Allow assume role with acl

src/main/java/hudson/plugins/s3/ClientHelper.java

@@ -1,16 +1,20 @@
 package hudson.plugins.s3;
 
 import com.amazonaws.ClientConfiguration;
+import com.amazonaws.auth.AWSCredentialsProvider;
+import com.amazonaws.auth.AWSStaticCredentialsProvider;
 import com.amazonaws.auth.BasicAWSCredentials;
+import com.amazonaws.auth.STSAssumeRoleSessionCredentialsProvider;
 import com.amazonaws.regions.Region;
 import com.amazonaws.regions.RegionUtils;
 import com.amazonaws.regions.Regions;
 import com.amazonaws.services.s3.AmazonS3;
 import com.amazonaws.services.s3.AmazonS3Client;
+import com.amazonaws.services.s3.AmazonS3ClientBuilder;
+import org.apache.commons.lang.StringUtils;
 import hudson.ProxyConfiguration;
 
 import java.util.regex.Pattern;
-
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
@@ -19,20 +23,67 @@ public class ClientHelper {
             "hudson.plugins.s3.DEFAULT_AMAZON_S3_REGION",
             com.amazonaws.services.s3.model.Region.US_Standard.toAWSRegion().getName());
 
-    public static AmazonS3Client createClient(String accessKey, String secretKey, boolean useRole, String region, ProxyConfiguration proxy)
-    {
-        Region awsRegion = getRegionFromString(region);
+    public static class Builder {
+        private final ProxyConfiguration proxyConfiguration;
+        private final String region;
 
-        ClientConfiguration clientConfiguration = getClientConfiguration(proxy, awsRegion);
+        public Builder(String region, ProxyConfiguration proxyConfiguration) {
+            this.region = region;
+            this.proxyConfiguration = proxyConfiguration;
+        }
 
-        final AmazonS3Client client;
-        if (useRole) {
-            client = new AmazonS3Client(clientConfiguration);
-        } else {
-            client = new AmazonS3Client(new BasicAWSCredentials(accessKey, secretKey), clientConfiguration);
+        public AmazonS3 build(String accessKey, String secretKey) {
+            return this.buildClient(new AWSStaticCredentialsProvider(new BasicAWSCredentials(accessKey, secretKey)));
+        }
+
+        public AmazonS3 build(String assumeRole) {
+            return this.buildClient(new STSAssumeRoleSessionCredentialsProvider.Builder(assumeRole, "jenkins-s3-plugin").build());
         }
 
-        client.setRegion(awsRegion);
+        public AmazonS3 build() {
+            return this.buildClient(null);
+        }
+
+        private AmazonS3 buildClient(@Nullable AWSCredentialsProvider awsCredentialsProvider) {
+            Region awsRegion = getRegionFromString(region);
+
+            ClientConfiguration clientConfiguration = getClientConfiguration(proxyConfiguration, awsRegion);
+
+            final AmazonS3 client;
+            if (awsCredentialsProvider != null) {
+                client = new AmazonS3Client(awsCredentialsProvider, clientConfiguration);
+            } else {
+                client = new AmazonS3Client(clientConfiguration);
+            }
+
+            client.setRegion(awsRegion);
+
+            return client;
+        }
+    }
+
+    /**
+     * @deprecated use {@link ClientHelper.Builder} instead
+     */
+    @Deprecated
+    public static AmazonS3 createClient(
+        String accessKey,
+        String secretKey,
+        boolean useRole,
+        String assumeRole,
+        String region,
+        ProxyConfiguration proxy
+    ) {
+        Builder builder = new Builder(region, proxy);
+
+        final AmazonS3 client;
+        if (StringUtils.isNotEmpty(assumeRole)) {
+            client = builder.build(assumeRole);
+        } else if (useRole) {
+            client = builder.build();
+        } else {
+            client = builder.build(accessKey, secretKey);
+        }
 
         return client;
     }

src/main/java/hudson/plugins/s3/Entry.java

@@ -3,11 +3,12 @@
 import com.amazonaws.regions.Region;
 import com.amazonaws.regions.RegionUtils;
 import com.amazonaws.services.s3.AmazonS3;
+import com.amazonaws.services.s3.model.CannedAccessControlList;
+import org.kohsuke.stapler.DataBoundConstructor;
 import hudson.Extension;
 import hudson.model.Describable;
 import hudson.model.Descriptor;
 import hudson.util.ListBoxModel;
-import org.kohsuke.stapler.DataBoundConstructor;
 
 import java.util.List;
 
