From 489bd124d235712e10a144eae6909853fd89c0c0 Mon Sep 17 00:00:00 2001 From: carlosmonastyrski Date: Tue, 17 Jun 2025 16:06:35 -0300 Subject: [PATCH] feat(dynamic-secret): Add custom tags to AWS IAM dynamic secret --- .../20250617181915_add-dynamic-secret-tags.ts | 21 ++++++++++++++++ backend/src/db/schemas/dynamic-secrets.ts | 3 ++- .../src/ee/routes/v1/dynamic-secret-router.ts | 2 ++ .../dynamic-secret-lease-service.ts | 1 + .../dynamic-secret/dynamic-secret-service.ts | 8 +++++-- .../dynamic-secret/dynamic-secret-types.ts | 2 ++ .../dynamic-secret/providers/aws-iam.ts | 15 ++++++++++-- .../dynamic-secret/providers/models.ts | 1 + frontend/src/hooks/api/dynamicSecret/types.ts | 4 ++++ .../AwsIamInputForm.tsx | 17 +++++++++---- .../EditDynamicSecretAwsIamForm.tsx | 16 ++++++++++--- .../DynamicSecretListView/MetadataForm.tsx | 24 ++++++++++++++----- 12 files changed, 96 insertions(+), 18 deletions(-) create mode 100644 backend/src/db/migrations/20250617181915_add-dynamic-secret-tags.ts diff --git a/backend/src/db/migrations/20250617181915_add-dynamic-secret-tags.ts b/backend/src/db/migrations/20250617181915_add-dynamic-secret-tags.ts new file mode 100644 index 000000000..d11a98028 --- /dev/null +++ b/backend/src/db/migrations/20250617181915_add-dynamic-secret-tags.ts @@ -0,0 +1,21 @@ +import { Knex } from "knex"; + +import { TableName } from "../schemas"; + +export async function up(knex: Knex): Promise { + const hasCol = await knex.schema.hasColumn(TableName.DynamicSecret, "tags"); + if (!hasCol) { + await knex.schema.alterTable(TableName.DynamicSecret, (t) => { + t.jsonb("tags").nullable(); + }); + } +} + +export async function down(knex: Knex): Promise { + const hasCol = await knex.schema.hasColumn(TableName.DynamicSecret, "tags"); + if (hasCol) { + await knex.schema.alterTable(TableName.DynamicSecret, (t) => { + t.dropColumn("tags"); + }); + } +} diff --git a/backend/src/db/schemas/dynamic-secrets.ts b/backend/src/db/schemas/dynamic-secrets.ts index 637d0c632..2720aa729 100644 --- a/backend/src/db/schemas/dynamic-secrets.ts +++ b/backend/src/db/schemas/dynamic-secrets.ts @@ -29,7 +29,8 @@ export const DynamicSecretsSchema = z.object({ encryptedInput: zodBuffer, projectGatewayId: z.string().uuid().nullable().optional(), gatewayId: z.string().uuid().nullable().optional(), - usernameTemplate: z.string().nullable().optional() + usernameTemplate: z.string().nullable().optional(), + tags: z.unknown().nullable().optional() }); export type TDynamicSecrets = z.infer; diff --git a/backend/src/ee/routes/v1/dynamic-secret-router.ts b/backend/src/ee/routes/v1/dynamic-secret-router.ts index b916bab67..e931d4f82 100644 --- a/backend/src/ee/routes/v1/dynamic-secret-router.ts +++ b/backend/src/ee/routes/v1/dynamic-secret-router.ts @@ -80,6 +80,7 @@ export const registerDynamicSecretRouter = async (server: FastifyZodProvider) => environmentSlug: z.string().describe(DYNAMIC_SECRETS.CREATE.environmentSlug).min(1), name: slugSchema({ min: 1, max: 64, field: "Name" }).describe(DYNAMIC_SECRETS.CREATE.name), metadata: ResourceMetadataSchema.optional(), + tags: ResourceMetadataSchema.optional(), usernameTemplate: userTemplateSchema.optional() }), response: { @@ -146,6 +147,7 @@ export const registerDynamicSecretRouter = async (server: FastifyZodProvider) => .nullable(), newName: z.string().describe(DYNAMIC_SECRETS.UPDATE.newName).optional(), metadata: ResourceMetadataSchema.optional(), + tags: ResourceMetadataSchema.optional(), usernameTemplate: userTemplateSchema.nullable().optional() }) }), diff --git a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts index 168b16c5f..90d3c9603 100644 --- a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts +++ b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts @@ -166,6 +166,7 @@ export const dynamicSecretLeaseServiceFactory = ({ usernameTemplate: dynamicSecretCfg.usernameTemplate, identity, metadata: { projectId }, + tags: dynamicSecretCfg.tags as Record[] | undefined, config }); } catch (error: unknown) { diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts index 5a7da6a3e..a46ef1c9c 100644 --- a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts +++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts @@ -79,6 +79,7 @@ export const dynamicSecretServiceFactory = ({ defaultTTL, actorAuthMethod, metadata, + tags, usernameTemplate }: TCreateDynamicSecretDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); @@ -165,7 +166,8 @@ export const dynamicSecretServiceFactory = ({ folderId: folder.id, name, gatewayId: selectedGatewayId, - usernameTemplate + usernameTemplate, + tags: JSON.stringify(tags) }, tx ); @@ -202,6 +204,7 @@ export const dynamicSecretServiceFactory = ({ actorOrgId, actorAuthMethod, metadata, + tags, usernameTemplate }: TUpdateDynamicSecretDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); @@ -315,7 +318,8 @@ export const dynamicSecretServiceFactory = ({ name: newName ?? name, status: null, gatewayId: selectedGatewayId, - usernameTemplate + usernameTemplate, + tags: JSON.stringify(tags) }, tx ); diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-types.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-types.ts index 6720cf2c8..e8fa010b1 100644 --- a/backend/src/ee/services/dynamic-secret/dynamic-secret-types.ts +++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-types.ts @@ -23,6 +23,7 @@ export type TCreateDynamicSecretDTO = { projectSlug: string; metadata?: ResourceMetadataDTO; usernameTemplate?: string | null; + tags?: ResourceMetadataDTO; } & Omit; export type TUpdateDynamicSecretDTO = { @@ -35,6 +36,7 @@ export type TUpdateDynamicSecretDTO = { inputs?: TProvider["inputs"]; projectSlug: string; metadata?: ResourceMetadataDTO; + tags?: ResourceMetadataDTO; usernameTemplate?: string | null; } & Omit; diff --git a/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts b/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts index f7383d4ac..12a9558c9 100644 --- a/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts +++ b/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts @@ -119,20 +119,31 @@ export const AwsIamProvider = (): TDynamicProviderFns => { identity?: { name: string; }; + tags?: Record[]; metadata: { projectId: string }; }) => { - const { inputs, usernameTemplate, metadata, identity } = data; + const { inputs, usernameTemplate, metadata, identity, tags } = data; const providerInputs = await validateProviderInputs(inputs); const client = await $getClient(providerInputs, metadata.projectId); const username = generateUsername(usernameTemplate, identity); const { policyArns, userGroups, policyDocument, awsPath, permissionBoundaryPolicyArn } = providerInputs; + const awsTags = [{ Key: "createdBy", Value: "infisical-dynamic-secret" }]; + + if (tags && Array.isArray(tags)) { + const additionalTags = tags.map((tag) => ({ + Key: tag.key, + Value: tag.value + })); + awsTags.push(...additionalTags); + } + const createUserRes = await client.send( new CreateUserCommand({ Path: awsPath, PermissionsBoundary: permissionBoundaryPolicyArn || undefined, - Tags: [{ Key: "createdBy", Value: "infisical-dynamic-secret" }], + Tags: awsTags, UserName: username }) ); diff --git a/backend/src/ee/services/dynamic-secret/providers/models.ts b/backend/src/ee/services/dynamic-secret/providers/models.ts index 8f361e166..c86361583 100644 --- a/backend/src/ee/services/dynamic-secret/providers/models.ts +++ b/backend/src/ee/services/dynamic-secret/providers/models.ts @@ -525,6 +525,7 @@ export type TDynamicProviderFns = { name: string; }; metadata: { projectId: string }; + tags?: Record[]; config?: TDynamicSecretLeaseConfig; }) => Promise<{ entityId: string; data: unknown }>; validateConnection: (inputs: unknown, metadata: { projectId: string }) => Promise; diff --git a/frontend/src/hooks/api/dynamicSecret/types.ts b/frontend/src/hooks/api/dynamicSecret/types.ts index e8d80e632..a569e94ba 100644 --- a/frontend/src/hooks/api/dynamicSecret/types.ts +++ b/frontend/src/hooks/api/dynamicSecret/types.ts @@ -15,6 +15,7 @@ export type TDynamicSecret = { maxTTL: string; usernameTemplate?: string | null; metadata?: { key: string; value: string }[]; + tags?: { key: string; value: string }[]; }; export enum DynamicSecretProviders { @@ -89,6 +90,7 @@ export type TDynamicSecretProvider = } | { type: DynamicSecretProviders.AwsIam; + tags?: { key: string; value: string }[]; inputs: | { method: DynamicSecretAwsIamAuth.AccessKey; @@ -345,6 +347,7 @@ export type TCreateDynamicSecretDTO = { name: string; metadata?: { key: string; value: string }[]; usernameTemplate?: string; + tags?: { key: string; value: string }[]; }; export type TUpdateDynamicSecretDTO = { @@ -359,6 +362,7 @@ export type TUpdateDynamicSecretDTO = { maxTTL?: string | null; inputs?: unknown; usernameTemplate?: string | null; + tags?: { key: string; value: string }[]; }; }; diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AwsIamInputForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AwsIamInputForm.tsx index 80c80ee61..60bfa6304 100644 --- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AwsIamInputForm.tsx +++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AwsIamInputForm.tsx @@ -21,6 +21,8 @@ import { } from "@app/hooks/api/dynamicSecret/types"; import { WorkspaceEnv } from "@app/hooks/api/types"; +import { MetadataForm } from "../../DynamicSecretListView/MetadataForm"; + const formSchema = z.object({ provider: z.discriminatedUnion("method", [ z.object({ @@ -67,7 +69,10 @@ const formSchema = z.object({ }), name: z.string().refine((val) => val.toLowerCase() === val, "Must be lowercase"), environment: z.object({ name: z.string(), slug: z.string() }), - usernameTemplate: z.string().nullable().optional() + usernameTemplate: z.string().nullable().optional(), + tags: z + .array(z.object({ key: z.string().trim().min(1), value: z.string().trim().min(1) })) + .optional() }); type TForm = z.infer; @@ -100,7 +105,8 @@ export const AwsIamInputForm = ({ usernameTemplate: "{{randomUsername}}", provider: { method: DynamicSecretAwsIamAuth.AssumeRole - } + }, + tags: [] } }); @@ -113,7 +119,8 @@ export const AwsIamInputForm = ({ provider, defaultTTL, environment, - usernameTemplate + usernameTemplate, + tags }: TForm) => { // wait till previous request is finished if (createDynamicSecret.isPending) return; @@ -129,7 +136,8 @@ export const AwsIamInputForm = ({ projectSlug, environmentSlug: environment.slug, usernameTemplate: - !usernameTemplate || isDefaultUsernameTemplate ? undefined : usernameTemplate + !usernameTemplate || isDefaultUsernameTemplate ? undefined : usernameTemplate, + tags }); onCompleted(); } catch { @@ -398,6 +406,7 @@ export const AwsIamInputForm = ({ )} /> + {!isSingleEnvironmentMode && ( ; @@ -89,7 +94,8 @@ export const EditDynamicSecretAwsIamForm = ({ usernameTemplate: dynamicSecret?.usernameTemplate || "{{randomUsername}}", inputs: { ...(dynamicSecret.inputs as TForm["inputs"]) - } + }, + tags: dynamicSecret.tags } }); const isAccessKeyMethod = watch("inputs.method") === DynamicSecretAwsIamAuth.AccessKey; @@ -101,7 +107,8 @@ export const EditDynamicSecretAwsIamForm = ({ maxTTL, defaultTTL, newName, - usernameTemplate + usernameTemplate, + tags }: TForm) => { // wait till previous request is finished if (updateDynamicSecret.isPending) return; @@ -117,7 +124,9 @@ export const EditDynamicSecretAwsIamForm = ({ defaultTTL, inputs, newName: newName === dynamicSecret.name ? undefined : newName, - usernameTemplate: !usernameTemplate || isDefaultUsernameTemplate ? null : usernameTemplate + usernameTemplate: + !usernameTemplate || isDefaultUsernameTemplate ? null : usernameTemplate, + tags } }); onClose(); @@ -380,6 +389,7 @@ export const EditDynamicSecretAwsIamForm = ({ )} /> +
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/MetadataForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/MetadataForm.tsx index 986ba9e46..c7ca96b14 100644 --- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/MetadataForm.tsx +++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/MetadataForm.tsx @@ -4,14 +4,22 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; import { FormControl, FormLabel, IconButton, Input } from "@app/components/v2"; -export const MetadataForm = ({ control }: { control: Control }) => { +export const MetadataForm = ({ + control, + name = "metadata", + isValueRequired = false +}: { + control: Control; + name?: string; + isValueRequired?: boolean; +}) => { const metadataFormFields = useFieldArray({ control, - name: "metadata" + name }); return ( - +
{metadataFormFields.fields.map(({ id: metadataFieldId }, i) => (
@@ -19,7 +27,7 @@ export const MetadataForm = ({ control }: { control: Control }) => { {i === 0 && Key} ( }) => {
{i === 0 && ( - + )} (