hiera-secrets-manager 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: ddb4e09c2998f196711cd698067557e0ba49e66c315a8bb77cabdf75cc4d309b
+  data.tar.gz: bc5fab11b745e1d8b42054a652f9bc0a704642d84fae56c2fe59b77f10265d5a
+SHA512:
+  metadata.gz: 61f468931ae0cc0ec27c9b312c511b95f607d994bd4ddd2489feb9db7ab7968861e0c4dd402b063d25c02043d76cf6a07ddb1ae30df3876e8e5720b20356fa6c
+  data.tar.gz: 1c4fac048ab6cc8083bc28d97f7f0e0b712b8b4e06767f82fa01b0d64a69469afa4f56bc4ec3301dfa4fbf263bd13f2fefd61e7de9c9b54dbb541e0d0a9974b7

data/lib/hiera/backend/secrets_manager_backend.rb

@@ -0,0 +1,48 @@
+class Hiera
+  module Backend
+    class Secrets_manager_backend
+      def initialize
+        require 'aws-sdk-secretsmanager'
+        @client = Aws::SecretsManager::Client.new(
+          region: Config[:secrets_manager][:region]
+        )
+
+        Hiera.debug('AWS Secrets Manager backend starting')
+      end
+
+      def lookup(key, scope, order_override, resolution_type)
+        answer = nil
+
+        key_to_query = format_key(key, scope, Config[:secrets_manager])
+
+        begin
+          answer = @client.get_secret_value(secret_id: key_to_query)['secret_string']
+        rescue Aws::SecretsManager::Errors::ResourceNotFoundException => error
+          Hiera.debug("#{key} not found: #{error.message}")
+        end
+
+        answer
+      end
+
+      private
+
+      def get_prefix(environments, scope)
+        if environments && environments.key?(scope['environment'])
+          environments[scope['environment']]
+        else
+          scope['environment']
+        end
+      end
+
+      def format_key(key, scope, config)
+        if scope.key?('environment')
+          environments = config[:environments]
+          prefix = get_prefix(environments, scope)
+          "#{prefix}/#{key}"
+        else
+          key
+        end
+      end
+    end
+  end
+end

data/spec/secrets_manager_backend_spec.rb

@@ -0,0 +1,125 @@
+require 'spec_helper'
+require 'hiera/backend/secrets_manager_backend'
+
+class Hiera
+  module Backend
+    describe Secrets_manager_backend do
+      before do
+        @region_object = { region: 'some_region' }
+        @config_object = { secrets_manager:
+                               {
+                                 region: @region_object[:region],
+                                 environments:
+                                       {
+                                         'env1' => 'production',
+                                         'env2' => 'staging',
+                                         'env3' => 'development'
+                                       }
+                               } }
+        Config.load(@config_object)
+        Hiera.stubs(:debug)
+        Aws::SecretsManager::Client
+          .stubs(:new)
+          .with(@region_object)
+      end
+
+      describe '#initialize' do
+        it 'should announce its creation' do
+          Hiera
+            .expects(:debug)
+            .with('AWS Secrets Manager backend starting')
+          Secrets_manager_backend.new
+        end
+
+        it 'should set up a connection to AWS Secrets Manager' do
+          Aws::SecretsManager::Client
+            .expects(:new)
+            .with(@region_object)
+          Secrets_manager_backend.new
+        end
+      end
+
+      describe '#lookup' do
+        before do
+          @mock_client = mock('client')
+          Aws::SecretsManager::Client
+            .stubs(:new)
+            .with(@region_object).returns(@mock_client)
+          @backend = Secrets_manager_backend.new
+          @scope = { 'environment' => 'env1' }
+        end
+
+        it 'should return a secret that exists' do
+          secret_name = 'secret_name'
+          secret_string = 'i_am_a_secret'
+          prefixed_secret_name = 'production/secret_name'
+
+          @mock_client.stubs(:get_secret_value)
+                      .with(secret_id: prefixed_secret_name)
+                      .returns('secret_string' => secret_string)
+
+          answer = @backend.lookup(secret_name, @scope, nil, nil)
+          expect(answer).to eq(secret_string)
+        end
+
+        it 'should not return a secret that does not exist' do
+          nonexistent_secret = 'does_not_exist'
+          prefixed_nonexistent_secret = 'production/does_not_exist'
+          mock_context = {}
+          error_message = 'Secrets Manager could not find this secret.'
+          error = Aws::
+                  SecretsManager::
+                  Errors::
+                  ResourceNotFoundException.new(
+                    mock_context,
+                    error_message
+                  )
+          @mock_client.stubs(:get_secret_value)
+                      .with(secret_id: prefixed_nonexistent_secret)
+                      .raises(error)
+          Hiera
+            .expects(:debug)
+            .with("#{nonexistent_secret} not found: #{error_message}")
+          answer = @backend.lookup(nonexistent_secret, @scope, nil, nil)
+          expect(answer).to eq(nil)
+        end
+
+        it 'falls back to provided scope environment when Hiera config does not include environment as a key / value pair' do
+          scope = { 'environment' => 'some_env_not_in_config' }
+          prefixed_secret_name = 'some_env_not_in_config/secret_name'
+
+          @mock_client
+            .expects(:get_secret_value)
+            .with(secret_id: prefixed_secret_name)
+            .returns('secret_string' => 'the_secret')
+          @backend.lookup('secret_name', scope, nil, nil)
+        end
+
+        it 'falls back to provided scope environment when Hiera config does not include any environments' do
+          incomplete_config = { secrets_manager: { region: @region_object[:region] } }
+          Config.load(incomplete_config)
+
+          scope = { 'environment' => 'some_env' }
+          prefixed_secret_name = 'some_env/secret_name'
+
+          @mock_client
+            .expects(:get_secret_value)
+            .with(secret_id: prefixed_secret_name)
+            .returns('secret_string' => 'the_secret')
+          @backend.lookup('secret_name', scope, nil, nil)
+        end
+
+        it 'does not use prefix if no environment is provided in scope' do
+          scope = { 'no_environment_key' => 'some_value' }
+          secret_name = 'secret_name'
+
+          @mock_client
+            .expects(:get_secret_value)
+            .with(secret_id: secret_name)
+            .returns('secret_string' => 'the_secret')
+          @backend.lookup('secret_name', scope, nil, nil)
+        end
+      end
+    end
+  end
+end

metadata

@@ -0,0 +1,61 @@
+--- !ruby/object:Gem::Specification
+name: hiera-secrets-manager
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Unruly
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2018-08-21 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-secretsmanager
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.11.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.11.0
+description: Hiera-Secrets-Manager is a backend for Hiera which can look up secrets
+  from AWS Secrets Manager.
+email: boss@unrulygroup.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/hiera/backend/secrets_manager_backend.rb
+- spec/secrets_manager_backend_spec.rb
+homepage: https://github.com/unruly/hiera-secrets-manager
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.7.7
+signing_key: 
+specification_version: 4
+summary: AWS Secrets Manager backend for Hiera
+test_files:
+- spec/secrets_manager_backend_spec.rb