e06a78a474
* Rename builtin/credential/aws-ec2 to aws The aws-ec2 authentication backend is being expanded and will become the generic aws backend. This is a small rename commit to keep the commit history clean. * Expand aws-ec2 backend to more generic aws This adds the ability to authenticate arbitrary AWS IAM principals using AWS's sts:GetCallerIdentity method. The AWS-EC2 auth backend is being to just AWS with the expansion. * Add missing aws auth handler to CLI This was omitted from the previous commit * aws auth backend general variable name cleanup Also fixed a bug where allowed auth types weren't being checked upon login, and added tests for it. * Update docs for the aws auth backend * Refactor aws bind validation * Fix env var override in aws backend test Intent is to override the AWS environment variables with the TEST_* versions if they are set, but the reverse was happening. * Update docs on use of IAM authentication profile AWS now allows you to change the instance profile of a running instance, so the use case of "a long-lived instance that's not in an instance profile" no longer means you have to use the the EC2 auth method. You can now just change the instance profile on the fly. * Fix typo in aws auth cli help * Respond to PR feedback * More PR feedback * Respond to additional PR feedback * Address more feedback on aws auth PR * Make aws auth_type immutable per role * Address more aws auth PR feedback * Address more iam auth PR feedback * Rename aws-ec2.html.md to aws.html.md Per PR feedback, to go along with new backend name. * Add MountType to logical.Request * Make default aws auth_type dependent upon MountType When MountType is aws-ec2, default to ec2 auth_type for backwards compatibility with legacy roles. Otherwise, default to iam. * Pass MountPoint and MountType back up to the core Previously the request router reset the MountPoint and MountType back to the empty string before returning to the core. This ensures they get set back to the correct values.
249 lines
7.4 KiB
Go
249 lines
7.4 KiB
Go
package awsauth
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/fatih/structs"
|
|
"github.com/hashicorp/vault/logical"
|
|
"github.com/hashicorp/vault/logical/framework"
|
|
)
|
|
|
|
// awsStsEntry is used to store details of an STS role for assumption
|
|
type awsStsEntry struct {
|
|
StsRole string `json:"sts_role" structs:"sts_role" mapstructure:"sts_role"`
|
|
}
|
|
|
|
func pathListSts(b *backend) *framework.Path {
|
|
return &framework.Path{
|
|
Pattern: "config/sts/?",
|
|
|
|
Callbacks: map[logical.Operation]framework.OperationFunc{
|
|
logical.ListOperation: b.pathStsList,
|
|
},
|
|
|
|
HelpSynopsis: pathListStsHelpSyn,
|
|
HelpDescription: pathListStsHelpDesc,
|
|
}
|
|
}
|
|
|
|
func pathConfigSts(b *backend) *framework.Path {
|
|
return &framework.Path{
|
|
Pattern: "config/sts/" + framework.GenericNameRegex("account_id"),
|
|
Fields: map[string]*framework.FieldSchema{
|
|
"account_id": {
|
|
Type: framework.TypeString,
|
|
Description: `AWS account ID to be associated with STS role. If set,
|
|
Vault will use assumed credentials to verify any login attempts from EC2
|
|
instances in this account.`,
|
|
},
|
|
"sts_role": {
|
|
Type: framework.TypeString,
|
|
Description: `AWS ARN for STS role to be assumed when interacting with the account specified.
|
|
The Vault server must have permissions to assume this role.`,
|
|
},
|
|
},
|
|
|
|
ExistenceCheck: b.pathConfigStsExistenceCheck,
|
|
|
|
Callbacks: map[logical.Operation]framework.OperationFunc{
|
|
logical.CreateOperation: b.pathConfigStsCreateUpdate,
|
|
logical.UpdateOperation: b.pathConfigStsCreateUpdate,
|
|
logical.ReadOperation: b.pathConfigStsRead,
|
|
logical.DeleteOperation: b.pathConfigStsDelete,
|
|
},
|
|
|
|
HelpSynopsis: pathConfigStsSyn,
|
|
HelpDescription: pathConfigStsDesc,
|
|
}
|
|
}
|
|
|
|
// Establishes dichotomy of request operation between CreateOperation and UpdateOperation.
|
|
// Returning 'true' forces an UpdateOperation, CreateOperation otherwise.
|
|
func (b *backend) pathConfigStsExistenceCheck(req *logical.Request, data *framework.FieldData) (bool, error) {
|
|
accountID := data.Get("account_id").(string)
|
|
if accountID == "" {
|
|
return false, fmt.Errorf("missing account_id")
|
|
}
|
|
|
|
entry, err := b.lockedAwsStsEntry(req.Storage, accountID)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
return entry != nil, nil
|
|
}
|
|
|
|
// pathStsList is used to list all the AWS STS role configurations
|
|
func (b *backend) pathStsList(
|
|
req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
|
|
b.configMutex.RLock()
|
|
defer b.configMutex.RUnlock()
|
|
sts, err := req.Storage.List("config/sts/")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return logical.ListResponse(sts), nil
|
|
}
|
|
|
|
// nonLockedSetAwsStsEntry creates or updates an STS role association with the given accountID
|
|
// This method does not acquire the write lock before creating or updating. If locking is
|
|
// desired, use lockedSetAwsStsEntry instead
|
|
func (b *backend) nonLockedSetAwsStsEntry(s logical.Storage, accountID string, stsEntry *awsStsEntry) error {
|
|
if accountID == "" {
|
|
return fmt.Errorf("missing AWS account ID")
|
|
}
|
|
|
|
if stsEntry == nil {
|
|
return fmt.Errorf("missing AWS STS Role ARN")
|
|
}
|
|
|
|
entry, err := logical.StorageEntryJSON("config/sts/"+accountID, stsEntry)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if entry == nil {
|
|
return fmt.Errorf("failed to create storage entry for AWS STS configuration")
|
|
}
|
|
|
|
return s.Put(entry)
|
|
}
|
|
|
|
// lockedSetAwsStsEntry creates or updates an STS role association with the given accountID
|
|
// This method acquires the write lock before creating or updating the STS entry.
