PR fix suggestions for aws secret rotations

This commit is contained in:
carlosmonastyrski
2025-04-22 17:40:15 -03:00
parent b85809293c
commit 5819b8c576
15 changed files with 66 additions and 48 deletions
@@ -8,7 +8,7 @@ export const AWS_IAM_USER_SECRET_ROTATION_LIST_OPTION: TSecretRotationV2ListItem
connection: AppConnection.AWS,
template: {
secretsMapping: {
accessKeyId: "AWS_ACCESS_KEY",
accessKeyId: "AWS_ACCESS_KEY_ID",
secretAccessKey: "AWS_SECRET_ACCESS_KEY"
}
}
@@ -18,7 +18,7 @@ export const awsIamUserSecretRotationFactory: TRotationFactory<
TAwsIamUserSecretRotationGeneratedCredentials
> = (secretRotation) => {
const {
parameters: { region, clientName },
parameters: { region, userName },
connection,
secretsMapping
} = secretRotation;
@@ -27,26 +27,29 @@ export const awsIamUserSecretRotationFactory: TRotationFactory<
const { credentials } = await getAwsConnectionConfig(connection, region);
const iam = new AWS.IAM({ credentials });
const { AccessKeyMetadata } = await iam.listAccessKeys({ UserName: clientName }).promise();
const { AccessKeyMetadata } = await iam.listAccessKeys({ UserName: userName }).promise();
if (AccessKeyMetadata && AccessKeyMetadata.length > 0) {
for (const key of AccessKeyMetadata) {
if (key.Status === "Inactive" && key.AccessKeyId) {
// eslint-disable-next-line no-await-in-loop
await iam
.deleteAccessKey({
UserName: clientName,
AccessKeyId: key.AccessKeyId
})
.promise();
}
}
// Delete inactive keys
await Promise.all(
AccessKeyMetadata.map((key) => {
if (key.Status === "Inactive" && key.AccessKeyId) {
return iam
.deleteAccessKey({
UserName: userName,
AccessKeyId: key.AccessKeyId
})
.promise();
}
return Promise.resolve();
})
);
const activeKey = AccessKeyMetadata.find((k) => k.Status === "Active");
if (activeKey && activeKey.AccessKeyId) {
await iam
.updateAccessKey({
UserName: clientName,
UserName: userName,
AccessKeyId: activeKey.AccessKeyId,
Status: "Inactive"
})
@@ -54,7 +57,7 @@ export const awsIamUserSecretRotationFactory: TRotationFactory<
}
}
const { AccessKey } = await iam.createAccessKey({ UserName: clientName }).promise();
const { AccessKey } = await iam.createAccessKey({ UserName: userName }).promise();
return {
accessKeyId: AccessKey.AccessKeyId,
@@ -77,15 +80,16 @@ export const awsIamUserSecretRotationFactory: TRotationFactory<
const { credentials } = await getAwsConnectionConfig(connection, region);
const iam = new AWS.IAM({ credentials });
for (const generatedCredential of generatedCredentials) {
// eslint-disable-next-line no-await-in-loop
await iam
.deleteAccessKey({
UserName: clientName,
AccessKeyId: generatedCredential.accessKeyId
})
.promise();
}
await Promise.all(
generatedCredentials.map((generatedCredential) =>
iam
.deleteAccessKey({
UserName: userName,
AccessKeyId: generatedCredential.accessKeyId
})
.promise()
)
);
return callback();
};
@@ -20,11 +20,11 @@ export const AwsIamUserSecretRotationGeneratedCredentialsSchema = z
.max(2);
const AwsIamUserSecretRotationParametersSchema = z.object({
clientName: z
userName: z
.string()
.trim()
.min(1, "Client Name Required")
.describe(SecretRotations.PARAMETERS.AWS_IAM_USER_SECRET.clientName),
.describe(SecretRotations.PARAMETERS.AWS_IAM_USER_SECRET.userName),
region: z.nativeEnum(AWSRegion).describe(SecretRotations.PARAMETERS.AWS_IAM_USER_SECRET.region)
});
@@ -3,7 +3,7 @@ import { AppConnection } from "@app/services/app-connection/app-connection-enums
export const SECRET_ROTATION_NAME_MAP: Record<SecretRotation, string> = {
[SecretRotation.PostgresCredentials]: "PostgreSQL Credentials",
[SecretRotation.MsSqlCredentials]: "Microsoft SQL Sever Credentials",
[SecretRotation.MsSqlCredentials]: "Microsoft SQL Server Credentials",
[SecretRotation.Auth0ClientSecret]: "Auth0 Client Secret",
[SecretRotation.AwsIamUserSecret]: "AWS IAM User Secret"
};