@@ -64,6 +65,11 @@ public final class Entry implements Describable<Entry> {
      */
     public boolean useServerSideEncryption;
 
+    /**
+     * Use this canned ACL when uploading
+     */
+    public String cannedACL;
+
     /**
      * Flatten directories
      */
@@ -93,7 +99,7 @@ public final class Entry implements Describable<Entry> {
     @DataBoundConstructor
     public Entry(String bucket, String sourceFile, String excludedFile, String storageClass, String selectedRegion,
                  boolean noUploadOnFailure, boolean uploadFromSlave, boolean managedArtifacts,
-                 boolean useServerSideEncryption, boolean flatten, boolean gzipFiles, boolean keepForever,
+                 boolean useServerSideEncryption, String cannedACL, boolean flatten, boolean gzipFiles, boolean keepForever,
                  boolean showDirectlyInBrowser, List<MetadataPair> userMetadata) {
         this.bucket = bucket;
         this.sourceFile = sourceFile;
@@ -104,6 +110,7 @@ public Entry(String bucket, String sourceFile, String excludedFile, String stora
         this.uploadFromSlave = uploadFromSlave;
         this.managedArtifacts = managedArtifacts;
         this.useServerSideEncryption = useServerSideEncryption;
+        this.cannedACL = cannedACL;
         this.flatten = flatten;
         this.gzipFiles = gzipFiles;
         this.keepForever = keepForever;
@@ -134,6 +141,14 @@ public ListBoxModel doFillStorageClassItems() {
             return model;
         }
 
+        public ListBoxModel doFillCannedACLItems() {
+            final ListBoxModel model = new ListBoxModel();
+            for (CannedAccessControlList cannedAccessControlList : CannedAccessControlList.values()) {
+                model.add(cannedAccessControlList.toString(), cannedAccessControlList.name());
+            }
+            return model;
+        }
+
         public ListBoxModel doFillSelectedRegionItems() {
             final ListBoxModel model = new ListBoxModel();
             for (Region r : regions) {

src/main/java/hudson/plugins/s3/FileHelper.java

@@ -1,7 +1,7 @@
 package hudson.plugins.s3;
 
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import org.apache.tools.ant.types.selectors.FilenameSelector;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 
 import java.io.File;
 
@@ -60,4 +60,4 @@ public static int getSearchPathLength(String workSpace, String filterExpanded, b
             return file2.getParent().length() + 1;
         }
     }
-}
+}

src/main/java/hudson/plugins/s3/S3ArtifactsAction.java

@@ -1,25 +1,22 @@
 package hudson.plugins.s3;
 
-import java.io.File;
-import java.io.IOException;
-
-import java.util.Date;
-import java.util.List;
-
-import javax.servlet.ServletException;
+import static javax.servlet.http.HttpServletResponse.SC_NOT_FOUND;
 
-import com.amazonaws.services.s3.AmazonS3Client;
+import com.amazonaws.services.s3.AmazonS3;
 import com.amazonaws.services.s3.model.GeneratePresignedUrlRequest;
 import com.amazonaws.services.s3.model.ResponseHeaderOverrides;
-import jenkins.model.RunAction2;
 import org.kohsuke.stapler.StaplerRequest;
 import org.kohsuke.stapler.StaplerResponse;
-
-import hudson.model.Run;
 import org.kohsuke.stapler.export.Exported;
 import org.kohsuke.stapler.export.ExportedBean;
+import hudson.model.Run;
+import jenkins.model.RunAction2;
 
-import static javax.servlet.http.HttpServletResponse.SC_NOT_FOUND;
+import java.io.File;
+import java.io.IOException;
+import java.util.Date;
+import java.util.List;
+import javax.servlet.ServletException;
 
