Allow assume role

src/main/java/hudson/plugins/s3/ClientHelper.java

@@ -1,16 +1,20 @@
 package hudson.plugins.s3;
 
 import com.amazonaws.ClientConfiguration;
+import com.amazonaws.auth.AWSCredentialsProvider;
+import com.amazonaws.auth.AWSStaticCredentialsProvider;
 import com.amazonaws.auth.BasicAWSCredentials;
+import com.amazonaws.auth.STSAssumeRoleSessionCredentialsProvider;
 import com.amazonaws.regions.Region;
 import com.amazonaws.regions.RegionUtils;
 import com.amazonaws.regions.Regions;
 import com.amazonaws.services.s3.AmazonS3;
 import com.amazonaws.services.s3.AmazonS3Client;
+import com.amazonaws.services.s3.AmazonS3ClientBuilder;
+import org.apache.commons.lang.StringUtils;
 import hudson.ProxyConfiguration;
 
 import java.util.regex.Pattern;
-
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
@@ -19,20 +23,67 @@ public class ClientHelper {
  "hudson.plugins.s3.DEFAULT_AMAZON_S3_REGION",
  com.amazonaws.services.s3.model.Region.US_Standard.toAWSRegion().getName());
 
- public static AmazonS3Client createClient(String accessKey, String secretKey, boolean useRole, String region, ProxyConfiguration proxy)
- {
- Region awsRegion = getRegionFromString(region);
+ public static class Builder {
+  private final ProxyConfiguration proxyConfiguration;
+ private final String region;
 
- ClientConfiguration clientConfiguration = getClientConfiguration(proxy, awsRegion);
+ public Builder(String region, ProxyConfiguration proxyConfiguration) {
+ this.region = region;
+ this.proxyConfiguration = proxyConfiguration;
+ }
 
- final AmazonS3Client client;
- if (useRole) {
- client = new AmazonS3Client(clientConfiguration);
- } else {
- client = new AmazonS3Client(new BasicAWSCredentials(accessKey, secretKey), clientConfiguration);
+ public AmazonS3 build(String accessKey, String secretKey) {
+ return this.buildClient(new AWSStaticCredentialsProvider(new BasicAWSCredentials(accessKey, secretKey)));
+ }
+
+ public AmazonS3 build(String assumeRole) {
+ return this.buildClient(new STSAssumeRoleSessionCredentialsProvider.Builder(assumeRole, "jenkins-s3-plugin").build());
  }
 
- client.setRegion(awsRegion);
+ public AmazonS3 build() {
+ return this.buildClient(null);
+ }
+
+ private AmazonS3 buildClient(@Nullable AWSCredentialsProvider awsCredentialsProvider) {
+ Region awsRegion = getRegionFromString(region);
+
+ ClientConfiguration clientConfiguration = getClientConfiguration(proxyConfiguration, awsRegion);
+
+ final AmazonS3 client;
+ if (awsCredentialsProvider != null) {
+ client = new AmazonS3Client(awsCredentialsProvider, clientConfiguration);
+ } else {
+ client = new AmazonS3Client(clientConfiguration);
+ }
+
+ client.setRegion(awsRegion);
+
+ return client;
+ }
+ }
+
+ /**
+ * @deprecated use {@link ClientHelper.Builder} instead
+ */
+ @Deprecated
+ public static AmazonS3 createClient(
+ String accessKey,
+ String secretKey,
+ boolean useRole,
+ String assumeRole,
+ String region,
+ ProxyConfiguration proxy
+ ) {
+ Builder builder = new Builder(region, proxy);
+
+ final AmazonS3 client;
+ if (StringUtils.isNotEmpty(assumeRole)) {
+ client = builder.build(assumeRole);
+ } else if (useRole) {
+ client = builder.build();
+ } else {
+ client = builder.build(accessKey, secretKey);
+ }
 
  return client;
  }

src/main/java/hudson/plugins/s3/Entry.java

@@ -3,11 +3,11 @@
 import com.amazonaws.regions.Region;
 import com.amazonaws.regions.RegionUtils;
 import com.amazonaws.services.s3.AmazonS3;
+import org.kohsuke.stapler.DataBoundConstructor;
 import hudson.Extension;
 import hudson.model.Describable;
 import hudson.model.Descriptor;
 import hudson.util.ListBoxModel;
-import org.kohsuke.stapler.DataBoundConstructor;
 
 import java.util.List;
 

src/main/java/hudson/plugins/s3/FileHelper.java

@@ -1,7 +1,7 @@
 package hudson.plugins.s3;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import org.apache.tools.ant.types.selectors.FilenameSelector;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 
 import java.io.File;
 
