Current File : //lib/python2.7/site-packages/salt/renderers/aws_kms.pyo
�
���^c @@ sZ d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l m
Z
y5 d d l Z d d l
Z
e j d � j e j � Wn e k
r� n Xy d d l j Z e Z Wn e k
r� e Z n Xd � Z e j e � Z d d � Z d � Z d � Z d
� Z d � Z d � Z d
� Z! e d � Z" e d � Z# d d d d � Z$ d S( u+
Renderer that will decrypt ciphers encrypted using `AWS KMS Envelope Encryption`_.
.. _`AWS KMS Envelope Encryption`: https://docs.aws.amazon.com/kms/latest/developerguide/workflow.html
Any key in the data to be rendered can be a urlsafe_b64encoded string, and this renderer will attempt
to decrypt it before passing it off to Salt. This allows you to safely store secrets in
source control, in such a way that only your Salt master can decrypt them and
distribute them only to the minions that need them.
The typical use-case would be to use ciphers in your pillar data, and keep the encrypted
data key on your master. This way developers with appropriate AWS IAM privileges can add new secrets
quickly and easily.
This renderer requires the boto3_ Python library.
.. _boto3: https://boto3.readthedocs.io/
Setup
-----
First, set up your AWS client. For complete instructions on configuration the AWS client,
please read the `boto3 configuration documentation`_. By default, this renderer will use
the default AWS profile. You can override the profile name in salt configuration.
For example, if you have a profile in your aws client configuration named "salt",
you can add the following salt configuration:
.. code-block:: yaml
aws_kms:
profile_name: salt
.. _boto3 configuration documentation: https://boto3.readthedocs.io/en/latest/guide/configuration.html
The rest of these instructions assume that you will use the default profile for key generation
and setup. If not, export AWS_PROFILE and set it to the desired value.
Once the aws client is configured, generate a KMS customer master key and use that to generate
a local data key.
.. code-block:: bash
# data_key=$(aws kms generate-data-key --key-id your-key-id --key-spec AES_256
--query 'CiphertextBlob' --output text)
# echo 'aws_kms:'
# echo ' data_key: !!binary "%s"\n' "$data_key" >> config/master
To apply the renderer on a file-by-file basis add the following line to the
top of any pillar with gpg data in it:
.. code-block:: yaml
#!yaml|aws_kms
Now with your renderer configured, you can include your ciphers in your pillar
data like so:
.. code-block:: yaml
#!yaml|aws_kms
a-secret: gAAAAABaj5uzShPI3PEz6nL5Vhk2eEHxGXSZj8g71B84CZsVjAAtDFY1mfjNRl-1Su9YVvkUzNjI4lHCJJfXqdcTvwczBYtKy0Pa7Ri02s10Wn1tF0tbRwk=
i ( t absolute_importt print_functiont unicode_literalsN( t sixu boto3c C@ s t o t j j j � S( ug
Only load if boto libraries exist and if boto libraries are greater than
a given version.
( t
HAS_FERNETt saltt utilst versionst check_boto_reqs( ( ( s: /usr/lib/python2.7/site-packages/salt/renderers/aws_kms.pyt __virtual__[ s c C@ s4 t j d t j � } | d i � } | j | | � S( uz
Return the requested value from the aws_kms key in salt configuration.
If it's not set, return the default.
u
config.getu aws_kms( t __salt__t gett __opts__( t keyt defaultt root_cfgt kms_cfg( ( s: /usr/lib/python2.7/site-packages/salt/renderers/aws_kms.pyt _cfgf s c C@ s/ t d d � } | r | St j j d � � d S( un
Return the encrypted KMS data key from configuration.
Raises SaltConfigurationError if not set.
u data_keyu u aws_kms:data_key is not setN( R R t
exceptionst SaltConfigurationError( t data_key( ( s: /usr/lib/python2.7/site-packages/salt/renderers/aws_kms.pyt
_cfg_data_keyq s c C@ s� t d � } | r% t j d | � n
t j d � y t j d | � SWn� t j j k
r� } d j | pm d � } t j j
| � } t j | | � nP t j j
k
r� } d j | p� d � } t j j
| � } t j | | � n Xd S( uH
Return the boto3 session to use for the KMS client.
If aws_kms:profile_name is set in the salt configuration, use that profile.
Otherwise, fall back on the default aws profile.
