Skip to content

Commit 7362eec

Browse files
sheensantoscapadngansheensantoscapadngan
authored
Merge pull request #123 from Infisical/feat/new-access-method-for-pam
feat: new access method for pam
2 parents 9ef9396 + 29c243e commit 7362eec

File tree

7 files changed

+257
-239
lines changed

7 files changed

+257
-239
lines changed

‎packages/api/model.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -788,7 +788,8 @@ type RegisterGatewayResponse struct {
788788

789789
type PAMAccessRequest struct {
790790
Duration string `json:"duration,omitempty"`
791-
AccountPath string `json:"accountPath,omitempty"`
791+
ResourceName string `json:"resourceName,omitempty"`
792+
AccountName string `json:"accountName,omitempty"`
792793
ProjectId string `json:"projectId,omitempty"`
793794
MfaSessionId string `json:"mfaSessionId,omitempty"`
794795
}
@@ -807,7 +808,8 @@ type PAMAccessResponse struct {
807808
}
808809

809810
type PAMAccessApprovalRequestPayloadRequestData struct {
810-
AccountPath string `json:"accountPath"`
811+
ResourceName string `json:"resourceName,omitempty"`
812+
AccountName string `json:"accountName,omitempty"`
811813
AccessDuration string `json:"accessDuration"`
812814
}
813815

‎packages/cmd/pam.go‎

Lines changed: 105 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ var pamCmd = &cobra.Command{
1717
Args: cobra.NoArgs,
1818
}
1919

20+
// ==================== Database Commands ====================
21+
2022
var pamDbCmd = &cobra.Command{
2123
Use: "db",
2224
Short: "Database-related PAM commands",
@@ -25,17 +27,22 @@ var pamDbCmd = &cobra.Command{
2527
Args: cobra.NoArgs,
2628
}
2729

28-
var pamDbAccessAccountCmd = &cobra.Command{
29-
Use: "access-account <account-path>",
30+
var pamDbAccessCmd = &cobra.Command{
31+
Use: "access",
3032
Short: "Access PAM database accounts",
3133
Long: "Access PAM database accounts for Infisical. This starts a local database proxy server that you can use to connect to databases directly.",
32-
Example: "infisical pam db access-account prod/db/my-postgres-account --duration 4h --port 5432 --project-id 1234567890",
34+
Example: "infisical pam db access --resource infisical-shared-cloud-instances --account infisical --project-id b38bef10-2685-43c4-9a2c-635206d60bec --duration 4h",
3335
DisableFlagsInUseLine: true,
34-
Args: cobra.ExactArgs(1),
36+
Args: cobra.NoArgs,
3537
Run: func(cmd *cobra.Command, args []string) {
3638
util.RequireLogin()
3739

38-
accountPath := args[0]
40+
resourceName, _ := cmd.Flags().GetString("resource")
41+
accountName, _ := cmd.Flags().GetString("account")
42+
43+
if resourceName == "" || accountName == "" {
44+
util.PrintErrorMessageAndExit("Both --resource and --account flags are required")
45+
}
3946

4047
projectID, err := cmd.Flags().GetString("project-id")
4148
if err != nil {
@@ -55,7 +62,6 @@ var pamDbAccessAccountCmd = &cobra.Command{
5562
util.HandleError(err, "Unable to parse duration flag")
5663
}
5764

58-
// Parse duration
5965
_, err = time.ParseDuration(durationStr)
6066
if err != nil {
6167
util.HandleError(err, "Invalid duration format. Use formats like '1h', '30m', '2h30m'")
@@ -83,10 +89,15 @@ var pamDbAccessAccountCmd = &cobra.Command{
8389
loggedInUserDetails = util.EstablishUserLoginSession()
8490
}
8591

86-
pam.StartDatabaseLocalProxy(loggedInUserDetails.UserCredentials.JTWToken, accountPath, projectID, durationStr, port)
92+
pam.StartDatabaseLocalProxy(loggedInUserDetails.UserCredentials.JTWToken, pam.PAMAccessParams{
93+
ResourceName: resourceName,
94+
AccountName: accountName,
95+
}, projectID, durationStr, port)
8796
},
8897
}
8998

99+
// ==================== SSH Commands ====================
100+
90101
var pamSshCmd = &cobra.Command{
91102
Use: "ssh",
92103
Short: "SSH-related PAM commands",
@@ -95,24 +106,28 @@ var pamSshCmd = &cobra.Command{
95106
Args: cobra.NoArgs,
96107
}
97108

