Fix: AWS ElastiCache support

backend/package.json

@@ -106,10 +106,13 @@
     "vitest": "^1.2.2"
   },
   "dependencies": {
+    "@aws-crypto/sha256-js": "^5.2.0",
+    "@aws-sdk/client-elasticache": "^3.637.0",
     "@aws-sdk/client-iam": "^3.525.0",
     "@aws-sdk/client-kms": "^3.609.0",
     "@aws-sdk/client-secrets-manager": "^3.504.0",
     "@aws-sdk/client-sts": "^3.600.0",
+    "@aws-sdk/types": "^3.609.0",
     "@casl/ability": "^6.5.0",
     "@fastify/cookie": "^9.3.1",
     "@fastify/cors": "^8.5.0",
@@ -129,6 +132,8 @@
     "@peculiar/x509": "^1.12.1",
     "@serdnam/pino-cloudwatch-transport": "^1.0.4",
     "@sindresorhus/slugify": "1.1.0",
+    "@smithy/protocol-http": "^4.1.0",
+    "@smithy/signature-v4": "^4.1.0",
     "@team-plain/typescript-sdk": "^4.6.1",
     "@ucast/mongo2js": "^1.3.4",
     "ajv": "^8.12.0",

backend/src/ee/services/dynamic-secret/providers/models.ts

@@ -7,16 +7,51 @@ export enum SqlProviders {
   MsSQL = "mssql"
 }
 
-export const DynamicSecretRedisDBSchema = z.object({
-  host: z.string().trim().toLowerCase(),
-  port: z.number(),
-  username: z.string().trim(), // this is often "default".
-  password: z.string().trim().optional(), // only required if requirepass is set.
-  creationStatement: z.string().trim(),
-  revocationStatement: z.string().trim(),
-  renewStatement: z.string().trim().optional(),
-  ca: z.string().optional()
-});
+export enum RedisProviders {
+  Redis = "redis",
+  Elasticache = "elasticache"
+}
+
+export const DynamicSecretRedisDBSchema = z
+  .object({
+    client: z.nativeEnum(RedisProviders),
+    host: z.string().trim().toLowerCase(),
+    port: z.number(),
+    username: z.string().trim(), // this is often "default".
+    password: z.string().trim().optional(),
+
+    elastiCacheIamUsername: z.string().trim().optional(),
+    elastiCacheRegion: z.string().trim().optional(),
+
+    creationStatement: z.string().trim(),
+    revocationStatement: z.string().trim(),
+    renewStatement: z.string().trim().optional(),
+    ca: z.string().optional()
+  })
+  .refine(
+    (data) => {
+      if (data.client === RedisProviders.Elasticache) {
+        return !!data.elastiCacheIamUsername;
+      }
+      return true;
+    },
+    {
+      message: "elastiCacheIamUsername is required when client is ElastiCache",
+      path: ["elastiCacheIamUsername"]
+    }
+  )
+  .refine(
+    (data) => {
+      if (data.client === RedisProviders.Elasticache) {
+        return !!data.elastiCacheRegion;
+      }
+      return true;
+    },
+    {
+      message: "elastiCacheRegion is required when client is ElastiCache",
+      path: ["elastiCacheRegion"]
+    }
+  );
 
 export const DynamicSecretSqlDBSchema = z.object({
   client: z.nativeEnum(SqlProviders),

backend/src/ee/services/dynamic-secret/providers/redis.ts

@@ -4,19 +4,25 @@ import { Redis } from "ioredis";
 import { customAlphabet } from "nanoid";
 import { z } from "zod";
 
+import { CreateElastiCacheUserSchema, ElastiCacheConnector, ElastiCacheUserManager } from "@app/lib/aws";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError } from "@app/lib/errors";
 import { getDbConnectionHost } from "@app/lib/knex";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 
-import { DynamicSecretRedisDBSchema, TDynamicProviderFns } from "./models";
+import { DynamicSecretRedisDBSchema, RedisProviders, TDynamicProviderFns } from "./models";
 
 const generatePassword = () => {
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.~!*$#";
   return customAlphabet(charset, 64)();
 };
 
-const generateUsername = () => {
+const generateUsername = (provider: RedisProviders) => {
+  if (provider === RedisProviders.Elasticache) {
+    const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-";
+    return `inf-${customAlphabet(charset, 32)()}`; // Username must start with an ascii letter, so we prepend the username with "inf-"
+  }
+
   return alphaNumericNanoId(32);
 };
 
