class Hiera::Backend::Secrets_manager_backend
Public Class Methods
new()
click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 4 def initialize require 'json' require 'aws-sdk-secretsmanager' @config = Config @client = create_client end
Public Instance Methods
lookup(key, scope, order_override, resolution_type)
click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 11 def lookup(key, scope, order_override, resolution_type) answer = nil if @client.nil? Hiera.debug('Key lookup failed. AWS Secrets Manager backend is in a bad state.') return answer end if contains_illegal_characters?(key) Hiera.debug("#{key} contains illegal characters. Skipping lookup.") return answer end key_to_query = format_key(key, scope, Config[:secrets_manager]) begin case resolution_type when :array Hiera.warn("Hiera Secrets Manager backend does not support arrays.") when :hash answer = JSON.parse(retrieve_secret(key_to_query)) else answer = retrieve_secret(key_to_query) end rescue Aws::SecretsManager::Errors::ResourceNotFoundException => error Hiera.debug("#{key_to_query} not found: #{error.message}") rescue StandardError => error Hiera.debug("Secrets Manager Backend Error:") Hiera.debug(error) end answer end
Private Instance Methods
contains_illegal_characters?(key)
click to toggle source
AWS Secrets Manager only allows alphanumeric characters or (/_+=.@-) in key names GetSecret requests will fail for keys which have illegal characters
# File lib/hiera/backend/secrets_manager_backend.rb, line 49 def contains_illegal_characters?(key) %r{^[a-zA-Z0-9\/_+=.@\-]+$}.match(key).nil? end
create_client()
click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 71 def create_client if missing_config? Hiera.debug('Warning! Config is empty. Starting in a bad state.') return nil end if missing_keys? Hiera.debug("Warning! Missing key(s) #{missing_keys} in Config. Starting in a bad state.") return nil end Hiera.debug('AWS Secrets Manager backend starting') Aws::SecretsManager::Client.new( region: @config[:secrets_manager][:region], access_key_id: @config[:secrets_manager][:access_key_id], secret_access_key: @config[:secrets_manager][:secret_access_key] ) end
format_key(key, scope, config)
click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 61 def format_key(key, scope, config) if scope.include?('environment') && scope['environment'] environments = config[:environments] prefix = get_prefix(environments, scope) "#{prefix}/#{key}" else key end end
get_prefix(environments, scope)
click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 53 def get_prefix(environments, scope) if environments && environments.key?(scope['environment']) environments[scope['environment']] else scope['environment'] end end
missing_config?()
click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 90 def missing_config? @config[:secrets_manager].nil? end
missing_keys()
click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 98 def missing_keys [:region, :access_key_id, :secret_access_key].reject do |key| @config[:secrets_manager].include?(key) end end
missing_keys?()
click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 94 def missing_keys? !missing_keys.empty? end
retrieve_secret(key)
click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 104 def retrieve_secret(key) response = @client.get_secret_value(secret_id: key) Hiera.debug("Retrieved Secret '#{key}' with version '#{response['version_id']}'") response['secret_string'] end