MovableInkAWS 2.6.1 → 2.6.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 238d21eb16377f58da3db182b93157e34f26e05b5a12a8f233039153e581ab1a
-  data.tar.gz: 55249c69017ffb581c53478eedb109c026fce69fde1dec5f60580d66b42970af
+  metadata.gz: d617b4671eb664f2e36fc1f1df11607066c0a46c1c5e536a552eb2c7ac451545
+  data.tar.gz: 5d975ee847ec37369c1488dd7c4ecc11c5d4abae33bb9131308260af256a557d
 SHA512:
-  metadata.gz: 365976f0e0e1ba918bfd8875e95e0d78d3ce59cf83ab6896b3c001250046cf5081e2cfe09b192196e01f7daef60c41523e647d720a5b8356980e2fca3900dfe2
-  data.tar.gz: 2fed258445a35f69973085710a2465e09845a1e98068f1f535551cefb3e1ebd11af9fdaed90781055b4757961eb107f8b92745bb4a0f3443cb25ebe95d7c8b75
+  metadata.gz: 70ace6a3c1a4f9d4a60e1053f93c0d37e10e5737800b149c358f804b02b3de9522dd9624dc0723b1da66bc2912544ce91de18ee8852926e39665c61cc2d8a6d5
+  data.tar.gz: b51afda56e2c80126efa86737ef9359327698324a61fc67e9c86774e4f0eb191cead2c235e665f843c8fb4f0f7b6be881dee04c271671a6c9d3e70680f5862ad

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    MovableInkAWS (2.6.1)
+    MovableInkAWS (2.6.5)
       aws-sdk-athena (~> 1)
       aws-sdk-autoscaling (~> 1)
       aws-sdk-cloudwatch (~> 1)
@@ -9,6 +9,7 @@ PATH
       aws-sdk-ec2 (~> 1)
       aws-sdk-eks (~> 1)
       aws-sdk-elasticache (~> 1)
+      aws-sdk-iam (~> 1)
       aws-sdk-rds (~> 1)
       aws-sdk-route53 (~> 1)
       aws-sdk-s3 (~> 1)
@@ -48,6 +49,9 @@ GEM
     aws-sdk-elasticache (1.76.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
+    aws-sdk-iam (1.68.0)
+      aws-sdk-core (~> 3, >= 3.127.0)
+      aws-sigv4 (~> 1.1)
     aws-sdk-kms (1.55.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
@@ -117,4 +121,4 @@ DEPENDENCIES
   webmock
 
 BUNDLED WITH
-   2.1.4
+   2.3.11

data/MovableInkAWS.gemspec

@@ -16,6 +16,7 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency 'aws-sdk-ec2', '~> 1'
   s.add_runtime_dependency 'aws-sdk-eks', '~> 1'
   s.add_runtime_dependency 'aws-sdk-elasticache', '~> 1'
+  s.add_runtime_dependency 'aws-sdk-iam', '~> 1'
   s.add_runtime_dependency 'aws-sdk-rds', '~> 1'
   s.add_runtime_dependency 'aws-sdk-route53', '~> 1'
   s.add_runtime_dependency 'aws-sdk-s3', '~> 1'

data/lib/movable_ink/aws/iam.rb

@@ -0,0 +1,23 @@
+require 'aws-sdk-iam'
+
+module MovableInk
+  class AWS
+    module IAM
+      def is_arn_iam_user?(arn, username = nil)
+        # arn:aws:iam::account:user/user-name-with-path
+        !arn.match(/arn:aws:iam::\d+:user\/#{(username) ? username + '$' : ''}/).nil?
+      end
+
+      def is_arn_iam_role?(arn, rolename = nil)
+        # arn:aws:iam::account:role/role-name-with-path
+        !arn.match(/arn:aws:iam::\d+:role\/#{(rolename) ? rolename + '$' : ''}/).nil?
+      end
+
+      def is_arn_iam_assumed_role?(arn, rolename = nil, exact_match = true)
+        # arn:aws:sts::account:assumed-role/role-name/role-session-name
+        role_name_session_delimiter = (exact_match) ? '/' : ''
+        !arn.match(/arn:aws:sts::\d+:assumed\-role\/#{(rolename) ? rolename + role_name_session_delimiter : ''}/).nil?
+      end
+    end
+  end
+end

