node-vault-client 1.0.1 → 2.0.0

package/src/auth/VaultIAMAuth.js

@@ -1,187 +1,212 @@
-'use strict';
-
-const VaultBaseAuth = require('./VaultBaseAuth');
-const aws4 = require('aws4');
-const { fromNodeProviderChain } = require('@aws-sdk/credential-providers');
-const _ = require('lodash');
-const errors = require('../errors');
-
-/**
- * Implementation of AWS Auth Backend :: IAM Authentication Method
- * @link https://www.vaultproject.io/docs/auth/aws.html#iam-authentication-method
- *
- * @usage
- *
- * ```bash
- * vault write auth/aws/config/client secret_key=AWS_SECRET_KEY access_key=AWS_ACCESS_KEY
- * vault write auth/aws/config/client iam_server_id_header_value=VAULT_ADDR
- * vault write auth/aws/role/iam_name_of_role auth_type=iam bound_iam_principal_arn=arn:aws:iam::.... max_ttl=500h
- * ```
- *
- * ```js
- *
- * VaultClient.boot('main', {
- *       api: { url: VAULT_ADDR },
- *       auth: {
- *           type: 'iam',
- *           mount: 'some_other_aws_mount_point',          // Optional
- *           config: {
- *               role: 'my_iam_role',
- *               iam_server_id_header_value: VAULT_ADDR,   // Optional
- *               namespace: 'some_namespace',              // Optional
- *               credentials: {                            // Optional
- *                 accessKeyId: AWS_ACCESS_KEY,
- *                 secretAccessKey: AWS_SECRET_KEY,
- *               },
- *           }
- *       }
- *   })
- * ```
- *
- */
-class VaultIAMAuth extends VaultBaseAuth {
-    /**
-     * @typedef AWSCredentials
-     * @property {String} accessKeyId
-     * @property {String} secretAccessKey
-     *
-     * @typedef {Object} VaultIAMAuthConfig
-     * @property {String} role - Role name of the auth/{mount}/role/{name} backend.
-     * @property [AWSCredentials] [credentials] - Optional. AWS Credentials
-     * @property {String} [iam_server_id_header_value] - Optional. Header's value X-Vault-AWS-IAM-Server-ID.
-     *
-     * @param {VaultApiClient} api - see {@link VaultBaseAuth#constructor}
-     * @param {Object} logger
-     * @param {VaultIAMAuthConfig} config
-     * @param {String} mount - Vault's AWS Auth Backend mount point ("aws" by default)
-     */
-    constructor(api, logger, config, mount) {
-        super(api, logger, mount || 'aws');
-
-        this.__role = config.role;
-        this.__iam_server_id_header_value = config.iam_server_id_header_value;
-        this.__namespace = config.namespace;
-
-
-        const { credentials } = config;
-        this._validateCredentialsConfig(credentials);
-
-        this.__credentialChain = credentials ? () => Promise.resolve(credentials) : fromNodeProviderChain();
-    }
-
-    /**
-     * @inheritDoc
-     */
-    _authenticate() {
-        this._log.info(
-            'making authentication request: role=%s',
-            this.__role
-        );
-
-        var headers = {};
-
-        if (this.__namespace) {
-            headers = {
-                'X-Vault-Namespace': this.__namespace,
-            }
-        }
-
-
-        return Promise.resolve()
-            .then(() => this.__getCredentials())
-            .then((credentials) => {
-                return this.__apiClient.makeRequest(
-                    'POST',
-                    `/auth/${this._mount}/login`,
-                    this.__getVaultAuthRequestBody(this.__getStsRequest(credentials)),
-                    headers
-                );
-            })
-            .then((response) => {
-                this._log.debug(
-                    'receive token: %s',
-                    response.auth.client_token
-                );
-                return this._getTokenEntity(response.auth.client_token)
-            })
-    }
-
-    /**
-     * Credentials resolved by {@see @aws-sdk/credential-providers}
-     *
-     * @returns {Promise<AwsCredentialIdentity>}
-     * @private
-     */
-    __getCredentials() {
-        return this.__credentialChain();
-    }
-
-    /**
-     * Prepare vault auth request body
-     *
