Documentation
¶
Overview ¶
Package secretsmanager provides emulation of AWS Secrets Manager. See docs/services/secretsmanager.md for the support matrix.
Index ¶
- type Handler
- func (h *Handler) InitLambdaInvoker(inv events.FunctionSyncInvoker)
- func (h *Handler) RemoveRegionsFromReplication(w http.ResponseWriter, r *http.Request)
- func (h *Handler) ReplicateSecretToRegions(w http.ResponseWriter, r *http.Request)
- func (h *Handler) RestoreSecret(w http.ResponseWriter, r *http.Request)
- type RotationAttempt
- type RotationRules
- type Secret
- type SecretVersion
- type Service
- func (s *Service) Dispatch(w http.ResponseWriter, r *http.Request)
- func (s *Service) InitBus(bus *events.Bus)
- func (s *Service) InitLambdaInvoker(invoker events.FunctionSyncInvoker)
- func (s *Service) Name() string
- func (s *Service) Operations() []op.Operation
- func (s *Service) RegisterRoutes(r chi.Router)
- func (s *Service) SecretValue(ctx context.Context, secretID string) (string, bool)
- func (s *Service) Stop(ctx context.Context)
- func (s *Service) SupportedProtocols() []codec.Codec
- func (s *Service) TargetPrefix() string
- type Tag
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler holds Secrets Manager handler dependencies.
func (*Handler) InitLambdaInvoker ¶
func (h *Handler) InitLambdaInvoker(inv events.FunctionSyncInvoker)
InitLambdaInvoker wires the synchronous Lambda invoker used by rotation.
func (*Handler) RemoveRegionsFromReplication ¶
func (h *Handler) RemoveRegionsFromReplication(w http.ResponseWriter, r *http.Request)
func (*Handler) ReplicateSecretToRegions ¶
func (h *Handler) ReplicateSecretToRegions(w http.ResponseWriter, r *http.Request)
func (*Handler) RestoreSecret ¶
func (h *Handler) RestoreSecret(w http.ResponseWriter, r *http.Request)
type RotationAttempt ¶
type RotationAttempt struct {
ClientRequestToken string `json:"ClientRequestToken,omitempty"`
Status string `json:"Status,omitempty"`
Step string `json:"Step,omitempty"`
Error string `json:"Error,omitempty"`
Trigger string `json:"Trigger,omitempty"`
StartedDate float64 `json:"StartedDate,omitempty"`
CompletedDate float64 `json:"CompletedDate,omitempty"`
}
RotationAttempt records the outcome of the most recent rotation run.
It has no AWS API equivalent — real Secrets Manager surfaces rotation progress through CloudTrail and the console. Overcast keeps it on the secret so the web console can show which of the four steps failed, and so a failure is still visible after the RotateSecret call that reported it has gone. It is deliberately absent from every AWS-shaped response.
type RotationRules ¶
type RotationRules struct {
AutomaticallyAfterDays int64 `json:"AutomaticallyAfterDays,omitempty" cbor:"AutomaticallyAfterDays,omitempty"`
Duration string `json:"Duration,omitempty" cbor:"Duration,omitempty"`
ScheduleExpression string `json:"ScheduleExpression,omitempty" cbor:"ScheduleExpression,omitempty"`
}
RotationRules describes the automatic rotation schedule.
type Secret ¶
type Secret struct {
ARN string `json:"ARN"`
Name string `json:"Name"`
Description string `json:"Description,omitempty"`
Tags []Tag `json:"Tags,omitempty"`
Versions []SecretVersion `json:"Versions"`
CurrentVersionId string `json:"CurrentVersionId"`
CreatedDate float64 `json:"CreatedDate"`
LastChangedDate float64 `json:"LastChangedDate"`
RotationEnabled bool `json:"RotationEnabled,omitempty"`
RotationRules *RotationRules `json:"RotationRules,omitempty"`
RotationLambdaARN string `json:"RotationLambdaARN,omitempty"`
LastRotatedDate float64 `json:"LastRotatedDate,omitempty"`
NextRotationDate float64 `json:"NextRotationDate,omitempty"`
LastRotationAttempt *RotationAttempt `json:"LastRotationAttempt,omitempty"`
ResourcePolicy string `json:"ResourcePolicy,omitempty"`
}
Secret is the full domain model stored for each secret.
type SecretVersion ¶
type SecretVersion struct {
VersionId string `json:"VersionId" cbor:"VersionId"`
SecretString string `json:"SecretString,omitempty" cbor:"SecretString,omitempty"`
SecretBinary string `json:"SecretBinary,omitempty" cbor:"SecretBinary,omitempty"` // base64-encoded
Stages []string `json:"VersionStages" cbor:"VersionStages"`
CreatedDate float64 `json:"CreatedDate" cbor:"CreatedDate"`
}
SecretVersion holds the payload for one version of a secret.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service implements router.Service for Secrets Manager.
func New ¶
New returns a configured Secrets Manager Service.
It does no I/O: the rotation engine starts from RegisterRoutes, and its first store read happens on the goroutine, never on router.New's critical path.
func (*Service) Dispatch ¶
func (s *Service) Dispatch(w http.ResponseWriter, r *http.Request)
Dispatch routes to the correct Secrets Manager handler based on X-Amz-Target.
func (*Service) InitLambdaInvoker ¶
func (s *Service) InitLambdaInvoker(invoker events.FunctionSyncInvoker)
InitLambdaInvoker wires the synchronous Lambda invoker the rotation protocol drives. Rotation refuses to run rather than pretending, when it is absent.
func (*Service) Operations ¶
Operations implements router.ProtocolService.
func (*Service) RegisterRoutes ¶
RegisterRoutes mounts admin endpoints for the web console.
func (*Service) SecretValue ¶
SecretValue returns the current SecretString for a secret named by ID, name or ARN. Used by ECS to resolve a container definition's `secrets`, which is how a task receives credentials without them being written into the task definition. ok is false for an unknown secret or one holding only binary.
func (*Service) SupportedProtocols ¶
SupportedProtocols implements router.ProtocolService.
func (*Service) TargetPrefix ¶
TargetPrefix returns the X-Amz-Target prefix for Secrets Manager dispatch.
Source Files