refactor: switch from awsutil to awsutilv2 (#34)

* fix(storage): Storage Assume Role Support

This commit introduces fixes to enable operators to use AWS dynamic
credentials on the storage side of this plugin, namely validation,
improved credential lifecycle management to allow for storage buckets to
be updated from static to dynamic credentials and vice versa, and a new
way to determine credential types.

It also introduces new tests for dynamic credential usage for the
various functions.

* fix(storage): Static rotated creds being deleted on plugin err

On Storage Bucket update, when we determine if the credentials are to be
updated to new ones, we call `credState.ReplaceCreds`.

This call, if the old credentials were managed by us (rotated at create
time), will delete the old credentials and set the new ones onto
credState.

We called this function without validating if the incoming credentials
are valid. This could get the bucket in a state where where, while we'd
return an update error if the incoming credentials weren't working with
S3 (err in the dry run process that happens at the end of the update),
we'd also silently delete the old credentials the bucket used, rendering
the bucket completely broken.

---------

Co-authored-by: Hugo <hugoamvieira@users.noreply.github.com>

plugin/service/host/plugin.go

@@ -83,15 +83,14 @@ func (p *HostPlugin) OnCreateCatalog(ctx context.Context, req *pb.OnCreateCatalo
 		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
 	}
 
-	// Try to rotate static credentials
-	if cred.HasStaticCredentials(credState.CredentialsConfig.AccessKey) {
+	if cred.GetCredentialType(credState.CredentialsConfig) == cred.StaticAWS {
 		if !catalogAttributes.DisableCredentialRotation {
-			if err := credState.RotateCreds(); err != nil {
+			if err := credState.RotateCreds(ctx); err != nil {
 				return nil, status.Errorf(codes.InvalidArgument, "error during credential rotation: %s", err)
 			}
 		} else {
 			// Simply validate if we aren't rotating.
-			if err := credState.ValidateCreds(); err != nil {
+			if err := credState.ValidateCreds(ctx); err != nil {
 				return nil, status.Errorf(codes.InvalidArgument, "error during credential validation: %s", err)
 			}
 		}
@@ -160,7 +159,7 @@ func (p *HostPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalo
 		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
 	}
 
-	if cred.HasStaticCredentials(credState.CredentialsConfig.AccessKey) {
+	if cred.GetCredentialType(credState.CredentialsConfig) == cred.StaticAWS {
 		if catalogAttributes.DisableCredentialRotation && !updateSecrets {
 			// This is a validate check to make sure that we aren't disabling
 			// rotation for credentials currently being managed by rotation.
@@ -179,7 +178,7 @@ func (p *HostPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalo
 			// Replace the credentials. This checks the timestamp on the last
 			// rotation time as well and deletes the credentials if we are
 			// managing them (ie: if we've rotated them before).
-			if err := credState.ReplaceCreds(catalogSecrets); err != nil {
+			if err := credState.ReplaceCreds(ctx, catalogSecrets); err != nil {
 				return nil, status.Errorf(codes.InvalidArgument, "error attempting to replace credentials: %s", err)
 			}
 		}
@@ -187,7 +186,7 @@ func (p *HostPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalo
 		if !catalogAttributes.DisableCredentialRotation && credState.CredsLastRotatedTime.IsZero() {
 			// If we're enabling rotation now but didn't before, or have
 			// freshly replaced credentials, we can rotate here.
-			if err := credState.RotateCreds(); err != nil {
+			if err := credState.RotateCreds(ctx); err != nil {
 				return nil, status.Errorf(codes.InvalidArgument, "error during credential rotation: %s", err)
 			}
 		}
@@ -244,12 +243,12 @@ func (p *HostPlugin) OnDeleteCatalog(ctx context.Context, req *pb.OnDeleteCatalo
 	}
 