-     * @param stsRequest
-     * @returns {Object} {@link https://www.vaultproject.io/docs/auth/aws.html#via-the-api}
-     * @private
-     */
-    __getVaultAuthRequestBody(stsRequest) {
-        return {
-            iam_http_request_method: stsRequest.method,
-            iam_request_headers: this.__base64encode(
-                JSON.stringify(this.__headersLikeGolangStyle(stsRequest.headers))
-            ),
-            iam_request_body: this.__base64encode(stsRequest.body),
-            iam_request_url: this.__base64encode(`https://${stsRequest.hostname}${stsRequest.path}`),
-            role: this.__role
-        }
-    }
-
-    /**
-     * Prepare signed request to AWS STS :: GetCallerIdentity
-     *
-     * @param credentials
-     * @private
-     */
-    __getStsRequest(credentials) {
-        return aws4.sign({
-            service: 'sts',
-            method: 'POST',
-            body: 'Action=GetCallerIdentity&Version=2011-06-15',
-            headers: this.__iam_server_id_header_value ? {
-                'X-Vault-AWS-IAM-Server-ID': this.__iam_server_id_header_value,
-            } : {}
-        }, credentials);
-    }
-
-    /**
-     * @param string
-     * @private
-     */
-    __base64encode(string) {
-        return new Buffer(string).toString('base64')
-    }
-
-    /**
-     * @link https://github.com/hashicorp/vault/issues/2810
-     * @link https://golang.org/pkg/net/http/#Header
-     *
-     * @param {Object} headers
-     * @returns {Object}
-     * @private
-     */
-    __headersLikeGolangStyle(headers) {
-        return _.mapValues(headers, (value) => [`${value}`]);
-    }
-
-    _validateCredentialsConfig(credentials) {
-        if (Array.isArray(credentials)) {
-            throw new errors.InvalidAWSCredentialsError('Invalid AWS credentials provided in config. See CHANGELOG if migating from 0.x.x');
-        }
-        if (credentials && typeof credentials === 'object') {
-            if (!credentials.secretAccessKey || !credentials.accessKeyId) {
-                throw new errors.InvalidAWSCredentialsError('Invalid AWS credentials provided in config: accessKeyId and secretAccessKey are required.');
-            }
-        }
-    }
-}
-
-module.exports = VaultIAMAuth;
+'use strict';
+
+const VaultBaseAuth = require('./VaultBaseAuth');
+const aws4 = require('aws4');
+const { fromNodeProviderChain } = require('@aws-sdk/credential-providers');
+const _ = require('lodash');
+const errors = require('../errors');
+
+/**
+ * Implementation of AWS Auth Backend :: IAM Authentication Method
+ * @link https://www.vaultproject.io/docs/auth/aws.html#iam-authentication-method
+ *
+ * @usage
+ *
+ * ```bash
+ * vault write auth/aws/config/client secret_key=AWS_SECRET_KEY access_key=AWS_ACCESS_KEY
+ * vault write auth/aws/config/client iam_server_id_header_value=VAULT_ADDR
+ * vault write auth/aws/role/iam_name_of_role auth_type=iam bound_iam_principal_arn=arn:aws:iam::.... max_ttl=500h
+ * ```
+ *
+ * ```js
+ *
+ * VaultClient.boot('main', {
+ *       api: { url: VAULT_ADDR },
+ *       auth: {
+ *           type: 'iam',
+ *           mount: 'some_other_aws_mount_point',          // Optional
+ *           config: {
+ *               role: 'my_iam_role',
+ *               iam_server_id_header_value: VAULT_ADDR,   // Optional
+ *               namespace: 'some_namespace',              // Optional
+ *               region: 'eu-central-1',                   // Optional. AWS STS region.
+ *               credentials: {                            // Optional
+ *                 accessKeyId: AWS_ACCESS_KEY,
+ *                 secretAccessKey: AWS_SECRET_KEY,
+ *               },
+ *           }
+ *       }
+ *   })
+ * ```
+ *
+ */
+class VaultIAMAuth extends VaultBaseAuth {
+    /**
+     * @typedef AWSCredentials
+     * @property {String} accessKeyId
+     * @property {String} secretAccessKey
+     *
+     * @typedef {Object} VaultIAMAuthConfig
+     * @property {String} role - Role name of the auth/{mount}/role/{name} backend.
