parameterstore_databag_wrapper 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 672727279e9753a52f2d2b5c5e007705aae58922
+  data.tar.gz: b76b801a5a47e61d47eab758795237a3fd48b10d
+SHA512:
+  metadata.gz: 63fd147bce8d7be7aff1f9d6bc163fc93caf5edc81f0883af2971d8ec135a23ed1e2bda9e1b7fb6c9348acb01eb78cf9db820d805bcfd9a6b34c29a39360429c
+  data.tar.gz: f0cb09b046a150b8ac82aafbe0dcacdc1c6eabf8fee5c86867a934c2d885d1530cd4c481d14e13b834b172ee7e2ec3d1fb0c18727d2755323d45508f35a4d70d

data/LICENSE

@@ -0,0 +1,19 @@
+Copyright 2018 Amplify Education, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,93 @@
+parameterstore_databag_wrapper
+=====================
+
+Usage
+-----
+Provides wrapper for Chef's EncryptedDataBagItem that adds support for reading secrets from ParameterStore and simplifies the obtainment of database secrets. This would be used with Chef Cookbooks to provide sensitive credentials and data to deployed nodes using ParameterStore as the source for the secrets.
+
+Libraries
+----
+### Amplify::EncryptedDataBagItem
+
+Read from Databags from either Chef or ParameterStore using the Amplify::EncryptedDataBagItem class.  During local testing these values will be stored in an encrypted chef databag under `test/chef/data_bags/<data_bag_name>/local.json`.  During deployment to a real environment, these values are stored in ParameterStore.
+
+```ruby
+data_bag = Amplify::EncryptedDataBagItem.load('data_bag_name', 'environment_name')
+some_value = data_bag[:some_value]
+some_other_value = data_bag[:some_other_value]
+```
+
+### Amplify::EncryptedDatabaseInfo
+Read database credentials and hostname information using the Amplify::EncryptedDatabaseInfo class.  During local testing these values will be stored in an encrypted chef databag under `test/chef/data_bags/<database_name>/local.json`.  During deployment these values are stored in ParameterStore.
+
+```ruby
+dbinfo = Amplify::EncryptedDatabaseInfo.load('some_db_name', 'environment_name')
+host = dbinfo[:host]
+user = dbinfo[:user]
+password = dbinfo[:password]
+```
+
+parameterstore_databag_wrapper
+============
+
+Provides wrapper for EncryptedDataBagItem which adds support for reading secrets from ParameterStore and simplifies the obtainment of database secrets.
+
+About Amplify
+=============
+
+Amplify builds innovative and compelling digital educational products that empower teachers and students across the country. We have a long history as the leading innovator in K-12 education - and have been described as the best tech company in education and the best education company in tech. While others try to shrink the learning experience into the technology, we use technology to expand what is possible in real classrooms with real students and teachers.
+
+Learn more at https://www.amplify.com
+
+Getting Started
+===============
+
+Prerequisites
+-------------
+
+* Ruby >= 2.2.3
+* gems
+    * Runtime
+        * aws-sdk ~> 3.0
+        * chef ~> 12.0
+        * chef-zero ~> 5.3
+        * hashie ~> 3.5
+    * Testing
+        * aws-sdk ~> 3.0
+        * chef ~> 12.0
+        * chefspec ~> 7.1
+        * chef-zero ~> 5.3
+        * hashie ~> 3.5
+        * rake ~> 12.3
+        * rubocop ~> 0.54
+        * rspec ~> 3.7
+        * webmock ~> 3.3
+        * bundler
+
+Installing/Building
+----------
+
+Install all dependencies using `bundle install`.
+
+An installable packaged gem can be created if the following command is ran inside the repo's directory:
+`gem build parameterstore_databag_wrapper.gemspec`
+
+Running Tests
+-------------
+
+Using bundler, run `bundle exec rake test` to start all test suites.
+
+Responsible Disclosure
+======================
+
+If you have any security issue to report, contact project maintainers privately.
+You can reach us at <github@amplify.com>
+
+Contributing
+============
+
+We welcome pull requests! For your pull request to be accepted smoothly, we suggest that you:
+
+1. For any sizable change, first open a GitHub issue to discuss your idea.
+2. Create a pull request.  Explain why you want to make the change and what it’s for.
+We’ll try to answer any PR’s promptly.

