mirror of
https://github.com/Kingsrook/qqq.git
synced 2025-07-18 13:10:44 +00:00
Initial checkin
This commit is contained in:
@ -0,0 +1,275 @@
|
|||||||
|
/*
|
||||||
|
* QQQ - Low-code Application Framework for Engineers.
|
||||||
|
* Copyright (C) 2021-2023. Kingsrook, LLC
|
||||||
|
* 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
|
||||||
|
* contact@kingsrook.com
|
||||||
|
* https://github.com/Kingsrook/
|
||||||
|
*
|
||||||
|
* This program is free software: you can redistribute it and/or modify
|
||||||
|
* it under the terms of the GNU Affero General Public License as
|
||||||
|
* published by the Free Software Foundation, either version 3 of the
|
||||||
|
* License, or (at your option) any later version.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU Affero General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU Affero General Public License
|
||||||
|
* along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package com.kingsrook.qqq.backend.core.instances;
|
||||||
|
|
||||||
|
|
||||||
|
import java.io.File;
|
||||||
|
import java.io.IOException;
|
||||||
|
import java.util.Objects;
|
||||||
|
import java.util.Optional;
|
||||||
|
import com.amazonaws.auth.AWSStaticCredentialsProvider;
|
||||||
|
import com.amazonaws.auth.BasicAWSCredentials;
|
||||||
|
import com.amazonaws.services.secretsmanager.AWSSecretsManager;
|
||||||
|
import com.amazonaws.services.secretsmanager.AWSSecretsManagerClientBuilder;
|
||||||
|
import com.amazonaws.services.secretsmanager.model.CreateSecretRequest;
|
||||||
|
import com.amazonaws.services.secretsmanager.model.Filter;
|
||||||
|
import com.amazonaws.services.secretsmanager.model.GetSecretValueRequest;
|
||||||
|
import com.amazonaws.services.secretsmanager.model.GetSecretValueResult;
|
||||||
|
import com.amazonaws.services.secretsmanager.model.ListSecretsRequest;
|
||||||
|
import com.amazonaws.services.secretsmanager.model.ListSecretsResult;
|
||||||
|
import com.amazonaws.services.secretsmanager.model.PutSecretValueRequest;
|
||||||
|
import com.amazonaws.services.secretsmanager.model.ResourceExistsException;
|
||||||
|
import com.amazonaws.services.secretsmanager.model.SecretListEntry;
|
||||||
|
import com.kingsrook.qqq.backend.core.utils.StringUtils;
|
||||||
|
import org.apache.commons.io.FileUtils;
|
||||||
|
import org.apache.logging.log4j.LogManager;
|
||||||
|
import org.apache.logging.log4j.Logger;
|
||||||
|
import org.json.JSONException;
|
||||||
|
import org.json.JSONObject;
|
||||||
|
|
||||||
|
|
||||||
|
/*******************************************************************************
|
||||||
|
** Utility class for working with AWS Secrets Manager.
|
||||||
|
**
|
||||||
|
** Relies on environment variables:
|
||||||
|
** SECRETS_MANAGER_ACCESS_KEY
|
||||||
|
** SECRETS_MANAGER_SECRET_KEY
|
||||||
|
** SECRETS_MANAGER_REGION
|
||||||
|
**
|
||||||
|
*******************************************************************************/
|
||||||
|
public class SecretsManagerUtils
|
||||||
|
{
|
||||||
|
private static final Logger LOG = LogManager.getLogger(SecretsManagerUtils.class);
|
||||||
|
|
||||||
|
private static QMetaDataVariableInterpreter qMetaDataVariableInterpreter;
|
||||||
|
private static AWSSecretsManager _client = null;
