@stacksjs/ts-cloud-core 0.1.3 → 0.1.7

package/src/security/secrets-rotation.ts

@@ -1,456 +0,0 @@
-/**
- * Automated Secrets Rotation
- * Automatic rotation for RDS credentials, API keys, and other secrets
- */
-
-export interface SecretRotation {
-  id: string
-  secretId: string
-  secretType: SecretType
-  rotationEnabled: boolean
-  rotationDays: number
-  rotationLambdaArn?: string
-  lastRotated?: Date
-  nextRotation?: Date
-  versionStages?: string[]
-}
-
-export type SecretType =
-  | 'rds_credentials'
-  | 'api_key'
-  | 'oauth_token'
-  | 'ssh_key'
-  | 'certificate'
-  | 'generic'
-
-export interface RotationConfig {
-  automaticallyAfterDays: number
-  rotationLambda?: RotationLambda
-  requireMasterPassword?: boolean
-  excludeCharacters?: string
-  passwordLength?: number
-}
-
-export interface RotationLambda {
-  functionArn: string
-  functionName: string
-  runtime: string
-  handler: string
-}
-
-export interface RotationSchedule {
-  id: string
-  name: string
-  secrets: string[] // secret IDs
-  schedule: string // rate or cron expression
-  enabled: boolean
-  lastRun?: Date
-  nextRun?: Date
-}
-
-export interface RotationResult {
-  success: boolean
-  secretId: string
-  oldVersion: string
-  newVersion: string
-  rotatedAt: Date
-  error?: string
-}
-
-export interface RDSRotationConfig {
-  secretArn: string
-  databaseIdentifier: string
-  engine: 'postgres' | 'mysql' | 'sqlserver' | 'oracle'
-  masterSecretArn?: string
-  superuserSecretArn?: string
-}
-
-/**
- * Secrets rotation manager
- */
-export class SecretsRotationManager {
-  private rotations: Map<string, SecretRotation> = new Map()
-  private schedules: Map<string, RotationSchedule> = new Map()
-  private rotationCounter = 0
-  private scheduleCounter = 0
-
-  /**
-   * Create secret rotation
-   */
-  createRotation(rotation: Omit<SecretRotation, 'id'>): SecretRotation {
-    const id = `rotation-${Date.now()}-${this.rotationCounter++}`
-
-    const secretRotation: SecretRotation = {
-      id,
-      ...rotation,
-    }
-
-    this.rotations.set(id, secretRotation)
-
-    return secretRotation
-  }
-
-  /**
-   * Enable RDS credentials rotation
-   */
-  enableRDSRotation(options: {
-    secretId: string
-    databaseIdentifier: string
-    engine: 'postgres' | 'mysql' | 'sqlserver' | 'oracle'
-    rotationDays?: number
-    masterSecretArn?: string
-  }): SecretRotation {
-    const rotation = this.createRotation({
-      secretId: options.secretId,
-      secretType: 'rds_credentials',
-      rotationEnabled: true,
-      rotationDays: options.rotationDays || 30,
-      rotationLambdaArn: this.generateRDSRotationLambdaArn(options.engine),
-    })
-
-    // Calculate next rotation
-    rotation.nextRotation = new Date(Date.now() + rotation.rotationDays * 24 * 60 * 60 * 1000)
-
-    return rotation
-  }
-
-  /**
-   * Enable API key rotation
-   */
-  enableAPIKeyRotation(options: {
-    secretId: string
-    rotationDays?: number
-    rotationLambdaArn?: string
-  }): SecretRotation {
-    return this.createRotation({
-      secretId: options.secretId,
-      secretType: 'api_key',
-      rotationEnabled: true,
-      rotationDays: options.rotationDays || 90,
-      rotationLambdaArn: options.rotationLambdaArn,
-    })
-  }
-
-  /**
-   * Enable OAuth token rotation
-   */
-  enableOAuthRotation(options: {
-    secretId: string
-    rotationDays?: number
-    rotationLambdaArn: string
-  }): SecretRotation {
-    return this.createRotation({
-      secretId: options.secretId,
-      secretType: 'oauth_token',
-      rotationEnabled: true,
-      rotationDays: options.rotationDays || 60,
-      rotationLambdaArn: options.rotationLambdaArn,
-    })
-  }
-
-  /**
-   * Enable SSH key rotation
-   */
-  enableSSHKeyRotation(options: {
-    secretId: string
-    rotationDays?: number
-    rotationLambdaArn: string
-  }): SecretRotation {
-    return this.createRotation({
-      secretId: options.secretId,
-      secretType: 'ssh_key',
-      rotationEnabled: true,
