Fix: AWS ElastiCache support

backend/package.json

@@ -106,10 +106,13 @@
     "vitest": "^1.2.2"
   },
   "dependencies": {
+    "@aws-crypto/sha256-js": "^5.2.0",
+    "@aws-sdk/client-elasticache": "^3.637.0",
     "@aws-sdk/client-iam": "^3.525.0",
     "@aws-sdk/client-kms": "^3.609.0",
     "@aws-sdk/client-secrets-manager": "^3.504.0",
     "@aws-sdk/client-sts": "^3.600.0",
+    "@aws-sdk/types": "^3.609.0",
     "@casl/ability": "^6.5.0",
     "@fastify/cookie": "^9.3.1",
     "@fastify/cors": "^8.5.0",
@@ -129,6 +132,8 @@
     "@peculiar/x509": "^1.12.1",
     "@serdnam/pino-cloudwatch-transport": "^1.0.4",
     "@sindresorhus/slugify": "1.1.0",
+    "@smithy/protocol-http": "^4.1.0",
+    "@smithy/signature-v4": "^4.1.0",
     "@team-plain/typescript-sdk": "^4.6.1",
     "@ucast/mongo2js": "^1.3.4",
     "ajv": "^8.12.0",

backend/src/ee/services/dynamic-secret/providers/models.ts

@@ -7,16 +7,51 @@ export enum SqlProviders {
   MsSQL = "mssql"
 }
 
-export const DynamicSecretRedisDBSchema = z.object({
+export enum RedisProviders {
-  host: z.string().trim().toLowerCase(),
+  Redis = "redis",
-  port: z.number(),
+  Elasticache = "elasticache"
-  username: z.string().trim(), // this is often "default".
+}
-  password: z.string().trim().optional(), // only required if requirepass is set.
+
-  creationStatement: z.string().trim(),
+export const DynamicSecretRedisDBSchema = z
-  revocationStatement: z.string().trim(),
+  .object({
-  renewStatement: z.string().trim().optional(),
+    client: z.nativeEnum(RedisProviders),
-  ca: z.string().optional()
+    host: z.string().trim().toLowerCase(),
-});
+    port: z.number(),
+    username: z.string().trim(), // this is often "default".
+    password: z.string().trim().optional(),
+
+    elastiCacheIamUsername: z.string().trim().optional(),
+    elastiCacheRegion: z.string().trim().optional(),
+
+    creationStatement: z.string().trim(),
+    revocationStatement: z.string().trim(),
+    renewStatement: z.string().trim().optional(),
+    ca: z.string().optional()
+  })
+  .refine(
+    (data) => {
+      if (data.client === RedisProviders.Elasticache) {
+        return !!data.elastiCacheIamUsername;
+      }
+      return true;
+    },
+    {
+      message: "elastiCacheIamUsername is required when client is ElastiCache",
+      path: ["elastiCacheIamUsername"]
+    }
+  )
+  .refine(
+    (data) => {
+      if (data.client === RedisProviders.Elasticache) {
+        return !!data.elastiCacheRegion;
+      }
+      return true;
+    },
+    {
+      message: "elastiCacheRegion is required when client is ElastiCache",
+      path: ["elastiCacheRegion"]
+    }
+  );
 
 export const DynamicSecretSqlDBSchema = z.object({
   client: z.nativeEnum(SqlProviders),

backend/src/ee/services/dynamic-secret/providers/redis.ts

@@ -4,19 +4,25 @@ import { Redis } from "ioredis";
 import { customAlphabet } from "nanoid";
 import { z } from "zod";
 
+import { CreateElastiCacheUserSchema, ElastiCacheConnector, ElastiCacheUserManager } from "@app/lib/aws";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError } from "@app/lib/errors";
 import { getDbConnectionHost } from "@app/lib/knex";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 
-import { DynamicSecretRedisDBSchema, TDynamicProviderFns } from "./models";
+import { DynamicSecretRedisDBSchema, RedisProviders, TDynamicProviderFns } from "./models";
 
 const generatePassword = () => {
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.~!*$#";
   return customAlphabet(charset, 64)();
 };
 
-const generateUsername = () => {
+const generateUsername = (provider: RedisProviders) => {
+  if (provider === RedisProviders.Elasticache) {
+    const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-";
+    return `inf-${customAlphabet(charset, 32)()}`; // Username must start with an ascii letter, so we prepend the username with "inf-"
+  }
+
   return alphaNumericNanoId(32);
 };
 
@@ -54,9 +60,22 @@ export const RedisDatabaseProvider = (): TDynamicProviderFns => {
   const validateProviderInputs = async (inputs: unknown) => {
     const appCfg = getConfig();
     const isCloud = Boolean(appCfg.LICENSE_SERVER_KEY); // quick and dirty way to check if its cloud or not
-    const dbHost = appCfg.DB_HOST || getDbConnectionHost(appCfg.DB_CONNECTION_URI);
+    const dbHost = appCfg.REDIS_URL || getDbConnectionHost(appCfg.REDIS_URL);
+
+    const providerInputs = DynamicSecretRedisDBSchema.parse(inputs);
+
+    if (providerInputs.client === RedisProviders.Elasticache) {
+      JSON.parse(providerInputs.creationStatement);
+      JSON.parse(providerInputs.revocationStatement);
+      if (providerInputs.renewStatement) {
+        JSON.parse(providerInputs.renewStatement);
+      }
+
+      if (!providerInputs.elastiCacheRegion) {
+        throw new BadRequestError({ message: "elastiCacheRegion is required when client is ElastiCache" });
+      }
+    }
 
