Support for access key sessionTokens

lstatro commented 4 years ago

Hi'ya,

I don't see a means to manually supply a sessionToken. Obviously that's not an issue when running on a server logging out to the server's host account, as aws will supply the default creds. However it seems to be an issue should one want to push the logs to another account using creds from a sts assumeRole request.

I welcome feedback anyone may have (admittedly, I may have missed something).

Thanks!

    if (awsAccessKeyId && awsSecretKey && awsRegion) {
      config = { accessKeyId: awsAccessKeyId, secretAccessKey: awsSecretKey, region: awsRegion };
    } else if (awsRegion && !awsAccessKeyId && !awsSecretKey) {
      // Amazon SDK will automatically pull access credentials
      // from IAM Role when running on EC2 but region still
      // needs to be configured
      config = { region: awsRegion };
    }

https://github.com/lazywithclass/winston-cloudwatch/blob/master/index.js#L47

lazywithclass commented 4 years ago

Hi, I'm not aware of what a sessionToken is. It was ages since I used this module and now I am only maintaining it, could you please provide a code example of how you would use this feature?

Also if you could link from the AWS about sessionToken it would be great! Thanks.

lstatro commented 4 years ago

Hi,

Sorry for the delay, here are a few links and an example:

Using Temporary Credentials With AWS Resources

When you make a call using temporary security credentials, the call must include a session token, which is returned along with those temporary credentials. AWS uses the session token to validate the temporary security credentials.
aws-sdk sts.AssumeRole documentation

  const sts = new AWS.STS();
  /* 
    this role would be in another account that 
    has a trust relationship setup with the account hosting 
    this logger specific logger
  */
  let assumedRole = await sts.assumeRole({
    RoleArn: 'myRoleArn',
    RoleSessionName: 'mySessionName'
  }).promise();

  winston.add(new WinstonCloudWatch({
    awsRegion: 'us-east-1',
    awsAccessKeyId: assumedRole.Credentials.AccessKeyId,
    awsSecretKey: assumedRole.Credentials.SecretAccessKey,
    /* 
      awsSessionToken is not a valid option for winston-cloudwatch, 
      but is necessary for api calls that use AssumeRole based creds 
    */
    awsSessionToken: assumedRole.Credentials.SessionToken,
    awsOptions: {
      logStreamName: 'us-east-1'
    },
    logGroupName: 'testing',
    logStreamName: 'first'
  }))

  winston.error('1');

lazywithclass commented 4 years ago

As you might imagine I've been quite busy lately, sorry for the absurd delay in dealing with this. Is this still an issue?

If so, am I right that I would just have to provide an awsSessionToken and use that info to authenticate the calls?

emanueleragni-nova commented 3 years ago

I'm facing the same issue, and yes you are right, it's just needed to add a awsSessionToken in the request. Check this for reference: Using temporary credentials with AWS resources

lazywithclass commented 3 years ago

Ok I will have a look in the following weeks, I might have some free time.

Snapu commented 2 years ago

+1

dsoyez commented 8 months ago

if you use awsOptions?: CloudWatchLogsClientConfig; to provide the credentials object. i guess it should be passed down to aws sdk. That's what i'm using and no issue with sts assumeRole.

lazywithclass / winston-cloudwatch

Support for access key sessionTokens #124