feat(api): add ACM certificates to the cloud explorer
CI / checks (pull_request) Successful in 27m28s
CI / checks (pull_request) Successful in 27m28s
Request public certificates (optionally exportable) or import your own, see each domain's DNS validation records and what uses a certificate, download the certificate and chain, export an exportable one with its encrypted key, and revoke it. ListCertificates asks for every key type, since AWS otherwise leaves EC certificates out.
This commit is contained in:
Zakaria
@@ -94,6 +94,7 @@ cd packages/api && bun run scripts/service-matrix.ts
|
|||||||
| Security | Secrets Manager / Key Vault / Secret Manager | Yes (list, create, inspect, delete) | Yes (list, create, delete, inspect) | Yes (list, create, inspect, delete) |
|
| Security | Secrets Manager / Key Vault / Secret Manager | Yes (list, create, inspect, delete) | Yes (list, create, delete, inspect) | Yes (list, create, inspect, delete) |
|
||||||
| Security | KMS / Key Management | Yes (list, create, delete, inspect) | No | No |
|
| Security | KMS / Key Management | Yes (list, create, delete, inspect) | No | No |
|
||||||
| Security | Parameter Store | Yes (list, create, delete, inspect) | No | No |
|
| Security | Parameter Store | Yes (list, create, delete, inspect) | No | No |
|
||||||
|
| Security | Certificate Manager / Certificates | Yes (list, create, delete, inspect) | No | No |
|
||||||
| Observability | CloudWatch / Monitoring | Yes (list, create, delete, inspect) | No | No |
|
| Observability | CloudWatch / Monitoring | Yes (list, create, delete, inspect) | No | No |
|
||||||
| Observability | CloudWatch Logs / Logs | Yes (list, create, delete, inspect) | No | No |
|
| Observability | CloudWatch Logs / Logs | Yes (list, create, delete, inspect) | No | No |
|
||||||
|
|
||||||
|
|||||||
@@ -10,6 +10,7 @@
|
|||||||
"test": "FLOCI_UI_ADMIN_USER=admin FLOCI_UI_ADMIN_PASSWORD_HASH='$argon2id$v=19$m=65536,t=2,p=1$I5n/tqYyZO0S+4z++KcAlpAJVu442Ivi7KxPl2CXoO4$mRSyN9R5ACFosgnfnd6S5ePoKrz2XBfVf4DTfG7T6LQ' FLOCI_UI_SESSION_SECRET=01234567890123456789012345678901 FLOCI_UI_SECURE_COOKIES=false bun test"
|
"test": "FLOCI_UI_ADMIN_USER=admin FLOCI_UI_ADMIN_PASSWORD_HASH='$argon2id$v=19$m=65536,t=2,p=1$I5n/tqYyZO0S+4z++KcAlpAJVu442Ivi7KxPl2CXoO4$mRSyN9R5ACFosgnfnd6S5ePoKrz2XBfVf4DTfG7T6LQ' FLOCI_UI_SESSION_SECRET=01234567890123456789012345678901 FLOCI_UI_SECURE_COOKIES=false bun test"
|
||||||
},
|
},
|
||||||
"dependencies": {
|
"dependencies": {
|
||||||
|
"@aws-sdk/client-acm": "^3.1146.0",
|
||||||
"@aws-sdk/client-api-gateway": "^3.1076.0",
|
"@aws-sdk/client-api-gateway": "^3.1076.0",
|
||||||
"@aws-sdk/client-apigatewayv2": "^3.1076.0",
|
"@aws-sdk/client-apigatewayv2": "^3.1076.0",
|
||||||
"@aws-sdk/client-appconfig": "^3.1076.0",
|
"@aws-sdk/client-appconfig": "^3.1076.0",
|
||||||
|
|||||||
@@ -0,0 +1,164 @@
|
|||||||
|
import {describe, expect, test} from 'bun:test'
|
||||||
|
import {
|
||||||
|
type ACMClient,
|
||||||
|
DeleteCertificateCommand,
|
||||||
|
DescribeCertificateCommand,
|
||||||
|
ExportCertificateCommand,
|
||||||
|
GetCertificateCommand,
|
||||||
|
ImportCertificateCommand,
|
||||||
|
ListCertificatesCommand,
|
||||||
|
RequestCertificateCommand,
|
||||||
|
RevokeCertificateCommand,
|
||||||
|
} from '@aws-sdk/client-acm'
|
||||||
|
import {AwsCertificatesAdapter} from './AwsCertificatesAdapter'
|
||||||
|
import {ValidationError} from '../cloud-spi/errors'
|
||||||
|
|
||||||
|
type SendResult = Record<string, unknown>
|
||||||
|
|
||||||
|
function stubAcm(handler: (command: object) => SendResult | Promise<SendResult>) {
|
||||||
|
const sent: object[] = []
|
||||||
|
const client = {
|
||||||
|
async send(command: object) {
|
||||||
|
sent.push(command)
|
||||||
|
return handler(command)
|
||||||
|
},
|
||||||
|
} as unknown as ACMClient
|
||||||
|
return {client, sent}
|
||||||
|
}
|
||||||
|
|
||||||
|
function awsError(name: string, status = 400): Error {
|
||||||
|
return Object.assign(new Error(name), {name, $metadata: {httpStatusCode: status}})
|
||||||
|
}
|
||||||
|
|
||||||
|
const ID = '5ed9dc37-d9fb-456e-911e-e87f091480ba'
|
||||||
|
const ARN = `arn:aws:acm:us-east-1:000000000000:certificate/${ID}`
|
||||||
|
const detail = {
|
||||||
|
CertificateArn: ARN,
|
||||||
|
DomainName: 'notes.thecloud.localhost',
|
||||||
|
SubjectAlternativeNames: ['notes.thecloud.localhost', 'api.thecloud.localhost'],
|
||||||
|
DomainValidationOptions: [{
|
||||||
|
DomainName: 'notes.thecloud.localhost',
|
||||||
|
ValidationStatus: 'SUCCESS',
|
||||||
|
ValidationMethod: 'DNS',
|
||||||
|
ResourceRecord: {Name: '_a1.notes.thecloud.localhost.', Type: 'CNAME', Value: '_e8.acm-validations.aws.'},
|
||||||
|
}],
|
||||||
|
Status: 'ISSUED',
|
||||||
|
Type: 'AMAZON_ISSUED',
|
||||||
|
KeyAlgorithm: 'RSA-2048',
|
||||||
|
Issuer: 'CN=Floci Local CA',
|
||||||
|
CreatedAt: new Date('2026-10-25T16:28:12Z'),
|
||||||
|
NotAfter: new Date('2027-10-25T16:28:12Z'),
|
||||||
|
InUseBy: ['arn:aws:elasticloadbalancing:us-east-1:000000000000:loadbalancer/app/web/1'],
|
||||||
|
Options: {Export: 'ENABLED', CertificateTransparencyLoggingPreference: 'ENABLED'},
|
||||||
|
}
|
||||||
|
|
||||||
|
function adapterWith(handler: (command: object) => SendResult | Promise<SendResult>) {
|
||||||
|
const stub = stubAcm(handler)
|
||||||
|
return {...stub, adapter: new AwsCertificatesAdapter(stub.client, '000000000000', 'us-east-1')}
|
||||||
|
}
|
||||||
|
|
||||||
|
describe('AwsCertificatesAdapter', () => {
|
||||||
|
test('lists every key type across pages and searches the alternative names too', async () => {
|
||||||
|
const {adapter, sent} = adapterWith((command) => {
|
||||||
|
if (!(command instanceof ListCertificatesCommand)) return {}
|
||||||
|
return command.input.NextToken
|
||||||
|
? {CertificateSummaryList: [{CertificateArn: ARN.replace(ID, '11111111-2222-3333-4444-555555555555'), DomainName: 'shop.test', Type: 'IMPORTED', Status: 'ISSUED', InUse: false}]}
|
||||||
|
: {CertificateSummaryList: [{CertificateArn: ARN, DomainName: 'notes.thecloud.localhost', SubjectAlternativeNameSummaries: ['notes.thecloud.localhost', 'api.thecloud.localhost'], Type: 'AMAZON_ISSUED', Status: 'ISSUED', KeyAlgorithm: 'EC-prime256v1', InUse: true}], NextToken: 'page-2'}
|
||||||
|
})
|
||||||
|
|
||||||
|
const all = await adapter.list()
|
||||||
|
expect(all.map((certificate) => [certificate.id, certificate.name, certificate.metadata.certificateType, certificate.metadata.inUse])).toEqual([
|
||||||
|
[ID, 'notes.thecloud.localhost', 'Amazon issued', 'Yes'],
|
||||||
|
['11111111-2222-3333-4444-555555555555', 'shop.test', 'Imported', 'No'],
|
||||||
|
])
|
||||||
|
// Without Includes, AWS leaves EC certificates out of the list.