+     * @property {AWSCredentials} [credentials] - Optional. AWS Credentials
+     * @property {String} [namespace] - Optional. Vault namespace, sent as the X-Vault-Namespace header.
+     * @property {String} [iam_server_id_header_value] - Optional. Header's value X-Vault-AWS-IAM-Server-ID.
+     * @property {String} [region] - Optional. AWS region used to sign the STS GetCallerIdentity
+     *   request. When set, the request is signed against the regional STS endpoint
+     *   (`sts.<region>.amazonaws.com`) and the SigV4 credential scope is bound to that region.
+     *   When omitted, the global endpoint (`sts.amazonaws.com`, scope `us-east-1`) is used,
+     *   preserving the previous default behavior.
+     *
+     * @param {VaultApiClient} api - see {@link VaultBaseAuth#constructor}
+     * @param {Object} logger
+     * @param {VaultIAMAuthConfig} config
+     * @param {String} mount - Vault's AWS Auth Backend mount point ("aws" by default)
+     */
+    constructor(api, logger, config, mount) {
+        super(api, logger, mount || 'aws');
+
+        this.__role = config.role;
+        this.__iam_server_id_header_value = config.iam_server_id_header_value;
+        this.__namespace = config.namespace;
+        this.__region = config.region;
+
+
+        const { credentials } = config;
+        this._validateCredentialsConfig(credentials);
+
+        this.__credentialChain = credentials ? () => Promise.resolve(credentials) : fromNodeProviderChain();
+    }
+
+    /**
+     * @inheritDoc
+     */
+    _authenticate() {
+        this._log.info(
+            'making authentication request: role=%s',
+            this.__role
+        );
+
+        var headers = {};
+
+        if (this.__namespace) {
+            headers = {
+                'X-Vault-Namespace': this.__namespace,
+            }
+        }
+
+
+        return Promise.resolve()
+            .then(() => this.__getCredentials())
+            .then((credentials) => {
+                return this.__apiClient.makeRequest(
+                    'POST',
+                    `/auth/${this._mount}/login`,
+                    this.__getVaultAuthRequestBody(this.__getStsRequest(credentials)),
+                    headers
+                );
+            })
+            .then((response) => {
+                this._log.debug(
+                    'receive token: %s',
+                    response.auth.client_token
+                );
+                return this._getTokenEntity(response.auth.client_token)
+            })
+    }
+
+    /**
+     * Credentials resolved by {@see @aws-sdk/credential-providers}
+     *
+     * @returns {Promise<AwsCredentialIdentity>}
+     * @private
+     */
+    __getCredentials() {
+        return this.__credentialChain();
+    }
+
+    /**
+     * Prepare vault auth request body
+     *
+     * @param stsRequest
+     * @returns {Object} {@link https://www.vaultproject.io/docs/auth/aws.html#via-the-api}
+     * @private
+     */
+    __getVaultAuthRequestBody(stsRequest) {
+        return {
+            iam_http_request_method: stsRequest.method,
+            iam_request_headers: this.__base64encode(
+                JSON.stringify(this.__headersLikeGolangStyle(stsRequest.headers))
+            ),
+            iam_request_body: this.__base64encode(stsRequest.body),
+            // `aws4` populates `hostname` for the default (global) endpoint, but
+            // `host` when an explicit host is supplied (regional endpoint). Use
+            // whichever is present so the URL sent to Vault matches the signed
+            // Host header.
+            iam_request_url: this.__base64encode(`https://${stsRequest.host || stsRequest.hostname}${stsRequest.path}`),
+            role: this.__role
+        }
+    }
+
+    /**
+     * Prepare signed request to AWS STS :: GetCallerIdentity
+     *
+     * @param credentials
+     * @private
+     */
+    __getStsRequest(credentials) {
+        const request = {
+            service: 'sts',
+            method: 'POST',
+            body: 'Action=GetCallerIdentity&Version=2011-06-15',
+            headers: this.__iam_server_id_header_value ? {
+                'X-Vault-AWS-IAM-Server-ID': this.__iam_server_id_header_value,
+            } : {}
+        };
+
+        // When a region is configured, sign the request against the regional STS
+        // endpoint. Both the SigV4 credential scope (via `region`) and the signed
+        // Host header / request URL (via `host`) must reference the same region,
+        // otherwise Vault's STS replay fails with `SignatureDoesNotMatch`.