98-
var pamSshAccessAccountCmd = &cobra.Command{
99-
Use: "access-account <account-path>",
109+
var pamSshAccessCmd = &cobra.Command{
110+
Use: "access",
100111
Short: "Start SSH session to PAM account",
101112
Long: "Start an SSH session to a PAM-managed SSH account. This command automatically launches an SSH client connected through the Infisical Gateway.",
102-
Example: "infisical pam ssh access-account prod/ssh/my-ssh-account --duration 2h --project-id 1234567890",
113+
Example: "infisical pam ssh access --resource prod-servers --account root --project-id b38bef10-2685-43c4-9a2c-635206d60bec --duration 1h",
103114
DisableFlagsInUseLine: true,
104-
Args: cobra.ExactArgs(1),
115+
Args: cobra.NoArgs,
105116
Run: func(cmd *cobra.Command, args []string) {
106117
util.RequireLogin()
107118

108-
accountPath := args[0]
119+
resourceName, _ := cmd.Flags().GetString("resource")
120+
accountName, _ := cmd.Flags().GetString("account")
121+
122+
if resourceName == "" || accountName == "" {
123+
util.PrintErrorMessageAndExit("Both --resource and --account flags are required")
124+
}
109125

110126
durationStr, err := cmd.Flags().GetString("duration")
111127
if err != nil {
112128
util.HandleError(err, "Unable to parse duration flag")
113129
}
114130

115-
// Parse duration
116131
_, err = time.ParseDuration(durationStr)
117132
if err != nil {
118133
util.HandleError(err, "Invalid duration format. Use formats like '1h', '30m', '2h30m'")
@@ -148,9 +163,15 @@ var pamSshAccessAccountCmd = &cobra.Command{
148163
loggedInUserDetails = util.EstablishUserLoginSession()
149164
}
150165

151-
pam.StartSSHLocalProxy(loggedInUserDetails.UserCredentials.JTWToken, accountPath, projectID, durationStr)
166+
pam.StartSSHLocalProxy(loggedInUserDetails.UserCredentials.JTWToken, pam.PAMAccessParams{
167+
ResourceName: resourceName,
168+
AccountName: accountName,
169+
}, projectID, durationStr)
152170
},
153171
}
172+
173+
// ==================== Kubernetes Commands ====================
174+
154175
var pamKubernetesCmd = &cobra.Command{
155176
Use: "kubernetes",
156177
Aliases: []string{"k8s"},
@@ -160,24 +181,28 @@ var pamKubernetesCmd = &cobra.Command{
160181
Args: cobra.NoArgs,
161182
}
162183

163-
var pamKubernetesAccessAccountCmd = &cobra.Command{
164-
Use: "access-account <account-path>",
184+
var pamKubernetesAccessCmd = &cobra.Command{
185+
Use: "access",
165186
Short: "Access Kubernetes PAM account",
166187
Long: "Access Kubernetes via a PAM-managed Kubernetes account. This command automatically launches a proxy connected to your Kubernetes cluster through the Infisical Gateway.",
167-
Example: "infisical pam kubernetes access-account prod/ssh/my-k8s-account --duration 2h --project-id <project_uuid>",
188+
Example: "infisical pam kubernetes access --resource prod-cluster --account developer --project-id b38bef10-2685-43c4-9a2c-635206d60bec --duration 4h",
168189
DisableFlagsInUseLine: true,
169-
Args: cobra.ExactArgs(1),
190+
Args: cobra.NoArgs,
170191
Run: func(cmd *cobra.Command, args []string) {
171192
util.RequireLogin()
172193

173-
accountPath := args[0]
194+
resourceName, _ := cmd.Flags().GetString("resource")
195+
accountName, _ := cmd.Flags().GetString("account")
196+
197+
if resourceName == "" || accountName == "" {
198+
util.PrintErrorMessageAndExit("Both --resource and --account flags are required")
199+
}
174200

175201
durationStr, err := cmd.Flags().GetString("duration")
176202
if err != nil {
177203
util.HandleError(err, "Unable to parse duration flag")
178204
}
179205

