66package config
77
88import (
9+ "context"
910 "crypto/tls"
1011 "crypto/x509"
1112 "encoding/base64"
1213 "encoding/hex"
1314 "encoding/json"
1415 "fmt"
15- "io/ioutil "
16+ "io"
1617 "net/http"
18+ "os"
1719 "regexp"
1820 "strings"
1921
20- "github.com/aws/aws-sdk-go/aws"
21- "github.com/aws/aws-sdk-go/aws/session "
22- "github.com/aws/aws-sdk-go/service/kms"
22+ "github.com/aws/aws-sdk-go-v2 /aws"
23+ "github.com/aws/aws-sdk-go-v2/config "
24+ "github.com/aws/aws-sdk-go-v2 /service/kms"
2325 "github.com/sirupsen/logrus"
2426 "gopkg.in/yaml.v2"
2527
@@ -192,7 +194,7 @@ func awskmsDecrypt(name string, secret load.Secret) string {
192194
193195 if secret .File != "" {
194196 var fileData []byte
195- fileData , err := ioutil .ReadFile (secret .File )
197+ fileData , err := os .ReadFile (secret .File )
196198 if err == nil {
197199 secretData , err = base64 .StdEncoding .DecodeString (string (fileData ))
198200 if err != nil {
@@ -240,43 +242,51 @@ func awskmsDecrypt(name string, secret load.Secret) string {
240242 }
241243
242244 if len (secretData ) > 0 {
243- var sess * session. Session
245+ ctx := context . TODO ()
244246
245- sharedConfigFiles := []string {}
246- if secret .CredentialFile != "" {
247- sharedConfigFiles = append (sharedConfigFiles , secret .CredentialFile )
248- }
249- if secret .ConfigFile != "" {
250- sharedConfigFiles = append (sharedConfigFiles , secret .ConfigFile )
251- }
252-
253- if len (sharedConfigFiles ) > 0 {
247+ var cfg aws.Config
248+ var err error
254249
250+ if secret .CredentialFile != "" || secret .ConfigFile != "" {
255251 load .Logrus .WithFields (logrus.Fields {
256252 "name" : name ,
257253 }).Debug ("config: aws kms decrypt using custom credentials and/or config" )
258254
259- sess = session .Must (session .NewSessionWithOptions (session.Options {
260- SharedConfigState : session .SharedConfigEnable ,
261- SharedConfigFiles : sharedConfigFiles ,
262- }))
255+ var configLoadOptions []func (* config.LoadOptions ) error
256+
257+ if secret .CredentialFile != "" {
258+ configLoadOptions = append (configLoadOptions , config .WithSharedCredentialsFiles ([]string {secret .CredentialFile }))
259+ }
260+ if secret .ConfigFile != "" {
261+ configLoadOptions = append (configLoadOptions , config .WithSharedConfigFiles ([]string {secret .ConfigFile }))
262+ }
263+
264+ cfg , err = config .LoadDefaultConfig (ctx , configLoadOptions ... )
263265 } else {
264266 load .Logrus .WithFields (logrus.Fields {
265267 "name" : name ,
266268 }).Debug ("config: aws kms decrypt using default credentials" )
267- sess = session .Must (session .NewSession (& aws.Config {
268- Region : aws .String (secret .Region ),
269- }))
269+
270+ cfg , err = config .LoadDefaultConfig (ctx , config .WithRegion (secret .Region ))
270271 }
271272
272- kmsClient := kms .New (sess )
273+ if err != nil {
274+ load .Logrus .WithFields (logrus.Fields {
275+ "name" : name ,
276+ "err" : err ,
277+ }).Error ("config: aws config load failed" )
278+ return ""
279+ }
280+
281+ kmsClient := kms .NewFromConfig (cfg )
273282 params := & kms.DecryptInput {
274283 CiphertextBlob : secretData ,
275284 }
276- resp , err := kmsClient .Decrypt (params )
285+ resp , err := kmsClient .Decrypt (ctx , params )
277286 if err != nil {
278287 load .Logrus .WithFields (logrus.Fields {
279288 "name" : name ,
289+ "err" : err ,
280290 }).Error ("config: aws kms decrypt secret failed" )
281291 return ""
282292 }
@@ -325,7 +335,7 @@ func httpWrapper(secret load.Secret) ([]byte, error) {
325335
326336 if secret .HTTP .TLSConfig .Ca != "" {
327337 rootCAs := x509 .NewCertPool ()
328- ca , err := ioutil .ReadFile (secret .HTTP .TLSConfig .Ca )
338+ ca , err := os .ReadFile (secret .HTTP .TLSConfig .Ca )
329339 if err != nil {
330340 load .Logrus .WithError (err ).Error ("config: secret failed to read tls ca" )
331341 } else {
@@ -355,7 +365,7 @@ func httpWrapper(secret load.Secret) ([]byte, error) {
355365 }
356366 defer resp .Body .Close ()
357367
358- bytes , err := ioutil .ReadAll (resp .Body )
368+ bytes , err := io .ReadAll (resp .Body )
359369 if err != nil {
360370 return nil , err
361371 }
@@ -373,7 +383,7 @@ func localDecrypt(name string, secret load.Secret) string {
373383
374384 if secret .File != "" {
375385 var fileData []byte
376- fileData , err := ioutil .ReadFile (secret .File )
386+ fileData , err := os .ReadFile (secret .File )
377387 if err == nil {
378388 secretData , err = hex .DecodeString (string (fileData ))
379389 if err != nil {
0 commit comments