|
||||||
|
expect((sent[0] as ListCertificatesCommand).input.Includes?.keyTypes).toContain('EC_prime256v1')
|
||||||
|
expect((await adapter.list({search: 'api.thecloud'})).map((certificate) => certificate.id)).toEqual([ID])
|
||||||
|
})
|
||||||
|
|
||||||
|
test('describes a certificate with its users and the DNS records validation asks for', async () => {
|
||||||
|
const {adapter, sent} = adapterWith(() => ({Certificate: detail}))
|
||||||
|
|
||||||
|
const certificate = await adapter.get(ID)
|
||||||
|
expect((sent[0] as DescribeCertificateCommand).input.CertificateArn).toBe(ARN)
|
||||||
|
expect(certificate?.metadata).toMatchObject({
|
||||||
|
inUse: 'Yes',
|
||||||
|
inUseBy: detail.InUseBy,
|
||||||
|
exportable: true,
|
||||||
|
issuer: 'CN=Floci Local CA',
|
||||||
|
notAfter: '2027-10-25T16:28:12.000Z',
|
||||||
|
domainValidations: [{domainName: 'notes.thecloud.localhost', status: 'SUCCESS', method: 'DNS', record: {name: '_a1.notes.thecloud.localhost.', type: 'CNAME', value: '_e8.acm-validations.aws.'}}],
|
||||||
|
})
|
||||||
|
})
|
||||||
|
|
||||||
|
test('a missing certificate is null, and an id that is not a UUID never reaches ACM', async () => {
|
||||||
|
const {adapter, sent} = adapterWith(() => { throw awsError('ResourceNotFoundException') })
|
||||||
|
expect(await adapter.get(ID)).toBeNull()
|
||||||
|
await expect(adapter.get('../other')).rejects.toBeInstanceOf(ValidationError)
|
||||||
|
expect(sent).toHaveLength(1)
|
||||||
|
})
|
||||||
|
|
||||||
|
test('requests a certificate for the domain and its extra names', async () => {
|
||||||
|
const {adapter, sent} = adapterWith((command) => command instanceof RequestCertificateCommand ? {CertificateArn: ARN} : {Certificate: detail})
|
||||||
|
|
||||||
|
const created = await adapter.create({values: {source: 'request', domainName: 'Notes.TheCloud.localhost', subjectAlternativeNames: 'api.thecloud.localhost\nnotes.thecloud.localhost\n*.thecloud.localhost', keyAlgorithm: 'EC_prime256v1', export: 'ENABLED'}})
|
||||||
|
expect(created.id).toBe(ID)
|
||||||
|
expect((sent[0] as RequestCertificateCommand).input).toEqual({
|
||||||
|
DomainName: 'notes.thecloud.localhost',
|
||||||
|
SubjectAlternativeNames: ['notes.thecloud.localhost', 'api.thecloud.localhost', '*.thecloud.localhost'],
|
||||||
|
ValidationMethod: 'DNS',
|
||||||
|
KeyAlgorithm: 'EC_prime256v1',
|
||||||
|
Options: {Export: 'ENABLED'},
|
||||||
|
})
|
||||||
|
})
|
||||||
|
|
||||||
|
test('refuses a request ACM would reject before calling it', async () => {
|
||||||
|
const {adapter, sent} = adapterWith(() => ({}))
|
||||||
|
await expect(adapter.create({values: {source: 'request', domainName: 'not a domain'}})).rejects.toBeInstanceOf(ValidationError)
|
||||||
|
await expect(adapter.create({values: {source: 'request', domainName: 'a.test', subjectAlternativeNames: 'b..test'}})).rejects.toThrow('b..test is not a domain name')
|
||||||
|
await expect(adapter.create({values: {source: 'request', domainName: 'a.test', keyAlgorithm: 'RSA_8192'}})).rejects.toBeInstanceOf(ValidationError)
|
||||||
|
await expect(adapter.create({values: {source: 'copy', domainName: 'a.test'}})).rejects.toBeInstanceOf(ValidationError)
|
||||||
|
expect(sent).toHaveLength(0)
|
||||||
|
})
|
||||||
|
|
||||||
|
test('imports PEM text as bytes, with the chain when given', async () => {
|
||||||
|
const {adapter, sent} = adapterWith((command) => command instanceof ImportCertificateCommand ? {CertificateArn: ARN} : {Certificate: {...detail, Type: 'IMPORTED'}})
|
||||||
|
const certificate = '-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----'
|
||||||
|
const privateKey = '-----BEGIN RSA PRIVATE KEY-----\nMIIE\n-----END RSA PRIVATE KEY-----'
|
||||||
|
|
||||||
|
const created = await adapter.create({values: {source: 'import', certificate, privateKey, certificateChain: certificate}})
|
||||||
|
expect(created.metadata.certificateType).toBe('Imported')
|
||||||
|
const input = (sent[0] as ImportCertificateCommand).input
|
||||||
|
expect(new TextDecoder().decode(input.Certificate)).toBe(certificate)
|
||||||
|
expect(new TextDecoder().decode(input.PrivateKey)).toBe(privateKey)
|
||||||
|
expect(input.CertificateChain).toBeDefined()
|
||||||
|
|
||||||
|
await expect(adapter.create({values: {source: 'import', certificate, privateKey: 'secret'}})).rejects.toThrow('privateKey must be PEM text')
|
||||||
|
})
|
||||||
|
|
||||||
|
test('downloads, exports and revokes by the rebuilt ARN', async () => {
|
||||||
|
const {adapter, sent} = adapterWith((command) => {
|
||||||
|
if (command instanceof GetCertificateCommand) return {Certificate: 'CERT', CertificateChain: 'CHAIN'}
|
||||||
|
if (command instanceof ExportCertificateCommand) return {Certificate: 'CERT', CertificateChain: 'CHAIN', PrivateKey: 'ENCRYPTED'}
|
||||||
|
if (command instanceof RevokeCertificateCommand) return {CertificateArn: ARN}
|
||||||
|
return {Certificate: {...detail, Status: 'REVOKED', RevocationReason: 'SUPERSEDED'}}
|
||||||
|
})
|
||||||
|
|
||||||
|
expect(await adapter.getCertificatePem(ID)).toEqual({certificate: 'CERT', certificateChain: 'CHAIN'})
|
||||||
|
expect(await adapter.exportCertificate(ID, 'open-sesame')).toEqual({certificate: 'CERT', certificateChain: 'CHAIN', privateKey: 'ENCRYPTED'})
|
||||||
|
expect(new TextDecoder().decode((sent[1] as ExportCertificateCommand).input.Passphrase)).toBe('open-sesame')
|
||||||
|
const revoked = await adapter.revokeCertificate(ID, 'SUPERSEDED')
|
||||||
|
expect(revoked.status).toBe('REVOKED')
|
||||||
|
expect((sent[2] as RevokeCertificateCommand).input).toEqual({CertificateArn: ARN, RevocationReason: 'SUPERSEDED'})
|
||||||
|
|
||||||
|
await expect(adapter.exportCertificate(ID, 'abc')).rejects.toBeInstanceOf(ValidationError)
|
||||||
|
await expect(adapter.exportCertificate(ID, 'has$dollar')).rejects.toBeInstanceOf(ValidationError)
|
||||||
|
await expect(adapter.revokeCertificate(ID, 'BORED' as never)).rejects.toBeInstanceOf(ValidationError)
|
||||||
|
})
|
||||||
|
|
||||||
|
test('deletes by ARN and lets ACM refuse a certificate that is in use', async () => {
|
||||||
|
