Skip to content

Commit 6f19c95

Browse files
authored
Merge pull request #116 from ravigurram8/topic-release-10
Rotational secret password
2 parents c90c8f3 + 2e3a6f9 commit 6f19c95

6 files changed

Lines changed: 106 additions & 37 deletions

File tree

config/mongo-config.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
{
22
"db_ssl_enable": "REPLACE_WITH_TRUE_FALSE",
33
"db_auth_enable": "REPLACE_WITH_TRUE_FALSE",
4-
"db_documentdb_enable": "REPLACE_WITH_TRUE_FALSE",
4+
"db_documentdb_enable": "REPLACE_WITH_TRUE_FALSE",
55
"db_ssl_config": {
66
"CAFile": "rds-combined-ca-bundle.pem",
77
"PEMFile": "REPLACE_WITH_PEM_FILE_NAME"
88
},
99
"db_auth_config": {
1010
"username": "app",
1111
"password": "App123",
12+
"secretName": "REPLACE_WITH_secretarn",
1213
"authenticateDb":"admin"
1314
}
1415

deploy.sh

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,7 @@ aws s3 cp "$localhome"/config.tar.gz s3://"$bucketname"
246246
rm -f config.tar.gz
247247

248248
echo "Copying script files to new bucket"
249+
sed -i "s/secret_name/RL-RG-$runid-$env/g" "$localhome"/scripts/connect-db.sh
249250
tar -czf scripts.tar.gz scripts/*
250251
tar -tf scripts.tar.gz
251252
aws s3 cp "$localhome"/scripts.tar.gz s3://"$bucketname"
@@ -337,10 +338,10 @@ function create_cognito_pool() {
337338
function create_doc_db() {
338339
echo "Creating new stack $1"
339340
aws cloudformation deploy --template-file "$localhome"/rg_document_db.yml --stack-name "$1" \
340-
--parameter-overrides MasterUser="$appuser" MasterPassword="$appuserpassword" \
341+
--parameter-overrides DocDBSecretName="RL-RG-$runid-$env" VpceSecurityGroupName="RGVE-SG-$runid" \
341342
DBClusterName="RGCluster-$runid" DBInstanceName="RGInstance-$runid" DBInstanceClass="db.t3.medium" \
342343
Subnet1="$subnet1id" Subnet2="$subnet2id" Subnet3="$subnet3id" VPC="$vpcid" \
343-
SecurityGroupName="RGDB-SG-$runid" DocDBSubnetGroupName="RGDBSubnet-$runid"
344+
SecurityGroupName="RGDB-SG-$runid" DocDBSubnetGroupName="RGDBSubnet-$runid" --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND
344345
echo "Waiting for stack $1 to finish deploying..."
345346
aws cloudformation wait stack-create-complete --stack-name "$1"
346347
}
@@ -355,6 +356,7 @@ function create_image_builder() {
355356

