github.com/Cloud-Foundations/Dominator@v0.3.4/lib/repowatch/getKey.go (about)

     1  package repowatch
     2  
     3  import (
     4  	"encoding/base64"
     5  	"encoding/pem"
     6  	"errors"
     7  	"fmt"
     8  	"io"
     9  	"os"
    10  	"path/filepath"
    11  	"strings"
    12  
    13  	"github.com/Cloud-Foundations/Dominator/lib/fsutil"
    14  	"github.com/Cloud-Foundations/Dominator/lib/log"
    15  )
    16  
    17  func awsGetKey(secretId string, logger log.DebugLogger) error {
    18  	if secretId == "" {
    19  		return nil
    20  	}
    21  	metadataClient, err := getMetadataClient()
    22  	if err != nil {
    23  		return err
    24  	}
    25  	secrets, err := getAwsSecret(metadataClient, secretId)
    26  	if err != nil {
    27  		return err
    28  	}
    29  	if err := writeSshKey(secrets); err != nil {
    30  		return err
    31  	}
    32  	logger.Printf("fetched SSH key from AWS Secrets Manager, SecretId: %s\n",
    33  		secretId)
    34  	return nil
    35  }
    36  
    37  // keyMap is mutated.
    38  func writeKeyAsPEM(writer io.Writer, keyMap map[string]string) error {
    39  	keyType := keyMap["KeyType"]
    40  	if keyType == "" {
    41  		return errors.New("no KeyType in map")
    42  	}
    43  	delete(keyMap, "KeyType")
    44  	privateKeyBase64 := keyMap["PrivateKey"]
    45  	if privateKeyBase64 == "" {
    46  		return errors.New("no PrivateKey in map")
    47  	}
    48  	delete(keyMap, "PrivateKey")
    49  	privateKey, err := base64.StdEncoding.DecodeString(
    50  		strings.Replace(privateKeyBase64, " ", "", -1))
    51  	if err != nil {
    52  		return err
    53  	}
    54  	block := &pem.Block{
    55  		Type:    keyType + " PRIVATE KEY",
    56  		Headers: keyMap,
    57  		Bytes:   privateKey,
    58  	}
    59  	return pem.Encode(writer, block)
    60  }
    61  
    62  // keyMap is mutated.
    63  func writeSshKey(keyMap map[string]string) error {
    64  	dirname := filepath.Join(os.Getenv("HOME"), ".ssh")
    65  	if err := os.MkdirAll(dirname, 0700); err != nil {
    66  		return err
    67  	}
    68  	var filename string
    69  	switch keyType := keyMap["KeyType"]; keyType {
    70  	case "DSA":
    71  		filename = "id_dsa"
    72  	case "RSA":
    73  		filename = "id_rsa"
    74  	default:
    75  		return fmt.Errorf("unsupported key type: %s", keyType)
    76  	}
    77  	writer, err := fsutil.CreateRenamingWriter(filepath.Join(dirname, filename),
    78  		fsutil.PrivateFilePerms)
    79  	if err != nil {
    80  		return err
    81  	}
    82  	if err := writeKeyAsPEM(writer, keyMap); err != nil {
    83  		writer.Abort()
    84  		return err
    85  	}
    86  	return writer.Close()
    87  }