const {adapter, sent} = adapterWith(() => { throw awsError('ResourceInUseException') })
|
||||||
|
await expect(adapter.delete(ID)).rejects.toThrow('ResourceInUseException')
|
||||||
|
expect((sent[0] as DeleteCertificateCommand).input.CertificateArn).toBe(ARN)
|
||||||
|
})
|
||||||
|
})
|
||||||
@@ -0,0 +1,290 @@
|
|||||||
|
import {
|
||||||
|
type ACMClient,
|
||||||
|
type CertificateDetail,
|
||||||
|
type CertificateSummary,
|
||||||
|
DeleteCertificateCommand,
|
||||||
|
DescribeCertificateCommand,
|
||||||
|
ExportCertificateCommand,
|
||||||
|
GetCertificateCommand,
|
||||||
|
ImportCertificateCommand,
|
||||||
|
type KeyAlgorithm,
|
||||||
|
ListCertificatesCommand,
|
||||||
|
RequestCertificateCommand,
|
||||||
|
RevokeCertificateCommand,
|
||||||
|
} from '@aws-sdk/client-acm'
|
||||||
|
import {
|
||||||
|
awsCertificatesSchema,
|
||||||
|
CERTIFICATE_DOMAIN_PATTERN,
|
||||||
|
CERTIFICATE_KEY_ALGORITHMS,
|
||||||
|
CERTIFICATE_REVOCATION_REASONS,
|
||||||
|
CERTIFICATE_VALIDATION_METHODS,
|
||||||
|
} from '../cloud-spi/certificatesSchema'
|
||||||
|
import {RuntimeError, ValidationError} from '../cloud-spi/errors'
|
||||||
|
import type {
|
||||||
|
CertificatePem,
|
||||||
|
CertificateRevocationReason,
|
||||||
|
CloudResource,
|
||||||
|
CloudServiceAdapter,
|
||||||
|
CreateResourceInput,
|
||||||
|
ExportedCertificate,
|
||||||
|
ResourceQuery,
|
||||||
|
ServiceSchema,
|
||||||
|
} from '../cloud-spi/types'
|
||||||
|
|
||||||
|
/**
|
||||||
|
* ListCertificates returns only RSA certificates unless asked for other key
|
||||||
|
* types, so a list without this would silently leave out every EC certificate.
|
||||||
|
*/
|
||||||
|
const ALL_KEY_TYPES: KeyAlgorithm[] = ['RSA_1024', 'RSA_2048', 'RSA_3072', 'RSA_4096', 'EC_prime256v1', 'EC_secp384r1', 'EC_secp521r1']
|
||||||
|
/** ACM's limit on names per certificate, the domain name included. */
|
||||||
|
const MAX_NAMES = 100
|
||||||
|
const CERTIFICATE_TYPE_LABEL: Record<string, string> = {AMAZON_ISSUED: 'Amazon issued', IMPORTED: 'Imported', PRIVATE: 'Private'}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Talks to AWS Certificate Manager, verified against Floci core (community, `latest`).
|
||||||
|
*
|
||||||
|
* Notes from probing the runtime:
|
||||||
|
* - Requested certificates are signed by the runtime's own local CA and issued at
|
||||||
|
* once (its validation wait defaults to 0), but DescribeCertificate still lists
|
||||||
|
* the CNAME records DNS validation would ask for, as AWS does.
|
||||||
|
* - DeleteCertificate refuses with ResourceInUseException while a load balancer,
|
||||||
|
* distribution or API domain uses the certificate, as on AWS.
|
||||||
|
*
|
||||||
|
* Resources are keyed by the certificate's UUID, the last part of its ARN, because
|
||||||
|
* an ARN's slash cannot travel in a URL path segment; the ARN is rebuilt from the
|
||||||
|
* account and region this adapter serves.
|
||||||
|
*/
|
||||||
|
export class AwsCertificatesAdapter implements CloudServiceAdapter {
|
||||||
|
readonly cloud = 'aws' as const
|
||||||
|
readonly service = 'certificates' as const
|
||||||
|
|
||||||
|
constructor(
|
||||||
|
private readonly acm: ACMClient,
|
||||||
|
private readonly accountId: string,
|
||||||
|
private readonly region = process.env.AWS_REGION || 'us-east-1',
|
||||||
|
) {}
|
||||||
|
|
||||||
|
schema(): ServiceSchema {
|
||||||
|
return awsCertificatesSchema()
|
||||||
|
}
|
||||||
|
|
||||||
|
async list(query: ResourceQuery = {}): Promise<CloudResource[]> {
|
||||||
|
const summaries: CertificateSummary[] = []
|
||||||
|
let next: string | undefined
|
||||||
|
do {
|
||||||
|
const res = await this.acm.send(new ListCertificatesCommand({Includes: {keyTypes: ALL_KEY_TYPES}, MaxItems: 1000, ...(next ? {NextToken: next} : {})}))
|
||||||
|
summaries.push(...(res.CertificateSummaryList ?? []))
|
||||||
|
next = res.NextToken
|
||||||
|
} while (next)
|
||||||
|
|
||||||
|
const search = query.search?.trim().toLowerCase()
|
||||||
|
return summaries.map((summary) => this.fromSummary(summary)).filter((certificate) => !search
|
||||||
|
|| certificate.name.toLowerCase().includes(search)
|
||||||
|
|| certificate.id.includes(search)
|
||||||
|
|| (certificate.metadata.subjectAlternativeNames as string[]).some((name) => name.toLowerCase().includes(search)))
|
||||||
|
}
|
||||||
|
|
||||||
|
async get(id: string): Promise<CloudResource | null> {
|
||||||
|
try {
|
||||||
|
const res = await this.acm.send(new DescribeCertificateCommand({CertificateArn: this.arn(id)}))
|
||||||
|
return res.Certificate ? this.fromDetail(res.Certificate) : null
|
||||||
|
} catch (error) {
|
||||||
|
if (errorName(error) === 'ResourceNotFoundException') return null
|
||||||
|
throw error
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async create(input: CreateResourceInput): Promise<CloudResource> {
|
||||||
|
const source = input.values.source ?? 'request'
|
||||||
|
const arn = source === 'import' ? await this.importCertificate(input.values)
|
||||||
|
: source === 'request' ? await this.requestCertificate(input.values)
|
||||||
|
: null
|
||||||
|
if (arn === null) throw new ValidationError('source must be request or import')
|
||||||
|
|
||||||
|
const created = await this.get(idFromArn(arn))
|
||||||
|
if (!created) throw new RuntimeError(`ACM did not return the new certificate ${arn}`)
|
||||||
|
return created
|
||||||
|
}
|
||||||
|
|
||||||
|
async delete(id: string): Promise<void> {
|
||||||
|
await this.acm.send(new DeleteCertificateCommand({CertificateArn: this.arn(id)}))
|
||||||
|
}
|
||||||
|
|
||||||
|
async getCertificatePem(id: string): Promise<CertificatePem> {
|
||||||
|
const res = await this.acm.send(new GetCertificateCommand({CertificateArn: this.arn(id)}))
|
||||||
|
if (!res.Certificate) throw new RuntimeError('ACM did not return the certificate')
|
||||||
|
return {certificate: res.Certificate, certificateChain: res.CertificateChain ?? null}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* AWS exports only private certificates and public ones requested as
|
||||||
|
* exportable; the private key comes back encrypted with the passphrase.