-    const providerInputs = await DynamicSecretRedisDBSchema.parseAsync(inputs);
     if (
       isCloud &&
       // localhost
@@ -66,36 +85,62 @@ export const RedisDatabaseProvider = (): TDynamicProviderFns => {
         providerInputs.host.match(/^192\.168\.\d+\.\d+/))
     )
       throw new BadRequestError({ message: "Invalid db host" });
-    if (providerInputs.host === "localhost" || providerInputs.host === "127.0.0.1" || dbHost === providerInputs.host)
+    if (providerInputs.host === "localhost" || dbHost === providerInputs.host)
       throw new BadRequestError({ message: "Invalid db host" });
     return providerInputs;
   };
 
   const getClient = async (providerInputs: z.infer<typeof DynamicSecretRedisDBSchema>) => {
     let connection: Redis | null = null;
-    try {
-      connection = new Redis({
-        username: providerInputs.username,
-        host: providerInputs.host,
-        port: providerInputs.port,
-        password: providerInputs.password,
-        ...(providerInputs.ca && {
-          tls: {
-            rejectUnauthorized: false,
-            ca: providerInputs.ca
-          }
-        })
-      });
 
-      let result: string;
+    try {
-      if (providerInputs.password) {
+      if (providerInputs.client === RedisProviders.Elasticache) {
-        result = await connection.auth(providerInputs.username, providerInputs.password, () => {});
+        const connectionUri = await ElastiCacheConnector(
-      } else {
+          {
-        result = await connection.auth(providerInputs.username, () => {});
+            host: providerInputs.host,
+            port: providerInputs.port,
+            userId: providerInputs.elastiCacheIamUsername!
+          },
+          {
+            accessKeyId: providerInputs.username,
+            secretAccessKey: providerInputs.password!
+          },
+          providerInputs.elastiCacheRegion!
+        ).createConnectionUri();
+
+        connection = new Redis(connectionUri, {
+          ...(providerInputs.ca && {
+            tls: {
+              rejectUnauthorized: false,
+              ca: providerInputs.ca
+            }
+          })
+        });
+      } else if (providerInputs.client === RedisProviders.Redis) {
+        connection = new Redis({
+          username: providerInputs.username,
+          host: providerInputs.host,
+          port: providerInputs.port,
+          password: providerInputs.password || undefined,
+          ...(providerInputs.ca && {
+            tls: {
+              rejectUnauthorized: false,
+              ca: providerInputs.ca
+            }
+          })
+        });
       }
 
-      if (result !== "OK") {
+      if (connection === null) {
-        throw new BadRequestError({ message: `Invalid credentials, Redis returned ${result} status` });
+        throw new BadRequestError({ message: "Failed to obtain a valid Redis client" });
+      }
+
+      let result: string;
+      if (providerInputs.password && providerInputs.client === RedisProviders.Redis) {
+        result = await connection.auth(providerInputs.username, providerInputs.password, () => {});
+        if (result !== "OK") {
+          throw new BadRequestError({ message: `Invalid credentials, Redis returned ${result} status` });
+        }
       }
 
       return connection;
@@ -119,25 +164,54 @@ export const RedisDatabaseProvider = (): TDynamicProviderFns => {
   };
 
   const create = async (inputs: unknown, expireAt: number) => {
+    console.log(inputs);
     const providerInputs = await validateProviderInputs(inputs);
     const connection = await getClient(providerInputs);
 
-    const username = generateUsername();
+    const leaseUsername = generateUsername(providerInputs.client);
-    const password = generatePassword();
+    const leasePassword = generatePassword();
-    const expiration = new Date(expireAt).toISOString();
+    const leaseExpiration = new Date(expireAt).toISOString();
 
-    const creationStatement = handlebars.compile(providerInputs.creationStatement, { noEscape: true })({
+    if (providerInputs.client === RedisProviders.Redis) {
-      username,
+      const creationStatement = handlebars.compile(providerInputs.creationStatement, { noEscape: true })({
-      password,
+        username: leaseUsername,
-      expiration
+        password: leasePassword,
-    });
+        expiration: leaseExpiration
+      });
+      const queries = creationStatement.toString().split(";").filter(Boolean);
 
-    const queries = creationStatement.toString().split(";").filter(Boolean);
+      await executeTransactions(connection, queries);
 
-    await executeTransactions(connection, queries);
+      await connection.quit();
+      return { entityId: leaseUsername, data: { DB_USERNAME: leaseUsername, DB_PASSWORD: leasePassword } };
+    }
+    if (providerInputs.client === RedisProviders.Elasticache) {
+      const parsedCreationData = CreateElastiCacheUserSchema.parse(JSON.parse(providerInputs.creationStatement));
 
-    await connection.quit();
+      await ElastiCacheUserManager(
-    return { entityId: username, data: { DB_USERNAME: username, DB_PASSWORD: password } };
+        {
+          accessKeyId: providerInputs.username,
+          secretAccessKey: providerInputs.password!
+        },
+        providerInputs.elastiCacheRegion!
+      ).createUser({
+        AccessString: parsedCreationData.AccessString,
+        Engine: parsedCreationData.Engine,
+        UserId: leaseUsername,
+        UserName: leaseUsername,
+        Passwords: [leasePassword]
+      });
+
+      return {
+        entityId: leaseUsername,
+        data: {
+          DB_USERNAME: leaseUsername,
+          DB_PASSWORD: leasePassword
+        }
+      };
+    }
+
+    throw new BadRequestError({ message: "Invalid client type" });
   };
 
