1 files changed, 48 insertions, 3 deletions

diff --git a/app/controllers/aws.go b/app/controllers/aws.go
index 5b1765d..4f32942 100644
--- a/app/controllers/aws.go
+++ b/app/controllers/aws.go
@@ -2,11 +2,14 @@ package controllers
 
 import (
         "context"
+        "sync"
 
         "code.crute.us/mcrute/cloud-identity-broker/app/middleware"
         "code.crute.us/mcrute/cloud-identity-broker/app/models"
         "code.crute.us/mcrute/cloud-identity-broker/cloud/aws"
 
+        "code.crute.us/mcrute/golib/secrets"
+
         "github.com/labstack/echo/v4"
 )
 
@@ -20,7 +23,49 @@ type requestContext struct {
 // This capability does common permission checks and populates a request
 // context with user, account, and AWS API information.
 type AWSAPI struct {
-        Store models.AccountStore
+        Store   models.AccountStore
+        Secrets secrets.Client
+        cache   sync.Map // of aws.AWSClient
+}
+
+func (h *AWSAPI) getClientFor(ctx context.Context, a *models.Account) (aws.AWSClient, error) {
+        var client aws.AWSClient
+
+        if cv, ok := h.cache.Load(a.ShortName); !ok {
+                client, err := aws.NewAWSClientFromAccount(ctx, a, h.Secrets)
+                if err != nil {
+                        return nil, err
+                }
+
+                cv, _ = h.cache.LoadOrStore(a.ShortName, client)
+                client = cv.(aws.AWSClient)
+        } else {
+                client = cv.(aws.AWSClient)
+        }
+
+        return client, nil
+}
+
+// Preload enumerates all managed accounts and pre-loads all of the
+// clients into the cache.
+//
+// This exists because there is replication delay of around 5-10 seconds
+// for IAM users into other regions so these should be created as early
+// in the process lifecycle as possible.
+func (h *AWSAPI) Preload(ctx context.Context) []error {
+        accounts, err := h.Store.List(ctx)
+        if err != nil {
+                return []error{err}
+        }
+
+        errors := []error{}
+        for _, a := range accounts {
+                _, err = h.getClientFor(ctx, a)
+                if err != nil {
+                        errors = append(errors, err)
+                }
+        }
+        return errors
 }
 
 // GetContext checks that the user is authenticated and is authorized to access
@@ -38,7 +83,7 @@ func (h *AWSAPI) GetContext(c echo.Context) (*requestContext, error) {
                 return nil, echo.NotFoundHandler(c)
         }
 
-        ac, err := aws.NewAWSClientFromAccount(account)
+        client, err := h.getClientFor(c.Request().Context(), account)
         if err != nil {
                 c.Logger().Errorf("Error building AWS client: %w", err)
                 return nil, echo.ErrInternalServerError
@@ -47,6 +92,6 @@ func (h *AWSAPI) GetContext(c echo.Context) (*requestContext, error) {
         return &requestContext{
                 Account:   account,
                 Principal: principal,
-                AWS:       ac,
+                AWS:       client,
         }, nil
 }