|
||||||
|
*/
|
||||||
|
async exportCertificate(id: string, passphrase: string): Promise<ExportedCertificate> {
|
||||||
|
if (typeof passphrase !== 'string' || passphrase.length < 4 || passphrase.length > 128) {
|
||||||
|
throw new ValidationError('passphrase must be 4 to 128 characters')
|
||||||
|
}
|
||||||
|
if (/[#$%]/.test(passphrase)) throw new ValidationError('passphrase must not contain #, $ or %')
|
||||||
|
|
||||||
|
const res = await this.acm.send(new ExportCertificateCommand({CertificateArn: this.arn(id), Passphrase: new TextEncoder().encode(passphrase)}))
|
||||||
|
if (!res.Certificate || !res.PrivateKey) throw new RuntimeError('ACM did not return the exported certificate')
|
||||||
|
return {certificate: res.Certificate, certificateChain: res.CertificateChain ?? null, privateKey: res.PrivateKey}
|
||||||
|
}
|
||||||
|
|
||||||
|
async revokeCertificate(id: string, reason: CertificateRevocationReason): Promise<CloudResource> {
|
||||||
|
if (!(CERTIFICATE_REVOCATION_REASONS as readonly string[]).includes(reason)) {
|
||||||
|
throw new ValidationError(`reason must be one of ${CERTIFICATE_REVOCATION_REASONS.join(', ')}`)
|
||||||
|
}
|
||||||
|
await this.acm.send(new RevokeCertificateCommand({CertificateArn: this.arn(id), RevocationReason: reason}))
|
||||||
|
const revoked = await this.get(id)
|
||||||
|
if (!revoked) throw new RuntimeError(`ACM did not return the revoked certificate ${id}`)
|
||||||
|
return revoked
|
||||||
|
}
|
||||||
|
|
||||||
|
private async requestCertificate(values: Record<string, unknown>): Promise<string> {
|
||||||
|
const domainName = text(values.domainName).toLowerCase()
|
||||||
|
if (!domainName) throw new ValidationError('domainName is required')
|
||||||
|
const pattern = new RegExp(CERTIFICATE_DOMAIN_PATTERN)
|
||||||
|
if (!pattern.test(domainName)) throw new ValidationError('domainName must be a domain name such as example.com or *.example.com')
|
||||||
|
|
||||||
|
const alternatives = [...new Set(text(values.subjectAlternativeNames).split(/[\s,]+/).map((name) => name.toLowerCase()).filter((name) => name && name !== domainName))]
|
||||||
|
const invalid = alternatives.find((name) => !pattern.test(name))
|
||||||
|
if (invalid) throw new ValidationError(`${invalid} is not a domain name`)
|
||||||
|
if (alternatives.length + 1 > MAX_NAMES) throw new ValidationError(`A certificate covers at most ${MAX_NAMES} names`)
|
||||||
|
|
||||||
|
const validationMethod = oneOf(values.validationMethod, CERTIFICATE_VALIDATION_METHODS, 'validationMethod')
|
||||||
|
const keyAlgorithm = oneOf(values.keyAlgorithm, CERTIFICATE_KEY_ALGORITHMS, 'keyAlgorithm')
|
||||||
|
const exportOption = oneOf(values.export, ['DISABLED', 'ENABLED'] as const, 'export')
|
||||||
|
|
||||||
|
const res = await this.acm.send(new RequestCertificateCommand({
|
||||||
|
DomainName: domainName,
|
||||||
|
...(alternatives.length > 0 ? {SubjectAlternativeNames: [domainName, ...alternatives]} : {}),
|
||||||
|
ValidationMethod: validationMethod,
|
||||||
|
KeyAlgorithm: keyAlgorithm,
|
||||||
|
Options: {Export: exportOption},
|
||||||
|
}))
|
||||||
|
if (!res.CertificateArn) throw new RuntimeError('ACM did not return the requested certificate')
|
||||||
|
return res.CertificateArn
|
||||||
|
}
|
||||||
|
|
||||||
|
private async importCertificate(values: Record<string, unknown>): Promise<string> {
|
||||||
|
const certificate = pem(values.certificate, 'certificate', 'CERTIFICATE')
|
||||||
|
const privateKey = pem(values.privateKey, 'privateKey', 'PRIVATE KEY')
|
||||||
|
const chain = text(values.certificateChain)
|
||||||
|
if (chain) pem(chain, 'certificateChain', 'CERTIFICATE')
|
||||||
|
|
||||||
|
const encode = (value: string) => new TextEncoder().encode(value)
|
||||||
|
const res = await this.acm.send(new ImportCertificateCommand({
|
||||||
|
Certificate: encode(certificate),
|
||||||
|
PrivateKey: encode(privateKey),
|
||||||
|
...(chain ? {CertificateChain: encode(chain)} : {}),
|
||||||
|
}))
|
||||||
|
if (!res.CertificateArn) throw new RuntimeError('ACM did not return the imported certificate')
|
||||||
|
return res.CertificateArn
|
||||||
|
}
|
||||||
|
|
||||||
|
private arn(id: string): string {
|
||||||
|
if (!/^[0-9a-f-]{36}$/i.test(id)) throw new ValidationError('certificate id must be the UUID at the end of its ARN')
|
||||||
|
return `arn:aws:acm:${this.region}:${this.accountId}:certificate/${id}`
|
||||||
|
}
|
||||||
|
|
||||||
|
private fromSummary(summary: CertificateSummary): CloudResource {
|
||||||
|
const arn = summary.CertificateArn ?? ''
|
||||||
|
return {
|
||||||
|
id: idFromArn(arn),
|
||||||
|
name: summary.DomainName ?? '',
|
||||||
|
cloud: 'aws',
|
||||||
|
service: 'certificates',
|
||||||
|
type: 'certificate',
|
||||||
|
region: arn.split(':')[3] || this.region,
|
||||||
|
createdAt: iso(summary.CreatedAt ?? summary.ImportedAt),
|
||||||
|
status: summary.Status ?? null,
|
||||||
|
metadata: {
|
||||||
|
arn,
|
||||||
|
certificateType: CERTIFICATE_TYPE_LABEL[summary.Type ?? ''] ?? summary.Type ?? null,
|
||||||
|
inUse: summary.InUse ? 'Yes' : 'No',
|
||||||
|
keyAlgorithm: summary.KeyAlgorithm ?? null,
|
||||||
|
notAfter: iso(summary.NotAfter),
|
||||||
|
subjectAlternativeNames: summary.SubjectAlternativeNameSummaries ?? [],
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private fromDetail(detail: CertificateDetail): CloudResource {
|
||||||
|
const arn = detail.CertificateArn ?? ''
|
||||||
|
const inUseBy = detail.InUseBy ?? []
|
||||||
|
return {
|
||||||
|
id: idFromArn(arn),
|
||||||
|
name: detail.DomainName ?? '',
|
||||||
|
cloud: 'aws',
|
||||||
|
service: 'certificates',
|
||||||
|
type: 'certificate',
|
||||||
|
region: arn.split(':')[3] || this.region,
|
||||||
|
createdAt: iso(detail.CreatedAt ?? detail.ImportedAt),
|
||||||
|
status: detail.Status ?? null,
|
||||||
|
metadata: {
|
||||||
|
arn,
|
||||||
|
certificateType: CERTIFICATE_TYPE_LABEL[detail.Type ?? ''] ?? detail.Type ?? null,
|
||||||
|
