env-secrets 0.1.0

package/.eslintignore

@@ -0,0 +1,2 @@
+node_modules
+dist

package/.eslintrc

@@ -0,0 +1,15 @@
+{
+  "root": true,
+  "parser": "@typescript-eslint/parser",
+  "plugins": ["@typescript-eslint", "prettier"],
+  "extends": [
+    "eslint:recommended",
+    "plugin:@typescript-eslint/eslint-recommended",
+    "plugin:@typescript-eslint/recommended",
+    "prettier"
+  ],
+  "rules": {
+    "no-console": 1,
+    "prettier/prettier": 2
+  }
+}

package/.nvmrc

@@ -0,0 +1 @@
+v16.17.0

package/.prettierrc

@@ -0,0 +1,6 @@
+{
+  "semi": true,
+  "trailingComma": "none",
+  "singleQuote": true,
+  "printWidth": 80
+}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 Mark C Allen (@markcallen)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,15 @@
+# env-secrets
+
+Get secrets from a vault and inject them as environment variables
+
+## Setup
+
+Install node
+
+## Debug
+
+Use debug-js pass in env-secrets for the main application and env-secrets:<vault> for vault specific debugging
+
+```
+DEBUG=env-secrets,env-secrets:secretsmanager npx ts-node src/index.ts aws -s local/sample -r ca-central-1 -p marka -- env
+```

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "env-secrets",
+  "version": "0.1.0",
+  "description": "get secrets from a secrets vault and inject them into the running environment",
+  "main": "index.js",
+  "author": "Mark C Allen (@markcallen)",
+  "repository": "markcallen/env-secrets",
+  "homepage": "https://github.com/markcallen/env-secrets",
+  "license": "MIT",
+  "private": false,
+  "scripts": {
+    "prebuild": "node -p \"'export const LIB_VERSION = ' + JSON.stringify(require('./package.json').version) + ';'\" > src/version.ts",
+    "build": "rimraf ./dist && tsc -b",
+    "postbuild": "chmod 755 ./dist/index.js",
+    "lint": "eslint . --ext .ts",
+    "prettier:fix": "npx prettier --write .",
+    "prettier:check": "npx prettier --check ."
+  },
+  "devDependencies": {
+    "@types/debug": "^4.1.7",
+    "@types/node": "^18.11.9",
+    "@typescript-eslint/eslint-plugin": "^5.43.0",
+    "@typescript-eslint/parser": "^5.43.0",
+    "eslint": "^8.27.0",
+    "eslint-config-prettier": "^8.5.0",
+    "eslint-plugin-prettier": "^4.2.1",
+    "prettier": "^2.7.1",
+    "rimraf": "^3.0.2",
+    "ts-node": "^10.9.1",
+    "typescript": "^4.8.4"
+  },
+  "dependencies": {
+    "aws-sdk": "^2.1257.0",
+    "commander": "^9.4.1",
+    "debug": "^4.3.4"
+  },
+  "bin": {
+    "env-secrets": "./dist/index.js"
+  }
+}

package/src/index.ts

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+
+import { Command, Argument } from 'commander';
+import { spawn } from 'node:child_process';
+import Debug from 'debug';
+
+import { LIB_VERSION } from './version';
+import { secretsmanager } from './vaults/secretsmanager';
+
+const debug = Debug('env-secrets');
+
+const program = new Command();
+
+program
+  .name('env-secrets')
+  .description(
+    'pull secrets from vaults and inject them into the running environment'
+  )
+  .version(LIB_VERSION);
+
+program
+  .command('aws')
+  .description('get secrets from AWS secrets manager')
+  .addArgument(new Argument('[program...]', 'program to run'))
+  .requiredOption('-s, --secret <secret>', 'secret to get')
+  .option('-p, --profile <profile>', 'profile to use')
+  .option('-r, --region <region>', 'region to use')
+  .action(async (program, options) => {
+    let env = await secretsmanager(options);
+    env = Object.assign({}, process.env, env);
+    debug(env);
+    if (program) {
+      debug(`${program[0]} ${program.slice(1)}`);
+      spawn(program[0], program.slice(1), {
+        stdio: 'inherit',
+        shell: true,
+        env
+      });
+    }
+  });
+
+program.parse();