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
/*******************************************************************************
|
||||||
|
** IF secret manager ENV vars are set,
|
||||||
|
** THEN lookup all secrets starting with the given prefix,
|
||||||
|
** and write them to a .env file (backing up any pre-existing .env files first).
|
||||||
|
*******************************************************************************/
|
||||||
|
public static void writeEnvFromSecretsWithNamePrefix(String prefix) throws IOException
|
||||||
|
{
|
||||||
|
Optional<AWSSecretsManager> optionalSecretsManagerClient = getSecretsManagerClient();
|
||||||
|
if(optionalSecretsManagerClient.isPresent())
|
||||||
|
{
|
||||||
|
AWSSecretsManager client = optionalSecretsManagerClient.get();
|
||||||
|
|
||||||
|
ListSecretsRequest listSecretsRequest = new ListSecretsRequest().withFilters(new Filter().withKey("name").withValues(prefix));
|
||||||
|
listSecretsRequest.withMaxResults(100);
|
||||||
|
ListSecretsResult listSecretsResult = client.listSecrets(listSecretsRequest);
|
||||||
|
|
||||||
|
StringBuilder fullEnv = new StringBuilder();
|
||||||
|
while(true)
|
||||||
|
{
|
||||||
|
for(SecretListEntry secretListEntry : listSecretsResult.getSecretList())
|
||||||
|
{
|
||||||
|
String nameWithoutPrefix = secretListEntry.getName().replace(prefix, "");
|
||||||
|
Optional<String> secretValue = getSecret(prefix, nameWithoutPrefix);
|
||||||
|
if(secretValue.isPresent())
|
||||||
|
{
|
||||||
|
String envLine = nameWithoutPrefix + "=" + secretValue.get();
|
||||||
|
fullEnv.append(envLine).append('\n');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if(listSecretsResult.getNextToken() != null)
|
||||||
|
{
|
||||||
|
LOG.trace("Calling for next token...");
|
||||||
|
listSecretsRequest.setNextToken(listSecretsResult.getNextToken());
|
||||||
|
listSecretsResult = client.listSecrets(listSecretsRequest);
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
File dotEnv = new File(".env");
|
||||||
|
if(dotEnv.exists())
|
||||||
|
{
|
||||||
|
dotEnv.renameTo(new File(".env.backup-" + System.currentTimeMillis()));
|
||||||
|
}
|
||||||
|
|
||||||
|
FileUtils.writeStringToFile(dotEnv, fullEnv.toString());
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
LOG.info("Not writing .env from secrets manager");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
/*******************************************************************************
|
||||||
|
** Get a single secret value.
|
||||||
|
**
|
||||||
|
** The lookup in secrets manager is done by (path + name). Then, in the value
|
||||||
|
** that comes back, if it looks like JSON, we look for a value inside it under
|
||||||
|
** the key of just "name". Else, if we didn't get JSON back, then we just return
|
||||||
|
** the full text value of the secret.
|
||||||
|
*******************************************************************************/
|
||||||
|
public static Optional<String> getSecret(String path, String name)
|
||||||
|
{
|
||||||
|
Optional<AWSSecretsManager> optionalSecretsManagerClient = getSecretsManagerClient();
|
||||||
|
if(optionalSecretsManagerClient.isPresent())
|
||||||
|
{
|
||||||
|
try
|
||||||
|
{
|
||||||
|
AWSSecretsManager client = optionalSecretsManagerClient.get();
|
||||||
|
String secretId = path + name;
|
||||||
|
GetSecretValueRequest getSecretValueRequest = new GetSecretValueRequest().withSecretId(secretId);
|
||||||
|
|
||||||
|
GetSecretValueResult getSecretValueResult = client.getSecretValue(getSecretValueRequest);
|
||||||
|
|
||||||
|
try
|
||||||
|
{
|
||||||
|
JSONObject secretJSON = new JSONObject(getSecretValueResult.getSecretString());
|
||||||
|
|
||||||
|
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
// know we know it's a json object - so - commit to either returning the value under this name, else warning and returning empty //
|
||||||
|
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
if(secretJSON.has(name))
|
||||||
|
{
|
||||||
|
return (Optional.of(secretJSON.getString(name)));
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
LOG.warn("SecretsManager secret at [" + secretId + "] was a JSON object, but it did not contain a key of [" + name + "] - so returning empty.");
|
||||||
|
return (Optional.empty());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
catch(JSONException je)
|
||||||
|
{
|
||||||
|
//////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
// if the secret value couldn't be parsed as json, then assume it to be text and just return it //
|
||||||
|
//////////////////////////////////////////////////////////////////////////////////////////////////
|
||||||
|
return (Optional.of(getSecretValueResult.getSecretString()));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
catch(Exception e)
|
||||||
|
{
|
||||||
|
LOG.debug("Error getting secret from secretManager: ", e);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return (Optional.empty());
