Merge pull request #3470 from Infisical/feat/awsSecretRotationV2

feat(secret-rotation-v2): Add AWS IAM User Secret rotation

frontend/src/hooks/api/appConnections/aws/queries.tsx

@@ -4,15 +4,20 @@ import { apiRequest } from "@app/config/request";
 import { appConnectionKeys } from "@app/hooks/api/appConnections";
 
 import {
+  TAwsConnectionIamUser,
   TAwsConnectionKmsKey,
+  TAwsConnectionListIamUsersResponse,
   TAwsConnectionListKmsKeysResponse,
+  TListAwsConnectionIamUsers,
   TListAwsConnectionKmsKeys
 } from "./types";
 
 const awsConnectionKeys = {
   all: [...appConnectionKeys.all, "aws"] as const,
   listKmsKeys: (params: TListAwsConnectionKmsKeys) =>
-    [...awsConnectionKeys.all, "kms-keys", params] as const
+    [...awsConnectionKeys.all, "kms-keys", params] as const,
+  listIamUsers: (params: TListAwsConnectionIamUsers) =>
+    [...awsConnectionKeys.all, "iam-users", params] as const
 };
 
 export const useListAwsConnectionKmsKeys = (
@@ -40,3 +45,28 @@ export const useListAwsConnectionKmsKeys = (
     ...options
   });
 };
+
+export const useListAwsConnectionIamUsers = (
+  { connectionId }: TListAwsConnectionIamUsers,
+  options?: Omit<
+    UseQueryOptions<
+      TAwsConnectionIamUser[],
+      unknown,
+      TAwsConnectionIamUser[],
+      ReturnType<typeof awsConnectionKeys.listIamUsers>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: awsConnectionKeys.listIamUsers({ connectionId }),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TAwsConnectionListIamUsersResponse>(
+        `/api/v1/app-connections/aws/${connectionId}/users`
+      );
+
+      return data.iamUsers;
+    },
+    ...options
+  });
+};

frontend/src/hooks/api/appConnections/aws/types.ts

@@ -14,3 +14,18 @@ export type TAwsConnectionKmsKey = {
 export type TAwsConnectionListKmsKeysResponse = {
   kmsKeys: TAwsConnectionKmsKey[];
 };
+
+export type TListAwsConnectionIamUsers = {
+  connectionId: string;
+};
+
+export type TAwsConnectionIamUser = {
+  arn: string;
+  UserName: string;
+};
+
+export type TAwsConnectionListIamUsersResponse = {
+  iamUsers: TAwsConnectionIamUser[];
+};
+
+export type TAwsIamUserSecret = TAwsConnectionIamUser;

frontend/src/hooks/api/secretRotationsV2/enums.ts

@@ -1,7 +1,8 @@
 export enum SecretRotation {
   PostgresCredentials = "postgres-credentials",
   MsSqlCredentials = "mssql-credentials",
-  Auth0ClientSecret = "auth0-client-secret"
+  Auth0ClientSecret = "auth0-client-secret",
+  AwsIamUserSecret = "aws-iam-user-secret"
 }
 
 export enum SecretRotationStatus {

frontend/src/hooks/api/secretRotationsV2/types/aws-iam-user-secret-rotation.ts

@@ -0,0 +1,38 @@
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { SecretRotation } from "@app/hooks/api/secretRotationsV2";
+import {
+  TSecretRotationV2Base,
+  TSecretRotationV2GeneratedCredentialsResponseBase
+} from "@app/hooks/api/secretRotationsV2/types/shared";
+
+export type TAwsIamUserSecretRotation = TSecretRotationV2Base & {
+  type: SecretRotation.AwsIamUserSecret;
+  parameters: {
+    region?: string;
+    userName: string;
+  };
+  secretsMapping: {
+    accessKeyId: string;
+    secretAccessKey: string;
+  };
+};
+
+export type TAwsIamUserSecretRotationGeneratedCredentials = {
+  accessKeyId: string;
+  secretAccessKey: string;
+};
+
+export type TAwsIamUserSecretRotationGeneratedCredentialsResponse =
+  TSecretRotationV2GeneratedCredentialsResponseBase<
+    SecretRotation.AwsIamUserSecret,
+    TAwsIamUserSecretRotationGeneratedCredentials
+  >;
+
+export type TAwsIamUserSecretRotationOption = {
+  name: string;
+  type: SecretRotation.AwsIamUserSecret;
+  connection: AppConnection.AWS;
+  template: {
+    secretsMapping: TAwsIamUserSecretRotation["secretsMapping"];
+  };
+};

frontend/src/hooks/api/secretRotationsV2/types/index.ts

@@ -4,6 +4,11 @@ import {
   TAuth0ClientSecretRotationGeneratedCredentialsResponse,
   TAuth0ClientSecretRotationOption
 } from "@app/hooks/api/secretRotationsV2/types/auth0-client-secret-rotation";
+import {
+  TAwsIamUserSecretRotation,
+  TAwsIamUserSecretRotationGeneratedCredentialsResponse,
+  TAwsIamUserSecretRotationOption
+} from "@app/hooks/api/secretRotationsV2/types/aws-iam-user-secret-rotation";
 import {
   TMsSqlCredentialsRotation,
   TMsSqlCredentialsRotationGeneratedCredentialsResponse
@@ -20,13 +25,15 @@ export type TSecretRotationV2 = (
   | TPostgresCredentialsRotation
   | TMsSqlCredentialsRotation
   | TAuth0ClientSecretRotation
+  | TAwsIamUserSecretRotation
 ) & {
   secrets: (SecretV3RawSanitized | null)[];
 };
 
 export type TSecretRotationV2Option =
   | TSqlCredentialsRotationOption
-  | TAuth0ClientSecretRotationOption;
+  | TAuth0ClientSecretRotationOption
+  | TAwsIamUserSecretRotationOption;
 
 export type TListSecretRotationV2Options = { secretRotationOptions: TSecretRotationV2Option[] };
 
@@ -35,7 +42,8 @@ export type TSecretRotationV2Response = { secretRotation: TSecretRotationV2 };
 export type TViewSecretRotationGeneratedCredentialsResponse =
   | TPostgresCredentialsRotationGeneratedCredentialsResponse
   | TMsSqlCredentialsRotationGeneratedCredentialsResponse
-  | TAuth0ClientSecretRotationGeneratedCredentialsResponse;
+  | TAuth0ClientSecretRotationGeneratedCredentialsResponse
+  | TAwsIamUserSecretRotationGeneratedCredentialsResponse;
 
 export type TCreateSecretRotationV2DTO = DiscriminativePick<
   TSecretRotationV2,
@@ -82,10 +90,12 @@ export type TSecretRotationOptionMap = {
   [SecretRotation.PostgresCredentials]: TSqlCredentialsRotationOption;
   [SecretRotation.MsSqlCredentials]: TSqlCredentialsRotationOption;
   [SecretRotation.Auth0ClientSecret]: TAuth0ClientSecretRotationOption;
+  [SecretRotation.AwsIamUserSecret]: TAwsIamUserSecretRotationOption;
 };
 
 export type TSecretRotationGeneratedCredentialsResponseMap = {
   [SecretRotation.PostgresCredentials]: TPostgresCredentialsRotationGeneratedCredentialsResponse;
   [SecretRotation.MsSqlCredentials]: TMsSqlCredentialsRotationGeneratedCredentialsResponse;
   [SecretRotation.Auth0ClientSecret]: TAuth0ClientSecretRotationGeneratedCredentialsResponse;
+  [SecretRotation.AwsIamUserSecret]: TAwsIamUserSecretRotationGeneratedCredentialsResponse;
 };