support aws speech by roleArn (#313)

* support aws speech by roleArn

* support 3 types of aws  credentials

* wip

* wip

* update speech util version

lib/routes/api/speech-credentials.js

@@ -113,6 +113,7 @@ const encryptCredential = (obj) => {
     secret_access_key,
     aws_region,
     api_key,
+    role_arn,
     region,
     client_id,
     secret,
@@ -155,10 +156,17 @@ const encryptCredential = (obj) => {
       return encrypt(service_key);
 
     case 'aws':
-      assert(access_key_id, 'invalid aws speech credential: access_key_id is required');
-      assert(secret_access_key, 'invalid aws speech credential: secret_access_key is required');
-      assert(aws_region, 'invalid aws speech credential: aws_region is required');
-      const awsData = JSON.stringify({aws_region, access_key_id, secret_access_key});
+      // AWS polly can work for 3 types of credentials:
+      // 1/ access_key_id and secret_access_key
+      // 2/ RoleArn Assume role
+      // 3/ RoleArn assigned to instance profile where will run this application
+      const awsData = JSON.stringify(
+        {
+          aws_region,
+          ...(access_key_id && {access_key_id}),
+          ...(secret_access_key && {secret_access_key}),
+          ...(role_arn && {role_arn}),
+        });
       return encrypt(awsData);
 
     case 'microsoft':
@@ -541,12 +549,13 @@ router.get('/:sid/test', async(req, res) => {
       }
     }
     else if (cred.vendor === 'aws') {
+      const {getTtsVoices, getAwsAuthToken} = req.app.locals;
       if (cred.use_for_tts) {
-        const {getTtsVoices} = req.app.locals;
         try {
           await testAwsTts(logger, getTtsVoices, {
             accessKeyId: credential.access_key_id,
             secretAccessKey: credential.secret_access_key,
+            roleArn: credential.role_arn,
             region: credential.aws_region || process.env.AWS_REGION
           });
           results.tts.status = 'ok';
@@ -558,9 +567,10 @@ router.get('/:sid/test', async(req, res) => {
       }
       if (cred.use_for_stt) {
         try {
-          await testAwsStt(logger, {
+          await testAwsStt(logger, getAwsAuthToken, {
             accessKeyId: credential.access_key_id,
             secretAccessKey: credential.secret_access_key,
+            roleArn: credential.role_arn,
             region: credential.aws_region || process.env.AWS_REGION
           });
           results.stt.status = 'ok';

lib/utils/speech-utils.js

@@ -165,16 +165,26 @@ const testAwsTts = async(logger, getTtsVoices, credentials) => {
   }
 };
 
-const testAwsStt = async(logger, credentials) => {
+const testAwsStt = async(logger, getAwsAuthToken, credentials) => {
   try {
-    const {region, accessKeyId, secretAccessKey} = credentials;
-    const client = new TranscribeClient({
-      region,
-      credentials: {
-        accessKeyId,
-        secretAccessKey
-      }
-    });
+    const {region, accessKeyId, secretAccessKey, roleArn} = credentials;
+    let client = null;
+    if (accessKeyId && secretAccessKey) {
+      client = new TranscribeClient({
+        region,
+        credentials: {
+          accessKeyId,
+          secretAccessKey
+        }
+      });
+    } else if (roleArn) {
+      client = new TranscribeClient({
+        region,
+        credentials: await getAwsAuthToken(null, null, region, roleArn),
+      });
+    } else {
+      client = new TranscribeClient({region});
+    }
     const command = new ListVocabulariesCommand({});
     const response =  await client.send(command);
     return response;
@@ -400,6 +410,7 @@ const getSpeechCredential = (credential, logger) => {
       ...credential,
       accessKeyId: credential.access_key_id,
       secretAccessKey: credential.secret_access_key,
+      roleArn: credential.role_arn,
       region: credential.aws_region || 'us-east-1'
     };
   }
@@ -421,6 +432,7 @@ function decryptCredential(obj, credential, logger, isObscureKey = true) {
   else if ('aws' === obj.vendor) {
     const o = JSON.parse(decrypt(credential));
     obj.access_key_id = o.access_key_id;
+    obj.role_arn = o.role_arn;
     obj.secret_access_key = isObscureKey ? obscureKey(o.secret_access_key) : o.secret_access_key;
     obj.aws_region = o.aws_region;
     logger.info({obj, o}, 'retrieving aws speech credential');
@@ -584,6 +596,7 @@ async function getLanguagesVoicesForAws(credential, getTtsVoices, logger) {
         credentials: {
           accessKeyId: credential.access_key_id,
           secretAccessKey: credential.secret_access_key,
+          roleArn: credential.role_arn,
           region: credential.aws_region || process.env.AWS_REGION
         }
       });