aws-chain-secrets 1.0.0__tar.gz

aws_chain_secrets-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Hyouk Oh
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

aws_chain_secrets-1.0.0/PKG-INFO

@@ -0,0 +1,133 @@
+Metadata-Version: 2.1
+Name: aws_chain_secrets
+Version: 1.0.0
+Summary: This aims to enable the use of one or more secrets from AWS SecretsManager.
+Home-page: https://github.com/h5kure/aws-chain-secrets
+Author: Hyouk Oh
+Author-email: h.5.kure@gmail.com
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.7
+Description-Content-Type: text/x-rst
+License-File: LICENSE
+
+AWS chain secrets
+===================
+
+This package aims to make using AWS SecretsManager more comfortable.
+
+Introduce
+---------
+This aims to enable the use of one or more secrets from AWS SecretsManager.
+
+If more than one secret is used, the secret specified last takes precedence.
+
+For example, if you use secrets named A and B in that order, overlapping entries from A and B will later use
+the value of the specified B entry.
+
+
+.. code-block:: python
+
+    >>> A = {"foo": 1, "bar": 2}
+    >>> B = {"bar": 3}
+    >>> secrets("bar", casting_type=int)
+    3
+
+Install
+-------
+
+.. code-block:: bash
+
+    $ python -m pip install aws_chain_secrets
+
+
+How to use
+----------
+
+.. note::
+
+    AWS credential is required.
+
+    If your credentials installed or set to environment, you can omit credentials when initialize `SecretsManager`.
+
+connect and fetch manually
+""""""""""""""""""""""""""
+
+.. code-block:: python
+
+    from aws_chain_secrets import SecretsManager
+    secrets = SecretsManager('ap-northeast-2', 'secret_name_1', 'secret_name_2', ...)
+    secrets.connect()
+    secrets.fetch()
+    secrets(key="A", default=None, casting_type=int)
+    secrets.disconnect()
+
+
+.. note::
+
+    The secret assigned last takes precedence over secrets assigned earlier.
+
+    In this case, `secret_name_2` has a higher priority than `secret_name_1`.
+
+    This works likes `dict.update` (`secret_name_1.update(secret_name_2)`).
+
+use with context manager
+""""""""""""""""""""""""
+
+You can omit `connect()`, `fetch()` and `disconnect()` when using context manager.
+
+.. code-block:: python
+
+    from aws_chain_secrets import SecretsManager
+    with SecretsManager('ap-northeast-2', 'secret_name_1', 'secret_name_2', ...) as secrets:
+        secrets(key="A", default=None, casting_type=int)
+
+type casting
+""""""""""""
+
+All secret values ​​retrieved from AWS SecretsManager are string types by default.
+
+You can change it to any type you want.
+
+.. code-block:: python
+
+    >>> secrets(key="A", casting_type=int)
+    1
+    >>> secrets(key="SOME_ARRAY", casting_type=list)
+    ['1', '2', '3', '4']
+    >>> secrets(key="SOME_ARRAY", casting_type=list[int])
+    [1, 2, 3, 4]
+
+default value
+"""""""""""""
+
+You can specify a default value, just like when using Python `dict`'s `get`.
+
+.. code-block:: python
+
+    # if the key value of A does not exist, 0 specified as default is returned.
+    >>> secrets(key="A", default=0)
+    0
+
+change value
+""""""""""""
+
+You can change (or add) the value of a specified secret by name.
+
+.. code-block:: python
+
+    >>> secrets.set('secret_name_1', 'key', 'value')
+
+update remote (AWS secrets manager) data from local
+"""""""""""""""""""""""""""""""""""""""""""""""""""
+
+You can update (upload) the values of a specified secret by name from local to remote.
+
+.. code-block:: python
+
+    >>> secrets.update('secret_name_1')

