|
| 1 | +use std::{num::NonZeroUsize, time::Duration}; |
| 2 | + |
| 3 | +use async_trait::async_trait; |
| 4 | +use aws_config::SdkConfig; |
| 5 | +use aws_sdk_secretsmanager::{ |
| 6 | + operation::get_secret_value::GetSecretValueError, Client as SecretsClient, |
| 7 | + Config as SecretsConfig, |
| 8 | +}; |
| 9 | +use aws_secretsmanager_caching::SecretsManagerCachingClient as SecretsCacheClient; |
| 10 | +use eyre::eyre; |
| 11 | +use tracing::warn; |
| 12 | + |
| 13 | +use crate::{Error, ErrorKind}; |
| 14 | + |
| 15 | +use super::SecretRepository; |
| 16 | + |
| 17 | +/// Type used for AWS Secrets Manager operations |
| 18 | +pub(crate) struct AwsSecretsManager { |
| 19 | + client: SecretsClient, |
| 20 | + cache: SecretsCacheClient, |
| 21 | +} |
| 22 | + |
| 23 | +impl AwsSecretsManager { |
| 24 | + /// Create a new instance of [AwsSecretsManager] with the given AWS SDK config |
| 25 | + pub async fn new(config: &SdkConfig) -> Self { |
| 26 | + let client = SecretsClient::new(config); |
| 27 | + // Cache size: 100 and a TTL of 5 minutes |
| 28 | + let cache = SecretsCacheClient::from_builder( |
| 29 | + SecretsConfig::from(config).to_builder(), |
| 30 | + NonZeroUsize::new(100).unwrap(), |
| 31 | + Duration::from_secs(300), |
| 32 | + true, |
| 33 | + ) |
| 34 | + .await |
| 35 | + .unwrap(); |
| 36 | + |
| 37 | + Self { client, cache } |
| 38 | + } |
| 39 | +} |
| 40 | + |
| 41 | +#[async_trait] |
| 42 | +impl SecretRepository for AwsSecretsManager { |
| 43 | + async fn store(&self, name: &str, data: &[u8]) -> Result<(), Error> { |
| 44 | + use aws_sdk_secretsmanager::error::SdkError; |
| 45 | + |
| 46 | + // Store a secret only if it does not already exist |
| 47 | + match self.client.describe_secret().secret_id(name).send().await { |
| 48 | + Ok(_) => { |
| 49 | + warn!("Secret {name} already exists. Skipping..."); |
| 50 | + Ok(()) |
| 51 | + } |
| 52 | + Err(SdkError::ServiceError(err)) if err.err().is_resource_not_found_exception() => { |
| 53 | + let secret = String::from_utf8_lossy(data).to_string(); |
| 54 | + // Secret does not exist, try to create it |
| 55 | + self.client |
| 56 | + .create_secret() |
| 57 | + .name(name) |
| 58 | + .secret_string(secret) |
| 59 | + .send() |
| 60 | + .await?; |
| 61 | + Ok(()) |
| 62 | + } |
| 63 | + Err(sdk_err) => Err(sdk_err.into()), |
| 64 | + } |
| 65 | + } |
| 66 | + |
| 67 | + async fn find(&self, name: &str) -> Result<Option<Vec<u8>>, Error> { |
| 68 | + use aws_sdk_secretsmanager::error::SdkError; |
| 69 | + |
| 70 | + match self.cache.get_secret_value(name, None, None, false).await { |
| 71 | + Ok(value) => Ok(value.secret_string.map(|s| s.into_bytes())), |
| 72 | + Err(err) => { |
| 73 | + // Check for ResourceNotFoundException |
| 74 | + if let Some(SdkError::ServiceError(service_err)) = |
| 75 | + err.downcast_ref::<SdkError<GetSecretValueError>>() |
| 76 | + { |
| 77 | + if service_err.err().is_resource_not_found_exception() { |
| 78 | + return Ok(None); |
| 79 | + } |
| 80 | + } |
| 81 | + Err(Error::msg(ErrorKind::RepositoryFailure, eyre!("{err}"))) |
| 82 | + } |
| 83 | + } |
| 84 | + } |
| 85 | + |
| 86 | + async fn delete(&self, name: &str) -> Result<(), Error> { |
| 87 | + self.client.delete_secret().secret_id(name).send().await?; |
| 88 | + |
| 89 | + // Invalidate cache by refreshing the secret |
| 90 | + let _ = self.cache.get_secret_value(name, None, None, true).await; |
| 91 | + Ok(()) |
| 92 | + } |
| 93 | +} |
0 commit comments