+        // When omitted, `aws4` defaults to the global endpoint (`sts.amazonaws.com`,
+        // scope `us-east-1`), preserving the previous behavior.
+        if (this.__region) {
+            request.region = this.__region;
+            request.host = `sts.${this.__region}.amazonaws.com`;
+        }
+
+        return aws4.sign(request, credentials);
+    }
+
+    /**
+     * @param string
+     * @private
+     */
+    __base64encode(string) {
+        return Buffer.from(string).toString('base64')
+    }
+
+    /**
+     * @link https://github.com/hashicorp/vault/issues/2810
+     * @link https://golang.org/pkg/net/http/#Header
+     *
+     * @param {Object} headers
+     * @returns {Object}
+     * @private
+     */
+    __headersLikeGolangStyle(headers) {
+        return _.mapValues(headers, (value) => [`${value}`]);
+    }
+
+    _validateCredentialsConfig(credentials) {
+        if (Array.isArray(credentials)) {
+            throw new errors.InvalidAWSCredentialsError('Invalid AWS credentials provided in config. See CHANGELOG if migating from 0.x.x');
+        }
+        if (credentials && typeof credentials === 'object') {
+            if (!credentials.secretAccessKey || !credentials.accessKeyId) {
+                throw new errors.InvalidAWSCredentialsError('Invalid AWS credentials provided in config: accessKeyId and secretAccessKey are required.');
+            }
+        }
+    }
+}
+
+module.exports = VaultIAMAuth;

package/src/auth/VaultKubernetesAuth.js

@@ -1,48 +1,49 @@
-const fs = require('fs');
-const VaultBaseAuth = require('./VaultBaseAuth');
-
-class VaultKubernetesAuth extends VaultBaseAuth {
-    /**
-     * @param {VaultApiClient} apiClient - see {@link VaultBaseAuth#constructor}
-     * @param {Object} config
-     * @param {String} config.role - Role configured in Vault Kubernetes Auth backend under which we want to issue Vault token.
-     * @param {String} [config.tokenPath] - Path to the Kube JWT token. If omitted - default will be used.
-     * @param {String} mount - Vault's  mount point ("kubernetes" by default)
-     */
-    constructor(apiClient, logger, config, mount) {
-        super(apiClient, logger, mount || 'kubernetes');
-
-        this.__role = config.role;
-        this.__tokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token';
-        if (config.tokenPath !== undefined) {
-            this.__tokenPath = config.tokenPath;
-        }
-    }
-
-    _authenticate() {
-        this._log.info(
-            'making authentication request: Vault role: "%s"; K8s token path: "%s"',
-            this.__role, this.__tokenPath
-        );
-
-        const k8sJwtToken = fs.readFileSync(this.__tokenPath).toString();
-        this._log.debug(
-            'receive K8s token: %s',
-            k8sJwtToken
-        );
-
-        return this.__apiClient.makeRequest('POST', `/auth/${this._mount}/login`, {
-            role: this.__role,
-            jwt: k8sJwtToken,
-        }).then((res) => {
-            this._log.debug(
-                'receive token: %s',
-                res.auth.client_token
-            );
-
-            return this._getTokenEntity(res.auth.client_token);
-        });
-    }
-}
-
-module.exports = VaultKubernetesAuth;
+const fs = require('fs');
+const VaultBaseAuth = require('./VaultBaseAuth');
+
+class VaultKubernetesAuth extends VaultBaseAuth {
+    /**
+     * @param {VaultApiClient} apiClient - see {@link VaultBaseAuth#constructor}
+     * @param {Object} logger
+     * @param {Object} config
+     * @param {String} config.role - Role configured in Vault Kubernetes Auth backend under which we want to issue Vault token.
+     * @param {String} [config.tokenPath] - Path to the Kube JWT token. If omitted - default will be used.
