Feature: Secrets Manager put_secret_value and list_secret_version_ids (#2116)
* initial work - adding put_secret_value and list_secret_versions * Added support for versions in all functions except rotate_secret * more work - refactor rotate_secret method - now, adds a new version of the secret and points default version id to it - updated implementation coverage readme - element in list check to fix unit test - fixed linting errors - added tests, fixed exception, failing tests still - secrets_manager/test_server fails when running whole suite, but not when running that individual test file * fixed failing test_get_secret_value * Removed test.py. Fixed condition statement. * fixed default stages + adding AWSPREVIOUS * remove old AWSPREVIOUS stages
This commit is contained in:
Justin Kieber-King
Terry Cain
parent
8f4c273095
commit
bbd7fefb37
6 changed files with 425 additions and 82 deletions
|
|
@ -29,6 +29,14 @@ class InvalidParameterException(SecretsManagerClientError):
|
|||
message)
|
||||
|
||||
|
||||
class ResourceExistsException(SecretsManagerClientError):
|
||||
def __init__(self, message):
|
||||
super(ResourceExistsException, self).__init__(
|
||||
'ResourceExistsException',
|
||||
message
|
||||
)
|
||||
|
||||
|
||||
class InvalidRequestException(SecretsManagerClientError):
|
||||
def __init__(self, message):
|
||||
super(InvalidRequestException, self).__init__(
|
||||
|
|
|
|||
|
|
@ -11,6 +11,7 @@ from moto.core import BaseBackend, BaseModel
|
|||
from .exceptions import (
|
||||
ResourceNotFoundException,
|
||||
InvalidParameterException,
|
||||
ResourceExistsException,
|
||||
InvalidRequestException,
|
||||
ClientError
|
||||
)
|
||||
|
|
@ -47,6 +48,17 @@ class SecretsManagerBackend(BaseBackend):
|
|||
if not self._is_valid_identifier(secret_id):
|
||||
raise ResourceNotFoundException()
|
||||
|
||||
if not version_id and version_stage:
|
||||
# set version_id to match version_stage
|
||||
versions_dict = self.secrets[secret_id]['versions']
|
||||
for ver_id, ver_val in versions_dict.items():
|
||||
if version_stage in ver_val['version_stages']:
|
||||
version_id = ver_id
|
||||
break
|
||||
if not version_id:
|
||||
raise ResourceNotFoundException()
|
||||
|
||||
# TODO check this part
|
||||
if 'deleted_date' in self.secrets[secret_id]:
|
||||
raise InvalidRequestException(
|
||||
"An error occurred (InvalidRequestException) when calling the GetSecretValue operation: You tried to \
|
||||
|
|
@ -54,42 +66,91 @@ class SecretsManagerBackend(BaseBackend):
|
|||
)
|
||||
|
||||
secret = self.secrets[secret_id]
|
||||
version_id = version_id or secret['default_version_id']
|
||||
|
||||
secret_version = secret['versions'][version_id]
|
||||
|
||||
response = json.dumps({
|
||||
"ARN": secret_arn(self.region, secret['secret_id']),
|
||||
"Name": secret['name'],
|
||||
"VersionId": secret['version_id'],
|
||||
"SecretString": secret['secret_string'],
|
||||
"VersionStages": [
|
||||
"AWSCURRENT",
|
||||
],
|
||||
"CreatedDate": secret['createdate']
|
||||
"VersionId": secret_version['version_id'],
|
||||
"SecretString": secret_version['secret_string'],
|
||||
"VersionStages": secret_version['version_stages'],
|
||||
"CreatedDate": secret_version['createdate'],
|
||||
})
|
||||
|
||||
return response
|
||||
|
||||
def create_secret(self, name, secret_string, tags, **kwargs):
|
||||
|
||||
generated_version_id = str(uuid.uuid4())
|
||||
# error if secret exists
|
||||
if name in self.secrets.keys():
|
||||
raise ResourceExistsException('A resource with the ID you requested already exists.')
