Skip to content

Commit c027b0f

Browse files
nschmellernschmeller
authored
feat(aws-install): add credential_profile flag (#1274)
This commit adds a new CLI flag to the `lacework agent aws-install <method>` command called `credential_profile`. This flag allows the user to specify an AWS credential profile for `aws-install` to use if the `default` profile is not appropriate. This flag applies for: * `aws-install ec2ic` * `aws-install ec2ssh` * `aws-install ec2ssm` Fixes RAIN-58289 Signed-off-by: Nick Schmeller <nick.schmeller@lacework.net>
1 parent 4acff42 commit c027b0f

File tree

9 files changed

+91
-55
lines changed

9 files changed

+91
-55
lines changed

‎cli/cmd/agent.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ var (
5151
InstallSkipCreatInfra bool
5252
InstallForceReinstall bool
5353
InstallServerURL string
54+
InstallAWSProfile string
5455
}{}
5556

5657
defaultSshIdentityKey = "~/.ssh/id_rsa"

‎cli/cmd/agent_aws-install_ec2ic.go‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,11 @@
1919
package cmd
2020

2121
import (
22+
"context"
2223
"fmt"
2324
"sync"
2425

26+
"github.com/aws/aws-sdk-go-v2/config"
2527
"github.com/gammazero/workerpool"
2628
"github.com/pkg/errors"
2729
"github.com/spf13/cobra"
@@ -61,6 +63,10 @@ To explicitly specify the server URL that the agent will connect to:
6163
6264
lacework agent aws-install ec2ic --server_url https://your.server.url.lacework.net
6365
66+
To specify an AWS credential profile other than 'default':
67+
68+
lacework agent aws-install ec2ic --credential_profile aws-profile-name
69+
6470
AWS credentials are read from the following environment variables:
6571
- AWS_ACCESS_KEY_ID
6672
- AWS_SECRET_ACCESS_KEY
@@ -106,6 +112,9 @@ func init() {
106112
agentInstallAWSEC2ICCmd.Flags().StringVar(&agentCmdState.InstallServerURL,
107113
"server_url", "https://api.lacework.net", "server URL that agents will talk to, prefixed with `https://`",
108114
)
115+
agentInstallAWSEC2ICCmd.Flags().StringVar(&agentCmdState.InstallAWSProfile,
116+
"credential_profile", "default", "AWS credential profile to use",
117+
)
109118
}
110119

111120
func installAWSEC2IC(_ *cobra.Command, _ []string) error {
@@ -129,6 +138,11 @@ func installAWSEC2IC(_ *cobra.Command, _ []string) error {
129138
return err
130139
}
131140

141+
cfg, err := config.LoadDefaultConfig(context.Background(), config.WithSharedConfigProfile(agentCmdState.InstallAWSProfile))
142+
if err != nil {
143+
return err
144+
}
145+
132146
wg := new(sync.WaitGroup)
133147
wp := workerpool.New(agentCmdState.InstallMaxParallelism)
134148
for _, runner := range runners {
@@ -153,7 +167,7 @@ func installAWSEC2IC(_ *cobra.Command, _ []string) error {
153167
"hostname", threadRunner.Runner.Hostname,
154168
"image name", threadRunner.ImageName,
155169
)
156-
err := threadRunner.SendAndUseIdentityFile()
170+
err := threadRunner.SendAndUseIdentityFile(cfg)
157171
if err != nil {
158172
cli.Log.Debugw("ec2ic key send failed", "err", err, "runner", threadRunner.InstanceID)
159173
return

‎cli/cmd/agent_aws-install_ec2ssh.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,10 @@ To authenticate using an identity file:
6969
7070
lacework agent aws-install ec2ssh -i /path/to/your/key
7171
72+
To specify an AWS credential profile other than 'default':
73+
74+
lacework agent aws-install ec2ssh --credential_profile aws-profile-name
75+
7276
The environment should contain AWS credentials in the following variables:
7377
- AWS_ACCESS_KEY_ID
7478
- AWS_SECRET_ACCESS_KEY
@@ -121,6 +125,9 @@ func init() {
121125
agentInstallAWSSSHCmd.Flags().StringVar(&agentCmdState.InstallServerURL,
122126
"server_url", "https://api.lacework.net", "server URL that agents will talk to, prefixed with `https://`",
123127
)
128+
agentInstallAWSSSHCmd.Flags().StringVar(&agentCmdState.InstallAWSProfile,
129+
"credential_profile", "default", "AWS credential profile to use",
130+
)
124131
}
125132

