hiera-secrets-manager 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 57e97872a9cbff8301bda0bed4d875eaf753ee98821a4a02dcd952d13edf5cb0
-  data.tar.gz: 6a7115676e77452f3877261e09c95f5313a4e44e6e7b5748eb9cddce24972ae8
+  metadata.gz: d957e8bc909ebdfa6cecd07424e9fcc3f3d39f9ba4323ada8fab950ac59ca34e
+  data.tar.gz: 2c06f3cf7e450bd190cb0c320eb650b46b4bd6b179323abfff45fc0a2b2377d3
 SHA512:
-  metadata.gz: 759c7e6f4359ebaccc1d513f2b0c85d9fe71198bfbe8a6ca6483f56a2c81585c8f9b1f829cfc5a18fc44c47d6f4d90a126d8313a7480b9a8e91fa5e5c549c0c5
-  data.tar.gz: f0b523c80d40cc1c11ac0e217dd4196b92ef0b3353c6873ec9526165555c773d9af4ba8acf454b62cd8c65bda5178e3475cb6f318051f60ab26142ccd6d31667
+  metadata.gz: bb4ca7d762873a65db8d5a028f0e890be496f9c706f97e55c0b815a0e0bf27e8e4820620093fb2edc529413aec2f58413c7cc80f2844edb6dee9dbd4f3b49158
+  data.tar.gz: e9bec7ae36a367ba8784cf3442e5d3da8e547c90e46fa6920ddd101ed0312079f9d58933dd103fb187eb2a97f729c622343e7d27a319c749a5fe384dea49bafc

data/lib/hiera/backend/secrets_manager_backend.rb

@@ -2,6 +2,7 @@ class Hiera
   module Backend
     class Secrets_manager_backend
       def initialize
+        require 'json'
         require 'aws-sdk-secretsmanager'
         @config = Config
         @client = create_client
@@ -23,13 +24,19 @@ class Hiera
         key_to_query = format_key(key, scope, Config[:secrets_manager])
 
         begin
-          response = @client.get_secret_value(secret_id: key_to_query)
-          answer = response['secret_string']
-          Hiera.debug("Retrieved Secret '#{key_to_query}' with version '#{response['version_id']}'")
+          case resolution_type
+          when :array
+            Hiera.warn("Hiera Secrets Manager backend does not support arrays.")
+          when :hash
+            answer = JSON.parse(retrieve_secret(key_to_query))
+          else
+            answer = retrieve_secret(key_to_query)
+          end
         rescue Aws::SecretsManager::Errors::ResourceNotFoundException => error
           Hiera.debug("#{key_to_query} not found: #{error.message}")
         rescue StandardError => error
-          Hiera.debug("AWS Secrets Manager Error: #{error}")
+          Hiera.debug("Secrets Manager Backend Error:")
+          Hiera.debug(error)
         end
 
         answer
@@ -93,6 +100,12 @@ class Hiera
           @config[:secrets_manager].include?(key)
         end
       end
+
+      def retrieve_secret(key)
+        response = @client.get_secret_value(secret_id: key)
+        Hiera.debug("Retrieved Secret '#{key}' with version '#{response['version_id']}'")
+        response['secret_string']
+      end
     end
   end
 end

data/spec/secrets_manager_backend_spec.rb

@@ -160,7 +160,8 @@ class Hiera
               .raises(error)
           Hiera
               .expects(:debug)
-              .with("AWS Secrets Manager Error: #{error_message}")
+              .with("Secrets Manager Backend Error:")
+              .with(error)
           answer = @backend.lookup(secret_name, {}, nil, nil)
           expect(answer).to eq(nil)
         end
@@ -205,19 +206,62 @@ class Hiera
           @backend.lookup(secret_name, scope, nil, nil)
         end
 
-        %w[: ~ # \\].each do |character|
-          it "returns nil if key has illegal character [#{character}] (according to AWS)" do
-            @mock_client
-              .expects(:get_secret_value)
-              .never
+        context 'with illegal characters' do
+          %w[: ~ # \\].each do |character|
+            it "returns nil if key has illegal character [#{character}] (according to AWS)" do
+              @mock_client
+                  .expects(:get_secret_value)
+                  .never
+
+              secret_name = "secret#{character}name"
+
+              Hiera
+                  .expects(:debug)
+                  .with("#{secret_name} contains illegal characters. Skipping lookup.")
 
-            secret_name = "secret#{character}name"
+              @backend.lookup(secret_name, @scope, nil, nil)
+            end
+          end
+        end
 
+        context 'resolution type' do
+          it 'does not support arrays' do
+            @mock_client
+                .expects(:get_secret_value)
+                .never
             Hiera
-              .expects(:debug)
-              .with("#{secret_name} contains illegal characters. Skipping lookup.")
+                .expects(:warn)
+                .with("Hiera Secrets Manager backend does not support arrays.")
+            answer = @backend.lookup('some_secret', {}, nil, :array)
+            expect(answer).to eq(nil)
+          end
+
+          it 'parses hashes successfully' do
+            secret_name = 'some_secret'
+            @mock_client
+                .expects(:get_secret_value)
+                .with(secret_id: secret_name)
+                .returns('secret_string' => '{"foo": "bar"}')
+            answer = @backend.lookup(secret_name, {}, nil, :hash)
+            expect(answer).to eq({ 'foo' => 'bar' })
+          end
 
-            @backend.lookup(secret_name, @scope, nil, nil)
+          it 'should announce if expecting hash and receiving string' do
+            secret_name = 'some_secret'
+            error = JSON::ParserError.new('unexpected token')
+            @mock_client
+                .expects(:get_secret_value)
+                .with(secret_id: secret_name)
+                .returns('secret_string' => 'some string')
+            JSON
+                .stubs(:parse)
+                .raises(error)
+            Hiera
+                .expects(:debug)
+                .with("Secrets Manager Backend Error:")
+                .with(error)
+            answer = @backend.lookup(secret_name, {}, nil, :hash)
+            expect(answer).to eq(nil)
           end
         end
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hiera-secrets-manager
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Unruly
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-08-30 00:00:00.000000000 Z
+date: 2018-09-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-secretsmanager