Skip to content

Commit 7e8b011

Browse files
tyrannosaurus-beckstyrannosaurus-becks
authored
backport pr 8783 to 1.3.x (#8865)
1 parent 78bd5dc commit 7e8b011

File tree

12 files changed

+1331
-90
lines changed

12 files changed

+1331
-90
lines changed

‎builtin/credential/aws/path_config_identity.go‎

Lines changed: 64 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,52 @@ import (
55
"fmt"
66

77
"github.com/hashicorp/vault/sdk/framework"
8+
"github.com/hashicorp/vault/sdk/helper/authmetadata"
89
"github.com/hashicorp/vault/sdk/helper/strutil"
910
"github.com/hashicorp/vault/sdk/logical"
1011
)
1112

13+
var (
14+
// iamAuthMetadataFields is a list of the default auth metadata
15+
// added to tokens during login. The default alias type used
16+
// by this back-end is the role ID. Subsequently, the default
17+
// fields included are expected to have a low rate of change
18+
// when the role ID is in use.
19+
iamAuthMetadataFields = &authmetadata.Fields{
20+
FieldName: "iam_metadata",
21+
Default: []string{
22+
"account_id",
23+
"auth_type",
24+
},
25+
AvailableToAdd: []string{
26+
"canonical_arn",
27+
"client_arn",
28+
"client_user_id",
29+
"inferred_aws_region",
30+
"inferred_entity_id",
31+
"inferred_entity_type",
32+
},
33+
}
34+
35+
// ec2AuthMetadataFields is a list of the default auth metadata
36+
// added to tokens during login. The default alias type used
37+
// by this back-end is the role ID. Subsequently, the default
38+
// fields included are expected to have a low rate of change
39+
// when the role ID is in use.
40+
ec2AuthMetadataFields = &authmetadata.Fields{
41+
FieldName: "ec2_metadata",
42+
Default: []string{
43+
"account_id",
44+
"auth_type",
45+
},
46+
AvailableToAdd: []string{
47+
"ami_id",
48+
"instance_id",
49+
"region",
50+
},
51+
}
52+
)
53+
1254
func (b *backend) pathConfigIdentity() *framework.Path {
1355
return &framework.Path{
1456
Pattern: "config/identity$",
@@ -18,11 +60,13 @@ func (b *backend) pathConfigIdentity() *framework.Path {
1860
Default: identityAliasIAMUniqueID,
1961
Description: fmt.Sprintf("Configure how the AWS auth method generates entity aliases when using IAM auth. Valid values are %q, %q, and %q. Defaults to %q.", identityAliasRoleID, identityAliasIAMUniqueID, identityAliasIAMFullArn, identityAliasRoleID),
2062
},
63+
iamAuthMetadataFields.FieldName: authmetadata.FieldSchema(iamAuthMetadataFields),
2164
"ec2_alias": {
2265
Type: framework.TypeString,
2366
Default: identityAliasEC2InstanceID,
2467
Description: fmt.Sprintf("Configure how the AWS auth method generates entity alias when using EC2 auth. Valid values are %q, %q, and %q. Defaults to %q.", identityAliasRoleID, identityAliasEC2InstanceID, identityAliasEC2ImageID, identityAliasRoleID),
2568
},
69+
ec2AuthMetadataFields.FieldName: authmetadata.FieldSchema(ec2AuthMetadataFields),
2670
},
2771

2872
Operations: map[logical.Operation]framework.OperationHandler{
@@ -45,9 +89,12 @@ func identityConfigEntry(ctx context.Context, s logical.Storage) (*identityConfi
4589
return nil, err
4690
}
4791

48-
var entry identityConfig
92+
entry := &identityConfig{
93+
IAMAuthMetadataHandler: authmetadata.NewHandler(iamAuthMetadataFields),
94+
EC2AuthMetadataHandler: authmetadata.NewHandler(ec2AuthMetadataFields),
95+
}
4996
if entryRaw != nil {
50-
if err := entryRaw.DecodeJSON(&entry); err != nil {
97+
if err := entryRaw.DecodeJSON(entry); err != nil {
5198
return nil, err
5299
}
53100
}
@@ -60,7 +107,7 @@ func identityConfigEntry(ctx context.Context, s logical.Storage) (*identityConfi
60107
entry.EC2Alias = identityAliasRoleID
61108
}
62109

63-
return &entry, nil
110+
return entry, nil
64111
}
65112

66113
func pathConfigIdentityRead(ctx context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
@@ -71,8 +118,10 @@ func pathConfigIdentityRead(ctx context.Context, req *logical.Request, _ *framew
71118

72119
return &logical.Response{
73120
Data: map[string]interface{}{
74-
"iam_alias": config.IAMAlias,
75-
"ec2_alias": config.EC2Alias,
121+
"iam_alias": config.IAMAlias,
122+
iamAuthMetadataFields.FieldName: config.IAMAuthMetadataHandler.AuthMetadata(),
123+
"ec2_alias": config.EC2Alias,
124+
ec2AuthMetadataFields.FieldName: config.EC2AuthMetadataHandler.AuthMetadata(),
76125
},
77126
}, nil
78127
}
@@ -102,6 +151,12 @@ func pathConfigIdentityUpdate(ctx context.Context, req *logical.Request, data *f
102151
}
103152
config.EC2Alias = ec2Alias
104153
}
154+
if err := config.IAMAuthMetadataHandler.ParseAuthMetadata(data); err != nil {
155+
return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
156+
}
157+
if err := config.EC2AuthMetadataHandler.ParseAuthMetadata(data); err != nil {
158+
return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
159+
}
105160

