MovableInkAWS 2.6.2 → 2.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fb359b343b37bc026f547aa8edc0dcd01fc85786947ef5dc8a6d9ef8b6da05d1
-  data.tar.gz: f0c0c888ac995d1f1c895ae359ff19bc93e46b3ea621852733b39475cad138e1
+  metadata.gz: 0c539b888e241eca594269dd052c7742eefdad57ab4dd5eeb0790a0fad507cff
+  data.tar.gz: 0ae613422476b0371f818eee49d7b8da5f659f93e4d8541f361816fb93afb3c4
 SHA512:
-  metadata.gz: 698f828137a5d649ebe788b5d9c4ab42f333e0a80eeca47708044121703c8afa79248bd86ab8ec0f6afac221c8506d3e52e10356a6f2a3213a09a45926d2d4f0
-  data.tar.gz: 2d68a15e5b41f608411a498fad5db04ec837cdf88791605a73f285e64d1f58964bb7b6d49d7ff6d570e8c919f3c280f607bf6bbc84554339cfbf1ea29eb8de88
+  metadata.gz: 31f107ee7940dd7b18d7e7c50764fcc2971c63660eafc14ae642cf1819389487a118b2b26438912cd7e234b00e4009f95d60c58308a8200d31f47c86971390a3
+  data.tar.gz: 70b71c81bd0fe0a7806824b034dea3c4d08151582377de6eec2c9416a6d5fecc1fb4fae20f62ffe948a2c5c609f6399a70460d2fa4ba5cebdaae3726abc7bc8d

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    MovableInkAWS (2.6.2)
+    MovableInkAWS (2.7.0)
       aws-sdk-athena (~> 1)
       aws-sdk-autoscaling (~> 1)
       aws-sdk-cloudwatch (~> 1)
@@ -25,53 +25,53 @@ GEM
     addressable (2.7.0)
       public_suffix (>= 2.0.2, < 5.0)
     aws-eventstream (1.2.0)
-    aws-partitions (1.573.0)
-    aws-sdk-athena (1.52.0)
+    aws-partitions (1.605.0)
+    aws-sdk-athena (1.54.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-autoscaling (1.78.0)
+    aws-sdk-autoscaling (1.79.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-cloudwatch (1.62.0)
+    aws-sdk-cloudwatch (1.64.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.130.0)
+    aws-sdk-core (3.131.2)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.525.0)
       aws-sigv4 (~> 1.1)
-      jmespath (~> 1.0)
-    aws-sdk-ec2 (1.305.0)
+      jmespath (~> 1, >= 1.6.1)
+    aws-sdk-ec2 (1.321.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-eks (1.74.0)
+    aws-sdk-eks (1.75.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-elasticache (1.76.0)
+    aws-sdk-elasticache (1.78.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-iam (1.68.0)
+    aws-sdk-iam (1.69.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-kms (1.55.0)
+    aws-sdk-kms (1.57.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-rds (1.142.0)
+    aws-sdk-rds (1.148.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-route53 (1.62.0)
+    aws-sdk-route53 (1.63.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.113.0)
+    aws-sdk-s3 (1.114.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.4)
     aws-sdk-sns (1.53.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-ssm (1.134.0)
+    aws-sdk-ssm (1.137.0)
       aws-sdk-core (~> 3, >= 3.127.0)
       aws-sigv4 (~> 1.1)
-    aws-sigv4 (1.4.0)
+    aws-sigv4 (1.5.0)
       aws-eventstream (~> 1, >= 1.0.2)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
@@ -91,7 +91,7 @@ GEM
       mime-types-data (~> 3.2015)
     mime-types-data (3.2022.0105)
     multi_xml (0.6.0)
-    multipart-post (2.1.1)
+    multipart-post (2.2.3)
     public_suffix (4.0.5)
     rspec (3.9.0)
       rspec-core (~> 3.9.0)
@@ -121,4 +121,4 @@ DEPENDENCIES
   webmock
 