356357
}
357358

359+
358360
function create_main_stack() {
359361
echo "Creating new stack $1"
360362
#update the AMI id in the RGMainStack CFT
@@ -366,14 +368,14 @@ function create_main_stack() {
366368
echo "UserPool ClientId: $userpoolclient_id"
367369
echo "BucketName $bucketname"
368370
echo "RG URL: $rgurl"
369-
if [ -n "$appuserpassword" ]; then
371+
if [ -n "$secpassword" ]; then
370372
echo "UserPassword is not a blank string"
371373
fi
372374
if [ -n "$adminpassword" ]; then
373375
echo "AdminPassword is not a blank string"
374376
fi
375377
echo "VPC Id: $vpcid"
376-
echo "subnet1id: subnet1id"
378+
echo "subnet1id: $subnet1id"
377379
echo "Key Pair: $keypairname"
378380
echo "TGARN: $tgarn"
379381
echo "DocDBURL: $docdburl"
@@ -382,7 +384,7 @@ function create_main_stack() {
382384
aws cloudformation deploy --template-file "$localhome"/rg_main_stack.yml \
383385
--stack-name "$mainstackname" \
384386
--parameter-overrides CFTBucketName="$bucketname" RGUrl="$rgurl"\
385-
UserPassword="$appuserpassword" AdminPassword="$adminpassword" \
387+
UserPassword="$secpassword" AdminPassword="$adminpassword" \
386388
VPC="$vpcid" Subnet1="$subnet1id" KeyName1="$keypairname" TGARN="$tgarn" \
387389
DocumentDBInstanceURL="$docdburl" Environment="$env" BaseAccountPolicyName="RG-Portal-Base-Account-Policy-$env-$runid" \
388390
--capabilities CAPABILITY_NAMED_IAM
@@ -506,12 +508,14 @@ ac_name=$(aws sts get-caller-identity --query "Account" --output text)
506508
r53_domain_name="${rgurl//http[s]*:\/\//}"
507509
jqcmd='.HostedZones[] | select(.Name=='"\"${r53_domain_name}.\""')|.Id'
508510
hosted_zone=$(aws route53 list-hosted-zones-by-name --dns-name "$r53_domain_name" | jq -r "$jqcmd" | sed -e 's#\/hostedzone\/##')
511+
secretdb_arn=$(aws secretsmanager get-secret-value --secret-id RL-RG-$runid-$env | jq --raw-output .ARN)
509512
echo "Creating configs locally"
510513
export RG_ENV="$env"
511514
./makeconfigs.sh "$userpool_id" "$userpoolclient_id" "$bucketname" "$appuser" "$appuserpassword" \
512-
"$runid" "$rgurl" "$region" "ROLE_NAME" "$ac_name" "$hosted_zone"
515+
"$runid" "$rgurl" "$region" "ROLE_NAME" "$ac_name" "$hosted_zone" "$secretdb_arn"
513516
echo "Uploading configs to $bucketname"
514517
aws s3 cp "$localhome"/config.tar.gz s3://"$bucketname"
518+
secpassword=$(aws secretsmanager get-secret-value --secret-id RL-RG-$runid-$env --version-stage AWSCURRENT | jq --raw-output .SecretString| jq -r ."password")
515519
#===============================================================================================================
516520
#Creating Main stack
517521
echo "Deploying main stack (roles, ec2 instance etc.)"

makeconfigs.sh

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
version="0.1.0"
33
echo "Making configs locally...(makeconfigs.sh v$version)"
44
# Ensure right number of params
5-
if [ $# -lt 11 ]; then
5+
if [ $# -lt 12 ]; then
66
echo 'At least 11 parameters are required!'
77
echo ' Param 1: AWS Cognito User Pool id'
88
echo ' Param 2: AWS Cognito client id'
@@ -19,6 +19,7 @@ if [ $# -lt 11 ]; then
1919
echo ' same account to which Research Gateway is to be deployed'
2020
echo ' Param 11: Hosted Zone Id in Route53 to be used for enabling SSL'
2121
echo ' in projects'
22+
echo ' Param 12: AWS secret ARN'
2223
exit 1
2324
fi
2425

@@ -31,6 +32,7 @@ myrunid=$6
3132
myurl=$7
3233
region=$8
3334
role_name=$9
35+
secret_arn=${12}
3436
RG_HOME=$(mktemp -d -t "config.$myrunid.XXX")
3537
echo "RG_HOME=$RG_HOME"
3638
RG_SRC=$(pwd)
@@ -106,6 +108,7 @@ jq -r ".db_ssl_enable=true" "$mytemp/mongo-config.json" |
106108
jq -r ".db_documentdb_enable=true" |
107109
jq -r ".db_auth_config.username=\"$myappuser\"" |
108110
jq -r ".db_auth_config.password=\"$myapppwd\"" |
111+
jq -r ".db_auth_config.secretName=\"$secret_arn\"" |
109112
jq -r '.db_auth_config.authenticateDb="admin"' >"${RG_HOME}/config/mongo-config.json"
110113

