Python script for Vault IAM auth

python_example.py

#!/usr/bin/env python
import boto3
import json
import base64
import requests
import os

def headers_to_go_style(headers):
    retval = {}
    for k, v in headers.items():
        if isinstance(v, bytes):
            retval[k] = [str(v)]
        else:
            retval[k] = [v]
    return retval

def generate_vault_request(role_name=""):
    session         = boto3.session.Session()
    client          = session.client('sts')
    endpoint        = client._endpoint
    operation_model = client._service_model.operation_model('GetCallerIdentity')
    request_dict    = client._convert_to_request_dict({}, operation_model)
    request         = endpoint.create_request(request_dict, operation_model)

    return {
        'iam_http_request_method': request.method,
        'iam_request_url': str(base64.b64encode(request.url.encode('ascii'))),
        'iam_request_body': str(base64.b64encode(request.body.encode('ascii'))),
        'iam_request_headers': str(base64.b64encode(bytes(json.dumps(headers_to_go_style(dict(request.headers)))))),
        'role': role_name,
    }

def vault_auth():
    vault_addr             = os.environ['VAULT_ADDR']
    vault_iam_auth_request = json.dumps(generate_vault_request('aws-demo-role-iam'))
    response               = requests.post(vault_addr + "/v1/auth/aws/login", data=vault_iam_auth_request)
    parsed                 = json.loads(response.text)

    print json.dumps(parsed, indent=2, sort_keys=True)

vault_auth()