106161
entry, err := logical.StorageEntryJSON("config/identity", config)
107162
if err != nil {
@@ -117,8 +172,10 @@ func pathConfigIdentityUpdate(ctx context.Context, req *logical.Request, data *f
117172
}
118173

119174
type identityConfig struct {
120-
IAMAlias string `json:"iam_alias"`
121-
EC2Alias string `json:"ec2_alias"`
175+
IAMAlias string `json:"iam_alias"`
176+
IAMAuthMetadataHandler *authmetadata.Handler `json:"iam_auth_metadata_handler"`
177+
EC2Alias string `json:"ec2_alias"`
178+
EC2AuthMetadataHandler *authmetadata.Handler `json:"ec2_auth_metadata_handler"`
122179
}
123180

124181
const identityAliasIAMUniqueID = "unique_id"

‎builtin/credential/aws/path_login.go‎

Lines changed: 22 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -830,24 +830,23 @@ func (b *backend) pathLoginUpdateEc2(ctx context.Context, req *logical.Request,
830830

831831
auth := &logical.Auth{
832832
Metadata: map[string]string{
833-
"instance_id": identityDocParsed.InstanceID,
834-
"region": identityDocParsed.Region,
835-
"account_id": identityDocParsed.AccountID,
836833
"role_tag_max_ttl": rTagMaxTTL.String(),
837834
"role": roleName,
838-
"ami_id": identityDocParsed.AmiID,
839835
},
840836
Alias: &logical.Alias{
841837
Name: identityAlias,
842-
Metadata: map[string]string{
843-
"instance_id": identityDocParsed.InstanceID,
844-
"region": identityDocParsed.Region,
845-
"account_id": identityDocParsed.AccountID,
846-
"ami_id": identityDocParsed.AmiID,
847-
},
848838
},
849839
}
850840
roleEntry.PopulateTokenAuth(auth)
841+
if err := identityConfigEntry.EC2AuthMetadataHandler.PopulateDesiredMetadata(auth, map[string]string{
842+
"instance_id": identityDocParsed.InstanceID,
843+
"region": identityDocParsed.Region,
844+
"account_id": identityDocParsed.AccountID,
845+
"ami_id": identityDocParsed.AmiID,
846+
"auth_type": ec2AuthType,
847+
}); err != nil {
848+
b.Logger().Warn("unable to set alias metadata", "err", err)
849+
}
851850

852851
resp := &logical.Response{
853852
Auth: auth,
@@ -1348,15 +1347,7 @@ func (b *backend) pathLoginUpdateIam(ctx context.Context, req *logical.Request,
13481347

13491348
auth := &logical.Auth{
13501349
Metadata: map[string]string{
1351-
"client_arn": callerID.Arn,
1352-
"canonical_arn": entity.canonicalArn(),
1353-
"client_user_id": callerUniqueId,
1354-
"auth_type": iamAuthType,
1355-
"inferred_entity_type": inferredEntityType,
1356-
"inferred_entity_id": inferredEntityID,
1357-
"inferred_aws_region": roleEntry.InferredAWSRegion,
1358-
"account_id": entity.AccountNumber,
1359-
"role_id": roleEntry.RoleID,
1350+
"role_id": roleEntry.RoleID,
13601351
},
13611352
InternalData: map[string]interface{}{
13621353
"role_name": roleName,
@@ -1365,19 +1356,21 @@ func (b *backend) pathLoginUpdateIam(ctx context.Context, req *logical.Request,
13651356
DisplayName: entity.FriendlyName,
13661357
Alias: &logical.Alias{
13671358
Name: identityAlias,
1368-
Metadata: map[string]string{
1369-
"client_arn": callerID.Arn,
1370-
"canonical_arn": entity.canonicalArn(),
1371-
"client_user_id": callerUniqueId,
1372-
"auth_type": iamAuthType,
1373-
"inferred_entity_type": inferredEntityType,
1374-
"inferred_entity_id": inferredEntityID,
1375-
"inferred_aws_region": roleEntry.InferredAWSRegion,
1376-
"account_id": entity.AccountNumber,
1377-
},
13781359
},
13791360
}
13801361
roleEntry.PopulateTokenAuth(auth)
1362+
if err := identityConfigEntry.IAMAuthMetadataHandler.PopulateDesiredMetadata(auth, map[string]string{
1363+
"client_arn": callerID.Arn,
1364+
"canonical_arn": entity.canonicalArn(),
1365+
"client_user_id": callerUniqueId,
1366+
"auth_type": iamAuthType,
1367+
"inferred_entity_type": inferredEntityType,
1368+
"inferred_entity_id": inferredEntityID,
1369+
"inferred_aws_region": roleEntry.InferredAWSRegion,
1370+
"account_id": entity.AccountNumber,
1371+
}); err != nil {
1372+
b.Logger().Warn(fmt.Sprintf("unable to set alias metadata due to %s", err))
1373+
}
13811374

13821375
return &logical.Response{
13831376
Auth: auth,

0 commit comments

Comments
 (0)