We use the boto3 profile system to avoid having to duplicate
individual boto3 configuration settings in salt configuration.
u profile_nameu Using the "%s" aws profile.uI aws_kms:profile_name is not set in salt. Falling back on default profile.t profile_nameu9 Boto3 could not find the "{}" profile configured in Salt.u defaultuK Boto3 was unable to determine the AWS endpoint region using the {} profile.N( R t logt infot boto3t Sessiont botocoreR t ProfileNotFoundt formatR R R t
raise_fromt
NoRegionError( R t orig_exct err_msgt config_error( ( s: /usr/lib/python2.7/site-packages/salt/renderers/aws_kms.pyt _session} s
c C@ s t � } | j d � S( u2
Return the boto3 client for the KMS API.
u kms( R# t client( t session( ( s: /usr/lib/python2.7/site-packages/salt/renderers/aws_kms.pyt _kms� s c C@ s� t � } t � } y | j d | � SWnt t j j k
r� } | j j d i � j d d � } | d k rq � n d } t j j | � } t
j | | � n Xd S( uG
Return the response dictionary from the KMS decrypt API call.
t CiphertextBlobu Erroru Codeu u InvalidCiphertextExceptionu, aws_kms:data_key is not a valid KMS data keyN( R& R t decryptR R t ClientErrort responseR R R R R ( t kmsR R t
error_codeR! R" ( ( s: /usr/lib/python2.7/site-packages/salt/renderers/aws_kms.pyt _api_decrypt� s ! c C@ s� t t d d � } | d k } | s@ t � } t t d | � n | d } | d } t | d � ru | j t � } n t j d | | r� d n d � | S( u�
Return the configured KMS data key decrypted and encoded in urlsafe base64.
Cache the result to minimize API calls to AWS.
u responseu KeyIdu Plaintextu encodeu Using key %s from %su cacheu api callN(
t getattrt _plaintext_data_keyt NoneR- t setattrt hasattrt encodet __salt_system_encoding__R t debug( R* t cache_hitt key_idt plaintext( ( s: /usr/lib/python2.7/site-packages/salt/renderers/aws_kms.pyR/ � s
c C@ s t � } t j | � S( uU
Return the configured KMS data key decrypted and encoded in urlsafe base64.
( R/ t base64t urlsafe_b64encode( t plaintext_data_key( ( s: /usr/lib/python2.7/site-packages/salt/renderers/aws_kms.pyt _base64_plaintext_data_key� s c C@ s� | r | j d d � } n t | d � r< | j t � } n t � } t j | � j | � } t | d � r~ | j t � } n t j
| � S( u�
Given a blob of ciphertext as a bytestring, try to decrypt
the cipher and return the decrypted string. If the cipher cannot be
decrypted, log the error, and return the ciphertext back out.
u \nu
u encodeu decode( t replaceR2 R3 R4 R< t fernett FernetR( t decodeR t text_type( t ciphert translate_newlinesR t
plain_text( ( s: /usr/lib/python2.7/site-packages/salt/renderers/aws_kms.pyt _decrypt_ciphertext� s c C@ s t j j j | � r( t | j � | � St | t j � ro y t | d | �SWqt
j t f k
rk | SXn� t | t
� r� x3 t j | � D]" \ } } t | d | �| | <q� W| St | t � r� x0 t | � D]" \ } } t | d | �| | <q� W| S| Sd S( u�
Recursively try to decrypt any object.
Recur on objects that are not strings.
Decrypt strings that are valid Fernet tokens.
Return the rest unchanged.
RC N( R R t stringiot is_readablet _decrypt_objectt getvaluet
isinstanceR t string_typesRE R> t InvalidTokent TypeErrort dictt iteritemst listt enumerate( t objRC R
t value( ( s: /usr/lib/python2.7/site-packages/salt/renderers/aws_kms.pyRH � s& u baseu c K@ s" | j d t � } t | d | �S( u_
Decrypt the data to be rendered that was encrypted using AWS KMS envelope encryption.
u translate_newlinesRC ( R t FalseRH ( t datat saltenvt slst arglinet kwargsRC ( ( s: /usr/lib/python2.7/site-packages/salt/renderers/aws_kms.pyt render� s (% t __doc__t
__future__R R R t loggingR9 t salt.utils.stringioR t salt.extR t botocore.exceptionsR R t getLoggert setLevelt CRITICALt ImportErrort cryptography.fernetR> t TrueR RT R t __name__R R0 R R R# R& R- R/ R< RE RH RZ ( ( ( s: /usr/lib/python2.7/site-packages/salt/renderers/aws_kms.pyt <module>@ s8
Mini Shell