@itentialopensource/adapter-amazon_route53 0.4.4 → 0.4.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AUTH.md +31 -8
- package/CHANGELOG.md +16 -0
- package/TAB2.md +38 -9
- package/package.json +2 -2
- package/propertiesSchema.json +37 -0
- package/refs?service=git-upload-pack +0 -0
- package/report/adapterInfo.json +2 -2
- package/sampleProperties.json +7 -1
- package/compliance-report.json +0 -9
- package/compliance-report.txt +0 -5
package/AUTH.md
CHANGED
|
@@ -36,35 +36,58 @@ you can leave all of the other properties in the authentication section, they wi
|
|
|
36
36
|
### AWS Security Token Service
|
|
37
37
|
The Amazon Route53 adapter also supports AWS Security Token Service (STS) Authentication. For using this authentication, you need to use the calls in the Adapter that have the STSRole suffix on them and pass the STS information into the method.
|
|
38
38
|
|
|
39
|
+
```json
|
|
40
|
+
{
|
|
41
|
+
"RoleArn": "arn:aws:iam::1234567:role/my_role",
|
|
42
|
+
"RoleSessionName": "mySession"
|
|
43
|
+
}
|
|
44
|
+
```
|
|
45
|
+
|
|
46
|
+
The AWS STS Authentication goes to the AWS STS Service endpoint in order to validate that the primary "service" account the adapter has authenticated with has the permission to assume the role. This call is made to sts.amazonaws.com or a regional sts sevice (e.g. sts.us-east-1.amazonaws.com). By default traffic to these endpoints will go out through the Internet. In the case where you would prefer these route through your network, it is possible to change the STS config for the adapter. The proxy field should point to the AWS loadbalancer or a proxy server that forwards to AWS STS. In Itential Cloud, this can be NAT'd to your network. In addition to this, you may need to set the endpoint in order to have the STS SSL certificate validated successfully. By default the adapter will use sts regional servers. If the loadbalancer and proxy are set up for that you should be fine. If however, they point to the global STS service (sts.amazonaws.com) You will need to set the global as the endpoint or the STS certificate will be rejected due to the hosts not matching.
|
|
47
|
+
|
|
48
|
+
```json
|
|
49
|
+
"authentication": {
|
|
50
|
+
"aws_sts": {
|
|
51
|
+
"endpoint": "<sts certificate endpoint>",
|
|
52
|
+
"proxy": "<proxy/loadbalancer ip>",
|
|
53
|
+
}
|
|
54
|
+
}
|
|
55
|
+
```
|
|
56
|
+
|
|
39
57
|
### AWS IAM Role
|
|
40
58
|
The Amazon Route53 adapter also supports AWS IAM Role Authentication. For using this authentication, you need to use the calls in the Adapter that have the STSRole suffix on them and pass the RoleName into the method.
|
|
41
59
|
|
|
60
|
+
```json
|
|
61
|
+
"authentication": {
|
|
62
|
+
"auth_method": "aws_authentication",
|
|
63
|
+
"aws_iam_role": "role_arn"
|
|
64
|
+
}
|
|
65
|
+
```
|
|
66
|
+
|
|
42
67
|
### AMAZON STEPS FOR IAM ROLE
|
|
43
|
-
Increase number of hops if running IAP inside of docker on
|
|
68
|
+
Increase number of hops if running IAP inside of docker on an AWS instance
|
|
44
69
|
```bash
|
|
45
70
|
aws sso login --profile aws-bota-1
|
|
46
71
|
<export aws keys for CLI access>
|
|
47
72
|
|
|
48
|
-
|
|
73
|
+
Amazon ec2 modify-instance-metadata-options --instance-id i-0e150236026b7c45d --http-put-response-hop-limit 3 --http-endpoint enabled --region us-east-1
|
|
49
74
|
```
|
|
50
75
|
|
|
51
76
|
Create a new role and attach to it policies:
|
|
52
|
-
- go to your
|
|
77
|
+
- go to your Route53 instance, select it
|
|
53
78
|
- Actions->Security->Modify IAM Role
|
|
54
79
|
- Click 'Create New IAM Role'
|
|
55
80
|
- Create a role:
|
|
56
81
|
```text
|
|
57
82
|
Trusted entity type: AWS service
|
|
58
|
-
Use Case:
|
|
83
|
+
Use Case: Route53
|
|
59
84
|
```
|
|
60
85
|
|
|
61
|
-
Add policies to the role
|
|
62
|
-
- AmazonEC2FullAccess (Provides full access to Amazon EC2 via the AWS Management Console.)
