aws-delivlib
Version:
A fabulous library for defining continuous pipelines for building, testing and releasing code libraries.
108 lines • 12.4 kB
JavaScript
;
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
__setModuleDefault(result, mod);
return result;
};
Object.defineProperty(exports, "__esModule", { value: true });
const fs = __importStar(require("fs"));
const os = __importStar(require("os"));
const path = __importStar(require("path"));
const util = __importStar(require("util"));
// eslint-disable-next-line import/no-extraneous-dependencies
const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
const cfn = __importStar(require("./_cloud-formation"));
// eslint-disable-next-line @typescript-eslint/no-require-imports
const _exec = require("./_exec");
// eslint-disable-next-line @typescript-eslint/no-require-imports
const _rmrf = require("./_rmrf");
const mkdtemp = util.promisify(fs.mkdtemp);
const readFile = util.promisify(fs.readFile);
const secretsManager = new client_secrets_manager_1.SecretsManager();
exports.handler = cfn.customResourceHandler(handleEvent);
async function handleEvent(event, context) {
if (event.RequestType !== cfn.RequestType.DELETE) {
cfn.validateProperties(event.ResourceProperties, {
Description: false,
KeySize: true,
KmsKeyId: false,
SecretName: true,
});
}
switch (event.RequestType) {
case cfn.RequestType.CREATE:
return _createSecret(event, context);
case cfn.RequestType.UPDATE:
return _updateSecret(event, context);
case cfn.RequestType.DELETE:
return _deleteSecret(event);
}
}
async function _createSecret(event, context) {
const tmpDir = await mkdtemp(path.join(os.tmpdir(), 'x509PrivateKey-'));
try {
const pkeyFile = path.join(tmpDir, 'private_key.pem');
await _exec('openssl', 'genrsa', '-out', pkeyFile, event.ResourceProperties.KeySize);
const result = await secretsManager.createSecret({
ClientRequestToken: context.awsRequestId,
Description: event.ResourceProperties.Description,
KmsKeyId: event.ResourceProperties.KmsKeyId,
Name: event.ResourceProperties.SecretName,
SecretString: await readFile(pkeyFile, { encoding: 'utf8' }),
});
return {
Ref: result.ARN,
SecretArn: result.ARN,
};
}
finally {
await _rmrf(tmpDir);
}
}
async function _deleteSecret(event) {
if (event.PhysicalResourceId.startsWith('arn:')) {
