@fishawack/lab-env 5.7.0-beta.2 → 5.7.0-beta.4

package/commands/create/services/aws/iam.js

@@ -9,6 +9,7 @@ const {
     CreateAccessKeyCommand,
     DeleteAccessKeyCommand,
     ListAccessKeysCommand,
+    AddUserToGroupCommand,
     GetRoleCommand,
     CreateRoleCommand,
     DeleteRoleCommand,
@@ -25,17 +26,18 @@ const {
     CreateServiceLinkedRoleCommand,
 } = require("@aws-sdk/client-iam");
 const { Spinner } = require("../../libs/utilities");
+const { awsClientConfig } = require("../../libs/vars");
 
-module.exports.createIAMUser = async (UserName, tags = []) => {
-    const client = new IAMClient({});
+const getClient = () => new IAMClient(awsClientConfig);
 
+module.exports.createIAMUser = async (UserName, tags = []) => {
     let res;
 
     try {
         res = await Spinner.prototype.simple(
             `Creating IAM user ${UserName}`,
             () => {
-                return client.send(
+                return getClient().send(
                     new CreateUserCommand({
                         UserName,
                         Tags: [
@@ -49,7 +51,7 @@ module.exports.createIAMUser = async (UserName, tags = []) => {
         res = await Spinner.prototype.simple(
             `Retrieving the already existing IAM user ${UserName}`,
             () => {
-                return client.send(new GetUserCommand({ UserName }));
+                return getClient().send(new GetUserCommand({ UserName }));
             },
         );
     }
@@ -67,16 +69,25 @@ module.exports.createFWIAMUser = async (UserName, permissions) => {
     return res;
 };
 
-module.exports.removeIAMUser = async (UserName) => {
-    const client = new IAMClient({});
+module.exports.addUserToGroup = async (UserName, GroupName, iamClient) => {
+    const c = iamClient || getClient();
+
+    await Spinner.prototype.simple(
+        `Adding IAM user ${UserName} to group ${GroupName}`,
+        () => {
+            return c.send(new AddUserToGroupCommand({ UserName, GroupName }));
+        },
+    );
+};
 
+module.exports.removeIAMUser = async (UserName) => {
     let res;
 
     try {
         await Spinner.prototype.simple(
             `Checking if IAM user ${UserName} exists`,
             () => {
-                return client.send(new GetUserCommand({ UserName }));
+                return getClient().send(new GetUserCommand({ UserName }));
             },
         );
 
@@ -87,7 +98,7 @@ module.exports.removeIAMUser = async (UserName) => {
         res = await Spinner.prototype.simple(
             `Removing IAM user ${UserName}`,
             () => {
-                return client.send(new DeleteUserCommand({ UserName }));
+                return getClient().send(new DeleteUserCommand({ UserName }));
             },
         );
     } catch {
@@ -98,12 +109,10 @@ module.exports.removeIAMUser = async (UserName) => {
 };
 
 module.exports.attachIAMPolicy = async (UserName, policy) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(
         `Attaching IAM policy ${policy}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new AttachUserPolicyCommand({ UserName, PolicyArn: policy }),
             );
         },
@@ -115,68 +124,84 @@ module.exports.attachIAMPolicy = async (UserName, policy) => {
 module.exports.syncFWIAMPolicies = async (
     UserName,
     permissions = ["auto-content", "deploy-static"],
+    preserve = [],
 ) => {
-    await module.exports.removeAllIAMPolicies(UserName);
+    let res = await module.exports.listIAMPolicies(UserName);
+
+    // Detach existing policies in parallel
+    const toDetach = res.AttachedPolicies.filter(
+        (p) => !preserve.includes(p.PolicyArn),
+    );
+    if (toDetach.length) {
+        await Spinner.prototype.simple(
+            `Detaching ${toDetach.length} IAM policies`,
+            () =>
+                Promise.all(
+                    toDetach.map((p) =>
+                        getClient().send(
+                            new DetachUserPolicyCommand({
+                                UserName,
+                                PolicyArn: p.PolicyArn,
+                            }),
+                        ),
+                    ),
+                ),
+        );
+    }
+
+    // Collect policies to attach
+    const policies = [];
 
     if (
         permissions.includes("auto-content") ||
         permissions.includes("deploy-static")
     ) {
-        await module.exports.attachIAMPolicy(
-            UserName,
-            "arn:aws:iam::aws:policy/AmazonS3FullAccess",
-        );
+        policies.push("arn:aws:iam::aws:policy/AmazonS3FullAccess");
     }
 
