WIP: Implement IAM Authentication

lib/puppet/functions/hiera_vault.rb

@@ -1,5 +1,7 @@
 Puppet::Functions.create_function(:hiera_vault) do
 
+  require_relative 'special_auth'
+
   begin
     require 'json'
   rescue LoadError => e
@@ -82,8 +84,8 @@ def lookup_key(key, options, context)
       return context.not_found
     end
 
-    if vault_token(options).nil?
-      raise ArgumentError, '[hiera-vault] no token set in options and no token in VAULT_TOKEN'
+    if vault_token(options).nil? && !options.key?("authentication")
+      raise ArgumentError, '[hiera-vault] no token set in options, no token in VAULT_TOKEN and no special authentication configured'
     end
 
     result = vault_get(key, options, context)
@@ -119,12 +121,19 @@ def vault_get(key, options, context)
       begin
         $hiera_vault_client.configure do |config|
           config.address = options['address'] unless options['address'].nil?
-          config.token = vault_token(options)
           config.ssl_pem_file = options['ssl_pem_file'] unless options['ssl_pem_file'].nil?
           config.ssl_verify = options['ssl_verify'] unless options['ssl_verify'].nil?
           config.ssl_ca_cert = options['ssl_ca_cert'] if config.respond_to? :ssl_ca_cert
           config.ssl_ca_path = options['ssl_ca_path'] if config.respond_to? :ssl_ca_path
           config.ssl_ciphers = options['ssl_ciphers'] if config.respond_to? :ssl_ciphers
+
+          if options.key?("authentication")
+            context.explain { "[hiera-vault] Using #{options['authentication']['type']} authentication" }
+            authenticate(options['authentication'], $hiera_vault_client, context)
+          else
+            context.explain { "[hiera-vault] Using token authentication" }
+            config.token = vault_token(options)
+          end
         end
 
         if $hiera_vault_client.sys.seal_status.sealed?

lib/puppet/functions/special_auth.rb

@@ -0,0 +1,27 @@
+def authenticate(options, client, context)
+
+  auth_types = {
+    'aws_iam' => method(:aws_iam_auth)
+  }
+
+  auth_types[options['type']].(options['config'], client, context)
+
+end
+
+
+def aws_iam_auth(config, client, context)
+
+  begin
+    require 'aws-sdk-core'
+  rescue LoadError => e
+    raise Puppet::DataBinding::LookupError, "[hiera-vault] Must install aws-sdk-core gem to use AWS IAM authentication"
+  end
+
+  context.explain { "[hiera-vault] Starting aws_iam authentication with config: #{config}" }
+
+  role = config['role']
+
+  client.auth.aws_iam(role, Aws::InstanceProfileCredentials.new)
+
+end
+