|
||||
|
||||
secret = {
|
||||
'secret_string': secret_string,
|
||||
'secret_id': name,
|
||||
'name': name,
|
||||
'createdate': int(time.time()),
|
||||
'rotation_enabled': False,
|
||||
'rotation_lambda_arn': '',
|
||||
'auto_rotate_after_days': 0,
|
||||
'version_id': generated_version_id,
|
||||
'tags': tags
|
||||
}
|
||||
|
||||
self.secrets[name] = secret
|
||||
version_id = self._add_secret(name, secret_string, tags=tags)
|
||||
|
||||
response = json.dumps({
|
||||
"ARN": secret_arn(self.region, name),
|
||||
"Name": name,
|
||||
"VersionId": generated_version_id,
|
||||
"VersionId": version_id,
|
||||
})
|
||||
|
||||
return response
|
||||
|
||||
def _add_secret(self, secret_id, secret_string, tags=[], version_id=None, version_stages=None):
|
||||
|
||||
if version_stages is None:
|
||||
version_stages = ['AWSCURRENT']
|
||||
|
||||
if not version_id:
|
||||
version_id = str(uuid.uuid4())
|
||||
|
||||
secret_version = {
|
||||
'secret_string': secret_string,
|
||||
'createdate': int(time.time()),
|
||||
'version_id': version_id,
|
||||
'version_stages': version_stages,
|
||||
}
|
||||
|
||||
if secret_id in self.secrets:
|
||||
# remove all old AWSPREVIOUS stages
|
||||
for secret_verion_to_look_at in self.secrets[secret_id]['versions'].values():
|
||||
if 'AWSPREVIOUS' in secret_verion_to_look_at['version_stages']:
|
||||
secret_verion_to_look_at['version_stages'].remove('AWSPREVIOUS')
|
||||
|
||||
# set old AWSCURRENT secret to AWSPREVIOUS
|
||||
previous_current_version_id = self.secrets[secret_id]['default_version_id']
|
||||
self.secrets[secret_id]['versions'][previous_current_version_id]['version_stages'] = ['AWSPREVIOUS']
|
||||
|
||||
self.secrets[secret_id]['versions'][version_id] = secret_version
|
||||
self.secrets[secret_id]['default_version_id'] = version_id
|
||||
else:
|
||||
self.secrets[secret_id] = {
|
||||
'versions': {
|
||||
version_id: secret_version
|
||||
},
|
||||
'default_version_id': version_id,
|
||||
}
|
||||
|
||||
secret = self.secrets[secret_id]
|
||||
secret['secret_id'] = secret_id
|
||||
secret['name'] = secret_id
|
||||
secret['rotation_enabled'] = False
|
||||
secret['rotation_lambda_arn'] = ''
|
||||
secret['auto_rotate_after_days'] = 0
|
||||
secret['tags'] = tags
|
||||
|
||||
return version_id
|
||||
|
||||
def put_secret_value(self, secret_id, secret_string, version_stages):
|
||||
|
||||
version_id = self._add_secret(secret_id, secret_string, version_stages=version_stages)
|
||||
|
||||
response = json.dumps({
|
||||
'ARN': secret_arn(self.region, secret_id),
|
||||
'Name': secret_id,
|
||||
'VersionId': version_id,
|
||||
'VersionStages': version_stages
|
||||
})
|
||||
|
||||
return response
|
||||
|
|
@ -162,17 +223,24 @@ class SecretsManagerBackend(BaseBackend):
|
|||
|
||||
secret = self.secrets[secret_id]
|
||||
|
||||
secret['version_id'] = client_request_token or ''
|
||||
old_secret_version = secret['versions'][secret['default_version_id']]
|
||||
new_version_id = client_request_token or str(uuid.uuid4())
|
||||
|
||||
self._add_secret(secret_id, old_secret_version['secret_string'], secret['tags'], version_id=new_version_id, version_stages=['AWSCURRENT'])
|
||||
|
||||
secret['rotation_lambda_arn'] = rotation_lambda_arn or ''
|
||||
if rotation_rules:
|
||||
secret['auto_rotate_after_days'] = rotation_rules.get(rotation_days, 0)
|
||||
if secret['auto_rotate_after_days'] > 0:
|
||||
secret['rotation_enabled'] = True
|
||||
|
||||
if 'AWSCURRENT' in old_secret_version['version_stages']:
|
||||
old_secret_version['version_stages'].remove('AWSCURRENT')
|
||||
|
||||
response = json.dumps({
