class Hiera::Backend::Secrets_manager_backend

Public Class Methods

new() click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 4
def initialize
  require 'json'
  require 'aws-sdk-secretsmanager'
  @config = Config
  @client = create_client
end

Public Instance Methods

lookup(key, scope, order_override, resolution_type) click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 11
def lookup(key, scope, order_override, resolution_type)
  answer = nil

  if @client.nil?
    Hiera.debug('Key lookup failed. AWS Secrets Manager backend is in a bad state.')
    return answer
  end

  if contains_illegal_characters?(key)
    Hiera.debug("#{key} contains illegal characters. Skipping lookup.")
    return answer
  end

  key_to_query = format_key(key, scope, Config[:secrets_manager])

  begin
    case resolution_type
    when :array
      Hiera.warn("Hiera Secrets Manager backend does not support arrays.")
    when :hash
      answer = JSON.parse(retrieve_secret(key_to_query))
    else
      answer = retrieve_secret(key_to_query)
    end
  rescue Aws::SecretsManager::Errors::ResourceNotFoundException => error
    Hiera.debug("#{key_to_query} not found: #{error.message}")
  rescue StandardError => error
    Hiera.debug("Secrets Manager Backend Error:")
    Hiera.debug(error)
  end

  answer
end

Private Instance Methods

contains_illegal_characters?(key) click to toggle source

AWS Secrets Manager only allows alphanumeric characters or (/_+=.@-) in key names GetSecret requests will fail for keys which have illegal characters

# File lib/hiera/backend/secrets_manager_backend.rb, line 49
def contains_illegal_characters?(key)
  %r{^[a-zA-Z0-9\/_+=.@\-]+$}.match(key).nil?
end
create_client() click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 71
def create_client
  if missing_config?
    Hiera.debug('Warning! Config is empty. Starting in a bad state.')
    return nil
  end

  if missing_keys?
    Hiera.debug("Warning! Missing key(s) #{missing_keys} in Config. Starting in a bad state.")
    return nil
  end

  Hiera.debug('AWS Secrets Manager backend starting')
  Aws::SecretsManager::Client.new(
    region: @config[:secrets_manager][:region],
    access_key_id: @config[:secrets_manager][:access_key_id],
    secret_access_key: @config[:secrets_manager][:secret_access_key]
  )
end
format_key(key, scope, config) click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 61
def format_key(key, scope, config)
  if scope.include?('environment') && scope['environment']
    environments = config[:environments]
    prefix = get_prefix(environments, scope)
    "#{prefix}/#{key}"
  else
    key
  end
end
get_prefix(environments, scope) click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 53
def get_prefix(environments, scope)
  if environments && environments.key?(scope['environment'])
    environments[scope['environment']]
  else
    scope['environment']
  end
end
missing_config?() click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 90
def missing_config?
  @config[:secrets_manager].nil?
end
missing_keys() click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 98
def missing_keys
  [:region, :access_key_id, :secret_access_key].reject do |key|
    @config[:secrets_manager].include?(key)
  end
end
missing_keys?() click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 94
def missing_keys?
  !missing_keys.empty?
end
retrieve_secret(key) click to toggle source
# File lib/hiera/backend/secrets_manager_backend.rb, line 104
def retrieve_secret(key)
  response = @client.get_secret_value(secret_id: key)
  Hiera.debug("Retrieved Secret '#{key}' with version '#{response['version_id']}'")
  response['secret_string']
end