inUse: inUseBy.length > 0 ? 'Yes' : 'No',
|
||||||
|
inUseBy,
|
||||||
|
keyAlgorithm: detail.KeyAlgorithm ?? null,
|
||||||
|
signatureAlgorithm: detail.SignatureAlgorithm ?? null,
|
||||||
|
notBefore: iso(detail.NotBefore),
|
||||||
|
notAfter: iso(detail.NotAfter),
|
||||||
|
issuedAt: iso(detail.IssuedAt),
|
||||||
|
importedAt: iso(detail.ImportedAt),
|
||||||
|
revokedAt: iso(detail.RevokedAt),
|
||||||
|
revocationReason: detail.RevocationReason ?? null,
|
||||||
|
failureReason: detail.FailureReason ?? null,
|
||||||
|
subject: detail.Subject ?? null,
|
||||||
|
issuer: detail.Issuer ?? null,
|
||||||
|
serial: detail.Serial ?? null,
|
||||||
|
subjectAlternativeNames: detail.SubjectAlternativeNames ?? [],
|
||||||
|
exportable: detail.Options?.Export === 'ENABLED',
|
||||||
|
transparencyLogging: detail.Options?.CertificateTransparencyLoggingPreference ?? null,
|
||||||
|
renewalEligibility: detail.RenewalEligibility ?? null,
|
||||||
|
domainValidations: (detail.DomainValidationOptions ?? []).map((validation) => ({
|
||||||
|
domainName: validation.DomainName ?? '',
|
||||||
|
status: validation.ValidationStatus ?? null,
|
||||||
|
method: validation.ValidationMethod ?? null,
|
||||||
|
record: validation.ResourceRecord
|
||||||
|
? {name: validation.ResourceRecord.Name ?? '', type: validation.ResourceRecord.Type ?? 'CNAME', value: validation.ResourceRecord.Value ?? ''}
|
||||||
|
: null,
|
||||||
|
})),
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/** `arn:aws:acm:us-east-1:000000000000:certificate/<uuid>` — the UUID is what the console keys on. */
|
||||||
|
function idFromArn(arn: string): string {
|
||||||
|
return arn.slice(arn.lastIndexOf('/') + 1)
|
||||||
|
}
|
||||||
|
|
||||||
|
function iso(value: Date | undefined): string | null {
|
||||||
|
return value ? value.toISOString() : null
|
||||||
|
}
|
||||||
|
|
||||||
|
function text(value: unknown): string {
|
||||||
|
return typeof value === 'string' ? value.trim() : ''
|
||||||
|
}
|
||||||
|
|
||||||
|
function pem(value: unknown, field: string, label: string): string {
|
||||||
|
const body = text(value)
|
||||||
|
if (!body) throw new ValidationError(`${field} is required`)
|
||||||
|
if (!new RegExp(`-----BEGIN [A-Z ]*${label}-----`).test(body)) {
|
||||||
|
throw new ValidationError(`${field} must be PEM text starting with -----BEGIN ${label}-----`)
|
||||||
|
}
|
||||||
|
return body
|
||||||
|
}
|
||||||
|
|
||||||
|
function oneOf<T extends readonly string[]>(value: unknown, allowed: T, field: string): T[number] {
|
||||||
|
const raw = text(value)
|
||||||
|
if (!raw) return allowed[0] as T[number]
|
||||||
|
if (!allowed.includes(raw)) throw new ValidationError(`${field} must be one of ${allowed.join(', ')}`)
|
||||||
|
return raw as T[number]
|
||||||
|
}
|
||||||
|
|
||||||
|
function errorName(error: unknown): string | undefined {
|
||||||
|
return typeof error === 'object' && error !== null ? (error as {name?: string}).name : undefined
|
||||||
|
}
|
||||||
@@ -34,6 +34,7 @@ import { LightsailClient } from "@aws-sdk/client-lightsail";
|
|||||||
import { CognitoIdentityProviderClient } from "@aws-sdk/client-cognito-identity-provider";
|
import { CognitoIdentityProviderClient } from "@aws-sdk/client-cognito-identity-provider";
|
||||||
import { Route53Client } from "@aws-sdk/client-route-53";
|
import { Route53Client } from "@aws-sdk/client-route-53";
|
||||||
import { CloudFrontClient } from "@aws-sdk/client-cloudfront";
|
import { CloudFrontClient } from "@aws-sdk/client-cloudfront";
|
||||||
|
import { ACMClient } from "@aws-sdk/client-acm";
|
||||||
|
|
||||||
const endpoint = process.env.FLOCI_ENDPOINT;
|
const endpoint = process.env.FLOCI_ENDPOINT;
|
||||||
const region = process.env.AWS_REGION || "us-east-1";
|
const region = process.env.AWS_REGION || "us-east-1";
|
||||||
@@ -99,6 +100,7 @@ export type AwsClients = {
|
|||||||
cognito: CognitoIdentityProviderClient;
|
cognito: CognitoIdentityProviderClient;
|
||||||
route53: Route53Client;
|
route53: Route53Client;
|
||||||
cloudfront: CloudFrontClient;
|
cloudfront: CloudFrontClient;
|
||||||
|
acm: ACMClient;
|
||||||
};
|
};
|
||||||
|
|
||||||
export type AwsClientName = keyof AwsClients;
|
export type AwsClientName = keyof AwsClients;
|
||||||
@@ -148,6 +150,7 @@ function buildClients(accountId: string): AwsClients {
|
|||||||
cognito: new CognitoIdentityProviderClient(base),
|
cognito: new CognitoIdentityProviderClient(base),
|
||||||
route53: new Route53Client(base),
|
route53: new Route53Client(base),
|
||||||
cloudfront: new CloudFrontClient(base),
|
cloudfront: new CloudFrontClient(base),
|
||||||
|
acm: new ACMClient(base),
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -0,0 +1,154 @@
|
|||||||
|
import type {CloudProvider, FieldSchema, ServiceSchema, TableColumnSchema} from './types'
|
||||||
|
|
||||||
|
/** A domain name, optionally a wildcard (`*.example.com`), as RequestCertificate accepts it. */
|
||||||
|
export const CERTIFICATE_DOMAIN_PATTERN = '^(\\*\\.)?(?=.{1,253}$)([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$'
|
||||||
|
|
||||||
|
/** The key algorithms RequestCertificate accepts for a public certificate. */
|
||||||
|
export const CERTIFICATE_KEY_ALGORITHMS = ['RSA_2048', 'EC_prime256v1', 'EC_secp384r1'] as const
|
||||||
|
export const CERTIFICATE_VALIDATION_METHODS = ['DNS', 'EMAIL'] as const
|
||||||
|
/** RevokeCertificate's reasons, as the API names them. */
|
||||||
|
export const CERTIFICATE_REVOCATION_REASONS = [
|
||||||
|
'UNSPECIFIED',
|
||||||
|
'KEY_COMPROMISE',
|
||||||
|
'CA_COMPROMISE',
|
||||||
|
'AFFILIATION_CHANGED',
|
||||||
|
'SUPERSEDED',
|
||||||
|
'CESSATION_OF_OPERATION',
|
||||||
|
'PRIVILEGE_WITHDRAWN',
|
||||||
|
] as const
|
||||||
|
|
||||||
|
const certificateColumns: TableColumnSchema[] = [
|
||||||
|
{name: 'name', label: 'Domain name'},
|
||||||
|
{name: 'status', label: 'Status', format: 'badge'},
|
||||||
|
{name: 'certificateType', label: 'Type', path: 'metadata.certificateType'},