@@ -60,4 +60,4 @@ public static int getSearchPathLength(String workSpace, String filterExpanded, b
  return file2.getParent().length() + 1;
  }
  }
-}
+}

src/main/java/hudson/plugins/s3/S3ArtifactsAction.java

@@ -1,25 +1,22 @@
 package hudson.plugins.s3;
 
-import java.io.File;
-import java.io.IOException;
-
-import java.util.Date;
-import java.util.List;
-
-import javax.servlet.ServletException;
+import static javax.servlet.http.HttpServletResponse.SC_NOT_FOUND;
 
-import com.amazonaws.services.s3.AmazonS3Client;
+import com.amazonaws.services.s3.AmazonS3;
 import com.amazonaws.services.s3.model.GeneratePresignedUrlRequest;
 import com.amazonaws.services.s3.model.ResponseHeaderOverrides;
-import jenkins.model.RunAction2;
 import org.kohsuke.stapler.StaplerRequest;
 import org.kohsuke.stapler.StaplerResponse;
-
-import hudson.model.Run;
 import org.kohsuke.stapler.export.Exported;
 import org.kohsuke.stapler.export.ExportedBean;
+import hudson.model.Run;
+import jenkins.model.RunAction2;
 
-import static javax.servlet.http.HttpServletResponse.SC_NOT_FOUND;
+import java.io.File;
+import java.io.IOException;
+import java.util.Date;
+import java.util.List;
+import javax.servlet.ServletException;
 
 @ExportedBean
 public class S3ArtifactsAction implements RunAction2 {
@@ -77,7 +74,7 @@ public void doDownload(final StaplerRequest request, final StaplerResponse respo
  for (FingerprintRecord record : artifacts) {
  if (record.getArtifact().getName().equals(artifact)) {
  final S3Profile s3 = S3BucketPublisher.getProfile(profile);
- final AmazonS3Client client = s3.getClient(record.getArtifact().getRegion());
+ final AmazonS3 client = s3.getClient(record.getArtifact().getRegion());
  final String url = getDownloadURL(client, s3.getSignedUrlExpirySeconds(), build, record);
  response.sendRedirect2(url);
  return;
@@ -94,7 +91,7 @@ public void doDownload(final StaplerRequest request, final StaplerResponse respo
  * download and there's no need for the user to have credentials to
  * access S3.
  */
- private String getDownloadURL(AmazonS3Client client, int signedUrlExpirySeconds, Run run, FingerprintRecord record) {
+ private String getDownloadURL(AmazonS3 client, int signedUrlExpirySeconds, Run run, FingerprintRecord record) {
  final Destination dest = Destination.newFromRun(run, record.getArtifact());
  final GeneratePresignedUrlRequest request = new GeneratePresignedUrlRequest(dest.bucketName, dest.objectName);
  request.setExpiration(new Date(System.currentTimeMillis() + signedUrlExpirySeconds*1000));

src/main/java/hudson/plugins/s3/S3BucketPublisher.java

@@ -1,11 +1,20 @@
 package hudson.plugins.s3;
 
-import com.amazonaws.AmazonClientException;
-import com.amazonaws.regions.Region;
-import com.amazonaws.services.s3.AmazonS3Client;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.Lists;
 import com.google.common.collect.Maps;
+
+import com.amazonaws.AmazonClientException;
+import com.amazonaws.regions.Region;
+import com.amazonaws.services.s3.AmazonS3;
+import net.sf.json.JSONArray;
+import net.sf.json.JSONObject;
+import org.apache.commons.lang.StringUtils;
+import org.jenkinsci.Symbol;
+import org.kohsuke.stapler.DataBoundConstructor;
+import org.kohsuke.stapler.QueryParameter;
+import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.AbortException;
 import hudson.Extension;
@@ -30,17 +39,7 @@
 import hudson.util.Secret;
 import jenkins.model.Jenkins;
 import jenkins.tasks.SimpleBuildStep;
-import net.sf.json.JSONArray;
-import net.sf.json.JSONObject;
-import org.apache.commons.lang.StringUtils;
-import org.jenkinsci.Symbol;
-import org.kohsuke.stapler.DataBoundConstructor;
-import org.kohsuke.stapler.QueryParameter;
-import org.kohsuke.stapler.StaplerRequest;
-import org.kohsuke.stapler.StaplerResponse;
-import org.kohsuke.stapler.interceptor.RequirePOST;
 