180-
// Parse duration
181206
_, err = time.ParseDuration(durationStr)
182207
if err != nil {
183208
util.HandleError(err, "Invalid duration format. Use formats like '1h', '30m', '2h30m'")
@@ -218,10 +243,15 @@ var pamKubernetesAccessAccountCmd = &cobra.Command{
218243
loggedInUserDetails = util.EstablishUserLoginSession()
219244
}
220245

221-
pam.StartKubernetesLocalProxy(loggedInUserDetails.UserCredentials.JTWToken, accountPath, projectID, durationStr, port)
246+
pam.StartKubernetesLocalProxy(loggedInUserDetails.UserCredentials.JTWToken, pam.PAMAccessParams{
247+
ResourceName: resourceName,
248+
AccountName: accountName,
249+
}, projectID, durationStr, port)
222250
},
223251
}
224252

253+
// ==================== Redis Commands ====================
254+
225255
var pamRedisCmd = &cobra.Command{
226256
Use: "redis",
227257
Short: "Redis-related PAM commands",
@@ -230,17 +260,22 @@ var pamRedisCmd = &cobra.Command{
230260
Args: cobra.NoArgs,
231261
}
232262

233-
var pamRedisAccessAccountCmd = &cobra.Command{
234-
Use: "access-account <account-path>",
235-
Short: "Access Redis PAM account",
236-
Long: "Access Redis via a PAM-managed Redis account. This starts a local Redis proxy server that you can use to connect to Redis directly.",
237-
Example: "infisical pam redis access-account prod/redis/my-redis-account --duration 4h --port 6379 --project-id <project_uuid>",
263+
var pamRedisAccessCmd = &cobra.Command{
264+
Use: "access",
265+
Short: "Access PAM Redis accounts",
266+
Long: "Access PAM Redis accounts for Infisical. This starts a local Redis proxy server that you can use to connect to Redis directly.",
267+
Example: "infisical pam redis access --resource my-redis-resource --account redis-admin --duration 4h --port 6379 --project-id <project_uuid>",
238268
DisableFlagsInUseLine: true,
239-
Args: cobra.ExactArgs(1),
269+
Args: cobra.NoArgs,
240270
Run: func(cmd *cobra.Command, args []string) {
241271
util.RequireLogin()
242272

243-
accountPath := args[0]
273+
resourceName, _ := cmd.Flags().GetString("resource")
274+
accountName, _ := cmd.Flags().GetString("account")
275+
276+
if resourceName == "" || accountName == "" {
277+
util.PrintErrorMessageAndExit("Both --resource and --account flags are required")
278+
}
244279

245280
projectID, err := cmd.Flags().GetString("project-id")
246281
if err != nil {
@@ -260,7 +295,6 @@ var pamRedisAccessAccountCmd = &cobra.Command{
260295
util.HandleError(err, "Unable to parse duration flag")
261296
}
262297

263-
// Parse duration
264298
_, err = time.ParseDuration(durationStr)
265299
if err != nil {
266300
util.HandleError(err, "Invalid duration format. Use formats like '1h', '30m', '2h30m'")
@@ -288,29 +322,52 @@ var pamRedisAccessAccountCmd = &cobra.Command{
288322
loggedInUserDetails = util.EstablishUserLoginSession()
289323
}
290324

291-
pam.StartRedisLocalProxy(loggedInUserDetails.UserCredentials.JTWToken, accountPath, projectID, durationStr, port)
325+
pam.StartRedisLocalProxy(loggedInUserDetails.UserCredentials.JTWToken, pam.PAMAccessParams{
326+
ResourceName: resourceName,
327+
AccountName: accountName,
328+
}, projectID, durationStr, port)
292329
},
293330
}
294331

