Import of source code

2 files changed, 229 insertions, 0 deletions

diff --git a/cloud/aws/aws.go b/cloud/aws/aws.go
new file mode 100644
index 0000000..180b2c4
--- /dev/null
+++ b/cloud/aws/aws.go
@@ -0,0 +1,218 @@
+package aws
+
+import (
+        "encoding/json"
+        "fmt"
+        "io/ioutil"
+        "net/http"
+        "net/url"
+        "strconv"
+
+        "code.crute.us/mcrute/cloud-identity-broker/app/models"
+
+        "code.crute.us/mcrute/golib/vault"
+        "github.com/aws/aws-sdk-go/aws"
+        "github.com/aws/aws-sdk-go/aws/credentials"
+        "github.com/aws/aws-sdk-go/aws/session"
+        "github.com/aws/aws-sdk-go/service/ec2"
+        "github.com/aws/aws-sdk-go/service/sts"
+)
+
+// defaultRegion is the region where AWS currently has may authoritative
+// service like IAM and ancillary auth services.
+var defaultRegion = aws.String("us-east-1")
+
+type Region struct {
+        Name    string
+        Enabled bool
+}
+
+type AWSClient interface {
+        AssumeRole(string, *string) (*sts.Credentials, error)
+        GetFederationURL(string, string) (string, error)
+        GetRegionList() ([]*Region, error)
+}
+
+// account models the account configuration stored in Vault for an AWS account
+// with assumable roles that are stored within a kv JSON record.
+type account struct {
+        AccessKeyId     string
+        SecretAccessKey string
+        Roles           map[string]struct {
+                ARN        string
+                ExternalId string
+        }
+}
+
+type client struct {
+        AccessKeyId                string
+        SecretAccessKey            string
+        ARN                        string
+        ExternalId                 string
+        ConsoleSessionDurationSecs int64
+}
+
+var _ AWSClient = (*client)(nil)
+
+// NewAWSClientFromAccount returns a new AWSClient based on an account.
+//
+// An account is actually more accurately called an assumable role. Each
+// account contains a vault material set path which is used to fetch all of the
+// credentials for that AWS account and is filtered to one assumable role ARN
+// which is used as the scope for this AWS client. Thus even if an account has
+// multiple roles there must be one instance of the AWS client per account/role
+// pair.
+func NewAWSClientFromAccount(a *models.Account) (AWSClient, error) {
+        var ac account
+        if err := vault.GetVaultKeyStruct(a.VaultMaterial, &ac); err != nil {
+                return nil, err
+        }
+
+        r, ok := ac.Roles[a.ShortName]
+        if !ok {
+                return nil, fmt.Errorf("No roles for account %s in vault response", a.ShortName)
+        }
+
+        return &client{
+                AccessKeyId:                ac.AccessKeyId,
+                SecretAccessKey:            ac.SecretAccessKey,
+                ARN:                        r.ARN,
+                ExternalId:                 r.ExternalId,
+                ConsoleSessionDurationSecs: a.ConsoleSessionDurationSecs(),
+        }, nil
+}
+
+// AssumeRole uses an IAM user credential with higher privilege to assume a
+// role in an AWS account and region. It returns the STS credentials.
+//
+// Not all credentials work for all regions. For newer regions and opt-in
+// regions AWS has been siloing assumed role credentials to that region so it's
+// important to use the correct regional endpoint to fetch the credentials.
+//
+// Note that this is not simply a passthrough to Vault's AWS backend because
+// the Vault backend works by assuming roles and when assuming roles with an
+// assumed role AWS limits the chained role lifetime to 1 hour which doesn't
+// work depending on how the upstream web application tied to this client
+// works. This method instead uses a long-lived IAM user credential to assume a
+// role, which has a limited lifetime which is typically greater than 1 hour.
