137 lines
4.2 KiB
Go
137 lines
4.2 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package awsauth
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net/http"
|
|
"sync/atomic"
|
|
"time"
|
|
|
|
"github.com/hashicorp/vault/sdk/framework"
|
|
"github.com/hashicorp/vault/sdk/helper/consts"
|
|
"github.com/hashicorp/vault/sdk/logical"
|
|
)
|
|
|
|
func (b *backend) pathTidyIdentityAccessList() *framework.Path {
|
|
return &framework.Path{
|
|
Pattern: "tidy/identity-accesslist$",
|
|
|
|
DisplayAttrs: &framework.DisplayAttributes{
|
|
OperationPrefix: operationPrefixAWS,
|
|
OperationSuffix: "identity-access-list",
|
|
OperationVerb: "tidy",
|
|
},
|
|
|
|
Fields: map[string]*framework.FieldSchema{
|
|
"safety_buffer": {
|
|
Type: framework.TypeDurationSecond,
|
|
Default: 259200,
|
|
Description: `The amount of extra time that must have passed beyond the identity's
|
|
expiration, before it is removed from the backend storage.`,
|
|
},
|
|
},
|
|
|
|
Operations: map[logical.Operation]framework.OperationHandler{
|
|
logical.UpdateOperation: &framework.PathOperation{
|
|
Callback: b.pathTidyIdentityAccessListUpdate,
|
|
},
|
|
},
|
|
|
|
HelpSynopsis: pathTidyIdentityAccessListSyn,
|
|
HelpDescription: pathTidyIdentityAccessListDesc,
|
|
}
|
|
}
|
|
|
|
// tidyAccessListIdentity is used to delete entries in the access list that are expired.
|
|
func (b *backend) tidyAccessListIdentity(ctx context.Context, req *logical.Request, safetyBuffer int) (*logical.Response, error) {
|
|
// If we are a performance standby forward the request to the active node
|
|
if b.System().ReplicationState().HasState(consts.ReplicationPerformanceStandby) {
|
|
return nil, logical.ErrReadOnly
|
|
}
|
|
|
|
if !atomic.CompareAndSwapUint32(b.tidyAccessListCASGuard, 0, 1) {
|
|
resp := &logical.Response{}
|
|
resp.AddWarning("Tidy operation already in progress.")
|
|
return resp, nil
|
|
}
|
|
|
|
s := req.Storage
|
|
|
|
go func() {
|
|
defer atomic.StoreUint32(b.tidyAccessListCASGuard, 0)
|
|
|
|
// Don't cancel when the original client request goes away
|
|
ctx = context.Background()
|
|
|
|
logger := b.Logger().Named("wltidy")
|
|
|
|
bufferDuration := time.Duration(safetyBuffer) * time.Second
|
|
|
|
doTidy := func() error {
|
|
identities, err := s.List(ctx, identityAccessListStorage)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
for _, instanceID := range identities {
|
|
identityEntry, err := s.Get(ctx, identityAccessListStorage+instanceID)
|
|
if err != nil {
|
|
return fmt.Errorf("error fetching identity of instanceID %q: %w", instanceID, err)
|
|
}
|
|
|
|
if identityEntry == nil {
|
|
return fmt.Errorf("identity entry for instanceID %q is nil", instanceID)
|
|
}
|
|
|
|
if identityEntry.Value == nil || len(identityEntry.Value) == 0 {
|
|
return fmt.Errorf("found identity entry for instanceID %q but actual identity is empty", instanceID)
|
|
}
|
|
|
|
var result accessListIdentity
|
|
if err := identityEntry.DecodeJSON(&result); err != nil {
|
|
return err
|
|
}
|
|
|
|
if time.Now().After(result.ExpirationTime.Add(bufferDuration)) {
|
|
if err := s.Delete(ctx, identityAccessListStorage+instanceID); err != nil {
|
|
return fmt.Errorf("error deleting identity of instanceID %q from storage: %w", instanceID, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
if err := doTidy(); err != nil {
|
|
logger.Error("error running access list tidy", "error", err)
|
|
return
|
|
}
|
|
}()
|
|
|
|
resp := &logical.Response{}
|
|
resp.AddWarning("Tidy operation successfully started. Any information from the operation will be printed to Vault's server logs.")
|
|
return logical.RespondWithStatusCode(resp, req, http.StatusAccepted)
|
|
}
|
|
|
|
// pathTidyIdentityAccessListUpdate is used to delete entries in the access list that are expired.
|
|
func (b *backend) pathTidyIdentityAccessListUpdate(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
|
|
return b.tidyAccessListIdentity(ctx, req, data.Get("safety_buffer").(int))
|
|
}
|
|
|
|
const pathTidyIdentityAccessListSyn = `
|
|
Clean-up the access list instance identity entries.
|
|
`
|
|
|
|
const pathTidyIdentityAccessListDesc = `
|
|
When an instance identity is in the access list, the expiration time of the access list
|
|
entry is set based on the maximum 'max_ttl' value set on: the role, the role tag
|
|
and the backend's mount.
|
|
|
|
When this endpoint is invoked, all the entries that are expired will be deleted.
|
|
A 'safety_buffer' (duration in seconds) can be provided, to ensure deletion of
|
|
only those entries that are expired before 'safety_buffer' seconds.
|
|
`
|