aws_chain_secrets-1.0.0/README.rst

@@ -0,0 +1,115 @@
+AWS chain secrets
+===================
+
+This package aims to make using AWS SecretsManager more comfortable.
+
+Introduce
+---------
+This aims to enable the use of one or more secrets from AWS SecretsManager.
+
+If more than one secret is used, the secret specified last takes precedence.
+
+For example, if you use secrets named A and B in that order, overlapping entries from A and B will later use
+the value of the specified B entry.
+
+
+.. code-block:: python
+
+    >>> A = {"foo": 1, "bar": 2}
+    >>> B = {"bar": 3}
+    >>> secrets("bar", casting_type=int)
+    3
+
+Install
+-------
+
+.. code-block:: bash
+
+    $ python -m pip install aws_chain_secrets
+
+
+How to use
+----------
+
+.. note::
+
+    AWS credential is required.
+
+    If your credentials installed or set to environment, you can omit credentials when initialize `SecretsManager`.
+
+connect and fetch manually
+""""""""""""""""""""""""""
+
+.. code-block:: python
+
+    from aws_chain_secrets import SecretsManager
+    secrets = SecretsManager('ap-northeast-2', 'secret_name_1', 'secret_name_2', ...)
+    secrets.connect()
+    secrets.fetch()
+    secrets(key="A", default=None, casting_type=int)
+    secrets.disconnect()
+
+
+.. note::
+
+    The secret assigned last takes precedence over secrets assigned earlier.
+
+    In this case, `secret_name_2` has a higher priority than `secret_name_1`.
+
+    This works likes `dict.update` (`secret_name_1.update(secret_name_2)`).
+
+use with context manager
+""""""""""""""""""""""""
+
+You can omit `connect()`, `fetch()` and `disconnect()` when using context manager.
+
+.. code-block:: python
+
+    from aws_chain_secrets import SecretsManager
+    with SecretsManager('ap-northeast-2', 'secret_name_1', 'secret_name_2', ...) as secrets:
+        secrets(key="A", default=None, casting_type=int)
+
+type casting
+""""""""""""
+
+All secret values ​​retrieved from AWS SecretsManager are string types by default.
+
+You can change it to any type you want.
+
+.. code-block:: python
+
+    >>> secrets(key="A", casting_type=int)
+    1
+    >>> secrets(key="SOME_ARRAY", casting_type=list)
+    ['1', '2', '3', '4']
+    >>> secrets(key="SOME_ARRAY", casting_type=list[int])
+    [1, 2, 3, 4]
+
+default value
+"""""""""""""
+
+You can specify a default value, just like when using Python `dict`'s `get`.
+
+.. code-block:: python
+
+    # if the key value of A does not exist, 0 specified as default is returned.
+    >>> secrets(key="A", default=0)
+    0
+
+change value
+""""""""""""
+
+You can change (or add) the value of a specified secret by name.
+
+.. code-block:: python
+
+    >>> secrets.set('secret_name_1', 'key', 'value')
+
+update remote (AWS secrets manager) data from local
+"""""""""""""""""""""""""""""""""""""""""""""""""""
+
+You can update (upload) the values of a specified secret by name from local to remote.
+
+.. code-block:: python
+
+    >>> secrets.update('secret_name_1')

aws_chain_secrets-1.0.0/aws_chain_secrets/__init__.py

@@ -0,0 +1 @@
+from .secrets_manager import SecretsManager

aws_chain_secrets-1.0.0/aws_chain_secrets/caster.py

@@ -0,0 +1,67 @@
+import json
+import string
+from dataclasses import dataclass
+from types import GenericAlias
+from typing import Any, Type, get_origin, get_args
+
+TRUE_STRINGS = ('y', 'yes', 't', 'true', 'on', '1')
+FALSE_STRINGS = ('', 'n', 'no', 'f', 'false', 'off', '0')
+
+
+def string_to_boolean(value: str) -> bool:
+    """
+    Convert a string representation of truth to True or False.
+
+    :param value: a string representation of truth
+    :return: True if value represents truth, False if value represents false, otherwise raise ValueError
+    :raises: Raises ValueError if 'value' is anything else
+    """
+    value = value.lower()
+    if value in TRUE_STRINGS:
+        return True
+    if value in FALSE_STRINGS:
+        return False
+    raise ValueError(f"invalid truth value {repr(value)}")
+
+
+def cast_boolean(value: Any) -> bool:
+    value = str(value)
+    return string_to_boolean(value)
+
+
+def cast(value: str, casting_type: Type = None) -> Any:
+    """
+    string value to typed value
+    :param value: original string
+    :param casting_type: expected type to be
+    :return: typed value
+    """
+    if casting_type is None:
+        return value
+    if casting_type is bool:
+        return cast_boolean(value)
+    if casting_type in (set, list, tuple, bytes, bytearray):
+        return Sequence(wrapper=casting_type)(value)
+    if casting_type is dict:
+        return json.loads(value)
+    if isinstance(casting_type, GenericAlias):
+        origin = get_origin(casting_type)
+        args = get_args(casting_type)
+        if origin in (set, list, tuple, bytes, bytearray):
+            return Sequence(cast_type=args[0] if args else str, wrapper=origin)(value)
+        raise NotImplementedError(f"cannot cast to {repr(casting_type)}")
+    return casting_type(value)
+
+
+@dataclass
+class Sequence:
+    """
+    Helper to cast Sequence (list, tuple, bytes, bytearray) and Set(set, frozenset)
+    """
+    cast_type: Type = str
+    delimiter: str = ','
+    strip: str = string.whitespace
+    wrapper: Type = list
+
+    def __call__(self, value: str):
+        return self.wrapper(cast(v.strip(self.strip), self.cast_type) for v in value.split(self.delimiter))

