Add AWS Secret Engine Root Credential Rotation #5140
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This allows the AWS Secret Engine to rotate its credentials used to access AWS. This will only work when the AWS Secret Engine has been provided explicit IAM credentials via the config/root endpoint, and further, when the IAM credentials provided are the only access key on the IAM user associated wtih the access key (because AWS allows a maximum of 2 access keys per user). Fixes hashicorp#4385
Also fix a typo in the root credential rotation code
And wire the backend up in a bunch of places so the config can get the lock
joelthompson
changed the title
|
Finished the TODOs, should be ready for review! :) |
vishalnayak
reviewed
Sep 13, 2018
vishalnayak
reviewed
Sep 14, 2018
vishalnayak
previously approved these changes
Sep 14, 2018
vishalnayak
previously approved these changes
Sep 17, 2018
|
This isn't ready to merge yet. The addition of the client caching and locking significantly complicates things here, and I'm worried the simple solution is vulnerable to a deadlock, so need to think this through more thoroughly. |
joelthompson
commented
Sep 21, 2018
| _, err = client.DeleteAccessKey(&deleteAccessKeyInput) | ||
| if err != nil { | ||
| return nil, errwrap.Wrapf("error deleting old access key: {{err}}", err) | ||
| } |
There was a problem hiding this comment.
Should this just be a warning response instead of returning an err? In this event, the access key was successfully rotated, but it just failed to clean up.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This will only work when the AWS Secret Engine has been
provided explicit IAM credentials via the config/root endpoint, and
further, when the IAM credentials provided are the only access key on
the IAM user associated wtih the access key (because AWS allows a
maximum of 2 access keys per user).
TODO:
I'm a bit unclear about Seal Wrapping -- I think I don't need to do anything special here, and
SealWrapStoragerefers to paths in storage, but let me know if this assumption is wrong.Fixes #4385