@@ -54,9 +60,22 @@ export const RedisDatabaseProvider = (): TDynamicProviderFns => {
   const validateProviderInputs = async (inputs: unknown) => {
     const appCfg = getConfig();
     const isCloud = Boolean(appCfg.LICENSE_SERVER_KEY); // quick and dirty way to check if its cloud or not
-    const dbHost = appCfg.DB_HOST || getDbConnectionHost(appCfg.DB_CONNECTION_URI);
+    const dbHost = appCfg.REDIS_URL || getDbConnectionHost(appCfg.REDIS_URL);
+
+    const providerInputs = DynamicSecretRedisDBSchema.parse(inputs);
+
+    if (providerInputs.client === RedisProviders.Elasticache) {
+      JSON.parse(providerInputs.creationStatement);
+      JSON.parse(providerInputs.revocationStatement);
+      if (providerInputs.renewStatement) {
+        JSON.parse(providerInputs.renewStatement);
+      }
+
+      if (!providerInputs.elastiCacheRegion) {
+        throw new BadRequestError({ message: "elastiCacheRegion is required when client is ElastiCache" });
+      }
+    }
 
-    const providerInputs = await DynamicSecretRedisDBSchema.parseAsync(inputs);
     if (
       isCloud &&
       // localhost
@@ -66,36 +85,62 @@ export const RedisDatabaseProvider = (): TDynamicProviderFns => {
         providerInputs.host.match(/^192\.168\.\d+\.\d+/))
     )
       throw new BadRequestError({ message: "Invalid db host" });
-    if (providerInputs.host === "localhost" || providerInputs.host === "127.0.0.1" || dbHost === providerInputs.host)
+    if (providerInputs.host === "localhost" || dbHost === providerInputs.host)
       throw new BadRequestError({ message: "Invalid db host" });
     return providerInputs;
   };
 
   const getClient = async (providerInputs: z.infer<typeof DynamicSecretRedisDBSchema>) => {
     let connection: Redis | null = null;
-    try {
-      connection = new Redis({
-        username: providerInputs.username,
-        host: providerInputs.host,
-        port: providerInputs.port,
-        password: providerInputs.password,
-        ...(providerInputs.ca && {
-          tls: {
-            rejectUnauthorized: false,
-            ca: providerInputs.ca
-          }
-        })
-      });
 
-      let result: string;
-      if (providerInputs.password) {
-        result = await connection.auth(providerInputs.username, providerInputs.password, () => {});
-      } else {
-        result = await connection.auth(providerInputs.username, () => {});
+    try {
+      if (providerInputs.client === RedisProviders.Elasticache) {
+        const connectionUri = await ElastiCacheConnector(
+          {
+            host: providerInputs.host,
+            port: providerInputs.port,
+            userId: providerInputs.elastiCacheIamUsername!
+          },
+          {
+            accessKeyId: providerInputs.username,
+            secretAccessKey: providerInputs.password!
+          },
+          providerInputs.elastiCacheRegion!
+        ).createConnectionUri();
+
+        connection = new Redis(connectionUri, {
+          ...(providerInputs.ca && {
+            tls: {
+              rejectUnauthorized: false,
+              ca: providerInputs.ca
+            }
+          })
+        });
+      } else if (providerInputs.client === RedisProviders.Redis) {
+        connection = new Redis({
+          username: providerInputs.username,
+          host: providerInputs.host,
+          port: providerInputs.port,
+          password: providerInputs.password || undefined,
+          ...(providerInputs.ca && {
+            tls: {
+              rejectUnauthorized: false,
+              ca: providerInputs.ca
+            }
+          })
+        });
       }
 
-      if (result !== "OK") {
-        throw new BadRequestError({ message: `Invalid credentials, Redis returned ${result} status` });
+      if (connection === null) {
+        throw new BadRequestError({ message: "Failed to obtain a valid Redis client" });
+      }
+
+      let result: string;
+      if (providerInputs.password && providerInputs.client === RedisProviders.Redis) {
+        result = await connection.auth(providerInputs.username, providerInputs.password, () => {});
+        if (result !== "OK") {
+          throw new BadRequestError({ message: `Invalid credentials, Redis returned ${result} status` });
+        }
       }
 
       return connection;
@@ -119,25 +164,54 @@ export const RedisDatabaseProvider = (): TDynamicProviderFns => {
   };
 
   const create = async (inputs: unknown, expireAt: number) => {
+    console.log(inputs);
     const providerInputs = await validateProviderInputs(inputs);
     const connection = await getClient(providerInputs);
 
-    const username = generateUsername();
-    const password = generatePassword();
-    const expiration = new Date(expireAt).toISOString();
+    const leaseUsername = generateUsername(providerInputs.client);
+    const leasePassword = generatePassword();
+    const leaseExpiration = new Date(expireAt).toISOString();
 
-    const creationStatement = handlebars.compile(providerInputs.creationStatement, { noEscape: true })({
-      username,
-      password,
-      expiration
-    });
+    if (providerInputs.client === RedisProviders.Redis) {
+      const creationStatement = handlebars.compile(providerInputs.creationStatement, { noEscape: true })({
+        username: leaseUsername,
+        password: leasePassword,
+        expiration: leaseExpiration
+      });
+      const queries = creationStatement.toString().split(";").filter(Boolean);
 
