@itentialopensource/adapter-aws_cloudformation 0.3.6 → 0.3.8

package/AUTH.md

@@ -41,6 +41,17 @@ The AWS CloudFormation adapter also supports AWS Security Token Service (STS) Au
 }
 ```
 
+The AWS STS Authentication goes to the AWS STS Service endpoint in order to validate that the primary "service" account the adapter has authenticated with has the permission to assume the role. This call is made to sts.amazonaws.com or a regional sts sevice (e.g. sts.us-east-1.amazonaws.com). By default traffic to these endpoints will go out through the Internet. In the case where you would prefer these route through your network, it is possible to change the STS config for the adapter. The proxy field should point to the AWS loadbalancer or a proxy server that forwards to AWS STS. In Itential Cloud, this can be NAT'd to your network. In addition to this, you may need to set the endpoint in order to have the STS SSL certificate validated successfully. By default the adapter will use sts regional servers. If the loadbalancer and proxy are set up for that you should be fine. If however, they point to the global STS service (sts.amazonaws.com) You will need to set the global as the endpoint or the STS certificate will be rejected due to the hosts not matching.
+
+```json
+"authentication": {
+  "aws_sts": {
+    "endpoint": "<sts certificate endpoint>",
+    "proxy": "<proxy/loadbalancer ip>",
+  }
+}
+```
+
 ### AWS IAM Role
 The AWS CloudFormation adapter also supports AWS IAM Role Authentication. For using this authentication, you need to use the calls in the Adapter that have the STSRole suffix on them and provide the role's ARN in the RoleName variable. In addition to passing the IAM Role in the task, it is possible to set an IAM Role in the Service Instance Configuration by using the `aws_iam_role` property in the authentication section and providing the role's ARN.
 
@@ -52,29 +63,29 @@ The AWS CloudFormation adapter also supports AWS IAM Role Authentication. For us
 ```
 
 ### AMAZON STEPS FOR IAM ROLE
-Increase number of hops if running IAP inside of docker on EC2 instance
+Increase number of hops if running IAP inside of docker on an AWS instance
 ```bash
 aws sso login --profile aws-bota-1
 <export aws keys for CLI access>
 
-AWS ec2 modify-instance-metadata-options  --instance-id i-0e150236026b7c45d  --http-put-response-hop-limit 3 --http-endpoint enabled --region us-east-1
+Amazon ec2 modify-instance-metadata-options  --instance-id i-0e150236026b7c45d  --http-put-response-hop-limit 3 --http-endpoint enabled --region us-east-1
 ```
 
 Create a new role and attach to it policies:
-- go to your EC2 instance, select it
+- go to your Cloudformation instance, select it
 - Actions->Security->Modify IAM Role
 - Click 'Create New IAM Role'
 - Create a role:
 ```text
 Trusted entity type: AWS service
-Use Case: EC2
+Use Case: Cloudformation
 ```
 
-Add desired policies to the role. 
+Add needed Cloudformation policies to the role
 
 Save the role
 
-Go back to your EC2 instance and Actions->Security->Modify IAM Role, associate newly created role with your EC2 instance
+Go back to Cloudformation and Actions->Security->Modify IAM Role, associate newly created role with your Cloudformation instance
 
 ### Troubleshooting
 - Make sure you copied over the correct access key, secret key and session token.

package/CHANGELOG.md

@@ -1,4 +1,20 @@
 
+## 0.3.8 [09-30-2024]
+
+* update auth docs
+
+See merge request itentialopensource/adapters/adapter-aws_cloudformation!23
+
+---
+
+## 0.3.7 [09-12-2024]
+
+* add properties for sts
+
+See merge request itentialopensource/adapters/adapter-aws_cloudformation!22
+
+---
+
 ## 0.3.6 [08-23-2024]
 