   const revoke = async (inputs: unknown, entityId: string) => {

backend/src/ee/services/license/licence-fns.ts

@@ -17,7 +17,7 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   environmentsUsed: 0,
   identityLimit: null,
   identitiesUsed: 0,
-  dynamicSecret: false,
+  dynamicSecret: true,
   secretVersioning: true,
   pitRecovery: false,
   ipAllowlisting: false,

backend/src/lib/aws/elasticache.ts

@@ -0,0 +1,208 @@
+import { Sha256 } from "@aws-crypto/sha256-js";
+import {
+  CreateUserCommand,
+  CreateUserGroupCommand,
+  DeleteUserCommand,
+  DescribeReplicationGroupsCommand,
+  DescribeUserGroupsCommand,
+  ElastiCache,
+  ModifyReplicationGroupCommand,
+  ModifyUserGroupCommand
+} from "@aws-sdk/client-elasticache";
+import { QueryParameterBag } from "@aws-sdk/types";
+import { HttpRequest } from "@smithy/protocol-http";
+import { SignatureV4 } from "@smithy/signature-v4";
+import { z } from "zod";
+
+type TElastiCacheRedisUser = {
+  userId: string;
+  password: string;
+};
+
+type TBasicAWSCredentials = { accessKeyId: string; secretAccessKey: string };
+type TElastiCacheConnection = {
+  host: string;
+  port: number;
+  userId: string; // the redis user configured for IAM auth
+};
+
+export const CreateElastiCacheUserSchema = z.object({
+  UserId: z.string().trim().min(1),
+  UserName: z.string().trim().min(1),
+  Engine: z.string().default("redis"),
+  Passwords: z.array(z.string().trim().min(1)).min(1).max(1), // Minimum password length is 16 characters, required by AWS.
+  AccessString: z.string().trim().min(1) // Example: "on ~* +@all"
+});
+
+export const DeleteElasticCacheUserSchema = z.object({
+  UserId: z.string().trim().min(1)
+});
+
+export type TCreateElastiCacheUserInput = z.infer<typeof CreateElastiCacheUserSchema>;
+export type TDeleteElastiCacheUserInput = z.infer<typeof DeleteElasticCacheUserSchema>;
+
+export const ElastiCacheUserManager = (credentials: TBasicAWSCredentials, region: string) => {
+  const elastiCache = new ElastiCache({
+    region,
+    credentials
+  });
+  const infisicalGroup = "infisical-managed-group-elasticache";
+
+  const ensureInfisicalGroupExists = async (clusterName: string) => {
+    const replicationGroups = await elastiCache.send(new DescribeUserGroupsCommand());
+
+    const existingGroup = replicationGroups.UserGroups?.find((group) => group.UserGroupId === infisicalGroup);
+
+    let newlyCreatedGroup = false;
+    if (!existingGroup) {
+      const createGroupCommand = new CreateUserGroupCommand({
+        UserGroupId: infisicalGroup,
+        UserIds: ["default"],
+        Engine: "redis"
+      });
+
+      await elastiCache.send(createGroupCommand);
+      newlyCreatedGroup = true;
+    }
+
+    if (existingGroup || newlyCreatedGroup) {
+      const replicationGroup = (
+        await elastiCache.send(
+          new DescribeReplicationGroupsCommand({
+            ReplicationGroupId: clusterName
+          })
+        )
+      ).ReplicationGroups?.[0];
+
+      if (!replicationGroup?.UserGroupIds?.includes(infisicalGroup)) {
+        // If the replication group doesn't have the infisical user group, we need to associate it
+        const modifyGroupCommand = new ModifyReplicationGroupCommand({
+          UserGroupIdsToAdd: [infisicalGroup],
+          UserGroupIdsToRemove: [],
+          ApplyImmediately: true,
+          ReplicationGroupId: clusterName
+        });
+        await elastiCache.send(modifyGroupCommand);
+      }
+    }
+  };
+
+  const addUserToInfisicalGroup = async (userId: string) => {
+    // figure out if the default user is already in the group, if it is, then we shouldn't add it again
+
+    const addUserToGroupCommand = new ModifyUserGroupCommand({
+      UserGroupId: infisicalGroup,
+      UserIdsToAdd: [userId],
+      UserIdsToRemove: []
+    });
+
+    await elastiCache.send(addUserToGroupCommand);
+  };
+
+  const createUser = async (creationInput: TCreateElastiCacheUserInput) => {
+    await ensureInfisicalGroupExists("newtest-redis-oss"); // TODO: Make this not hardcoded (currently hardcoded for testing)
+
+    await elastiCache.send(new CreateUserCommand({ ...creationInput })); // First create the user
+    await addUserToInfisicalGroup(creationInput.UserId); // Then add the user to the group. We know the group is already a part of the cluster because of ensureInfisicalGroupExists()
+
+    return {
+      userId: creationInput.UserId,
+      password: creationInput.Passwords[0]
+    };
+  };
+
+  const deleteUser = async (
+    deletionInput: TDeleteElastiCacheUserInput
+  ): Promise<Pick<TElastiCacheRedisUser, "userId">> => {
+    await elastiCache.send(new DeleteUserCommand(deletionInput));
+    return { userId: deletionInput.UserId };
+  };
+
+  return {
+    createUser,
+    deleteUser
+  };
+};
+
+export const ElastiCacheConnector = (
+  connection: TElastiCacheConnection,
+  credentials: TBasicAWSCredentials,
+  region: string,
+  isServerless = false
+) => {
+  const constants = {
+    REQUEST_METHOD: "GET",
+    PARAM_ACTION: "Action",
+    PARAM_USER: "User",
+    PARAM_RESOURCE_TYPE: "ResourceType",
+    RESOURCE_TYPE_SERVERLESS_CACHE: "ServerlessCache",
+    ACTION_NAME: "connect",
+    SERVICE_NAME: "elasticache",
+    TOKEN_EXPIRY_SECONDS: 900
+  };
+
+  const getSignableRequest = () => {
+    const query: Record<string, string> = {
+      [constants.PARAM_ACTION]: constants.ACTION_NAME,
+      [constants.PARAM_USER]: connection.userId
+    };
+
+    if (isServerless) {
+      query[constants.PARAM_RESOURCE_TYPE] = constants.RESOURCE_TYPE_SERVERLESS_CACHE;
+    }
+
+    return new HttpRequest({
+      method: constants.REQUEST_METHOD,
+      hostname: `${connection.host}:${connection.port}`,
+      headers: {
+        host: `${connection.host}:${connection.port}`
+      },
+      path: "/",
+      query
+    });
+  };
+
+  const sign = async (request: HttpRequest) => {
+    const signer = new SignatureV4({
+      credentials,
+      region,
+      service: constants.SERVICE_NAME,
+      sha256: Sha256
+    });
+
+    const expiresIn = constants.TOKEN_EXPIRY_SECONDS;
+    const signedRequest = await signer.presign(request, { expiresIn });
+
+    // Create a new HttpRequest object with the signed properties
+    return new HttpRequest({
+      method: signedRequest.method,
+      hostname: signedRequest.hostname,
+      headers: signedRequest.headers,
+      path: signedRequest.path,
+      query: signedRequest.query
+    });
+  };
+
+  const queryToString = (query: QueryParameterBag) => {
+    return Object.entries(query)
+      .map(([key, value]) => {
+        if (Array.isArray(value)) {
+          return value.map((v) => `${encodeURIComponent(key)}=${encodeURIComponent(v)}`).join("&");
+        }
+        if (value !== null) {
+          return `${encodeURIComponent(key)}=${encodeURIComponent(value)}`;
+        }
+        return encodeURIComponent(key);
+      })
+      .join("&");
+  };
+
+  const createConnectionUri = async () => {
+    const request = getSignableRequest();
+    const signedRequest = await sign(request);
+
+    return `redis://${signedRequest.hostname}${signedRequest.path}?${queryToString(signedRequest.query)}`;
+  };
+
+  return { createConnectionUri };
+};

