class Credstash::Init
Public Instance Methods
init!()
click to toggle source
Your code goes hereā¦
# File lib/credstash/init.rb, line 9 def init! usage! unless profile_name && region && users.any? %w(production staging development).each do |env| ensure_kms_key_exists env run_credstash_setup env end end
usage!()
click to toggle source
# File lib/credstash/init.rb, line 17 def usage! puts "Usage: #{$0} <profile> <region> <admin_username> [ ... ]" puts "You must provide a profile, region, and list of users (in that order)" exit 1 end
Private Instance Methods
account_id()
click to toggle source
# File lib/credstash/init.rb, line 66 def account_id iam.get_user.user.arn.split(':')[4] end
create_kms_key!(env)
click to toggle source
# File lib/credstash/init.rb, line 39 def create_kms_key! env puts "Creating KMS Key for #{env}" result = kms.create_key description: "Credstash key for #{env} secrets", policy: policy(env) puts "Creating KMS Alias #{key_name env}" kms.create_alias alias_name: key_name(env), target_key_id: result.key_metadata.key_id end
ensure_kms_key_exists(env)
click to toggle source
# File lib/credstash/init.rb, line 25 def ensure_kms_key_exists env create_kms_key! env unless kms_key_exists? env end
iam()
click to toggle source
# File lib/credstash/init.rb, line 82 def iam @iam ||= ::Aws::IAM::Client.new profile: profile_name, region: region end
key_name(env)
click to toggle source
# File lib/credstash/init.rb, line 70 def key_name env "alias/credstash-#{env}" end
kms()
click to toggle source
# File lib/credstash/init.rb, line 78 def kms @kms ||= ::Aws::KMS::Client.new profile: profile_name, region: region end
kms_key_exists?(env)
click to toggle source
# File lib/credstash/init.rb, line 29 def kms_key_exists? env begin kms.describe_key(key_id: key_name(env)) puts "Found existing key alias #{key_name env}" return true rescue Aws::KMS::Errors::NotFoundException => e return false end end
policy(env)
click to toggle source
# File lib/credstash/init.rb, line 46 def policy env template_file = File.join File.dirname(__FILE__), 'template', 'credstash-key-policy.json.erb' # expose some variables to the binding @env = env @account_id = account_id data = JSON.parse ERB.new(File.read(template_file)).result(binding) require 'pp' data['Statement'].each do |statement| next unless statement['Principal']['AWS'].is_a? Array statement['Principal']['AWS'] = user_arns end JSON.pretty_generate data end
profile_name()
click to toggle source
# File lib/credstash/init.rb, line 86 def profile_name ARGV.first end
region()
click to toggle source
# File lib/credstash/init.rb, line 90 def region ARGV[1] end
run_credstash_setup(env)
click to toggle source
# File lib/credstash/init.rb, line 74 def run_credstash_setup env system "credstash -p #{profile_name} -r #{region} -t credstash-#{env} setup" end
user_arns()
click to toggle source
# File lib/credstash/init.rb, line 62 def user_arns users.map { |user| "arn:aws:iam::#{account_id}:user/#{user}" } end
users()
click to toggle source
# File lib/credstash/init.rb, line 94 def users ARGV.last ARGV.length - 2 end