 @ExportedBean
 public class S3ArtifactsAction implements RunAction2 {
@@ -77,7 +74,7 @@ public void doDownload(final StaplerRequest request, final StaplerResponse respo
         for (FingerprintRecord record : artifacts) {
             if (record.getArtifact().getName().equals(artifact)) {
                 final S3Profile s3 = S3BucketPublisher.getProfile(profile);
-                final AmazonS3Client client = s3.getClient(record.getArtifact().getRegion());
+                final AmazonS3 client = s3.getClient(record.getArtifact().getRegion());
                 final String url = getDownloadURL(client, s3.getSignedUrlExpirySeconds(), build, record);
                 response.sendRedirect2(url);
                 return;
@@ -94,7 +91,7 @@ public void doDownload(final StaplerRequest request, final StaplerResponse respo
      * download and there's no need for the user to have credentials to
      * access S3.
      */
-    private String getDownloadURL(AmazonS3Client client, int signedUrlExpirySeconds, Run run, FingerprintRecord record) {
+    private String getDownloadURL(AmazonS3 client, int signedUrlExpirySeconds, Run run, FingerprintRecord record) {
         final Destination dest = Destination.newFromRun(run, record.getArtifact());
         final GeneratePresignedUrlRequest request = new GeneratePresignedUrlRequest(dest.bucketName, dest.objectName);
         request.setExpiration(new Date(System.currentTimeMillis() + signedUrlExpirySeconds*1000));

src/main/java/hudson/plugins/s3/S3BucketPublisher.java

@@ -1,11 +1,20 @@
 package hudson.plugins.s3;
 
-import com.amazonaws.AmazonClientException;
-import com.amazonaws.regions.Region;
-import com.amazonaws.services.s3.AmazonS3Client;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.Lists;
 import com.google.common.collect.Maps;
+
+import com.amazonaws.AmazonClientException;
+import com.amazonaws.regions.Region;
+import com.amazonaws.services.s3.AmazonS3;
+import net.sf.json.JSONArray;
+import net.sf.json.JSONObject;
+import org.apache.commons.lang.StringUtils;
+import org.jenkinsci.Symbol;
+import org.kohsuke.stapler.DataBoundConstructor;
+import org.kohsuke.stapler.QueryParameter;
+import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.AbortException;
 import hudson.Extension;
@@ -30,17 +39,7 @@
 import hudson.util.Secret;
 import jenkins.model.Jenkins;
 import jenkins.tasks.SimpleBuildStep;
-import net.sf.json.JSONArray;
-import net.sf.json.JSONObject;
-import org.apache.commons.lang.StringUtils;
-import org.jenkinsci.Symbol;
-import org.kohsuke.stapler.DataBoundConstructor;
-import org.kohsuke.stapler.QueryParameter;
-import org.kohsuke.stapler.StaplerRequest;
-import org.kohsuke.stapler.StaplerResponse;
-import org.kohsuke.stapler.interceptor.RequirePOST;
 
-import javax.annotation.Nonnull;
 import java.io.IOException;
 import java.io.PrintStream;
 import java.util.ArrayList;
@@ -50,6 +49,8 @@
 import java.util.Map;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import javax.annotation.Nonnull;
+import javax.servlet.ServletException;
 
 public final class S3BucketPublisher extends Recorder implements SimpleBuildStep {
 
@@ -290,7 +291,7 @@ public void perform(@Nonnull Run<?, ?> run, @Nonnull FilePath ws, @Nonnull Launc
                 final Map<String, String> escapedMetadata = buildMetadata(envVars, entry);
 
                 final List<FingerprintRecord> records = Lists.newArrayList();
-                final List<FingerprintRecord> fingerprints = profile.upload(run, bucket, paths, filenames, escapedMetadata, storageClass, selRegion, entry.uploadFromSlave, entry.managedArtifacts, entry.useServerSideEncryption, entry.gzipFiles);
+                final List<FingerprintRecord> fingerprints = profile.upload(run, bucket, paths, filenames, escapedMetadata, storageClass, selRegion, entry.uploadFromSlave, entry.managedArtifacts, entry.useServerSideEncryption, entry.cannedACL, entry.gzipFiles);
 
                 for (FingerprintRecord fingerprintRecord : fingerprints) {
                     records.add(fingerprintRecord);
@@ -510,14 +511,33 @@ public Result[] getPluginFailureResultConstraints() {
             return pluginFailureResultConstraints.clone();
         }
 
