feat(aws-iam-rotation): add credentials validation

backend/src/ee/services/secret-rotation-v2/aws-iam-user-secret/aws-iam-user-secret-rotation-fns.ts

@@ -11,7 +11,21 @@ import {
   TRotationFactoryRevokeCredentials,
   TRotationFactoryRotateCredentials
 } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-types";
-import { getAwsConnectionConfig } from "@app/services/app-connection/aws";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  AwsConnectionMethod,
+  getAwsConnectionConfig,
+  validateAwsConnectionCredentials
+} from "@app/services/app-connection/aws";
+
+const sleep = async () =>
+  new Promise((resolve) => {
+    setTimeout(resolve, 10000);
+  });
+
+const getCreateDate = (key: AWS.IAM.AccessKeyMetadata): number => {
+  return key.CreateDate ? new Date(key.CreateDate).getTime() : 0;
+};
 
 export const awsIamUserSecretRotationFactory: TRotationFactory<
   TAwsIamUserSecretRotationWithConnection,
@@ -30,35 +44,37 @@ export const awsIamUserSecretRotationFactory: TRotationFactory<
     const { AccessKeyMetadata } = await iam.listAccessKeys({ UserName: userName }).promise();
 
     if (AccessKeyMetadata && AccessKeyMetadata.length > 0) {
-      // Delete inactive keys
+      // Sort keys by creation date (oldest first)
-      await Promise.all(
+      const sortedKeys = [...AccessKeyMetadata].sort((a, b) => getCreateDate(a) - getCreateDate(b));
-        AccessKeyMetadata.map((key) => {
-          if (key.Status === "Inactive" && key.AccessKeyId) {
-            return iam
-              .deleteAccessKey({
-                UserName: userName,
-                AccessKeyId: key.AccessKeyId
-              })
-              .promise();
-          }
-          return Promise.resolve();
-        })
-      );
 
-      const activeKey = AccessKeyMetadata.find((k) => k.Status === "Active");
+      // If we already have 2 keys, delete the oldest one
-      if (activeKey && activeKey.AccessKeyId) {
+      if (sortedKeys.length >= 2) {
-        await iam
+        const accessId = sortedKeys[0].AccessKeyId || sortedKeys[1].AccessKeyId;
-          .updateAccessKey({
+        if (accessId) {
-            UserName: userName,
+          await iam
-            AccessKeyId: activeKey.AccessKeyId,
+            .deleteAccessKey({
-            Status: "Inactive"
+              UserName: userName,
-          })
+              AccessKeyId: accessId
-          .promise();
+            })
+            .promise();
+        }
       }
     }
 
     const { AccessKey } = await iam.createAccessKey({ UserName: userName }).promise();
 
+    await sleep();
+
+    await validateAwsConnectionCredentials({
+      app: AppConnection.AWS,
+      orgId: connection.orgId,
+      method: AwsConnectionMethod.AccessKey,
+      credentials: {
+        accessKeyId: AccessKey.AccessKeyId,
+        secretAccessKey: AccessKey.SecretAccessKey
+      }
+    });
+
     return {
       accessKeyId: AccessKey.AccessKeyId,
       secretAccessKey: AccessKey.SecretAccessKey