VAULT-12226: Add Static Roles to the AWS plugin

builtin/logical/aws/backend.go

@@ -13,6 +13,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/sts/stsiface"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/queue"
 )
 
 const (
@@ -32,6 +33,7 @@ func Factory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend,
 
 func Backend() *backend {
 	var b backend
+	b.credRotationQueue = queue.New()
 	b.Backend = &framework.Backend{
 		Help: strings.TrimSpace(backendHelp),
 
@@ -40,7 +42,8 @@ func Backend() *backend {
 				framework.WALPrefix,
 			},
 			SealWrapStorage: []string{
-				"config/root",
+				rootConfigPath,
+				pathStaticCreds + "/",
 			},
 		},
 
@@ -50,6 +53,8 @@ func Backend() *backend {
 			pathConfigLease(&b),
 			pathRoles(&b),
 			pathListRoles(&b),
+			pathStaticRoles(&b),
+			pathStaticCredentials(&b),
 			pathUser(&b),
 		},
 
@@ -60,6 +65,7 @@ func Backend() *backend {
 		Invalidate:        b.invalidate,
 		WALRollback:       b.walRollback,
 		WALRollbackMinAge: minAwsUserRollbackAge,
+		PeriodicFunc:      b.rotateExpiredStaticCreds,
 		BackendType:       logical.TypeLogical,
 	}
 
@@ -79,6 +85,8 @@ type backend struct {
 	// to enable mocking with AWS iface for tests
 	iamClient iamiface.IAMAPI
 	stsClient stsiface.STSAPI
+
+	credRotationQueue *queue.PriorityQueue
 }
 
 const backendHelp = `

builtin/logical/aws/path_static_creds.go

@@ -0,0 +1,99 @@
+package aws
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	"github.com/fatih/structs"
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+const (
+	pathStaticCreds = "static-creds"
+
+	paramAccessKeyID      = "access_key_id"
+	paramSecretsAccessKey = "secret_access_key"
+)
+
+type awsCredentials struct {
+	AccessKeyID     string `json:"access_key_id" structs:"access_key_id" mapstructure:"access_key_id"`
+	SecretAccessKey string `json:"secret_access_key" structs:"secret_access_key" mapstructure:"secret_access_key"`
+}
+
+func pathStaticCredentials(b *backend) *framework.Path {
+	return &framework.Path{
+		Pattern: fmt.Sprintf("%s/%s", pathStaticCreds, framework.GenericNameWithAtRegex(paramRoleName)),
+		Fields: map[string]*framework.FieldSchema{
+			paramRoleName: {
+				Type:        framework.TypeString,
+				Description: descRoleName,
+			},
+		},
+
+		Operations: map[logical.Operation]framework.OperationHandler{
+			logical.ReadOperation: &framework.PathOperation{
+				Callback: b.pathStaticCredsRead,
+				Responses: map[int][]framework.Response{
+					http.StatusOK: {{
+						Description: http.StatusText(http.StatusOK),
+						Fields: map[string]*framework.FieldSchema{
+							paramAccessKeyID: {
+								Type:        framework.TypeString,
+								Description: descAccessKeyID,
+							},
+							paramSecretsAccessKey: {
+								Type:        framework.TypeString,
+								Description: descSecretAccessKey,
+							},
+						},
+					}},
+				},
+			},
+		},
+
+		HelpSynopsis:    pathStaticCredsHelpSyn,
+		HelpDescription: pathStaticCredsHelpDesc,
+	}
+}
+
+func (b *backend) pathStaticCredsRead(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	roleName, ok := data.GetOk(paramRoleName)
+	if !ok {
+		return nil, fmt.Errorf("missing '%s' parameter", paramRoleName)
+	}
+
+	entry, err := req.Storage.Get(ctx, formatCredsStoragePath(roleName.(string)))
+	if err != nil {
+		return nil, fmt.Errorf("failed to read credentials for role '%q': %w", roleName, err)
+	}
+	if entry == nil {
+		return nil, nil
+	}
+
+	var credentials awsCredentials
+	if err := entry.DecodeJSON(&credentials); err != nil {
+		return nil, fmt.Errorf("failed to decode credentials: %w", err)
+	}
+
+	return &logical.Response{
+		Data: structs.New(credentials).Map(),
+	}, nil
+}
+
+func formatCredsStoragePath(roleName string) string {
+	return fmt.Sprintf("%s/%s", pathStaticCreds, roleName)
+}
+
+const pathStaticCredsHelpSyn = `Retrieve static credentials from the named role.`
+
+const pathStaticCredsHelpDesc = `
+This path reads AWS credentials for a certain static role. The keys are rotated
+periodically according to their configuration, and will return the same password
+until they are rotated.`
+
+const (
+	descAccessKeyID     = "The access key of the AWS Credential"
+	descSecretAccessKey = "The secret key of the AWS Credential"
+)

builtin/logical/aws/path_static_creds_test.go

@@ -0,0 +1,92 @@
+package aws
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"github.com/fatih/structs"
+
+	"github.com/hashicorp/vault/sdk/framework"
+
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+// TestStaticCredsRead verifies that we can correctly read a cred that exists, and correctly _not read_
+// a cred that does not exist.
+func TestStaticCredsRead(t *testing.T) {
+	// setup
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+	bgCTX := context.Background() // for brevity later
+
+	// insert a cred to get
+	creds := &awsCredentials{
+		AccessKeyID:     "foo",
+		SecretAccessKey: "bar",
+	}
+	entry, err := logical.StorageEntryJSON(formatCredsStoragePath("test"), creds)
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = config.StorageView.Put(bgCTX, entry)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// cases
+	cases := []struct {
+		name             string
+		roleName         string
+		expectedError    error
+		expectedResponse *logical.Response
+	}{
+		{
+			name:     "get existing creds",
+			roleName: "test",
+			expectedResponse: &logical.Response{
+				Data: structs.New(creds).Map(),
+			},
+		},
+		{
+			name:     "get non-existent creds",
+			roleName: "this-doesnt-exist",
+			// returns nil, nil
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			b := Backend()
+
+			req := &logical.Request{
+				Storage: config.StorageView,
+				Data: map[string]interface{}{
+					"name": c.roleName,
+				},
+			}
+			resp, err := b.pathStaticCredsRead(bgCTX, req, staticCredsFieldData(req.Data))
+
+			if err != c.expectedError {
+				t.Fatalf("got error %q, but expected %q", err, c.expectedError)
+			}
+			if !reflect.DeepEqual(resp, c.expectedResponse) {
+				t.Fatalf("got response %v, but expected %v", resp, c.expectedResponse)
+			}
+		})
+	}
+}
+
+func staticCredsFieldData(data map[string]interface{}) *framework.FieldData {
+	schema := map[string]*framework.FieldSchema{
+		paramRoleName: {
+			Type:        framework.TypeString,
+			Description: descRoleName,
+		},
+	}
+
+	return &framework.FieldData{
+		Raw:    data,
+		Schema: schema,
+	}
+}