mirror of https://github.com/grafana/grafana
Cloudwatch: use shared library for aws auth (#29550)
* use sdk for handling auth * fix broken test * lint fixes Co-authored-by: Erik Sundell <erik.sundell87@gmail.com>pull/31281/head
Ryan McKinley
5 years ago
committed by
GitHub
parent
8404d54277
commit
9dd1d5f553
@ -1,44 +0,0 @@ |
|||||||
package cloudwatch |
|
||||||
|
|
||||||
import ( |
|
||||||
"sync" |
|
||||||
"time" |
|
||||||
|
|
||||||
"github.com/aws/aws-sdk-go/aws" |
|
||||||
"github.com/aws/aws-sdk-go/aws/credentials" |
|
||||||
"github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds" |
|
||||||
"github.com/aws/aws-sdk-go/aws/credentials/stscreds" |
|
||||||
"github.com/aws/aws-sdk-go/aws/ec2metadata" |
|
||||||
"github.com/aws/aws-sdk-go/aws/session" |
|
||||||
) |
|
||||||
|
|
||||||
type envelope struct { |
|
||||||
session *session.Session |
|
||||||
expiration time.Time |
|
||||||
} |
|
||||||
|
|
||||||
var sessCache = map[string]envelope{} |
|
||||||
var sessCacheLock sync.RWMutex |
|
||||||
|
|
||||||
// Session factory.
|
|
||||||
// Stubbable by tests.
|
|
||||||
//nolint:gocritic
|
|
||||||
var newSession = func(cfgs ...*aws.Config) (*session.Session, error) { |
|
||||||
return session.NewSession(cfgs...) |
|
||||||
} |
|
||||||
|
|
||||||
// STS credentials factory.
|
|
||||||
// Stubbable by tests.
|
|
||||||
//nolint:gocritic
|
|
||||||
var newSTSCredentials = stscreds.NewCredentials |
|
||||||
|
|
||||||
// EC2Metadata service factory.
|
|
||||||
// Stubbable by tests.
|
|
||||||
//nolint:gocritic
|
|
||||||
var newEC2Metadata = ec2metadata.New |
|
||||||
|
|
||||||
// EC2 role credentials factory.
|
|
||||||
// Stubbable by tests.
|
|
||||||
var newEC2RoleCredentials = func(sess *session.Session) *credentials.Credentials { |
|
||||||
return credentials.NewCredentials(&ec2rolecreds.EC2RoleProvider{Client: ec2metadata.New(sess), ExpiryWindow: stscreds.DefaultDuration}) |
|
||||||
} |
|
||||||
@ -1,188 +0,0 @@ |
|||||||
package cloudwatch |
|
||||||
|
|
||||||
import ( |
|
||||||
"reflect" |
|
||||||
"testing" |
|
||||||
|
|
||||||
"github.com/aws/aws-sdk-go/aws" |
|
||||||
"github.com/aws/aws-sdk-go/aws/client" |
|
||||||
"github.com/aws/aws-sdk-go/aws/credentials" |
|
||||||
"github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds" |
|
||||||
"github.com/aws/aws-sdk-go/aws/credentials/stscreds" |
|
||||||
"github.com/aws/aws-sdk-go/aws/ec2metadata" |
|
||||||
"github.com/aws/aws-sdk-go/aws/session" |
|
||||||
"github.com/google/go-cmp/cmp" |
|
||||||
"github.com/google/go-cmp/cmp/cmpopts" |
|
||||||
"github.com/grafana/grafana/pkg/setting" |
|
||||||
"github.com/stretchr/testify/assert" |
|
||||||
"github.com/stretchr/testify/require" |
|
||||||
) |
|
||||||
|
|
||||||
// Test cloudWatchExecutor.newSession with assumption of IAM role.
