2023-03-15 16:00:52 +00:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
|
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
|
2017-04-24 19:15:50 +00:00
|
|
|
package awsauth
|
2017-02-01 19:16:03 +00:00
|
|
|
|
|
|
|
import (
|
2018-01-08 18:31:38 +00:00
|
|
|
"context"
|
2017-02-01 19:16:03 +00:00
|
|
|
"fmt"
|
|
|
|
|
2019-04-12 21:54:35 +00:00
|
|
|
"github.com/hashicorp/vault/sdk/framework"
|
2019-04-13 07:44:06 +00:00
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
2017-02-01 19:16:03 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
// awsStsEntry is used to store details of an STS role for assumption
|
|
|
|
type awsStsEntry struct {
|
2018-02-27 20:27:49 +00:00
|
|
|
StsRole string `json:"sts_role"`
|
2017-02-01 19:16:03 +00:00
|
|
|
}
|
|
|
|
|
2019-07-31 23:11:35 +00:00
|
|
|
func (b *backend) pathListSts() *framework.Path {
|
2017-02-01 19:16:03 +00:00
|
|
|
return &framework.Path{
|
|
|
|
Pattern: "config/sts/?",
|
|
|
|
|
2023-04-06 15:08:30 +00:00
|
|
|
DisplayAttrs: &framework.DisplayAttributes{
|
|
|
|
OperationPrefix: operationPrefixAWS,
|
|
|
|
OperationSuffix: "sts-role-relationships",
|
|
|
|
},
|
|
|
|
|
2019-07-31 23:11:35 +00:00
|
|
|
Operations: map[logical.Operation]framework.OperationHandler{
|
|
|
|
logical.ListOperation: &framework.PathOperation{
|
|
|
|
Callback: b.pathStsList,
|
|
|
|
},
|
2017-02-01 19:16:03 +00:00
|
|
|
},
|
|
|
|
|
|
|
|
HelpSynopsis: pathListStsHelpSyn,
|
|
|
|
HelpDescription: pathListStsHelpDesc,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-07-31 23:11:35 +00:00
|
|
|
func (b *backend) pathConfigSts() *framework.Path {
|
2017-02-01 19:16:03 +00:00
|
|
|
return &framework.Path{
|
|
|
|
Pattern: "config/sts/" + framework.GenericNameRegex("account_id"),
|
2023-04-06 15:08:30 +00:00
|
|
|
|
|
|
|
DisplayAttrs: &framework.DisplayAttributes{
|
|
|
|
OperationPrefix: operationPrefixAWS,
|
|
|
|
OperationSuffix: "sts-role",
|
|
|
|
},
|
|
|
|
|
2017-02-01 19:16:03 +00:00
|
|
|
Fields: map[string]*framework.FieldSchema{
|
|
|
|
"account_id": {
|
|
|
|
Type: framework.TypeString,
|
|
|
|
Description: `AWS account ID to be associated with STS role. If set,
|
|
|
|
Vault will use assumed credentials to verify any login attempts from EC2
|
|
|
|
instances in this account.`,
|
|
|
|
},
|
|
|
|
"sts_role": {
|
|
|
|
Type: framework.TypeString,
|
|
|
|
Description: `AWS ARN for STS role to be assumed when interacting with the account specified.
|
|
|
|
The Vault server must have permissions to assume this role.`,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
|
|
|
|
ExistenceCheck: b.pathConfigStsExistenceCheck,
|
|
|
|
|
2019-07-31 23:11:35 +00:00
|
|
|
Operations: map[logical.Operation]framework.OperationHandler{
|
|
|
|
logical.CreateOperation: &framework.PathOperation{
|
|
|
|
Callback: b.pathConfigStsCreateUpdate,
|
|
|
|
},
|
|
|
|
logical.UpdateOperation: &framework.PathOperation{
|
|
|
|
Callback: b.pathConfigStsCreateUpdate,
|
|
|
|
},
|
|
|
|
logical.ReadOperation: &framework.PathOperation{
|
|
|
|
Callback: b.pathConfigStsRead,
|
|
|
|
},
|
|
|
|
logical.DeleteOperation: &framework.PathOperation{
|
|
|
|
Callback: b.pathConfigStsDelete,
|
|
|
|
},
|
2017-02-01 19:16:03 +00:00
|
|
|
},
|
|
|
|
|
|
|
|
HelpSynopsis: pathConfigStsSyn,
|
|
|
|
HelpDescription: pathConfigStsDesc,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Establishes dichotomy of request operation between CreateOperation and UpdateOperation.
|
|
|
|
// Returning 'true' forces an UpdateOperation, CreateOperation otherwise.