 BUNDLED WITH
-   2.3.11
+   2.3.14

data/lib/movable_ink/aws/iam.rb

@@ -0,0 +1,23 @@
+require 'aws-sdk-iam'
+
+module MovableInk
+  class AWS
+    module IAM
+      def is_arn_iam_user?(arn, username = nil)
+        # arn:aws:iam::account:user/user-name-with-path
+        !arn.match(/arn:aws:iam::\d+:user\/#{(username) ? username + '$' : ''}/).nil?
+      end
+
+      def is_arn_iam_role?(arn, rolename = nil)
+        # arn:aws:iam::account:role/role-name-with-path
+        !arn.match(/arn:aws:iam::\d+:role\/#{(rolename) ? rolename + '$' : ''}/).nil?
+      end
+
+      def is_arn_iam_assumed_role?(arn, rolename = nil, exact_match = true)
+        # arn:aws:sts::account:assumed-role/role-name/role-session-name
+        role_name_session_delimiter = (exact_match) ? '/' : ''
+        !arn.match(/arn:aws:sts::\d+:assumed\-role\/#{(rolename) ? rolename + role_name_session_delimiter : ''}/).nil?
+      end
+    end
+  end
+end

data/lib/movable_ink/aws/route53.rb

@@ -13,18 +13,20 @@ module MovableInk
       end
 
       def get_resource_record_sets_by_instance_name(zone, instance_name, client = nil)
-        resource_record_sets(zone, client).select{|rrs| rrs.set_identifier == instance_name}.first.to_h
+        resource_record_sets(zone, client).select{|rrs| rrs.set_identifier == instance_name}.map(&:to_h)
       end
 
       def delete_resource_record_sets(zone, instance_name, client = nil)
-        resource_record_set = get_resource_record_sets_by_instance_name(zone, instance_name, client)
-        return if resource_record_set.empty?
+        resource_record_sets = get_resource_record_sets_by_instance_name(zone, instance_name, client)
+        return if resource_record_sets.empty?
 
         change_batch = {
-          "changes": [{
-            "action": 'DELETE',
-            "resource_record_set": resource_record_set
-          }]
+          "changes": resource_record_sets.map { |resource_record_set|
+            {
+              "action": 'DELETE',
+              "resource_record_set": resource_record_set
+            }
+          }
         }
 
         run_with_backoff do

data/lib/movable_ink/aws/ssm.rb

@@ -4,14 +4,33 @@ module MovableInk
   class AWS
     module SSM
 
+      SSM_DEFAULT_REGION = 'us-east-1'
+      SSM_DEFAULT_FAILOVER_REGION = 'us-west-2'
+
+      def mi_secrets_config_file_path
+        '/etc/movableink/secrets_config.json'
+      end
+
+      def mi_secrets_config
+        @mi_secrets_config ||= (File.exist?(mi_secrets_config_file_path)) ? JSON.parse(File.read(mi_secrets_config_file_path), :symbolize_names => true) : nil
+      end
+
+      def mi_ssm_clients_regions
+        default_regions = [SSM_DEFAULT_REGION, SSM_DEFAULT_FAILOVER_REGION]
+
+        return default_regions if !mi_secrets_config || !mi_secrets_config[:ssm_parameters_regions_map] || !mi_secrets_config[:ssm_parameters_regions_map].key?(my_region.to_sym)
+        my_region_map = mi_secrets_config[:ssm_parameters_regions_map][my_region.to_sym]
+        (my_region_map.keys == [:primary_region, :failover_region]) ? my_region_map.values : default_regions
+      end
+
       def ssm_client(region = nil)
         @ssm_clients_map ||= {}
-        @ssm_clients_map[region] ||= Aws::SSM::Client.new(region: (region.nil?) ? 'us-east-1' : region)
+        @ssm_clients_map[region] ||= Aws::SSM::Client.new(region: (region.nil?) ? mi_ssm_clients_regions[0] : region)
       end
 
       def ssm_client_failover(failregion = nil)
         @ssm_failover_clients_map ||= {}
-        @ssm_failover_clients_map[failregion] ||= Aws::SSM::Client.new(region: (failregion.nil?) ? 'us-west-2' : failregion)
+        @ssm_failover_clients_map[failregion] ||= Aws::SSM::Client.new(region: (failregion.nil?) ? mi_ssm_clients_regions[1] : failregion)
       end
 
       def run_with_backoff_and_client_fallback(region = nil, failregion = nil, &block)

data/lib/movable_ink/aws.rb

@@ -7,13 +7,12 @@ require_relative 'aws/route53'
 require_relative 'aws/ssm'
 require_relative 'aws/athena'
 require_relative 'aws/s3'
+require_relative 'aws/iam'
 require_relative 'aws/eks'
 require_relative 'aws/elasticache'
 require_relative 'aws/api_gateway'
 require_relative 'consul/consul'
 require 'aws-sdk-cloudwatch'
-require 'aws-sdk-iam'
-
 
