* Support rotating secrets using Lambda The Secrets manager rotation process uses an AWS Lambda function to perform the rotation of a secret. [1] In fact, it's not possible to trigger rotation of a Secret without specifying a Lambda function at some point in the life of the secret: ``` $ aws secretsmanager rotate-secret --secret-id /rotationTest An error occurred (InvalidRequestException) when calling the RotateSecret operation: No Lambda rotation function ARN is associated with this secret. ``` `moto` can be a little more lenient in this regard and allow `rotate_secret` to be called without a Lambda function being present, if only to allow simulation of the `AWSCURRENT` and `AWSPREVIOUS` labels moving across versions. However, if a lambda function _has_ been specified when calling `rotate_secret`, it should be invoked therefore providing the developer with the full multi-stage process [3] which can be used to test the Lambda function itself and ensuring that full end-to-end testing is performed. Without this there's no easy way to configure the Secret in the state needed to provide the Lambda function with the data in the format it needs to be in at each step of the invocation process. [1]: https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-lambda-function-overview.html [2]: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/secretsmanager.html#SecretsManager.Client.rotate_secret [3]: https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-lambda-function-overview.html#rotation-explanation-of-steps * Run `black` over `secretsmanager/models.py` * Make `lambda_backends` import local to the condition * Implement `update_secret_version_stage` Allow a staging label to be moved across versions. https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/secretsmanager.html#SecretsManager.Client.update_secret_version_stage * Add an integration test for Secrets Manager & Lambda * Support passing `ClientRequestToken` to `put_secret_value` By passing `ClientRequestToken` to `put_secret_value` within the lambda function invoked by calling `rotate_secret`, one can update the value associated with the existing (pending) version, without causing a new secret version to be created. * Add application logic for `AWSPENDING` The rotation function must end with the versions of the secret in one of two states: - The `AWSPENDING` and `AWSCURRENT` staging labels are attached to the same version of the secret, or - The `AWSPENDING` staging label is not attached to any version of the secret. If the `AWSPENDING` staging label is present but not attached to the same version as `AWSCURRENT` then any later invocation of RotateSecret assumes that a previous rotation request is still in progress and returns an error. * Update `default_version_id` after Lambda rotation concludes Call `set_default_version_id` directly, rather than going through `reset_default_version` as the Lambda function is responsible for moving the version labels around, not `rotate_secret`. * Run `black` over changed files * Fix Python 2.7 compatibility * Add additional test coverage for Secrets Manager * Fix bug found by tests AWSPENDING + AWSCURRENT check wasn't using `version_stages`. Also tidy up the AWSCURRENT moving in `update_secret_version_stage` to remove AWSPREVIOUS it from the new stage. * Run `black` over changed files * Add additional `rotate_secret` tests * Skip `test_rotate_secret_lambda_invocations` in test server mode * Add test for invalid Lambda ARN
This commit is contained in:
Daniel Samuels
GitHub
parent
45167737e5
commit
a4b1498665
4 changed files with 564 additions and 15 deletions
|
|
@ -3,7 +3,7 @@ from __future__ import unicode_literals
|
|||
|
||||
import boto3
|
||||
|
||||
from moto import mock_secretsmanager
|
||||
from moto import mock_secretsmanager, mock_lambda, settings
|
||||
from botocore.exceptions import ClientError
|
||||
import string
|
||||
import pytz
|
||||
|
|
@ -628,6 +628,131 @@ def test_rotate_secret_rotation_period_too_long():
|
|||
)
|
||||
|
||||
|
||||
def get_rotation_zip_file():
|
||||
from tests.test_awslambda.test_lambda import _process_lambda
|
||||
|
||||
func_str = """
|
||||
import boto3
|
||||
import json
|
||||
|
||||
def lambda_handler(event, context):
|
||||
arn = event['SecretId']
|
||||
token = event['ClientRequestToken']
|
||||
step = event['Step']
|
||||
|
||||
client = boto3.client("secretsmanager", region_name="us-west-2", endpoint_url="http://motoserver:5000")