 	// try to delete static credentials
-	if cred.HasStaticCredentials(credState.CredentialsConfig.AccessKey) {
+	if cred.GetCredentialType(credState.CredentialsConfig) == cred.StaticAWS {
 		if !credState.CredsLastRotatedTime.IsZero() {
 			// Delete old/existing credentials. This is done with the same
 			// credentials to ensure that it has the proper permissions to do
 			// it.
-			if err := credState.DeleteCreds(); err != nil {
+			if err := credState.DeleteCreds(ctx); err != nil {
 				return nil, status.Errorf(codes.Aborted, "error removing rotated credentials during catalog deletion: %s", err)
 			}
 		}
@@ -332,11 +331,7 @@ func (p *HostPlugin) OnCreateSet(ctx context.Context, req *pb.OnCreateSetRequest
 		return nil, err
 	}
 
-	opts := []ec2Option{}
-	if catalogAttributes.Region != "" {
-		opts = append(opts, WithRegion(catalogAttributes.Region))
-	}
-	ec2Client, err := catalogState.EC2Client(ctx, opts...)
+	ec2Client, err := catalogState.EC2Client(ctx)
 	if err != nil {
 		return nil, status.Errorf(codes.InvalidArgument, "error getting EC2 client: %s", err)
 	}
@@ -409,11 +404,7 @@ func (p *HostPlugin) OnUpdateSet(ctx context.Context, req *pb.OnUpdateSetRequest
 		return nil, err
 	}
 
-	opts := []ec2Option{}
-	if catalogAttributes.Region != "" {
-		opts = append(opts, WithRegion(catalogAttributes.Region))
-	}
-	ec2Client, err := catalogState.EC2Client(ctx, opts...)
+	ec2Client, err := catalogState.EC2Client(ctx)
 	if err != nil {
 		return nil, status.Errorf(codes.InvalidArgument, "error getting EC2 client: %s", err)
 	}
@@ -516,11 +507,7 @@ func (p *HostPlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (*
 		}
 	}
 
-	opts := []ec2Option{}
-	if catalogAttributes.Region != "" {
-		opts = append(opts, WithRegion(catalogAttributes.Region))
-	}
-	ec2Client, err := catalogState.EC2Client(ctx, opts...)
+	ec2Client, err := catalogState.EC2Client(ctx)
 	if err != nil {
 		return nil, status.Errorf(codes.InvalidArgument, "error getting EC2 client: %s", err)
 	}

plugin/service/host/plugin_test.go

@@ -17,7 +17,7 @@ import (
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostcatalogs"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostsets"
 	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
-	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"github.com/hashicorp/go-secure-stdlib/awsutil/v2"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -153,7 +153,7 @@ func TestPluginOnCreateCatalogErr(t *testing.T) {
 					),
 				}),
 			},
-			expectedErrContains: fmt.Sprintf("error during credential rotation: error rotating credentials: error calling CreateAccessKey: error calling aws.GetUser: %s", testGetUserErr),
+			expectedErrContains: fmt.Sprintf("error during credential rotation: error rotating credentials: error calling CreateAccessKey: error calling iam.GetUser: %s", testGetUserErr),
 			expectedErrCode:     codes.InvalidArgument,
 		},
 		{
@@ -411,7 +411,7 @@ func TestPluginOnUpdateCatalogErr(t *testing.T) {
 					),
 				}),
 			},
-			expectedErrContains: fmt.Sprintf("error during credential rotation: error rotating credentials: error calling CreateAccessKey: error calling aws.GetUser: %s", testGetUserErr),
+			expectedErrContains: fmt.Sprintf("error during credential rotation: error rotating credentials: error calling CreateAccessKey: error calling iam.GetUser: %s", testGetUserErr),
 			expectedErrCode:     codes.InvalidArgument,
 		},
 	}

plugin/service/host/state.go

@@ -12,8 +12,6 @@ import (
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/config"
-	"github.com/aws/aws-sdk-go-v2/credentials"
 	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
 	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
@@ -88,75 +86,16 @@ func (s *awsCatalogPersistedState) toProto() (*pb.HostCatalogPersisted, error) {
 