|
||||||
|
{name: 'inUse', label: 'In use', path: 'metadata.inUse'},
|
||||||
|
{name: 'keyAlgorithm', label: 'Key algorithm', path: 'metadata.keyAlgorithm'},
|
||||||
|
{name: 'notAfter', label: 'Expires', path: 'metadata.notAfter', format: 'datetime', emptyText: '—'},
|
||||||
|
{name: 'id', label: 'Certificate ID', format: 'code'},
|
||||||
|
]
|
||||||
|
|
||||||
|
const certificateFilters: FieldSchema[] = [{name: 'search', label: 'Search', type: 'text', required: false}]
|
||||||
|
|
||||||
|
const requested = {field: 'source', values: ['request']}
|
||||||
|
const imported = {field: 'source', values: ['import']}
|
||||||
|
|
||||||
|
export function awsCertificatesSchema(): ServiceSchema {
|
||||||
|
return {
|
||||||
|
cloud: 'aws',
|
||||||
|
service: 'certificates',
|
||||||
|
displayName: 'AWS Certificate Manager',
|
||||||
|
fields: [
|
||||||
|
{
|
||||||
|
name: 'source',
|
||||||
|
label: 'Certificate type',
|
||||||
|
type: 'select',
|
||||||
|
required: true,
|
||||||
|
defaultValue: 'request',
|
||||||
|
options: [
|
||||||
|
{label: 'Request a public certificate', value: 'request'},
|
||||||
|
{label: 'Import a certificate', value: 'import'},
|
||||||
|
],
|
||||||
|
span: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: 'domainName',
|
||||||
|
label: 'Domain name',
|
||||||
|
type: 'text',
|
||||||
|
required: false,
|
||||||
|
requiredWhen: {field: 'source', equals: 'request'},
|
||||||
|
visibleWhen: requested,
|
||||||
|
description: 'For example notes.thecloud.localhost, or *.thecloud.localhost for every subdomain. TheCloud signs it with its own local certificate authority.',
|
||||||
|
validation: {pattern: CERTIFICATE_DOMAIN_PATTERN, message: 'Use a domain name such as example.com or *.example.com'},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: 'subjectAlternativeNames',
|
||||||
|
label: 'Additional names',
|
||||||
|
type: 'textarea',
|
||||||
|
required: false,
|
||||||
|
visibleWhen: requested,
|
||||||
|
description: 'Other names the certificate covers, one per line.',
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: 'validationMethod',
|
||||||
|
label: 'Validation method',
|
||||||
|
type: 'select',
|
||||||
|
required: false,
|
||||||
|
defaultValue: 'DNS',
|
||||||
|
visibleWhen: requested,
|
||||||
|
description: 'How ACM proves you own the domain. TheCloud issues the certificate without checking, and still shows the DNS records AWS would ask for.',
|
||||||
|
options: CERTIFICATE_VALIDATION_METHODS.map((value) => ({label: value, value})),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: 'keyAlgorithm',
|
||||||
|
label: 'Key algorithm',
|
||||||
|
type: 'select',
|
||||||
|
required: false,
|
||||||
|
defaultValue: 'RSA_2048',
|
||||||
|
visibleWhen: requested,
|
||||||
|
options: CERTIFICATE_KEY_ALGORITHMS.map((value) => ({label: value.replace('_', ' '), value})),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: 'export',
|
||||||
|
label: 'Exportable',
|
||||||
|
type: 'select',
|
||||||
|
required: false,
|
||||||
|
defaultValue: 'DISABLED',
|
||||||
|
visibleWhen: requested,
|
||||||
|
description: 'An exportable certificate can be downloaded with its private key, to use on servers outside AWS. This is chosen once and cannot be changed later.',
|
||||||
|
options: [
|
||||||
|
{label: 'No', value: 'DISABLED'},
|
||||||
|
{label: 'Yes, allow export', value: 'ENABLED'},
|
||||||
|
],
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: 'certificate',
|
||||||
|
label: 'Certificate body (PEM)',
|
||||||
|
type: 'textarea',
|
||||||
|
required: false,
|
||||||
|
requiredWhen: {field: 'source', equals: 'import'},
|
||||||
|
visibleWhen: imported,
|
||||||
|
span: true,
|
||||||
|
description: 'Starts with -----BEGIN CERTIFICATE-----.',
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: 'privateKey',
|
||||||
|
label: 'Private key (PEM)',
|
||||||
|
type: 'textarea',
|
||||||
|
required: false,
|
||||||
|
requiredWhen: {field: 'source', equals: 'import'},
|
||||||
|
visibleWhen: imported,
|
||||||
|
span: true,
|
||||||
|
description: 'The unencrypted key that matches the certificate.',
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: 'certificateChain',
|
||||||
|
label: 'Certificate chain (PEM)',
|
||||||
|
type: 'textarea',
|
||||||
|
required: false,
|
||||||
|
visibleWhen: imported,
|
||||||
|
span: true,
|
||||||
|
description: 'The intermediate certificates, if the certificate is not self-signed.',
|
||||||
|
},
|
||||||
|
],
|
||||||
|
actions: ['list', 'create', 'delete', 'inspect'],
|
||||||
|
capabilities: {
|
||||||
|
resourceActions: [
|
||||||
|
{name: 'list', label: 'List certificates', enabled: true, status: 'available', runtimeRequired: true},
|
||||||
|
{name: 'create', label: 'Request or import a certificate', enabled: true, status: 'available', runtimeRequired: true},
|
||||||
|
{name: 'delete', label: 'Delete certificate', enabled: true, status: 'available', runtimeRequired: true},
|
||||||
|
{name: 'inspect', label: 'Inspect certificate', enabled: true, status: 'available', runtimeRequired: true},
|
||||||
|
],
|
||||||
|
certificateActions: [
|
||||||
|
{name: 'download', label: 'Download the certificate and chain', enabled: true, status: 'available', runtimeRequired: true},
|
||||||
|
{name: 'export', label: 'Export with the private key', enabled: true, status: 'available', runtimeRequired: true},
|
||||||
|
{name: 'revoke', label: 'Revoke certificate', enabled: true, status: 'available', runtimeRequired: true},
|
||||||
|
],
|
||||||
|
},
|
||||||
|
filters: certificateFilters,
|
||||||
|
columns: certificateColumns,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
export function certificatesSchemaFor(cloud: CloudProvider): ServiceSchema | null {
|
||||||
|
return cloud === 'aws' ? awsCertificatesSchema() : null
|
||||||
|
}
|
||||||
@@ -239,6 +239,13 @@ export const SERVICE_CATALOG = {
|
|||||||
// AWS retains its dedicated page while Azure and GCP use Cloud Explorer.