295332
func init() {
296-
pamDbCmd.AddCommand(pamDbAccessAccountCmd)
297-
pamDbAccessAccountCmd.Flags().String("duration", "1h", "Duration for database access session (e.g., '1h', '30m', '2h30m')")
298-
pamDbAccessAccountCmd.Flags().Int("port", 0, "Port for the local database proxy server (0 for auto-assign)")
299-
pamDbAccessAccountCmd.Flags().String("project-id", "", "Project ID of the account to access")
300-
301-
pamSshCmd.AddCommand(pamSshAccessAccountCmd)
302-
pamSshAccessAccountCmd.Flags().String("duration", "1h", "Duration for SSH access session (e.g., '1h', '30m', '2h30m')")
303-
pamSshAccessAccountCmd.Flags().String("project-id", "", "Project ID of the account to access")
304-
305-
pamKubernetesCmd.AddCommand(pamKubernetesAccessAccountCmd)
306-
pamKubernetesAccessAccountCmd.Flags().String("duration", "1h", "Duration for kubernetes access session (e.g., '1h', '30m', '2h30m')")
307-
pamKubernetesAccessAccountCmd.Flags().Int("port", 0, "Port for the local kubernetes proxy server (0 for auto-assign)")
308-
pamKubernetesAccessAccountCmd.Flags().String("project-id", "", "Project ID of the account to access")
309-
310-
pamRedisCmd.AddCommand(pamRedisAccessAccountCmd)
311-
pamRedisAccessAccountCmd.Flags().String("duration", "1h", "Duration for Redis access session (e.g., '1h', '30m', '2h30m')")
312-
pamRedisAccessAccountCmd.Flags().Int("port", 0, "Port for the local Redis proxy server (0 for auto-assign)")
313-
pamRedisAccessAccountCmd.Flags().String("project-id", "", "Project ID of the account to access")
333+
// Database commands
334+
pamDbCmd.AddCommand(pamDbAccessCmd)
335+
pamDbAccessCmd.Flags().String("resource", "", "Name of the PAM resource to access")
336+
pamDbAccessCmd.Flags().String("account", "", "Name of the account within the resource")
337+
pamDbAccessCmd.Flags().String("duration", "1h", "Duration for database access session (e.g., '1h', '30m', '2h30m')")
338+
pamDbAccessCmd.Flags().Int("port", 0, "Port for the local database proxy server (0 for auto-assign)")
339+
pamDbAccessCmd.Flags().String("project-id", "", "Project ID of the account to access")
340+
pamDbAccessCmd.MarkFlagRequired("resource")
341+
pamDbAccessCmd.MarkFlagRequired("account")
342+
343+
// SSH commands
344+
pamSshCmd.AddCommand(pamSshAccessCmd)
345+
pamSshAccessCmd.Flags().String("resource", "", "Name of the PAM resource to access")
346+
pamSshAccessCmd.Flags().String("account", "", "Name of the account within the resource")
347+
pamSshAccessCmd.Flags().String("duration", "1h", "Duration for SSH access session (e.g., '1h', '30m', '2h30m')")
348+
pamSshAccessCmd.Flags().String("project-id", "", "Project ID of the account to access")
349+
pamSshAccessCmd.MarkFlagRequired("resource")
350+
pamSshAccessCmd.MarkFlagRequired("account")
351+
352+
// Kubernetes commands
353+
pamKubernetesCmd.AddCommand(pamKubernetesAccessCmd)
354+
pamKubernetesAccessCmd.Flags().String("resource", "", "Name of the PAM resource to access")
355+
pamKubernetesAccessCmd.Flags().String("account", "", "Name of the account within the resource")
356+
pamKubernetesAccessCmd.Flags().String("duration", "1h", "Duration for kubernetes access session (e.g., '1h', '30m', '2h30m')")
357+
pamKubernetesAccessCmd.Flags().Int("port", 0, "Port for the local kubernetes proxy server (0 for auto-assign)")
358+
pamKubernetesAccessCmd.Flags().String("project-id", "", "Project ID of the account to access")
359+
pamKubernetesAccessCmd.MarkFlagRequired("resource")
360+
pamKubernetesAccessCmd.MarkFlagRequired("account")
361+
362+
// Redis commands
363+
pamRedisCmd.AddCommand(pamRedisAccessCmd)
364+
pamRedisAccessCmd.Flags().String("resource", "", "Name of the PAM resource to access")
365+
pamRedisAccessCmd.Flags().String("account", "", "Name of the account within the resource")
366+
pamRedisAccessCmd.Flags().String("duration", "1h", "Duration for Redis access session (e.g., '1h', '30m', '2h30m')")
367+
pamRedisAccessCmd.Flags().Int("port", 0, "Port for the local Redis proxy server (0 for auto-assign)")
368+
pamRedisAccessCmd.Flags().String("project-id", "", "Project ID of the account to access")
369+
pamRedisAccessCmd.MarkFlagRequired("resource")
370+
pamRedisAccessCmd.MarkFlagRequired("account")
314371

315372
pamCmd.AddCommand(pamDbCmd)
316373
pamCmd.AddCommand(pamSshCmd)

0 commit comments

Comments
 (0)