mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-15 06:35:21 +00:00
PR fix suggestions for aws secret rotations
This commit is contained in:
+1
-1
@@ -8,7 +8,7 @@ export const AWS_IAM_USER_SECRET_ROTATION_LIST_OPTION: TSecretRotationV2ListItem
|
||||
connection: AppConnection.AWS,
|
||||
template: {
|
||||
secretsMapping: {
|
||||
accessKeyId: "AWS_ACCESS_KEY",
|
||||
accessKeyId: "AWS_ACCESS_KEY_ID",
|
||||
secretAccessKey: "AWS_SECRET_ACCESS_KEY"
|
||||
}
|
||||
}
|
||||
|
||||
+28
-24
@@ -18,7 +18,7 @@ export const awsIamUserSecretRotationFactory: TRotationFactory<
|
||||
TAwsIamUserSecretRotationGeneratedCredentials
|
||||
> = (secretRotation) => {
|
||||
const {
|
||||
parameters: { region, clientName },
|
||||
parameters: { region, userName },
|
||||
connection,
|
||||
secretsMapping
|
||||
} = secretRotation;
|
||||
@@ -27,26 +27,29 @@ export const awsIamUserSecretRotationFactory: TRotationFactory<
|
||||
const { credentials } = await getAwsConnectionConfig(connection, region);
|
||||
const iam = new AWS.IAM({ credentials });
|
||||
|
||||
const { AccessKeyMetadata } = await iam.listAccessKeys({ UserName: clientName }).promise();
|
||||
const { AccessKeyMetadata } = await iam.listAccessKeys({ UserName: userName }).promise();
|
||||
|
||||
if (AccessKeyMetadata && AccessKeyMetadata.length > 0) {
|
||||
for (const key of AccessKeyMetadata) {
|
||||
if (key.Status === "Inactive" && key.AccessKeyId) {
|
||||
// eslint-disable-next-line no-await-in-loop
|
||||
await iam
|
||||
.deleteAccessKey({
|
||||
UserName: clientName,
|
||||
AccessKeyId: key.AccessKeyId
|
||||
})
|
||||
.promise();
|
||||
}
|
||||
}
|
||||
// Delete inactive keys
|
||||
await Promise.all(
|
||||
AccessKeyMetadata.map((key) => {
|
||||
if (key.Status === "Inactive" && key.AccessKeyId) {
|
||||
return iam
|
||||
.deleteAccessKey({
|
||||
UserName: userName,
|
||||
AccessKeyId: key.AccessKeyId
|
||||
})
|
||||
.promise();
|
||||
}
|
||||
return Promise.resolve();
|
||||
})
|
||||
);
|
||||
|
||||
const activeKey = AccessKeyMetadata.find((k) => k.Status === "Active");
|
||||
if (activeKey && activeKey.AccessKeyId) {
|
||||
await iam
|
||||
.updateAccessKey({
|
||||
UserName: clientName,
|
||||
UserName: userName,
|
||||
AccessKeyId: activeKey.AccessKeyId,
|
||||
Status: "Inactive"
|
||||
})
|
||||
@@ -54,7 +57,7 @@ export const awsIamUserSecretRotationFactory: TRotationFactory<
|
||||
}
|
||||
}
|
||||
|
||||
const { AccessKey } = await iam.createAccessKey({ UserName: clientName }).promise();
|
||||
const { AccessKey } = await iam.createAccessKey({ UserName: userName }).promise();
|
||||
|
||||
return {
|
||||
accessKeyId: AccessKey.AccessKeyId,
|
||||
@@ -77,15 +80,16 @@ export const awsIamUserSecretRotationFactory: TRotationFactory<
|
||||
const { credentials } = await getAwsConnectionConfig(connection, region);
|
||||
const iam = new AWS.IAM({ credentials });
|
||||
|
||||
for (const generatedCredential of generatedCredentials) {
|
||||
// eslint-disable-next-line no-await-in-loop
|
||||
await iam
|
||||
.deleteAccessKey({
|
||||
UserName: clientName,
|
||||
AccessKeyId: generatedCredential.accessKeyId
|
||||
})
|
||||
.promise();
|
||||
}
|
||||
await Promise.all(
|
||||
generatedCredentials.map((generatedCredential) =>
|
||||
iam
|
||||
.deleteAccessKey({
|
||||
UserName: userName,
|
||||
AccessKeyId: generatedCredential.accessKeyId
|
||||
})
|
||||
.promise()
|
||||
)
|
||||
);
|
||||
|
||||
return callback();
|
||||
};
|
||||
|
||||
+2
-2
@@ -20,11 +20,11 @@ export const AwsIamUserSecretRotationGeneratedCredentialsSchema = z
|
||||
.max(2);
|
||||
|
||||
const AwsIamUserSecretRotationParametersSchema = z.object({
|
||||
clientName: z
|
||||
userName: z
|
||||
.string()
|
||||
.trim()
|
||||
.min(1, "Client Name Required")
|
||||
.describe(SecretRotations.PARAMETERS.AWS_IAM_USER_SECRET.clientName),
|
||||
.describe(SecretRotations.PARAMETERS.AWS_IAM_USER_SECRET.userName),
|
||||
region: z.nativeEnum(AWSRegion).describe(SecretRotations.PARAMETERS.AWS_IAM_USER_SECRET.region)
|
||||
});
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@ import { AppConnection } from "@app/services/app-connection/app-connection-enums
|
||||
|
||||
export const SECRET_ROTATION_NAME_MAP: Record<SecretRotation, string> = {
|
||||
[SecretRotation.PostgresCredentials]: "PostgreSQL Credentials",
|
||||
[SecretRotation.MsSqlCredentials]: "Microsoft SQL Sever Credentials",
|
||||
[SecretRotation.MsSqlCredentials]: "Microsoft SQL Server Credentials",
|
||||
[SecretRotation.Auth0ClientSecret]: "Auth0 Client Secret",
|
||||
[SecretRotation.AwsIamUserSecret]: "AWS IAM User Secret"
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user