await secretsManager.deleteSecret({
SecretId: event.PhysicalResourceId,
ForceDeleteWithoutRecovery: true,
});
}
return { Ref: event.PhysicalResourceId };
}
async function _updateSecret(event, context) {
const props = event.ResourceProperties;
const oldProps = event.OldResourceProperties;
for (const key of ['KeySize', 'SecretName']) {
if (oldProps[key] !== props[key]) {
throw new Error(`The ${key} property cannot be updated, but it was changed from ${oldProps[key]} to ${props[key]}`);
}
}
const result = await secretsManager.updateSecret({
ClientRequestToken: context.awsRequestId,
Description: props.Description,
KmsKeyId: props.KmsKeyId,
SecretId: event.PhysicalResourceId,
});
return {
Ref: result.ARN,
SecretArn: result.ARN,
};
}
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJpdmF0ZS1rZXkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJwcml2YXRlLWtleS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsdUNBQXlCO0FBQ3pCLHVDQUF5QjtBQUN6QiwyQ0FBNkI7QUFDN0IsMkNBQTZCO0FBQzdCLDZEQUE2RDtBQUM3RCw0RUFBaUU7QUFFakUsd0RBQTBDO0FBQzFDLGlFQUFpRTtBQUNqRSxpQ0FBa0M7QUFFbEMsaUVBQWlFO0FBQ2pFLGlDQUFrQztBQUVsQyxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsQ0FBQztBQUMzQyxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUU3QyxNQUFNLGNBQWMsR0FBRyxJQUFJLHVDQUFjLEVBQUUsQ0FBQztBQUU1QyxPQUFPLENBQUMsT0FBTyxHQUFHLEdBQUcsQ0FBQyxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsQ0FBQztBQUV6RCxLQUFLLFVBQVUsV0FBVyxDQUFDLEtBQWdCLEVBQUUsT0FBdUI7SUFDbEUsSUFBSSxLQUFLLENBQUMsV0FBVyxLQUFLLEdBQUcsQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFO1FBQ2hELEdBQUcsQ0FBQyxrQkFBa0IsQ0FBQyxLQUFLLENBQUMsa0JBQWtCLEVBQUU7WUFDL0MsV0FBVyxFQUFFLEtBQUs7WUFDbEIsT0FBTyxFQUFFLElBQUk7WUFDYixRQUFRLEVBQUUsS0FBSztZQUNmLFVBQVUsRUFBRSxJQUFJO1NBQ2pCLENBQUMsQ0FBQztLQUNKO0lBRUQsUUFBUSxLQUFLLENBQUMsV0FBVyxFQUFFO1FBQ3pCLEtBQUssR0FBRyxDQUFDLFdBQVcsQ0FBQyxNQUFNO1lBQ3pCLE9BQU8sYUFBYSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQztRQUN2QyxLQUFLLEdBQUcsQ0FBQyxXQUFXLENBQUMsTUFBTTtZQUN6QixPQUFPLGFBQWEsQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDdkMsS0FBSyxHQUFHLENBQUMsV0FBVyxDQUFDLE1BQU07WUFDekIsT0FBTyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUM7S0FDL0I7QUFDSCxDQUFDO0FBTUQsS0FBSyxVQUFVLGFBQWEsQ0FBQyxLQUFzQixFQUFFLE9BQXVCO0lBQzFFLE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxFQUFFLGlCQUFpQixDQUFDLENBQUMsQ0FBQztJQUN4RSxJQUFJO1FBQ0YsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztRQUN0RCxNQUFNLEtBQUssQ0FBQyxTQUFTLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsS0FBSyxDQUFDLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3JGLE1BQU0sTUFBTSxHQUFHLE1BQU0sY0FBYyxDQUFDLFlBQVksQ0FBQztZQUMvQyxrQkFBa0IsRUFBRSxPQUFPLENBQUMsWUFBWTtZQUN4QyxXQUFXLEVBQUUsS0FBSyxDQUFDLGtCQUFrQixDQUFDLFdBQVc7WUFDakQsUUFBUSxFQUFFLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxRQUFRO1lBQzNDLElBQUksRUFBRSxLQUFLLENBQUMsa0JBQWtCLENBQUMsVUFBVTtZQUN6QyxZQUFZLEVBQUUsTUFBTSxRQUFRLENBQUMsUUFBUSxFQUFFLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxDQUFDO1NBQzdELENBQUMsQ0FBQztRQUNILE9BQU87WUFDTCxHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUk7WUFDaEIsU0FBUyxFQUFFLE1BQU0sQ0FBQyxHQUFJO1NBQ3ZCLENBQUM7S0FDSDtZQUFTO1FBQ1IsTUFBTSxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUM7S0FDckI7QUFDSCxDQUFDO0FBRUQsS0FBSyxVQUFVLGFBQWEsQ0FBQyxLQUFzQjtJQUNqRCxJQUFJLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLEVBQUU7UUFDL0MsTUFBTSxjQUFjLENBQUMsWUFBWSxDQUFDO1lBQ2hDLFFBQVEsRUFBRSxLQUFLLENBQUMsa0JBQWtCO1lBQ2xDLDBCQUEwQixFQUFFLElBQUk7U0FDakMsQ0FBQyxDQUFDO0tBQ0o7SUFDRCxPQUFPLEVBQUUsR0FBRyxFQUFFLEtBQUssQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO0FBQzNDLENBQUM7QUFFRCxLQUFLLFVBQVUsYUFBYSxDQUFDLEtBQXNCLEVBQUUsT0FBdUI7SUFDMUUsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLGtCQUFrQixDQUFDO0lBQ3ZDLE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQztJQUM3QyxLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsU0FBUyxFQUFFLFlBQVksQ0FBQyxFQUFFO1FBQzNDLElBQUksUUFBUSxDQUFDLEdBQUcsQ0FBQyxLQUFLLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRTtZQUNoQyxNQUFNLElBQUksS0FBSyxDQUFDLE9BQU8sR0FBRyx3REFBd0QsUUFBUSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7U0FDckg7S0FDRjtJQUNELE1BQU0sTUFBTSxHQUFHLE1BQU0sY0FBYyxDQUFDLFlBQVksQ0FBQztRQUMvQyxrQkFBa0IsRUFBRSxPQUFPLENBQUMsWUFBWTtRQUN4QyxXQUFXLEVBQUUsS0FBSyxDQUFDLFdBQVc7UUFDOUIsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO1FBQ3hCLFFBQVEsRUFBRSxLQUFLLENBQUMsa0JBQWtCO0tBQ25DLENBQUMsQ0FBQztJQUVILE9BQU87UUFDTCxHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUk7UUFDaEIsU0FBUyxFQUFFLE1BQU0sQ0FBQyxHQUFJO0tBQ3ZCLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgZnMgZnJvbSAnZnMnO1xuaW1wb3J0ICogYXMgb3MgZnJvbSAnb3MnO1xuaW1wb3J0ICogYXMgcGF0aCBmcm9tICdwYXRoJztcbmltcG9ydCAqIGFzIHV0aWwgZnJvbSAndXRpbCc7XG4vLyBlc2xpbnQtZGlzYWJsZS1uZXh0LWxpbmUgaW1wb3J0L25vLWV4dHJhbmVvdXMtZGVwZW5kZW5jaWVzXG5pbXBvcnQgeyBTZWNyZXRzTWFuYWdlciB9IGZyb20gJ0Bhd3Mtc2RrL2NsaWVudC1zZWNyZXRzLW1hbmFnZXInO1xuXG5pbXBvcnQgKiBhcyBjZm4gZnJvbSAnLi9fY2xvdWQtZm9ybWF0aW9uJztcbi8vIGVzbGludC1kaXNhYmxlLW5leHQtbGluZSBAdHlwZXNjcmlwdC1lc2xpbnQvbm8tcmVxdWlyZS1pbXBvcnRzXG5pbXBvcnQgX2V4ZWMgPSByZXF1aXJlKCcuL19leGVjJyk7XG5pbXBvcnQgKiBhcyBsYW1iZGEgZnJvbSAnLi9fbGFtYmRhJztcbi8vIGVzbGludC1kaXNhYmxlLW5leHQtbGluZSBAdHlwZXNjcmlwdC1lc2xpbnQvbm8tcmVxdWlyZS1pbXBvcnRzXG5pbXBvcnQgX3JtcmYgPSByZXF1aXJlKCcuL19ybXJmJyk7XG5cbmNvbnN0IG1rZHRlbXAgPSB1dGlsLnByb21pc2lmeShmcy5ta2R0ZW1wKTtcbmNvbnN0IHJlYWRGaWxlID0gdXRpbC5wcm9taXNpZnkoZnMucmVhZEZpbGUpO1xuXG5jb25zdCBzZWNyZXRzTWFuYWdlciA9IG5ldyBTZWNyZXRzTWFuYWdlcigpO1xuXG5leHBvcnRzLmhhbmRsZXIgPSBjZm4uY3VzdG9tUmVzb3VyY2VIYW5kbGVyKGhhbmRsZUV2ZW50KTtcblxuYXN5bmMgZnVuY3Rpb24gaGFuZGxlRXZlbnQoZXZlbnQ6IGNmbi5FdmVudCwgY29udGV4dDogbGFtYmRhLkNvbnRleHQpOiBQcm9taXNlPGNmbi5SZXNvdXJjZUF0dHJpYnV0ZXM+IHtcbiAgaWYgKGV2ZW50LlJlcXVlc3RUeXBlICE9PSBjZm4uUmVxdWVzdFR5cGUuREVMRVRFKSB7XG4gICAgY2ZuLnZhbGlkYXRlUHJvcGVydGllcyhldmVudC5SZXNvdXJjZVByb3BlcnRpZXMsIHtcbiAgICAgIERlc2NyaXB0aW9uOiBmYWxzZSxcbiAgICAgIEtleVNpemU6IHRydWUsXG4gICAgICBLbXNLZXlJZDogZmFsc2UsXG4gICAgICBTZWNyZXROYW1lOiB0cnVlLFxuICAgIH0pO1xuICB9XG5cbiAgc3dpdGNoIChldmVudC5SZXF1ZXN0VHlwZSkge1xuICAgIGNhc2UgY2ZuLlJlcXVlc3RUeXBlLkNSRUFURTpcbiAgICAgIHJldHVybiBfY3JlYXRlU2VjcmV0KGV2ZW50LCBjb250ZXh0KTtcbiAgICBjYXNlIGNmbi5SZXF1ZXN0VHlwZS5VUERBVEU6XG4gICAgICByZXR1cm4gX3VwZGF0ZVNlY3JldChldmVudCwgY29udGV4dCk7XG4gICAgY2FzZSBjZm4uUmVxdWVzdFR5cGUuREVMRVRFOlxuICAgICAgcmV0dXJuIF9kZWxldGVTZWNyZXQoZXZlbnQpO1xuICB9XG59XG5cbmludGVyZmFjZSBSZXNvdXJjZUF0dHJpYnV0ZXMgZXh0ZW5kcyBjZm4uUmVzb3VyY2VBdHRyaWJ1dGVzIHtcbiAgU2VjcmV0QXJuOiBzdHJpbmc7XG59XG5cbmFzeW5jIGZ1bmN0aW9uIF9jcmVhdGVTZWNyZXQoZXZlbnQ6IGNmbi5DcmVhdGVFdmVudCwgY29udGV4dDogbGFtYmRhLkNvbnRleHQpOiBQcm9taXNlPFJlc291cmNlQXR0cmlidXRlcz4ge1xuICBjb25zdCB0bXBEaXIgPSBhd2FpdCBta2R0ZW1wKHBhdGguam9pbihvcy50bXBkaXIoKSwgJ3g1MDlQcml2YXRlS2V5LScpKTtcbiAgdHJ5IHtcbiAgICBjb25zdCBwa2V5RmlsZSA9IHBhdGguam9pbih0bXBEaXIsICdwcml2YXRlX2tleS5wZW0nKTtcbiAgICBhd2FpdCBfZXhlYygnb3BlbnNzbCcsICdnZW5yc2EnLCAnLW91dCcsIHBrZXlGaWxlLCBldmVudC5SZXNvdXJjZVByb3BlcnRpZXMuS2V5U2l6ZSk7XG4gICAgY29uc3QgcmVzdWx0ID0gYXdhaXQgc2VjcmV0c01hbmFnZXIuY3JlYXRlU2VjcmV0KHtcbiAgICAgIENsaWVudFJlcXVlc3RUb2tlbjogY29udGV4dC5hd3NSZXF1ZXN0SWQsXG4gICAgICBEZXNjcmlwdGlvbjogZXZlbnQuUmVzb3VyY2VQcm9wZXJ0aWVzLkRlc2NyaXB0aW9uLFxuICAgICAgS21zS2V5SWQ6IGV2ZW50LlJlc291cmNlUHJvcGVydGllcy5LbXNLZXlJZCxcbiAgICAgIE5hbWU6IGV2ZW50LlJlc291cmNlUHJvcGVydGllcy5TZWNyZXROYW1lLFxuICAgICAgU2VjcmV0U3RyaW5nOiBhd2FpdCByZWFkRmlsZShwa2V5RmlsZSwgeyBlbmNvZGluZzogJ3V0ZjgnIH0pLFxuICAgIH0pO1xuICAgIHJldHVybiB7XG4gICAgICBSZWY6IHJlc3VsdC5BUk4hLFxuICAgICAgU2VjcmV0QXJuOiByZXN1bHQuQVJOISxcbiAgICB9O1xuICB9IGZpbmFsbHkge1xuICAgIGF3YWl0IF9ybXJmKHRtcERpcik7XG4gIH1cbn1cblxuYXN5bmMgZnVuY3Rpb24gX2RlbGV0ZVNlY3JldChldmVudDogY2ZuLkRlbGV0ZUV2ZW50KTogUHJvbWlzZTxjZm4uUmVzb3VyY2VBdHRyaWJ1dGVzPiB7XG4gIGlmIChldmVudC5QaHlzaWNhbFJlc291cmNlSWQuc3RhcnRzV2l0aCgnYXJuOicpKSB7XG4gICAgYXdhaXQgc2VjcmV0c01hbmFnZXIuZGVsZXRlU2VjcmV0KHtcbiAgICAgIFNlY3JldElkOiBldmVudC5QaHlzaWNhbFJlc291cmNlSWQsXG4gICAgICBGb3JjZURlbGV0ZVdpdGhvdXRSZWNvdmVyeTogdHJ1ZSxcbiAgICB9KTtcbiAgfVxuICByZXR1cm4geyBSZWY6IGV2ZW50LlBoeXNpY2FsUmVzb3VyY2VJZCB9O1xufVxuXG5hc3luYyBmdW5jdGlvbiBfdXBkYXRlU2VjcmV0KGV2ZW50OiBjZm4uVXBkYXRlRXZlbnQsIGNvbnRleHQ6IGxhbWJkYS5Db250ZXh0KTogUHJvbWlzZTxSZXNvdXJjZUF0dHJpYnV0ZXM+IHtcbiAgY29uc3QgcHJvcHMgPSBldmVudC5SZXNvdXJjZVByb3BlcnRpZXM7XG4gIGNvbnN0IG9sZFByb3BzID0gZXZlbnQuT2xkUmVzb3VyY2VQcm9wZXJ0aWVzO1xuICBmb3IgKGNvbnN0IGtleSBvZiBbJ0tleVNpemUnLCAnU2VjcmV0TmFtZSddKSB7XG4gICAgaWYgKG9sZFByb3BzW2tleV0gIT09IHByb3BzW2tleV0pIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihgVGhlICR7a2V5fSBwcm9wZXJ0eSBjYW5ub3QgYmUgdXBkYXRlZCwgYnV0IGl0IHdhcyBjaGFuZ2VkIGZyb20gJHtvbGRQcm9wc1trZXldfSB0byAke3Byb3BzW2tleV19YCk7XG4gICAgfVxuICB9XG4gIGNvbnN0IHJlc3VsdCA9IGF3YWl0IHNlY3JldHNNYW5hZ2VyLnVwZGF0ZVNlY3JldCh7XG4gICAgQ2xpZW50UmVxdWVzdFRva2VuOiBjb250ZXh0LmF3c1JlcXVlc3RJZCxcbiAgICBEZXNjcmlwdGlvbjogcHJvcHMuRGVzY3JpcHRpb24sXG4gICAgS21zS2V5SWQ6IHByb3BzLkttc0tleUlkLFxuICAgIFNlY3JldElkOiBldmVudC5QaHlzaWNhbFJlc291cmNlSWQsXG4gIH0pO1xuXG4gIHJldHVybiB7XG4gICAgUmVmOiByZXN1bHQuQVJOISxcbiAgICBTZWNyZXRBcm46IHJlc3VsdC5BUk4hLFxuICB9O1xufVxuIl19