-      rotationDays: options.rotationDays || 180,
-      rotationLambdaArn: options.rotationLambdaArn,
-    })
-  }
-
-  /**
-   * Create rotation schedule
-   */
-  createSchedule(schedule: Omit<RotationSchedule, 'id'>): RotationSchedule {
-    const id = `schedule-${Date.now()}-${this.scheduleCounter++}`
-
-    const rotationSchedule: RotationSchedule = {
-      id,
-      ...schedule,
-    }
-
-    this.schedules.set(id, rotationSchedule)
-
-    return rotationSchedule
-  }
-
-  /**
-   * Execute rotation
-   */
-  async executeRotation(rotationId: string): Promise<RotationResult> {
-    const rotation = this.rotations.get(rotationId)
-
-    if (!rotation) {
-      throw new Error(`Rotation not found: ${rotationId}`)
-    }
-
-    console.log(`\nExecuting rotation for secret: ${rotation.secretId}`)
-    console.log(`Secret type: ${rotation.secretType}`)
-    console.log(`Rotation interval: ${rotation.rotationDays} days`)
-
-    try {
-      // Simulate rotation steps
-      console.log('\nRotation steps:')
-      console.log('1. Creating new secret version...')
-      const newVersion = `v${Date.now()}`
-
-      console.log('2. Testing new credentials...')
-      // Test logic would go here
-
-      console.log('3. Updating application references...')
-      // Update logic would go here
-
-      console.log('4. Marking previous version as deprecated...')
-      const oldVersion = rotation.versionStages?.[0] || 'v1'
-
-      console.log('5. Finalizing rotation...')
-      rotation.lastRotated = new Date()
-      rotation.nextRotation = new Date(
-        Date.now() + rotation.rotationDays * 24 * 60 * 60 * 1000
-      )
-
-      console.log('\n✓ Rotation completed successfully')
-      console.log(`  New version: ${newVersion}`)
-      console.log(`  Next rotation: ${rotation.nextRotation.toISOString()}`)
-
-      return {
-        success: true,
-        secretId: rotation.secretId,
-        oldVersion,
-        newVersion,
-        rotatedAt: new Date(),
-      }
-    } catch (error) {
-      console.error('\n✗ Rotation failed:', error)
-
-      return {
-        success: false,
-        secretId: rotation.secretId,
-        oldVersion: 'unknown',
-        newVersion: 'unknown',
-        rotatedAt: new Date(),
-        error: error instanceof Error ? error.message : String(error),
-      }
-    }
-  }
-
-  /**
-   * Check if rotation needed
-   */
-  needsRotation(rotationId: string): boolean {
-    const rotation = this.rotations.get(rotationId)
-
-    if (!rotation || !rotation.rotationEnabled) {
-      return false
-    }
-
-    if (!rotation.lastRotated) {
-      return true
-    }
-
-    const daysSinceRotation =
-      (Date.now() - rotation.lastRotated.getTime()) / (1000 * 60 * 60 * 24)
-
-    return daysSinceRotation >= rotation.rotationDays
-  }
-
-  /**
-   * Get secrets needing rotation
-   */
-  getSecretsNeedingRotation(): SecretRotation[] {
-    return Array.from(this.rotations.values()).filter(rotation =>
-      this.needsRotation(rotation.id)
-    )
-  }
-
-  /**
-   * Generate RDS rotation Lambda ARN
-   */
-  private generateRDSRotationLambdaArn(engine: string): string {
-    const functionMap: Record<string, string> = {
-      postgres: 'SecretsManagerRDSPostgreSQLRotationSingleUser',
-      mysql: 'SecretsManagerRDSMySQLRotationSingleUser',
-      sqlserver: 'SecretsManagerRDSSQLServerRotationSingleUser',
-      oracle: 'SecretsManagerRDSOracleRotationSingleUser',
-    }
-
-    const functionName = functionMap[engine] || functionMap.postgres
-
-    return `arn:aws:lambda:us-east-1:123456789012:function:${functionName}`
-  }
-
-  /**
-   * Get rotation
-   */
-  getRotation(id: string): SecretRotation | undefined {
-    return this.rotations.get(id)
-  }
-
-  /**
-   * List rotations
-   */
-  listRotations(): SecretRotation[] {
-    return Array.from(this.rotations.values())
-  }
-
-  /**
-   * Get schedule
-   */
-  getSchedule(id: string): RotationSchedule | undefined {
-    return this.schedules.get(id)
-  }
-
-  /**
