sign-request.py modified for python 3.x

sign-request-py3.py

#!/usr/bin/env python
# -What-------------------------------------------------------------------------
# This script creates a request to the AWS Security Token Service API
# with the action "GetCallerIdentity" and then signs the request using the
# AWS credentials. It was modified from the python 2.x example published by
# J. Thompson, the author of the Vault IAM auth method, at the vault support
# mailing list. https://groups.google.com/forum/#!topic/vault-tool/Mfi3O-lW60I
# -Why--------------------------------------------------------------------------
# We are using python here instead of bash to take advantage of the boto3 library
# which facilitates this work by an order of magnitude
# -What-for---------------------------------------------------------------------
# This is useful for authenticating to Vault, because a client can use
# this script to generate this request and this request is sent with the
# login attempt to the Vault server. Vault then executes this request and gets
# the response from GetCallerIdentity, which tells who is trying to authenticate
# ------------------------------------------------------------------------------

import base64
import botocore.session
import json
import sys


def headers_to_go_style(headers):
    retval = {}
    for k, v in headers.items():
        if isinstance(v, bytes):
            retval[k] = [str(v, 'utf-8')]
        else:
            retval[k] = [v]
    return retval


def generate_vault_request(awsIamServerId):
    session = botocore.session.get_session()
    client = session.create_client('sts')
    endpoint = client._endpoint
    operation_model = client._service_model.operation_model('GetCallerIdentity')
    request_dict = client._convert_to_request_dict({}, operation_model)

    request_dict['headers']['X-Vault-AWS-IAM-Server-ID'] = awsIamServerId

    request = endpoint.create_request(request_dict, operation_model)

    return {
        'iam_http_request_method': request.method,
        'iam_request_url':         str(base64.b64encode(bytes(request.url, 'utf-8')), 'utf-8'),
        'iam_request_body':        str(base64.b64encode(bytes(request.body, 'utf-8')), 'utf-8'),
        'iam_request_headers':     str(base64.b64encode(bytes(json.dumps(headers_to_go_style(dict(request.headers))), 'utf-8')), 'utf-8') # It's a CaseInsensitiveDict, which is not JSON-serializable
    }


if __name__ == "__main__":
    awsIamServerId = sys.argv[1]
    print json.dumps(generate_vault_request(awsIamServerId))