Matt Romanelli
86273c5fcd
* feat(tests) Add Terraform testing to support Cross-account discovery **Problem** * To support cross-account DHC discovery, we need to add terraform configurations and tests to test against live AWS data. * However, there was nothing in place to support any AssumeRole testing, irrespective of cross-account. **Solution** * Added a new terraform file, iam_assume_role.tf, to contain the new terraform configurations for single-account AssumeRole and cross-role * Added a second terraform file, iam_cross_account.tf, to contain the new terraform configurations for cross-account * Refactored how the tests are organized. The previous static test cases used a system where a separate function was created for each test. This was moved to a dedicated file, e2e_host_static_test.go. * For AssumeRole tests (single account, cross role, and cross account), this system wasn't ideal since there are so many test cases and they are all extremely similar. A table driven system was better that passed in a set of variables to shared test helpers. A dedicated file, e2e_host_assumerole_test.go, was created to contain the testing infrastructure for AssumeRole tests. * e2e_host_test.go remains the main test runner that then calls e2e_host_assumerole_test.go and e2e_host_static_test.go * The terraform tests work by setting environment variables for the AWS account that you want to configure the terraform for. The existing setup worked for single-account and cross-role. However, to support cross-account, support had to be added for a second set of credentials. The second set of environment variables can now be set with the TARGET_ prefix. Some configuration in testing.go had to be added to support creating/destroying multiple terraform setups. **Testing** * The single account tests pass as expected. However, a bug was discovered during this process that will be addressed later. * The cross-role and cross-account tests failed as expected because this featured has not yet been delivered. * It was noticed that some of the existing static tests were flaky. The problem and fix were identified and will be addressed later.
AWS Plugin for HashiCorp Boundary
This repo contains the aws plugin for HashiCorp Boundary.
Credential Rotation
This is the following priority for the credential chain: static, assume role, environment variables.
Static Credentials
Although static credentials are stored encrypted within Boundary, by default this
plugin will attempt to rotate credentials when they are supplied through the
secrets object. The given credentials will be used to create a new credential,
and then the given credential will be revoked. In this way, after rotation,
only Boundary knows the client secret in use by this plugin. More information
about AWS static credentials can be found here.
Credential rotation can be turned off by setting the
disable_credential_rotation attribute to true.
Assume Role Credentials
This plugin will attempt to assume a role when a role_arn is supplied through the
attributes object. More information about assume an AWS role can be found here. This feature only works when the plugin is running on a self managed Boundary worker.
To discover hosts across multiple AWS accounts, supply a target_role_arn in addition to role_arn. The plugin uses the principal credentials to assume the target role via a two-hop AssumeRole chain, enabling cross-account host discovery from a single worker. See Attributes and Secrets for the full list of target_* attributes.
Environment Credentials
This plugin will attempt to retrieve credentials from environment variables. More information about environment variables for AWS credentials can be found here. This feature only works when the plugin is running on a self managed Boundary worker.
Dynamic Hosts
This plugin supports dynamically sourcing hosts from Amazon EC2.
Host sets created with this plugin define filters which select and group like instances within AWS; these host sets can in turn be added to targets within Boundary as host sources.
At creation, update or deletion of a host catalog of this type, configuration of the plugin is performed via the attribute/secret values passed to the create, update, or delete calls actions. The values passed in to the plugin here are the attributes set on on a host catalog in boundary.
The plugin fetches hosts through the DescribeInstances call.
Storage Bucket
This plugin supports storing and fetching objects from Amazon S3.
Files created with this plugin are stored as objects defined by the bucket name and bucket prefix values configured in the storage bucket resource; these storage bucket resources can in turn be associated to targets within Boundary.
At creation, update or deletion of a storage bucket of this type, configuration of the plugin is performed via the attribute/secret values passed to the create, update, or delete calls actions. The values passed in to the plugin here are the attributes set on on a storage bucket in boundary.
The plugin fetches files through the GetObject call.
The plugin stores files through the PutObject call.
The plugin fetches metadata about the files through the HeadObject call.