|
|
63
|
-
- AmazonRoute53FullAccess (Provides full access to all Amazon Route 53 via the AWS Management Console.)
|
|
86
|
+
Add needed Route53 policies to the role
|
|
64
87
|
|
|
65
88
|
Save the role
|
|
66
89
|
|
|
67
|
-
Go back to
|
|
90
|
+
Go back to Route53 and Actions->Security->Modify IAM Role, associate newly created role with your Route53 instance
|
|
68
91
|
|
|
69
92
|
### Troubleshooting
|
|
70
93
|
- Make sure you copied over the correct access key, secret key and session token.
|
package/CHANGELOG.md
CHANGED
|
@@ -1,4 +1,20 @@
|
|
|
1
1
|
|
|
2
|
+
## 0.4.6 [09-30-2024]
|
|
3
|
+
|
|
4
|
+
* update auth docs
|
|
5
|
+
|
|
6
|
+
See merge request itentialopensource/adapters/adapter-amazon_route53!22
|
|
7
|
+
|
|
8
|
+
---
|
|
9
|
+
|
|
10
|
+
## 0.4.5 [09-12-2024]
|
|
11
|
+
|
|
12
|
+
* add properties for sts
|
|
13
|
+
|
|
14
|
+
See merge request itentialopensource/adapters/adapter-amazon_route53!21
|
|
15
|
+
|
|
16
|
+
---
|
|
17
|
+
|
|
2
18
|
## 0.4.4 [08-22-2024]
|
|
3
19
|
|
|
4
20
|
* update dependencies and metadata
|
package/TAB2.md
CHANGED
|
@@ -47,35 +47,58 @@ you can leave all of the other properties in the authentication section, they wi
|
|
|
47
47
|
#### AWS Security Token Service
|
|
48
48
|
The Amazon Route53 adapter also supports AWS Security Token Service (STS) Authentication. For using this authentication, you need to use the calls in the Adapter that have the STSRole suffix on them and pass the STS information into the method.
|
|
49
49
|
|
|
50
|
+
```json
|
|
51
|
+
{
|
|
52
|
+
"RoleArn": "arn:aws:iam::1234567:role/my_role",
|
|
53
|
+
"RoleSessionName": "mySession"
|
|
54
|
+
}
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
The AWS STS Authentication goes to the AWS STS Service endpoint in order to validate that the primary "service" account the adapter has authenticated with has the permission to assume the role. This call is made to sts.amazonaws.com or a regional sts sevice (e.g. sts.us-east-1.amazonaws.com). By default traffic to these endpoints will go out through the Internet. In the case where you would prefer these route through your network, it is possible to change the STS config for the adapter. The proxy field should point to the AWS loadbalancer or a proxy server that forwards to AWS STS. In Itential Cloud, this can be NAT'd to your network. In addition to this, you may need to set the endpoint in order to have the STS SSL certificate validated successfully. By default the adapter will use sts regional servers. If the loadbalancer and proxy are set up for that you should be fine. If however, they point to the global STS service (sts.amazonaws.com) You will need to set the global as the endpoint or the STS certificate will be rejected due to the hosts not matching.