 // EC2Client returns a configured EC2 client based on the session
 // information stored in the state.
-func (s *awsCatalogPersistedState) EC2Client(ctx context.Context, opt ...ec2Option) (EC2API, error) {
-	opts, err := getOpts(opt...)
+func (s *awsCatalogPersistedState) EC2Client(ctx context.Context) (EC2API, error) {
+	awsCfg, err := s.GenerateCredentialChain(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("error parsing options when fetching EC2 client: %w", err)
+		return nil, fmt.Errorf("error getting AWS configuration when fetching EC2 client: %w", err)
 	}
-
-	awsConfigOpts := []func(*config.LoadOptions) error{}
-	sess, err := s.GetSession()
-	if err != nil {
-		return nil, fmt.Errorf("error getting AWS session when fetching EC2 client: %w", err)
+	if awsCfg == nil {
+		return nil, fmt.Errorf("nil aws configuration")
 	}
-	creds, err := sess.Config.Credentials.Get()
-	if err != nil {
-		return nil, fmt.Errorf("error getting AWS session when fetching EC2 client: %w", err)
-	}
-	customCredentials := config.WithCredentialsProvider(
-		credentials.NewStaticCredentialsProvider(creds.AccessKeyID, creds.SecretAccessKey, creds.SessionToken),
-	)
-	awsConfigOpts = append(awsConfigOpts, customCredentials)
-	if sess.Config.Region != nil {
-		awsConfigOpts = append(awsConfigOpts, config.WithRegion(*sess.Config.Region))
-	}
-	if opts.withRegion != "" {
-		awsConfigOpts = append(awsConfigOpts, config.WithRegion(opts.withRegion))
-	}
-	cfg, err := config.LoadDefaultConfig(ctx, awsConfigOpts...)
-	if err != nil {
-		return nil, fmt.Errorf("error loading aws configuration when fetching EC2 client: %w", err)
-	}
-
 	if s.testEC2APIFunc != nil {
-		return s.testEC2APIFunc(cfg)
-	}
-
-	cfg.HTTPClient = customClient
-
-	return ec2.NewFromConfig(cfg), nil
-}
-
-// getOpts iterates the inbound ec2Options and returns a struct
-func getOpts(opt ...ec2Option) (ec2Options, error) {
-	opts := getDefaultEC2Options()
-	for _, o := range opt {
-		if o == nil {
-			continue
-		}
-		if err := o(&opts); err != nil {
-			return ec2Options{}, err
-		}
-	}
-	return opts, nil
-}
-
-// ec2Option - how ec2Options are passed as arguments
-type ec2Option func(*ec2Options) error
-
-// options = how options are represented
-type ec2Options struct {
-	withRegion string
-}
-
-func getDefaultEC2Options() ec2Options {
-	return ec2Options{}
-}
-
-// WithRegion contains the region to use
-func WithRegion(with string) ec2Option {
-	return func(o *ec2Options) error {
-		o.withRegion = with
-		return nil
+		return s.testEC2APIFunc(*awsCfg)
 	}
+	return ec2.NewFromConfig(*awsCfg), nil
 }

plugin/service/host/state_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 
 	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
-	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"github.com/hashicorp/go-secure-stdlib/awsutil/v2"
 	"github.com/stretchr/testify/require"
 )
 
@@ -29,7 +29,7 @@ func TestAwsCatalogPersistedStateEC2Client(t *testing.T) {
 	)
 	require.NoError(err)
 
-	clientRaw, err := state.EC2Client(context.Background(), WithRegion("us-west-2"))
+	clientRaw, err := state.EC2Client(context.Background())
 	require.NoError(err)
 	require.NotNil(clientRaw)
 	client, ok := clientRaw.(*testMockEC2)