Skip to content

Commit 5bcfc89

Browse files
mlodicmlodic
authored
fix for correctly handling AWS Secrets (#2567)
* fix for correctly handling AWS Secrets * fix for correctly handling AWS Secrets
1 parent 38692c5 commit 5bcfc89

File tree

5 files changed

+68
-52
lines changed

5 files changed

+68
-52
lines changed

‎docker/env_file_app_template‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ SLACK_TOKEN=
5353
DEFAULT_SLACK_CHANNEL=
5454

5555
# Elastic Search Configuration
56+
ELASTIC_DSL_ENABLED=False
5657
ELASTIC_HOST=
5758
ELASTIC_PASSWORD=
5859
# consult to: https://django-elasticsearch-dsl.readthedocs.io/en/latest/settings.html

‎intel_owl/secrets.py‎

Lines changed: 29 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -34,28 +34,31 @@ def aws_get_secret(secret_name):
3434
try:
3535
get_secret_value_response = client.get_secret_value(SecretId=secret_name)
3636
except ClientError as e:
37-
if e.response["Error"]["Code"] == "DecryptionFailureException":
38-
# Secrets Manager can't decrypt the protected secret text..
39-
# ... using the provided KMS key.
40-
# Deal with the exception here, and/or rethrow at your discretion.
41-
raise RetrieveSecretException(e)
42-
if e.response["Error"]["Code"] == "InternalServiceErrorException":
43-
# An error occurred on the server side.
44-
# Deal with the exception here, and/or rethrow at your discretion.
45-
raise RetrieveSecretException(e)
46-
if e.response["Error"]["Code"] == "InvalidParameterException":
47-
# You provided an invalid value for a parameter.
48-
# Deal with the exception here, and/or rethrow at your discretion.
49-
raise RetrieveSecretException(e)
50-
if e.response["Error"]["Code"] == "InvalidRequestException":
51-
# You provided a parameter value that is not valid for the..
52-
# ... current state of the resource.
53-
# Deal with the exception here, and/or rethrow at your discretion.
54-
raise RetrieveSecretException(e)
55-
if e.response["Error"]["Code"] == "ResourceNotFoundException":
56-
# We can't find the resource that you asked for.
57-
# Deal with the exception here, and/or rethrow at your discretion.
58-
raise RetrieveSecretException(e)
37+
match e.response["Error"]["Code"]:
38+
case "DecryptionFailureException" | "DecryptionFailure":
39+
# Secrets Manager can't decrypt the protected secret text..
40+
# ... using the provided KMS key.
41+
# Deal with the exception here, and/or rethrow at your discretion.
42+
raise RetrieveSecretException(e)
43+
case "InternalServiceErrorException" | "InternalServiceError":
44+
# An error occurred on the server side.
45+
# Deal with the exception here, and/or rethrow at your discretion.
46+
raise RetrieveSecretException(e)
47+
case "InvalidParameterException":
48+
# You provided an invalid value for a parameter.
49+
# Deal with the exception here, and/or rethrow at your discretion.
50+
raise RetrieveSecretException(e)
51+
case "InvalidRequestException":
52+
# You provided a parameter value that is not valid for the..
53+
# ... current state of the resource.
54+
# Deal with the exception here, and/or rethrow at your discretion.
55+
raise RetrieveSecretException(e)
56+
case "ResourceNotFoundException":
57+
# We can't find the resource that you asked for.
58+
# Deal with the exception here, and/or rethrow at your discretion.
59+
raise RetrieveSecretException(e)
60+
case _:
61+
raise RetrieveSecretException(e)
5962
else:
6063
# Decrypts secret using the associated KMS CMK.
6164
# Depending on whether the secret is a string or binary,..
@@ -86,5 +89,8 @@ def get_secret(secret_name, default=""):
8689
logging.error(
8790
f"Error: {e}. Secret: {secret_name}"
8891
) # lgtm [py/clear-text-logging-sensitive-data]
89-
92+
except Exception as e:
93+
logging.exception(
94+
f"Error: {e}. Secret: {secret_name}"
95+
) # lgtm [py/clear-text-logging-sensitive-data]
9096
return secret

‎intel_owl/settings/aws.py‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
# This file is a part of IntelOwl https://github.com/intelowlproject/IntelOwl
22
# See the file 'LICENSE' for copying permission.
33

4+
import sys
5+
46
from intel_owl import secrets
57

68
# AWS settings
@@ -10,6 +12,10 @@
1012
AWS_SECRET_ACCESS_KEY = secrets.get_secret("AWS_SECRET_ACCESS_KEY")
1113
AWS_SECRETS = secrets.get_secret("AWS_SECRETS", False) == "True"
1214
AWS_SQS = secrets.get_secret("AWS_SQS", False) == "True"
13-
AWS_USER_NUMBER = secrets.get_secret("AWS_USER_NUMBER")
15+
if AWS_SQS:
16+
AWS_USER_NUMBER = secrets.get_secret("AWS_USER_NUMBER")
17+
if not AWS_USER_NUMBER:
18+
print("you must specify the USER NUMBER")
19+
sys.exit(4)
1420