|
|
func (b *backend) lockedSetAwsStsEntry(s logical.Storage, accountID string, stsEntry *awsStsEntry) error {
|
|
if accountID == "" {
|
|
return fmt.Errorf("missing AWS account ID")
|
|
}
|
|
|
|
if stsEntry == nil {
|
|
return fmt.Errorf("missing sts entry")
|
|
}
|
|
|
|
b.configMutex.Lock()
|
|
defer b.configMutex.Unlock()
|
|
|
|
return b.nonLockedSetAwsStsEntry(s, accountID, stsEntry)
|
|
}
|
|
|
|
// nonLockedAwsStsEntry returns the STS role associated with the given accountID.
|
|
// This method does not acquire the read lock before returning information. If locking is
|
|
// desired, use lockedAwsStsEntry instead
|
|
func (b *backend) nonLockedAwsStsEntry(s logical.Storage, accountID string) (*awsStsEntry, error) {
|
|
entry, err := s.Get("config/sts/" + accountID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if entry == nil {
|
|
return nil, nil
|
|
}
|
|
var stsEntry awsStsEntry
|
|
if err := entry.DecodeJSON(&stsEntry); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &stsEntry, nil
|
|
}
|
|
|
|
// lockedAwsStsEntry returns the STS role associated with the given accountID.
|
|
// This method acquires the read lock before returning the association.
|
|
func (b *backend) lockedAwsStsEntry(s logical.Storage, accountID string) (*awsStsEntry, error) {
|
|
b.configMutex.RLock()
|
|
defer b.configMutex.RUnlock()
|
|
|
|
return b.nonLockedAwsStsEntry(s, accountID)
|
|
}
|
|
|
|
// pathConfigStsRead is used to return information about an STS role/AWS accountID association
|
|
func (b *backend) pathConfigStsRead(req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
|
|
accountID := data.Get("account_id").(string)
|
|
if accountID == "" {
|
|
return logical.ErrorResponse("missing account id"), nil
|
|
}
|
|
|
|
stsEntry, err := b.lockedAwsStsEntry(req.Storage, accountID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if stsEntry == nil {
|
|
return nil, nil
|
|
}
|
|
|
|
return &logical.Response{
|
|
Data: structs.New(stsEntry).Map(),
|
|
}, nil
|
|
}
|
|
|
|
// pathConfigStsCreateUpdate is used to associate an STS role with a given AWS accountID
|
|
func (b *backend) pathConfigStsCreateUpdate(req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
|
|
accountID := data.Get("account_id").(string)
|
|
if accountID == "" {
|
|
return logical.ErrorResponse("missing AWS account ID"), nil
|
|
}
|
|
|
|
b.configMutex.Lock()
|
|
defer b.configMutex.Unlock()
|
|
|
|
// Check if an STS role is already registered
|
|
stsEntry, err := b.nonLockedAwsStsEntry(req.Storage, accountID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if stsEntry == nil {
|
|
stsEntry = &awsStsEntry{}
|
|
}
|
|
|
|
// Check that an STS role has actually been provided
|
|
stsRole, ok := data.GetOk("sts_role")
|
|
if ok {
|
|
stsEntry.StsRole = stsRole.(string)
|
|
} else if req.Operation == logical.CreateOperation {
|
|
return logical.ErrorResponse("missing sts role"), nil
|
|
}
|
|
|
|
if stsEntry.StsRole == "" {
|
|
return logical.ErrorResponse("sts role cannot be empty"), nil
|
|
}
|
|
|
|
// save the provided STS role
|
|
if err := b.nonLockedSetAwsStsEntry(req.Storage, accountID, stsEntry); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return nil, nil
|
|
}
|
|
|
|
// pathConfigStsDelete is used to delete a previously configured STS configuration
|
|
func (b *backend) pathConfigStsDelete(req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
|
|
b.configMutex.Lock()
|
|
defer b.configMutex.Unlock()
|
|
|
|
accountID := data.Get("account_id").(string)
|
|
if accountID == "" {
|
|
return logical.ErrorResponse("missing account id"), nil
|
|
}
|
|
|
|
return nil, req.Storage.Delete("config/sts/" + accountID)
|
|
}
|
|
|
|
const pathConfigStsSyn = `
|
|
Specify STS roles to be assumed for certain AWS accounts.
|
|
`
|
|
|
|
const pathConfigStsDesc = `
|
|
Allows the explicit association of STS roles to satellite AWS accounts (i.e. those
|
|
which are not the account in which the Vault server is running.) Login attempts from
|
|
EC2 instances running in these accounts will be verified using credentials obtained
|
|
by assumption of these STS roles.
|
|
|
|
The environment in which the Vault server resides must have access to assume the
|
|
given STS roles.
|
|
`
|
|
const pathListStsHelpSyn = `
|
|
List all the AWS account/STS role relationships registered with Vault.
|
|
`
|
|
|
|
const pathListStsHelpDesc = `
|
|
AWS accounts will be listed by account ID, along with their respective role names.
|
|
`
|