 * turn off savemetric

package/TAB2.md

@@ -52,6 +52,17 @@ The AWS CloudFormation adapter also supports AWS Security Token Service (STS) Au
 }
 ```
 
+The AWS STS Authentication goes to the AWS STS Service endpoint in order to validate that the primary "service" account the adapter has authenticated with has the permission to assume the role. This call is made to sts.amazonaws.com or a regional sts sevice (e.g. sts.us-east-1.amazonaws.com). By default traffic to these endpoints will go out through the Internet. In the case where you would prefer these route through your network, it is possible to change the STS config for the adapter. The proxy field should point to the AWS loadbalancer or a proxy server that forwards to AWS STS. In Itential Cloud, this can be NAT'd to your network. In addition to this, you may need to set the endpoint in order to have the STS SSL certificate validated successfully. By default the adapter will use sts regional servers. If the loadbalancer and proxy are set up for that you should be fine. If however, they point to the global STS service (sts.amazonaws.com) You will need to set the global as the endpoint or the STS certificate will be rejected due to the hosts not matching.
+
+```json
+"authentication": {
+  "aws_sts": {
+    "endpoint": "<sts certificate endpoint>",
+    "proxy": "<proxy/loadbalancer ip>",
+  }
+}
+```
+
 #### AWS IAM Role
 The AWS CloudFormation adapter also supports AWS IAM Role Authentication. For using this authentication, you need to use the calls in the Adapter that have the STSRole suffix on them and provide the role's ARN in the RoleName variable. In addition to passing the IAM Role in the task, it is possible to set an IAM Role in the Service Instance Configuration by using the `aws_iam_role` property in the authentication section and providing the role's ARN.
 
@@ -63,29 +74,29 @@ The AWS CloudFormation adapter also supports AWS IAM Role Authentication. For us
 ```
 
 #### AMAZON STEPS FOR IAM ROLE
-Increase number of hops if running IAP inside of docker on EC2 instance
+Increase number of hops if running IAP inside of docker on an AWS instance
 ```bash
 aws sso login --profile aws-bota-1
 <export aws keys for CLI access>
 
-AWS ec2 modify-instance-metadata-options  --instance-id i-0e150236026b7c45d  --http-put-response-hop-limit 3 --http-endpoint enabled --region us-east-1
+Amazon ec2 modify-instance-metadata-options  --instance-id i-0e150236026b7c45d  --http-put-response-hop-limit 3 --http-endpoint enabled --region us-east-1
 ```
 
 Create a new role and attach to it policies:
-- go to your EC2 instance, select it
+- go to your Cloudformation instance, select it
 - Actions->Security->Modify IAM Role
 - Click 'Create New IAM Role'
 - Create a role:
 ```text
 Trusted entity type: AWS service
-Use Case: EC2
+Use Case: Cloudformation
 ```
 
-Add desired policies to the role. 
+Add needed Cloudformation policies to the role
 
 Save the role
 
-Go back to your EC2 instance and Actions->Security->Modify IAM Role, associate newly created role with your EC2 instance
+Go back to Cloudformation and Actions->Security->Modify IAM Role, associate newly created role with your Cloudformation instance
 
 #### Troubleshooting
 - Make sure you copied over the correct access key, secret key and session token.
@@ -150,7 +161,13 @@ Sample Properties can be used to help you configure the adapter in the Itential
       "aws_access_key": "aws_access_key",
       "aws_secret_key": "aws_secret_key",
       "aws_session_token": "aws_session_token",
-      "aws_iam_role": ""
+      "aws_iam_role": "",
+      "aws_sts": {
+        "sslEnable": true,
+        "endpoint": "",
+        "proxy": "",
+        "proxyagent": ""
+      }
     },
     "healthcheck": {
       "type": "startup",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itentialopensource/adapter-aws_cloudformation",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "This adapter integrates with system described as: Aws_cloudformation.",
   "main": "adapter.js",
   "wizardVersion": "2.44.7",
@@ -54,7 +54,7 @@
   "author": "Itential",
   "homepage": "https://gitlab.com/itentialopensource/adapters/adapter-aws_cloudformation#readme",
   "dependencies": {
-    "@itentialopensource/adapter-utils": "^5.7.0",
+    "@itentialopensource/adapter-utils": "^5.7.2",
     "acorn": "^8.12.1",
     "ajv": "^8.17.1",
     "aws4": "^1.9.0",

