Skip to content

Always use SessionProxy - #71

Merged
tobywf merged 2 commits into
aws-cloudformation:masterfrom
tobywf:scrub-creds
Jan 27, 2020
Merged

tobywf merged 2 commits into
aws-cloudformation:masterfrom
tobywf:scrub-creds

Conversation

@tobywf

@tobywf tobywf commented Dec 5, 2019 •

Copy link
Copy Markdown
Contributor

Issue #, if available: N/A

Description of changes: The main change is to use SessionProxy, instead of passing credentials around (although they are still needed for the re-invoke). I've also changed the way the request is parsed, first we try and parse the platform part. If this fails, it's now an InternalFailure. Then, the ProviderLogHandler uses this parsed data instead of re-parsing the event data itself. Finally, the request is "parsed" and if this fails, it is an InvalidRequest for now ("parsed" but not really, see #27 ). Both of these steps will make adding a validation library much easier.

I also reworked the MetricPublisher interface a bit like we discussed in #69 .

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@tobywf tobywf self-assigned this Dec 5, 2019
event.requestData.callerCredentials = None
event.requestData.providerCredentials = None
if platform_sess is None:
raise ValueError("No platform credentials")

@jaymccon jaymccon Dec 11, 2019 •

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks like the creds are already inadvertently being re-used across invocations. In an end-to-end test, a cwl re-invoke raises valueError.

Need to investigate a bit further, but we may need to be doing something like java's refreshClient operation.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dug into this a bit deeper and it looks like the scheduler needs the credentials to be part of the request for re-invokes to work (looks to be the same in the java plugin). So if we're going to scrub these we'll need to stash them somewhere and inject them back into the handler_request for reschedule_after_minutes.

@jaymccon jaymccon left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

overall looks great, just need to work out how to get the creds into the cloudwatch events payload so that re-invokes work.

@tobywf tobywf changed the title Scrub credentials, always use SessionProxy Always use SessionProxy Jan 16, 2020
@tobywf

tobywf commented Jan 16, 2020

Copy link
Copy Markdown
Contributor Author

I can't really come up with a good way to fix this, but everything being typed/using SessionProxy is still valuable IMO. So I've removed the zeroing out, and this PR should serve as a good basis if we want to do this in future. Meanwhile, we'll still get the other refactoring benefits.

@tobywf

tobywf commented Jan 16, 2020 •

Copy link
Copy Markdown
Contributor Author

The framework creates a CloudWatch scheduled event that has AWS credentials in it? In the user's account?

The LogAndMetricsDeliveryRole from the managed upload infrastructure stack controls what we can do in a user's account (edit: The handler will also perform actions in the account, which is hopefully expected. This can also be controlled by the Role ARN during submission). I'd appreciate it if we could keep speculation on security issues to a minimum here, these topics are vulnerable to hysteria and half-facts. We take security and user account permissions very seriously. If you think there's an issue, please do reach out ASAP as described in CONTRIBUTING.md.

That said, all Jay's comment is saying is that the re-invoke needs to use a similar payload to the initial invoke. And currently, the re-invoke is executed via CloudWatch; but this is an implementation detail.

@tobywf
tobywf requested review from johnttompkins and removed request for johnttompkins January 24, 2020 23:02
@tobywf
tobywf merged commit 48c64bc into aws-cloudformation:master Jan 27, 2020
@tobywf
tobywf deleted the scrub-creds branch January 27, 2020 01:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants