Adding support for the AWS session token used in STS temporary credentials

[garnaat]

This PR adds support for the session_token used in STS temporary credentials such as IAM roles.

[garnaat]

Fixes #9

[DavidMuller]

Thanks for this pull request @garnaat

This PR adds support for the session_token used in STS temporary credentials such as IAM roles.

Have you used this change-set to successfully authenticate with temporary credentials and a production elatsicsearch cluster?

[garnaat]

Yes, I did that this morning. I need to be able to talk to an AWS Elasticsearch service that is protected within a Lambda function where the only credentials I have are temporary creds supplied to the Lambda container. It is working for me.

[garnaat]

Thanks!

[DavidMuller]

I've published this change on pypi -- version 0.2.4

(I also added a note about temporary credentials to the changelog and the bottom of the README)

[alexbao]

@garnaat thanks for the change!

I was trying to use the instance role for ES access and I got The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. error not sure whether it's because of anything misconfigured.

I am using elastalert library, the auth is constructed as https://github.com/Yelp/elastalert/blob/master/elastalert/auth.py#L58 with only aws_region setup to pick up the instance role. Verified that the role should have the access to ES.

Any advice? Thank you in advance!

[alexbao]

Happy to be proven wrong: my guess is that aws might updated the way to calculate signature. The auth should have worked when set up the connection, but failed later when the query is sent. cc @garnaat @DavidMuller