111114
echo "Modifying notification-config.json"
@@ -122,6 +125,7 @@ jq -r ".db_ssl_enable=true" "$mytemp/mongo-config.json" |
122125
jq -r '.db_ssl_config.PEMFile="mongodb.pem"' |
123126
jq -r ".db_auth_config.username=\"$myappuser\"" |
124127
jq -r ".db_auth_config.password=\"$myapppwd\"" |
128+
jq -r ".db_auth_config.secretName=\"$secret_arn\"" |
125129
jq -r '.db_auth_config.authenticateDb="admin"' >"${RG_HOME}/config/mongo-config.json"
126130
tar -C "$RG_HOME" -czf config.tar.gz "config"/*
127131
tar -tf config.tar.gz

rg_document_db.yml

Lines changed: 81 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
Description: "AWS CloudFormation Sample Template DocumentDB_Quick_Create: Sample template showing how to create a DocumentDB DB cluster and DB instance. **WARNING** This template creates an Amazon DocumentDB resources and you will be billed for the AWS resources used if you create a stack from this template."
2-
2+
Transform: AWS::SecretsManager-2020-07-23
33
Parameters:
44
DBClusterName:
55
Default: "MyCluster1"
@@ -18,24 +18,7 @@ Parameters:
1818
MaxLength: "64"
1919
AllowedPattern : "[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*"
2020
ConstraintDescription : "Must begin with a letter and contain only alphanumeric characters."
21-
22-
MasterUser:
23-
NoEcho: "true"
24-
Description : "The database admin account username"
25-
Type: "String"
26-
MinLength: "1"
27-
MaxLength: "16"
28-
AllowedPattern: "[a-zA-Z][a-zA-Z0-9]*"
29-
ConstraintDescription : "Must begin with a letter and contain only alphanumeric characters."
30-
31-
MasterPassword:
32-
NoEcho: "true"
33-
Description : "The database admin account password"
34-
Type: "String"
35-
MinLength: "8"
36-
MaxLength: "100"
37-
AllowedPattern : "[a-zA-Z0-9]{8,100}"
38-
ConstraintDescription : "must contain only alphanumeric characters."
21+
3922
AccessFromCidr:
4023
Description: Lockdown SSH and HTTPS access (default can be accessed from anywhere)
4124
Type: String
@@ -55,13 +38,19 @@ Parameters:
5538
Type: AWS::EC2::Subnet::Id
5639
Subnet3:
5740
Description: The VPC subnet in which the EC2 instance
58-
Type: AWS::EC2::Subnet::Id
41+
Type: AWS::EC2::Subnet::Id
5942
SecurityGroupName:
6043
Description: Lockdown SSH and HTTPS access (default can be accessed from anywhere)
6144
Type: String
45+
VpceSecurityGroupName:
46+
Description: Lockdown SSH and HTTPS access
47+
Type: String
6248
DocDBSubnetGroupName:
6349
Description: Subnet Group Name
6450
Type: String
51+
DocDBSecretName:
52+
Description: Secret Name
53+
Type: String
6554
DBInstanceClass:
6655
Description : "Instance class. Please refer to: https://docs.aws.amazon.com/documentdb/latest/developerguide/db-instance-classes.html#db-instance-classes-by-region"
6756
Type: "String"
@@ -81,7 +70,7 @@ Resources:
8170
Properties:
8271
GroupDescription: Amazon DocumentDB Security Group