backend/src/lib/aws/index.ts

@@ -0,0 +1 @@
+export * from "./elasticache";

frontend/src/hooks/api/dynamicSecret/types.ts

@@ -29,6 +29,11 @@ export enum SqlProviders {
   MsSQL = "mssql"
 }
 
+export enum RedisProviders {
+  Redis = "redis",
+  Elasticache = "elasticache"
+}
+
 export type TDynamicSecretProvider =
   | {
       type: DynamicSecretProviders.SqlDatabase;

frontend/src/views/SecretMainPage/components/ActionBar/CreateDynamicSecretForm/RedisInputForm.tsx

@@ -1,3 +1,4 @@
+import { useEffect } from "react";
 import { Controller, useForm } from "react-hook-form";
 import { zodResolver } from "@hookform/resolvers/zod";
 import ms from "ms";
@@ -14,22 +15,54 @@ import {
   FormControl,
   Input,
   SecretInput,
+  Select,
+  SelectItem,
   TextArea
 } from "@app/components/v2";
 import { useCreateDynamicSecret } from "@app/hooks/api";
-import { DynamicSecretProviders } from "@app/hooks/api/dynamicSecret/types";
+import { DynamicSecretProviders, RedisProviders } from "@app/hooks/api/dynamicSecret/types";
 
 const formSchema = z.object({
-  provider: z.object({
+  provider: z
-    host: z.string().toLowerCase().min(1),
+    .object({
-    port: z.coerce.number(),
+      client: z.nativeEnum(RedisProviders),
-    username: z.string().min(1),
+      host: z.string().toLowerCase().min(1),
-    password: z.string().min(1).optional(),
+      port: z.coerce.number(),
-    creationStatement: z.string().min(1),
+      username: z.string().min(1), // In case of Elasticache, this is accessKeyId
-    renewStatement: z.string().optional(),
+      password: z.string().min(1).optional(), // In case of Elasticache, this is secretAccessKey
-    revocationStatement: z.string().min(1),
+
-    ca: z.string().optional()
+      elastiCacheIamUsername: z.string().trim().optional(),
-  }),
+      elastiCacheRegion: z.string().trim().optional(),
+
+      creationStatement: z.string().min(1),
+      renewStatement: z.string().optional(),
+      revocationStatement: z.string().min(1),
+      ca: z.string().optional()
+    })
+    .refine(
+      (data) => {
+        if (data.client === RedisProviders.Elasticache) {
+          return !!data.elastiCacheIamUsername;
+        }
+        return true;
+      },
+      {
+        message: "elastiCacheIamUsername is required when client is ElastiCache",
+        path: ["elastiCacheIamUsername"]
+      }
+    )
+    .refine(
+      (data) => {
+        if (data.client === RedisProviders.Elasticache) {
+          return !!data.elastiCacheRegion;
+        }
+        return true;
+      },
+      {
+        message: "AWS region is required when using ElastiCache",
+        path: ["elastiCacheRegion"]
+      }
+    ),
   defaultTTL: z.string().superRefine((val, ctx) => {
     const valMs = ms(val);
     if (valMs < 60 * 1000)
@@ -72,14 +105,15 @@ export const RedisInputForm = ({
   const {
     control,
     formState: { isSubmitting },
-    handleSubmit
+    handleSubmit,
+    setValue,
+    watch
   } = useForm<TForm>({
     resolver: zodResolver(formSchema),
     defaultValues: {
       provider: {
-        username: "default",
+        client: RedisProviders.Redis,
-        creationStatement: "ACL SETUSER {{username}} on >{{password}} ~* &* +@all",
+        username: "default"
-        revocationStatement: "ACL DELUSER {{username}}"
       }
     }
   });
@@ -108,6 +142,52 @@ export const RedisInputForm = ({
     }
   };
 
