moonshot 1.1.0.beta1 → 1.1.0.beta2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 2940b0c43a48274eb8368400726fc3269ff6fdf9
-  data.tar.gz: fb6dfbf21127e8c55533bf848361f81c07f2b0d7
+  metadata.gz: 47ebc9ac74a51f7c8b474a1947508d4f32d16e9d
+  data.tar.gz: 84c3812ddc48bb7308027d442306a85288be1c94
 SHA512:
-  metadata.gz: 146242a237abcccc8229257e0c73310ff539ba1483a57695cc1d6ccbc534778ac015354a9b91fa7ee09e83a8c2e921c3e61946dfd7a5ce0169b04ef005b37376
-  data.tar.gz: aaf546412e380adc74bc823e7e2a7aef2e1ae31eafb35c2fe284e075b714940eb3d88b7c72dfa53a890f1bf9a62b0fb2108691f52eca510aa205bc1eccf67af2
+  metadata.gz: 2bd8244804aa2441c7f95434f68ae5f39c8e0c9fa305d986a66e5477e0285d244a6cb196a77036d22080fe62cf4897b8438f932fba53638fe71120c1b2bc065a
+  data.tar.gz: fb7bba6e3ae5e84e2a8f4f9c70953f1578425770fe37ea9ce2a2f2bc7f920757a31f311c7cacc3834488a3355b828871ca22a271fb385620fbb4e0a2c4935a54

data/lib/plugins/encrypted_parameters.rb

@@ -0,0 +1,111 @@
+# This plugin encrypts parameters of the stack using a KMS Key,
+# storing and passing the key used to the stack as a parameter as
+# well. The resources in the stack can then use that KMS Key to
+# decrypt those values.
+#
+# Example:
+#
+# Moonshot.config do |s|
+#   # .. mechanism config, etc. ..
+#
+#   # The user will be prompted for values for SecretParameter1 and
+#   # SecretParameter2, which will then be encrypted by this plugins
+#   # pre_create and pre_update hooks.
+#   c.plugins << Moonshot::Plugins::EncryptedParameters.new(
+#     'KMSKey1', %w(SecretParameter1 SecretParameter2)
+#
+#   # Don't prompt the user for a KMS Key, since the default of 'Auto'
+#   # will generate a new key. They can override it with an answer
+#   # file or command line parameter if needed.
+#   c.parameter_sources['KMSKey1'] = Moonshot::AlwaysUseDefaultSource.new
+# end
+module Moonshot
+  class EncryptedParameters
+    # @param [String] kms_key_parameter_name
+    #   The parameter name to store the KMS Key ARN as.
+    # @param [Array<String>] parameters
+    #   Names of parameters to encrypt, if they are not already set.
+    def initialize(kms_key_parameter_name, parameters)
+      @kms_key_parameter_name = kms_key_parameter_name
+      @parameters = parameters
+      @delete_key = true
+    end
+
+    def pre_create(res)
+      @ilog = res.ilog
+
+      key_arn = find_or_create_kms_key
+      pe = ParameterEncrypter.new(key_arn)
+
+      @parameters.each do |parameter_name|
+        sp = Moonshot.config.parameters[parameter_name]
+        raise "No such parameter #{parameter_name}" unless sp
+
+        @ilog.start_threaded "Handling encrypted parameter #{parameter_name.blue}..." do |s|
+          if sp.use_previous?
+            # TODO: Remove this and the one below when the upstream race is fixed.
+            #       See https://github.com/askreet/interactive-logger/issues/7
+            sleep 0.05
+            s.success "Using previous encrypted value for #{parameter_name.blue}."
+          elsif !sp.set? && !sp.default?
+            # If the parameter isn't set, we can't encrypt it. Doing
+            # nothing means we will give the user a friendly error message
+            # about unset parameters when the controller resumes.
+            sleep 0.05
+            s.failure "No value to encrypt for #{parameter_name.blue}!"
+          else
+            s.continue "Encrypting new value for parameter #{parameter_name.blue}..."
+            Moonshot.config.parameters[sp.name].set(pe.encrypt(sp.value))
+            s.success "Encrypted new value for parameter #{parameter_name.blue}!"
+          end
+        end
+      end
+    end
+    alias pre_update pre_create
+
+    def post_delete(res)
+      key_arn = Moonshot.config.parameters[@kms_key_parameter_name].value
+
+      res.ilog.start_threaded "Cleaning up KMS Key #{@kms_key_parameter_name.blue}..." do |s|
+        if @delete_key
+          KmsKey.new(key_arn).delete
+          s.success "Deleted KMS Key #{@kms_key_parameter_name.blue}!"
+        else
+          # TODO: See above.
+          sleep 0.05
+          s.success "Retained KMS Key #{@kms_key_parameter_name.blue}."
+        end
+      end
+    end
+
+    def delete_cli_hook(parser)
+      parser.on('--retain-kms-key', TrueClass, 'Do not delete the KMS Key for this environment.') do
+        @delete_key = false
+      end
+    end
+
+    private
+
+    def find_or_create_kms_key
+      key_arn = nil
+
+      @ilog.start_threaded "Checking for KMS Key #{@kms_key_parameter_name}" do |s|
+        if Moonshot.config.parameters.key?(@kms_key_parameter_name)
+          if 'Auto' == Moonshot.config.parameters[@kms_key_parameter_name].value
+            s.continue "Auto-generating KMS Key for #{@kms_key_parameter_name.blue}... "
+            key_arn = KmsKey.create.arn
+            Moonshot.config.parameters[@kms_key_parameter_name].set(key_arn)
+            s.success "Created a new KMS Key for #{@kms_key_parameter_name.blue}!"
+          else
+            key_arn = KmsKey.new(Moonshot.config.parameters[@kms_key_parameter_name].value).arn
+            s.success "Using existing KMS Key for #{@kms_key_parameter_name.blue}!"
+          end
+        end
+      end
+
+      raise "No such Stack Parameter #{@kms_key_parameter_name}!" unless key_arn
+
+      key_arn
+    end
+  end
+end

