serverless-kms-alias 1.0.0

package/.husky/pre-commit

@@ -0,0 +1,10 @@
+#!/bin/sh
+# shellcheck disable=SC1090,SC1091
+. "$(dirname "$0")/_/husky.sh"
+
+PATH=$PATH:/usr/local/bin
+
+echo 'NOTE: If node or npm is not found, you may need to run brew link for your specific node version'
+npm run lint-staged
+npm run build
+git add dist/

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to make participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+- Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+- The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+- Trolling, insulting/derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all project spaces, and it also applies when
+an individual is representing the project or its community in public spaces.
+Examples of representing a project or community include using an official
+project e-mail address, posting via an official social media account, or acting
+as an appointed representative at an online or offline event. Representation of
+a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at opensource@github.com. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at <https://www.contributor-covenant.org/version/1/4/code-of-conduct.html>
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+<https://www.contributor-covenant.org/faq>

package/CONTRIBUTING.md

@@ -0,0 +1,22 @@
+# Contributors
+
+## Checkin
+
+- Do checkin source (src)
+- Do not checkin build output (dist)
+- Do not checkin node_modules
+
+## Development
+
+In order to handle code style and static analysis, we run [Husky](https://github.com/typicode/husky) before each commit.
+This step ensures that formatting and checkin rules are followed. To make sure Husky runs correctly, please use the
+following workflow:
+
+```sh
+npm install                                 # installs all devDependencies including Husky
+git add abc.ext                             # Add the files you've changed. This should include files in src, lib, and node_modules (see above)
+git commit -m "Informative commit message"  # Commit. This will run Husky
+```
+
+During the commit step, Husky will take care of formatting all files with [Prettier](https://github.com/prettier/prettier).
+It will also make sure these changes are appropriately included in your commit (no further work is needed)

package/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2022 James Geurts
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,43 @@
+# serverless-kms-alias
+
+Serverless plugin to expand a KMS alias variable to the ARN of the KMS key
+
+## Usage
+
+`${kms:<alias>}` will expand to the ARN of the kms key. The variable can be used anywhere that other Serverless
+variables are resolved.
+
+### Example - Provider kmsKeyArn
+
+```yaml
+service: foo
+
+provider:
+  name: aws
+  kmsKeyArn: '${kms:alias/aws/lambda}'
+  runtime: nodejs14.x
+
+plugins:
+  - serverless-kms-alias
+
+functions:
+  foo:
+    handler: foo.handler
+```
+
+### Example - Function kmsKeyArn
+
+```yaml
+service: foo
+provider:
+  name: aws
+  runtime: nodejs14.x
+
+plugins:
+  - serverless-kms-alias
+
+functions:
+  foo:
+    handler: foo.handler
+    kmsKeyArn: '${kms:arn:aws:kms:${aws:region}:${aws:accountId}:alias/aws/lambda}'
+```

