hiera-secrets-manager 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ddb4e09c2998f196711cd698067557e0ba49e66c315a8bb77cabdf75cc4d309b
-  data.tar.gz: bc5fab11b745e1d8b42054a652f9bc0a704642d84fae56c2fe59b77f10265d5a
+  metadata.gz: c62c6220168593608f0c75ea45f2c6669cfeab3394d3a00ea8471e9df634b6df
+  data.tar.gz: 0ff04f5c3f5def5bb5251017d475c30217ac9e1f338ccfd3be76efa1c8e773b3
 SHA512:
-  metadata.gz: 61f468931ae0cc0ec27c9b312c511b95f607d994bd4ddd2489feb9db7ab7968861e0c4dd402b063d25c02043d76cf6a07ddb1ae30df3876e8e5720b20356fa6c
-  data.tar.gz: 1c4fac048ab6cc8083bc28d97f7f0e0b712b8b4e06767f82fa01b0d64a69469afa4f56bc4ec3301dfa4fbf263bd13f2fefd61e7de9c9b54dbb541e0d0a9974b7
+  metadata.gz: 296c97802ac92301ae42ae581edb461bc570e63564a5732bd14b1acd0453c68eec7ece9461be07573f6ac145c2ea51fcf50f4a29f687eb2cf28e8f0dedee6b6d
+  data.tar.gz: 317abde2b8f974939dd5282f5dd4e42d3c86cfbc947826b0a24c074dab95cb80002520cb0584e9104be84492a1454925b32ca8eef786ba37665c5d188f201c29

data/lib/hiera/backend/secrets_manager_backend.rb

@@ -3,16 +3,23 @@ class Hiera
     class Secrets_manager_backend
       def initialize
         require 'aws-sdk-secretsmanager'
-        @client = Aws::SecretsManager::Client.new(
-          region: Config[:secrets_manager][:region]
-        )
-
-        Hiera.debug('AWS Secrets Manager backend starting')
+        @config = Config
+        @client = create_client
       end
 
       def lookup(key, scope, order_override, resolution_type)
         answer = nil
 
+        if @client.nil?
+          Hiera.debug('Key lookup failed. AWS Secrets Manager backend is in a bad state.')
+          return answer
+        end
+
+        if contains_illegal_characters?(key)
+          Hiera.debug("#{key} contains illegal characters. Skipping lookup.")
+          return answer
+        end
+
         key_to_query = format_key(key, scope, Config[:secrets_manager])
 
         begin
@@ -26,6 +33,12 @@ class Hiera
 
       private
 
+      # AWS Secrets Manager only allows alphanumeric characters or (/_+=.@-) in key names
+      # GetSecret requests will fail for keys which have illegal characters
+      def contains_illegal_characters?(key)
+        %r{^[a-zA-Z0-9\/_+=.@\-]+$}.match(key).nil?
+      end
+
       def get_prefix(environments, scope)
         if environments && environments.key?(scope['environment'])
           environments[scope['environment']]
@@ -35,7 +48,7 @@ class Hiera
       end
 
       def format_key(key, scope, config)
-        if scope.key?('environment')
+        if scope.include?('environment') && scope['environment']
           environments = config[:environments]
           prefix = get_prefix(environments, scope)
           "#{prefix}/#{key}"
@@ -43,6 +56,39 @@ class Hiera
           key
         end
       end
+
+      def create_client
+        if missing_config?
+          Hiera.debug('Warning! Config is empty. Starting in a bad state.')
+          return nil
+        end
+
+        if missing_keys?
+          Hiera.debug("Warning! Missing key(s) #{missing_keys} in Config. Starting in a bad state.")
+          return nil
+        end
+
+        Hiera.debug('AWS Secrets Manager backend starting')
+        Aws::SecretsManager::Client.new(
+          region: @config[:secrets_manager][:region],
+          access_key_id: @config[:secrets_manager][:access_key_id],
+          secret_access_key: @config[:secrets_manager][:secret_access_key]
+        )
+      end
+
+      def missing_config?
+        @config[:secrets_manager].nil?
+      end
+
+      def missing_keys?
+        !missing_keys.empty?
+      end
+
+      def missing_keys
+        %i[region access_key_id secret_access_key].reject do |key|
+          @config[:secrets_manager].include?(key)
+        end
+      end
     end
   end
 end

