Add support for AWS SSO profiles

.gitignore

@@ -1,6 +1,7 @@
 node_modules
 
 *.env
+mantle.yml
 
 *.DS_Store
 

mantle/rbx_mantle/Cargo.toml

@@ -20,7 +20,10 @@ clap = "2.33.0"
 glob = "0.3.0"
 sha2 = "0.9.8"
 difference = "2.0.0"
+dirs-next = "2.0.0"
+rust-ini = "0.20.0"
 rusoto_core = "0.47.0"
+rusoto_sts = "0.48.0"
 rusoto_s3 = "0.47.0"
 tokio = { version = "1", features = ["full"] }
 async-trait = "0.1.51"

mantle/rbx_mantle/src/state/aws_credentials_provider.rs

@@ -1,9 +1,12 @@
 use async_trait::async_trait;
+use dirs_next::home_dir;
+use ini::Ini;
 use rusoto_core::credential::{
     AwsCredentials, ContainerProvider, CredentialsError, EnvironmentProvider,
     InstanceMetadataProvider, ProfileProvider, ProvideAwsCredentials,
 };
 use std::env;
+use std::path::PathBuf;
 use std::time::Duration;
 
 #[derive(Clone, Debug)]
@@ -17,6 +20,17 @@ pub struct AwsCredentialsProvider {
 
 impl AwsCredentialsProvider {
     pub fn new() -> AwsCredentialsProvider {
+        // Set up profile provider using optionally supplied profile name //
+        let profile_provider: Option<ProfileProvider>;
+        if let Ok(profile_name) = env::var("MANTLE_AWS_PROFILE") {
+            let mut provider = ProfileProvider::new().unwrap();
+            provider.set_profile(profile_name);
+            profile_provider = Some(provider);
+        } else {
+            profile_provider = ProfileProvider::new().ok();
+        }
+
+        // Inherit IAM role from instance metadata service or ECS agent role //
         let mut inherit_iam_role = false;
         if let Ok(value) = env::var("MANTLE_AWS_INHERIT_IAM_ROLE") {
             if value == "true" {
@@ -27,7 +41,7 @@ impl AwsCredentialsProvider {
         AwsCredentialsProvider {
             prefixed_environment_provider: EnvironmentProvider::with_prefix("MANTLE_AWS"),
             environment_provider: EnvironmentProvider::default(),
-            profile_provider: ProfileProvider::new().ok(),
+            profile_provider,
             container_provider: if inherit_iam_role {
                 let mut provider = ContainerProvider::new();
                 provider.set_timeout(Duration::from_secs(15));
@@ -46,6 +60,13 @@ impl AwsCredentialsProvider {
     }
 }
 
+fn get_config_path() -> PathBuf {
+    home_dir()
+        .expect("Expected a HOME directory")
+        .join(".aws")
+        .join("config")
+}
+
 async fn chain_provider_credentials(
     provider: AwsCredentialsProvider,
 ) -> Result<AwsCredentials, CredentialsError> {
@@ -56,9 +77,29 @@ async fn chain_provider_credentials(
         return Ok(creds);
     }
     if let Some(ref profile_provider) = provider.profile_provider {
+        // Check standard profile credentials first //
         if let Ok(creds) = profile_provider.credentials().await {
             return Ok(creds);
         }
+
+        // Check SSO profile credentials as fallback //
+        println!("Checking profile provider (sso)");
+        let aws_config = Ini::load_from_file(get_config_path())
+            .expect(format!("Failed to load AWS config ({:?})", get_config_path()).as_str());
+        let profile_name = profile_provider.profile();
+        println!("profile name: {}", profile_name);
+
+        let target_section = aws_config.iter().find(|(section, _)| {
+            section.is_some() && section.unwrap() == format!("profile {}", profile_name)
+        });
+
+        if let Some((section, properties)) = target_section {
+            let section_name = section.unwrap();
+            println!("Section name: {}", section_name);
+            for (key, value) in properties.iter() {
+                println!("{}: {:?}", key, value);
+            }
+        }
     }
     if let Some(ref container_provider) = provider.container_provider {
         if let Ok(creds) = container_provider.credentials().await {