|
|
58
|
+
|
|
59
|
+
```json
|
|
60
|
+
"authentication": {
|
|
61
|
+
"aws_sts": {
|
|
62
|
+
"endpoint": "<sts certificate endpoint>",
|
|
63
|
+
"proxy": "<proxy/loadbalancer ip>",
|
|
64
|
+
}
|
|
65
|
+
}
|
|
66
|
+
```
|
|
67
|
+
|
|
50
68
|
#### AWS IAM Role
|
|
51
69
|
The Amazon Route53 adapter also supports AWS IAM Role Authentication. For using this authentication, you need to use the calls in the Adapter that have the STSRole suffix on them and pass the RoleName into the method.
|
|
52
70
|
|
|
71
|
+
```json
|
|
72
|
+
"authentication": {
|
|
73
|
+
"auth_method": "aws_authentication",
|
|
74
|
+
"aws_iam_role": "role_arn"
|
|
75
|
+
}
|
|
76
|
+
```
|
|
77
|
+
|
|
53
78
|
#### AMAZON STEPS FOR IAM ROLE
|
|
54
|
-
Increase number of hops if running IAP inside of docker on
|
|
79
|
+
Increase number of hops if running IAP inside of docker on an AWS instance
|
|
55
80
|
```bash
|
|
56
81
|
aws sso login --profile aws-bota-1
|
|
57
82
|
<export aws keys for CLI access>
|
|
58
83
|
|
|
59
|
-
|
|
84
|
+
Amazon ec2 modify-instance-metadata-options --instance-id i-0e150236026b7c45d --http-put-response-hop-limit 3 --http-endpoint enabled --region us-east-1
|
|
60
85
|
```
|
|
61
86
|
|
|
62
87
|
Create a new role and attach to it policies:
|
|
63
|
-
- go to your
|
|
88
|
+
- go to your Route53 instance, select it
|
|
64
89
|
- Actions->Security->Modify IAM Role
|
|
65
90
|
- Click 'Create New IAM Role'
|
|
66
91
|
- Create a role:
|
|
67
92
|
```text
|
|
68
93
|
Trusted entity type: AWS service
|
|
69
|
-
Use Case:
|
|
94
|
+
Use Case: Route53
|
|
70
95
|
```
|
|
71
96
|
|
|
72
|
-
Add policies to the role
|
|
73
|
-
- AmazonEC2FullAccess (Provides full access to Amazon EC2 via the AWS Management Console.)
|
|
74
|
-
- AmazonRoute53FullAccess (Provides full access to all Amazon Route 53 via the AWS Management Console.)
|
|
97
|
+
Add needed Route53 policies to the role
|
|
75
98
|
|
|
76
99
|
Save the role
|
|
77
100
|
|
|
78
|
-
Go back to
|
|
101
|
+
Go back to Route53 and Actions->Security->Modify IAM Role, associate newly created role with your Route53 instance
|
|
79
102
|
|
|
80
103
|
#### Troubleshooting
|
|
81
104
|
- Make sure you copied over the correct access key, secret key and session token.
|
|
@@ -141,7 +164,13 @@ Sample Properties can be used to help you configure the adapter in the Itential
|
|
|
141
164
|
"aws_access_key": "aws_access_key",
|
|
142
165
|
"aws_secret_key": "aws_secret_key",
|
|
143
166
|
"aws_session_token": "aws_session_token",
|
|
144
|
-
"aws_iam_role": ""
|
|
167
|
+
"aws_iam_role": "",
|
|
168
|
+
"aws_sts": {
|
|
169
|
+
"sslEnable": true,
|
|
170
|
+
"endpoint": "",
|
|
171
|
+
"proxy": "",
|
|
172
|
+
"proxyagent": ""
|
|
173
|
+
}
|
|
145
174
|
},
|
|
146
175
|
"healthcheck": {
|
|
147
176
|
"type": "startup",
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@itentialopensource/adapter-amazon_route53",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.6",
|
|
4
4
|
"description": "This adapter integrates with system described as: Amazon Route53.",
|
|
5
5
|
"main": "adapter.js",
|
|
6
6
|
"systemName": "Amazon AWS Route53",
|
|
@@ -55,7 +55,7 @@
|
|
|
55
55
|
"author": "Itential",
|
|
56
56
|
"homepage": "https://gitlab.com/itentialopensource/adapters/adapter-amazon_route53#readme",
|
|
57
57
|
"dependencies": {
|
|
58
|
-
"@itentialopensource/adapter-utils": "^5.7.