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
/*******************************************************************************
|
||||||
|
** Tries to do a Create - if that fails, then does a Put (update).
|
||||||
|
**
|
||||||
|
** Path is expected to end in a /, but I suppose it isn't strictly required.
|
||||||
|
*******************************************************************************/
|
||||||
|
public static void writeSecret(String path, String name, String value)
|
||||||
|
{
|
||||||
|
JSONObject secretJson = new JSONObject();
|
||||||
|
secretJson.put(name, value);
|
||||||
|
|
||||||
|
Optional<AWSSecretsManager> optionalSecretsManagerClient = getSecretsManagerClient();
|
||||||
|
if(optionalSecretsManagerClient.isPresent())
|
||||||
|
{
|
||||||
|
AWSSecretsManager client = optionalSecretsManagerClient.get();
|
||||||
|
|
||||||
|
try
|
||||||
|
{
|
||||||
|
CreateSecretRequest createSecretRequest = new CreateSecretRequest();
|
||||||
|
createSecretRequest.setName(path + name);
|
||||||
|
createSecretRequest.setSecretString(secretJson.toString());
|
||||||
|
client.createSecret(createSecretRequest);
|
||||||
|
}
|
||||||
|
catch(ResourceExistsException e)
|
||||||
|
{
|
||||||
|
PutSecretValueRequest putSecretValueRequest = new PutSecretValueRequest();
|
||||||
|
putSecretValueRequest.setSecretId(path + name);
|
||||||
|
putSecretValueRequest.setSecretString(secretJson.toString());
|
||||||
|
client.putSecretValue(putSecretValueRequest);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
/*******************************************************************************
|
||||||
|
**
|
||||||
|
*******************************************************************************/
|
||||||
|
private static Optional<AWSSecretsManager> getSecretsManagerClient()
|
||||||
|
{
|
||||||
|
if(_client == null)
|
||||||
|
{
|
||||||
|
QMetaDataVariableInterpreter interpreter = getQMetaDataVariableInterpreter();
|
||||||
|
|
||||||
|
String accessKey = interpreter.interpret("${env.SECRETS_MANAGER_ACCESS_KEY}");
|
||||||
|
String secretKey = interpreter.interpret("${env.SECRETS_MANAGER_SECRET_KEY}");
|
||||||
|
String region = interpreter.interpret("${env.SECRETS_MANAGER_REGION}");
|
||||||
|
|
||||||
|
if(StringUtils.hasContent(accessKey) && StringUtils.hasContent(secretKey) && StringUtils.hasContent(region))
|
||||||
|
{
|
||||||
|
try
|
||||||
|
{
|
||||||
|
BasicAWSCredentials credentials = new BasicAWSCredentials(accessKey, secretKey);
|
||||||
|
_client = AWSSecretsManagerClientBuilder.standard()
|
||||||
|
.withCredentials(new AWSStaticCredentialsProvider(credentials))
|
||||||
|
.withRegion(region)
|
||||||
|
.build();
|
||||||
|
}
|
||||||
|
catch(Exception e)
|
||||||
|
{
|
||||||
|
LOG.error("Error opening Secrets Manager client", e);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
LOG.warn("One or more SECRETS_MANAGER env var was not set. Unable to open Secrets Manager client.");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return (Optional.ofNullable(_client));
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
/*******************************************************************************
|
||||||
|
**
|
||||||
|
*******************************************************************************/
|
||||||
|
private static QMetaDataVariableInterpreter getQMetaDataVariableInterpreter()
|
||||||
|
{
|
||||||
|
return Objects.requireNonNullElseGet(qMetaDataVariableInterpreter, QMetaDataVariableInterpreter::new);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
/*******************************************************************************
|
||||||
|
** Ideally meant for tests or one-offs to set up a variable interpreter with
|
||||||
|
** an override ENV.
|
||||||
|
*******************************************************************************/
|
||||||
|
static void setQMetaDataVariableInterpreter(QMetaDataVariableInterpreter qMetaDataVariableInterpreter)
|
||||||
|
{
|
||||||
|
SecretsManagerUtils.qMetaDataVariableInterpreter = qMetaDataVariableInterpreter;
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user