#4745 S3 storage: Authenticate using Amazon IAM Role

inc/classes/BxDolStorageS3v4alt.php

@@ -24,14 +24,28 @@ class BxDolStorageS3v4alt extends BxDolStorageS3
 {
     protected function init ($aObject)
     {
+        $sAccessKey = getParam('sys_storage_s3_access_key'),
+        $sSecretKey = getParam('sys_storage_s3_secret_key'),
+        $aCredentials = [];
+        if (getParam('sys_storage_s3_amz_iam_role')) {
+            $sRole = bx_file_get_contents('http://169.254.169.254/latest/meta-data/iam/security-credentials/');
+            $sCredentials = bx_file_get_contents('http://169.254.169.254/latest/meta-data/iam/security-credentials/' . $role);
+            if ($sCredentials && ($aCredentials = @json_decode($sCredentials, true))) {
+                $sAccessKey = $aCredentials['AccessKeyId'];
+            	$sSecretKey = $aCredentials['SecretAccessKey'];
+            }
+        }
+
         $oConfiguration = new Akeeba\Engine\Postproc\Connector\S3v4\Configuration(
-            getParam('sys_storage_s3_access_key'),
-            getParam('sys_storage_s3_secret_key'),
+            $sAccessKey,
+            $sSecretKey,
             getParam('sys_storage_s3_sig_ver'),
             getParam('sys_storage_s3_region')
         );
         if ($this->_sEndpoint)
             $oConfiguration->setEndpoint($this->_sEndpoint);
+        if ($aCredentials && isset($aCredentials['Token']))
+            $oConfiguration->setToken($aCredentials['Token']);
 
         $this->_s3 = new Akeeba\Engine\Postproc\Connector\S3v4\Connector($oConfiguration);
     }

install/sql/system.sql

@@ -608,8 +608,8 @@ INSERT INTO `sys_options`(`category_id`, `name`, `caption`, `value`, `type`, `ex
 (@iCategoryId, 'sys_storage_s3_domain', '_adm_stg_cpt_option_sys_storage_s3_domain', '', 'digit', '', '', '', 5),
 (@iCategoryId, 'sys_storage_s3_endpoint', '_adm_stg_cpt_option_sys_storage_s3_endpoint', '', 'digit', '', '', '', 6),
 (@iCategoryId, 'sys_storage_s3_sig_ver', '_adm_stg_cpt_option_sys_storage_s3_sig_ver', 'v2', 'select', 'v2,v4', '', '', 7),
-(@iCategoryId, 'sys_storage_s3_region', '_adm_stg_cpt_option_sys_storage_s3_region', '', 'digit', '', '', '', 8);
-
+(@iCategoryId, 'sys_storage_s3_region', '_adm_stg_cpt_option_sys_storage_s3_region', '', 'digit', '', '', '', 8),
+(@iCategoryId, 'sys_storage_s3_amz_iam_role', '_adm_stg_cpt_option_sys_storage_s3_amz_iam_role', '', 'checkbox', '', '', '', 10);
 --
 -- CATEGORY: Account
 --

modules/boonex/english/data/langs/system/en.xml

@@ -1688,6 +1688,7 @@
 	<string name="_adm_stg_cpt_option_sys_storage_s3_endpoint"><![CDATA[Endpoint (specify if other than Amazon, such as storage.googleapis.com, s3.wasabisys.com)]]></string>
 	<string name="_adm_stg_cpt_option_sys_storage_s3_sig_ver"><![CDATA[Signature version (only S3v4alt storage supports both v2 and v4)]]></string>
 	<string name="_adm_stg_cpt_option_sys_storage_s3_region"><![CDATA[Region (for signature v4 only)]]></string>
+    <string name="_adm_stg_cpt_option_sys_storage_s3_amz_iam_role"><![CDATA[Authenticate using Amazon  IAM Role (S3v4alt storage only)]]></string>
 
     <string name="_adm_stg_cpt_option_sys_template_cache_image_enable"><![CDATA[Enable cache for images]]></string>
     <string name="_adm_stg_cpt_option_sys_template_cache_image_max_size"><![CDATA[Cached image max size (in Kb)]]></string>

modules/boonex/russian/data/langs/system/ru.xml

@@ -1663,6 +1663,7 @@
 	<string name="_adm_stg_cpt_option_sys_storage_s3_endpoint"><![CDATA[Endpoint (например storage.googleapis.com или s3.wasabisys.com, для Amazon оставивить пустым)]]></string>
 	<string name="_adm_stg_cpt_option_sys_storage_s3_sig_ver"><![CDATA[Версия подписи (только S3v4alt движок поддерживает обе версии v4 и v2)]]></string>
 	<string name="_adm_stg_cpt_option_sys_storage_s3_region"><![CDATA[Регион (только для подписи v4)]]></string>
+    <string name="_adm_stg_cpt_option_sys_storage_s3_amz_iam_role"><![CDATA[Аутентификация с использованием Amazon IAM Role (только для S3v4alt)]]></string>
 
     <string name="_adm_stg_cpt_option_sys_template_cache_image_enable"><![CDATA[Задействовать кэш для изображений]]></string>
     <string name="_adm_stg_cpt_option_sys_template_cache_image_max_size"><![CDATA[Максимальный размер кэшируемого изображения (в Кб)]]></string>