126133
func installAWSSSH(_ *cobra.Command, args []string) error {

‎cli/cmd/agent_aws-install_ec2ssm.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,10 @@ To explicitly specify the server URL that the agent will connect to:
8686
8787
lacework agent aws-install ec2ssm --server_url https://your.server.url.lacework.net
8888
89+
To specify an AWS credential profile other than 'default':
90+
91+
lacework agent aws-install ec2ssm --credential_profile aws-profile-name
92+
8993
AWS credentials are read from the following environment variables:
9094
- AWS_ACCESS_KEY_ID
9195
- AWS_SECRET_ACCESS_KEY
@@ -144,6 +148,9 @@ func init() {
144148
agentInstallAWSSSMCmd.Flags().StringVar(&agentCmdState.InstallServerURL,
145149
"server_url", "https://api.lacework.net", "server URL that agents will talk to, prefixed with `https://`",
146150
)
151+
agentInstallAWSSSMCmd.Flags().StringVar(&agentCmdState.InstallAWSProfile,
152+
"credential_profile", "default", "AWS credential profile to use",
153+
)
147154
}
148155

149156
func installAWSSSM(_ *cobra.Command, _ []string) error {
@@ -176,7 +183,7 @@ func installAWSSSM(_ *cobra.Command, _ []string) error {
176183
return nil
177184
}
178185

179-
cfg, err := config.LoadDefaultConfig(context.Background())
186+
cfg, err := config.LoadDefaultConfig(context.Background(), config.WithSharedConfigProfile(agentCmdState.InstallAWSProfile))
180187
if err != nil {
181188
return err
182189
}

‎cli/cmd/aws.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ func awsDescribeRegions() ([]types.Region, error) {
6969
Filters: filters,
7070
}
7171

72-
cfg, err := config.LoadDefaultConfig(context.Background())
72+
cfg, err := config.LoadDefaultConfig(context.Background(), config.WithSharedConfigProfile(agentCmdState.InstallAWSProfile))
7373
if err != nil {
7474
return nil, err
7575
}
@@ -90,7 +90,7 @@ func awsRegionDescribeInstances(region string, filterSSH bool) ([]*lwrunner.AWSR
9090
tagKey = agentCmdState.InstallTagKey
9191
tag = agentCmdState.InstallTag
9292
)
93-
cfg, err := config.LoadDefaultConfig(context.Background())
93+
cfg, err := config.LoadDefaultConfig(context.Background(), config.WithSharedConfigProfile(agentCmdState.InstallAWSProfile))
9494
if err != nil {
9595
return nil, err
9696
}
@@ -196,6 +196,7 @@ func awsRegionDescribeInstances(region string, filterSSH bool) ([]*lwrunner.AWSR
196196
*threadInstance.InstanceId,
197197
filterSSH,
198198
verifyHostCallback,
199+
cfg,
199200
)
200201
if err != nil {
201202
cli.Log.Debugw("error identifying runner", "error", err, "instance_id", *threadInstance.InstanceId)

‎integration/test_resources/help/agent_aws-install_ec2ic‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ To explicitly specify the server URL that the agent will connect to:
2626

2727
lacework agent aws-install ec2ic --server_url https://your.server.url.lacework.net
2828

29+
To specify an AWS credential profile other than 'default':
30+
31+
lacework agent aws-install ec2ic --credential_profile aws-profile-name
32+
2933
AWS credentials are read from the following environment variables:
3034
- AWS_ACCESS_KEY_ID
3135
- AWS_SECRET_ACCESS_KEY
@@ -43,15 +47,16 @@ Usage:
4347
lacework agent aws-install ec2ic [flags]
4448

4549
Flags:
46-
-h, --help help for ec2ic
47-
-r, --include_regions strings list of regions to filter on
48-
-n, --max_parallelism int maximum number of workers executing AWS API calls, set if rate limits are lower or higher than normal (default 50)
49-
--server_url https:// server URL that agents will talk to, prefixed with https:// (default "https://api.lacework.net")
50-
--ssh_username string username to login with
51-
--tag strings only install agents on infra with this tag
52-
--tag_key string only install agents on infra with this tag key set
53-
--token string agent access token
54-
--trust_host_key automatically add host keys to the ~/.ssh/known_hosts file (default true)
50+
--credential_profile string AWS credential profile to use (default "default")
51+
-h, --help help for ec2ic
52+
-r, --include_regions strings list of regions to filter on
53+
-n, --max_parallelism int maximum number of workers executing AWS API calls, set if rate limits are lower or higher than normal (default 50)
54+
--server_url https:// server URL that agents will talk to, prefixed with https:// (default "https://api.lacework.net")
55+
--ssh_username string username to login with
56+
--tag strings only install agents on infra with this tag
57+
--tag_key string only install agents on infra with this tag key set
58+
--token string agent access token
59+
--trust_host_key automatically add host keys to the ~/.ssh/known_hosts file (default true)
5560