8372
GroupName: !Ref SecurityGroupName
84-
VpcId: !Ref VPC
73+
VpcId: !Ref VPC
8574
SecurityGroupIngress:
8675
- IpProtocol: tcp
8776
CidrIp: !Ref AccessFromCidr
@@ -90,6 +79,47 @@ Resources:
9079
Tags:
9180
- Key: Name
9281
Value: !Ref SecurityGroupName
82+
VpcendpointSecurityGroup:
83+
Type: AWS::EC2::SecurityGroup
84+
Properties:
85+
GroupDescription: vpc endpoint Security Group
86+
GroupName: !Ref VpceSecurityGroupName
87+
VpcId: !Ref VPC
88+
SecurityGroupIngress:
89+
- IpProtocol: tcp
90+
FromPort: "0"
91+
ToPort: "65535"
92+
CidrIp : "0.0.0.0/0"
93+
Tags:
94+
- Key: Name
95+
Value: !Ref VpceSecurityGroupName
96+
SecretsManagerVPCEndpoint:
97+
Type: AWS::EC2::VPCEndpoint
98+
Properties:
99+
SubnetIds:
100+
- Ref: Subnet1
101+
- Ref: Subnet2
102+
SecurityGroupIds:
103+
- !GetAtt VpcendpointSecurityGroup.GroupId
104+
VpcEndpointType: Interface
105+
ServiceName:
106+
Fn::Sub: com.amazonaws.${AWS::Region}.secretsmanager
107+
PrivateDnsEnabled: true
108+
VpcId:
109+
Ref: VPC
110+
DocDBClusterRotationSecret:
111+
Type: 'AWS::SecretsManager::Secret'
112+
Properties:
113+
Name: !Ref DocDBSecretName
114+
Description: secrets for Documentdb
115+
GenerateSecretString:
116+
SecretStringTemplate: '{"username": "rguser"}'
117+
GenerateStringKey: "password"
118+
PasswordLength: 16
119+
ExcludeCharacters: '"@/\'
120+
Tags:
121+
- Key: Name
122+
Value: /rl/cc/app/server/config/test
93123
DocumentDBSubnetGroup:
94124
Type: AWS::DocDB::DBSubnetGroup
95125
Properties:
@@ -107,8 +137,9 @@ Resources:
107137
DeletionPolicy: Delete
108138
Properties:
109139
DBClusterIdentifier: !Ref DBClusterName
110-
MasterUsername: !Ref MasterUser
111-
MasterUserPassword: !Ref MasterPassword
140+
MasterUsername: rguser
141+
MasterUserPassword:
142+
Fn::Sub: "{{resolve:secretsmanager:${DocDBClusterRotationSecret}::password}}"
112143
EngineVersion: 3.6.0
113144
DBSubnetGroupName : !Ref DocumentDBSubnetGroup
114145
VpcSecurityGroupIds:
@@ -120,6 +151,33 @@ Resources:
120151
DBInstanceIdentifier: !Ref DBInstanceName
121152
DBInstanceClass: !Ref DBInstanceClass
122153
DependsOn: DBCluster
154+
SecretDocDBClusterAttachment:
155+
Type: AWS::SecretsManager::SecretTargetAttachment
156+
Properties:
157+
SecretId:
158+
Ref: DocDBClusterRotationSecret
159+
TargetId:
160+
Ref: DBCluster
161+
TargetType: AWS::DocDB::DBCluster
162+
SecretRotationSchedule:
163+
Type: AWS::SecretsManager::RotationSchedule
164+
DependsOn: SecretDocDBClusterAttachment
165+
Properties:
166+
SecretId:
167+
Ref: DocDBClusterRotationSecret
168+
HostedRotationLambda:
169+
RotationType: MongoDBSingleUser
170+
RotationLambdaName: MongoDBSingleUser
171+
VpcSecurityGroupIds:
172+
Ref: DocumentDBSecurityGroup
173+
VpcSubnetIds:
174+
Fn::Join:
175+
- ","
176+
- - Ref: Subnet1
177+
- Ref: Subnet2
178+
RotationRules:
179+
Duration: 6h
180+
ScheduleExpression: 'rate(30 days)'
123181

