path: root/cloud/aws/aws.go

package aws

import (
	"encoding/json"
	"fmt"
	"io/ioutil"
	"net/http"
	"net/url"
	"strconv"

	"code.crute.us/mcrute/cloud-identity-broker/app/models"

	"code.crute.us/mcrute/golib/vault"
	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/credentials"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/ec2"
	"github.com/aws/aws-sdk-go/service/sts"
)

// defaultRegion is the region where AWS currently has may authoritative
// service like IAM and ancillary auth services.
var defaultRegion = aws.String("us-east-1")

type Region struct {
	Name    string
	Enabled bool
}

type AWSClient interface {
	AssumeRole(string, *string) (*sts.Credentials, error)
	GetFederationURL(string, string) (string, error)
	GetRegionList() ([]*Region, error)
}

// account models the account configuration stored in Vault for an AWS account
// with assumable roles that are stored within a kv JSON record.
type account struct {
	AccessKeyId     string
	SecretAccessKey string
	Roles           map[string]struct {
		ARN        string
		ExternalId string
	}
}

type client struct {
	AccessKeyId                string
	SecretAccessKey            string
	ARN                        string
	ExternalId                 string
	ConsoleSessionDurationSecs int64
}

var _ AWSClient = (*client)(nil)

// NewAWSClientFromAccount returns a new AWSClient based on an account.
//
// An account is actually more accurately called an assumable role. Each
// account contains a vault material set path which is used to fetch all of the
// credentials for that AWS account and is filtered to one assumable role ARN
// which is used as the scope for this AWS client. Thus even if an account has
// multiple roles there must be one instance of the AWS client per account/role
// pair.
func NewAWSClientFromAccount(a *models.Account) (AWSClient, error) {
	var ac account
	if err := vault.GetVaultKeyStruct(a.VaultMaterial, &ac); err != nil {
		return nil, err
	}

	r, ok := ac.Roles[a.ShortName]
	if !ok {
		return nil, fmt.Errorf("No roles for account %s in vault response", a.ShortName)
	}

	return &client{
		AccessKeyId:                ac.AccessKeyId,
		SecretAccessKey:            ac.SecretAccessKey,
		ARN:                        r.ARN,
		ExternalId:                 r.ExternalId,
		ConsoleSessionDurationSecs: a.ConsoleSessionDurationSecs(),
	}, nil
}

// ValidateVaultMaterial is used to check that a Vault material can be accessed
// and that the shape of that material is correct for an AWS access key and
// role list.
//
// This should be used for admission control for the creation of new accounts.
func ValidateVaultMaterial(m string) error {
	var ac account
	if err := vault.GetVaultKeyStruct(m, &ac); err != nil {
		return fmt.Errorf("Unable to access vault material: %w", err)
	}

	if ac.AccessKeyId == "" {
		return fmt.Errorf("AccessKeyId is empty")
	}

	if ac.SecretAccessKey == "" {
		return fmt.Errorf("SecretAccessKey is empty")
	}

	if len(ac.Roles) == 0 {
		return fmt.Errorf("No roles specified")
	}

	for k, r := range ac.Roles {
		if r.ARN == "" {
			return fmt.Errorf("ARN for role %s is empty", k)
		}
		if r.ExternalId == "" {
			return fmt.Errorf("ExternalId for role %s is empty", k)
		}
	}

	return nil
}

// AssumeRole uses an IAM user credential with higher privilege to assume a
// role in an AWS account and region. It returns the STS credentials.
//
// Not all credentials work for all regions. For newer regions and opt-in
// regions AWS has been siloing assumed role credentials to that region so it's
// important to use the correct regional endpoint to fetch the credentials.
//
// Note that this is not simply a passthrough to Vault's AWS backend because
// the Vault backend works by assuming roles and when assuming roles with an
// assumed role AWS limits the chained role lifetime to 1 hour which doesn't
// work depending on how the upstream web application tied to this client
// works. This method instead uses a long-lived IAM user credential to assume a
// role, which has a limited lifetime which is typically greater than 1 hour.
func (a *client) AssumeRole(user string, region *string) (*sts.Credentials, error) {
	if region != nil && *region == "global" {
		region = nil
	}

	c := sts.New(session.New(&aws.Config{
		Region: region,
		Credentials: credentials.NewStaticCredentials(
			a.AccessKeyId,
			a.SecretAccessKey,
			"",
		),
	}))
	result, err := c.AssumeRole(&sts.AssumeRoleInput{
		ExternalId:      aws.String(a.ExternalId),
		RoleArn:         aws.String(a.ARN),
		RoleSessionName: aws.String(user),
		DurationSeconds: aws.Int64(a.ConsoleSessionDurationSecs),
	})
	if err != nil {
		return nil, err
	}

	return result.Credentials, nil
}

// GetRegionList returns all of the EC2 regions that are enabled for an
// account.
//
// All regions should return the same answer to this query so just send it to
// the default region.
func (a *client) GetRegionList() ([]*Region, error) {
	r, err := a.AssumeRole("region-list", defaultRegion)
	if err != nil {
		return nil, err
	}

	ec2c := ec2.New(session.New(&aws.Config{
		Region: defaultRegion,
		Credentials: credentials.NewStaticCredentials(
			*r.AccessKeyId,
			*r.SecretAccessKey,
			*r.SessionToken,
		),
	}))

	ro, err := ec2c.DescribeRegions(&ec2.DescribeRegionsInput{AllRegions: aws.Bool(true)})
	if err != nil {
		return nil, err
	}

	out := []*Region{}
	for _, r := range ro.Regions {
		out = append(out, &Region{
			Name:    *r.RegionName,
			Enabled: (*r.OptInStatus != "not-opted-in"),
		})
	}

	return out, nil
}

// GetFederationURL assumes a role and returns a URL that can be used to login
// to the AWS console for that role.
//
// This URL can be used for any region but the endpoints to return the URL only
// work in us-east-1.
func (a *client) GetFederationURL(user string, issuerEndpoint string) (string, error) {
	r, err := a.AssumeRole(user, defaultRegion)
	if err != nil {
		return "", err
	}

	sp, _ := json.Marshal(map[string]string{
		"sessionId":    *r.AccessKeyId,
		"sessionKey":   *r.SecretAccessKey,
		"sessionToken": *r.SessionToken,
	})

	client := &http.Client{}
	fedResp, err := client.Do(&http.Request{
		Method: http.MethodGet,
		URL: &url.URL{
			Scheme: "https",
			Host:   "signin.aws.amazon.com",
			Path:   "/federation",
			RawQuery: url.Values{
				"Action":          []string{"getSigninToken"},
				"Session":         []string{string(sp)},
				"SessionDuration": []string{strconv.FormatInt(a.ConsoleSessionDurationSecs, 10)},
			}.Encode(),
		},
	})
	if err != nil {
		return "", err
	}

	if fedResp.StatusCode != 200 {
		return "", fmt.Errorf("federation endpoint returned HTTP %d", fedResp.StatusCode)
	}

	body, err := ioutil.ReadAll(fedResp.Body)
	if err != nil {
		return "", err
	}

	var fedData map[string]string
	if err = json.Unmarshal(body, &fedData); err != nil {
		return "", err
	}

	u, _ := url.Parse("https://signin.aws.amazon.com/federation")
	u.RawQuery = url.Values{
		"Action":      []string{"login"},
		"Issuer":      []string{issuerEndpoint},
		"Destination": []string{"https://console.aws.amazon.com/"},
		"SigninToken": []string{fedData["SigninToken"]},
	}.Encode()

	return u.String(), nil
}