heroku-config 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9f2111e59e572f3463941128576134d04698f17a13fd133c1213a420b8aa59dd
-  data.tar.gz: 77deca42ebf969b897016d61895c61c9c401a0d1833e5f0a2bbbb2a65a021e51
+  metadata.gz: 52a0676bf09a3f428fafa5a9c04dc2199f8b7c86712c406591ee300c7725a851
+  data.tar.gz: 3b4c9a26b6f26788a07a5cecd85de0c16a317f4b174aed58dfa43b02b2b5796a
 SHA512:
-  metadata.gz: 077a3d0563fb87a77786a1e714a0c1674f6efbcf0deb97df964d02cb32018ceb9d77dcb9b6234a95db9ac2f5e9c8e61f5698e8542ad0746d7025325740e8db71
-  data.tar.gz: b2f1d704ee3de001475569491e09368c41ba22258d64d15b88e0e1a4ff92f44f8553d1007d6f1b1472e816963837320bf40f3b5e357fb280b3f0568c193f3648
+  metadata.gz: 5840cceab8d8bb86d4a2bc126f8e1e132cb7e4849e2b7b31a475cf37ed80b9aa25f60e94afc8b7611ec4e2c9517cd48c1a2779e3b4b4b2b0c989c48307781dee
+  data.tar.gz: e07acd595822a3c66c53f3b727180bf87e9d30aae5f9fc26db4374035a6786859736bb58597402349bdfee96c56219688defb6285cf78d0ca71b73c9a7c2dadd

data/CHANGELOG.md

@@ -3,6 +3,10 @@
 All notable changes to this project will be documented in this file.
 This project *tries* to adhere to [Semantic Versioning](http://semver.org/), even before v1.0.
 
+## [0.3.0]
+- add aws-rotate-all command
+- friendly error if access key does not exist on heroku app
+
 ## [0.2.0]
 - check if new key is useable before completing rotation
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    heroku-config (0.1.0)
+    heroku-config (0.2.0)
       activesupport
       aws-sdk-core
       aws-sdk-iam

data/README.md

@@ -4,12 +4,18 @@
 
 Quickly rotate [AWS credential keys](https://docs.aws.amazon.com/general/latest/gr/aws-security-credentials.html) and [heroku configs](https://devcenter.heroku.com/articles/config-vars).
 
-Do you have long-term AWS credentials like `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` deployed to your Heroku applications? When was the last time they were rotated?  
+Do you have long-term AWS credentials like `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` deployed to your Heroku applications? When was the last time they were rotated?
 
 Rotating AWS keys is one of the simplest security measures to take. Usually though, we're too busy with developing features and rotating keys take a back seat. This tool automates the boring and manual process of rotating keys. Run this on your CodeBuild, jenkins server, a lambda function, or just manually when you have to.
 
 ## Usage
 
+Switch to an AWS_PROFILE with the permissions to create and delete AWS keys, usually an admin.
+
+    export AWS_PROFILE=yourprofile
+
+Run the `aws-rotate` command.
+
     heroku-config aws-rotate APP
 
 ## Example with Output
@@ -27,9 +33,30 @@ Rotating AWS keys is one of the simplest security measures to take. Usually thou
     Old access key deleted: AKIAXZ6ODJLQSGEXAMPLE
     $
 
+## Rotate Multiple Apps
+
+You can use the `aws-rotate-all` command to rotate a list of heroku apps.
+
+    heroku-config aws-rotate-all FILE
+
+The FILE should contain a list of apps separated by new lines.  Example:
+
+~/heroku-apps.txt:
+
+    radiant-fortress-40674
+    protected-oasis-24054
+
+Then the command would be:
+
+    heroku-config aws-rotate-all ~/heroku-apps.txt
+
+For more help:
+
+    heroku-config aws-rotate-all -h
+
 ## Installation
 
-Or install with RubyGems.
+Install with:
 
     gem install heroku-config
 

data/lib/heroku_config/aws_key.rb

@@ -2,6 +2,7 @@ module HerokuConfig
   class AwsKey < Base
     include AwsServices
     class MaxKeysError < StandardError; end
+    class AccessKeyNotFound < StandardError; end
 
     def initialize(options, access_key_id)
       @options, @access_key_id = options, access_key_id
@@ -26,13 +27,25 @@ module HerokuConfig
       true
     end
 
-    def get_user_name
+    def get_user_name(quiet_error: true)
       return "fakeuser" if @options[:noop]
 