124182
Outputs:
125183
ClusterId:

rg_main_stack.yml

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,7 @@ Resources:
102102
- arn:aws:iam::aws:policy/service-role/AWSAppRunnerServicePolicyForECRAccess
103103
- arn:aws:iam::aws:policy/IAMReadOnlyAccess
104104
- arn:aws:iam::aws:policy/AmazonRoute53FullAccess
105+
- arn:aws:iam::aws:policy/SecretsManagerReadWrite
105106
- Ref: ResearchGatewayRolePolicy
106107
Path: /
107108
ResearchGatewayInstanceProfile:
@@ -124,6 +125,7 @@ Resources:
124125
- ec2:CopyImage
125126
- ec2:ModifyImageAttribute
126127
- ec2:ModifyInstanceMetadataOptions
128+
- ec2:CreateNetworkInterface
127129
- iam:attachRolePolicy
128130
- iam:createPolicy
129131
- iam:createPolicyVersion
@@ -163,7 +165,7 @@ Resources:
163165
Type: AWS::EC2::Instance
164166
Properties:
165167
ImageId: ami-0fb3fe843311c4412
166-
InstanceType: t3.large
168+
InstanceType: t3.medium
167169
Monitoring: "true"
168170
DisableApiTermination: "false"
169171
IamInstanceProfile:
@@ -196,7 +198,7 @@ Resources:
196198
aws s3 cp s3://${CFTBucketName}/config.tar.gz /home/ubuntu
197199
chmod +x /home/ubuntu/updatescripts.sh
198200
/home/ubuntu/updatescripts.sh
199-
fixmongo.sh ${Environment}-cc ${AdminPassword} rguser ${UserPassword} ${RGUrl}
201+
fixmongo.sh ${Environment}-cc ${AdminPassword} rguser '${UserPassword}' ${RGUrl}
200202
fixconfigs.sh
201203
start_server.sh ${RGUrl} ${TGARN}
202204
/opt/aws/bin/cfn-signal -e 0 --stack ${AWS::StackName} --resource RGEC2Instance --region ${AWS::Region}
@@ -212,7 +214,7 @@ Resources:
212214
chmod +x /home/ubuntu/updatescripts.sh
213215
/home/ubuntu/updatescripts.sh
214216
fixconfigs.sh
215-
fixdocdb.sh ${DocumentDBInstanceURL} ${Environment}-cc rguser ${UserPassword} ${RGUrl}
217+
fixdocdb.sh ${DocumentDBInstanceURL} ${Environment}-cc rguser '${UserPassword}' ${RGUrl}
216218
start_server.sh ${RGUrl} ${TGARN}
217219
/opt/aws/bin/cfn-signal -e 0 --stack ${AWS::StackName} --resource RGEC2Instance --region ${AWS::Region}
218220
CreationPolicy:
@@ -221,4 +223,4 @@ Resources:
221223
Outputs:
222224
RGAccessURL:
223225
Description: URL to access Research Gateway
224-
Value: !Ref RGUrl
226+
Value: !Ref RGUrl

scripts/connect-db.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ if [ -z "$myinput" ]; then
1515
exit 1
1616
fi
1717

18-
mydbuser=$(jq -r '.db_auth_config.username' <<<"${myinput}")
19-
mydbuserpwd=$(jq -r '.db_auth_config.password' <<<"${myinput}")
18+
mydbuser=$(aws secretsmanager get-secret-value --secret-id secret_name --version-stage AWSCURRENT | jq --raw-output .SecretString| jq -r ."username")
19+
mydbuserpwd=$(aws secretsmanager get-secret-value --secret-id secret_name --version-stage AWSCURRENT | jq --raw-output .SecretString| jq -r ."password")
2020

2121
if [ -z "$mydbuser" ] || [ -z "$mydbuserpwd" ]; then
2222
echo "Could not find DB details. Exiting"

0 commit comments

Comments
 (0)