+func (a *client) AssumeRole(user string, region *string) (*sts.Credentials, error) {
+        if region != nil && *region == "global" {
+                region = nil
+        }
+
+        c := sts.New(session.New(&aws.Config{
+                Region: region,
+                Credentials: credentials.NewStaticCredentials(
+                        a.AccessKeyId,
+                        a.SecretAccessKey,
+                        "",
+                ),
+        }))
+        result, err := c.AssumeRole(&sts.AssumeRoleInput{
+                ExternalId:      aws.String(a.ExternalId),
+                RoleArn:         aws.String(a.ARN),
+                RoleSessionName: aws.String(user),
+                DurationSeconds: aws.Int64(a.ConsoleSessionDurationSecs),
+        })
+        if err != nil {
+                return nil, err
+        }
+
+        return result.Credentials, nil
+}
+
+// GetRegionList returns all of the EC2 regions that are enabled for an
+// account.
+//
+// All regions should return the same answer to this query so just send it to
+// the default region.
+func (a *client) GetRegionList() ([]*Region, error) {
+        r, err := a.AssumeRole("region-list", defaultRegion)
+        if err != nil {
+                return nil, err
+        }
+
+        ec2c := ec2.New(session.New(&aws.Config{
+                Region: defaultRegion,
+                Credentials: credentials.NewStaticCredentials(
+                        *r.AccessKeyId,
+                        *r.SecretAccessKey,
+                        *r.SessionToken,
+                ),
+        }))
+
+        ro, err := ec2c.DescribeRegions(&ec2.DescribeRegionsInput{AllRegions: aws.Bool(true)})
+        if err != nil {
+                return nil, err
+        }
+
+        out := []*Region{}
+        for _, r := range ro.Regions {
+                out = append(out, &Region{
+                        Name:    *r.RegionName,
+                        Enabled: (*r.OptInStatus != "not-opted-in"),
+                })
+        }
+
+        return out, nil
+}
+
+// GetFederationURL assumes a role and returns a URL that can be used to login
+// to the AWS console for that role.
+//
+// This URL can be used for any region but the endpoints to return the URL only
+// work in us-east-1.
+func (a *client) GetFederationURL(user string, issuerEndpoint string) (string, error) {
+        r, err := a.AssumeRole(user, defaultRegion)
+        if err != nil {
+                return "", err
+        }
+
+        sp, _ := json.Marshal(map[string]string{
+                "sessionId":    *r.AccessKeyId,
+                "sessionKey":   *r.SecretAccessKey,
+                "sessionToken": *r.SessionToken,
+        })
+
+        client := &http.Client{}
+        fedResp, err := client.Do(&http.Request{
+                Method: http.MethodGet,
+                URL: &url.URL{
+                        Scheme: "https",
+                        Host:   "signin.aws.amazon.com",
+                        Path:   "/federation",
+                        RawQuery: url.Values{
+                                "Action":          []string{"getSigninToken"},
+                                "Session":         []string{string(sp)},
+                                "SessionDuration": []string{strconv.FormatInt(a.ConsoleSessionDurationSecs, 10)},
+                        }.Encode(),
+                },
+        })
+        if err != nil {
+                return "", err
+        }
+
+        if fedResp.StatusCode != 200 {
+                return "", fmt.Errorf("federation endpoint returned HTTP %d", fedResp.StatusCode)
+        }
+
+        body, err := ioutil.ReadAll(fedResp.Body)
+        if err != nil {
+                return "", err
+        }
+
+        var fedData map[string]string
+        if err = json.Unmarshal(body, &fedData); err != nil {
+                return "", err
+        }
+
+        u, _ := url.Parse("https://signin.aws.amazon.com/federation")
+        u.RawQuery = url.Values{
+                "Action":      []string{"login"},
+                "Issuer":      []string{issuerEndpoint},
+                "Destination": []string{"https://console.aws.amazon.com/"},
+                "SigninToken": []string{fedData["SigninToken"]},
+        }.Encode()
+
+        return u.String(), nil
+}
diff --git a/cloud/aws/error.go b/cloud/aws/error.go
new file mode 100644
index 0000000..62fda48
--- /dev/null
+++ b/cloud/aws/error.go
@@ -0,0 +1,11 @@
+package aws
+
+import (
+        "strings"
+)
+
+// IsRegionNotExist tries to determine if the error is caused by a region not
+// existing, as would be the case in a user typo.
+func IsRegionNotExist(err error) bool {
+        return strings.Contains(err.Error(), "no such host")
+}