Permalink
Browse files

Move secrets from json file to environment variables sourced from bas…

…h file
  • Loading branch information...
gene1wood committed Oct 31, 2018
1 parent 99c18e5 commit f5267b9c5bb64c28ef0bd6141a3f482a829faf32
Showing with 13 additions and 6 deletions.
  1. +2 −1 .gitignore
  2. +9 −5 cloudy_mozdef/Makefile
  3. +1 −0 cloudy_mozdef/aws_parameters.example.sh
  4. +1 −0 cloudy_mozdef/dmake
View
@@ -13,4 +13,5 @@ alerts/generic_alerts
/.project
/data
.vscode
cloudy_mozdef/aws_parameters.json
cloudy_mozdef/aws_parameters.json
cloudy_mozdef/aws_parameters.sh
View
@@ -8,7 +8,8 @@ STACK_PARAMS := file://aws_parameters.json
S3_BUCKET_NAME := mozdef.infosec.allizom.org
S3_BUCKET_PATH := cf
S3_BUCKET_URI := s3://$(S3_BUCKET_NAME)/$(S3_BUCKET_PATH)
S3_STACK_URI := https://s3-$(AWS_REGION).amazonaws.com/$(S3_BUCKET_NAME)/$(S3_BUCKET_PATH)/mozdef-parent.yml
S3_STACK_URI := https://s3-$(AWS_REGION).amazonaws.com/$(S3_BUCKET_NAME)/$(S3_BUCKET_PATH)/
# OIDC_CLIENT_SECRET is set in an environment variable by running ". aws_parameters.sh"
all:
@echo 'Available make targets:'
@@ -23,10 +24,12 @@ packer-build: ## Build the base AMI with packer
.PHONY: create-stack
create-stack: test ## Create everything you need for a fresh new stack!
@export AWS_REGION=$(AWS_REGION)
@echo "Make sure you have a param file ($(STACK_PARAMS)) with OIDCClientSecret set."
aws cloudformation create-stack --stack-name $(STACK_NAME) --template-url $(S3_STACK_URI) \
@echo "Make sure you have an environment variable OIDC_CLIENT_SECRET set."
aws cloudformation create-stack --stack-name $(STACK_NAME) --template-url $(S3_STACK_URI)mozdef-parent.yml \
--capabilities CAPABILITY_IAM \
--parameters $(STACK_PARAMS) \
--parameters ParameterKey=S3TemplateLocation,ParameterValue=$(S3_STACK_URI) \
ParameterKey=OIDCClientSecret,ParameterValue=$(OIDC_CLIENT_SECRET) \
--output text
.PHONY: create-s3-bucket
@@ -37,9 +40,10 @@ create-s3-bucket:
.PHONY: updated-nested-stack
update-stack: test ## Updates the nested stack on AWS
@export AWS_REGION=$(AWS_REGION)
aws cloudformation update-stack --stack-name $(STACK_NAME) --template-url $(S3_STACK_URI) \
aws cloudformation update-stack --stack-name $(STACK_NAME) --template-url $(S3_STACK_URI)mozdef-parent.yml \
--capabilities CAPABILITY_IAM \
--parameters $(STACK_PARAMS) \
--parameters ParameterKey=S3TemplateLocation,ParameterValue=$(S3_STACK_URI) \
ParameterKey=OIDCClientSecret,ParameterValue=$(OIDC_CLIENT_SECRET) \
--output text
# --ignore-checks=E2502 : https://github.com/awslabs/cfn-python-lint/issues/408
@@ -0,0 +1 @@
export OIDC_CLIENT_SECRET=secretgoeshere
View
@@ -37,4 +37,5 @@ exec docker run --rm --name ${CONTAINER_NAME} \
-e "AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}" \
-e "AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}" \
-e "AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION}" \
-e "OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}"
${HUB}/${IMG_NAME}:latest make $@

0 comments on commit f5267b9

Please sign in to comment.