-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Feature][Add] Added AWS Secret Manager support (#1)
* Added a code for AWS Secret Manager Signed-off-by: iamabhishek-dubey <[email protected]> * Upgraded version Signed-off-by: iamabhishek-dubey <[email protected]> * Updated information for AWS Secret Manager Signed-off-by: iamabhishek-dubey <[email protected]>
- Loading branch information
1 parent
4d0bec0
commit 2341250
Showing
8 changed files
with
159 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| package cmd | ||
|
|
||
| import ( | ||
| awsSDK "github.com/aws/aws-sdk-go/aws" | ||
| "github.com/spf13/cobra" | ||
| "github.com/spf13/viper" | ||
| "k8s-secret-injector/pkg/aws" | ||
| ) | ||
|
|
||
| var ( | ||
| region string | ||
| secretNameAWS string | ||
| previousVersion string | ||
| roleARN string | ||
| ) | ||
|
|
||
| // awsCmd represents the aws command | ||
| var awsCmd = &cobra.Command{ | ||
| Use: "aws", | ||
| Short: "Fetch secrets from AWS Secret Manager", | ||
| Long: `Fetch secrets from AWS Secret Manager`, | ||
| Run: func(cmd *cobra.Command, args []string) { | ||
| var ( | ||
| secretData map[string]interface{} | ||
| err error | ||
| ) | ||
|
|
||
| cfg := &aws.Config{ | ||
| Region: region, | ||
| RoleARN: roleARN, | ||
| PreviousVersion: previousVersion, | ||
| SecretName: awsSDK.String(secretNameAWS), | ||
| } | ||
|
|
||
| secretData, err = aws.RetrieveSecret(cfg) | ||
| if err != nil { | ||
| exitWithError("Error getting secrets from AWS Secret manager", err) | ||
| } | ||
| processSecrets(secretData, args) | ||
| }, | ||
| } | ||
|
|
||
| func init() { | ||
| RootCmd.AddCommand(awsCmd) | ||
|
|
||
| viper.SetDefault("region", "us-east-1") | ||
| viper.SetDefault("role_arn", "") | ||
| viper.SetDefault("secret_name", "") | ||
| viper.SetDefault("previous_version", "") | ||
| viper.AutomaticEnv() | ||
|
|
||
| awsCmd.Flags().StringVar(®ion, "region", viper.GetString("region"), "AWS Region for the Secret Manager (default: us-east-1)") | ||
| awsCmd.Flags().StringVar(&roleARN, "role-arn", viper.GetString("role_arn"), "AWS Role ARN with access to the secret, this requires also permissions on the KMS key for that role") | ||
| awsCmd.Flags().StringVar(&secretNameAWS, "secret-name", viper.GetString("secret_name"), "AWS Secret Name") | ||
| awsCmd.Flags().StringVar(&previousVersion, "previous-version", viper.GetString("previous_version"), "If using lambda to rotate secrets you can get the previous version (default: current version)") | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| package aws | ||
|
|
||
| import ( | ||
| "context" | ||
| "encoding/json" | ||
| "fmt" | ||
|
|
||
| "github.com/aws/aws-sdk-go/aws" | ||
| "github.com/aws/aws-sdk-go/aws/credentials/stscreds" | ||
| "github.com/aws/aws-sdk-go/aws/session" | ||
| "github.com/aws/aws-sdk-go/service/secretsmanager" | ||
| "github.com/aws/aws-sdk-go/service/secretsmanager/secretsmanageriface" | ||
| log "github.com/sirupsen/logrus" | ||
| ) | ||
|
|
||
| // Config configuration for AWS | ||
| type Config struct { | ||
| Region string | ||
| SecretName *string | ||
| PreviousVersion string | ||
| RoleARN string | ||
| } | ||
|
|
||
| func newSecretManagerClient(region, roleArn string) *secretsmanager.SecretsManager { | ||
| log.Infof("Using region: %s", region) | ||
| sess := session.Must(session.NewSession(&aws.Config{ | ||
| Region: aws.String(region), // Sessions Manager functions require region configuration | ||
| })) | ||
|
|
||
| if roleArn != "" { | ||
| log.Debugf("Using Role Arn: %s", roleArn) | ||
| // the new Credentials object wraps the AssumeRoleProvider | ||
| sess.Config.Credentials = stscreds.NewCredentials(sess, roleArn) | ||
| } | ||
|
|
||
| // Create a SecretsManager client with additional configuration | ||
| return secretsmanager.New(sess, aws.NewConfig().WithRegion(region)) | ||
| } | ||
|
|
||
| // GetSecretData will fetch the secret from secret manager | ||
| func GetSecretData(api secretsmanageriface.SecretsManagerAPI, secretValueInput *secretsmanager.GetSecretValueInput) (map[string]interface{}, error) { | ||
| var secretData map[string]interface{} | ||
| ctx := context.Background() | ||
| secretValueOutput, err := api.GetSecretValueWithContext(ctx, secretValueInput) | ||
|
|
||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to access secret version: %w", err) | ||
| } | ||
|
|
||
| err = json.Unmarshal([]byte(*secretValueOutput.SecretString), &secretData) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("bad secret JSON data, can not decode secret JSON data: %w", err) | ||
| } | ||
| return secretData, nil | ||
| } | ||
|
|
||
| func buildSecretValueInput(cfg *Config) (*secretsmanager.GetSecretValueInput, error) { | ||
| secretName := cfg.SecretName | ||
| if aws.StringValue(secretName) == "" { | ||
| return nil, fmt.Errorf("error: missing SECRET_NAME environment variable") | ||
| } | ||
| versionStage := aws.String("AWSCURRENT") | ||
| if cfg.PreviousVersion != "" { | ||
| versionStage = aws.String("AWSPREVIOUS") | ||
| } | ||
| secretValueInput := &secretsmanager.GetSecretValueInput{ | ||
| SecretId: secretName, | ||
| VersionStage: versionStage, | ||
| } | ||
| return secretValueInput, nil | ||
| } | ||
|
|
||
| // RetrieveSecret from AWS secrets manager | ||
| func RetrieveSecret(cfg *Config) (map[string]interface{}, error) { | ||
| log.Info("Using AWS Secret Manager") | ||
| secretValueInput, err := buildSecretValueInput(cfg) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| client := newSecretManagerClient(cfg.Region, cfg.RoleARN) | ||
| secretData, err := GetSecretData(client, secretValueInput) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return secretData, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters