kms_root.go

package aws

import (
	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/awserr"
	"github.com/aws/aws-sdk-go/service/kms"
	log "github.com/sirupsen/logrus"
	"time"

	"github.com/Qovery/pleco/pkg/common"
)

type CompleteKey struct {
	common.CloudProviderResource
	Status     string
	KeyManager string
}

func getKeys(svc kms.KMS) []*kms.KeyListEntry {
	var marker *string
	var keysOutput []*kms.KeyListEntry
	for {
		input := &kms.ListKeysInput{
			Limit:  aws.Int64(1000),
			Marker: marker,
		}

		keys, err := svc.ListKeys(input)
		handleKMSError(err)
		keysOutput = append(keysOutput, keys.Keys...)

		if keys.NextMarker == nil || keys.NextMarker == marker {
			break
		}

		marker = keys.NextMarker
	}

	return keysOutput
}

func getCompleteKey(svc kms.KMS, keyId *string, tagName string) CompleteKey {
	tags := getKeyTags(svc, keyId)
	metaData := getKeyMetadata(svc, keyId)

	if metaData == nil || tags == nil {
		return CompleteKey{
			CloudProviderResource: common.CloudProviderResource{
				Identifier:   *keyId,
				Description:  "KMS: " + *keyId,
				CreationDate: time.Now().UTC(),
				TTL:          -1,
				Tag:          "ttl",
				IsProtected:  false,
			},
			Status:     "PendingDeletion",
			KeyManager: "",
		}
	}
	essentialTags := common.GetEssentialTags(tags, tagName)

	return CompleteKey{
		CloudProviderResource: common.CloudProviderResource{
			Identifier:   *keyId,
			Description:  "KMS: " + *keyId,
			CreationDate: metaData.KeyMetadata.CreationDate.UTC(),
			TTL:          essentialTags.TTL,
			Tag:          essentialTags.Tag,
			IsProtected:  essentialTags.IsProtected,
		},
		Status:     *metaData.KeyMetadata.KeyState,
		KeyManager: *metaData.KeyMetadata.KeyManager,
	}
}

func deleteKey(svc kms.KMS, keyId string) (*kms.ScheduleKeyDeletionOutput, error) {
	input := &kms.ScheduleKeyDeletionInput{
		KeyId:               aws.String(keyId),
		PendingWindowInDays: aws.Int64(7),
	}

	result, err := svc.ScheduleKeyDeletion(input)
	handleKMSError(err)

	return result, err
}

func getKeyTags(svc kms.KMS, keyId *string) []*kms.Tag {
	input := &kms.ListResourceTagsInput{
		KeyId: aws.String(*keyId),
	}

	tags, err := svc.ListResourceTags(input)
	handleKMSError(err)

	return tags.Tags
}

func getKeyMetadata(svc kms.KMS, keyId *string) *kms.DescribeKeyOutput {
	input := &kms.DescribeKeyInput{KeyId: keyId}

	data, err := svc.DescribeKey(input)
	handleKMSError(err)

	return data
}

func handleKMSError(error error) {
	if error != nil {
		if aerr, ok := error.(awserr.Error); ok {
			switch aerr.Code() {
			case kms.ErrCodeNotFoundException:
				log.Error(kms.ErrCodeNotFoundException, aerr.Error())
			case kms.ErrCodeInvalidArnException:
				log.Error(kms.ErrCodeInvalidArnException, aerr.Error())
			case kms.ErrCodeDependencyTimeoutException:
				log.Error(kms.ErrCodeDependencyTimeoutException, aerr.Error())
			case kms.ErrCodeInternalException:
				log.Error(kms.ErrCodeInternalException, aerr.Error())
			case kms.ErrCodeInvalidStateException:
				log.Error(kms.ErrCodeInvalidStateException, aerr.Error())
			default:
				log.Error(aerr.Error())
			}
		} else {
			log.Error(error.Error())
		}

	}
}

func DeleteExpiredKeys(sessions AWSSessions, options AwsOptions) {
	keys := getKeys(*sessions.KMS)
	region := sessions.KMS.Config.Region
	var expiredKeys []CompleteKey
	for _, key := range keys {
		completeKey := getCompleteKey(*sessions.KMS, key.KeyId, options.TagName)

		if completeKey.Status != "PendingDeletion" && completeKey.Status != "Disabled" && completeKey.CloudProviderResource.IsResourceExpired(options.TagValue, options.DisableTTLCheck) && completeKey.KeyManager == "CUSTOMER" {
			expiredKeys = append(expiredKeys, completeKey)
		}
	}

	count, start := common.ElemToDeleteFormattedInfos("expired KMS key", len(expiredKeys), *region)

	log.Info(count)

	if options.DryRun || len(expiredKeys) == 0 {
		return
	}

	log.Info(start)

	for _, key := range expiredKeys {
		_, deletionErr := deleteKey(*sessions.KMS, key.Identifier)
		if deletionErr != nil {
			log.Errorf("Deletion KMS key error %s/%s: %s", key.Identifier, *region, deletionErr)
		} else {
			log.Debugf("KMS key %s in %s deleted.", key.Identifier, *sessions.KMS.Config.Region)
		}
	}
}