Merge pull request #166 from janerikcarlsen/add-session-token

Add aws session token as config parameter

README.md

@@ -118,7 +118,7 @@ Note: Each value should be adjusted to your system by yourself.
 ## Configuration: Credentials
 To put records into Amazon Kinesis Data Streams or Firehose, you need to provide AWS security credentials somehow. Without specifying credentials in config file, this plugin automatically fetch credential just following AWS SDK for Ruby does (environment variable, shared profile, and instance profile).
 
-This plugin uses the same configuration in [fluent-plugin-s3][fluent-plugin-s3].
+This plugin uses the same configuration in [fluent-plugin-s3][fluent-plugin-s3], but also supports aws session tokens for temporary credentials. 
 
 **aws_key_id**
 
@@ -128,6 +128,10 @@ AWS access key id. This parameter is required when your agent is not running on
 
 AWS secret key. This parameter is required when your agent is not running on EC2 instance with an IAM Role.
 
+**aws_ses_token**
+
+AWS session token. This parameter is optional, but can be provided if using MFA or temporary credentials when your agent is not running on EC2 instance with an IAM Role. 
+
 **aws_iam_retries**
 
 The number of attempts to make (with exponential backoff) when loading instance profile credentials from the EC2 metadata service using an IAM role. Defaults to 5 retries.

lib/fluent/plugin/kinesis_helper/client.rb

@@ -29,6 +29,7 @@ module ClientParams
 
           config_param :aws_key_id,  :string, default: nil, secret: true
           config_param :aws_sec_key, :string, default: nil, secret: true
+          config_param :aws_ses_token, :string, default: nil, secret: true
           config_section :assume_role_credentials, multi: false do
             desc "The Amazon Resource Name (ARN) of the role to assume"
             config_param :role_arn, :string, secret: true
@@ -115,6 +116,10 @@ def setup_credentials
           options = {}
           credentials_options = {}
           case
+          when @aws_key_id && @aws_sec_key && @aws_ses_token
+            options[:access_key_id] = @aws_key_id
+            options[:secret_access_key] = @aws_sec_key
+            options[:session_token] = @aws_ses_token  
           when @aws_key_id && @aws_sec_key
             options[:access_key_id] = @aws_key_id
             options[:secret_access_key] = @aws_sec_key