package/dist/index.js

@@ -0,0 +1,37 @@
+"use strict";
+const client_kms_1 = require("@aws-sdk/client-kms");
+class KmsAliasPlugin {
+    constructor(serverless) {
+        this.configurationVariablesSources = {
+            kms: {
+                async resolve({ address }) {
+                    if (!/^(alias\/[a-zA-Z]|arn:aws:kms:[\w-]*:[\d]*:alias)/i.test(address)) {
+                        throw new Error(`Expected variable in the form of 'kms:alias/foo'`);
+                    }
+                    serverless.cli.log(`Info: Fetching KMS key for alias: ${address}`);
+                    const client = new client_kms_1.KMSClient({
+                        ...serverless.providers.aws.getCredentials(),
+                        region: serverless.providers.aws.getRegion(),
+                    });
+                    const command = new client_kms_1.DescribeKeyCommand({
+                        KeyId: address,
+                    });
+                    const response = await client.send(command);
+                    const keyMetadata = response.KeyMetadata;
+                    if (!keyMetadata) {
+                        throw new Error(`Unable to get key metadata for kms alias: ${address}`);
+                    }
+                    if (!keyMetadata.Arn) {
+                        throw new Error(`Unable to determine ARN for kms alias: ${address}`);
+                    }
+                    serverless.cli.log(`Info: Found KMS key for alias (${address}): ${keyMetadata.Arn}`);
+                    return {
+                        value: keyMetadata.Arn,
+                    };
+                },
+            },
+        };
+    }
+}
+module.exports = KmsAliasPlugin;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBLG9EQUFvRTtBQWtCcEUsTUFBTSxjQUFjO0lBR2xCLFlBQW1CLFVBQThCO1FBQy9DLElBQUksQ0FBQyw2QkFBNkIsR0FBRztZQUNuQyxHQUFHLEVBQUU7Z0JBQ0gsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLE9BQU8sRUFBaUI7b0JBQ3RDLElBQUksQ0FBQyxvREFBb0QsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUU7d0JBQ3ZFLE1BQU0sSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsQ0FBQztxQkFDckU7b0JBRUQsVUFBVSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMscUNBQXFDLE9BQU8sRUFBRSxDQUFDLENBQUM7b0JBRW5FLE1BQU0sTUFBTSxHQUFHLElBQUksc0JBQVMsQ0FBQzt3QkFDM0IsR0FBRyxVQUFVLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxjQUFjLEVBQUU7d0JBQzVDLE1BQU0sRUFBRSxVQUFVLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxTQUFTLEVBQUU7cUJBQzdDLENBQUMsQ0FBQztvQkFDSCxNQUFNLE9BQU8sR0FBRyxJQUFJLCtCQUFrQixDQUFDO3dCQUNyQyxLQUFLLEVBQUUsT0FBTztxQkFDZixDQUFDLENBQUM7b0JBQ0gsTUFBTSxRQUFRLEdBQUcsTUFBTSxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO29CQUU1QyxNQUFNLFdBQVcsR0FBRyxRQUFRLENBQUMsV0FBVyxDQUFDO29CQUV6QyxJQUFJLENBQUMsV0FBVyxFQUFFO3dCQUNoQixNQUFNLElBQUksS0FBSyxDQUFDLDZDQUE2QyxPQUFPLEVBQUUsQ0FBQyxDQUFDO3FCQUN6RTtvQkFFRCxJQUFJLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRTt3QkFDcEIsTUFBTSxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsT0FBTyxFQUFFLENBQUMsQ0FBQztxQkFDdEU7b0JBRUQsVUFBVSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsa0NBQWtDLE9BQU8sTUFBTSxXQUFXLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztvQkFFckYsT0FBTzt3QkFDTCxLQUFLLEVBQUUsV0FBVyxDQUFDLEdBQUc7cUJBQ3ZCLENBQUM7Z0JBQ0osQ0FBQzthQUNGO1NBQ0YsQ0FBQztJQUNKLENBQUM7Q0FDRjtBQUVELGlCQUFTLGNBQWMsQ0FBQyJ9

package/dist/types/ServerlessInstance.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU2VydmVybGVzc0luc3RhbmNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3R5cGVzL1NlcnZlcmxlc3NJbnN0YW5jZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/dist/types/index.js

@@ -0,0 +1,14 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./ServerlessInstance"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7O0FBQUEsdURBQXFDIn0=