|
|
58
|
+
"@itentialopensource/adapter-utils": "^5.7.2",
|
|
59
59
|
"acorn": "^8.12.1",
|
|
60
60
|
"ajv": "^8.17.1",
|
|
61
61
|
"axios": "^1.7.4",
|
package/propertiesSchema.json
CHANGED
|
@@ -381,6 +381,43 @@
|
|
|
381
381
|
"examples": [
|
|
382
382
|
"roleOnAllCalls"
|
|
383
383
|
]
|
|
384
|
+
},
|
|
385
|
+
"aws_sts": {
|
|
386
|
+
"type": "object",
|
|
387
|
+
"properties": {
|
|
388
|
+
"sslEnable": {
|
|
389
|
+
"type": "boolean",
|
|
390
|
+
"description": "This can disable the ssl for the sts requests",
|
|
391
|
+
"default": true
|
|
392
|
+
},
|
|
393
|
+
"endpoint": {
|
|
394
|
+
"type": "string",
|
|
395
|
+
"description": "change the sts endpoint used for assume role",
|
|
396
|
+
"default": "",
|
|
397
|
+
"enum": [
|
|
398
|
+
"sts.amazonaws.com",
|
|
399
|
+
"sts.us-east-2.amazonaws.com",
|
|
400
|
+
""
|
|
401
|
+
]
|
|
402
|
+
},
|
|
403
|
+
"proxy": {
|
|
404
|
+
"type": "string",
|
|
405
|
+
"description": "add a proxy to calls used for assume role",
|
|
406
|
+
"default": "",
|
|
407
|
+
"examples": [
|
|
408
|
+
"https://1.1.1.1"
|
|
409
|
+
]
|
|
410
|
+
},
|
|
411
|
+
"proxyagent": {
|
|
412
|
+
"type": "string",
|
|
413
|
+
"description": "define a proxy agent for calls to assume role",
|
|
414
|
+
"default": "",
|
|
415
|
+
"examples": [
|
|
416
|
+
"https",
|
|
417
|
+
"http"
|
|
418
|
+
]
|
|
419
|
+
}
|
|
420
|
+
}
|
|
384
421
|
}
|
|
385
422
|
},
|
|
386
423
|
"required": [
|
|
Binary file
|
package/report/adapterInfo.json
CHANGED
package/sampleProperties.json
CHANGED
|
@@ -46,7 +46,13 @@
|
|
|
46
46
|
"aws_access_key": "aws_access_key",
|
|
47
47
|
"aws_secret_key": "aws_secret_key",
|
|
48
48
|
"aws_session_token": "aws_session_token",
|
|
49
|
-
"aws_iam_role": ""
|
|
49
|
+
"aws_iam_role": "",
|
|
50
|
+
"aws_sts": {
|
|
51
|
+
"sslEnable": true,
|
|
52
|
+
"endpoint": "",
|
|
53
|
+
"proxy": "",
|
|
54
|
+
"proxyagent": ""
|
|
55
|
+
}
|
|
50
56
|
},
|
|
51
57
|
"healthcheck": {
|
|
52
58
|
"type": "startup",
|
package/compliance-report.json
DELETED
package/compliance-report.txt
DELETED
|
@@ -1,5 +0,0 @@
|
|
|
1
|
-
---------------------------------------------------------------------------------------------
|
|
2
|
-
**** Project Compliance Summary ****
|
|
3
|
-
0 project(s) are not valid
|
|
4
|
-
0 project(s) are valid
|
|
5
|
-
---------------------------------------------------------------------------------------------
|