-   * List schedules
-   */
-  listSchedules(): RotationSchedule[] {
-    return Array.from(this.schedules.values())
-  }
-
-  /**
-   * Generate CloudFormation for rotation
-   */
-  generateRotationCF(rotation: SecretRotation): any {
-    return {
-      RotationEnabled: rotation.rotationEnabled,
-      RotationRules: {
-        AutomaticallyAfterDays: rotation.rotationDays,
-      },
-      ...(rotation.rotationLambdaArn && {
-        RotationLambdaARN: rotation.rotationLambdaArn,
-      }),
-    }
-  }
-
-  /**
-   * Generate CloudFormation for rotation Lambda
-   */
-  generateRotationLambdaCF(options: {
-    functionName: string
-    secretType: SecretType
-    vpcConfig?: {
-      subnetIds: string[]
-      securityGroupIds: string[]
-    }
-  }): any {
-    return {
-      Type: 'AWS::Lambda::Function',
-      Properties: {
-        FunctionName: options.functionName,
-        Runtime: 'python3.11',
-        Handler: 'lambda_function.lambda_handler',
-        Role: { 'Fn::GetAtt': ['RotationLambdaRole', 'Arn'] },
-        Timeout: 30,
-        Environment: {
-          Variables: {
-            SECRETS_MANAGER_ENDPOINT: 'https://secretsmanager.us-east-1.amazonaws.com',
-          },
-        },
-        ...(options.vpcConfig && {
-          VpcConfig: {
-            SubnetIds: options.vpcConfig.subnetIds,
-            SecurityGroupIds: options.vpcConfig.securityGroupIds,
-          },
-        }),
-      },
-    }
-  }
-
-  /**
-   * Generate CloudFormation for rotation Lambda role
-   */
-  generateRotationLambdaRoleCF(): any {
-    return {
-      Type: 'AWS::IAM::Role',
-      Properties: {
-        AssumeRolePolicyDocument: {
-          Version: '2012-10-17',
-          Statement: [
-            {
-              Effect: 'Allow',
-              Principal: {
-                Service: 'lambda.amazonaws.com',
-              },
-              Action: 'sts:AssumeRole',
-            },
-          ],
-        },
-        ManagedPolicyArns: [
-          'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
-          'arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole',
-        ],
-        Policies: [
-          {
-            PolicyName: 'SecretsRotationPolicy',
-            PolicyDocument: {
-              Version: '2012-10-17',
-              Statement: [
-                {
-                  Effect: 'Allow',
-                  Action: [
-                    'secretsmanager:DescribeSecret',
-                    'secretsmanager:GetSecretValue',
-                    'secretsmanager:PutSecretValue',
-                    'secretsmanager:UpdateSecretVersionStage',
-                  ],
-                  Resource: '*',
-                },
-                {
-                  Effect: 'Allow',
-                  Action: ['secretsmanager:GetRandomPassword'],
-                  Resource: '*',
-                },
-              ],
-            },
-          },
-        ],
-      },
-    }
-  }
-
-  /**
-   * Generate EventBridge rule for rotation schedule
-   */
-  generateRotationScheduleCF(schedule: RotationSchedule): any {
-    return {
-      Type: 'AWS::Events::Rule',
-      Properties: {
-        Name: schedule.name,
-        Description: `Rotation schedule for ${schedule.secrets.length} secrets`,
-        ScheduleExpression: schedule.schedule,
-        State: schedule.enabled ? 'ENABLED' : 'DISABLED',
-        Targets: [
-          {
-            Arn: { 'Fn::GetAtt': ['RotationStateMachine', 'Arn'] },
-            RoleArn: { 'Fn::GetAtt': ['EventBridgeRotationRole', 'Arn'] },
-            Input: JSON.stringify({
-              secrets: schedule.secrets,
-            }),
-          },
-        ],
-      },
-    }
-  }
-
-  /**
-   * Clear all data
-   */
-  clear(): void {
-    this.rotations.clear()
-    this.schedules.clear()
-    this.rotationCounter = 0
-    this.scheduleCounter = 0
-  }
-}
-
-/**
- * Global secrets rotation manager instance
- */
-export const secretsRotationManager: SecretsRotationManager = new SecretsRotationManager()