|
| 1 | +# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. |
| 2 | +# |
| 3 | +# Licensed under the Apache License, Version 2.0 (the "License"). |
| 4 | +# You may not use this file except in compliance with the License. |
| 5 | +# You may obtain a copy of the License at |
| 6 | +# |
| 7 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +# |
| 9 | +# Unless required by applicable law or agreed to in writing, software |
| 10 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +# See the License for the specific language governing permissions and |
| 13 | +# limitations under the License. |
| 14 | + |
| 15 | +from __future__ import annotations |
| 16 | + |
| 17 | +from typing import TYPE_CHECKING |
| 18 | + |
| 19 | +if TYPE_CHECKING: |
| 20 | + from boto3 import Session |
| 21 | + from aws_wrapper.hostinfo import HostInfo |
| 22 | + from aws_wrapper.pep249 import Connection |
| 23 | + from aws_wrapper.plugin_service import PluginService |
| 24 | + |
| 25 | +from json import loads |
| 26 | +from logging import getLogger |
| 27 | +from re import search |
| 28 | +from types import SimpleNamespace |
| 29 | +from typing import Callable, Dict, Optional, Set, Tuple |
| 30 | + |
| 31 | +import boto3 |
| 32 | +from botocore.exceptions import ClientError |
| 33 | + |
| 34 | +from aws_wrapper.errors import AwsWrapperError |
| 35 | +from aws_wrapper.plugin import Plugin, PluginFactory |
| 36 | +from aws_wrapper.utils.messages import Messages |
| 37 | +from aws_wrapper.utils.properties import Properties, WrapperProperties |
| 38 | + |
| 39 | +logger = getLogger(__name__) |
| 40 | + |
| 41 | + |
| 42 | +class AwsSecretsManagerPlugin(Plugin): |
| 43 | + _SUBSCRIBED_METHODS: Set[str] = {"connect", "force_connect"} |
| 44 | + |
| 45 | + _SECRETS_ARN_PATTERN = r"^arn:aws:secretsmanager:(?P<region>[^:\n]*):[^:\n]*:([^:/\n]*[:/])?(.*)$" |
| 46 | + |
| 47 | + _secrets_cache: Dict[Tuple, SimpleNamespace] = {} |
| 48 | + _secret_key: Tuple = () |
| 49 | + |
| 50 | + @property |
| 51 | + def subscribed_methods(self) -> Set[str]: |
| 52 | + return self._SUBSCRIBED_METHODS |
| 53 | + |
| 54 | + def __init__(self, plugin_service: PluginService, props: Properties, session: Optional[Session] = None): |
| 55 | + self._plugin_service = plugin_service |
| 56 | + self._session = session |
| 57 | + |
| 58 | + secret_id = WrapperProperties.SECRETS_MANAGER_SECRET_ID.get(props) |
| 59 | + if not secret_id: |
| 60 | + raise AwsWrapperError( |
| 61 | + Messages.get_formatted("AwsSecretsManagerPlugin.MissingRequiredConfigParameter", |
| 62 | + WrapperProperties.SECRETS_MANAGER_SECRET_ID.name)) |
| 63 | + |
| 64 | + region: str = self._get_rds_region(secret_id, props) |
| 65 | + |
| 66 | + self._secret_key: Tuple = (secret_id, region) |
| 67 | + |
| 68 | + def connect(self, host_info: HostInfo, props: Properties, initial: bool, connect_func: Callable) -> Connection: |
| 69 | + return self._connect(props, connect_func) |
| 70 | + |
| 71 | + def force_connect(self, host_info: HostInfo, props: Properties, initial: bool, |
| 72 | + force_connect_func: Callable) -> Connection: |
| 73 | + return self._connect(props, force_connect_func) |
| 74 | + |
| 75 | + def _connect(self, props: Properties, connect_func: Callable) -> Connection: |
| 76 | + secret_fetched: bool = self._update_secret() |
| 77 | + |
| 78 | + try: |
| 79 | + self._apply_secret_to_properties(props) |
| 80 | + return connect_func() |
| 81 | + |
| 82 | + except Exception as e: |
| 83 | + if not self._plugin_service.is_login_exception(error=e) or secret_fetched: |