-    const queries = creationStatement.toString().split(";").filter(Boolean);
+      await executeTransactions(connection, queries);
 
-    await executeTransactions(connection, queries);
+      await connection.quit();
+      return { entityId: leaseUsername, data: { DB_USERNAME: leaseUsername, DB_PASSWORD: leasePassword } };
+    }
+    if (providerInputs.client === RedisProviders.Elasticache) {
+      const parsedCreationData = CreateElastiCacheUserSchema.parse(JSON.parse(providerInputs.creationStatement));
 
-    await connection.quit();
-    return { entityId: username, data: { DB_USERNAME: username, DB_PASSWORD: password } };
+      await ElastiCacheUserManager(
+        {
+          accessKeyId: providerInputs.username,
+          secretAccessKey: providerInputs.password!
+        },
+        providerInputs.elastiCacheRegion!
+      ).createUser({
+        AccessString: parsedCreationData.AccessString,
+        Engine: parsedCreationData.Engine,
+        UserId: leaseUsername,
+        UserName: leaseUsername,
+        Passwords: [leasePassword]
+      });
+
+      return {
+        entityId: leaseUsername,
+        data: {
+          DB_USERNAME: leaseUsername,
+          DB_PASSWORD: leasePassword
+        }
+      };
+    }
+
+    throw new BadRequestError({ message: "Invalid client type" });
   };
 
   const revoke = async (inputs: unknown, entityId: string) => {

backend/src/ee/services/license/licence-fns.ts

@@ -17,7 +17,7 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   environmentsUsed: 0,
   identityLimit: null,
   identitiesUsed: 0,
-  dynamicSecret: false,
+  dynamicSecret: true,
   secretVersioning: true,
   pitRecovery: false,
   ipAllowlisting: false,