|
2018-01-08 18:31:38 +00:00
|
|
|
func (b *backend) pathConfigStsExistenceCheck(ctx context.Context, req *logical.Request, data *framework.FieldData) (bool, error) {
|
2017-02-01 19:16:03 +00:00
|
|
|
accountID := data.Get("account_id").(string)
|
|
|
|
if accountID == "" {
|
|
|
|
return false, fmt.Errorf("missing account_id")
|
|
|
|
}
|
|
|
|
|
2018-01-19 06:44:44 +00:00
|
|
|
entry, err := b.lockedAwsStsEntry(ctx, req.Storage, accountID)
|
2017-02-01 19:16:03 +00:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return entry != nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// pathStsList is used to list all the AWS STS role configurations
|
2018-01-08 18:31:38 +00:00
|
|
|
func (b *backend) pathStsList(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
|
2017-02-01 19:16:03 +00:00
|
|
|
b.configMutex.RLock()
|
|
|
|
defer b.configMutex.RUnlock()
|
2018-01-19 06:44:44 +00:00
|
|
|
sts, err := req.Storage.List(ctx, "config/sts/")
|
2017-02-01 19:16:03 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return logical.ListResponse(sts), nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// nonLockedSetAwsStsEntry creates or updates an STS role association with the given accountID
|
|
|
|
// This method does not acquire the write lock before creating or updating. If locking is
|
|
|
|
// desired, use lockedSetAwsStsEntry instead
|
2018-01-19 06:44:44 +00:00
|
|
|
func (b *backend) nonLockedSetAwsStsEntry(ctx context.Context, s logical.Storage, accountID string, stsEntry *awsStsEntry) error {
|
2017-02-01 19:16:03 +00:00
|
|
|
if accountID == "" {
|
|
|
|
return fmt.Errorf("missing AWS account ID")
|
|
|
|
}
|
|
|
|
|
|
|
|
if stsEntry == nil {
|
|
|
|
return fmt.Errorf("missing AWS STS Role ARN")
|
|
|
|
}
|
|
|
|
|
|
|
|
entry, err := logical.StorageEntryJSON("config/sts/"+accountID, stsEntry)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if entry == nil {
|
|
|
|
return fmt.Errorf("failed to create storage entry for AWS STS configuration")
|
|
|
|
}
|
|
|
|
|
2018-01-19 06:44:44 +00:00
|
|
|
return s.Put(ctx, entry)
|
2017-02-01 19:16:03 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// lockedSetAwsStsEntry creates or updates an STS role association with the given accountID
|
|
|
|
// This method acquires the write lock before creating or updating the STS entry.
|
2018-01-19 06:44:44 +00:00
|
|
|
func (b *backend) lockedSetAwsStsEntry(ctx context.Context, s logical.Storage, accountID string, stsEntry *awsStsEntry) error {
|
2017-02-01 19:16:03 +00:00
|
|
|
if accountID == "" {
|
|
|
|
return fmt.Errorf("missing AWS account ID")
|
|
|
|
}
|
|
|
|
|
|
|
|
if stsEntry == nil {
|
|
|
|
return fmt.Errorf("missing sts entry")
|
|
|
|
}
|
|
|
|
|
|
|
|
b.configMutex.Lock()
|
|
|
|
defer b.configMutex.Unlock()
|
|
|
|
|
2018-01-19 06:44:44 +00:00
|
|
|
return b.nonLockedSetAwsStsEntry(ctx, s, accountID, stsEntry)
|
2017-02-01 19:16:03 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// nonLockedAwsStsEntry returns the STS role associated with the given accountID.
|
|
|
|
// This method does not acquire the read lock before returning information. If locking is
|
|
|
|
// desired, use lockedAwsStsEntry instead
|
2018-01-19 06:44:44 +00:00
|
|
|
func (b *backend) nonLockedAwsStsEntry(ctx context.Context, s logical.Storage, accountID string) (*awsStsEntry, error) {
|
|
|
|
entry, err := s.Get(ctx, "config/sts/"+accountID)
|
2017-02-01 19:16:03 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if entry == nil {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
var stsEntry awsStsEntry
|
|
|
|
if err := entry.DecodeJSON(&stsEntry); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return &stsEntry, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// lockedAwsStsEntry returns the STS role associated with the given accountID.
|
|
|
|
// This method acquires the read lock before returning the association.