package/propertiesSchema.json

@@ -267,22 +267,6 @@
           "description": "This property turns on logging of Authentication Information and should only be true when debugging authentication and connectivity",
           "default": false
         },
-        "aws_access_key": {
-          "type": "string",
-          "description": "AWS access key for authentication",
-          "default": "",
-          "examples": [
-            "accesskey"
-          ]
-        },
-        "aws_secret_key": {
-          "type": "string",
-          "description": "AWS secret key for authentication",
-          "default": "",
-          "examples": [
-            "secretkey"
-          ]
-        },
         "client_id": {
           "type": "string",
           "description": "The client id for OAuth requests - can also use username depending on schema",
@@ -365,6 +349,75 @@
               }
             }
           }
+        },
+        "aws_access_key": {
+          "type": "string",
+          "description": "AWS access key for authentication",
+          "default": "",
+          "examples": [
+            "accesskey"
+          ]
+        },
+        "aws_secret_key": {
+          "type": "string",
+          "description": "AWS secret key for authentication",
+          "default": "",
+          "examples": [
+            "secretkey"
+          ]
+        },
+        "aws_session_token": {
+          "type": "string",
+          "description": "AWS session token for all calls - not all systems require this",
+          "default": "",
+          "examples": [
+            "sessionToken"
+          ]
+        },
+        "aws_iam_role": {
+          "type": "string",
+          "description": "AWS IAM Role for all calls - not all systems require this",
+          "default": "",
+          "examples": [
+            "roleOnAllCalls"
+          ]
+        },
+        "aws_sts": {
+          "type": "object",
+          "properties": {
+            "sslEnable": {
+              "type": "boolean",
+              "description": "This can disable the ssl for the sts requests",
+              "default": true
+            },
+            "endpoint": {
+              "type": "string",
+              "description": "change the sts endpoint used for assume role",
+              "default": "",
+              "enum": [
+                "sts.amazonaws.com",
+                "sts.us-east-2.amazonaws.com",
+                ""
+              ]
+            },
+            "proxy": {
+              "type": "string",
+              "description": "add a proxy to calls used for assume role",
+              "default": "",
+              "examples": [
+                "https://1.1.1.1"
+              ]
+            },
+            "proxyagent": {
+              "type": "string",
+              "description": "define a proxy agent for calls to assume role",
+              "default": "",
+              "examples": [
+                "https",
+                "http"
+              ]
+            }
+          }
         }
       },
       "required": [

package/report/adapterInfo.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.3.5",
-  "configLines": 13223,
+  "version": "0.3.7",
+  "configLines": 13276,
   "scriptLines": 1783,
   "codeLines": 11578,
   "testLines": 7158,

package/sampleProperties.json

@@ -45,7 +45,13 @@
       "aws_access_key": "aws_access_key",
       "aws_secret_key": "aws_secret_key",
       "aws_session_token": "aws_session_token",
-      "aws_iam_role": ""
+      "aws_iam_role": "",
+      "aws_sts": {
+        "sslEnable": true,
+        "endpoint": "",
+        "proxy": "",
+        "proxyagent": ""
+      }
     },
     "healthcheck": {
       "type": "startup",

package/compliance-report.json

@@ -1,9 +0,0 @@
-{
-  "ComplianceEntries": [
-    {
-      "name": "Compliance Summary",
-      "numInvalidProjects": 0,
-      "numValidProjects": 0
-    }
-  ]
-}

package/compliance-report.txt

@@ -1,5 +0,0 @@
----------------------------------------------------------------------------------------------
-**** Project Compliance Summary ****
-0 project(s) are not valid
-0 project(s) are valid
----------------------------------------------------------------------------------------------