handler

README

concourse-sts-lambda

Lambda function to rotate AWS credentials used by Concourse teams. See the terraform subdirectory for an example that should work (with minimal effort).

Why?

Our CI/CD (in our case Concourse) needs AWS credentials to deploy Terraform templates. Since we are sharing workers between teams, the instance profile itself has no privileges. And so, we need to pass in credentials to the tasks which require them.

Instead of having individual teams being responsible for their CI credentials, we can use this Lambda function to write temporary credentials to a specific teams Concourse secrets, for one or more accounts.

How?

In short:

1. This Lambda function is deployed to the same account as our Concourse.
2. Individual accounts add a CI role with the Lambda functions execution role as a trusted entity.
3. A team adds a CloudWatch event rule with the configuration for which accounts they need access to.
4. Lambda assumes the roles specified in the configuration and rotates the temporary AWS credentials for said team on a 50min schedule.
5. ???
6. Profit.

Usage

Be in the root directory:

make release

You should now have a zipped Lambda function. Next, edit terraform/example.tf to your liking. When done, be in the terraform directory:

terraform init
terraform apply

NOTE: The aws/secretsmanager KMS Key Alias has to be created/exist before the lambda is deployed.

Team configuration

Example configuration for a Team (which is then passed as input in the CloudWatch event rule):

{
  "name": "example-team",
  "accounts": [{
    "name": "divx-lab",
    "roleArn": "arn:aws:iam::123456789999:role/machine-user-example"
  }]
}

You can also optionally specify the duration the sts assume role call should use:

{
  "name": "example-team",
  "accounts": [{
    "name": "divx-lab",
    "roleArn": "arn:aws:iam::123456789999:role/machine-user-example",
    "duration": 7200
  }]
}

Note: Role chaining has a limit on duration to be maximum 1 hour.

When the function is triggered with this input it will assume the roleArn, and write the credentials to (by default):

• /concourse/example-team/divx-lab-access-key
• /concourse/example-team/divx-lab-secret-key
• /concourse/example-team/divx-lab-session-token

Note that you can have multiple accounts, in which case the account name must be unique to avoid overwriting the secrets in Secrets manager.

Documentation

Index

• func New(manager *Manager, secretTemplate string, logger *logrus.Logger) func(Configuration) error
• type Account
• type Configuration
• type Manager
  • func NewManager(sess *session.Session) *Manager
  • func NewTestManager(sm SecretsClient, sts STSClient, s3 S3Client) *Manager
  • func (m *Manager) AssumeRole(arn, team string, duration int64) (*sts.Credentials, error)
  • func (m *Manager) ReadConfig(bucket, key string) (*Team, error)
  • func (m *Manager) WriteCredentials(creds *sts.Credentials, path string) error
• type S3Client
• type STSClient
• type SecretPath
  • func NewSecretPath(team, account, template string) *SecretPath
  • func (p *SecretPath) String() (string, error)
• type SecretsClient
• type Team

Functions

func New

func New(manager *Manager, secretTemplate string, logger *logrus.Logger) func(Configuration) error

New lambda handler with the provided settings.

Types

type Account

type Account struct {
	Name     string `json:"name"`
	RoleArn  string `json:"roleArn"`
	Duration int64  `json:"duration"`
}

Account represents the configuration for an assumable role.

type Configuration

type Configuration struct {
	Bucket string `json:"bucket"`
	Key    string `json:"key"`
}

Configuration passed to the Lambda, pointing to an S3 object with the team configuration.

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

Manager handles API calls to AWS.

func NewManager

func NewManager(sess *session.Session) *Manager

NewManager creates a new manager from an existing AWS session.

func NewTestManager

func NewTestManager(sm SecretsClient, sts STSClient, s3 S3Client) *Manager

NewTestManager ...

func (*Manager) AssumeRole

func (m *Manager) AssumeRole(arn, team string, duration int64) (*sts.Credentials, error)

AssumeRole on the given role ARN and the given team name (identifier).

func (*Manager) ReadConfig

func (m *Manager) ReadConfig(bucket, key string) (*Team, error)

ReadConfig from S3.

func (*Manager) WriteCredentials

func (m *Manager) WriteCredentials(creds *sts.Credentials, path string) error

WriteCredentials handles writing a set of Credentials to the parameter store.

type S3Client

type S3Client s3iface.S3API

S3Client for testing purposes.

type STSClient

type STSClient stsiface.STSAPI

STSClient for testing purposes.

type SecretPath

type SecretPath struct {
	Team     string
	Account  string
	Template string
}

SecretPath represents the path used to write secrets into Secrets manager.

func NewSecretPath

func NewSecretPath(team, account, template string) *SecretPath

NewSecretPath ...

func (*SecretPath) String

func (p *SecretPath) String() (string, error)

type SecretsClient

type SecretsClient secretsmanageriface.SecretsManagerAPI

SecretsClient for testing purposes.

type Team

type Team struct {
	Name     string     `json:"name"`
	Accounts []*Account `json:"accounts"`
}

Team represents the configuration for a single team.