Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport 1.8.x: Fix auth/aws so that config/rotate-root saves new key pair #12866

Merged
merged 2 commits into from
Oct 19, 2021
Merged

Backport 1.8.x: Fix auth/aws so that config/rotate-root saves new key pair #12866

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3c6b813
Fix auth/aws so that config/rotate-root saves new key pair to vault (…
ludewigh Oct 19, 2021
282f1dc
go get & go mod tidy
jasonodonnell Oct 19, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
8 changes: 4 additions & 4 deletions builtin/credential/aws/path_config_rotate_root.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,10 @@ func (b *backend) pathConfigRotateRootUpdate(ctx context.Context, req *logical.R
}
}()

oldAccessKey := clientConf.AccessKey
clientConf.AccessKey = *createAccessKeyRes.AccessKey.AccessKeyId
clientConf.SecretKey = *createAccessKeyRes.AccessKey.SecretAccessKey

// Now get ready to update storage, doing everything beforehand so we can minimize how long
// we need to hold onto the lock.
newEntry, err := b.configClientToEntry(clientConf)
Expand All @@ -153,10 +157,6 @@ func (b *backend) pathConfigRotateRootUpdate(ctx context.Context, req *logical.R
return nil, errs
}

oldAccessKey := clientConf.AccessKey
clientConf.AccessKey = *createAccessKeyRes.AccessKey.AccessKeyId
clientConf.SecretKey = *createAccessKeyRes.AccessKey.SecretAccessKey

// Someday we may want to allow the user to send a number of seconds to wait here
// before deleting the previous access key to allow work to complete. That would allow
// AWS, which is eventually consistent, to finish populating the new key in all places.
Expand Down
22 changes: 11 additions & 11 deletions builtin/credential/aws/path_config_rotate_root_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,12 @@ package awsauth
import (
"context"
"testing"
"time"

"github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/session"
"github.com/aws/aws-sdk-go/service/iam"
"github.com/aws/aws-sdk-go/service/iam/iamiface"
"github.com/hashicorp/go-hclog"
"github.com/hashicorp/vault/sdk/helper/awsutil"
"github.com/hashicorp/go-secure-stdlib/awsutil"
"github.com/hashicorp/vault/sdk/logical"
)

Expand All @@ -33,15 +31,13 @@ func TestPathConfigRotateRoot(t *testing.T) {
}

ctx := context.Background()
config := logical.TestBackendConfig()
logical.TestBackendConfig()
storage := &logical.InmemStorage{}
b, err := Factory(ctx, &logical.BackendConfig{
StorageView: storage,
Logger: hclog.Default(),
System: &logical.StaticSystemView{
DefaultLeaseTTLVal: time.Hour,
MaxLeaseTTLVal: time.Hour,
},
})
config.StorageView = storage

b, err := Backend(config)

if err != nil {
t.Fatal(err)
}
Expand Down Expand Up @@ -76,4 +72,8 @@ func TestPathConfigRotateRoot(t *testing.T) {
if resp.Data["access_key"].(string) != "fizz2" {
t.Fatalf("expected new access key buzz2 but received %s", resp.Data["access_key"])
}
newClientConf, err := b.nonLockedClientConfigEntry(ctx, req.Storage)
if resp.Data["access_key"].(string) != newClientConf.AccessKey {
t.Fatalf("expected new access key buzz2 to be saved to storage but receieved %s", clientConf.AccessKey)
}
}
3 changes: 3 additions & 0 deletions changelog/12715.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:bug
auth/aws: fix config/rotate-root to store new key
```
1 change: 1 addition & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,7 @@ require (
github.com/hashicorp/go-raftchunking v0.6.3-0.20191002164813-7e9e8525653a
github.com/hashicorp/go-retryablehttp v0.6.7
github.com/hashicorp/go-rootcerts v1.0.2
github.com/hashicorp/go-secure-stdlib/awsutil v0.1.2
github.com/hashicorp/go-sockaddr v1.0.2
github.com/hashicorp/go-syslog v1.0.0
github.com/hashicorp/go-uuid v1.0.2
Expand Down