5661
Global Flags:
5762
-a, --account string account subdomain of URL (i.e. <ACCOUNT>.lacework.net)

‎integration/test_resources/help/agent_aws-install_ec2ssh‎

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,10 @@ To authenticate using an identity file:
3535

3636
lacework agent aws-install ec2ssh -i /path/to/your/key
3737

38+
To specify an AWS credential profile other than 'default':
39+
40+
lacework agent aws-install ec2ssh --credential_profile aws-profile-name
41+
3842
The environment should contain AWS credentials in the following variables:
3943
- AWS_ACCESS_KEY_ID
4044
- AWS_SECRET_ACCESS_KEY
@@ -48,18 +52,19 @@ Usage:
4852
lacework agent aws-install ec2ssh [flags]
4953

5054
Flags:
51-
-h, --help help for ec2ssh
52-
-i, --identity_file string identity (private key) for public key authentication (default "~/.ssh/id_rsa")
53-
-r, --include_regions strings list of regions to filter on
54-
-n, --max_parallelism int maximum number of workers executing AWS API calls, set if rate limits are lower or higher than normal (default 50)
55-
--server_url https:// server URL that agents will talk to, prefixed with https:// (default "https://api.lacework.net")
56-
--ssh_password string password for authentication
57-
--ssh_port int port to connect to on the remote host (default 22)
58-
--ssh_username string username to login with
59-
--tag strings only select instances with this tag
60-
--tag_key string only install agents on infra with this tag key
61-
--token string agent access token
62-
--trust_host_key automatically add host keys to the ~/.ssh/known_hosts file (default true)
55+
--credential_profile string AWS credential profile to use (default "default")
56+
-h, --help help for ec2ssh
57+
-i, --identity_file string identity (private key) for public key authentication (default "~/.ssh/id_rsa")
58+
-r, --include_regions strings list of regions to filter on
59+
-n, --max_parallelism int maximum number of workers executing AWS API calls, set if rate limits are lower or higher than normal (default 50)
60+
--server_url https:// server URL that agents will talk to, prefixed with https:// (default "https://api.lacework.net")
61+
--ssh_password string password for authentication
62+
--ssh_port int port to connect to on the remote host (default 22)
63+
--ssh_username string username to login with
64+
--tag strings only select instances with this tag
65+
--tag_key string only install agents on infra with this tag key
66+
--token string agent access token
67+
--trust_host_key automatically add host keys to the ~/.ssh/known_hosts file (default true)
6368

6469
Global Flags:
6570
-a, --account string account subdomain of URL (i.e. <ACCOUNT>.lacework.net)

‎integration/test_resources/help/agent_aws-install_ec2ssm‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,10 @@ To explicitly specify the server URL that the agent will connect to:
4242

4343
lacework agent aws-install ec2ssm --server_url https://your.server.url.lacework.net
4444

45+
To specify an AWS credential profile other than 'default':
46+
47+
lacework agent aws-install ec2ssm --credential_profile aws-profile-name
48+
4549
AWS credentials are read from the following environment variables:
4650
- AWS_ACCESS_KEY_ID
4751
- AWS_SECRET_ACCESS_KEY
@@ -52,17 +56,18 @@ Usage:
5256
lacework agent aws-install ec2ssm [flags]
5357

5458
Flags:
55-
-d, --dry_run set this flag to print out the target instances and exit
56-
-f, --force_reinstall set this flag to force-reinstall the agent, even if already running on the target instance
57-
-h, --help help for ec2ssm
58-
--iam_role_name string IAM role name (not ARN) with SSM policy, if not provided then an ephemeral role will be created
59-
-r, --include_regions strings list of regions to filter on
60-
-n, --max_parallelism int maximum number of workers executing AWS API calls, set if rate limits are lower or higher than normal (default 50)
61-
--server_url https:// server URL that agents will talk to, prefixed with https:// (default "https://api.lacework.net")
62-
--skip_iam_role_creation set this flag to skip creating an IAM role and instance profile and associating the instance profile. Assumes all instances are already setup for SSM
63-
--tag strings only install agents on infra with this tag
64-
--tag_key string only install agents on infra with this tag key set
65-
--token string agent access token
59+
--credential_profile string AWS credential profile to use (default "default")
60+
-d, --dry_run set this flag to print out the target instances and exit
61+
-f, --force_reinstall set this flag to force-reinstall the agent, even if already running on the target instance
62+
-h, --help help for ec2ssm
63+
--iam_role_name string IAM role name (not ARN) with SSM policy, if not provided then an ephemeral role will be created
64+
-r, --include_regions strings list of regions to filter on
65+
-n, --max_parallelism int maximum number of workers executing AWS API calls, set if rate limits are lower or higher than normal (default 50)
66+
--server_url https:// server URL that agents will talk to, prefixed with https:// (default "https://api.lacework.net")
67+
--skip_iam_role_creation set this flag to skip creating an IAM role and instance profile and associating the instance profile. Assumes all instances are already setup for SSM
68+
--tag strings only install agents on infra with this tag
69+
--tag_key string only install agents on infra with this tag key set
70+
--token string agent access token
6671

