Skip to content

Commit f9705b5

Browse files
lym953lym953
authored
chore: Separate AwsCredentials from AwsConfig (#716)
# Problem Right now `AwsConfig` has a lot of fields, including the ones related to credential: ``` pub aws_access_key_id: String, pub aws_secret_access_key: String, pub aws_session_token: String, pub aws_container_credentials_full_uri: String, pub aws_container_authorization_token: String, ``` The next PR #717 wants to lazily load API key and the credentials. To do that, for the resolver function `resolve_secrets()`, I need to change the param `aws_config` from `&AwsConfig` to `Arc<RwLock<AwsConfig>>`. Because `aws_config` is passed to many places, this change involves updating lots of functions, which is formidable. # This PR Separates these credential-related fields out from `AwsConfig` and creates a new struct `AwsCredentials` Thus, the next PR will only need to change the param `aws_credentials` from `&AwsCredentials` to `Arc<RwLock<AwsCredentials>>`. Because `aws_credentials` is not used in lots of places, the next PR becomes easier. https://datadoghq.atlassian.net/issues/SVLS-6996 https://datadoghq.atlassian.net/issues/SVLS-6998
1 parent 24f14f8 commit f9705b5

7 files changed

Lines changed: 93 additions & 86 deletions

File tree

‎bottlecap/src/bin/bottlecap/main.rs‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ use bottlecap::{
1313
base_url,
1414
config::{
1515
self,
16-
aws::{build_lambda_function_arn, AwsConfig},
16+
aws::{build_lambda_function_arn, AwsConfig, AwsCredentials},
1717
Config,
1818
},
1919
event_bus::bus::EventBus,
@@ -302,7 +302,7 @@ async fn register(client: &Client) -> Result<RegisterResponse> {
302302
#[tokio::main]
303303
async fn main() -> Result<()> {
304304
let start_time = Instant::now();
305-
let (mut aws_config, config) = load_configs(start_time);
305+
let (aws_config, mut aws_credentials, config) = load_configs(start_time);
306306

307307
enable_logging_subsystem(&config);
308308
log_fips_status(&aws_config.region);
@@ -329,7 +329,9 @@ async fn main() -> Result<()> {
329329
.await
330330
.map_err(|e| Error::new(std::io::ErrorKind::InvalidData, e.to_string()))?;
331331

332-
if let Some(resolved_api_key) = resolve_secrets(Arc::clone(&config), &mut aws_config).await {
332+
if let Some(resolved_api_key) =
333+
resolve_secrets(Arc::clone(&config), &aws_config, &mut aws_credentials).await
334+
{
333335
match extension_loop_active(
334336
&aws_config,
335337
&config,
@@ -357,9 +359,10 @@ async fn main() -> Result<()> {
357359
}
358360
}
359361

360-
fn load_configs(start_time: Instant) -> (AwsConfig, Arc<Config>) {
362+
fn load_configs(start_time: Instant) -> (AwsConfig, AwsCredentials, Arc<Config>) {
361363
// First load the AWS configuration
362364
let aws_config = AwsConfig::from_env(start_time);
365+
let aws_credentials = AwsCredentials::from_env();
363366
let lambda_directory: String =
364367
env::var("LAMBDA_TASK_ROOT").unwrap_or_else(|_| "/var/task".to_string());
365368
let config = match config::get_config(Path::new(&lambda_directory)) {
@@ -370,7 +373,7 @@ fn load_configs(start_time: Instant) -> (AwsConfig, Arc<Config>) {
370373
}
371374
};
372375

373-
(aws_config, config)
376+
(aws_config, aws_credentials, config)
374377
}
375378