data/lib/amplify/encrypted_data_bag_item.rb

@@ -0,0 +1,14 @@
+require 'amplify/vault_data_bag_wrapper_base'
+
+module Amplify
+  module VaultSecrets
+    def self.read_from_vault(app_name, env)
+      EncryptedDataBagItem.load(app_name, env)
+    end
+  end
+  class EncryptedDataBagItem < VaultDataBagWrapperBase
+    def self.vault_path(app_name, env)
+      "secret/#{env}/databags/#{app_name}"
+    end
+  end
+end

data/lib/amplify/encrypted_database_info.rb

@@ -0,0 +1,21 @@
+module Amplify
+  require 'amplify/vault_data_bag_wrapper_base'
+
+  class EncryptedDatabaseInfo < Amplify::VaultDataBagWrapperBase
+    def self.vault_path(db_name, env)
+      "secret/#{env}/dbs/standard/#{db_name}"
+    end
+
+    def self.jdbc_url(db_name, env)
+      db_info = load(db_name, env)
+
+      db_username = db_info['user']
+      db_password = db_info['password']
+      db_host = db_info['host']
+      db_port = db_info['port']
+      db_name = db_info['database']
+      db_scheme = db_info['scheme']
+      "jdbc:#{db_scheme}://#{db_username}:#{db_password}@#{db_host}:#{db_port}/#{db_name}"
+    end
+  end
+end

data/lib/amplify/parameter_store_client.rb

@@ -0,0 +1,78 @@
+require 'hashie'
+
+module Amplify
+  module ParameterStoreClient
+    @aws_region = 'us-east-1'
+
+    def self.aws_region=(val)
+      ::Chef::Log.info "Setting aws_region to #{val}"
+      @aws_region = val
+    end
+
+    def self.client
+      require 'aws-sdk'
+      Aws::SSM::Client.new(region: @aws_region)
+    end
+
+    def self.deep_merge(result, value)
+      result = result.merge(value) do |_key, oldval, newval|
+        if oldval.respond_to?(:merge) && newval.respond_to?(:merge)
+          deep_merge(oldval, newval)
+        else
+          newval
+        end
+      end
+      ::Hashie::Mash.new(result)
+    end
+
+    # rubocop:disable Metrics/MethodLength
+    # rubocop:disable Lint/Loop
+    def self.get_parameters_by_path(prefix_path)
+      next_token = nil
+      result = []
+
+      begin
+        api_result = client.get_parameters_by_path(
+          path: prefix_path,
+          recursive: true,
+          max_results: 10,
+          next_token: next_token,
+          with_decryption: true
+        )
+        next_token = api_result.next_token
+        result = result.concat api_result.parameters
+      end until next_token.nil?
+
+      result
+    end
+
+    # rubocop:enable Metrics/MethodLength
+    # rubocop:enable Lint/Loop
+    def self.read(path)
+      prefix_path = "/#{path}"
+      result = get_parameters_by_path(prefix_path)
+               .reduce({}) { |aggregate, param| reduce_parameters(aggregate, param, prefix_path) }
+
+      result.empty? ? nil : result
+    end
+
+    def self.reduce_parameters(result, parameter, prefix_path)
+      sub_path = remove_prefix(prefix_path, parameter.name)
+      name_parts = sub_path.split '/'
+
+      value = name_parts.reverse.reduce(parameter.value) do |leaf, root|
+        ::Hashie::Mash.new(root => leaf)
+      end
+
+      deep_merge(result, value)
+    end
+
+    def self.remove_prefix(prefix_path, parameter_name)
+      # prefix_path = '/secret/<env>/databags'
+      # parameter_name = '/secret/<env>/databags/<app>/<name>'
+      first_index = prefix_path.length + 1 # add /
+      last_index = parameter_name.length - 1
+      parameter_name[first_index..last_index]
+    end
+  end
+end