6772
Global Flags:
6873
-a, --account string account subdomain of URL (i.e. <ACCOUNT>.lacework.net)

‎lwrunner/awsrunner.go‎

Lines changed: 10 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ import (
2626
"time"
2727

2828
"github.com/aws/aws-sdk-go-v2/aws"
29-
"github.com/aws/aws-sdk-go-v2/config"
3029
"github.com/aws/aws-sdk-go-v2/service/ec2"
3130
ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
3231
"github.com/aws/aws-sdk-go-v2/service/ec2instanceconnect"
@@ -45,9 +44,9 @@ type AWSRunner struct {
4544
ImageName string
4645
}
4746

48-
func NewAWSRunner(amiImageId, userFromCLIArg, host, region, availabilityZone, instanceID string, filterSSH bool, callback ssh.HostKeyCallback) (*AWSRunner, error) {
47+
func NewAWSRunner(amiImageId, userFromCLIArg, host, region, availabilityZone, instanceID string, filterSSH bool, callback ssh.HostKeyCallback, cfg aws.Config) (*AWSRunner, error) {
4948
// Look up the AMI name of the runner
50-
imageName, err := getAMIName(amiImageId, region)
49+
imageName, err := getAMIName(amiImageId, region, cfg)
5150
if err != nil {
5251
return nil, err
5352
}
@@ -79,13 +78,13 @@ func NewAWSRunner(amiImageId, userFromCLIArg, host, region, availabilityZone, in
7978
}, nil
8079
}
8180

82-
func (run AWSRunner) SendAndUseIdentityFile() error {
81+
func (run AWSRunner) SendAndUseIdentityFile(cfg aws.Config) error {
8382
pubBytes, privBytes, err := GetKeyBytes()
8483
if err != nil {
8584
return err
8685
}
8786

88-
err = run.SendPublicKey(pubBytes)
87+
err = run.SendPublicKey(pubBytes, cfg)
8988
if err != nil {
9089
return err
9190
}
@@ -103,12 +102,8 @@ func (run AWSRunner) SendAndUseIdentityFile() error {
103102
// EC2InstanceConnect. The AWS account used to run the tests must
104103
// have EC2InstanceConnect permissions attached to its IAM role.
105104
// First checks to make sure the instance is still running.
106-
func (run AWSRunner) SendPublicKey(pubBytes []byte) error {
105+
func (run AWSRunner) SendPublicKey(pubBytes []byte, cfg aws.Config) error {
107106
// Send public key
108-
cfg, err := config.LoadDefaultConfig(context.Background())
109-
if err != nil {
110-
return err
111-
}
112107
cfg.Region = run.Region
113108
svc := ec2instanceconnect.NewFromConfig(cfg)
114109

@@ -119,7 +114,7 @@ func (run AWSRunner) SendPublicKey(pubBytes []byte) error {
119114
SSHPublicKey: aws.String(string(pubBytes)),
120115
}
121116

122-
_, err = svc.SendSSHPublicKey(context.Background(), input)
117+
_, err := svc.SendSSHPublicKey(context.Background(), input)
123118
if err != nil {
124119
return err
125120
}
@@ -329,14 +324,10 @@ func (run AWSRunner) RunSSMCommandOnRemoteHost(cfg aws.Config, operation string)
329324
)
330325
}
331326

332-
// getAMIName takes an AMI image ID and an AWS region name as input
333-
// and calls the AWS API to get the name of the AMI. Returns the AMI
334-
// name or an error if unsuccessful.
335-
func getAMIName(amiImageId, region string) (string, error) {
336-
cfg, err := config.LoadDefaultConfig(context.Background())
337-
if err != nil {
338-
return "", err
339-
}
327+
// getAMIName takes an AMI image ID, an AWS region name, and an AWS
328+
// credential config as input and calls the AWS API to get the name
329+
// of the AMI. Returns the AMI name or an error if unsuccessful.
330+
func getAMIName(amiImageId, region string, cfg aws.Config) (string, error) {
340331
cfg.Region = region
341332
svc := ec2.NewFromConfig(cfg)
342333
input := ec2.DescribeImagesInput{

0 commit comments

Comments
 (0)