|
// AWS retains its dedicated page while Azure and GCP use Cloud Explorer.
|
||||||
routeByCloud: {aws: '/secretsmanager'},
|
routeByCloud: {aws: '/secretsmanager'},
|
||||||
},
|
},
|
||||||
|
certificates: {
|
||||||
|
displayName: 'Certificates',
|
||||||
|
displayNameByCloud: {aws: 'Certificate Manager'},
|
||||||
|
iconKey: 'certificates',
|
||||||
|
group: 'Security',
|
||||||
|
order: 35,
|
||||||
|
},
|
||||||
cdn: {
|
cdn: {
|
||||||
displayName: 'CDN',
|
displayName: 'CDN',
|
||||||
displayNameByCloud: {aws: 'CloudFront'},
|
displayNameByCloud: {aws: 'CloudFront'},
|
||||||
|
|||||||
@@ -186,6 +186,7 @@ export type UserPoolActionName =
|
|||||||
| 'describeClient'
|
| 'describeClient'
|
||||||
| 'updateClientOAuth'
|
| 'updateClientOAuth'
|
||||||
export type DistributionActionName = 'setEnabled' | 'createInvalidation'
|
export type DistributionActionName = 'setEnabled' | 'createInvalidation'
|
||||||
|
export type CertificateActionName = 'download' | 'export' | 'revoke'
|
||||||
export type MonitoringActionName = 'listMetrics' | 'getMetricData' | 'alarmHistory' | 'setAlarmState' | 'setAlarmActions'
|
export type MonitoringActionName = 'listMetrics' | 'getMetricData' | 'alarmHistory' | 'setAlarmState' | 'setAlarmActions'
|
||||||
export type HttpApiActionName =
|
export type HttpApiActionName =
|
||||||
| 'describe'
|
| 'describe'
|
||||||
@@ -245,6 +246,7 @@ export interface ServiceSchema {
|
|||||||
kubernetesActions?: CapabilitySchema<KubernetesActionName>[]
|
kubernetesActions?: CapabilitySchema<KubernetesActionName>[]
|
||||||
userPoolActions?: CapabilitySchema<UserPoolActionName>[]
|
userPoolActions?: CapabilitySchema<UserPoolActionName>[]
|
||||||
distributionActions?: CapabilitySchema<DistributionActionName>[]
|
distributionActions?: CapabilitySchema<DistributionActionName>[]
|
||||||
|
certificateActions?: CapabilitySchema<CertificateActionName>[]
|
||||||
monitoringActions?: CapabilitySchema<MonitoringActionName>[]
|
monitoringActions?: CapabilitySchema<MonitoringActionName>[]
|
||||||
/** API Gateway v2 (HTTP and WebSocket APIs): what the routes, stages and security panel can do. */
|
/** API Gateway v2 (HTTP and WebSocket APIs): what the routes, stages and security panel can do. */
|
||||||
httpApiActions?: CapabilitySchema<HttpApiActionName>[]
|
httpApiActions?: CapabilitySchema<HttpApiActionName>[]
|
||||||
@@ -515,6 +517,26 @@ export interface AlarmHistoryItem {
|
|||||||
summary: string
|
summary: string
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/** A certificate and its chain as PEM text; never the private key. */
|
||||||
|
export interface CertificatePem {
|
||||||
|
certificate: string
|
||||||
|
certificateChain: string | null
|
||||||
|
}
|
||||||
|
|
||||||
|
/** An exported certificate: the private key is PEM, encrypted with the caller's passphrase. */
|
||||||
|
export interface ExportedCertificate extends CertificatePem {
|
||||||
|
privateKey: string
|
||||||
|
}
|
||||||
|
|
||||||
|
export type CertificateRevocationReason =
|
||||||
|
| 'UNSPECIFIED'
|
||||||
|
| 'KEY_COMPROMISE'
|
||||||
|
| 'CA_COMPROMISE'
|
||||||
|
| 'AFFILIATION_CHANGED'
|
||||||
|
| 'SUPERSEDED'
|
||||||
|
| 'CESSATION_OF_OPERATION'
|
||||||
|
| 'PRIVILEGE_WITHDRAWN'
|
||||||
|
|
||||||
export interface DistributionInvalidation {
|
export interface DistributionInvalidation {
|
||||||
id: string
|
id: string
|
||||||
status: string
|
status: string
|
||||||
@@ -1182,6 +1204,9 @@ export interface CloudServiceAdapter {
|
|||||||
setAlarmState?(alarmName: string, state: AlarmStateValue, reason: string): Promise<void>
|
setAlarmState?(alarmName: string, state: AlarmStateValue, reason: string): Promise<void>
|
||||||
setAlarmActionsEnabled?(alarmName: string, enabled: boolean): Promise<void>
|
setAlarmActionsEnabled?(alarmName: string, enabled: boolean): Promise<void>
|
||||||
createDistributionInvalidation?(distributionId: string, paths: string[]): Promise<DistributionInvalidation>
|
createDistributionInvalidation?(distributionId: string, paths: string[]): Promise<DistributionInvalidation>
|
||||||
|
getCertificatePem?(certificateId: string): Promise<CertificatePem>
|
||||||
|
exportCertificate?(certificateId: string, passphrase: string): Promise<ExportedCertificate>
|
||||||
|
revokeCertificate?(certificateId: string, reason: CertificateRevocationReason): Promise<CloudResource>
|
||||||
updateUserPoolClientOAuth?(poolId: string, clientId: string, input: UpdateUserPoolClientOAuthInput): Promise<UserPoolClientSettings>
|
updateUserPoolClientOAuth?(poolId: string, clientId: string, input: UpdateUserPoolClientOAuthInput): Promise<UserPoolClientSettings>
|
||||||
/** Clears the provider's locally captured email inbox, if it exposes one. */
|
/** Clears the provider's locally captured email inbox, if it exposes one. */
|
||||||
clearEmailInbox?(): Promise<void>
|
clearEmailInbox?(): Promise<void>
|
||||||
|
|||||||
@@ -2,7 +2,7 @@ import {describe, expect, test} from 'bun:test'
|
|||||||
import {createCloudAdapterRegistry} from './cloudProxy'
|
import {createCloudAdapterRegistry} from './cloudProxy'
|
||||||
import {checkChildCapabilities} from './cloud-spi/childCapabilities'
|
import {checkChildCapabilities} from './cloud-spi/childCapabilities'
|
||||||
import {isServiceType} from './cloud-spi/serviceCatalog'
|
import {isServiceType} from './cloud-spi/serviceCatalog'
|
||||||
import type {CloudProvider, CloudServiceAdapter, CloudServiceType, DatabaseActionName, DistributionActionName, HttpApiActionName, KubernetesActionName, MonitoringActionName, ResourceActionName, UserPoolActionName} from './cloud-spi/types'
|
import type {CloudProvider, CloudServiceAdapter, CloudServiceType, CertificateActionName, DatabaseActionName, DistributionActionName, HttpApiActionName, KubernetesActionName, MonitoringActionName, ResourceActionName, UserPoolActionName} from './cloud-spi/types'
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Guards the schema-to-implementation contract for every registered adapter.