+        private FormValidation doCheckAssumeRole(String assumeRole) {
+            if(StringUtils.isEmpty(assumeRole)) {
+                return FormValidation.ok();
+            }
+
+            final String defaultRegion = ClientHelper.DEFAULT_AMAZON_S3_REGION_NAME;
+            final AmazonS3 client = new ClientHelper.Builder(defaultRegion, Jenkins.get().proxy).build(assumeRole);
+
+            try {
+                client.listBuckets();
+            } catch (AmazonClientException e) {
+                LOGGER.log(Level.SEVERE, e.getMessage(), e);
+                return FormValidation.error("Cannot list buckets from S3: " + e.getMessage());
+            }
+            return FormValidation.ok("Successfully assumed role: " + assumeRole);
+        }
+
         @SuppressWarnings("unused")
         @RequirePOST
         public FormValidation doLoginCheck(@QueryParameter String name, @QueryParameter String accessKey,
-                                           @QueryParameter Secret secretKey, @QueryParameter boolean useRole) {
+                                           @QueryParameter Secret secretKey, @QueryParameter String assumeRole,
+                                           @QueryParameter boolean useRole) {
             Jenkins.get().checkPermission(Jenkins.ADMINISTER);
 
             final String checkedName = Util.fixNull(name);
             final String checkedAccessKey = Util.fixNull(accessKey);
+            final String checkedAssumeRole = Util.fixNull(assumeRole);
             final String checkedSecretKey = secretKey != null ? secretKey.getPlainText() : "";
 
             final boolean couldBeValidated = !checkedName.isEmpty() && !checkedAccessKey.isEmpty() && !checkedSecretKey.isEmpty();
@@ -531,6 +551,11 @@ public FormValidation doLoginCheck(@QueryParameter String name, @QueryParameter
                     return FormValidation.ok();
                 }
 
+                if (!checkedAssumeRole.isEmpty()) {
+                    return doCheckAssumeRole(checkedAssumeRole);
+                }
+
+
                 if (checkedAccessKey.isEmpty()) {
                     return FormValidation.ok("Please, enter accessKey");
                 }
@@ -541,8 +566,8 @@ public FormValidation doLoginCheck(@QueryParameter String name, @QueryParameter
             }
 
             final String defaultRegion = ClientHelper.DEFAULT_AMAZON_S3_REGION_NAME;
-            final AmazonS3Client client = ClientHelper.createClient(
-                    checkedAccessKey, checkedSecretKey, useRole, defaultRegion, Jenkins.get().proxy);
+            final AmazonS3 client = ClientHelper.createClient(
+                    checkedAccessKey, checkedSecretKey, useRole, assumeRole, defaultRegion, Jenkins.get().proxy);
 
             try {
                 client.listBuckets();

src/main/java/hudson/plugins/s3/S3CopyArtifact.java

@@ -24,6 +24,13 @@
 package hudson.plugins.s3;
 
 import com.google.common.collect.Maps;
+
+import org.acegisecurity.GrantedAuthority;
+import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
+import org.jenkinsci.Symbol;
+import org.kohsuke.stapler.AncestorInPath;
+import org.kohsuke.stapler.DataBoundConstructor;
+import org.kohsuke.stapler.QueryParameter;
 import hudson.DescriptorExtensionList;
 import hudson.EnvVars;
 import hudson.Extension;
@@ -62,6 +69,8 @@
 import hudson.tasks.Fingerprinter.FingerprintAction;
 import hudson.util.DescribableList;
 import hudson.util.FormValidation;
+import jenkins.model.Jenkins;
+import jenkins.tasks.SimpleBuildStep;
 
 import java.io.IOException;
 import java.io.PrintStream;
@@ -72,17 +81,6 @@
 import java.util.Map;
 import java.util.logging.Level;
 import java.util.logging.Logger;
-
-import jenkins.model.Jenkins;
-
-import jenkins.tasks.SimpleBuildStep;
-import org.acegisecurity.GrantedAuthority;
-import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
-import org.jenkinsci.Symbol;
-import org.kohsuke.stapler.AncestorInPath;
-import org.kohsuke.stapler.DataBoundConstructor;
-import org.kohsuke.stapler.QueryParameter;
-
 import javax.annotation.Nonnull;
 
 /**