go.mondoo.com/cnquery@v0.0.0-20231005093811-59568235f6ea/providers-sdk/v1/vault/awsparameterstore/parameterstore.go (about)

     1  // Copyright (c) Mondoo, Inc.
     2  // SPDX-License-Identifier: BUSL-1.1
     3  
     4  package awsparameterstore
     5  
     6  import (
     7  	"context"
     8  	"strings"
     9  
    10  	"github.com/aws/aws-sdk-go-v2/aws"
    11  	"github.com/aws/aws-sdk-go-v2/service/ssm"
    12  	"github.com/aws/aws-sdk-go/aws/arn"
    13  	"github.com/cockroachdb/errors"
    14  	"go.mondoo.com/cnquery/providers-sdk/v1/vault"
    15  )
    16  
    17  var notImplemented = errors.New("not implemented")
    18  
    19  // https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html
    20  // https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetParameter.html
    21  func New(cfg aws.Config) *Vault {
    22  	return &Vault{
    23  		cfg: cfg,
    24  	}
    25  }
    26  
    27  type Vault struct {
    28  	cfg aws.Config
    29  }
    30  
    31  func (v *Vault) About(context.Context, *vault.Empty) (*vault.VaultInfo, error) {
    32  	return &vault.VaultInfo{Name: "AWS Parameter Store"}, nil
    33  }
    34  
    35  // arn:aws:ssm:us-east-2:123456789012:parameter/prod-*
    36  func (v *Vault) Get(ctx context.Context, id *vault.SecretID) (*vault.Secret, error) {
    37  	// create the client
    38  	parsedArn, err := arn.Parse(id.Key)
    39  	if err != nil {
    40  		return nil, err
    41  	}
    42  	cfg := v.cfg.Copy()
    43  	cfg.Region = parsedArn.Region
    44  	c := ssm.NewFromConfig(cfg)
    45  
    46  	name := strings.TrimPrefix(parsedArn.Resource, "parameter/")
    47  	// retrieve secret
    48  	out, err := c.GetParameter(ctx, &ssm.GetParameterInput{
    49  		Name:           aws.String(name),
    50  		WithDecryption: aws.Bool(true),
    51  	})
    52  	if err != nil {
    53  		return nil, vault.NotFoundError
    54  	}
    55  
    56  	var data []byte
    57  	if out != nil && out.Parameter != nil {
    58  		v := *out.Parameter.Value
    59  		data = []byte(v)
    60  	}
    61  
    62  	return &vault.Secret{
    63  		Key:  id.Key,
    64  		Data: data,
    65  		// we do not know the encoding here, but the default is binary
    66  		Encoding: vault.SecretEncoding_encoding_binary,
    67  	}, nil
    68  }
    69  
    70  func (v *Vault) Set(ctx context.Context, cred *vault.Secret) (*vault.SecretID, error) {
    71  	return nil, errors.New("not implemented")
    72  }