awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-09 22:28:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: added one to one support for aws SM integration

Browse Source
This commit is contained in:
Sheen Capadngan
2024-05-23 20:30:55 +08:00
parent 663f8abc51
commit de2a5b4255
8 changed files with 217 additions and 140 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/lib/api-docs/constants.ts
+1
View File
@@ -662,6 +662,7 @@ export const INTEGRATION = {
secretPrefix: "The prefix for the saved secret. Used by GCP.",
secretSuffix: "The suffix for the saved secret. Used by GCP.",
initialSyncBehavoir: "Type of syncing behavoir with the integration.",
mappingBehavior: "The mapping behavior of the integration.",
shouldAutoRedeploy: "Used by Render to trigger auto deploy.",
secretGCPLabel: "The label for GCP secrets.",
secretAWSTag: "The tags for AWS secrets.",
backend/src/server/routes/v1/integration-router.ts
+2
View File
@@ -49,6 +49,7 @@ export const registerIntegrationRouter = async (server: FastifyZodProvider) => {
secretPrefix: z.string().optional().describe(INTEGRATION.CREATE.metadata.secretPrefix),
secretSuffix: z.string().optional().describe(INTEGRATION.CREATE.metadata.secretSuffix),
initialSyncBehavior: z.string().optional().describe(INTEGRATION.CREATE.metadata.initialSyncBehavoir),
mappingBehavior: z.string().optional().describe(INTEGRATION.CREATE.metadata.mappingBehavior),
shouldAutoRedeploy: z.boolean().optional().describe(INTEGRATION.CREATE.metadata.shouldAutoRedeploy),
secretGCPLabel: z
.object({
@@ -160,6 +161,7 @@ export const registerIntegrationRouter = async (server: FastifyZodProvider) => {
secretPrefix: z.string().optional().describe(INTEGRATION.CREATE.metadata.secretPrefix),
secretSuffix: z.string().optional().describe(INTEGRATION.CREATE.metadata.secretSuffix),
initialSyncBehavior: z.string().optional().describe(INTEGRATION.CREATE.metadata.initialSyncBehavoir),
mappingBehavior: z.string().optional().describe(INTEGRATION.CREATE.metadata.mappingBehavior),
shouldAutoRedeploy: z.boolean().optional().describe(INTEGRATION.CREATE.metadata.shouldAutoRedeploy),
secretGCPLabel: z
.object({
backend/src/services/integration-auth/integration-list.ts
+5
View File
@@ -43,6 +43,11 @@ export enum IntegrationInitialSyncBehavior {
PREFER_SOURCE = "prefer-source"
}
export enum IntegrationMappingBehavior {
ONE_TO_ONE = "one-to-one",
MANY_TO_ONE = "many-to-one"
}
export enum IntegrationUrls {
// integration oauth endpoints
GCP_TOKEN_URL = "https://oauth2.googleapis.com/token",
backend/src/services/integration-auth/integration-sync-secret.ts
+30 -14
View File
@@ -30,7 +30,12 @@ import { BadRequestError } from "@app/lib/errors";
import { TCreateManySecretsRawFn, TUpdateManySecretsRawFn } from "@app/services/secret/secret-types";
import { TIntegrationDALFactory } from "../integration/integration-dal";
import { IntegrationInitialSyncBehavior, Integrations, IntegrationUrls } from "./integration-list";
import {
IntegrationInitialSyncBehavior,
IntegrationMappingBehavior,
Integrations,
IntegrationUrls
} from "./integration-list";
const getSecretKeyValuePair = (secrets: Record<string, { value: string | null; comment?: string } | null>) =>
Object.keys(secrets).reduce<Record<string, string | null | undefined>>((prev, key) => {
@@ -570,13 +575,11 @@ const syncSecretsAWSSecretManager = async ({
accessId: string | null;
accessToken: string;
}) => {
let secretsManager;
const secKeyVal = getSecretKeyValuePair(secrets);
const metadata = z.record(z.any()).parse(integration.metadata || {});
try {
if (!accessId) return;
secretsManager = new SecretsManagerClient({