-      resp = iam.get_access_key_last_used(
-        access_key_id: @access_key_id,
-      )
-      resp.user_name
+      begin
+        resp = iam.get_access_key_last_used(
+          access_key_id: @access_key_id,
+        )
+        resp.user_name
+      rescue Aws::IAM::Errors::AccessDenied => e # "obscure" error if access key is not found also
+        puts "#{e.class} #{e.message}".color(:red)
+        puts <<~EOL
+          Are you sure the access key exists?
+          You can try running the following with an admin user to see if the key exists:
+
+              aws iam get-access-key-last-used --access-key-id #{@access_key_id}
+
+        EOL
+        @options[:cli] ? exit(1) : raise(AccessKeyNotFound)
+      end
     end
 
     def wait_until_usable(key, secret)
@@ -44,6 +57,7 @@ module HerokuConfig
       )
       begin
         sts.get_caller_identity
+        puts "Confirmed that new AWS key is usable."
         true
       rescue Aws::STS::Errors::InvalidClientTokenId => e
         puts "#{e.class}: #{e.message}"

data/lib/heroku_config/aws_rotate.rb

@@ -1,5 +1,7 @@
 module HerokuConfig
   class AwsRotate < Base
+    class MaxKeysError < StandardError; end
+
     def initialize(options={})
       @options = options
       @app = options[:app]
@@ -8,8 +10,13 @@ module HerokuConfig
     def run
       key_id = config.get("AWS_ACCESS_KEY_ID")
       unless key_id
-        puts "WARN: No AWS_ACCESS_KEY_ID found for #{@app.color(:green)} app. Exiting."
-        exit 0
+        puts "WARN: No AWS_ACCESS_KEY_ID found for #{@app.color(:green)} app."
+        if @options[:cli]
+          puts "Exiting"
+          exit 0
+        else
+          return
+        end
       end
 
       aws_key = AwsKey.new(@options, key_id)

data/lib/heroku_config/aws_rotate_all.rb

@@ -0,0 +1,24 @@
+module HerokuConfig
+  class AwsRotateAll < Base
+    def initialize(options={})
+      @options = options
+      @file = options[:file]
+    end
+
+    def run
+      if ENV['HEROKU_CONFIG_TEST']
+        puts "NOOP"
+        return
+      end
+
+      apps.each do |app|
+        AwsRotate.new(@options.merge(app: app)).run
+      end
+    end
+
+    def apps
+      IO.readlines(@file).map(&:strip).reject(&:empty?)
+    end
+    memoize :apps
+  end
+end

data/lib/heroku_config/cli.rb

@@ -3,10 +3,16 @@ module HerokuConfig
     class_option :verbose, type: :boolean
     class_option :noop, type: :boolean
 
-    desc "aws-rotate APP", "Say aws_rotate to APP"
+    desc "aws-rotate APP", "Rotates AWS key for app"
     long_desc Help.text(:aws_rotate)
     def aws_rotate(app)
-      AwsRotate.new(options.merge(app: app)).run
+      AwsRotate.new(options.merge(app: app, cli: true)).run
+    end
+
+    desc "aws-rotate-all FILE", "Rotates AWS key for list of apps"
+    long_desc Help.text(:aws_rotate_all)
+    def aws_rotate_all(file)
+      AwsRotateAll.new(options.merge(file: file)).run
     end
 
     desc "completion *PARAMS", "Prints words for auto-completion."

data/lib/heroku_config/config.rb

@@ -9,7 +9,8 @@ module HerokuConfig
 
     def get(name)
       return "fakevalue" if ENV['HEROKU_CONFIG_TEST']
-      sh "heroku config:get #{name} -a #{@app}"
+      out = sh "heroku config:get #{name} -a #{@app}"
+      return out if !out&.empty?
     end
 
     def set(*params)

data/lib/heroku_config/help/aws_rotate.md

@@ -8,11 +8,13 @@
     => heroku config:get AWS_ACCESS_KEY_ID -a protected-oasis-24054
     Updating access key for user: bob
     Created new access key: AKIAXZ6ODJLQQEXAMPLE
+    Checking if new AWS key is usable yet.
+    Confirmed that new AWS key is usable.
     => heroku config:set AWS_ACCESS_KEY_ID=AKIAXZ6ODJLQQEXAMPLE AWS_SECRET_ACCESS_KEY=sp4gmsuif0XgYG2cPiZbkvl93kTGaeDDhEXAMPLE -a protected-oasis-24054
     Setting heroku config variables
     Setting AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and restarting protected-oasis-24054... done, v21
 