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "serverless-kms-alias",
+  "version": "1.0.0",
+  "engines": {
+    "node": ">= 12"
+  },
+  "dependencies": {
+    "@aws-sdk/client-kms": "^3.47.0"
+  },
+  "devDependencies": {
+    "@types/lodash": "4.14.178",
+    "@types/serverless": "1.78.41",
+    "@typescript-eslint/eslint-plugin": "5.10.0",
+    "@typescript-eslint/parser": "5.10.0",
+    "eslint": "8.7.0",
+    "eslint-config-airbnb-base": "15.0.0",
+    "eslint-config-airbnb-typescript": "16.1.0",
+    "eslint-config-prettier": "8.3.0",
+    "eslint-plugin-import": "2.25.4",
+    "eslint-plugin-jsdoc": "37.6.1",
+    "eslint-plugin-prettier": "4.0.0",
+    "eslint-plugin-promise": "6.0.0",
+    "eslint-plugin-security": "1.4.0",
+    "husky": "7.0.4",
+    "lint-staged": "12.2.0",
+    "markdownlint-cli": "0.30.0",
+    "npm-run-all": "4.1.5",
+    "pinst": "2.1.6",
+    "prettier": "2.5.1",
+    "prettier-plugin-packagejson": "2.2.15",
+    "typescript": "4.5.4"
+  },
+  "main": "dist/index.js",
+  "license": "MIT",
+  "scripts": {
+    "build": "tsc",
+    "lint:markdown": "prettier --write '*.md' '!(node_modules|dist)/**/*.md' && markdownlint '*.md' '!(node_modules|dist)/**/*.md' --config=.github/linters/.markdown-lint.yml --fix",
+    "lint:code": "prettier --write *.json .eslintrc.js .prettierrc.js && eslint --fix --ext .ts src",
+    "lint": "run-p lint:*",
+    "lint-staged": "lint-staged",
+    "prepublishOnly": "rm -rf dist && npm run build && npm run lint && pinst --disable",
+    "_postinstall": "husky install",
+    "postpublish": "pinst --enable"
+  },
+  "lint-staged": {
+    "*.md": [
+      "prettier --write",
+      "markdownlint --config=.github/linters/.markdown-lint.yml --fix"
+    ],
+    "./*.js": [
+      "eslint --fix"
+    ],
+    "*.ts": [
+      "eslint --fix"
+    ]
+  },
+  "repository": "https://github.com/mpirik/serverless-kms-alias.git"
+}

package/src/index.ts

@@ -0,0 +1,62 @@
+import { DescribeKeyCommand, KMSClient } from '@aws-sdk/client-kms';
+
+import type { ServerlessInstance } from './types';
+
+interface ResolveParams {
+  address: string;
+  params?: string[];
+  resolveVariable: (name: string) => Promise<string>;
+}
+
+interface ResolveResult {
+  value: string;
+}
+
+interface ServerlessVariableSource {
+  resolve(params: ResolveParams): Promise<ResolveResult>;
+}
+
+class KmsAliasPlugin {
+  public configurationVariablesSources: Record<string, ServerlessVariableSource>;
+
+  public constructor(serverless: ServerlessInstance) {
+    this.configurationVariablesSources = {
+      kms: {
+        async resolve({ address }: ResolveParams): Promise<ResolveResult> {
+          if (!/^(alias\/[a-zA-Z]|arn:aws:kms:[\w-]*:[\d]*:alias)/i.test(address)) {
+            throw new Error(`Expected variable in the form of 'kms:alias/foo'`);
+          }
+
+          serverless.cli.log(`Info: Fetching KMS key for alias: ${address}`);
+
+          const client = new KMSClient({
+            ...serverless.providers.aws.getCredentials(),
+            region: serverless.providers.aws.getRegion(),
+          });
+          const command = new DescribeKeyCommand({
+            KeyId: address,
+          });
+          const response = await client.send(command);
+
+          const keyMetadata = response.KeyMetadata;
+
+          if (!keyMetadata) {
+            throw new Error(`Unable to get key metadata for kms alias: ${address}`);
+          }
+
+          if (!keyMetadata.Arn) {
+            throw new Error(`Unable to determine ARN for kms alias: ${address}`);
+          }
+
+          serverless.cli.log(`Info: Found KMS key for alias (${address}): ${keyMetadata.Arn}`);
+
+          return {
+            value: keyMetadata.Arn,
+          };
+        },
+      },
+    };
+  }
+}
+
+export = KmsAliasPlugin;

package/src/types/ServerlessInstance.ts

@@ -0,0 +1,13 @@
+import type { AwsAuthInputConfig } from '@aws-sdk/middleware-signing/dist-types/configurations';
+
+export interface ServerlessInstance {
+  providers: {
+    aws: {
+      getCredentials(): AwsAuthInputConfig['credentials'];
+      getRegion(): string;
+    };
+  };
+  cli: {
+    log(str: string, entity?: string): void;
+  };
+}

package/src/types/index.ts

@@ -0,0 +1 @@
+export * from './ServerlessInstance';

package/tsconfig.json

@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "es2018",
+    "lib": ["esnext"],
+    "module": "commonjs",
+    "moduleResolution": "node",
+
+    "inlineSourceMap": true,
+
+    "baseUrl": ".",
+    "outDir": "dist",
+
+    "strict": true,
+    "forceConsistentCasingInFileNames": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true
+  },
+  "include": ["src"]
+}