const secretsManager = new SecretsManagerClient({
region: integration.region as string,
credentials: {
accessKeyId: accessId,
@@ -584,9 +587,11 @@ const syncSecretsAWSSecretManager = async ({
}
});
const processAwsSecret = async (secretId: string, keyValuePairs: Record<string, string | null | undefined>) => {
try {
const awsSecretManagerSecret = await secretsManager.send(
new GetSecretValueCommand({
SecretId: integration.app as string
SecretId: secretId
})
);
@@ -596,11 +601,11 @@ const syncSecretsAWSSecretManager = async ({
awsSecretManagerSecretObj = JSON.parse(awsSecretManagerSecret.SecretString);
}
if (!isEqual(awsSecretManagerSecretObj, secKeyVal)) {
if (!isEqual(awsSecretManagerSecretObj, keyValuePairs)) {
await secretsManager.send(
new UpdateSecretCommand({
SecretId: integration.app as string,
SecretString: JSON.stringify(secKeyVal)
SecretId: secretId,
SecretString: JSON.stringify(keyValuePairs)
})
);
}
@@ -611,7 +616,7 @@ const syncSecretsAWSSecretManager = async ({
const describedSecret = await secretsManager.send(
// requires secretsmanager:DescribeSecret policy
new DescribeSecretCommand({
SecretId: integration.app as string
SecretId: secretId
})
);
@@ -669,7 +674,7 @@ const syncSecretsAWSSecretManager = async ({
if (tagsToUpdate.length) {
await secretsManager.send(
new TagResourceCommand({
SecretId: integration.app as string,
SecretId: secretId,
Tags: tagsToUpdate
})
);
@@ -678,7 +683,7 @@ const syncSecretsAWSSecretManager = async ({
if (tagsToDelete.length) {
await secretsManager.send(
new UntagResourceCommand({
SecretId: integration.app as string,
SecretId: secretId,
TagKeys: tagsToDelete.map((tag) => tag.Key)
})
);
@@ -689,8 +694,8 @@ const syncSecretsAWSSecretManager = async ({
if (err instanceof ResourceNotFoundException && secretsManager) {
await secretsManager.send(
new CreateSecretCommand({
Name: integration.app as string,
SecretString: JSON.stringify(secKeyVal),
Name: secretId,
SecretString: JSON.stringify(keyValuePairs),
...(metadata.kmsKeyId && { KmsKeyId: metadata.kmsKeyId }),
Tags: metadata.secretAWSTag
? metadata.secretAWSTag.map((tag: { key: string; value: string }) => ({ Key: tag.key, Value: tag.value }))
@@ -701,6 +706,17 @@ const syncSecretsAWSSecretManager = async ({
}
};
if (metadata.mappingBehavior === IntegrationMappingBehavior.ONE_TO_ONE) {
for await (const [key, value] of Object.entries(secrets)) {
await processAwsSecret(key, {
[key]: value.value
});
}
} else {
await processAwsSecret(integration.app as string, getSecretKeyValuePair(secrets));
}
};
/**
* Sync/push [secrets] to Heroku app named [integration.app]
*/
frontend/src/hooks/api/integrations/queries.tsx
+1
View File
@@ -64,6 +64,7 @@ export const useCreateIntegration = () => {
secretSuffix?: string;
initialSyncBehavior?: string;
shouldAutoRedeploy?: boolean;
mappingBehavior?: string;
secretAWSTag?: {
key: string;
value: string;
frontend/src/hooks/api/integrations/types.ts
+6
View File
@@ -36,6 +36,7 @@ export type TIntegration = {
metadata?: {
secretSuffix?: string;
syncBehavior?: IntegrationSyncBehavior;
mappingBehavior?: IntegrationMappingBehavior;
scope: string;
org: string;
project: string;
@@ -48,3 +49,8 @@ export enum IntegrationSyncBehavior {
PREFER_TARGET = "prefer-target",
PREFER_SOURCE = "prefer-source"
}
export enum IntegrationMappingBehavior {
ONE_TO_ONE = "one-to-one",
MANY_TO_ONE = "many-to-one"
}
frontend/src/pages/integrations/aws-secret-manager/create.tsx
+42 -2
View File
@@ -15,6 +15,7 @@ import queryString from "query-string";
import { useCreateIntegration } from "@app/hooks/api";
import { useGetIntegrationAuthAwsKmsKeys } from "@app/hooks/api/integrationAuth/queries";