+  const getRedisStatements = (type: RedisProviders) => {
+    const defaultRedisStatements = {
+      creationStatement: "ACL SETUSER {{username}} on >{{password}} ~* &* +@all",
+      revocationStatement: "ACL DELUSER {{username}}",
+      renewStatement: ""
+    };
+
+    if (type === RedisProviders.Redis) {
+      return defaultRedisStatements;
+    }
+    if (type === RedisProviders.Elasticache) {
+      return {
+        creationStatement: `{
+        "UserId": "{{username}}",
+        "UserName": "{{username}}",
+        "Engine": "redis",
+        "Passwords": ["{{password}}"],
+        "AccessString": "on ~* +@all"
+}`,
+        revocationStatement: `{
+        "UserId": "{{username}}"
+}`,
+        renewStatement: ""
+      };
+    }
+
+    return defaultRedisStatements;
+  };
+
+  const selectedProvider = watch("provider.client");
+
+  const handleDatabaseChange = (type: RedisProviders) => {
+    const redisStatement = getRedisStatements(type);
+    setValue("provider.creationStatement", redisStatement.creationStatement);
+    setValue("provider.renewStatement", redisStatement.renewStatement);
+    setValue("provider.revocationStatement", redisStatement.revocationStatement);
+
+    if (type === RedisProviders.Elasticache) {
+      setValue("provider.username", "");
+    }
+  };
+
+  useEffect(() => {
+    handleDatabaseChange(selectedProvider);
+  }, []);
+
   return (
     <div>
       <form onSubmit={handleSubmit(handleCreateDynamicSecret)} autoComplete="off">
@@ -167,45 +247,89 @@ export const RedisInputForm = ({
               Configuration
             </div>
             <div className="flex flex-col">
-              <div className="flex items-center space-x-2">
+              <div className="flex w-full items-center gap-2">
                 <Controller
                   control={control}
-                  name="provider.host"
+                  name="provider.client"
-                  defaultValue=""
+                  defaultValue={RedisProviders.Redis}
-                  render={({ field, fieldState: { error } }) => (
+                  render={({ field: { value, onChange }, fieldState: { error } }) => (
                     <FormControl
-                      label="Host"
+                      label="Service"
-                      className="flex-grow"
+                      className="w-full"
                       isError={Boolean(error?.message)}
                       errorText={error?.message}
                     >
-                      <Input {...field} />
+                      <Select
-                    </FormControl>
+                        value={value}
-                  )}
+                        onValueChange={(val) => {
-                />
+                          onChange(val);
-                <Controller
+                          handleDatabaseChange(val as RedisProviders);
-                  control={control}
+                        }}
-                  name="provider.port"
+                        className="w-full border border-mineshaft-500"
-                  defaultValue={5432}
+                      >
-                  render={({ field, fieldState: { error } }) => (
+                        <SelectItem value={RedisProviders.Redis}>Redis</SelectItem>
-                    <FormControl
+                        <SelectItem value={RedisProviders.Elasticache}>AWS ElastiCache</SelectItem>
-                      label="Port"
+                      </Select>
-                      isError={Boolean(error?.message)}
-                      errorText={error?.message}
-                    >
-                      <Input {...field} type="number" />
                     </FormControl>
                   )}
                 />
+                {selectedProvider === RedisProviders.Elasticache && (
+                  <Controller
+                    control={control}
+                    name="provider.elastiCacheRegion"
+                    defaultValue=""
+                    render={({ field, fieldState: { error } }) => (
+                      <FormControl
+                        label="AWS Region"
+                        className="w-full"
+                        isError={Boolean(error?.message)}
+                        errorText={error?.message}
+                      >
+                        <Input {...field} placeholder="us-east-1" />
+                      </FormControl>
+                    )}
+                  />
+                )}
               </div>
-              <div className="flex items-center space-x-2">
+              <Controller
+                control={control}
+                name="provider.host"
+                defaultValue=""
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="Host"
+                    className="flex-grow"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                  >
+                    <Input {...field} />
+                  </FormControl>
+                )}
+              />
+              <Controller
+                control={control}
+                name="provider.port"
+                defaultValue={6379}
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="Port"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                  >
+                    <Input {...field} type="number" />
+                  </FormControl>
+                )}
+              />
+            </div>
+            {selectedProvider === RedisProviders.Elasticache && (
+              <div className="flex w-full">
                 <Controller
                   control={control}
-                  name="provider.username"
+                  name="provider.elastiCacheIamUsername"
-                  defaultValue=""
                   render={({ field, fieldState: { error } }) => (
                     <FormControl
-                      label="User"
+                      label="Redis Username"
+                      className="w-full"
                       isError={Boolean(error?.message)}
                       errorText={error?.message}
                     >
@@ -213,104 +337,132 @@ export const RedisInputForm = ({
                     </FormControl>
                   )}
                 />
-                <Controller
-                  control={control}
-                  name="provider.password"
-                  render={({ field, fieldState: { error } }) => (
-                    <FormControl
-                      tooltipText="Required if your Redis server is password protected."
-                      label="Password"
-                      isError={Boolean(error?.message)}
-                      errorText={error?.message}
-                    >
-                      <Input {...field} type="password" autoComplete="new-password" />
-                    </FormControl>
-                  )}
-                />
-              </div>
-              <div>
-                <Controller
-                  control={control}
-                  name="provider.ca"
-                  render={({ field, fieldState: { error } }) => (
-                    <FormControl
-                      isOptional
-                      label="CA(SSL)"
-                      isError={Boolean(error?.message)}
-                      errorText={error?.message}
-                    >
-                      <SecretInput
-                        {...field}
-                        containerClassName="text-bunker-300 hover:border-primary-400/50 border border-mineshaft-600 bg-mineshaft-900 px-2 py-1.5"
-                      />
-                    </FormControl>
-                  )}
-                />
-                <Accordion type="single" collapsible className="mb-2 w-full bg-mineshaft-700">
-                  <AccordionItem value="advance-statements">
-                    <AccordionTrigger>Modify Redis Statements</AccordionTrigger>
-                    <AccordionContent>
-                      <Controller
-                        control={control}
-                        name="provider.creationStatement"
