-
Notifications
You must be signed in to change notification settings - Fork 0
/
key.go
72 lines (57 loc) · 1.87 KB
/
key.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
package kms
import (
"context"
"github.com/observeinc/aws-snapshot/pkg/api"
"github.com/aws/aws-sdk-go/aws/awserr"
"github.com/aws/aws-sdk-go/service/kms"
)
type DescribeKeyOutput struct {
*kms.DescribeKeyOutput
}
func (o *DescribeKeyOutput) Records() (records []*api.Record) {
records = append(records, &api.Record{
ID: o.KeyMetadata.Arn,
Data: o,
})
return
}
type DescribeKey struct {
API
}
var _ api.RequestBuilder = &DescribeKey{}
// New implements api.RequestBuilder
func (fn *DescribeKey) New(name string, config interface{}) ([]api.Request, error) {
var listKeysInput kms.ListKeysInput
if err := api.DecodeConfig(config, &listKeysInput); err != nil {
return nil, err
}
call := func(ctx context.Context, ch chan<- *api.Record) error {
var outerErr, innerErr error
outerErr = fn.ListKeysPagesWithContext(ctx, &listKeysInput, func(output *kms.ListKeysOutput, last bool) bool {
for _, entry := range output.Keys {
output, err := fn.DescribeKeyWithContext(ctx, &kms.DescribeKeyInput{
KeyId: entry.KeyId,
})
// According to https://github.com/awsdocs/aws-kms-developer-guide/blob/master/doc_source/key-policies.md#using-key-policies-in-aws-kms
// "Unless the key policy explicitly allows it, you cannot use IAM policies to allow access to a KMS key."
//
// This means that AccessDeniedException errors like https://observe.atlassian.net/browse/OB-10958 should happen
// for users that use KMS and set a more restrictive key policy.
if aerr, ok := err.(awserr.Error); ok && aerr.Code() == "AccessDeniedException" {
continue
}
if err != nil {
innerErr = err
return false
}
if err := api.SendRecords(ctx, ch, name, &DescribeKeyOutput{output}); err != nil {
innerErr = err
return false
}
}
return true
})
return api.FirstError(outerErr, innerErr)
}
return []api.Request{call}, nil
}