import { IntegrationMappingBehavior } from "@app/hooks/api/integrations/types";
import {
Button,
@@ -70,6 +71,17 @@ const awsRegions = [
{ name: "AWS GovCloud (US-West)", slug: "us-gov-west-1" }
];
const mappingBehaviors = [
{
label: "Many to One - secrets will be mapped to one AWS Secret",
value: IntegrationMappingBehavior.MANY_TO_ONE
},
{
label: "One to One - secrets will be mapped to individual AWS secrets",
value: IntegrationMappingBehavior.ONE_TO_ONE
}
];
export default function AWSSecretManagerCreateIntegrationPage() {
const router = useRouter();
const { mutateAsync } = useCreateIntegration();
@@ -84,6 +96,9 @@ export default function AWSSecretManagerCreateIntegrationPage() {
const [selectedSourceEnvironment, setSelectedSourceEnvironment] = useState("");
const [secretPath, setSecretPath] = useState("/");
const [selectedAWSRegion, setSelectedAWSRegion] = useState("");
const [selectedMappingBehavior, setSelectedMappingBehavior] = useState(
IntegrationMappingBehavior.MANY_TO_ONE
);
const [targetSecretName, setTargetSecretName] = useState("");
const [targetSecretNameErrorText, setTargetSecretNameErrorText] = useState("");
const [tagKey, setTagKey] = useState("");
@@ -116,7 +131,14 @@ export default function AWSSecretManagerCreateIntegrationPage() {
const handleButtonClick = async () => {
try {
if (targetSecretName.trim() === "") {
if (!selectedMappingBehavior) {
return;
}
if (
selectedMappingBehavior === IntegrationMappingBehavior.MANY_TO_ONE &&
targetSecretName.trim() === ""
) {
setTargetSecretName("Secret name cannot be blank");
return;
}
@@ -143,7 +165,8 @@ export default function AWSSecretManagerCreateIntegrationPage() {
]
}
: {}),
...(kmsKeyId && { kmsKeyId })
...(kmsKeyId && { kmsKeyId }),
mappingBehavior: selectedMappingBehavior
}
});
@@ -248,6 +271,22 @@ export default function AWSSecretManagerCreateIntegrationPage() {
))}
</Select>
</FormControl>
<FormControl label="Mapping Behavior">
<Select
value={selectedMappingBehavior}
onValueChange={(val) => {
setSelectedMappingBehavior(val as IntegrationMappingBehavior);
}}
className="w-full border border-mineshaft-500"
>
{mappingBehaviors.map((option) => (
<SelectItem value={option.value} key={`aws-environment-${option.value}`}>
{option.label}
</SelectItem>
))}
</Select>
</FormControl>
{selectedMappingBehavior === IntegrationMappingBehavior.MANY_TO_ONE && (
<FormControl
label="AWS SM Secret Name"
errorText={targetSecretNameErrorText}
@@ -261,6 +300,7 @@ export default function AWSSecretManagerCreateIntegrationPage() {
onChange={(e) => setTargetSecretName(e.target.value)}
/>
</FormControl>
)}
</motion.div>
</TabPanel>
<TabPanel value={TabSections.Options}>
frontend/src/views/IntegrationsPage/components/IntegrationsSection/IntegrationsSection.tsx
+6
View File
@@ -21,6 +21,7 @@ import {
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
import { usePopUp } from "@app/hooks";
import { useSyncIntegration } from "@app/hooks/api/integrations/queries";
import { IntegrationMappingBehavior } from "@app/hooks/api/integrations/types";
import { TIntegration } from "@app/hooks/api/types";
type Props = {
@@ -131,6 +132,10 @@ export const IntegrationsSection = ({
</div>
</div>
)}
{!(
integration.integration === "aws-secret-manager" &&
integration.metadata?.mappingBehavior === IntegrationMappingBehavior.ONE_TO_ONE
) && (
<div className="ml-2 flex flex-col">
<FormLabel
label={
@@ -155,6 +160,7 @@ export const IntegrationsSection = ({
integration.app}
</div>
</div>
)}
{(integration.integration === "vercel" ||
integration.integration === "netlify" ||
integration.integration === "railway" ||