secrets: add AWS IAM supportsecrets/v0.3.0

3 files changed, 96 insertions, 4 deletions

diff --git a/secrets/client.go b/secrets/client.go
index 92c46ef..779f28c 100644
--- a/secrets/client.go
+++ b/secrets/client.go
@@ -33,6 +33,12 @@ type ApiKey struct {
         Key string `json:"key" mapstructure:"key"`
 }
 
+type AWSCredential struct {
+        AccessKeyId     string `json:"access_key" mapstructure:"access_key"`
+        SecretAccessKey string `json:"secret_key" mapstructure:"secret_key"`
+        SessionToken    string `json:"security_token" mapstructure:"security_token"`
+}
+
 type RSAKey struct {
         Key string `json:"key" mapstructure:"key"`
 }
@@ -63,9 +69,13 @@ func (k *RSAKey) RSAPrivateKey() (*rsa.PrivateKey, error) {
 // to inject stubs to code that doesn't care about the fact that a
 // manager may exist.
 type Client interface {
-        DatabaseCredential(context.Context, string) (*Credential, Handle, error)
-        Secret(context.Context, string, any) (Handle, error)
-        WriteSecret(context.Context, string, any) error
+        DatabaseCredential(ctx context.Context, suffix string) (*Credential, Handle, error)
+        Secret(ctx context.Context, suffix string, out any) (Handle, error)
+        RawSecret(ctx context.Context, path string, out any) (Handle, error)
+        AWSIAMUser(ctx context.Context, name string) (*AWSCredential, Handle, error)
+        AWSAssumeRoleSimple(ctx context.Context, name string) (*AWSCredential, Handle, error)
+        AWSAssumeRole(ctx context.Context, name string, sessionName string, ttl time.Duration) (*AWSCredential, Handle, error)
+        WriteSecret(ctx context.Context, suffix string, out any) error
         Destroy(Handle) error
         MakeNonCritical(Handle) error
 }
diff --git a/secrets/noop_client.go b/secrets/noop_client.go
index 85bd736..e727e51 100644
--- a/secrets/noop_client.go
+++ b/secrets/noop_client.go
@@ -3,6 +3,7 @@ package secrets
 import (
         "context"
         "sync"
+        "time"
 )
 
 type NoopHandle struct{}
@@ -33,6 +34,22 @@ func (c *NoopClient) Secret(ctx context.Context, path string, out any) (Handle,
         return &NoopHandle{}, nil
 }
 
+func (c *NoopClient) RawSecret(ctx context.Context, path string, out any) (Handle, error) {
+        return &NoopHandle{}, nil
+}
+
+func (c *NoopClient) AWSIAMUser(ctx context.Context, name string) (*AWSCredential, Handle, error) {
+        return &AWSCredential{}, &NoopHandle{}, nil
+}
+
+func (c *NoopClient) AWSAssumeRoleSimple(ctx context.Context, name string) (*AWSCredential, Handle, error) {
+        return &AWSCredential{}, &NoopHandle{}, nil
+}
+
+func (c *NoopClient) AWSAssumeRole(ctx context.Context, name string, sessionName string, ttl time.Duration) (*AWSCredential, Handle, error) {
+        return &AWSCredential{}, &NoopHandle{}, nil
+}
+
 func (c *NoopClient) WriteSecret(ctx context.Context, path string, in any) error {
         return nil
 }
diff --git a/secrets/vault_client.go b/secrets/vault_client.go
index ce26dbe..b84b344 100644
--- a/secrets/vault_client.go
+++ b/secrets/vault_client.go
@@ -289,8 +289,25 @@ func (c *VaultClient) makeHandle(name string, s *api.Secret) Handle {
         return h
 }
 
+func (c *VaultClient) writeHandle(ctx context.Context, prefix, suffix string, data map[string]any) (Handle, error) {
+        key := suffix
+        if prefix != "" {
+                key = path.Join(prefix, suffix)
+        }
+
+        s, err := c.logical.WriteWithContext(ctx, key, data)
+        if err != nil {
+                return nil, fmt.Errorf("writeHandle: error writing to Vault: %w", err)
+        }
+
+        return c.makeHandle(key, s), nil
+}
+
 func (c *VaultClient) read(ctx context.Context, prefix, suffix string) (Handle, error) {
-        key := path.Join(prefix, suffix)
+        key := suffix
+        if prefix != "" {
+                key = path.Join(prefix, suffix)
+        }
 
         s, err := c.logical.ReadWithContext(ctx, key)
         if err != nil {
@@ -358,6 +375,54 @@ func (c *VaultClient) Secret(ctx context.Context, suffix string, out any) (Handl
         return h, nil
 }
 
+func (c *VaultClient) RawSecret(ctx context.Context, path string, out any) (Handle, error) {
+        h, err := c.read(ctx, "", path)
+        if err != nil {
+                return nil, err
+        }
+
+        if err = mapstructure.Decode(h.(*VaultHandle).secret.Data["data"], out); err != nil {
+                return nil, err
+        }
+
+        return h, nil
+}
+
+func (c *VaultClient) AWSAssumeRoleSimple(ctx context.Context, name string) (*AWSCredential, Handle, error) {
+        return c.AWSAssumeRole(ctx, name, fmt.Sprintf("%s-%d", name, time.Now().UnixNano()), time.Hour)
+}
+
+func (c *VaultClient) AWSAssumeRole(ctx context.Context, name string, sessionName string, ttl time.Duration) (*AWSCredential, Handle, error) {
+        h, err := c.writeHandle(ctx, "aws/sts", name, map[string]any{
+                "role_session_name": sessionName,
+                "ttl":               ttl.String(),
+        })
+        if err != nil {
+                return nil, nil, err
+        }
+
+        var d AWSCredential
+        if err = mapstructure.Decode(h.(*VaultHandle).secret.Data, &d); err != nil {
+                return nil, nil, fmt.Errorf("AWSIAMUser: error decoding secret: %w", err)
+        }
+
+        return nil, nil, nil
+}
+
+func (c *VaultClient) AWSIAMUser(ctx context.Context, name string) (*AWSCredential, Handle, error) {
+        h, err := c.read(ctx, "aws/creds", name)
+        if err != nil {
+                return nil, nil, err
+        }
+
+        var d AWSCredential
+        if err = mapstructure.Decode(h.(*VaultHandle).secret.Data, &d); err != nil {
+                return nil, nil, fmt.Errorf("AWSIAMUser: error decoding secret: %w", err)
+        }
+
+        return &d, h, nil
+}
+
 func (c *VaultClient) WriteSecret(ctx context.Context, suffix string, in any) error {
         inb, err := json.Marshal(in)
         if err != nil {