376379
fn enable_logging_subsystem(config: &Arc<Config>) {

‎bottlecap/src/config/aws.rs‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,6 @@ const AWS_LAMBDA_EXEC_WRAPPER: &str = "AWS_LAMBDA_EXEC_WRAPPER";
1515
#[derive(Debug, Clone)]
1616
pub struct AwsConfig {
1717
pub region: String,
18-
pub aws_access_key_id: String,
19-
pub aws_secret_access_key: String,
20-
pub aws_session_token: String,
21-
pub aws_container_credentials_full_uri: String,
22-
pub aws_container_authorization_token: String,
2318
pub aws_lwa_proxy_lambda_runtime_api: Option<String>,
2419
pub function_name: String,
2520
pub runtime_api: String,
@@ -32,18 +27,36 @@ impl AwsConfig {
3227
pub fn from_env(start_time: Instant) -> Self {
3328
Self {
3429
region: env::var(AWS_DEFAULT_REGION).unwrap_or("us-east-1".to_string()),
30+
aws_lwa_proxy_lambda_runtime_api: env::var(AWS_LWA_LAMBDA_RUNTIME_API_PROXY).ok(),
31+
function_name: env::var(AWS_LAMBDA_FUNCTION_NAME).unwrap_or_default(),
32+
runtime_api: env::var(AWS_LAMBDA_RUNTIME_API).unwrap_or_default(),
33+
sandbox_init_time: start_time,
34+
exec_wrapper: env::var(AWS_LAMBDA_EXEC_WRAPPER).ok(),
35+
}
36+
}
37+
}
38+
39+
#[allow(clippy::module_name_repetitions)]
40+
#[derive(Debug, Clone)]
41+
pub struct AwsCredentials {
42+
pub aws_access_key_id: String,
43+
pub aws_secret_access_key: String,
44+
pub aws_session_token: String,
45+
pub aws_container_credentials_full_uri: String,
46+
pub aws_container_authorization_token: String,
47+
}
48+
49+
impl AwsCredentials {
50+
#[must_use]
51+
pub fn from_env() -> Self {
52+
Self {
3553
aws_access_key_id: env::var(AWS_ACCESS_KEY_ID).unwrap_or_default(),
3654
aws_secret_access_key: env::var(AWS_SECRET_ACCESS_KEY).unwrap_or_default(),
3755
aws_session_token: env::var(AWS_SESSION_TOKEN).unwrap_or_default(),
3856
aws_container_credentials_full_uri: env::var(AWS_CONTAINER_CREDENTIALS_FULL_URI)
3957
.unwrap_or_default(),
4058
aws_container_authorization_token: env::var(AWS_CONTAINER_AUTHORIZATION_TOKEN)
4159
.unwrap_or_default(),
42-
aws_lwa_proxy_lambda_runtime_api: env::var(AWS_LWA_LAMBDA_RUNTIME_API_PROXY).ok(),
43-
function_name: env::var(AWS_LAMBDA_FUNCTION_NAME).unwrap_or_default(),
44-
runtime_api: env::var(AWS_LAMBDA_RUNTIME_API).unwrap_or_default(),
45-
sandbox_init_time: start_time,
46-
exec_wrapper: env::var(AWS_LAMBDA_EXEC_WRAPPER).ok(),
4760
}
4861
}
4962
}

‎bottlecap/src/lifecycle/invocation/processor.rs‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -966,11 +966,6 @@ mod tests {
966966
fn setup() -> Processor {
967967
let aws_config = AwsConfig {
968968
region: "us-east-1".into(),
969-
aws_access_key_id: "***".into(),
970-
aws_secret_access_key: "***".into(),
971-
aws_session_token: "***".into(),
972-
aws_container_credentials_full_uri: "***".into(),
973-
aws_container_authorization_token: "***".into(),
974969
aws_lwa_proxy_lambda_runtime_api: Some("***".into()),
975970
function_name: "test-function".into(),
976971
sandbox_init_time: Instant::now(),

‎bottlecap/src/lifecycle/invocation/span_inferrer.rs‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -480,11 +480,6 @@ mod tests {
480480

481481
let aws_config = AwsConfig {
482482
region: "us-east-1".to_string(),
483-
aws_access_key_id: "".to_string(),
484-
aws_secret_access_key: "".to_string(),
485-
aws_session_token: "".to_string(),
486-
aws_container_credentials_full_uri: "".to_string(),
487-
aws_container_authorization_token: "".to_string(),
488483
aws_lwa_proxy_lambda_runtime_api: Some("".to_string()),
489484
runtime_api: "".to_string(),
490485
function_name: "".to_string(),

‎bottlecap/src/proxy/interceptor.rs‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -400,13 +400,8 @@ mod tests {
400400

401401
let aws_config = AwsConfig {
402402
region: "us-east-1".to_string(),
403-
aws_access_key_id: "AKIDEXAMPLE".to_string(),
404-
aws_secret_access_key: "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY".to_string(),
405-
aws_session_token: "AQoDYXdzEJr...<remainder of session token>".to_string(),
406403
function_name: "arn:some-function".to_string(),
407404
sandbox_init_time: Instant::now(),
408-
aws_container_credentials_full_uri: String::new(),
409-
aws_container_authorization_token: String::new(),
410405
runtime_api: aws_lambda_runtime_api.to_string(),
411406
aws_lwa_proxy_lambda_runtime_api: Some(aws_lwa_lambda_runtime_api.to_string()),
412407
exec_wrapper: None,

‎bottlecap/src/proxy/mod.rs‎

Lines changed: 0 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,6 @@ mod tests {
3737
});
3838
let aws_config = AwsConfig {
3939
region: "us-east-1".to_string(),
40-
aws_access_key_id: "".to_string(),
41-
aws_secret_access_key: "".to_string(),
42-
aws_session_token: "".to_string(),
43-
aws_container_credentials_full_uri: "".to_string(),
44-
aws_container_authorization_token: "".to_string(),
4540
aws_lwa_proxy_lambda_runtime_api: Some("127.0.0.1:12345".to_string()),
4641
function_name: "".to_string(),
4742
runtime_api: "".to_string(),
@@ -55,11 +50,6 @@ mod tests {
5550
let config = Arc::new(Config::default());
5651
let aws_config = AwsConfig {
5752
region: "us-east-1".to_string(),
58-
aws_access_key_id: "".to_string(),
59-
aws_secret_access_key: "".to_string(),
60-
aws_session_token: "".to_string(),
61-
aws_container_credentials_full_uri: "".to_string(),
62-
aws_container_authorization_token: "".to_string(),
6353
// LWA proxy is set, so we should start the proxy
6454
aws_lwa_proxy_lambda_runtime_api: Some("127.0.0.1:12345".to_string()),
6555
function_name: "".to_string(),
@@ -79,11 +69,6 @@ mod tests {
7969
});
8070
let aws_config = AwsConfig {
8171
region: "us-east-1".to_string(),
82-
aws_access_key_id: "".to_string(),
83-
aws_secret_access_key: "".to_string(),
84-
aws_session_token: "".to_string(),
85-
aws_container_credentials_full_uri: "".to_string(),
86-
aws_container_authorization_token: "".to_string(),
8772
aws_lwa_proxy_lambda_runtime_api: None,
8873
function_name: "".to_string(),
8974
runtime_api: "".to_string(),
@@ -102,11 +87,6 @@ mod tests {
10287
});
10388
let aws_config = AwsConfig {
10489
region: "us-east-1".to_string(),
105-
aws_access_key_id: "".to_string(),
106-
aws_secret_access_key: "".to_string(),
107-
aws_session_token: "".to_string(),
108-
aws_container_credentials_full_uri: "".to_string(),
109-
aws_container_authorization_token: "".to_string(),
11090
aws_lwa_proxy_lambda_runtime_api: None,
11191
function_name: "".to_string(),
11292
runtime_api: "".to_string(),
@@ -125,11 +105,6 @@ mod tests {
125105
});
126106
let aws_config = AwsConfig {
127107
region: "us-east-1".to_string(),
128-
aws_access_key_id: "".to_string(),
129-
aws_secret_access_key: "".to_string(),
130-
aws_session_token: "".to_string(),
131-
aws_container_credentials_full_uri: "".to_string(),
132-
aws_container_authorization_token: "".to_string(),
133108
aws_lwa_proxy_lambda_runtime_api: None,
134109
function_name: "".to_string(),
135110
runtime_api: "".to_string(),

0 commit comments

Comments
 (0)