+     * @param {String} mount - Vault's  mount point ("kubernetes" by default)
+     */
+    constructor(apiClient, logger, config, mount) {
+        super(apiClient, logger, mount || 'kubernetes');
+
+        this.__role = config.role;
+        this.__tokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token';
+        if (config.tokenPath !== undefined) {
+            this.__tokenPath = config.tokenPath;
+        }
+    }
+
+    _authenticate() {
+        this._log.info(
+            'making authentication request: Vault role: "%s"; K8s token path: "%s"',
+            this.__role, this.__tokenPath
+        );
+
+        const k8sJwtToken = fs.readFileSync(this.__tokenPath).toString();
+        this._log.debug(
+            'receive K8s token: %s',
+            k8sJwtToken
+        );
+
+        return this.__apiClient.makeRequest('POST', `/auth/${this._mount}/login`, {
+            role: this.__role,
+            jwt: k8sJwtToken,
+        }).then((res) => {
+            this._log.debug(
+                'receive token: %s',
+                res.auth.client_token
+            );
+
+            return this._getTokenEntity(res.auth.client_token);
+        });
+    }
+}
+
+module.exports = VaultKubernetesAuth;

package/src/auth/VaultTokenAuth.js

@@ -1,34 +1,35 @@
-'use strict';
-
-const VaultBaseAuth = require('./VaultBaseAuth');
-const errors = require('../errors');
-
-class VaultTokenAuth extends VaultBaseAuth {
-
-    /**
-     * @param {Object} connConfig - see {@link VaultBaseAuth#constructor}
-     * @param {Object} config
-     * @param {String} config.token
-     * @param {String} mount - Vault's  mount point ("token" by default)
-     */
-    constructor(connConfig, logger, config, mount) {
-        super(connConfig, logger, mount || 'token');
-
-        if (!config.token) {
-            throw new errors.InvalidArgumentsError('Auth token should be provided for VaultTokenAuth');
-        }
-
-        this.__token = config.token;
-    }
-
-    _authenticate() {
-        return this._getTokenEntity(this.__token);
-    }
-
-    _reauthenticationAllowed() {
-        return false;
-    }
-
-}
-
-module.exports = VaultTokenAuth;
+'use strict';
+
+const VaultBaseAuth = require('./VaultBaseAuth');
+const errors = require('../errors');
+
+class VaultTokenAuth extends VaultBaseAuth {
+
+    /**
+     * @param {VaultApiClient} apiClient - see {@link VaultBaseAuth#constructor}
+     * @param {Object} logger
+     * @param {Object} config
+     * @param {String} config.token
+     * @param {String} mount - Vault's mount point ("token" by default)
+     */
+    constructor(apiClient, logger, config, mount) {
+        super(apiClient, logger, mount || 'token');
+
+        if (!config.token) {
+            throw new errors.InvalidArgumentsError('Auth token should be provided for VaultTokenAuth');
+        }
+
+        this.__token = config.token;
+    }
+
+    _authenticate() {
+        return this._getTokenEntity(this.__token);
+    }
+
+    _reauthenticationAllowed() {
+        return false;
+    }
+
+}
+
+module.exports = VaultTokenAuth;

package/src/errors.js

@@ -1,21 +1,21 @@
-'use strict';
-
-class VaultError extends Error {
-    constructor(message, error) {
-        super(message);
-        this.name = this.constructor.name;
-        this.message = message;
-
-        Error.captureStackTrace(this, this.constructor.name);
-    }
-}
-class InvalidArgumentsError extends VaultError {}
-class InvalidAWSCredentialsError extends InvalidArgumentsError {}
-class AuthTokenExpiredError extends VaultError {}
-
-module.exports = {
-    VaultError,
-    InvalidArgumentsError,
-    InvalidAWSCredentialsError,
-    AuthTokenExpiredError,
-};
+'use strict';
+
+class VaultError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = this.constructor.name;
+        this.message = message;
+
+        Error.captureStackTrace(this, this.constructor);
+    }
+}
+class InvalidArgumentsError extends VaultError {}
+class InvalidAWSCredentialsError extends InvalidArgumentsError {}
+class AuthTokenExpiredError extends VaultError {}
+
+module.exports = {
+    VaultError,
+    InvalidArgumentsError,
+    InvalidAWSCredentialsError,
+    AuthTokenExpiredError,
+};