 module MovableInk
   class AWS
@@ -28,6 +27,7 @@ module MovableInk
     include ElastiCache
     include ApiGateway
     include EKS
+    include IAM
 
     class << self
       def regions
@@ -36,7 +36,8 @@ module MovableInk
           'rld' => 'us-west-2',
           'dub' => 'eu-west-1',
           'ord' => 'us-east-2',
-          'fra' => 'eu-central-1'
+          'fra' => 'eu-central-1',
+          'par' => 'eu-west-3'
         }
       end
     end

data/lib/movable_ink/version.rb

@@ -1,5 +1,5 @@
 module MovableInk
   class AWS
-    VERSION = '2.6.2'
+    VERSION = '2.7.0'
   end
 end

data/spec/iam_spec.rb

@@ -0,0 +1,43 @@
+require_relative '../lib/movable_ink/aws'
+
+describe MovableInk::AWS::IAM do
+  let(:aws) { MovableInk::AWS.new }
+
+  describe 'is_arn_iam_user?' do
+    it 'matches user by arn type' do
+      expect(aws.is_arn_iam_user?('arn:aws:iam::123:user/anosulchyk')).to eq true
+      expect(aws.is_arn_iam_user?('arn:aws:iam::123:role/anosulchyk')).to eq false
+    end
+
+    it 'matches user by arn type and name' do
+      expect(aws.is_arn_iam_user?('arn:aws:iam::123:user/anosulchyk', 'anosulchyk')).to eq true
+      expect(aws.is_arn_iam_user?('arn:aws:iam::123:user/this/is/user/too', 'this/is/user/too')).to eq true
+      expect(aws.is_arn_iam_user?('arn:aws:iam::123:user/anosulchyk', 'anosulchik11')).to eq false
+    end
+  end
+
+   describe 'is_arn_iam_role?' do
+    it 'matches role by arn type' do
+      expect(aws.is_arn_iam_role?('arn:aws:iam::123:role/anosulchyk')).to eq true
+      expect(aws.is_arn_iam_role?('arn:aws:sts::123:role/anosulchyk')).to eq false
+    end
+
+    it 'matches role by arn type and name' do
+       expect(aws.is_arn_iam_role?('arn:aws:iam::123:role/anosulchyk', 'anosulchyk')).to eq true
+      expect(aws.is_arn_iam_role?('arn:aws:iam::123:role/anosulchyk', 'anosulchik11')).to eq false
+    end
+  end
+
+  describe 'is_arn_iam_assumed_role?' do
+    it 'matches role by arn type' do
+      expect(aws.is_arn_iam_assumed_role?('arn:aws:sts::123:assumed-role/anosulchyk/session')).to eq true
+      expect(aws.is_arn_iam_assumed_role?('arn:aws:sts::123:role/anosulchyk')).to eq false
+    end
+
+    it 'matches role by arn type and name' do
+       expect(aws.is_arn_iam_assumed_role?('arn:aws:sts::123:assumed-role/anosulchyk/session', 'anosulchyk')).to eq true
+      expect(aws.is_arn_iam_assumed_role?('arn:aws:sts::123:assumed-role/anosulchyk/session-name', '1anosulchyk1')).to eq false
+    end
+  end
+
+end

data/spec/route53_spec.rb

@@ -15,6 +15,11 @@ describe MovableInk::AWS::Route53 do
           name: 'host2.domain.tld.',
           set_identifier: '10_0_0_2',
           type: '???'
+        },
+        {
+          name: 'host2-other.domain.tld.',
+          set_identifier: '10_0_0_2',
+          type: '???'
         }
       ])
     }
@@ -23,12 +28,23 @@ describe MovableInk::AWS::Route53 do
       route53.stub_responses(:list_resource_record_sets, rrset_data)
       allow(aws).to receive(:route53).and_return(route53)
 
-      expect(aws.resource_record_sets('Z123').count).to eq(2)
-      expect(aws.resource_record_sets('Z123').first.name).to eq('host1.domain.tld.')
-      expect(aws.resource_record_sets('Z123').last.name).to eq('host2.domain.tld.')
+      expect(aws.resource_record_sets('Z123').count).to eq(3)
+      expect(aws.resource_record_sets('Z123')[0].name).to eq('host1.domain.tld.')
+      expect(aws.resource_record_sets('Z123')[1].name).to eq('host2.domain.tld.')
+      expect(aws.resource_record_sets('Z123')[2].name).to eq('host2-other.domain.tld.')
+    end
+
+    it "returns all sets with an identifier" do
+      route53.stub_responses(:list_resource_record_sets, rrset_data)
+      allow(aws).to receive(:route53).and_return(route53)
+
+      sets = aws.get_resource_record_sets_by_instance_name('Z123', '10_0_0_2')
+      expect(sets.count).to eq(2)
+      expect(sets[0][:name]).to eq('host2.domain.tld.')
+      expect(sets[1][:name]).to eq('host2-other.domain.tld.')
     end
 