data/lib/movable_ink/aws/ssm.rb

@@ -4,14 +4,33 @@ module MovableInk
   class AWS
     module SSM
 
+      SSM_DEFAULT_REGION = 'us-east-1'
+      SSM_DEFAULT_FAILOVER_REGION = 'us-west-2'
+
+      def mi_secrets_config_file_path
+        '/etc/movableink/secrets_config.json'
+      end
+
+      def mi_secrets_config
+        @mi_secrets_config ||= (File.exist?(mi_secrets_config_file_path)) ? JSON.parse(File.read(mi_secrets_config_file_path), :symbolize_names => true) : nil
+      end
+
+      def mi_ssm_clients_regions
+        default_regions = [SSM_DEFAULT_REGION, SSM_DEFAULT_FAILOVER_REGION]
+
+        return default_regions if !mi_secrets_config || !mi_secrets_config[:ssm_parameters_regions_map] || !mi_secrets_config[:ssm_parameters_regions_map].key?(my_region.to_sym)
+        my_region_map = mi_secrets_config[:ssm_parameters_regions_map][my_region.to_sym]
+        (my_region_map.keys == [:primary_region, :failover_region]) ? my_region_map.values : default_regions
+      end
+
       def ssm_client(region = nil)
         @ssm_clients_map ||= {}
-        @ssm_clients_map[region] ||= Aws::SSM::Client.new(region: (region.nil?) ? 'us-east-1' : region)
+        @ssm_clients_map[region] ||= Aws::SSM::Client.new(region: (region.nil?) ? mi_ssm_clients_regions[0] : region)
       end
 
       def ssm_client_failover(failregion = nil)
         @ssm_failover_clients_map ||= {}
-        @ssm_failover_clients_map[failregion] ||= Aws::SSM::Client.new(region: (failregion.nil?) ? 'us-west-2' : failregion)
+        @ssm_failover_clients_map[failregion] ||= Aws::SSM::Client.new(region: (failregion.nil?) ? mi_ssm_clients_regions[1] : failregion)
       end
 
       def run_with_backoff_and_client_fallback(region = nil, failregion = nil, &block)

data/lib/movable_ink/aws.rb

@@ -7,13 +7,13 @@ require_relative 'aws/route53'
 require_relative 'aws/ssm'
 require_relative 'aws/athena'
 require_relative 'aws/s3'
+require_relative 'aws/iam'
 require_relative 'aws/eks'
 require_relative 'aws/elasticache'
 require_relative 'aws/api_gateway'
 require_relative 'consul/consul'
 require 'aws-sdk-cloudwatch'
 
-
 module MovableInk
   class AWS
     include Metadata
@@ -27,6 +27,7 @@ module MovableInk
     include ElastiCache
     include ApiGateway
     include EKS
+    include IAM
 
     class << self
       def regions
@@ -35,7 +36,8 @@ module MovableInk
           'rld' => 'us-west-2',
           'dub' => 'eu-west-1',
           'ord' => 'us-east-2',
-          'fra' => 'eu-central-1'
+          'fra' => 'eu-central-1',
+          'par' => 'eu-west-3'
         }
       end
     end
@@ -84,7 +86,10 @@ module MovableInk
                Aws::SSM::Errors::Http503Error,
                Aws::SSM::Errors::Http502Error,
                Aws::Athena::Errors::ThrottlingException,
-               MovableInk::AWS::Errors::NoEnvironmentTagError
+               MovableInk::AWS::Errors::NoEnvironmentTagError,
+               Aws::IAM::Errors::LimitExceededException,
+               Aws::IAM::Errors::RequestLimitExceeded,
+               Aws::IAM::Errors::Throttling
           sleep_time = (num+1)**2 + rand(10)
           if quiet
             (num >= tries - 1) ? notify_and_sleep(sleep_time, $!.class) : sleep(sleep_time)

data/lib/movable_ink/version.rb

@@ -1,5 +1,5 @@
 module MovableInk
   class AWS
-    VERSION = '2.6.1'
+    VERSION = '2.6.5'
   end
 end

