Fork of hashicorp/boundary-plugin-aws (MPL-2.0). Module path and Boundary SDK
imports now point at repo.anhonesthost.net/CyberCoveLLC. Adds NOTICE and an
About this fork section to the README.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* bug(go) gRPC status codes were getting overwritten by the handlers
**Problem**
* If the gRPC handlers received an error with a gRPC status code from checkHosts, it got overwritten by a plain error value.
**Solution**
* Added a check to each checkHosts call that passes on the error received (with its gRPC status)
**Testing**
* Added new unit tests for when the handlers receive an error from checkHosts with a status code.
* Existing unit tests and terraform tests passed
* feat(tests) Add Terraform testing to support Cross-account discovery
**Problem**
* To support cross-account DHC discovery, we need to add terraform configurations and tests to test against live AWS data.
* However, there was nothing in place to support any AssumeRole testing, irrespective of cross-account.
**Solution**
* Added a new terraform file, iam_assume_role.tf, to contain the new terraform configurations for single-account AssumeRole and cross-role
* Added a second terraform file, iam_cross_account.tf, to contain the new terraform configurations for cross-account
* Refactored how the tests are organized. The previous static test cases used a system where a separate function was created for each test. This was moved to a dedicated file, e2e_host_static_test.go.
* For AssumeRole tests (single account, cross role, and cross account), this system wasn't ideal since there are so many test cases and they are all extremely similar. A table driven system was better that passed in a set of variables to shared test helpers. A dedicated file, e2e_host_assumerole_test.go, was created to contain the testing infrastructure for AssumeRole tests.
* e2e_host_test.go remains the main test runner that then calls e2e_host_assumerole_test.go and e2e_host_static_test.go
* The terraform tests work by setting environment variables for the AWS account that you want to configure the terraform for. The existing setup worked for single-account and cross-role. However, to support cross-account, support had to be added for a second set of credentials. The second set of environment variables can now be set with the TARGET_ prefix. Some configuration in testing.go had to be added to support creating/destroying multiple terraform setups.
**Testing**
* The single account tests pass as expected. However, a bug was discovered during this process that will be addressed later.
* The cross-role and cross-account tests failed as expected because this featured has not yet been delivered.
* It was noticed that some of the existing static tests were flaky. The problem and fix were identified and will be addressed later.
* temporary commit
* feat(host): replace dryRunValidation with checkHosts in catalog and set handlers
* refactor(host): clean up comments and fix typos in dry-run validation blocks
* refactor(host): address PR feedback on dry-run validation blocks
* refactor(host): remove dead dryRunValidation function and its tests
* refactor(host): extract dry run error message as a constant
* refactor(host): propagate BadRequestStatusf from buildFilters through buildDescribeInstancesInput
---------
Co-authored-by: ryanflynn9299 <ryan.flynn001@gmail.com>
This changeset implements multipart uploads. AWS caps PutObject calls at 5
GiB, effectively causing the plugin to error on any upload larger than that.
Multipart limit is 8 TiB, which should be plenty for most use cases.
Multipart implementation is size-gated: we only switch to multipart uploads once
the file size is greater than multipartThreshold, which is currently set to 8
MiB, and we set the part size to 8 MiB as well (this follows AWS CLI and boto3).
That gives us ~78 GiB max object before we auto-scale, due to 10,000 part cap on
AWS.
---------
Co-authored-by: Hugo <10965479+hugoghx@users.noreply.github.com>
This commit also introduces a new dry run validation step when creating
or updating a host catalog. Additionally, it introduces new tests
related to using AssumeRole credentials, as well as more error and
success state cases.
service/host/plugin.go now closely follows service/storage/plugin.go.
This is by design as to bring both "halves" of the AWS plugin into
parity with each other.
* fix: Append list error for permission validation
Instead of returning the error right away, append the error when `ListObject` is successful but the key expected if not found. Set the `Read` permission state as `Unknown` if the response from the list calls does not find the expected key.
This can be caused if the credentials do not have `s3:PutObject` but have `s3:ListBucket`. Without `s3:PutObject`, the object will not be written to S3 so other calls to find the object will not be successful even if they have valid permissions.
This prevents us from returning a `write` error on Boundary because the list call will always fail. Without this, the Permissions are not wrapped and the SBC states are all set to `unknown` even though we know certain permission failed.
* feat: parse generic aws api errors
* feat: parse s3 api errors
* feat: return credential state for all status errors
* fix status codes on certain http error codes and re-enable two tests
* switch code to FailedPrecondition
* update certain error codes
* update go.mod for new sdk version
---------
Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>
This commit fixes a problem where the plugin/AWS SDK would not recognise
static AWS credentials set in the machine's environment variables (by
setting AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY)
The default `WithSharedCredentials` value is `true` in awsutil (v2) -
This essentially disables the ability to read credentials from the
environment because we set the `default` AWS profile options, making the
SDK go search for a profile that may not exist and ignoring the
environment in the way, so we need to set it to `false` (see
`awsutil@v2.(*CredentialsConfig).generateAwsConfigOptions`) for extra
details.
shadowdaoandClaude Sonnet 5.5
Matt Romanelli
Delaine Rogers
Ryan Flynn
rebecca-yohandryanflynn9299
richardtrinh1
dependabot[bot]
Susmitha Girumala
Piotr KazmierczakandHugo
Damian Debkowski
Louis Ruch
aditya2548
hashicorp-copywrite[bot]
oss-core-libraries-dashboard[bot]andhashicorp-copywrite[bot]
Emilia
Katrina Schwark
daniandDanielle Miu
Irena Rindos
Johan Brandhorst-Satzkorn
Elim Tsiagbey
Michael Li
Hugo