|
|
||||||
func TestNewSession_AssumeRole(t *testing.T) { |
|
||||||
origNewSession := newSession |
|
||||||
origNewSTSCredentials := newSTSCredentials |
|
||||||
origNewEC2Metadata := newEC2Metadata |
|
||||||
t.Cleanup(func() { |
|
||||||
newSession = origNewSession |
|
||||||
newSTSCredentials = origNewSTSCredentials |
|
||||||
newEC2Metadata = origNewEC2Metadata |
|
||||||
}) |
|
||||||
newSession = func(cfgs ...*aws.Config) (*session.Session, error) { |
|
||||||
cfg := aws.Config{} |
|
||||||
cfg.MergeIn(cfgs...) |
|
||||||
return &session.Session{ |
|
||||||
Config: &cfg, |
|
||||||
}, nil |
|
||||||
} |
|
||||||
newSTSCredentials = func(c client.ConfigProvider, roleARN string, |
|
||||||
options ...func(*stscreds.AssumeRoleProvider)) *credentials.Credentials { |
|
||||||
p := &stscreds.AssumeRoleProvider{ |
|
||||||
RoleARN: roleARN, |
|
||||||
} |
|
||||||
for _, o := range options { |
|
||||||
o(p) |
|
||||||
} |
|
||||||
|
|
||||||
return credentials.NewCredentials(p) |
|
||||||
} |
|
||||||
newEC2Metadata = func(p client.ConfigProvider, cfgs ...*aws.Config) *ec2metadata.EC2Metadata { |
|
||||||
return nil |
|
||||||
} |
|
||||||
|
|
||||||
duration := stscreds.DefaultDuration |
|
||||||
|
|
||||||
t.Run("Without external ID", func(t *testing.T) { |
|
||||||
t.Cleanup(func() { |
|
||||||
sessCache = map[string]envelope{} |
|
||||||
}) |
|
||||||
|
|
||||||
const roleARN = "test" |
|
||||||
|
|
||||||
e := newExecutor(nil, newTestConfig()) |
|
||||||
e.DataSource = fakeDataSource(fakeDataSourceCfg{ |
|
||||||
assumeRoleARN: roleARN, |
|
||||||
}) |
|
||||||
|
|
||||||
sess, err := e.newSession(defaultRegion) |
|
||||||
require.NoError(t, err) |
|
||||||
require.NotNil(t, sess) |
|
||||||
|
|
||||||
expCreds := credentials.NewCredentials(&stscreds.AssumeRoleProvider{ |
|
||||||
RoleARN: roleARN, |
|
||||||
Duration: duration, |
|
||||||
}) |
|
||||||
diff := cmp.Diff(expCreds, sess.Config.Credentials, cmp.Exporter(func(_ reflect.Type) bool { |
|
||||||
return true |
|
||||||
}), cmpopts.IgnoreFields(stscreds.AssumeRoleProvider{}, "Expiry")) |
|
||||||
assert.Empty(t, diff) |
|
||||||
}) |
|
||||||
|
|
||||||
t.Run("With external ID", func(t *testing.T) { |
|
||||||
t.Cleanup(func() { |
|
||||||
sessCache = map[string]envelope{} |
|
||||||
}) |
|
||||||
|
|
||||||
const roleARN = "test" |
|
||||||
const externalID = "external" |
|
||||||
|
|
||||||
e := newExecutor(nil, newTestConfig()) |
|
||||||
e.DataSource = fakeDataSource(fakeDataSourceCfg{ |
|
||||||
assumeRoleARN: roleARN, |
|
||||||
externalID: externalID, |
|
||||||
}) |
|
||||||
|
|
||||||
sess, err := e.newSession(defaultRegion) |
|
||||||
require.NoError(t, err) |
|
||||||
require.NotNil(t, sess) |
|
||||||
|
|
||||||
expCreds := credentials.NewCredentials(&stscreds.AssumeRoleProvider{ |
|
||||||
RoleARN: roleARN, |
|
||||||
ExternalID: aws.String(externalID), |
|
||||||
Duration: duration, |
|
||||||
}) |
|
||||||
diff := cmp.Diff(expCreds, sess.Config.Credentials, cmp.Exporter(func(_ reflect.Type) bool { |
|
||||||
return true |
|
||||||
}), cmpopts.IgnoreFields(stscreds.AssumeRoleProvider{}, "Expiry")) |
|
||||||
assert.Empty(t, diff) |
|
||||||
}) |
|
||||||
|
|
||||||
t.Run("Assume role not enabled", func(t *testing.T) { |
|
||||||
t.Cleanup(func() { |
|
||||||
