class Credstash::Init

Public Instance Methods

init!() click to toggle source

Your code goes here…

# File lib/credstash/init.rb, line 9
def init!
  usage! unless profile_name && region && users.any?
  %w(production staging development).each do |env|
    ensure_kms_key_exists env
    run_credstash_setup env
  end
end
usage!() click to toggle source
# File lib/credstash/init.rb, line 17
def usage!
  puts "Usage: #{$0} <profile> <region> <admin_username> [ ... ]"
  puts "You must provide a profile, region, and list of users (in that order)"
  exit 1
end

Private Instance Methods

account_id() click to toggle source
# File lib/credstash/init.rb, line 66
def account_id
  iam.get_user.user.arn.split(':')[4]
end
create_kms_key!(env) click to toggle source
# File lib/credstash/init.rb, line 39
def create_kms_key! env
  puts "Creating KMS Key for #{env}"
  result = kms.create_key description: "Credstash key for #{env} secrets", policy: policy(env)
  puts "Creating KMS Alias #{key_name env}"
  kms.create_alias alias_name: key_name(env), target_key_id: result.key_metadata.key_id
end
ensure_kms_key_exists(env) click to toggle source
# File lib/credstash/init.rb, line 25
def ensure_kms_key_exists env
  create_kms_key! env unless kms_key_exists? env
end
iam() click to toggle source
# File lib/credstash/init.rb, line 82
def iam
  @iam ||= ::Aws::IAM::Client.new profile: profile_name, region: region
end
key_name(env) click to toggle source
# File lib/credstash/init.rb, line 70
def key_name env
  "alias/credstash-#{env}"
end
kms() click to toggle source
# File lib/credstash/init.rb, line 78
def kms
  @kms ||= ::Aws::KMS::Client.new profile: profile_name, region: region
end
kms_key_exists?(env) click to toggle source
# File lib/credstash/init.rb, line 29
def kms_key_exists? env
  begin
    kms.describe_key(key_id: key_name(env))
    puts "Found existing key alias #{key_name env}"
    return true
  rescue Aws::KMS::Errors::NotFoundException => e
    return false
  end
end
policy(env) click to toggle source
# File lib/credstash/init.rb, line 46
def policy env
  template_file = File.join File.dirname(__FILE__), 'template', 'credstash-key-policy.json.erb'

  # expose some variables to the binding
  @env = env
  @account_id = account_id
  data = JSON.parse ERB.new(File.read(template_file)).result(binding)
  require 'pp'
  data['Statement'].each do |statement|
    next unless statement['Principal']['AWS'].is_a? Array
    statement['Principal']['AWS'] = user_arns
  end

  JSON.pretty_generate data
end
profile_name() click to toggle source
# File lib/credstash/init.rb, line 86
def profile_name
  ARGV.first
end
region() click to toggle source
# File lib/credstash/init.rb, line 90
def region
  ARGV[1]
end
run_credstash_setup(env) click to toggle source
# File lib/credstash/init.rb, line 74
def run_credstash_setup env
  system "credstash -p #{profile_name} -r #{region} -t credstash-#{env} setup"
end
user_arns() click to toggle source
# File lib/credstash/init.rb, line 62
def user_arns
  users.map { |user| "arn:aws:iam::#{account_id}:user/#{user}" }
end
users() click to toggle source
# File lib/credstash/init.rb, line 94
def users
  ARGV.last ARGV.length - 2
end