|
||||
metadata = client.describe_secret(SecretId=arn)
|
||||
value = client.get_secret_value(SecretId=arn, VersionId=token, VersionStage="AWSPENDING")
|
||||
|
||||
if not metadata['RotationEnabled']:
|
||||
print("Secret %s is not enabled for rotation." % arn)
|
||||
raise ValueError("Secret %s is not enabled for rotation." % arn)
|
||||
versions = metadata['VersionIdsToStages']
|
||||
if token not in versions:
|
||||
print("Secret version %s has no stage for rotation of secret %s." % (token, arn))
|
||||
raise ValueError("Secret version %s has no stage for rotation of secret %s." % (token, arn))
|
||||
if "AWSCURRENT" in versions[token]:
|
||||
print("Secret version %s already set as AWSCURRENT for secret %s." % (token, arn))
|
||||
return
|
||||
elif "AWSPENDING" not in versions[token]:
|
||||
print("Secret version %s not set as AWSPENDING for rotation of secret %s." % (token, arn))
|
||||
raise ValueError("Secret version %s not set as AWSPENDING for rotation of secret %s." % (token, arn))
|
||||
|
||||
if step == 'createSecret':
|
||||
try:
|
||||
client.get_secret_value(SecretId=arn, VersionId=token, VersionStage='AWSPENDING')
|
||||
except client.exceptions.ResourceNotFoundException:
|
||||
client.put_secret_value(
|
||||
SecretId=arn,
|
||||
ClientRequestToken=token,
|
||||
SecretString=json.dumps({'create': True}),
|
||||
VersionStages=['AWSPENDING']
|
||||
)
|
||||
|
||||
if step == 'setSecret':
|
||||
client.put_secret_value(
|
||||
SecretId=arn,
|
||||
ClientRequestToken=token,
|
||||
SecretString='UpdatedValue',
|
||||
VersionStages=["AWSPENDING"],
|
||||
)
|
||||
|
||||
elif step == 'finishSecret':
|
||||
current_version = next(
|
||||
version
|
||||
for version, stages in metadata['VersionIdsToStages'].items()
|
||||
if 'AWSCURRENT' in stages
|
||||
)
|
||||
print("current: %s new: %s" % (current_version, token))
|
||||
client.update_secret_version_stage(
|
||||
SecretId=arn,
|
||||
VersionStage='AWSCURRENT',
|
||||
MoveToVersionId=token,
|
||||
RemoveFromVersionId=current_version,
|
||||
)
|
||||
client.update_secret_version_stage(
|
||||
SecretId=arn,
|
||||
VersionStage='AWSPENDING',
|
||||
RemoveFromVersionId=token,
|
||||
)
|
||||
"""
|
||||
return _process_lambda(func_str)
|
||||
|
||||
|
||||
if settings.TEST_SERVER_MODE:
|
||||
|
||||
@mock_lambda
|
||||
@mock_secretsmanager
|
||||
def test_rotate_secret_using_lambda():
|
||||
from tests.test_awslambda.test_lambda import get_role_name
|
||||
|
||||
# Passing a `RotationLambdaARN` value to `rotate_secret` should invoke lambda
|
||||
lambda_conn = boto3.client(
|
||||
"lambda", region_name="us-west-2", endpoint_url="http://localhost:5000",
|
||||
)
|
||||
func = lambda_conn.create_function(
|
||||
FunctionName="testFunction",
|
||||
Runtime="python3.8",
|
||||
Role=get_role_name(),
|
||||
Handler="lambda_function.lambda_handler",
|
||||
Code={"ZipFile": get_rotation_zip_file()},
|
||||
Description="Secret rotator",
|
||||
Timeout=3,
|
||||
MemorySize=128,
|
||||
Publish=True,
|
||||
)
|
||||
|
||||
secrets_conn = boto3.client(
|
||||
"secretsmanager",
|
||||
region_name="us-west-2",
|
||||
endpoint_url="http://localhost:5000",
|
||||
)
|
||||
secret = secrets_conn.create_secret(
|
||||
Name=DEFAULT_SECRET_NAME, SecretString="InitialValue",
|
||||
)
|
||||
initial_version = secret["VersionId"]
|
||||
|
||||
rotated_secret = secrets_conn.rotate_secret(
|
||||
SecretId=DEFAULT_SECRET_NAME,
|
||||
RotationLambdaARN=func["FunctionArn"],
|
||||
RotationRules=dict(AutomaticallyAfterDays=30,),
|
||||
)
|
||||
|
||||
# Ensure we received an updated VersionId from `rotate_secret`
|
||||
assert rotated_secret["VersionId"] != initial_version
|
||||
|
||||
updated_secret = secrets_conn.get_secret_value(
|
||||
SecretId=DEFAULT_SECRET_NAME, VersionStage="AWSCURRENT",
|
||||
)
|
||||
rotated_version = updated_secret["VersionId"]
|
||||
|
||||
assert initial_version != rotated_version
|
||||
metadata = secrets_conn.describe_secret(SecretId=DEFAULT_SECRET_NAME)
|
||||
assert metadata["VersionIdsToStages"][initial_version] == ["AWSPREVIOUS"]
|
||||
assert metadata["VersionIdsToStages"][rotated_version] == ["AWSCURRENT"]
|
||||
assert updated_secret["SecretString"] == "UpdatedValue"
|
||||
|
||||
|
||||
@mock_secretsmanager
|
||||
def test_put_secret_value_on_non_existing_secret():
|
||||
conn = boto3.client("secretsmanager", region_name="us-west-2")
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue