-
Notifications
You must be signed in to change notification settings - Fork 16
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: limit access to S3 by VPC ID (#1829)
* feat: changes to implement alternative number 1 [#187430076](https://www.pivotaltracker.com/story/show/187430076) * chore: analysis to create a debate [#187430076](https://www.pivotaltracker.com/story/show/187430076) * chore: improve readability [#187430076](https://www.pivotaltracker.com/story/show/187430076) * chore: add alternative for use case number 2 [#187430076](https://www.pivotaltracker.com/story/show/187430076) * chore: minor adjustment [#187430076](https://www.pivotaltracker.com/story/show/187430076) * fix: incorrect format [#187430076](https://www.pivotaltracker.com/story/show/187430076) * chore: small improvements [#187430076](https://www.pivotaltracker.com/story/show/187430076) * fix: close quotes [#187430076](https://www.pivotaltracker.com/story/show/187430076) * fix: format [#187430076](https://www.pivotaltracker.com/story/show/187430076) * fix: format when adding image [#187430076](https://www.pivotaltracker.com/story/show/187430076) * fix: error when adding the image [#187430076](https://www.pivotaltracker.com/story/show/187430076) * feat: Limit access to S3 buckets by VPC ID [#187430076](https://www.pivotaltracker.com/story/show/187430076) * test: new property in binding [#187430076](https://www.pivotaltracker.com/story/show/187430076) * test: new variable is required [#187430076](https://www.pivotaltracker.com/story/show/187430076) * test: change package name [#187430076](https://www.pivotaltracker.com/story/show/187430076) * chore: remove unexpected arn user [#187430076](https://www.pivotaltracker.com/story/show/187430076) * chore: be generic and let users decide what level of security is needed [#187430076](https://www.pivotaltracker.com/story/show/187430076) * test: change test implementation * create a VPC endpoint * run the test * delete the VPC endpoint [#187430076](https://www.pivotaltracker.com/story/show/187430076) * test: use dms package [#187430076](https://www.pivotaltracker.com/story/show/187430076) * chore: change property description [#187430076](https://www.pivotaltracker.com/story/show/187430076) * test: follow conventions [#187430076](https://www.pivotaltracker.com/story/show/187430076)
- Loading branch information
1 parent
851eec8
commit b099a19
Showing
20 changed files
with
316 additions
and
32 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
3 changes: 2 additions & 1 deletion
3
acceptance-tests/helpers/dms/aws.go → acceptance-tests/helpers/awscli/aws.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,5 @@ | ||
| package dms | ||
| // Package awscli provides test helpers for setting up AWS resources | ||
| package awscli | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
115 changes: 115 additions & 0 deletions
115
acceptance-tests/helpers/awscli/vpcendpoint/vpcendpoint.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,115 @@ | ||
| // Package vpcendpoint provides test helpers for setting up an AWS VPC Endpoint | ||
| package vpcendpoint | ||
|
|
||
| import ( | ||
| "csbbrokerpakaws/acceptance-tests/helpers/awscli" | ||
| "fmt" | ||
| ) | ||
|
|
||
| type CallerIdentity struct { | ||
| Arn string `json:"Arn"` | ||
| } | ||
|
|
||
| type RouteTable struct { | ||
| RouteTableID string `json:"RouteTableId"` | ||
| } | ||
|
|
||
| type RouteTables struct { | ||
| RouteTables []RouteTable `json:"RouteTables"` | ||
| } | ||
|
|
||
| type VpcEndpoint struct { | ||
| VpcEndpointID string `json:"VpcEndpointId"` | ||
| } | ||
|
|
||
| type VpcEndpointResponse struct { | ||
| VpcEndpoint VpcEndpoint `json:"VpcEndpoint"` | ||
| } | ||
|
|
||
| func CreateEndpoint(allowedVPCID, defaultRegion string) string { | ||
|
|
||
| // Get the ARN of the current user | ||
| getCallerIdentityCommand := []string{ | ||
| "sts", | ||
| "get-caller-identity", | ||
| "--output", | ||
| "json", | ||
| } | ||
|
|
||
| var callerIdentity CallerIdentity | ||
| awscli.AWSToJSON(&callerIdentity, getCallerIdentityCommand...) | ||
| allowedUserARN := callerIdentity.Arn | ||
|
|
||
| policyDocument := fmt.Sprintf(`{ | ||
| "Statement": [ | ||
| { | ||
| "Action": "*", | ||
| "Effect": "Allow", | ||
| "Resource": "*", | ||
| "Principal": "*", | ||
| "Condition": { | ||
| "StringEquals": { | ||
| "aws:sourceVpc": %[1]q | ||
| }, | ||
| "StringLike": { | ||
| "aws:username": "csb-*" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "Action": "*", | ||
| "Effect": "Allow", | ||
| "Resource": "*", | ||
| "Principal": { | ||
| "AWS": %[2]q | ||
| }, | ||
| "Condition": { | ||
| "StringEquals": { | ||
| "aws:sourceVpc": %[1]q | ||
| } | ||
| } | ||
| } | ||
| ] | ||
| }`, allowedVPCID, allowedUserARN) | ||
|
|
||
| describeRoutesTablesCommand := []string{ | ||
| "ec2", | ||
| "describe-route-tables", | ||
| "--filters", | ||
| "Name=vpc-id,Values=" + allowedVPCID, | ||
| "--output", | ||
| "json", | ||
| } | ||
|
|
||
| var routesTables RouteTables | ||
| awscli.AWSToJSON(&routesTables, describeRoutesTablesCommand...) | ||
|
|
||
| routeTableIDs := make([]string, len(routesTables.RouteTables)) | ||
| for i, rt := range routesTables.RouteTables { | ||
| routeTableIDs[i] = rt.RouteTableID | ||
| } | ||
|
|
||
| createEndpointCommand := []string{ | ||
| "ec2", "create-vpc-endpoint", | ||
| "--vpc-id", allowedVPCID, | ||
| "--service-name", fmt.Sprintf("com.amazonaws.%s.s3", defaultRegion), | ||
| "--vpc-endpoint-type", "Gateway", | ||
| "--route-table-ids", | ||
| } | ||
|
|
||
| createEndpointCommand = append(createEndpointCommand, routeTableIDs...) | ||
| createEndpointCommand = append(createEndpointCommand, []string{"--policy-document", policyDocument, "--output", "json"}...) | ||
|
|
||
| var response VpcEndpointResponse | ||
| awscli.AWSToJSON(&response, createEndpointCommand...) | ||
| return response.VpcEndpoint.VpcEndpointID | ||
| } | ||
|
|
||
| func DeleteVPCEndpoint(vpcEndpointID string) { | ||
| deleteEndpointCommand := []string{ | ||
| "ec2", "delete-vpc-endpoints", | ||
| "--vpc-endpoint-ids", vpcEndpointID, | ||
| } | ||
|
|
||
| awscli.AWS(deleteEndpointCommand...) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.