backend/src/lib/aws/elasticache.ts

@@ -0,0 +1,208 @@
+import { Sha256 } from "@aws-crypto/sha256-js";
+import {
+  CreateUserCommand,
+  CreateUserGroupCommand,
+  DeleteUserCommand,
+  DescribeReplicationGroupsCommand,
+  DescribeUserGroupsCommand,
+  ElastiCache,
+  ModifyReplicationGroupCommand,
+  ModifyUserGroupCommand
+} from "@aws-sdk/client-elasticache";
+import { QueryParameterBag } from "@aws-sdk/types";
+import { HttpRequest } from "@smithy/protocol-http";
+import { SignatureV4 } from "@smithy/signature-v4";
+import { z } from "zod";
+
+type TElastiCacheRedisUser = {
+  userId: string;
+  password: string;
+};
+
+type TBasicAWSCredentials = { accessKeyId: string; secretAccessKey: string };
+type TElastiCacheConnection = {
+  host: string;
+  port: number;
+  userId: string; // the redis user configured for IAM auth
+};
+
+export const CreateElastiCacheUserSchema = z.object({
+  UserId: z.string().trim().min(1),
+  UserName: z.string().trim().min(1),
+  Engine: z.string().default("redis"),
+  Passwords: z.array(z.string().trim().min(1)).min(1).max(1), // Minimum password length is 16 characters, required by AWS.
+  AccessString: z.string().trim().min(1) // Example: "on ~* +@all"
+});
+
+export const DeleteElasticCacheUserSchema = z.object({
+  UserId: z.string().trim().min(1)
+});
+
+export type TCreateElastiCacheUserInput = z.infer<typeof CreateElastiCacheUserSchema>;
+export type TDeleteElastiCacheUserInput = z.infer<typeof DeleteElasticCacheUserSchema>;
+
+export const ElastiCacheUserManager = (credentials: TBasicAWSCredentials, region: string) => {
+  const elastiCache = new ElastiCache({
+    region,
+    credentials
+  });
+  const infisicalGroup = "infisical-managed-group-elasticache";
+
+  const ensureInfisicalGroupExists = async (clusterName: string) => {
+    const replicationGroups = await elastiCache.send(new DescribeUserGroupsCommand());
+
+    const existingGroup = replicationGroups.UserGroups?.find((group) => group.UserGroupId === infisicalGroup);
+
+    let newlyCreatedGroup = false;
+    if (!existingGroup) {
+      const createGroupCommand = new CreateUserGroupCommand({
+        UserGroupId: infisicalGroup,
+        UserIds: ["default"],
+        Engine: "redis"
+      });
+
+      await elastiCache.send(createGroupCommand);
+      newlyCreatedGroup = true;
+    }
+
+    if (existingGroup || newlyCreatedGroup) {
+      const replicationGroup = (
+        await elastiCache.send(
+          new DescribeReplicationGroupsCommand({
+            ReplicationGroupId: clusterName
+          })
+        )
+      ).ReplicationGroups?.[0];
+
+      if (!replicationGroup?.UserGroupIds?.includes(infisicalGroup)) {
+        // If the replication group doesn't have the infisical user group, we need to associate it
+        const modifyGroupCommand = new ModifyReplicationGroupCommand({
+          UserGroupIdsToAdd: [infisicalGroup],
+          UserGroupIdsToRemove: [],
+          ApplyImmediately: true,
+          ReplicationGroupId: clusterName
+        });
+        await elastiCache.send(modifyGroupCommand);
+      }
+    }
+  };
+
+  const addUserToInfisicalGroup = async (userId: string) => {
+    // figure out if the default user is already in the group, if it is, then we shouldn't add it again
+
+    const addUserToGroupCommand = new ModifyUserGroupCommand({
+      UserGroupId: infisicalGroup,
+      UserIdsToAdd: [userId],
+      UserIdsToRemove: []
+    });
+
+    await elastiCache.send(addUserToGroupCommand);
+  };
+
+  const createUser = async (creationInput: TCreateElastiCacheUserInput) => {
+    await ensureInfisicalGroupExists("newtest-redis-oss"); // TODO: Make this not hardcoded (currently hardcoded for testing)
+
+    await elastiCache.send(new CreateUserCommand({ ...creationInput })); // First create the user
+    await addUserToInfisicalGroup(creationInput.UserId); // Then add the user to the group. We know the group is already a part of the cluster because of ensureInfisicalGroupExists()
+
+    return {
+      userId: creationInput.UserId,
+      password: creationInput.Passwords[0]
+    };
+  };
+
+  const deleteUser = async (
+    deletionInput: TDeleteElastiCacheUserInput
+  ): Promise<Pick<TElastiCacheRedisUser, "userId">> => {
+    await elastiCache.send(new DeleteUserCommand(deletionInput));
+    return { userId: deletionInput.UserId };
+  };
+
+  return {
+    createUser,
+    deleteUser
+  };
+};
+
+export const ElastiCacheConnector = (
+  connection: TElastiCacheConnection,
+  credentials: TBasicAWSCredentials,
+  region: string,
+  isServerless = false
+) => {
+  const constants = {
+    REQUEST_METHOD: "GET",
+    PARAM_ACTION: "Action",
+    PARAM_USER: "User",
+    PARAM_RESOURCE_TYPE: "ResourceType",
+    RESOURCE_TYPE_SERVERLESS_CACHE: "ServerlessCache",
+    ACTION_NAME: "connect",
+    SERVICE_NAME: "elasticache",
+    TOKEN_EXPIRY_SECONDS: 900
+  };
+
+  const getSignableRequest = () => {
+    const query: Record<string, string> = {
+      [constants.PARAM_ACTION]: constants.ACTION_NAME,
+      [constants.PARAM_USER]: connection.userId
+    };
+
+    if (isServerless) {
+      query[constants.PARAM_RESOURCE_TYPE] = constants.RESOURCE_TYPE_SERVERLESS_CACHE;
+    }
+
+    return new HttpRequest({
+      method: constants.REQUEST_METHOD,
+      hostname: `${connection.host}:${connection.port}`,
+      headers: {
+        host: `${connection.host}:${connection.port}`
+      },
+      path: "/",
+      query
+    });
+  };
+
+  const sign = async (request: HttpRequest) => {
+    const signer = new SignatureV4({
+      credentials,
+      region,
+      service: constants.SERVICE_NAME,
+      sha256: Sha256
+    });
+
+    const expiresIn = constants.TOKEN_EXPIRY_SECONDS;
+    const signedRequest = await signer.presign(request, { expiresIn });
+
+    // Create a new HttpRequest object with the signed properties
+    return new HttpRequest({
+      method: signedRequest.method,
+      hostname: signedRequest.hostname,
+      headers: signedRequest.headers,
+      path: signedRequest.path,
+      query: signedRequest.query
+    });
+  };
+
+  const queryToString = (query: QueryParameterBag) => {
+    return Object.entries(query)
+      .map(([key, value]) => {
+        if (Array.isArray(value)) {
+          return value.map((v) => `${encodeURIComponent(key)}=${encodeURIComponent(v)}`).join("&");
+        }
+        if (value !== null) {
+          return `${encodeURIComponent(key)}=${encodeURIComponent(value)}`;
+        }
+        return encodeURIComponent(key);
+      })
+      .join("&");
+  };
+
+  const createConnectionUri = async () => {
+    const request = getSignableRequest();
+    const signedRequest = await sign(request);
+
+    return `redis://${signedRequest.hostname}${signedRequest.path}?${queryToString(signedRequest.query)}`;
+  };
+
+  return { createConnectionUri };
+};

backend/src/lib/aws/index.ts

@@ -0,0 +1 @@
+export * from "./elasticache";