-    it 'deletes a rrset that exists' do
+    it 'deletes rrsets that exist under the same identifier' do
       route53.stub_responses(:list_resource_record_sets, rrset_data)
       allow(aws).to receive(:route53).and_return(route53)
 
@@ -41,6 +57,14 @@ describe MovableInk::AWS::Route53 do
               type: "???",
               set_identifier: "10_0_0_2"
             }
+          },
+          {
+            action: "DELETE",
+            resource_record_set: {
+              name: "host2-other.domain.tld.",
+              type: "???",
+              set_identifier: "10_0_0_2"
+            }
           }]
         },
         hosted_zone_id: "Z123"

data/spec/ssm_spec.rb

@@ -9,6 +9,8 @@ describe MovableInk::AWS::SSM do
       value: 'too-many-secrets'
     })
   }
+  let(:mi_secrets_config_file_path) { '/etc/movableink/secrets_config.json' }
+  let(:mi_secrets_config_file_mock) { "{\"ssm_parameters_regions_map\": { \"us-east-1\": {\"primary_region\": \"us-east-1\", \"failover_region\": \"us-east-2\"}}}" }
   let(:parameters) { ssm.stub_data(:get_parameters_by_path, parameters: [
       {
         name: '/test/zelda/Its',
@@ -113,4 +115,36 @@ describe MovableInk::AWS::SSM do
       expect(results).to include(1, 2)
     end
   end
+
+  describe 'mi_secrets_config_file_path' do
+    it 'returns string' do
+      expect(aws.mi_secrets_config_file_path).to eq mi_secrets_config_file_path
+    end
+  end
+
+  describe 'mi_secrets_config' do
+    it 'parses config file with symbols' do
+       allow(File).to receive(:read).with(mi_secrets_config_file_path).and_return(mi_secrets_config_file_mock)
+       allow(File).to receive(:exist?).with(mi_secrets_config_file_path).and_return(true)
+
+       config = aws.mi_secrets_config
+       expect(config.keys).to eq([:ssm_parameters_regions_map])
+       expect(config[:ssm_parameters_regions_map][:"us-east-1"][:primary_region]).to eq 'us-east-1'
+       expect(config[:ssm_parameters_regions_map][:"us-east-1"][:failover_region]).to eq 'us-east-2'
+    end
+  end
+
+  describe 'mi_ssm_clients_regions' do
+    it 'returns values from config' do
+      allow(aws).to receive(:mi_secrets_config).and_return(JSON.parse(mi_secrets_config_file_mock, :symbolize_names => true))
+      allow(aws).to receive(:my_region).and_return('us-east-1')
+      expect(aws.mi_ssm_clients_regions).to eq ['us-east-1', 'us-east-2']
+    end
+
+    it 'returns default values if config is missing' do
+      allow(aws).to receive(:mi_secrets_config).and_return(nil)
+      allow(aws).to receive(:my_region).and_return('us-east-1')
+      expect(aws.mi_ssm_clients_regions).to eq ['us-east-1', 'us-west-2']
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: MovableInkAWS
 version: !ruby/object:Gem::Version
-  version: 2.6.2
+  version: 2.7.0
 platform: ruby
 authors:
 - Matt Chesler
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-09 00:00:00.000000000 Z
+date: 2022-07-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-core
@@ -255,6 +255,7 @@ files:
 - lib/movable_ink/aws/eks.rb
 - lib/movable_ink/aws/elasticache.rb
 - lib/movable_ink/aws/errors.rb
+- lib/movable_ink/aws/iam.rb
 - lib/movable_ink/aws/metadata.rb
 - lib/movable_ink/aws/route53.rb
 - lib/movable_ink/aws/s3.rb
@@ -267,6 +268,7 @@ files:
 - spec/consul_spec.rb
 - spec/ec2_spec.rb
 - spec/elasticache_spec.rb
+- spec/iam_spec.rb
 - spec/metadata_spec.rb
 - spec/route53_spec.rb
 - spec/s3_spec.rb