|
2018-01-19 06:44:44 +00:00
|
|
|
func (b *backend) lockedAwsStsEntry(ctx context.Context, s logical.Storage, accountID string) (*awsStsEntry, error) {
|
2017-02-01 19:16:03 +00:00
|
|
|
b.configMutex.RLock()
|
|
|
|
defer b.configMutex.RUnlock()
|
|
|
|
|
2018-01-19 06:44:44 +00:00
|
|
|
return b.nonLockedAwsStsEntry(ctx, s, accountID)
|
2017-02-01 19:16:03 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// pathConfigStsRead is used to return information about an STS role/AWS accountID association
|
2018-01-08 18:31:38 +00:00
|
|
|
func (b *backend) pathConfigStsRead(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
|
2017-02-01 19:16:03 +00:00
|
|
|
accountID := data.Get("account_id").(string)
|
|
|
|
if accountID == "" {
|
|
|
|
return logical.ErrorResponse("missing account id"), nil
|
|
|
|
}
|
|
|
|
|
2018-01-19 06:44:44 +00:00
|
|
|
stsEntry, err := b.lockedAwsStsEntry(ctx, req.Storage, accountID)
|
2017-02-01 19:16:03 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if stsEntry == nil {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
return &logical.Response{
|
2018-02-27 18:22:47 +00:00
|
|
|
Data: map[string]interface{}{
|
|
|
|
"sts_role": stsEntry.StsRole,
|
|
|
|
},
|
2017-02-01 19:16:03 +00:00
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// pathConfigStsCreateUpdate is used to associate an STS role with a given AWS accountID
|
2018-01-08 18:31:38 +00:00
|
|
|
func (b *backend) pathConfigStsCreateUpdate(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
|
2017-02-01 19:16:03 +00:00
|
|
|
accountID := data.Get("account_id").(string)
|
|
|
|
if accountID == "" {
|
|
|
|
return logical.ErrorResponse("missing AWS account ID"), nil
|
|
|
|
}
|
|
|
|
|
|
|
|
b.configMutex.Lock()
|
|
|
|
defer b.configMutex.Unlock()
|
|
|
|
|
|
|
|
// Check if an STS role is already registered
|
2018-01-19 06:44:44 +00:00
|
|
|
stsEntry, err := b.nonLockedAwsStsEntry(ctx, req.Storage, accountID)
|
2017-02-01 19:16:03 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if stsEntry == nil {
|
|
|
|
stsEntry = &awsStsEntry{}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check that an STS role has actually been provided
|
|
|
|
stsRole, ok := data.GetOk("sts_role")
|
|
|
|
if ok {
|
|
|
|
stsEntry.StsRole = stsRole.(string)
|
|
|
|
} else if req.Operation == logical.CreateOperation {
|
|
|
|
return logical.ErrorResponse("missing sts role"), nil
|
|
|
|
}
|
|
|
|
|
|
|
|
if stsEntry.StsRole == "" {
|
|
|
|
return logical.ErrorResponse("sts role cannot be empty"), nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// save the provided STS role
|
2018-01-19 06:44:44 +00:00
|
|
|
if err := b.nonLockedSetAwsStsEntry(ctx, req.Storage, accountID, stsEntry); err != nil {
|
2017-02-01 19:16:03 +00:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// pathConfigStsDelete is used to delete a previously configured STS configuration
|
2018-01-08 18:31:38 +00:00
|
|
|
func (b *backend) pathConfigStsDelete(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
|
2017-02-01 19:16:03 +00:00
|
|
|
b.configMutex.Lock()
|
|
|
|
defer b.configMutex.Unlock()
|
|
|
|
|
|
|
|
accountID := data.Get("account_id").(string)
|
|
|
|
if accountID == "" {
|
|
|
|
return logical.ErrorResponse("missing account id"), nil
|
|
|
|
}
|
|
|
|
|
2018-01-19 06:44:44 +00:00
|
|
|
return nil, req.Storage.Delete(ctx, "config/sts/"+accountID)
|
2017-02-01 19:16:03 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
const pathConfigStsSyn = `
|
|
|
|
Specify STS roles to be assumed for certain AWS accounts.
|
|
|
|
`
|
|
|
|
|
|
|
|
const pathConfigStsDesc = `
|
|
|
|
Allows the explicit association of STS roles to satellite AWS accounts (i.e. those
|
|
|
|
which are not the account in which the Vault server is running.) Login attempts from
|
|
|
|
EC2 instances running in these accounts will be verified using credentials obtained
|
|
|
|
by assumption of these STS roles.
|
|
|
|
|
|
|
|
The environment in which the Vault server resides must have access to assume the
|
|
|
|
given STS roles.
|
|
|
|
`
|
2021-04-08 16:43:39 +00:00
|
|
|
|
2017-02-01 19:16:03 +00:00
|
|
|
const pathListStsHelpSyn = `
|
|
|
|
List all the AWS account/STS role relationships registered with Vault.
|
|
|
|
`
|
|
|
|
|
|
|
|
const pathListStsHelpDesc = `
|
|
|
|
AWS accounts will be listed by account ID, along with their respective role names.
|
|
|
|
`
|