aws_chain_secrets-1.0.0/aws_chain_secrets/client.py

@@ -0,0 +1,44 @@
+from typing import Optional
+
+import boto3
+from botocore.client import BaseClient
+
+
+class Client:
+    """
+    wrapper for AWS client
+    """
+    def __init__(
+            self,
+            service_name: str,
+            region_name: str,
+            aws_access_key_id: str = None,
+            aws_secret_access_key: str = None
+    ):
+        self.service_name = service_name
+        self.region_name = region_name
+        self.aws_access_key_id = aws_access_key_id
+        self.aws_secret_access_key = aws_secret_access_key
+        self._client: Optional[BaseClient] = None
+
+    def __enter__(self):
+        self.connect()
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        self.disconnect()
+
+    def _create_client(self) -> BaseClient:
+        return boto3.session.Session().client(
+            service_name=self.service_name,
+            region_name=self.region_name,
+            aws_access_key_id=self.aws_access_key_id,
+            aws_secret_access_key=self.aws_secret_access_key
+        )
+
+    def connect(self):
+        self._client = self._create_client()
+
+    def disconnect(self):
+        self._client.close()
+        del self._client

aws_chain_secrets-1.0.0/aws_chain_secrets/exceptions.py

@@ -0,0 +1,42 @@
+
+
+class SecretsManagerException(Exception):
+    DEFAULT_MESSAGE = "Unknown error occurred."
+
+    def __init__(self, message: str = None):
+        super().__init__(message or self.DEFAULT_MESSAGE)
+
+    @classmethod
+    def from_code(cls, code: str, message: str = None) -> 'SecretsManagerException':
+        if code == 'DecryptionFailureException':
+            return DecryptionFailureException(message)
+        elif code == 'InternalServiceErrorException':
+            return InternalServiceErrorException(message)
+        elif code == 'InvalidParameterException':
+            return InvalidParameterException(message)
+        elif code == 'InvalidRequestException':
+            return InvalidRequestException(message)
+        elif code == 'ResourceNotFoundException':
+            return ResourceNotFoundException(message)
+        else:
+            return cls(message)
+
+
+class DecryptionFailureException(SecretsManagerException):
+    DEFAULT_MESSAGE = "Secrets Manager can't decrypt the protected secret text using the provided KMS key."
+
+
+class InternalServiceErrorException(SecretsManagerException):
+    DEFAULT_MESSAGE = "An error occurred on the server side."
+
+
+class InvalidParameterException(SecretsManagerException):
+    DEFAULT_MESSAGE = "You provided an invalid value for a parameter.",
+
+
+class InvalidRequestException(SecretsManagerException):
+    DEFAULT_MESSAGE = "You provided a parameter value that is not valid for the current state of the resource."
+
+
+class ResourceNotFoundException(SecretsManagerException):
+    DEFAULT_MESSAGE = "We can't find the resource that you asked for."