data/spec/secrets_manager_backend_spec.rb

@@ -4,23 +4,38 @@ require 'hiera/backend/secrets_manager_backend'
 class Hiera
   module Backend
     describe Secrets_manager_backend do
-      before do
+      before(:each) do
         @region_object = { region: 'some_region' }
+        @credentials = { access_key_id: 'some_id',
+                         secret_access_key: 'some_access_key' }
         @config_object = { secrets_manager:
-                               {
-                                 region: @region_object[:region],
-                                 environments:
-                                       {
-                                         'env1' => 'production',
-                                         'env2' => 'staging',
-                                         'env3' => 'development'
-                                       }
-                               } }
+                             {
+                               region: @region_object[:region],
+                               access_key_id: @credentials[:access_key_id],
+                               secret_access_key: @credentials[:secret_access_key],
+                               environments:
+                                     {
+                                       'env1' => 'production',
+                                       'env2' => 'staging',
+                                       'env3' => 'development'
+                                     }
+                             } }
+
         Config.load(@config_object)
         Hiera.stubs(:debug)
+        @mock_client = mock('client')
         Aws::SecretsManager::Client
           .stubs(:new)
-          .with(@region_object)
+          .with(region: @region_object[:region],
+                access_key_id: @credentials[:access_key_id],
+                secret_access_key: @credentials[:secret_access_key])
+          .returns(@mock_client)
+      end
+
+      def mock_scope_with_environment(environment)
+        mock_scope = mock
+        mock_scope.stubs(:lookupvar).with('environment').returns(environment)
+        Hiera::Scope.new(mock_scope)
       end
 
       describe '#initialize' do
@@ -34,19 +49,59 @@ class Hiera
         it 'should set up a connection to AWS Secrets Manager' do
           Aws::SecretsManager::Client
             .expects(:new)
-            .with(@region_object)
+            .with(region: @region_object[:region],
+                  access_key_id: @credentials[:access_key_id],
+                  secret_access_key: @credentials[:secret_access_key])
           Secrets_manager_backend.new
         end
+
+        context 'with bad config' do
+          after do
+            Secrets_manager_backend.new
+          end
+
+          it 'with empty config, should announce that it has no config' do
+            config_object = {}
+            Config.load(config_object)
+            Hiera
+              .expects(:debug)
+              .with('Warning! Config is empty. Starting in a bad state.')
+          end
+
+          it 'with no params, should announce that it is in a bad state' do
+            config_object = { secrets_manager: {} }
+            Config.load(config_object)
+            Hiera
+              .expects(:debug)
+              .with('Warning! Missing key(s) [:region, :access_key_id, :secret_access_key] in Config. Starting in a bad state.')
+          end
+
+          [:region, :access_key_id, :secret_access_key].each do |key|
+            it "debug should announce when key [#{key}] is missing in config" do
+              @config_object[:secrets_manager].delete(key)
+              Config.load(@config_object)
+              Hiera
+                .expects(:debug)
+                .with("Warning! Missing key(s) [:#{key}] in Config. Starting in a bad state.")
+            end
+          end
+        end
       end
 
       describe '#lookup' do
         before do
-          @mock_client = mock('client')
-          Aws::SecretsManager::Client
-            .stubs(:new)
-            .with(@region_object).returns(@mock_client)
           @backend = Secrets_manager_backend.new
-          @scope = { 'environment' => 'env1' }
+          @scope = mock_scope_with_environment('env1')
+        end
+
+        it 'should announce if it is in a bad state' do
+          config_object = { secrets_manager: {} }
+          Config.load(config_object)
+          Hiera
+            .expects(:debug)
+            .with('Key lookup failed. AWS Secrets Manager backend is in a bad state.')
+          backend = Secrets_manager_backend.new
+          backend.lookup('some_secret', {}, nil, nil)
         end
 
         it 'should return a secret that exists' do
@@ -85,7 +140,8 @@ class Hiera
         end
 
         it 'falls back to provided scope environment when Hiera config does not include environment as a key / value pair' do
-          scope = { 'environment' => 'some_env_not_in_config' }
+          scope = mock_scope_with_environment('some_env_not_in_config')
+
           prefixed_secret_name = 'some_env_not_in_config/secret_name'
 
           @mock_client
@@ -99,7 +155,8 @@ class Hiera
           incomplete_config = { secrets_manager: { region: @region_object[:region] } }
           Config.load(incomplete_config)
 
-          scope = { 'environment' => 'some_env' }
+          scope = mock_scope_with_environment('some_env')
+
           prefixed_secret_name = 'some_env/secret_name'
 
           @mock_client
@@ -110,14 +167,32 @@ class Hiera
         end
 
         it 'does not use prefix if no environment is provided in scope' do
-          scope = { 'no_environment_key' => 'some_value' }
+          scope = mock_scope_with_environment(nil)
+
           secret_name = 'secret_name'
 
           @mock_client
             .expects(:get_secret_value)
             .with(secret_id: secret_name)
             .returns('secret_string' => 'the_secret')
-          @backend.lookup('secret_name', scope, nil, nil)
+
+          @backend.lookup(secret_name, scope, nil, nil)
+        end
+
+        %w[: ~ # \\].each do |character|
+          it "returns nil if key has illegal character [#{character}] (according to AWS)" do
+            @mock_client
+              .expects(:get_secret_value)
+              .never
+
+            secret_name = "secret#{character}name"
+
+            Hiera
+              .expects(:debug)
+              .with("#{secret_name} contains illegal characters. Skipping lookup.")
+
+            @backend.lookup(secret_name, @scope, nil, nil)
+          end
         end
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hiera-secrets-manager
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Unruly
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-08-21 00:00:00.000000000 Z
+date: 2018-08-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-secretsmanager