1521
AWS_RDS_IAM_ROLE = secrets.get_secret("AWS_RDS_IAM_ROLE", False) == "True"

‎intel_owl/settings/celery.py‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,9 @@
22
# See the file 'LICENSE' for copying permission.
33

44
# this module must run before the others
5-
import sys
65

76
from ._util import get_secret
8-
from .aws import AWS_SQS, AWS_USER_NUMBER
7+
from .aws import AWS_SQS
98

109
RESULT_BACKEND = "django-db"
1110
BROKER_URL = get_secret("BROKER_URL", None)
@@ -23,7 +22,3 @@
2322
for queue in [DEFAULT_QUEUE, CONFIG_QUEUE]:
2423
if queue not in CELERY_QUEUES:
2524
CELERY_QUEUES.append(queue)
26-
27-
if AWS_SQS and not AWS_USER_NUMBER:
28-
print("you must specify the USER NUMBER")
29-
sys.exit(4)

‎intel_owl/settings/elasticsearch.py‎

Lines changed: 30 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -28,28 +28,36 @@
2828
f"ELASTICSEARCH BI client configuration did not connect correctly: {ELASTICSEARCH_BI_CLIENT.info()}"
2929
)
3030

31-
ELASTIC_HOST = secrets.get_secret("ELASTIC_HOST")
32-
if ELASTIC_HOST:
33-
elastic_client_settings = {"hosts": ELASTIC_HOST}
34-
35-
ELASTIC_PASSWORD = secrets.get_secret("ELASTIC_PASSWORD")
36-
if ELASTIC_PASSWORD:
37-
elastic_client_settings["basic_auth"] = ("elastic", ELASTIC_PASSWORD)
38-
ca_path = "/opt/deploy/intel_owl/certs/elastic_ca/ca.crt"
39-
cert_path = "/opt/deploy/intel_owl/certs/elastic_instance/elasticsearch.crt"
40-
if "elasticsearch:9200" in ELASTIC_HOST:
41-
# in case we use Elastic as container we need the generated
42-
# in case we use Elastic as external service it should have a valid cert
43-
elastic_client_settings["verify_certs"] = cert_path
44-
elastic_client_settings["ca_certs"] = ca_path
45-
ELASTICSEARCH_DSL = {"default": elastic_client_settings}
46-
47-
ELASTICSEARCH_DSL_INDEX_SETTINGS = {
48-
"number_of_shards": int(secrets.get_secret("ELASTICSEARCH_DSL_NO_OF_SHARDS")),
49-
"number_of_replicas": int(
50-
secrets.get_secret("ELASTICSEARCH_DSL_NO_OF_REPLICAS")
51-
),
52-
}
31+
ELASTIC_DSL_ENABLED = secrets.get_secret("ELASTIC_DSL_ENABLED", False) == "True"
32+
if ELASTIC_DSL_ENABLED:
33+
ELASTIC_HOST = secrets.get_secret("ELASTIC_HOST")
34+
if ELASTIC_HOST:
35+
elastic_client_settings = {"hosts": ELASTIC_HOST}
36+
37+
ELASTIC_PASSWORD = secrets.get_secret("ELASTIC_PASSWORD")
38+
if ELASTIC_PASSWORD:
39+
elastic_client_settings["basic_auth"] = ("elastic", ELASTIC_PASSWORD)
40+
ca_path = "/opt/deploy/intel_owl/certs/elastic_ca/ca.crt"
41+
cert_path = "/opt/deploy/intel_owl/certs/elastic_instance/elasticsearch.crt"
42+
if "elasticsearch:9200" in ELASTIC_HOST:
43+
# in case we use Elastic as container we need the generated
44+
# in case we use Elastic as external service it should have a valid cert
45+
elastic_client_settings["verify_certs"] = cert_path
46+
elastic_client_settings["ca_certs"] = ca_path
47+
ELASTICSEARCH_DSL = {"default": elastic_client_settings}
48+
49+
ELASTICSEARCH_DSL_INDEX_SETTINGS = {
50+
"number_of_shards": int(
51+
secrets.get_secret("ELASTICSEARCH_DSL_NO_OF_SHARDS")
52+
),
53+
"number_of_replicas": int(
54+
secrets.get_secret("ELASTICSEARCH_DSL_NO_OF_REPLICAS")
55+
),
56+
}
57+
else:
58+
print(
59+
"you have to configure ELASTIC_HOST with the URL of your ElasticSearch instance"
60+
)
5361
else:
5462
ELASTICSEARCH_DSL_AUTOSYNC = False
5563
ELASTICSEARCH_DSL = {

0 commit comments

Comments
 (0)