data/lib/plugins/encrypted_parameters/kms_key.rb

@@ -0,0 +1,22 @@
+class EncryptedParameters
+  # Class that manages KMS keys in AWS.
+  class KmsKey
+    attr_reader :arn
+
+    def initialize(arn)
+      @arn = arn
+      @kms_client = Aws::KMS::Client.new
+    end
+
+    def self.create
+      resp = Aws::KMS::Client.new.create_key
+      arn = resp.key_metadata.arn
+
+      new(arn)
+    end
+
+    def delete
+      @kms_client.schedule_key_deletion(key_id: @arn, pending_window_in_days: 7)
+    end
+  end
+end

data/lib/plugins/encrypted_parameters/parameter_encrypter.rb

@@ -0,0 +1,23 @@
+require 'base64'
+
+class EncryptedParameters
+  # Class that can encrypt and decrypt parameters using KMS.
+  class ParameterEncrypter
+    # @param [String] key_arn The ARN for the KMS key.
+    def initialize(key_arn)
+      @kms_client = Aws::KMS::Client.new
+      @key_arn = key_arn
+    end
+
+    # Encrypt and base64 encode the parameter value.
+    #
+    # @param [String] param_value The parameter to encrypt.
+    # @return [String] base64 encoded encrypted ciphertext.
+    def encrypt(param_value)
+      resp = @kms_client.encrypt(key_id: @key_arn, plaintext: param_value)
+
+      # Use strict here to avoid newlines which cause issues with parameters.
+      Base64.strict_encode64(resp.ciphertext_blob)
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: moonshot
 version: !ruby/object:Gem::Version
-  version: 1.1.0.beta1
+  version: 1.1.0.beta2
 platform: ruby
 authors:
 - Cloud Engineering <engineering@acquia.com>
@@ -317,6 +317,9 @@ files:
 - lib/moonshot/unicode_table.rb
 - lib/moonshot/yaml_stack_template.rb
 - lib/plugins/backup.rb
+- lib/plugins/encrypted_parameters.rb
+- lib/plugins/encrypted_parameters/kms_key.rb
+- lib/plugins/encrypted_parameters/parameter_encrypter.rb
 homepage: https://github.com/acquia/moonshot
 licenses:
 - Apache-2.0