aws_chain_secrets-1.0.0/aws_chain_secrets/secrets_manager.py

@@ -0,0 +1,117 @@
+import base64
+import json
+from collections import ChainMap
+from typing import Any, Type
+
+from botocore.exceptions import ClientError
+
+from aws_chain_secrets.caster import cast
+from aws_chain_secrets.client import Client
+from aws_chain_secrets.exceptions import SecretsManagerException
+
+
+class Null:
+    """
+    class to represent null type
+    """
+    pass
+
+
+null = Null()
+
+
+class SecretsManager(Client):
+    def __init__(
+            self,
+            region_name: str,
+            *secret_names: str,
+            aws_access_key_id: str = None,
+            aws_secret_access_key: str = None
+    ):
+        """
+        initial setup
+        :param region_name: AWS region name
+        :param secret_names: These are the secret names from which to read settings. The last name has priority.
+        """
+        self.secret_names = secret_names
+        super().__init__(
+            "secretsmanager",
+            region_name,
+            aws_access_key_id,
+            aws_secret_access_key
+        )
+        self._secrets = {secret_name: {} for secret_name in secret_names}
+        self._combined = ChainMap(*reversed(self._secrets.values()))
+
+    def __call__(self, key, *, default: Any = null, casting_type: Type = str):
+        return self.get(key, default=default, casting_type=casting_type)
+
+    def __enter__(self):
+        super().__enter__()
+        self.fetch()
+        return self
+
+    def get(self, key, *, default: Any = null, casting_type: Type = str):
+        """
+        get secret value
+        :param key: key value to search
+        :param default: default value if key not exists in secrets
+        :param casting_type: casting type to convert value
+        :return: Any secret value specified by key
+        """
+        try:
+            value = self._combined[key]
+        except KeyError:
+            if isinstance(default, Null):
+                raise KeyError(f"{repr(key)} not found. Please check secret value in AWS Secrets Manager.")
+            return default
+        return cast(value, casting_type)
+
+    def set(self, secret_name: str, key, value):
+        """
+        set a `key: value` to the specified secret
+        :param secret_name: secret_name of AWS Secrets Manager
+        :param key: key of map
+        :param value: value of map
+        """
+        self._secrets[secret_name][key] = value
+
+    def keys(self):
+        return self._combined.keys()
+
+    def values(self):
+        return self._combined.values()
+
+    def items(self):
+        return self._combined.items()
+
+    def fetch(self):
+        """
+        get secrets from AWS and update
+        """
+        for secret_name in self.secret_names:
+            self._secrets[secret_name].clear()
+            self._secrets[secret_name].update(self._get_secrets(secret_name))
+
+    def update(self, secret_name: str):
+        """
+        update specified secrets from local to AWS
+        :param secret_name: secret name of AWS Secrets Manager
+        """
+        self._client.update_secret(SecretId=secret_name, SecretString=json.dumps(self._secrets[secret_name]))
+
+    def _get_secrets(self, secret_name: str) -> dict:
+        """
+        get secrets from AWS
+        :param secret_name: secret name of AWS Secrets Manager
+        """
+        try:
+            response = self._client.get_secret_value(SecretId=secret_name)
+        except ClientError as e:
+            raise SecretsManagerException.from_code(e.response['Error']['Code'])
+        else:
+            if 'SecretString' in response:
+                return json.loads(response['SecretString'])
+            return json.loads(base64.b64decode(response['SecretBinary']))
+
+

aws_chain_secrets-1.0.0/aws_chain_secrets.egg-info/PKG-INFO

@@ -0,0 +1,133 @@
+Metadata-Version: 2.1
+Name: aws-chain-secrets
+Version: 1.0.0
+Summary: This aims to enable the use of one or more secrets from AWS SecretsManager.
+Home-page: https://github.com/h5kure/aws-chain-secrets
+Author: Hyouk Oh
+Author-email: h.5.kure@gmail.com
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.7
+Description-Content-Type: text/x-rst
+License-File: LICENSE
+
+AWS chain secrets
+===================
+
+This package aims to make using AWS SecretsManager more comfortable.
+
+Introduce
+---------
+This aims to enable the use of one or more secrets from AWS SecretsManager.
+
+If more than one secret is used, the secret specified last takes precedence.
+
+For example, if you use secrets named A and B in that order, overlapping entries from A and B will later use
+the value of the specified B entry.
+
+
+.. code-block:: python
+
+    >>> A = {"foo": 1, "bar": 2}
+    >>> B = {"bar": 3}
+    >>> secrets("bar", casting_type=int)
+    3
+
+Install
+-------
+
+.. code-block:: bash
+
+    $ python -m pip install aws_chain_secrets
+
+
+How to use
+----------
+
+.. note::
+
+    AWS credential is required.
+
+    If your credentials installed or set to environment, you can omit credentials when initialize `SecretsManager`.
+
+connect and fetch manually
+""""""""""""""""""""""""""
+
+.. code-block:: python
+
+    from aws_chain_secrets import SecretsManager
+    secrets = SecretsManager('ap-northeast-2', 'secret_name_1', 'secret_name_2', ...)
+    secrets.connect()
+    secrets.fetch()
+    secrets(key="A", default=None, casting_type=int)
+    secrets.disconnect()
+
+
+.. note::
+
+    The secret assigned last takes precedence over secrets assigned earlier.
+
+    In this case, `secret_name_2` has a higher priority than `secret_name_1`.
+
+    This works likes `dict.update` (`secret_name_1.update(secret_name_2)`).
+
+use with context manager
+""""""""""""""""""""""""
+
+You can omit `connect()`, `fetch()` and `disconnect()` when using context manager.
+
+.. code-block:: python
+
+    from aws_chain_secrets import SecretsManager
+    with SecretsManager('ap-northeast-2', 'secret_name_1', 'secret_name_2', ...) as secrets:
+        secrets(key="A", default=None, casting_type=int)
+
+type casting
+""""""""""""
+
+All secret values ​​retrieved from AWS SecretsManager are string types by default.
+
+You can change it to any type you want.
+
+.. code-block:: python
+
+    >>> secrets(key="A", casting_type=int)
+    1
+    >>> secrets(key="SOME_ARRAY", casting_type=list)
+    ['1', '2', '3', '4']
+    >>> secrets(key="SOME_ARRAY", casting_type=list[int])
+    [1, 2, 3, 4]
+
+default value
+"""""""""""""
+
+You can specify a default value, just like when using Python `dict`'s `get`.
+
+.. code-block:: python
+
+    # if the key value of A does not exist, 0 specified as default is returned.
+    >>> secrets(key="A", default=0)
+    0
+
+change value
+""""""""""""
+
+You can change (or add) the value of a specified secret by name.
+
+.. code-block:: python
+
+    >>> secrets.set('secret_name_1', 'key', 'value')
+
+update remote (AWS secrets manager) data from local
+"""""""""""""""""""""""""""""""""""""""""""""""""""
+
+You can update (upload) the values of a specified secret by name from local to remote.
+
+.. code-block:: python
+
+    >>> secrets.update('secret_name_1')