data/lib/amplify/vault_data_bag_wrapper_base.rb

@@ -0,0 +1,80 @@
+module Amplify
+  class VaultDataBagWrapperBase
+    ALLOWED_STRATEGIES ||= [:app_name, :env, :parameter_store, :vault].freeze
+    @strategy = :app_name
+    attr_reader :strategy
+
+    def self.strategy=(val)
+      msg = "Data bag strategy #{val} is not valid. Valid strategies are #{ALLOWED_STRATEGIES}"
+      raise msg unless ALLOWED_STRATEGIES.include?(val)
+      ::Chef::Log.info "Setting strategy to #{val}"
+      @strategy = val
+    end
+
+    def self.load(app_name, env)
+      ::Chef::Log.info "Retrieving secrets using #{@strategy} strategy"
+      if @strategy == :vault
+        read_from_vault(app_name, env)
+      elsif @strategy == :env
+        chef_databag_load(env, app_name)
+      elsif @strategy == :parameter_store
+        read_from_parameter_store(app_name, env)
+      else
+        chef_databag_load(app_name, env)
+      end
+    end
+
+    def self.chef_databag_load(name, item)
+      require 'hashie'
+      ::Hashie::Mash.new(::Chef::EncryptedDataBagItem.load(name, item).to_hash)
+    rescue ::Net::HTTPServerException => e
+      ::Chef::Log.error e
+      raise MissingDatabag, name: name, item: item
+    end
+
+    def self.vault_path(_app_name, _env)
+      raise NotExtendedCorrectly, 'vault_path was not overriden.'
+    end
+
+    def self.read_from_parameter_store(app_name, env)
+      path = vault_path(app_name, env)
+      secrets = Amplify::ParameterStoreClient.read(path)
+      raise SecretMissingError.new(path, env) if secrets.nil?
+      secrets
+    end
+
+    def self.read_from_vault(app_name, env)
+      path = vault_path(app_name, env)
+      secrets = Amplify::VaultAuthClient.read(path, env)
+      raise SecretMissingError.new(path, env) if secrets.nil?
+      secrets
+    end
+
+    class NotExtendedCorrectly < StandardError
+      def initialize(message)
+        super("Amplify::VaultDataBagWrapperBase was not extended correctly: #{message}")
+      end
+    end
+  end
+
+  class SecretMissingError < StandardError
+    def initialize(path, environment)
+      message = <<ERRORMESSAGE
+  Successfully authenticated with vault but...
+  Expecting #{path} to exist in #{environment}.
+  Please create DA-ticket to add secrets to vault
+ERRORMESSAGE
+      super(message)
+    end
+  end
+  class MissingDatabag < StandardError
+    def initialize(databag)
+      message = <<ERRORMESSAGE
+  Couldn't find #{databag[:name]}/#{databag[:item]}
+  You should only get this error during local converge.
+  Check: test/chef/data_bags/#{databag[:name]}/#{databag[:item]}.json
+ERRORMESSAGE
+      super(message)
+    end
+  end
+end

data/lib/parameterstore_databag_wrapper.rb

@@ -0,0 +1,4 @@
+require 'amplify/encrypted_data_bag_item'
+require 'amplify/encrypted_database_info'
+require 'amplify/parameter_store_client'
+require 'amplify/vault_data_bag_wrapper_base'

metadata

@@ -0,0 +1,176 @@
+--- !ruby/object:Gem::Specification
+name: parameterstore_databag_wrapper
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Ryan Walsh
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2018-04-04 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: aws-sdk
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: chef
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.0'
+- !ruby/object:Gem::Dependency
+  name: chefspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.1'
+- !ruby/object:Gem::Dependency
+  name: chef-zero
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.3'
+- !ruby/object:Gem::Dependency
+  name: hashie
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.5'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.5'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.54'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.54'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.7'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.7'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.3'
+description: "'Wrapper for obtaining secrets from ParameterStore for use with Chef
+  as EncryptedDatabags or Database secrets'"
+email: devtools@amplify.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- lib/amplify/encrypted_data_bag_item.rb
+- lib/amplify/encrypted_database_info.rb
+- lib/amplify/parameter_store_client.rb
+- lib/amplify/vault_data_bag_wrapper_base.rb
+- lib/parameterstore_databag_wrapper.rb
+homepage: http://rubygems.org/gems/parameterstore_databag_wrapper
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.5.2
+signing_key: 
+specification_version: 3
+summary: Secrets!
+test_files: []