     if (permissions.includes("deploy-static")) {
-        await module.exports.attachIAMPolicy(
-            UserName,
-            "arn:aws:iam::aws:policy/CloudFrontFullAccess",
-        );
+        policies.push("arn:aws:iam::aws:policy/CloudFrontFullAccess");
     }
 
     if (permissions.includes("deploy-fullstack")) {
-        await module.exports.attachIAMPolicy(
-            UserName,
+        policies.push(
             "arn:aws:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk",
-        );
-
-        await module.exports.attachIAMPolicy(
-            UserName,
             "arn:aws:iam::aws:policy/AmazonOpenSearchServiceFullAccess",
-        );
-
-        await module.exports.attachIAMPolicy(
-            UserName,
             "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
-        );
-
-        await module.exports.attachIAMPolicy(
-            UserName,
             "arn:aws:iam::aws:policy/AmazonElastiCacheFullAccess",
-        );
-
-        await module.exports.attachIAMPolicy(
-            UserName,
             "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
+            "arn:aws:iam::aws:policy/AmazonSESFullAccess",
         );
     }
 
     if (permissions.includes("manage-users")) {
-        await module.exports.attachIAMPolicy(
-            UserName,
-            "arn:aws:iam::aws:policy/IAMFullAccess",
+        policies.push("arn:aws:iam::aws:policy/IAMFullAccess");
+    }
+
+    // Attach all policies in parallel
+    if (policies.length) {
+        await Spinner.prototype.simple(
+            `Attaching ${policies.length} IAM policies`,
+            () =>
+                Promise.all(
+                    policies.map((p) =>
+                        getClient().send(
+                            new AttachUserPolicyCommand({
+                                UserName,
+                                PolicyArn: p,
+                            }),
+                        ),
+                    ),
+                ),
         );
     }
 };
 
 module.exports.removeIAMPolicy = async (UserName, policy) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(
         `Detaching IAM policy ${policy}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new DetachUserPolicyCommand({ UserName, PolicyArn: policy }),
             );
         },
@@ -186,10 +211,10 @@ module.exports.removeIAMPolicy = async (UserName, policy) => {
 };
 
 module.exports.listIAMPolicies = async (UserName) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(`Listing IAM policies`, () => {
-        return client.send(new ListAttachedUserPoliciesCommand({ UserName }));
+        return getClient().send(
+            new ListAttachedUserPoliciesCommand({ UserName }),
+        );
     });
 
     return res;
@@ -198,10 +223,20 @@ module.exports.listIAMPolicies = async (UserName) => {
 module.exports.removeAllIAMPolicies = async (UserName) => {
     let res = await module.exports.listIAMPolicies(UserName);
 
-    for (let i = 0; i < res.AttachedPolicies.length; i++) {
-        await module.exports.removeIAMPolicy(
-            UserName,
-            res.AttachedPolicies[i].PolicyArn,
+    if (res.AttachedPolicies.length) {
+        await Spinner.prototype.simple(
+            `Detaching ${res.AttachedPolicies.length} IAM policies`,
+            () =>
+                Promise.all(
+                    res.AttachedPolicies.map((p) =>
+                        getClient().send(
+                            new DetachUserPolicyCommand({
+                                UserName,
+                                PolicyArn: p.PolicyArn,
+                            }),
+                        ),
+                    ),
+                ),
         );
     }
 
@@ -209,22 +244,18 @@ module.exports.removeAllIAMPolicies = async (UserName) => {
 };
 
 module.exports.createAccessKey = async (UserName) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(`Creating access key`, () => {
-        return client.send(new CreateAccessKeyCommand({ UserName }));
+        return getClient().send(new CreateAccessKeyCommand({ UserName }));
     });
 
     return res;
 };
 
 module.exports.removeAccessKey = async (UserName, AccessKeyId) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(
         `Removing access key ${AccessKeyId}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new DeleteAccessKeyCommand({ AccessKeyId, UserName }),
             );
         },
@@ -234,10 +265,8 @@ module.exports.removeAccessKey = async (UserName, AccessKeyId) => {
 };
 
 module.exports.listAccessKeys = async (UserName) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(`Listing access keys`, () => {
-        return client.send(new ListAccessKeysCommand({ UserName }));
+        return getClient().send(new ListAccessKeysCommand({ UserName }));
     });
 
     return res;
@@ -246,10 +275,20 @@ module.exports.listAccessKeys = async (UserName) => {
 module.exports.removeAllAccessKeys = async (UserName) => {
     let res = await module.exports.listAccessKeys(UserName);
 