aws_chain_secrets-1.0.0/aws_chain_secrets.egg-info/SOURCES.txt

@@ -0,0 +1,16 @@
+LICENSE
+README.rst
+setup.py
+aws_chain_secrets/__init__.py
+aws_chain_secrets/caster.py
+aws_chain_secrets/client.py
+aws_chain_secrets/exceptions.py
+aws_chain_secrets/py.typed
+aws_chain_secrets/secrets_manager.py
+aws_chain_secrets.egg-info/PKG-INFO
+aws_chain_secrets.egg-info/SOURCES.txt
+aws_chain_secrets.egg-info/dependency_links.txt
+aws_chain_secrets.egg-info/requires.txt
+aws_chain_secrets.egg-info/top_level.txt
+tests/__init__.py
+tests/test_caster.py

aws_chain_secrets-1.0.0/aws_chain_secrets.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

aws_chain_secrets-1.0.0/aws_chain_secrets.egg-info/requires.txt

@@ -0,0 +1 @@
+boto3

aws_chain_secrets-1.0.0/aws_chain_secrets.egg-info/top_level.txt

@@ -0,0 +1,2 @@
+aws_chain_secrets
+tests

aws_chain_secrets-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

aws_chain_secrets-1.0.0/setup.py

@@ -0,0 +1,29 @@
+import setuptools
+
+with open("README.rst", "r", encoding='utf-8') as readme:
+    long_description = readme.read()
+
+setuptools.setup(
+    name="aws_chain_secrets",
+    version='1.0.0',
+    author="Hyouk Oh",
+    author_email="h.5.kure@gmail.com",
+    description="This aims to enable the use of one or more secrets from AWS SecretsManager.",
+    long_description=long_description,
+    long_description_content_type="text/x-rst",
+    url="https://github.com/h5kure/aws-chain-secrets",
+    packages=setuptools.find_packages(),
+    package_data={"": ["py.typed"]},
+    include_package_data=True,
+    classifiers=[
+        "Programming Language :: Python :: 3.7",
+        "Programming Language :: Python :: 3.8",
+        "Programming Language :: Python :: 3.9",
+        "Programming Language :: Python :: 3.10",
+        "Programming Language :: Python :: 3.11",
+        "License :: OSI Approved :: MIT License",
+        "Operating System :: OS Independent",
+    ],
+    python_requires='>=3.7',
+    install_requires=['boto3']
+)

aws_chain_secrets-1.0.0/tests/test_caster.py

@@ -0,0 +1,21 @@
+import unittest
+
+from aws_chain_secrets import caster
+
+
+class CasterTestCase(unittest.TestCase):
+    def test_int(self):
+        self.assertEqual(1, caster.cast('1', int))
+
+    def test_bool(self):
+        self.assertTrue(caster.cast('true', bool))
+
+    def test_list(self):
+        self.assertEqual(['1', '2', '3', '4'], caster.cast('1,2,3,4', list))
+        self.assertEqual([1, 2, 3, 4], caster.cast('1, 2, 3, 4', list[int]))
+
+    def test_set(self):
+        self.assertEqual({1, 2, 3, 4}, caster.cast('1,2,3,4', set[int]))
+
+    def test_dict(self):
+        self.assertEqual({'foo': 'bar'}, caster.cast('{"foo": "bar"}', dict))