-                        render={({ field, fieldState: { error } }) => (
-                          <FormControl
-                            label="Creation Statement"
-                            isError={Boolean(error?.message)}
-                            errorText={error?.message}
-                            helperText="username, password and expiration are dynamically provisioned"
-                          >
-                            <TextArea
-                              {...field}
-                              reSize="none"
-                              rows={3}
-                              className="border-mineshaft-600 bg-mineshaft-900 text-sm"
-                            />
-                          </FormControl>
-                        )}
-                      />
-                      <Controller
-                        control={control}
-                        name="provider.revocationStatement"
-                        render={({ field, fieldState: { error } }) => (
-                          <FormControl
-                            label="Revocation Statement"
-                            isError={Boolean(error?.message)}
-                            errorText={error?.message}
-                            helperText="username is dynamically provisioned"
-                          >
-                            <TextArea
-                              {...field}
-                              reSize="none"
-                              rows={3}
-                              className="border-mineshaft-600 bg-mineshaft-900 text-sm"
-                            />
-                          </FormControl>
-                        )}
-                      />
-                      <Controller
-                        control={control}
-                        name="provider.renewStatement"
-                        render={({ field, fieldState: { error } }) => (
-                          <FormControl
-                            label="Renew Statement"
-                            helperText="username and expiration are dynamically provisioned"
-                            isError={Boolean(error?.message)}
-                            errorText={error?.message}
-                          >
-                            <TextArea
-                              {...field}
-                              reSize="none"
-                              rows={3}
-                              className="border-mineshaft-600 bg-mineshaft-900 text-sm"
-                            />
-                          </FormControl>
-                        )}
-                      />
-                    </AccordionContent>
-                  </AccordionItem>
-                </Accordion>
               </div>
+            )}
+            <div className="flex space-x-2">
+              <Controller
+                control={control}
+                name="provider.username"
+                defaultValue=""
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label={
+                      selectedProvider === RedisProviders.Elasticache ? "Access Key ID" : "Username"
+                    }
+                    className="w-full"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                  >
+                    <Input {...field} autoComplete="off" />
+                  </FormControl>
+                )}
+              />
+              <Controller
+                control={control}
+                name="provider.password"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    className="w-full"
+                    tooltipText={
+                      selectedProvider === RedisProviders.Redis
+                        ? "Required if your Redis server is password protected."
+                        : undefined
+                    }
+                    label={
+                      selectedProvider === RedisProviders.Elasticache
+                        ? "Secret Access Key"
+                        : "Username"
+                    }
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                  >
+                    <Input {...field} type="password" autoComplete="new-password" />
+                  </FormControl>
+                )}
+              />
+            </div>
+            <div>
+              <Controller
+                control={control}
+                name="provider.ca"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    isOptional
+                    label="CA(SSL)"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                  >
+                    <SecretInput
+                      {...field}
+                      containerClassName="text-bunker-300 hover:border-primary-400/50 border border-mineshaft-600 bg-mineshaft-900 px-2 py-1.5"
+                    />
+                  </FormControl>
+                )}
+              />
+              <Accordion type="single" collapsible className="mb-2 w-full bg-mineshaft-700">
+                <AccordionItem value="advance-statements">
+                  <AccordionTrigger>Modify Redis Statements</AccordionTrigger>
+                  <AccordionContent>
+                    <Controller
+                      control={control}
+                      name="provider.creationStatement"
+                      render={({ field, fieldState: { error } }) => (
+                        <FormControl
+                          label="Creation Statement"
+                          isError={Boolean(error?.message)}
+                          errorText={error?.message}
+                          helperText="username, password and expiration are dynamically provisioned"
+                        >
+                          <TextArea
+                            {...field}
+                            reSize="none"
+                            rows={3}
+                            className="border-mineshaft-600 bg-mineshaft-900 text-sm"
+                          />
+                        </FormControl>
+                      )}
+                    />
+                    <Controller
+                      control={control}
+                      name="provider.revocationStatement"
+                      render={({ field, fieldState: { error } }) => (
+                        <FormControl
+                          label="Revocation Statement"
+                          isError={Boolean(error?.message)}
+                          errorText={error?.message}
+                          helperText="username is dynamically provisioned"
+                        >
+                          <TextArea
+                            {...field}
+                            reSize="none"
+                            rows={3}
+                            className="border-mineshaft-600 bg-mineshaft-900 text-sm"
+                          />
+                        </FormControl>
+                      )}
+                    />
+                    <Controller
+                      control={control}
+                      name="provider.renewStatement"
+                      render={({ field, fieldState: { error } }) => (
+                        <FormControl
+                          label="Renew Statement"
+                          helperText="username and expiration are dynamically provisioned"
+                          isError={Boolean(error?.message)}
+                          errorText={error?.message}
+                        >
+                          <TextArea
+                            {...field}
+                            reSize="none"
+                            rows={3}
+                            className="border-mineshaft-600 bg-mineshaft-900 text-sm"
+                          />
+                        </FormControl>
+                      )}
+                    />
+                  </AccordionContent>
+                </AccordionItem>
+              </Accordion>
             </div>
           </div>
         </div>