|
||||
"ARN": secret_arn(self.region, secret['secret_id']),
|
||||
"Name": secret['name'],
|
||||
"VersionId": secret['version_id']
|
||||
"VersionId": new_version_id
|
||||
})
|
||||
|
||||
return response
|
||||
|
|
@ -206,28 +274,54 @@ class SecretsManagerBackend(BaseBackend):
|
|||
|
||||
return response
|
||||
|
||||
def list_secret_version_ids(self, secret_id):
|
||||
secret = self.secrets[secret_id]
|
||||
|
||||
version_list = []
|
||||
for version_id, version in secret['versions'].items():
|
||||
version_list.append({
|
||||
'CreatedDate': int(time.time()),
|
||||
'LastAccessedDate': int(time.time()),
|
||||
'VersionId': version_id,
|
||||
'VersionStages': version['version_stages'],
|
||||
})
|
||||
|
||||
response = json.dumps({
|
||||
'ARN': secret['secret_id'],
|
||||
'Name': secret['name'],
|
||||
'NextToken': '',
|
||||
'Versions': version_list,
|
||||
})
|
||||
|
||||
return response
|
||||
|
||||
def list_secrets(self, max_results, next_token):
|
||||
# TODO implement pagination and limits
|
||||
|
||||
secret_list = [{
|
||||
"ARN": secret_arn(self.region, secret['secret_id']),
|
||||
"DeletedDate": secret.get('deleted_date', None),
|
||||
"Description": "",
|
||||
"KmsKeyId": "",
|
||||
"LastAccessedDate": None,
|
||||
"LastChangedDate": None,
|
||||
"LastRotatedDate": None,
|
||||
"Name": secret['name'],
|
||||
"RotationEnabled": secret['rotation_enabled'],
|
||||
"RotationLambdaARN": secret['rotation_lambda_arn'],
|
||||
"RotationRules": {
|
||||
"AutomaticallyAfterDays": secret['auto_rotate_after_days']
|
||||
},
|
||||
"SecretVersionsToStages": {
|
||||
secret['version_id']: ["AWSCURRENT"]
|
||||
},
|
||||
"Tags": secret['tags']
|
||||
} for secret in self.secrets.values()]
|
||||
secret_list = []
|
||||
for secret in self.secrets.values():
|
||||
|
||||
versions_to_stages = {}
|
||||
for version_id, version in secret['versions'].items():
|
||||
versions_to_stages[version_id] = version['version_stages']
|
||||
|
||||
secret_list.append({
|
||||
"ARN": secret_arn(self.region, secret['secret_id']),
|
||||
"DeletedDate": secret.get('deleted_date', None),
|
||||
"Description": "",
|
||||
"KmsKeyId": "",
|
||||
"LastAccessedDate": None,
|
||||
"LastChangedDate": None,
|
||||
"LastRotatedDate": None,
|
||||
"Name": secret['name'],
|
||||
"RotationEnabled": secret['rotation_enabled'],
|
||||
"RotationLambdaARN": secret['rotation_lambda_arn'],
|
||||
"RotationRules": {
|
||||
"AutomaticallyAfterDays": secret['auto_rotate_after_days']
|
||||
},
|
||||
"SecretVersionsToStages": versions_to_stages,
|
||||
"Tags": secret['tags']
|
||||
})
|
||||
|
||||
return secret_list, None
|
||||
|
||||
|
|
|
|||
|
|
@ -67,6 +67,22 @@ class SecretsManagerResponse(BaseResponse):
|
|||
rotation_rules=rotation_rules
|
||||
)
|
||||
|
||||
def put_secret_value(self):
|
||||
secret_id = self._get_param('SecretId', if_none='')
|
||||
secret_string = self._get_param('SecretString', if_none='')
|
||||
version_stages = self._get_param('VersionStages', if_none=['AWSCURRENT'])
|
||||
return secretsmanager_backends[self.region].put_secret_value(
|
||||
secret_id=secret_id,
|
||||
secret_string=secret_string,
|
||||
version_stages=version_stages,
|
||||
)
|
||||
|
||||
def list_secret_version_ids(self):
|
||||
secret_id = self._get_param('SecretId', if_none='')
|
||||
return secretsmanager_backends[self.region].list_secret_version_ids(
|
||||
secret_id=secret_id
|
||||
)
|
||||
|
||||
def list_secrets(self):
|
||||
max_results = self._get_int_param("MaxResults")
|
||||
next_token = self._get_param("NextToken")
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue