Skip to content

Commit d97ab7f

Browse files
clintonkclintonk
authored
Enhanced AWS ARN handling to support more partitions
1 parent cf91db0 commit d97ab7f

File tree

4 files changed

+79
-12
lines changed

4 files changed

+79
-12
lines changed

‎storage_drivers/ontap/aws_common.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ func initializeAWSAPI(
8888
}
8989
if secretARN != "" {
9090
var err error
91-
secretManagerRegion, _, _, err = awsapi.ParseSecretARN(secretARN)
91+
_, secretManagerRegion, _, _, err = awsapi.ParseSecretARN(secretARN)
9292
if err != nil {
9393
return nil, err
9494
}
@@ -192,7 +192,7 @@ func getAWSSecretsManagerARNFromConfig(_ context.Context, config *drivers.OntapS
192192
return config.Credentials[drivers.KeyName], nil
193193
}
194194

195-
_, _, _, err := awsapi.ParseSecretARN(config.Username)
195+
_, _, _, _, err := awsapi.ParseSecretARN(config.Username)
196196
if err != nil {
197197
return config.Username, errors.NotFoundError("%s, %s driver with FSxN personality must include Credentials of type %s "+
198198
"in the configuration", err, config.StorageDriverName, string(drivers.CredentialStoreAWSARN))

‎storage_drivers/ontap/aws_common_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -332,7 +332,7 @@ func TestParseSecretARN(t *testing.T) {
332332
t.Run(test.name, func(t *testing.T) {
333333
secretARN := test.userName
334334

335-
_, _, _, err := awsapi.ParseSecretARN(secretARN)
335+
_, _, _, _, err := awsapi.ParseSecretARN(secretARN)
336336
if test.error == "" {
337337
assert.Nil(t, err)
338338
} else {
@@ -363,7 +363,7 @@ func TestParseVolumeARN(t *testing.T) {
363363
t.Run(test.name, func(t *testing.T) {
364364
volumeARN := test.userName
365365

366-
_, _, _, _, err := awsapi.ParseVolumeARN(volumeARN)
366+
_, _, _, _, _, err := awsapi.ParseVolumeARN(volumeARN)
367367
if test.error == "" {
368368
assert.Nil(t, err)
369369
} else {

‎storage_drivers/ontap/awsapi/aws.go‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@ const (
3535
)
3636

3737
var (
38-
volumeARNRegex = regexp.MustCompile(`^arn:(?P<partition>aws|aws-cn|aws-us-gov){1}:fsx:(?P<region>[^:]+):(?P<accountID>\d{12}):volume/(?P<filesystemID>[A-z0-9-]+)/(?P<volumeID>[A-z0-9-]+)$`)
39-
secretARNRegex = regexp.MustCompile(`^arn:(?P<partition>aws|aws-cn|aws-us-gov){1}:secretsmanager:(?P<region>[^:]+):(?P<accountID>\d{12}):secret:(?P<secretName>[A-z0-9/_+=.@-]+)-[A-z0-9/_+=.@-]{6}$`)
38+
volumeARNRegex = regexp.MustCompile(`^arn:(?P<partition>aws|aws-cn|aws-us-gov|aws-eusc|aws-iso(?:-[a-z0-9]+)?):fsx:(?P<region>[^:]+):(?P<accountID>\d{12}):volume/(?P<filesystemID>[A-z0-9-]+)/(?P<volumeID>[A-z0-9-]+)$`)
39+
secretARNRegex = regexp.MustCompile(`^arn:(?P<partition>aws|aws-cn|aws-us-gov|aws-eusc|aws-iso(?:-[a-z0-9]+)?):secretsmanager:(?P<region>[^:]+):(?P<accountID>\d{12}):secret:(?P<secretName>[A-z0-9/_+=.@-]+)-[A-z0-9/_+=.@-]{6}$`)
4040
)
4141

4242
// ClientConfig holds configuration data for the API driver object.
@@ -207,7 +207,7 @@ func (d *Client) DeleteSecret(ctx context.Context, secretARN string) error {
207207
}
208208

209209
// ParseVolumeARN parses the AWS-style ARN for a volume.
210-
func ParseVolumeARN(volumeARN string) (region, accountID, filesystemID, volumeID string, err error) {
210+
func ParseVolumeARN(volumeARN string) (partition, region, accountID, filesystemID, volumeID string, err error) {
211211
match := volumeARNRegex.FindStringSubmatch(volumeARN)
212212

213213
if match == nil {
@@ -222,6 +222,7 @@ func ParseVolumeARN(volumeARN string) (region, accountID, filesystemID, volumeID
222222
}
223223
}
224224

225+
partition = paramsMap["partition"]
225226
region = paramsMap["region"]
226227
accountID = paramsMap["accountID"]
227228
filesystemID = paramsMap["filesystemID"]
@@ -231,7 +232,7 @@ func ParseVolumeARN(volumeARN string) (region, accountID, filesystemID, volumeID
231232
}
232233

233234
// ParseSecretARN parses the AWS-style ARN for a secret.
234-
func ParseSecretARN(secretARN string) (region, accountID, secretName string, err error) {
235+
func ParseSecretARN(secretARN string) (partition, region, accountID, secretName string, err error) {
235236
match := secretARNRegex.FindStringSubmatch(secretARN)
236237

237238
if match == nil {
@@ -246,6 +247,7 @@ func ParseSecretARN(secretARN string) (region, accountID, secretName string, err
246247
}
247248
}
248249

250+
partition = paramsMap["partition"]
249251
region = paramsMap["region"]
250252
accountID = paramsMap["accountID"]
251253
secretName = paramsMap["secretName"]
@@ -568,7 +570,7 @@ func (d *Client) GetVolumeByName(ctx context.Context, name string) (*Volume, err
568570
}
569571

570572
func (d *Client) GetVolumeByARN(ctx context.Context, volumeARN string) (*Volume, error) {
571-
_, _, _, volumeID, err := ParseVolumeARN(volumeARN)
573+
_, _, _, _, volumeID, err := ParseVolumeARN(volumeARN)
572574
if err != nil {
573575
return nil, err
574576
}
@@ -663,7 +665,7 @@ func (d *Client) VolumeExistsByName(ctx context.Context, name string) (bool, *Vo
663665
}
664666

665667
func (d *Client) VolumeExistsByARN(ctx context.Context, volumeARN string) (bool, *Volume, error) {
666-
_, _, _, volumeID, err := ParseVolumeARN(volumeARN)
668+
_, _, _, _, volumeID, err := ParseVolumeARN(volumeARN)
667669
if err != nil {
668670
return false, nil, err
669671
}

‎storage_drivers/ontap/awsapi/aws_test.go‎

Lines changed: 67 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,7 @@ func TestParseVolumeARN(t *testing.T) {
198198
name string
199199
arn string
200200
expectError bool
201+
expectedPartition string
201202
expectedRegion string
202203
expectedAccountID string
203204
expectedFilesystemID string
@@ -207,6 +208,7 @@ func TestParseVolumeARN(t *testing.T) {
207208
name: "ValidARN",
208209
arn: testVolumeARN,
209210
expectError: false,
211+
expectedPartition: "aws",
210212
expectedRegion: "us-east-1",
211213
expectedAccountID: testAccountID,
212214
expectedFilesystemID: testFilesystemID,
@@ -236,6 +238,7 @@ func TestParseVolumeARN(t *testing.T) {
236238
name: "AWSChinaPartition",
237239
arn: "arn:aws-cn:fsx:cn-north-1:123456789012:volume/fs-1234567890abcdef0/fv-1234567890abcdef0",
238240
expectError: false,
241+
expectedPartition: "aws-cn",
239242
expectedRegion: "cn-north-1",
240243
expectedAccountID: testAccountID,
241244
expectedFilesystemID: testFilesystemID,
@@ -245,16 +248,37 @@ func TestParseVolumeARN(t *testing.T) {
245248
name: "AWSGovCloudPartition",
246249
arn: "arn:aws-us-gov:fsx:us-gov-east-1:123456789012:volume/fs-1234567890abcdef0/fv-1234567890abcdef0",
247250
expectError: false,
251+
expectedPartition: "aws-us-gov",
248252
expectedRegion: "us-gov-east-1",
249253
expectedAccountID: testAccountID,
250254
expectedFilesystemID: testFilesystemID,
251255
expectedVolumeID: testVolumeID,
252256
},
257+
{
258+
name: "AWSTopSecretPartition",
259+
arn: "arn:aws-iso:fsx:us-iso-east-1:123456789012:volume/fs-1234567890abcdef0/fv-1234567890abcdef0",
260+
expectError: false,
261+
expectedPartition: "aws-iso",
262+
expectedRegion: "us-iso-east-1",
263+
expectedAccountID: testAccountID,
264+
expectedFilesystemID: testFilesystemID,
265+
expectedVolumeID: testVolumeID,
266+
},
267+
{
268+
name: "AWSSecretPartition",
269+
arn: "arn:aws-iso-b:fsx:us-iso-b-east-1:123456789012:volume/fs-1234567890abcdef0/fv-1234567890abcdef0",
270+
expectError: false,
271+
expectedPartition: "aws-iso-b",
272+
expectedRegion: "us-iso-b-east-1",
273+
expectedAccountID: testAccountID,
274+
expectedFilesystemID: testFilesystemID,
275+
expectedVolumeID: testVolumeID,
276+
},
253277
}
254278

255279
for _, tt := range tests {
256280
t.Run(tt.name, func(t *testing.T) {
257-
region, accountID, filesystemID, volumeID, err := ParseVolumeARN(tt.arn)
281+
partition, region, accountID, filesystemID, volumeID, err := ParseVolumeARN(tt.arn)
258282

259283
if tt.expectError {
260284
assert.Error(t, err)
@@ -263,6 +287,7 @@ func TestParseVolumeARN(t *testing.T) {
263287
}
264288

265289
assert.NoError(t, err)
290+
assert.Equal(t, tt.expectedPartition, partition)
266291
assert.Equal(t, tt.expectedRegion, region)
267292
assert.Equal(t, tt.expectedAccountID, accountID)
268293
assert.Equal(t, tt.expectedFilesystemID, filesystemID)
@@ -276,6 +301,7 @@ func TestParseSecretARN(t *testing.T) {
276301
name string
277302
arn string
278303
expectError bool
304+
expectedPartition string
279305
expectedRegion string
280306
expectedAccountID string
281307
expectedSecretName string
@@ -284,6 +310,7 @@ func TestParseSecretARN(t *testing.T) {
284310
name: "ValidARN",
285311
arn: testSecretARN,
286312
expectError: false,
313+
expectedPartition: "aws",
287314
expectedRegion: "us-east-1",
288315
expectedAccountID: testAccountID,
289316
expectedSecretName: testSecretName,
@@ -312,15 +339,52 @@ func TestParseSecretARN(t *testing.T) {
312339
name: "SpecialCharacters",
313340
arn: "arn:aws:secretsmanager:us-east-1:123456789012:secret:my/secret_name.with+special@chars-AbCdEf",
314341
expectError: false,
342+
expectedPartition: "aws",
315343
expectedRegion: "us-east-1",
316344
expectedAccountID: testAccountID,
317345
expectedSecretName: "my/secret_name.with+special@chars",
318346
},
347+
{
348+
name: "AWSChinaPartition",
349+
arn: "arn:aws-cn:secretsmanager:cn-north-1:123456789012:secret:my/secret_name.with+special@chars-AbCdEf",
350+
expectError: false,
351+
expectedPartition: "aws-cn",
352+
expectedRegion: "cn-north-1",
353+
expectedAccountID: testAccountID,
354+
expectedSecretName: "my/secret_name.with+special@chars",
355+
},
356+
{
357+
name: "AWSGovCloudPartition",
358+
arn: "arn:aws-us-gov:secretsmanager:us-gov-east-1:123456789012:secret:my/secret_name.with+special@chars-AbCdEf",
359+
expectError: false,
360+
expectedPartition: "aws-us-gov",
361+
expectedRegion: "us-gov-east-1",
362+
expectedAccountID: testAccountID,
363+
expectedSecretName: "my/secret_name.with+special@chars",
364+
},
365+
{
366+
name: "AWSTopSecretPartition",
367+
arn: "arn:aws-iso:secretsmanager:us-iso-east-1:123456789012:secret:my/secret_name.with+special@chars-AbCdEf",
368+
expectError: false,
369+
expectedPartition: "aws-iso",
370+
expectedRegion: "us-iso-east-1",
371+
expectedAccountID: testAccountID,
372+
expectedSecretName: "my/secret_name.with+special@chars",
373+
},
374+
{
375+
name: "AWSSecretPartition",
376+
arn: "arn:aws-iso-b:secretsmanager:us-iso-b-east-1:123456789012:secret:my/secret_name.with+special@chars-AbCdEf",
377+
expectError: false,
378+
expectedPartition: "aws-iso-b",
379+
expectedRegion: "us-iso-b-east-1",
380+
expectedAccountID: testAccountID,
381+
expectedSecretName: "my/secret_name.with+special@chars",
382+
},
319383
}
320384

321385
for _, tt := range tests {
322386
t.Run(tt.name, func(t *testing.T) {
323-
region, accountID, secretName, err := ParseSecretARN(tt.arn)
387+
partition, region, accountID, secretName, err := ParseSecretARN(tt.arn)
324388

325389
if tt.expectError {
326390
assert.Error(t, err)
@@ -329,6 +393,7 @@ func TestParseSecretARN(t *testing.T) {
329393
}
330394

331395
assert.NoError(t, err)
396+
assert.Equal(t, tt.expectedPartition, partition)
332397
assert.Equal(t, tt.expectedRegion, region)
333398
assert.Equal(t, tt.expectedAccountID, accountID)
334399
assert.Equal(t, tt.expectedSecretName, secretName)

0 commit comments

Comments
 (0)