frontend/src/views/SecretMainPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretForm.tsx

@@ -6,6 +6,7 @@ import { DynamicSecretProviders } from "@app/hooks/api/dynamicSecret/types";
 
 import { EditDynamicSecretAwsIamForm } from "./EditDynamicSecretAwsIamForm";
 import { EditDynamicSecretCassandraForm } from "./EditDynamicSecretCassandraForm";
+import { EditDynamicSecretRedisProviderForm } from "./EditDynamicSecretRedisProviderForm";
 import { EditDynamicSecretSqlProviderForm } from "./EditDynamicSecretSqlProviderForm";
 
 type Props = {
@@ -92,6 +93,23 @@ export const EditDynamicSecretForm = ({
           />
         </motion.div>
       )}
+      {dynamicSecretDetails?.type === DynamicSecretProviders.Redis && (
+        <motion.div
+          key="redis-provider-edit"
+          transition={{ duration: 0.1 }}
+          initial={{ opacity: 0, translateX: 30 }}
+          animate={{ opacity: 1, translateX: 0 }}
+          exit={{ opacity: 0, translateX: -30 }}
+        >
+          <EditDynamicSecretRedisProviderForm
+            onClose={onClose}
+            projectSlug={projectSlug}
+            secretPath={secretPath}
+            dynamicSecret={dynamicSecretDetails}
+            environment={environment}
+          />
+        </motion.div>
+      )}
     </AnimatePresence>
   );
 };

frontend/src/views/SecretMainPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretRedisProviderForm.tsx

@@ -0,0 +1,343 @@
+import { Controller, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import ms from "ms";
+import { z } from "zod";
+
+import { TtlFormLabel } from "@app/components/features";
+import { createNotification } from "@app/components/notifications";
+import {
+  Accordion,
+  AccordionContent,
+  AccordionItem,
+  AccordionTrigger,
+  Button,
+  FormControl,
+  Input,
+  SecretInput,
+  TextArea
+} from "@app/components/v2";
+import { useUpdateDynamicSecret } from "@app/hooks/api";
+import { TDynamicSecret } from "@app/hooks/api/dynamicSecret/types";
+
+const formSchema = z.object({
+  inputs: z
+    .object({
+      host: z.string().toLowerCase().min(1),
+      port: z.coerce.number(),
+      username: z.string().min(1),
+      password: z.string().min(1).optional(),
+      creationStatement: z.string().min(1),
+      renewStatement: z.string().optional(),
+      revocationStatement: z.string().min(1),
+      ca: z.string().optional()
+    })
+    .partial(),
+  defaultTTL: z.string().superRefine((val, ctx) => {
+    const valMs = ms(val);
+    if (valMs < 60 * 1000)
+      ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be a greater than 1min" });
+    // a day
+    if (valMs > 24 * 60 * 60 * 1000)
+      ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than a day" });
+  }),
+  maxTTL: z
+    .string()
+    .optional()
+    .superRefine((val, ctx) => {
+      if (!val) return;
+      const valMs = ms(val);
+      if (valMs < 60 * 1000)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be a greater than 1min" });
+      // a day
+      if (valMs > 24 * 60 * 60 * 1000)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than a day" });
+    })
+    .nullable(),
+  newName: z
+    .string()
+    .refine((val) => val.toLowerCase() === val, "Must be lowercase")
+    .optional()
+});
+type TForm = z.infer<typeof formSchema>;
+
+type Props = {
+  onClose: () => void;
+  dynamicSecret: TDynamicSecret & { inputs: unknown };
+  secretPath: string;
+  environment: string;
+  projectSlug: string;
+};
+
+export const EditDynamicSecretRedisProviderForm = ({
+  onClose,
+  dynamicSecret,
+  environment,
+  secretPath,
+  projectSlug
+}: Props) => {
+  const {
+    control,
+    formState: { isSubmitting },
+    handleSubmit
+  } = useForm<TForm>({
+    resolver: zodResolver(formSchema),
+    values: {
+      defaultTTL: dynamicSecret.defaultTTL,
+      maxTTL: dynamicSecret.maxTTL,
+      newName: dynamicSecret.name,
+      inputs: {
+        ...(dynamicSecret.inputs as TForm["inputs"])
+      }
+    }
+  });
+
+  const updateDynamicSecret = useUpdateDynamicSecret();
+
+  const handleUpdateDynamicSecret = async ({ inputs, maxTTL, defaultTTL, newName }: TForm) => {
+    // wait till previous request is finished
+    if (updateDynamicSecret.isLoading) return;
+    try {
+      await updateDynamicSecret.mutateAsync({
+        name: dynamicSecret.name,
+        path: secretPath,
+        projectSlug,
+        environmentSlug: environment,
+        data: {
+          maxTTL: maxTTL || undefined,
+          defaultTTL,
+          inputs,
+          newName: newName === dynamicSecret.name ? undefined : newName
+        }
+      });
+      onClose();
+      createNotification({
+        type: "success",
+        text: "Successfully updated dynamic secret"
+      });
+    } catch (err) {
+      createNotification({
+        type: "error",
+        text: "Failed to update dynamic secret"
+      });
+    }
+  };
+
+  return (
+    <div>
+      <form onSubmit={handleSubmit(handleUpdateDynamicSecret)} autoComplete="off">
+        <div className="flex items-center space-x-2">
+          <div className="flex-grow">
+            <Controller
+              control={control}
+              name="newName"
+              render={({ field, fieldState: { error } }) => (
+                <FormControl
+                  label="Secret Name"
+                  isError={Boolean(error)}
+                  errorText={error?.message}
+                >
+                  <Input {...field} placeholder="DYN-1" />
+                </FormControl>
+              )}
+            />
+          </div>
+          <div className="w-32">
+            <Controller
+              control={control}
+              name="defaultTTL"
+              render={({ field, fieldState: { error } }) => (
+                <FormControl
+                  label={<TtlFormLabel label="Default TTL" />}
+                  isError={Boolean(error?.message)}
+                  errorText={error?.message}
+                >
+                  <Input {...field} />
+                </FormControl>
+              )}
+            />
+          </div>
+          <div className="w-32">
+            <Controller
+              control={control}
+              name="maxTTL"
+              render={({ field, fieldState: { error } }) => (
+                <FormControl
+                  label={<TtlFormLabel label="Max TTL" />}
+                  isError={Boolean(error?.message)}
+                  errorText={error?.message}
+                >
+                  <Input {...field} value={field.value || ""} />
+                </FormControl>
+              )}
+            />
+          </div>
+        </div>
+        <div>
+          <div className="mb-4 border-b border-b-mineshaft-600 pb-2">Configuration</div>
+          <div className="flex flex-col">
+            <div className="flex items-center space-x-2">
+              <Controller
+                control={control}
+                name="inputs.host"
+                defaultValue=""
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="Host"
+                    className="flex-grow"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                  >
+                    <Input {...field} />
+                  </FormControl>
+                )}
+              />
+              <Controller
+                control={control}
+                name="inputs.port"
+                defaultValue={6379}
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="Port"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                  >
+                    <Input
+                      {...field}
+                      type="number"
+                      onChange={(el) => field.onChange(parseInt(el.target.value, 10))}
+                    />
+                  </FormControl>
+                )}
+              />
+            </div>
+            <div className="flex w-full space-x-2">
+              <Controller
+                control={control}
+                name="inputs.username"
+                defaultValue=""
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    className="w-full"
+                    label="User"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                  >
+                    <Input {...field} autoComplete="off" />
+                  </FormControl>
+                )}
+              />
+              <Controller
+                control={control}
+                name="inputs.password"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    className="w-full"
+                    label="Password"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                  >
+                    <Input {...field} type="password" autoComplete="new-password" />
+                  </FormControl>
+                )}
+              />
+            </div>
+            <div>
+              <Controller
+                control={control}
+                name="inputs.ca"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    isOptional
+                    label="CA(SSL)"
+                    isError={Boolean(error?.message)}
+                    errorText={error?.message}
+                  >
+                    <SecretInput
+                      {...field}
+                      containerClassName="text-bunker-300 hover:border-primary-400/50 border border-mineshaft-600 bg-mineshaft-900 px-2 py-1.5"
+                    />
+                  </FormControl>
+                )}
+              />
+              <Accordion type="multiple" className="w-full bg-mineshaft-700">
+                <AccordionItem value="modify-redis-statement">
+                  <AccordionTrigger>Modify Redis Statements</AccordionTrigger>
+                  <AccordionContent>
+                    <Controller
+                      control={control}
+                      name="inputs.creationStatement"
+                      defaultValue="ACL SETUSER {{username}} on >{{password}} ~* &* +@all"
+                      render={({ field, fieldState: { error } }) => (
+                        <FormControl
+                          label="Creation Statement"
+                          isError={Boolean(error?.message)}
+                          errorText={error?.message}
+                          helperText="username, password and expiration are dynamically provisioned"
+                        >
+                          <TextArea
+                            {...field}
+                            reSize="none"
+                            rows={3}
+                            className="border-mineshaft-600 bg-mineshaft-900 text-sm"
+                          />
+                        </FormControl>
+                      )}
+                    />
+                    <Controller
+                      control={control}
+                      name="inputs.revocationStatement"
+                      defaultValue="ACL DELUSER {{username}}"
+                      render={({ field, fieldState: { error } }) => (
+                        <FormControl
+                          label="Revocation Statement"
+                          isError={Boolean(error?.message)}
+                          errorText={error?.message}
+                          helperText="username is dynamically provisioned"
+                        >
+                          <TextArea
+                            {...field}
+                            reSize="none"
+                            rows={3}
+                            className="border-mineshaft-600 bg-mineshaft-900 text-sm"
+                          />
+                        </FormControl>
+                      )}
+                    />
+                    <Controller
+                      control={control}
+                      name="inputs.renewStatement"
+                      defaultValue=""
+                      render={({ field, fieldState: { error } }) => (
+                        <FormControl
+                          label="Renew Statement"
+                          helperText="username and expiration are dynamically provisioned"
+                          isError={Boolean(error?.message)}
+                          errorText={error?.message}
+                        >
+                          <TextArea
+                            {...field}
+                            reSize="none"
+                            rows={3}
+                            className="border-mineshaft-600 bg-mineshaft-900 text-sm"
+                          />
+                        </FormControl>
+                      )}
+                    />
+                  </AccordionContent>
+                </AccordionItem>
+              </Accordion>
+            </div>
+          </div>
+        </div>
+        <div className="mt-4 flex items-center space-x-4">
+          <Button type="submit" isLoading={isSubmitting}>
+            Save
+          </Button>
+          <Button variant="outline_bg" onClick={onClose}>
+            Cancel
+          </Button>
+        </div>
+      </form>
+    </div>
+  );
+};