sessCache = map[string]envelope{} |
|
||||||
}) |
|
||||||
|
|
||||||
const roleARN = "test" |
|
||||||
|
|
||||||
e := newExecutor(nil, &setting.Cfg{AWSAllowedAuthProviders: []string{"default"}, AWSAssumeRoleEnabled: false}) |
|
||||||
e.DataSource = fakeDataSource(fakeDataSourceCfg{ |
|
||||||
assumeRoleARN: roleARN, |
|
||||||
}) |
|
||||||
|
|
||||||
sess, err := e.newSession(defaultRegion) |
|
||||||
require.Error(t, err) |
|
||||||
require.Nil(t, sess) |
|
||||||
|
|
||||||
expectedError := "attempting to use assume role (ARN) which is disabled in grafana.ini" |
|
||||||
assert.Equal(t, expectedError, err.Error()) |
|
||||||
}) |
|
||||||
} |
|
||||||
|
|
||||||
func TestNewSession_AllowedAuthProviders(t *testing.T) { |
|
||||||
t.Run("Not allowed auth type is used", func(t *testing.T) { |
|
||||||
e := newExecutor(nil, &setting.Cfg{AWSAllowedAuthProviders: []string{"keys"}}) |
|
||||||
e.DataSource = fakeDataSource() |
|
||||||
e.DataSource.JsonData.Set("authType", "default") |
|
||||||
|
|
||||||
sess, err := e.newSession(defaultRegion) |
|
||||||
require.Error(t, err) |
|
||||||
require.Nil(t, sess) |
|
||||||
|
|
||||||
assert.Equal(t, `attempting to use an auth type that is not allowed: "default"`, err.Error()) |
|
||||||
}) |
|
||||||
|
|
||||||
t.Run("Allowed auth type is used", func(t *testing.T) { |
|
||||||
e := newExecutor(nil, &setting.Cfg{AWSAllowedAuthProviders: []string{"keys"}}) |
|
||||||
e.DataSource = fakeDataSource() |
|
||||||
e.DataSource.JsonData.Set("authType", "keys") |
|
||||||
|
|
||||||
sess, err := e.newSession(defaultRegion) |
|
||||||
require.NoError(t, err) |
|
||||||
require.NotNil(t, sess) |
|
||||||
}) |
|
||||||
} |
|
||||||
|
|
||||||
func TestNewSession_EC2IAMRole(t *testing.T) { |
|
||||||
newSession = func(cfgs ...*aws.Config) (*session.Session, error) { |
|
||||||
cfg := aws.Config{} |
|
||||||
cfg.MergeIn(cfgs...) |
|
||||||
return &session.Session{ |
|
||||||
Config: &cfg, |
|
||||||
}, nil |
|
||||||
} |
|
||||||
newEC2Metadata = func(p client.ConfigProvider, cfgs ...*aws.Config) *ec2metadata.EC2Metadata { |
|
||||||
return nil |
|
||||||
} |
|
||||||
newEC2RoleCredentials = func(sess *session.Session) *credentials.Credentials { |
|
||||||
return credentials.NewCredentials(&ec2rolecreds.EC2RoleProvider{Client: newEC2Metadata(nil), ExpiryWindow: stscreds.DefaultDuration}) |
|
||||||
} |
|
||||||
|
|
||||||
t.Run("Credentials are created", func(t *testing.T) { |
|
||||||
e := newExecutor(nil, &setting.Cfg{AWSAllowedAuthProviders: []string{"ec2_iam_role"}, AWSAssumeRoleEnabled: true}) |
|
||||||
e.DataSource = fakeDataSource() |
|
||||||
e.DataSource.JsonData.Set("authType", "ec2_iam_role") |
|
||||||
|
|
||||||
sess, err := e.newSession(defaultRegion) |
|
||||||
require.NoError(t, err) |
|
||||||
require.NotNil(t, sess) |
|
||||||
|
|
||||||
expCreds := credentials.NewCredentials(&ec2rolecreds.EC2RoleProvider{ |
|
||||||
Client: newEC2Metadata(nil), ExpiryWindow: stscreds.DefaultDuration, |
|
||||||
}) |
|
||||||
|
|
||||||
diff := cmp.Diff(expCreds, sess.Config.Credentials, cmp.Exporter(func(_ reflect.Type) bool { |
|
||||||
return true |
|
||||||
}), cmpopts.IgnoreFields(stscreds.AssumeRoleProvider{}, "Expiry")) |
|
||||||
assert.Empty(t, diff) |
|
||||||
}) |
|
||||||
} |
|
||||||
Loading…
Reference in new issue