| 84 | + raise AwsWrapperError( |
| 85 | + Messages.get_formatted("AwsSecretsManagerPlugin.ConnectException", e)) from e |
| 86 | + |
| 87 | + secret_fetched = self._update_secret(True) |
| 88 | + |
| 89 | + if secret_fetched: |
| 90 | + try: |
| 91 | + self._apply_secret_to_properties(props) |
| 92 | + return connect_func() |
| 93 | + except Exception as unhandled_error: |
| 94 | + raise AwsWrapperError( |
| 95 | + Messages.get_formatted("AwsSecretsManagerPlugin.UnhandledException", |
| 96 | + unhandled_error)) from unhandled_error |
| 97 | + raise AwsWrapperError(Messages.get_formatted("AwsSecretsManagerPlugin.FailedLogin", e)) from e |
| 98 | + |
| 99 | + def _update_secret(self, force_refetch: bool = False) -> bool: |
| 100 | + fetched: bool = False |
| 101 | + |
| 102 | + self._secret: Optional[SimpleNamespace] = AwsSecretsManagerPlugin._secrets_cache.get(self._secret_key) |
| 103 | + |
| 104 | + if not self._secret or force_refetch: |
| 105 | + try: |
| 106 | + self._secret = self._fetch_latest_credentials() |
| 107 | + if self._secret: |
| 108 | + AwsSecretsManagerPlugin._secrets_cache[self._secret_key] = self._secret |
| 109 | + fetched = True |
| 110 | + except (ClientError, AttributeError) as e: |
| 111 | + logger.debug(Messages.get_formatted("AwsSecretsManagerPlugin.FailedToFetchDbCredentials", e)) |
| 112 | + raise AwsWrapperError( |
| 113 | + Messages.get_formatted("AwsSecretsManagerPlugin.FailedToFetchDbCredentials", e)) from e |
| 114 | + |
| 115 | + return fetched |
| 116 | + |
| 117 | + def _fetch_latest_credentials(self): |
| 118 | + session = self._session if self._session else boto3.Session() |
| 119 | + client = session.client( |
| 120 | + 'secretsmanager', |
| 121 | + region_name=self._secret_key[1], |
| 122 | + ) |
| 123 | + |
| 124 | + secret = client.get_secret_value( |
| 125 | + SecretId=self._secret_key[0], |
| 126 | + ) |
| 127 | + |
| 128 | + client.close() |
| 129 | + |
| 130 | + return loads(secret.get("SecretString"), object_hook=lambda d: SimpleNamespace(**d)) |
| 131 | + |
| 132 | + def _apply_secret_to_properties(self, properties: Properties): |
| 133 | + if self._secret: |
| 134 | + WrapperProperties.USER.set(properties, self._secret.username) |
| 135 | + WrapperProperties.PASSWORD.set(properties, self._secret.password) |
| 136 | + |
| 137 | + def _get_rds_region(self, secret_id: str, props: Properties) -> str: |
| 138 | + region: Optional[str] = props.get(WrapperProperties.SECRETS_MANAGER_REGION.name) |
| 139 | + if not region: |
| 140 | + match = search(self._SECRETS_ARN_PATTERN, secret_id) |
| 141 | + if match: |
| 142 | + region = match.group("region") |
| 143 | + else: |
| 144 | + raise AwsWrapperError( |
| 145 | + Messages.get_formatted("AwsSecretsManagerPlugin.MissingRequiredConfigParameter", |
| 146 | + WrapperProperties.SECRETS_MANAGER_REGION.name)) |
| 147 | + |
| 148 | + session = self._session if self._session else boto3.Session() |
| 149 | + if region not in session.get_available_regions("rds"): |
| 150 | + exception_message = Messages.get_formatted("AwsSdk.UnsupportedRegion", region) |
| 151 | + logger.debug(exception_message) |
| 152 | + raise AwsWrapperError(exception_message) |
| 153 | + |
| 154 | + return region |
| 155 | + |
| 156 | + |
| 157 | +class AwsSecretsManagerPluginFactory(PluginFactory): |
| 158 | + def get_instance(self, plugin_service: PluginService, props: Properties) -> Plugin: |
| 159 | + return AwsSecretsManagerPlugin(plugin_service, props) |
0 commit comments