aws-delivlib/lib/custom-resource-handlers/bin/certificate-signing-request/index.js

A fabulous library for defining continuous pipelines for building, testing and releasing code libraries.

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const fs = require("fs");
const os = require("os");
const path = require("path");
const util = require("util");
const client_s3_1 = require("@aws-sdk/client-s3");
const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
const cfn = require("./_cloud-formation");
const _exec = require("./_exec");
const _rmrf = require("./_rmrf");
const mkdtemp = util.promisify(fs.mkdtemp);
const readFile = util.promisify(fs.readFile);
const writeFile = util.promisify(fs.writeFile);
const secretsManager = new client_secrets_manager_1.SecretsManager();
exports.handler = cfn.customResourceHandler(handleEvent);
async function handleEvent(event, _context) {
    if (event.RequestType !== cfn.RequestType.DELETE) {
        cfn.validateProperties(event.ResourceProperties, {
            DnCommonName: true,
            DnCountry: true,
            DnEmailAddress: true,
            DnLocality: true,
            DnOrganizationName: true,
            DnOrganizationalUnitName: true,
            DnStateOrProvince: true,
            ExtendedKeyUsage: false,
            KeyUsage: true,
            PrivateKeySecretId: true,
            OutputBucket: true,
        });
    }
    switch (event.RequestType) {
        case cfn.RequestType.CREATE:
        case cfn.RequestType.UPDATE:
            return _createSelfSignedCertificate(event);
        case cfn.RequestType.DELETE:
            return { Ref: event.LogicalResourceId };
    }
}
async function _createSelfSignedCertificate(event) {
    const tempDir = await mkdtemp(path.join(os.tmpdir(), 'x509CSR-'));
    try {
        const configFile = await _makeCsrConfig(event, tempDir);
        const pkeyFile = await _retrievePrivateKey(event, tempDir);
        const csrFile = path.join(tempDir, 'csr.pem');
        await _exec('openssl', 'req', '-config', configFile, '-key', pkeyFile, '-out', csrFile, '-new');
        const certFile = path.join(tempDir, 'cert.pem');
        await _exec('openssl', 'x509', '-in', csrFile, '-out', certFile, '-req', '-signkey', pkeyFile, '-days', '365');
        const s3 = new client_s3_1.S3();
        const bucketName = event.ResourceProperties.OutputBucket;
        await s3.putObject({
            Bucket: bucketName,
            Key: 'certificate-signing-request.pem',
            Body: await readFile(csrFile, { encoding: 'utf8' }),
            ContentType: 'application/x-pem-file',
        });
        await s3.putObject({
            Bucket: bucketName,
            Key: 'self-signed-certificate.pem',
            Body: await readFile(certFile, { encoding: 'utf8' }),
            ContentType: 'application/x-pem-file',
        });
        return {
            Ref: event.LogicalResourceId,
            CSR: `s3://${bucketName}/certificate-signing-request.pem`,
            SelfSignedCertificate: `s3://${bucketName}/self-signed-certificate.pem`,
        };
    }
    finally {
        await _rmrf(tempDir);
    }
}
async function _makeCsrConfig(event, dir) {
    const file = path.join(dir, 'csr.config');
    await writeFile(file, [
        '[ req ]',