data/spec/iam_spec.rb

@@ -0,0 +1,43 @@
+require_relative '../lib/movable_ink/aws'
+
+describe MovableInk::AWS::IAM do
+  let(:aws) { MovableInk::AWS.new }
+
+  describe 'is_arn_iam_user?' do
+    it 'matches user by arn type' do
+      expect(aws.is_arn_iam_user?('arn:aws:iam::123:user/anosulchyk')).to eq true
+      expect(aws.is_arn_iam_user?('arn:aws:iam::123:role/anosulchyk')).to eq false
+    end
+
+    it 'matches user by arn type and name' do
+      expect(aws.is_arn_iam_user?('arn:aws:iam::123:user/anosulchyk', 'anosulchyk')).to eq true
+      expect(aws.is_arn_iam_user?('arn:aws:iam::123:user/this/is/user/too', 'this/is/user/too')).to eq true
+      expect(aws.is_arn_iam_user?('arn:aws:iam::123:user/anosulchyk', 'anosulchik11')).to eq false
+    end
+  end
+
+   describe 'is_arn_iam_role?' do
+    it 'matches role by arn type' do
+      expect(aws.is_arn_iam_role?('arn:aws:iam::123:role/anosulchyk')).to eq true
+      expect(aws.is_arn_iam_role?('arn:aws:sts::123:role/anosulchyk')).to eq false
+    end
+
+    it 'matches role by arn type and name' do
+       expect(aws.is_arn_iam_role?('arn:aws:iam::123:role/anosulchyk', 'anosulchyk')).to eq true
+      expect(aws.is_arn_iam_role?('arn:aws:iam::123:role/anosulchyk', 'anosulchik11')).to eq false
+    end
+  end
+
+  describe 'is_arn_iam_assumed_role?' do
+    it 'matches role by arn type' do
+      expect(aws.is_arn_iam_assumed_role?('arn:aws:sts::123:assumed-role/anosulchyk/session')).to eq true
+      expect(aws.is_arn_iam_assumed_role?('arn:aws:sts::123:role/anosulchyk')).to eq false
+    end
+
+    it 'matches role by arn type and name' do
+       expect(aws.is_arn_iam_assumed_role?('arn:aws:sts::123:assumed-role/anosulchyk/session', 'anosulchyk')).to eq true
+      expect(aws.is_arn_iam_assumed_role?('arn:aws:sts::123:assumed-role/anosulchyk/session-name', '1anosulchyk1')).to eq false
+    end
+  end
+
+end

data/spec/ssm_spec.rb

@@ -9,6 +9,8 @@ describe MovableInk::AWS::SSM do
       value: 'too-many-secrets'
     })
   }
+  let(:mi_secrets_config_file_path) { '/etc/movableink/secrets_config.json' }
+  let(:mi_secrets_config_file_mock) { "{\"ssm_parameters_regions_map\": { \"us-east-1\": {\"primary_region\": \"us-east-1\", \"failover_region\": \"us-east-2\"}}}" }
   let(:parameters) { ssm.stub_data(:get_parameters_by_path, parameters: [
       {
         name: '/test/zelda/Its',
@@ -113,4 +115,36 @@ describe MovableInk::AWS::SSM do
       expect(results).to include(1, 2)
     end
   end
+
+  describe 'mi_secrets_config_file_path' do
+    it 'returns string' do
+      expect(aws.mi_secrets_config_file_path).to eq mi_secrets_config_file_path
+    end
+  end
+
+  describe 'mi_secrets_config' do
+    it 'parses config file with symbols' do
+       allow(File).to receive(:read).with(mi_secrets_config_file_path).and_return(mi_secrets_config_file_mock)
+       allow(File).to receive(:exist?).with(mi_secrets_config_file_path).and_return(true)
+
+       config = aws.mi_secrets_config
+       expect(config.keys).to eq([:ssm_parameters_regions_map])
+       expect(config[:ssm_parameters_regions_map][:"us-east-1"][:primary_region]).to eq 'us-east-1'
+       expect(config[:ssm_parameters_regions_map][:"us-east-1"][:failover_region]).to eq 'us-east-2'
+    end
+  end
+
+  describe 'mi_ssm_clients_regions' do
+    it 'returns values from config' do
+      allow(aws).to receive(:mi_secrets_config).and_return(JSON.parse(mi_secrets_config_file_mock, :symbolize_names => true))
+      allow(aws).to receive(:my_region).and_return('us-east-1')
+      expect(aws.mi_ssm_clients_regions).to eq ['us-east-1', 'us-east-2']
+    end
+
+    it 'returns default values if config is missing' do
+      allow(aws).to receive(:mi_secrets_config).and_return(nil)
+      allow(aws).to receive(:my_region).and_return('us-east-1')
+      expect(aws.mi_ssm_clients_regions).to eq ['us-east-1', 'us-west-2']
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: MovableInkAWS
 version: !ruby/object:Gem::Version
-  version: 2.6.1
+  version: 2.6.5
 platform: ruby
 authors:
 - Matt Chesler
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-04-29 00:00:00.000000000 Z
+date: 2022-06-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-core
@@ -108,6 +108,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1'
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-iam
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
 - !ruby/object:Gem::Dependency
   name: aws-sdk-rds
   requirement: !ruby/object:Gem::Requirement
@@ -241,6 +255,7 @@ files:
 - lib/movable_ink/aws/eks.rb
 - lib/movable_ink/aws/elasticache.rb
 - lib/movable_ink/aws/errors.rb
+- lib/movable_ink/aws/iam.rb
 - lib/movable_ink/aws/metadata.rb
 - lib/movable_ink/aws/route53.rb
 - lib/movable_ink/aws/s3.rb
@@ -253,6 +268,7 @@ files:
 - spec/consul_spec.rb
 - spec/ec2_spec.rb
 - spec/elasticache_spec.rb
+- spec/iam_spec.rb
 - spec/metadata_spec.rb
 - spec/route53_spec.rb
 - spec/s3_spec.rb