     AWS_ACCESS_KEY_ID:     AKIAXZ6ODJLQQEXAMPLE
     AWS_SECRET_ACCESS_KEY: sp4gmsuif0XgYG2cPiZbkvl93kTGaeDDhEXAMPLE
-    Old access key deleted: AKIAXZ6ODJLQSGGE27KK
+    Old access key deleted: AKIAXZ6ODJLQSEXAMPLE
     $

data/lib/heroku_config/help/aws_rotate_all.md

@@ -0,0 +1,27 @@
+## Examples
+
+    heroku-config aws-rotate-all
+
+## Example with Output
+
+    $ cat ~/heroku-apps.txt
+    radiant-fortress-40674
+    protected-oasis-24054
+    $ heroku-config aws-rotate-all ~/heroku-apps.txt
+    => heroku config:get AWS_ACCESS_KEY_ID -a radiant-fortress-40674
+    WARN: No AWS_ACCESS_KEY_ID found for radiant-fortress-40674 app.
+    => heroku config:get AWS_ACCESS_KEY_ID -a protected-oasis-24054
+    Updating access key for user: bob
+    Created new access key: AKIAXZ6ODJLQSEXAMPLE
+    Checking if new AWS key is usable yet.
+    Aws::STS::Errors::InvalidClientTokenId: The security token included in the request is invalid.
+    New IAM key not usable yet. Delaying for 5 seconds and retrying...
+    Confirmed that new AWS key is usable.
+    => heroku config:set AWS_ACCESS_KEY_ID=AKIAXZ6ODJLQSEXAMPLE AWS_SECRET_ACCESS_KEY=SGxokj5/9PYaAtqu3C6UOqPPUi+C0yPT6EXAMPLE -a protected-oasis-24054
+    Setting heroku config variables
+    Setting AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and restarting protected-oasis-24054... done, v27
+
+    AWS_ACCESS_KEY_ID:     AKIAXZ6ODJLQSEXAMPLE
+    AWS_SECRET_ACCESS_KEY: SGxokj5/9PYaAtqu3C6UOqPPUi+C0yPT6EXAMPLE
+    Old access key deleted: AKIAXZ6ODJLQZEXAMPLE
+    $

data/lib/heroku_config/version.rb

@@ -1,3 +1,3 @@
 module HerokuConfig
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/spec/fixtures/heroku-apps.txt

@@ -0,0 +1,2 @@
+radiant-fortress-40674
+protected-oasis-24054

data/spec/lib/cli_spec.rb

@@ -6,8 +6,12 @@ describe HerokuConfig::CLI do
   describe "heroku-config" do
     it "aws-rotate" do
       out = execute("exe/heroku-config aws-rotate #{@args}")
-      puts out
       expect(out).to include("NOOP: Updating access key for user: fakeuser")
     end
+
+    it "aws-rotate-all" do
+      out = execute("exe/heroku-config aws-rotate-all spec/fixtures/heroku-apps.txt")
+      expect(out).to include("NOOP")
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: heroku-config
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Tung Nguyen
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-11-16 00:00:00.000000000 Z
+date: 2019-11-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -202,6 +202,7 @@ files:
 - lib/heroku_config/autoloader.rb
 - lib/heroku_config/aws_key.rb
 - lib/heroku_config/aws_rotate.rb
+- lib/heroku_config/aws_rotate_all.rb
 - lib/heroku_config/aws_services.rb
 - lib/heroku_config/base.rb
 - lib/heroku_config/cli.rb
@@ -212,9 +213,11 @@ files:
 - lib/heroku_config/config.rb
 - lib/heroku_config/help.rb
 - lib/heroku_config/help/aws_rotate.md
+- lib/heroku_config/help/aws_rotate_all.md
 - lib/heroku_config/help/completion.md
 - lib/heroku_config/help/completion_script.md
 - lib/heroku_config/version.rb
+- spec/fixtures/heroku-apps.txt
 - spec/lib/cli_spec.rb
 - spec/spec_helper.rb
 homepage: https://github.com/tongueroo/heroku-config
@@ -241,5 +244,6 @@ signing_key:
 specification_version: 4
 summary: Heroku Config AWS Access Key Rotator
 test_files:
+- spec/fixtures/heroku-apps.txt
 - spec/lib/cli_spec.rb
 - spec/spec_helper.rb