-    for (let i = 0; i < res.AccessKeyMetadata.length; i++) {
-        await module.exports.removeAccessKey(
-            UserName,
-            res.AccessKeyMetadata[i].AccessKeyId,
+    if (res.AccessKeyMetadata.length) {
+        await Spinner.prototype.simple(
+            `Removing ${res.AccessKeyMetadata.length} access keys`,
+            () =>
+                Promise.all(
+                    res.AccessKeyMetadata.map((k) =>
+                        getClient().send(
+                            new DeleteAccessKeyCommand({
+                                UserName,
+                                AccessKeyId: k.AccessKeyId,
+                            }),
+                        ),
+                    ),
+                ),
         );
     }
 
@@ -266,27 +305,72 @@ module.exports.createAccessKeySafe = async (UserName) => {
     return res;
 };
 
-module.exports.getRole = async (RoleName) => {
-    const client = new IAMClient({});
+module.exports.rotateAccessKey = async (UserName) => {
+    let res = await module.exports.listAccessKeys(UserName);
+    let keys = res.AccessKeyMetadata;
+
+    if (keys.length === 2) {
+        console.log(
+            `\n⚠ ${UserName} has 2 existing keys (likely from a failed previous rotation). Removing the older key to make room.\n`,
+        );
+
+        keys.sort((a, b) => new Date(a.CreateDate) - new Date(b.CreateDate));
+
+        await module.exports.removeAccessKey(UserName, keys[0].AccessKeyId);
+
+        keys = [keys[1]];
+    }
+
+    let newKey = await module.exports.createAccessKey(UserName);
+
+    if (keys.length === 1) {
+        await module.exports.removeAccessKey(UserName, keys[0].AccessKeyId);
+    }
+
+    return newKey;
+};
+
+module.exports.rotateFWIAMUser = async (UserName, permissions) => {
+    await module.exports.createIAMUser(UserName);
+
+    let preserve = [];
+
+    if (permissions && permissions.includes("manage-users")) {
+        preserve.push("arn:aws:iam::aws:policy/IAMFullAccess");
+    }
+
+    await module.exports.syncFWIAMPolicies(UserName, permissions, preserve);
 
+    let res = await module.exports.rotateAccessKey(UserName);
+
+    return res;
+};
+
+module.exports.getRole = async (RoleName) => {
     let res = await Spinner.prototype.simple(
         `Retrieving the role ${RoleName}`,
         () => {
-            return client.send(new GetRoleCommand({ RoleName }));
+            return getClient().send(new GetRoleCommand({ RoleName }));
         },
     );
 
     return res;
 };
 
-module.exports.createRole = async (RoleName, AssumeRolePolicyDocument) => {
-    const client = new IAMClient({});
-
+module.exports.createRole = async (
+    RoleName,
+    AssumeRolePolicyDocument,
+    Tags,
+) => {
     let res = await Spinner.prototype.simple(
         `Creating the role ${RoleName}`,
         () => {
-            return client.send(
-                new CreateRoleCommand({ RoleName, AssumeRolePolicyDocument }),
+            return getClient().send(
+                new CreateRoleCommand({
+                    RoleName,
+                    AssumeRolePolicyDocument,
+                    ...(Tags && Tags.length ? { Tags } : {}),
+                }),
             );
         },
     );
@@ -294,14 +378,15 @@ module.exports.createRole = async (RoleName, AssumeRolePolicyDocument) => {
     return res;
 };
 
-module.exports.createInstanceProfile = async (InstanceProfileName) => {
-    const client = new IAMClient({});
-
+module.exports.createInstanceProfile = async (InstanceProfileName, Tags) => {
     let res = await Spinner.prototype.simple(
         `Creating the instance profile ${InstanceProfileName}`,
         () => {
-            return client.send(
-                new CreateInstanceProfileCommand({ InstanceProfileName }),
+            return getClient().send(
+                new CreateInstanceProfileCommand({
+                    InstanceProfileName,
+                    ...(Tags && Tags.length ? { Tags } : {}),
+                }),
             );
         },
     );
@@ -313,12 +398,10 @@ module.exports.attachRoleToInstanceProfile = async (
     RoleName,
     InstanceProfileName,
 ) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(
         `Attaching role ${RoleName} to the instance profile ${InstanceProfileName}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new AddRoleToInstanceProfileCommand({
                     RoleName,
                     InstanceProfileName,
@@ -331,12 +414,10 @@ module.exports.attachRoleToInstanceProfile = async (
 };
 