package/src/vaults/secretsmanager.ts

@@ -0,0 +1,101 @@
+import AWS from 'aws-sdk';
+import Debug from 'debug';
+
+const debug = Debug('env-secrets:secretsmanager');
+
+interface secretsmanagerType {
+  secret: string;
+  profile?: string;
+  region?: string;
+}
+
+const checkConnection = async () => {
+  const sts = new AWS.STS();
+
+  const myPromise = new Promise((resolve, reject) => {
+    sts.getCallerIdentity({}, (err, data) => {
+      if (err) reject(err);
+      else {
+        resolve(data);
+      }
+    });
+  });
+
+  let value;
+  let err;
+
+  await myPromise
+    .then((v) => {
+      value = v;
+    })
+    .catch((e) => {
+      err = e;
+    });
+
+  if (err) {
+    console.error(err);
+  }
+  debug(value);
+
+  return !!value;
+};
+
+export const secretsmanager = async (options: secretsmanagerType) => {
+  const { secret, profile, region } = options;
+  const {
+    AWS_ACCESS_KEY_ID: awsAccessKeyId,
+    AWS_SECRET_ACCESS_KEY: awsSecretAccessKey
+  } = process.env;
+  if (profile) {
+    console.log(`Using profile: ${profile}`);
+    const credentials = new AWS.SharedIniFileCredentials({
+      profile
+    });
+    AWS.config.credentials = credentials;
+  } else if (awsAccessKeyId && awsSecretAccessKey) {
+    console.log('Using environment variables');
+  } else {
+    console.log('Using profile: default');
+  }
+
+  if (region) {
+    AWS.config.update({ region });
+  }
+  if (!AWS.config.region) {
+    console.log('no region set');
+  }
+
+  const connected = await checkConnection();
+
+  if (connected) {
+    const sm = new AWS.SecretsManager();
+
+    try {
+      const response = await sm
+        .getSecretValue({
+          SecretId: secret
+        })
+        .promise();
+
+      const secretvalue = response.SecretString;
+
+      try {
+        if (secretvalue) {
+          return JSON.parse(secretvalue);
+        }
+      } catch (err) {
+        console.error(err);
+      }
+    } catch (err: any) {
+      if (err && err.code === 'ResourceNotFoundException') {
+        console.error(`${secret} not found`);
+      } else if (err && err.code === 'ConfigError') {
+        console.error(err.message);
+      } else {
+        console.error(err);
+      }
+    }
+
+    return {};
+  }
+};

package/src/vaults/utils.ts

@@ -0,0 +1,29 @@
+import * as os from 'os';
+
+export const replaceWithAstrisk = (str: string | undefined) => {
+  if (str) {
+    return [...str]
+      .map((e, i) => {
+        if (i > 0 && i < str.length - 4) {
+          return '*';
+        }
+
+        return e;
+      })
+      .join('');
+  }
+};
+
+export const objectToExport = (obj: Record<string, any>) => {
+  return Object.entries(obj).reduce(
+    (env, [OutputKey, OutputValue]) =>
+      `${env}export ${OutputKey}=${OutputValue}${os.EOL}`,
+    ''
+  );
+};
+
+export const objectToEnv = (obj: Record<string, any>) => {
+  return Object.entries(obj).map(
+    ([OutputKey, OutputValue]) => (process.env[OutputKey] = OutputValue)
+  );
+};

package/src/version.ts

@@ -0,0 +1 @@
+export const LIB_VERSION = "0.1.0";

package/tsconfig.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "es2016",
+    "lib": ["es6"],
+    "module": "commonjs",
+    "rootDir": "src",
+    "resolveJsonModule": true,
+    "allowJs": true,
+    "outDir": "dist",
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "strict": true,
+    "noImplicitAny": true,
+    "skipLibCheck": true
+  }
+}