-import javax.annotation.Nonnull;
 import java.io.IOException;
 import java.io.PrintStream;
 import java.util.ArrayList;
@@ -50,6 +49,8 @@
 import java.util.Map;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import javax.annotation.Nonnull;
+import javax.servlet.ServletException;
 
 public final class S3BucketPublisher extends Recorder implements SimpleBuildStep {
 
@@ -510,14 +511,33 @@ public Result[] getPluginFailureResultConstraints() {
  return pluginFailureResultConstraints.clone();
  }
 
+ private FormValidation doCheckAssumeRole(String assumeRole) {
+ if(StringUtils.isEmpty(assumeRole)) {
+ return FormValidation.ok();
+ }
+
+ final String defaultRegion = ClientHelper.DEFAULT_AMAZON_S3_REGION_NAME;
+ final AmazonS3 client = new ClientHelper.Builder(defaultRegion, Jenkins.get().proxy).build(assumeRole);
+
+ try {
+ client.listBuckets();
+ } catch (AmazonClientException e) {
+ LOGGER.log(Level.SEVERE, e.getMessage(), e);
+ return FormValidation.error("Cannot list buckets from S3: " + e.getMessage());
+ }
+ return FormValidation.ok("Successfully assumed role: " + assumeRole);
+ }
+
  @SuppressWarnings("unused")
  @RequirePOST
  public FormValidation doLoginCheck(@QueryParameter String name, @QueryParameter String accessKey,
- @QueryParameter Secret secretKey, @QueryParameter boolean useRole) {
+ @QueryParameter Secret secretKey, @QueryParameter String assumeRole,
+ @QueryParameter boolean useRole) {
  Jenkins.get().checkPermission(Jenkins.ADMINISTER);
 
  final String checkedName = Util.fixNull(name);
  final String checkedAccessKey = Util.fixNull(accessKey);
+ final String checkedAssumeRole = Util.fixNull(assumeRole);
  final String checkedSecretKey = secretKey != null ? secretKey.getPlainText() : "";
 
  final boolean couldBeValidated = !checkedName.isEmpty() && !checkedAccessKey.isEmpty() && !checkedSecretKey.isEmpty();
@@ -531,6 +551,11 @@ public FormValidation doLoginCheck(@QueryParameter String name, @QueryParameter
  return FormValidation.ok();
  }
 
+ if (!checkedAssumeRole.isEmpty()) {
+ return doCheckAssumeRole(checkedAssumeRole);
+ }
+
+
  if (checkedAccessKey.isEmpty()) {
  return FormValidation.ok("Please, enter accessKey");
  }
@@ -541,8 +566,8 @@ public FormValidation doLoginCheck(@QueryParameter String name, @QueryParameter
  }
 
  final String defaultRegion = ClientHelper.DEFAULT_AMAZON_S3_REGION_NAME;
- final AmazonS3Client client = ClientHelper.createClient(
- checkedAccessKey, checkedSecretKey, useRole, defaultRegion, Jenkins.get().proxy);
+ final AmazonS3 client = ClientHelper.createClient(
+ checkedAccessKey, checkedSecretKey, useRole, assumeRole, defaultRegion, Jenkins.get().proxy);
 
  try {
  client.listBuckets();

src/main/java/hudson/plugins/s3/S3CopyArtifact.java

@@ -24,6 +24,13 @@
 package hudson.plugins.s3;
 
 import com.google.common.collect.Maps;
+
+import org.acegisecurity.GrantedAuthority;
+import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
+import org.jenkinsci.Symbol;
+import org.kohsuke.stapler.AncestorInPath;
+import org.kohsuke.stapler.DataBoundConstructor;
+import org.kohsuke.stapler.QueryParameter;
 import hudson.DescriptorExtensionList;
 import hudson.EnvVars;
 import hudson.Extension;
@@ -62,6 +69,8 @@
 import hudson.tasks.Fingerprinter.FingerprintAction;
 import hudson.util.DescribableList;
 import hudson.util.FormValidation;
+import jenkins.model.Jenkins;
+import jenkins.tasks.SimpleBuildStep;
 
 import java.io.IOException;
 import java.io.PrintStream;
@@ -72,17 +81,6 @@
 import java.util.Map;
 import java.util.logging.Level;
 import java.util.logging.Logger;
-
-import jenkins.model.Jenkins;
-
-import jenkins.tasks.SimpleBuildStep;
-import org.acegisecurity.GrantedAuthority;
-import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
-import org.jenkinsci.Symbol;
-import org.kohsuke.stapler.AncestorInPath;
-import org.kohsuke.stapler.DataBoundConstructor;
-import org.kohsuke.stapler.QueryParameter;
-
 import javax.annotation.Nonnull;
 
 /**