 module.exports.attachRolePolicy = async (RoleName, PolicyArn) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(
         `Attaching Role policy ${PolicyArn}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new AttachRolePolicyCommand({ RoleName, PolicyArn }),
             );
         },
@@ -350,12 +431,10 @@ module.exports.attachInlineRolePolicy = async (
     PolicyName,
     PolicyDocument,
 ) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(
         `Attaching Inline Role policy ${PolicyName}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new PutRolePolicyCommand({
                     RoleName,
                     PolicyName,
@@ -521,6 +600,7 @@ module.exports.ensureEnvironmentInstanceProfile = async (
     ebSlug,
     s3BucketName,
     opensearchDomainArn,
+    tags,
 ) => {
     const role = `${ebSlug}-role`;
 
@@ -541,9 +621,10 @@ module.exports.ensureEnvironmentInstanceProfile = async (
                     },
                 ],
             }),
+            tags,
         );
 
-        await module.exports.createInstanceProfile(role);
+        await module.exports.createInstanceProfile(role, tags);
         await module.exports.attachRoleToInstanceProfile(role, role);
     }
 
@@ -644,13 +725,11 @@ module.exports.ensureEnvironmentInstanceProfile = async (
 };
 
 module.exports.ensureOpenSearchServiceRole = async () => {
-    const client = new IAMClient({});
-
     try {
         await Spinner.prototype.simple(
             "Ensuring OpenSearch service-linked role exists",
             () => {
-                return client.send(
+                return getClient().send(
                     new CreateServiceLinkedRoleCommand({
                         AWSServiceName: "opensearchservice.amazonaws.com",
                     }),
@@ -670,7 +749,6 @@ module.exports.ensureOpenSearchServiceRole = async () => {
 };
 
 module.exports.removeEnvironmentInstanceProfile = async (ebSlug) => {
-    const client = new IAMClient({});
     const role = `${ebSlug}-role`;
 
     try {
@@ -682,7 +760,7 @@ module.exports.removeEnvironmentInstanceProfile = async (ebSlug) => {
     const attachedPolicies = await Spinner.prototype.simple(
         `Listing attached policies for ${role}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new ListAttachedRolePoliciesCommand({ RoleName: role }),
             );
         },
@@ -692,7 +770,7 @@ module.exports.removeEnvironmentInstanceProfile = async (ebSlug) => {
         await Spinner.prototype.simple(
             `Detaching policy ${policy.PolicyName}`,
             () => {
-                return client.send(
+                return getClient().send(
                     new DetachRolePolicyCommand({
                         RoleName: role,
                         PolicyArn: policy.PolicyArn,
@@ -705,7 +783,9 @@ module.exports.removeEnvironmentInstanceProfile = async (ebSlug) => {
     const inlinePolicies = await Spinner.prototype.simple(
         `Listing inline policies for ${role}`,
         () => {
-            return client.send(new ListRolePoliciesCommand({ RoleName: role }));
+            return getClient().send(
+                new ListRolePoliciesCommand({ RoleName: role }),
+            );
         },
     );
 
@@ -713,7 +793,7 @@ module.exports.removeEnvironmentInstanceProfile = async (ebSlug) => {
         await Spinner.prototype.simple(
             `Deleting inline policy ${policyName}`,
             () => {
-                return client.send(
+                return getClient().send(
                     new DeleteRolePolicyCommand({
                         RoleName: role,
                         PolicyName: policyName,
@@ -727,7 +807,7 @@ module.exports.removeEnvironmentInstanceProfile = async (ebSlug) => {
         await Spinner.prototype.simple(
             `Removing role from instance profile ${role}`,
             () => {
-                return client.send(
+                return getClient().send(
                     new RemoveRoleFromInstanceProfileCommand({
                         RoleName: role,
                         InstanceProfileName: role,
@@ -743,7 +823,7 @@ module.exports.removeEnvironmentInstanceProfile = async (ebSlug) => {
         await Spinner.prototype.simple(
             `Deleting instance profile ${role}`,
             () => {
-                return client.send(
+                return getClient().send(
                     new DeleteInstanceProfileCommand({
                         InstanceProfileName: role,
                     }),
@@ -755,6 +835,6 @@ module.exports.removeEnvironmentInstanceProfile = async (ebSlug) => {
     }
 
     await Spinner.prototype.simple(`Deleting role ${role}`, () => {
-        return client.send(new DeleteRoleCommand({ RoleName: role }));
+        return getClient().send(new DeleteRoleCommand({ RoleName: role }));
     });
 };