=config.role_session_expiration,
  164. sts_endpoint=config.sts_endpoint,
  165. http_options=HttpOptions(
  166. read_timeout=config.timeout,
  167. connect_timeout=config.connect_timeout,
  168. proxy=config.proxy,
  169. ),
  170. )
  171. return _CredentialsProviderWrap(type_name='rsa_key_pair', provider=provider)
  172. elif config.type == ac.OIDC_ROLE_ARN:
  173. provider = OIDCRoleArnCredentialsProvider(
  174. role_arn=config.role_arn,
  175. oidc_provider_arn=config.oidc_provider_arn,
  176. oidc_token_file_path=config.oidc_token_file_path,
  177. role_session_name=config.role_session_name,
  178. duration_seconds=config.role_session_expiration,
  179. policy=config.policy,
  180. sts_endpoint=config.sts_endpoint,
  181. http_options=HttpOptions(
  182. read_timeout=config.timeout,
  183. connect_timeout=config.connect_timeout,
  184. proxy=config.proxy,
  185. ),
  186. )
  187. return _CredentialsProviderWrap(type_name='oidc_role_arn', provider=provider)
  188. raise CredentialException(
  189. 'invalid type option, support: access_key, sts, bearer, ecs_ram_role, ram_role_arn, rsa_key_pair, oidc_role_arn, credentials_uri')
  190. @deprecated("Use 'get_credential().access_key_id' instead")
  191. def get_access_key_id(self):
  192. return self.cloud_credential.get_access_key_id()
  193. @deprecated("Use 'get_credential().access_key_secret' instead")
  194. def get_access_key_secret(self):
  195. return self.cloud_credential.get_access_key_secret()
  196. @deprecated("Use 'get_credential().security_token' instead")
  197. def get_security_token(self):
  198. return self.cloud_credential.get_security_token()
  199. @deprecated("Use 'get_credential_async().access_key_id' instead")
  200. async def get_access_key_id_async(self):
  201. return await self.cloud_credential.get_access_key_id_async()
  202. @deprecated("Use 'get_credential_async().access_key_secret' instead")
  203. async def get_access_key_secret_async(self):
  204. return await self.cloud_credential.get_access_key_secret_async()
  205. @deprecated("Use 'get_credential_async().security_token' instead")
  206. async def get_security_token_async(self):
  207. return await self.cloud_credential.get_security_token_async()
  208. @deprecated("Use 'get_credential().type' instead")
  209. @attribute_error_return_none
  210. def get_type(self):
  211. return self.cloud_credential.get_type()
  212. @deprecated("Use 'get_credential().bearer_token' instead")
  213. @attribute_error_return_none
  214. def get_bearer_token(self):
  215. return self.cloud_credential.bearer_token