mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-18 21:21:06 +02:00
0510b7ec35
* logical/aws: Harden WAL entry creation If AWS IAM user creation failed in any way, the WAL corresponding to the IAM user would get left around and Vault would try to roll it back. However, because the user never existed, the rollback failed. Thus, the WAL would essentially get "stuck" and Vault would continually attempt to roll it back, failing every time. A similar situation could arise if the IAM user that Vault created got deleted out of band, or if Vault deleted it but was unable to write the lease revocation back to storage (e.g., a storage failure). This attempts to harden it in two ways. One is by deleting the WAL log entry if the IAM user creation fails. However, the WAL deletion could still fail, and this wouldn't help where the user is deleted out of band, so second, consider the user rolled back if the user just doesn't exist, under certain circumstances. Fixes #5190 * Fix segfault in expiration unit tests TestExpiration_Tidy was passing in a leaseEntry that had a nil Secret, which then caused a segfault as the changes to revokeEntry didn't check whether Secret was nil; this is probably unlikely to occur in real life, but good to be extra cautious. * Fix potential segfault Missed the else... * Respond to PR feedback
140 lines
3.2 KiB
Go
140 lines
3.2 KiB
Go
package aws
|
|
|
|
import (
|
|
"context"
|
|
"strings"
|
|
"sync"
|
|
"time"
|
|
|
|
"github.com/aws/aws-sdk-go/service/iam/iamiface"
|
|
"github.com/aws/aws-sdk-go/service/sts/stsiface"
|
|
"github.com/hashicorp/vault/logical"
|
|
"github.com/hashicorp/vault/logical/framework"
|
|
)
|
|
|
|
func Factory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend, error) {
|
|
b := Backend()
|
|
if err := b.Setup(ctx, conf); err != nil {
|
|
return nil, err
|
|
}
|
|
return b, nil
|
|
}
|
|
|
|
func Backend() *backend {
|
|
var b backend
|
|
b.Backend = &framework.Backend{
|
|
Help: strings.TrimSpace(backendHelp),
|
|
|
|
PathsSpecial: &logical.Paths{
|
|
LocalStorage: []string{
|
|
framework.WALPrefix,
|
|
},
|
|
SealWrapStorage: []string{
|
|
"config/root",
|
|
},
|
|
},
|
|
|
|
Paths: []*framework.Path{
|
|
pathConfigRoot(&b),
|
|
pathConfigRotateRoot(&b),
|
|
pathConfigLease(&b),
|
|
pathRoles(&b),
|
|
pathListRoles(&b),
|
|
pathUser(&b),
|
|
},
|
|
|
|
Secrets: []*framework.Secret{
|
|
secretAccessKeys(&b),
|
|
},
|
|
|
|
WALRollback: b.walRollback,
|
|
WALRollbackMinAge: minAwsUserRollbackAge,
|
|
BackendType: logical.TypeLogical,
|
|
}
|
|
|
|
return &b
|
|
}
|
|
|
|
type backend struct {
|
|
*framework.Backend
|
|
|
|
// Mutex to protect access to reading and writing policies
|
|
roleMutex sync.RWMutex
|
|
|
|
// Mutex to protect access to iam/sts clients and client configs
|
|
clientMutex sync.RWMutex
|
|
|
|
// iamClient and stsClient hold configured iam and sts clients for reuse, and
|
|
// to enable mocking with AWS iface for tests
|
|
iamClient iamiface.IAMAPI
|
|
stsClient stsiface.STSAPI
|
|
}
|
|
|
|
const backendHelp = `
|
|
The AWS backend dynamically generates AWS access keys for a set of
|
|
IAM policies. The AWS access keys have a configurable lease set and
|
|
are automatically revoked at the end of the lease.
|
|
|
|
After mounting this backend, credentials to generate IAM keys must
|
|
be configured with the "root" path and policies must be written using
|
|
the "roles/" endpoints before any access keys can be generated.
|
|
`
|
|
|
|
// clientIAM returns the configured IAM client. If nil, it constructs a new one
|
|
// and returns it, setting it the internal variable
|
|
func (b *backend) clientIAM(ctx context.Context, s logical.Storage) (iamiface.IAMAPI, error) {
|
|
b.clientMutex.RLock()
|
|
if b.iamClient != nil {
|
|
b.clientMutex.RUnlock()
|
|
return b.iamClient, nil
|
|
}
|
|
|
|
// Upgrade the lock for writing
|
|
b.clientMutex.RUnlock()
|
|
b.clientMutex.Lock()
|
|
defer b.clientMutex.Unlock()
|
|
|
|
// check client again, in the event that a client was being created while we
|
|
// waited for Lock()
|
|
if b.iamClient != nil {
|
|
return b.iamClient, nil
|
|
}
|
|
|
|
iamClient, err := nonCachedClientIAM(ctx, s)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
b.iamClient = iamClient
|
|
|
|
return b.iamClient, nil
|
|
}
|
|
|
|
func (b *backend) clientSTS(ctx context.Context, s logical.Storage) (stsiface.STSAPI, error) {
|
|
b.clientMutex.RLock()
|
|
if b.stsClient != nil {
|
|
b.clientMutex.RUnlock()
|
|
return b.stsClient, nil
|
|
}
|
|
|
|
// Upgrade the lock for writing
|
|
b.clientMutex.RUnlock()
|
|
b.clientMutex.Lock()
|
|
defer b.clientMutex.Unlock()
|
|
|
|
// check client again, in the event that a client was being created while we
|
|
// waited for Lock()
|
|
if b.stsClient != nil {
|
|
return b.stsClient, nil
|
|
}
|
|
|
|
stsClient, err := nonCachedClientSTS(ctx, s)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
b.stsClient = stsClient
|
|
|
|
return b.stsClient, nil
|
|
}
|
|
|
|
const minAwsUserRollbackAge = 5 * time.Minute
|