        'default_md           = sha256',
        'distinguished_name   = dn',
        'prompt               = no',
        'req_extensions       = extensions',
        'string_mask          = utf8only',
        'utf8                 = yes',
        '',
        '[ dn ]',
        `CN                   = ${event.ResourceProperties.DnCommonName}`,
        `C                    = ${event.ResourceProperties.DnCountry}`,
        `ST                   = ${event.ResourceProperties.DnStateOrProvince}`,
        `L                    = ${event.ResourceProperties.DnLocality}`,
        `O                    = ${event.ResourceProperties.DnOrganizationName}`,
        `OU                   = ${event.ResourceProperties.DnOrganizationalUnitName}`,
        `emailAddress         = ${event.ResourceProperties.DnEmailAddress}`,
        '',
        '[ extensions ]',
        `extendedKeyUsage     = ${event.ResourceProperties.ExtendedKeyUsage}`,
        `keyUsage             = ${event.ResourceProperties.KeyUsage}`,
        'subjectKeyIdentifier = hash',
    ].join('\n'), { encoding: 'utf8' });
    return file;
}
async function _retrievePrivateKey(event, dir) {
    const file = path.join(dir, 'private_key.pem');
    const secret = await secretsManager.getSecretValue({
        SecretId: event.ResourceProperties.PrivateKeySecretId,
        VersionStage: 'AWSCURRENT',
    });
    await writeFile(file, secret.SecretString, { encoding: 'utf8' });
    return file;
}
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VydGlmaWNhdGUtc2lnbmluZy1yZXF1ZXN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NlcnRpZmljYXRlLXNpZ25pbmctcmVxdWVzdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUFBLHlCQUF5QjtBQUN6Qix5QkFBeUI7QUFDekIsNkJBQTZCO0FBQzdCLDZCQUE2QjtBQUU3QixrREFBd0M7QUFFeEMsNEVBQWlFO0FBRWpFLDBDQUEwQztBQUUxQyxpQ0FBa0M7QUFHbEMsaUNBQWtDO0FBRWxDLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0FBQzNDLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQzdDLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0FBRS9DLE1BQU0sY0FBYyxHQUFHLElBQUksdUNBQWMsRUFBRSxDQUFDO0FBRTVDLE9BQU8sQ0FBQyxPQUFPLEdBQUcsR0FBRyxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxDQUFDO0FBT3pELEtBQUssVUFBVSxXQUFXLENBQUMsS0FBZ0IsRUFBRSxRQUF3QjtJQUNuRSxJQUFJLEtBQUssQ0FBQyxXQUFXLEtBQUssR0FBRyxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUU7UUFDaEQsR0FBRyxDQUFDLGtCQUFrQixDQUFDLEtBQUssQ0FBQyxrQkFBa0IsRUFBRTtZQUMvQyxZQUFZLEVBQUUsSUFBSTtZQUNsQixTQUFTLEVBQUUsSUFBSTtZQUNmLGNBQWMsRUFBRSxJQUFJO1lBQ3BCLFVBQVUsRUFBRSxJQUFJO1lBQ2hCLGtCQUFrQixFQUFFLElBQUk7WUFDeEIsd0JBQXdCLEVBQUUsSUFBSTtZQUM5QixpQkFBaUIsRUFBRSxJQUFJO1lBQ3ZCLGdCQUFnQixFQUFFLEtBQUs7WUFDdkIsUUFBUSxFQUFFLElBQUk7WUFDZCxrQkFBa0IsRUFBRSxJQUFJO1lBQ3hCLFlBQVksRUFBRSxJQUFJO1NBQ25CLENBQUMsQ0FBQztLQUNKO0lBRUQsUUFBUSxLQUFLLENBQUMsV0FBVyxFQUFFO1FBQ3pCLEtBQUssR0FBRyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUM7UUFDNUIsS0FBSyxHQUFHLENBQUMsV0FBVyxDQUFDLE1BQU07WUFDekIsT0FBTyw0QkFBNEIsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUM3QyxLQUFLLEdBQUcsQ0FBQyxXQUFXLENBQUMsTUFBTTtZQUV6QixPQUFPLEVBQUUsR0FBRyxFQUFFLEtBQUssQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO0tBQzNDO0FBQ0gsQ0FBQztBQUVELEtBQUssVUFBVSw0QkFBNEIsQ0FBQyxLQUFnQjtJQUMxRCxNQUFNLE9BQU8sR0FBRyxNQUFNLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ2xFLElBQUk7UUFDRixNQUFNLFVBQVUsR0FBRyxNQUFNLGNBQWMsQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDeEQsTUFBTSxRQUFRLEdBQUcsTUFBTSxtQkFBbUIsQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDM0QsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDOUMsTUFBTSxLQUFLLENBQUMsU0FBUyxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsVUFBVSxFQUNqRCxNQUFNLEVBQUUsUUFBUSxFQUNoQixNQUFNLEVBQUUsT0FBTyxFQUNmLE1BQU0sQ0FBQyxDQUFDO1FBQ1YsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFDaEQsTUFBTSxLQUFLLENBQUMsU0FBUyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUMzQyxNQUFNLEVBQUUsUUFBUSxFQUNoQixNQUFNLEVBQ04sVUFBVSxFQUFFLFFBQVEsRUFDcEIsT0FBTyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBRWxCLE1BQU0sRUFBRSxHQUFHLElBQUksY0FBRSxFQUFFLENBQUM7UUFDcEIsTUFBTSxVQUFVLEdBQVcsS0FBSyxDQUFDLGtCQUFrQixDQUFDLFlBQVksQ0FBQztRQUNqRSxNQUFNLEVBQUUsQ0FBQyxTQUFTLENBQUM7WUFDakIsTUFBTSxFQUFFLFVBQVU7WUFDbEIsR0FBRyxFQUFFLGlDQUFpQztZQUN0QyxJQUFJLEVBQUUsTUFBTSxRQUFRLENBQUMsT0FBTyxFQUFFLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxDQUFDO1lBQ25ELFdBQVcsRUFBRSx3QkFBd0I7U0FDdEMsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxFQUFFLENBQUMsU0FBUyxDQUFDO1lBQ2pCLE1BQU0sRUFBRSxVQUFVO1lBQ2xCLEdBQUcsRUFBRSw2QkFBNkI7WUFDbEMsSUFBSSxFQUFFLE1BQU0sUUFBUSxDQUFDLFFBQVEsRUFBRSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsQ0FBQztZQUNwRCxXQUFXLEVBQUUsd0JBQXdCO1NBQ3RDLENBQUMsQ0FBQztRQUVILE9BQU87WUFDTCxHQUFHLEVBQUUsS0FBSyxDQUFDLGlCQUFpQjtZQUM1QixHQUFHLEVBQUUsUUFBUSxVQUFVLGtDQUFrQztZQUN6RCxxQkFBcUIsRUFBRSxRQUFRLFVBQVUsOEJBQThCO1NBQ3hFLENBQUM7S0FDSDtZQUFTO1FBQ1IsTUFBTSxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7S0FDdEI7QUFDSCxDQUFDO0FBRUQsS0FBSyxVQUFVLGNBQWMsQ0FBQyxLQUFnQixFQUFFLEdBQVc7SUFDekQsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsWUFBWSxDQUFDLENBQUM7SUFDMUMsTUFBTSxTQUFTLENBQUMsSUFBSSxFQUFFO1FBQ3BCLFNBQVM7UUFDVCwrQkFBK0I7UUFDL0IsMkJBQTJCO1FBQzNCLDJCQUEyQjtRQUMzQixtQ0FBbUM7UUFDbkMsaUNBQWlDO1FBQ2pDLDRCQUE0QjtRQUM1QixFQUFFO1FBQ0YsUUFBUTtRQUNSLDBCQUEwQixLQUFLLENBQUMsa0JBQWtCLENBQUMsWUFBWSxFQUFFO1FBQ2pFLDBCQUEwQixLQUFLLENBQUMsa0JBQWtCLENBQUMsU0FBUyxFQUFFO1FBQzlELDBCQUEwQixLQUFLLENBQUMsa0JBQWtCLENBQUMsaUJBQWlCLEVBQUU7UUFDdEUsMEJBQTBCLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxVQUFVLEVBQUU7UUFDL0QsMEJBQTBCLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxrQkFBa0IsRUFBRTtRQUN2RSwwQkFBMEIsS0FBSyxDQUFDLGtCQUFrQixDQUFDLHdCQUF3QixFQUFFO1FBQzdFLDBCQUEwQixLQUFLLENBQUMsa0JBQWtCLENBQUMsY0FBYyxFQUFFO1FBQ25FLEVBQUU7UUFDRixnQkFBZ0I7UUFDaEIsMEJBQTBCLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxnQkFBZ0IsRUFBRTtRQUNyRSwwQkFBMEIsS0FBSyxDQUFDLGtCQUFrQixDQUFDLFFBQVEsRUFBRTtRQUM3RCw2QkFBNkI7S0FDOUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUNwQyxPQUFPLElBQUksQ0FBQztBQUNkLENBQUM7QUFFRCxLQUFLLFVBQVUsbUJBQW1CLENBQUMsS0FBZ0IsRUFBRSxHQUFXO0lBQzlELE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLGlCQUFpQixDQUFDLENBQUM7SUFDL0MsTUFBTSxNQUFNLEdBQUcsTUFBTSxjQUFjLENBQUMsY0FBYyxDQUFDO1FBQ2pELFFBQVEsRUFBRSxLQUFLLENBQUMsa0JBQWtCLENBQUMsa0JBQWtCO1FBQ3JELFlBQVksRUFBRSxZQUFZO0tBQzNCLENBQUMsQ0FBQztJQUNILE1BQU0sU0FBUyxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsWUFBYSxFQUFFLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDbEUsT0FBTyxJQUFJLENBQUM7QUFDZCxDQUFDIn0=