|
* Guards the schema-to-implementation contract for every registered adapter.
|
||||||
@@ -75,6 +75,12 @@ const METHOD_FOR_DISTRIBUTION_ACTION: Record<DistributionActionName, keyof Cloud
|
|||||||
createInvalidation: 'createDistributionInvalidation',
|
createInvalidation: 'createDistributionInvalidation',
|
||||||
}
|
}
|
||||||
|
|
||||||
|
const METHOD_FOR_CERTIFICATE_ACTION: Record<CertificateActionName, keyof CloudServiceAdapter> = {
|
||||||
|
download: 'getCertificatePem',
|
||||||
|
export: 'exportCertificate',
|
||||||
|
revoke: 'revokeCertificate',
|
||||||
|
}
|
||||||
|
|
||||||
const METHOD_FOR_USER_POOL_ACTION: Record<UserPoolActionName, keyof CloudServiceAdapter> = {
|
const METHOD_FOR_USER_POOL_ACTION: Record<UserPoolActionName, keyof CloudServiceAdapter> = {
|
||||||
updateUser: 'updateUserPoolUser',
|
updateUser: 'updateUserPoolUser',
|
||||||
setUserGroups: 'setUserPoolUserGroups',
|
setUserGroups: 'setUserPoolUserGroups',
|
||||||
@@ -188,6 +194,15 @@ describe('registered adapters honour their schema', () => {
|
|||||||
).toBe('function')
|
).toBe('function')
|
||||||
}
|
}
|
||||||
|
|
||||||
|
const certificateClaims = (adapter.schema().capabilities?.certificateActions ?? []).filter((capability) => capability.status === 'available')
|
||||||
|
for (const capability of certificateClaims) {
|
||||||
|
const method = METHOD_FOR_CERTIFICATE_ACTION[capability.name]
|
||||||
|
expect(
|
||||||
|
typeof adapter[method],
|
||||||
|
`${label} advertises ${capability.name} as available but has no ${String(method)}()`,
|
||||||
|
).toBe('function')
|
||||||
|
}
|
||||||
|
|
||||||
const distributionClaims = (adapter.schema().capabilities?.distributionActions ?? []).filter((capability) => capability.status === 'available')
|
const distributionClaims = (adapter.schema().capabilities?.distributionActions ?? []).filter((capability) => capability.status === 'available')
|
||||||
for (const capability of distributionClaims) {
|
for (const capability of distributionClaims) {
|
||||||
const method = METHOD_FOR_DISTRIBUTION_ACTION[capability.name]
|
const method = METHOD_FOR_DISTRIBUTION_ACTION[capability.name]
|
||||||
@@ -210,6 +225,7 @@ describe('registered adapters honour their schema', () => {
|
|||||||
...(adapter.schema().capabilities?.kubernetesActions ?? []),
|
...(adapter.schema().capabilities?.kubernetesActions ?? []),
|
||||||
...(adapter.schema().capabilities?.userPoolActions ?? []),
|
...(adapter.schema().capabilities?.userPoolActions ?? []),
|
||||||
...(adapter.schema().capabilities?.distributionActions ?? []),
|
...(adapter.schema().capabilities?.distributionActions ?? []),
|
||||||
|
...(adapter.schema().capabilities?.certificateActions ?? []),
|
||||||
...(adapter.schema().capabilities?.monitoringActions ?? []),
|
...(adapter.schema().capabilities?.monitoringActions ?? []),
|
||||||
...(adapter.schema().capabilities?.httpApiActions ?? []),
|
...(adapter.schema().capabilities?.httpApiActions ?? []),
|
||||||
...(adapter.schema().capabilities?.collectionActions ?? []),
|
...(adapter.schema().capabilities?.collectionActions ?? []),
|
||||||
|
|||||||
@@ -50,6 +50,7 @@ import {AwsLightsailAdapter} from './adapter-aws/AwsLightsailAdapter'
|
|||||||
import {AwsUserPoolsAdapter} from './adapter-aws/AwsUserPoolsAdapter'
|
import {AwsUserPoolsAdapter} from './adapter-aws/AwsUserPoolsAdapter'
|
||||||
import {AwsDnsAdapter} from './adapter-aws/AwsDnsAdapter'
|
import {AwsDnsAdapter} from './adapter-aws/AwsDnsAdapter'
|
||||||
import {AwsCdnAdapter} from './adapter-aws/AwsCdnAdapter'
|
import {AwsCdnAdapter} from './adapter-aws/AwsCdnAdapter'
|
||||||
|
import {AwsCertificatesAdapter} from './adapter-aws/AwsCertificatesAdapter'
|
||||||
import {AwsMonitoringAdapter} from './adapter-aws/AwsMonitoringAdapter'
|
import {AwsMonitoringAdapter} from './adapter-aws/AwsMonitoringAdapter'
|
||||||
import {awsClientsForAccount, resolveAccountId} from './aws'
|
import {awsClientsForAccount, resolveAccountId} from './aws'
|
||||||
import {createEc2Service} from './services/ec2'
|
import {createEc2Service} from './services/ec2'
|
||||||
@@ -103,6 +104,7 @@ export function createCloudAdapterRegistry(accountId?: string | null): CloudAdap
|
|||||||
new AwsUserPoolsAdapter(clients.cognito),
|
new AwsUserPoolsAdapter(clients.cognito),
|
||||||
new AwsDnsAdapter(clients.route53),
|
new AwsDnsAdapter(clients.route53),
|
||||||
new AwsCdnAdapter(clients.cloudfront, clients.s3),
|
new AwsCdnAdapter(clients.cloudfront, clients.s3),
|
||||||
|
new AwsCertificatesAdapter(clients.acm, resolveAccountId(accountId)),
|
||||||
new AwsMonitoringAdapter(clients.cloudwatch),
|
new AwsMonitoringAdapter(clients.cloudwatch),
|
||||||
new AzureStorageAdapter(),
|
new AzureStorageAdapter(),
|
||||||
new AzureServiceBusAdapter(),
|
new AzureServiceBusAdapter(),
|
||||||
|
|||||||
@@ -18,6 +18,7 @@ import {awsStorageSchema, azureStorageSchema, gcpStorageSchema} from '../cloud-s
|
|||||||
import {awsSesEmailSchema} from '../cloud-spi/emailSchema'
|
import {awsSesEmailSchema} from '../cloud-spi/emailSchema'
|
||||||
import {awsUserPoolsSchema} from '../cloud-spi/userPoolsSchema'
|
import {awsUserPoolsSchema} from '../cloud-spi/userPoolsSchema'
|
||||||
import {awsCdnSchema} from '../cloud-spi/cdnSchema'
|
import {awsCdnSchema} from '../cloud-spi/cdnSchema'
|
||||||
|
import {awsCertificatesSchema} from '../cloud-spi/certificatesSchema'
|
||||||
import {awsMonitoringSchema} from '../cloud-spi/monitoringSchema'
|
import {awsMonitoringSchema} from '../cloud-spi/monitoringSchema'
|
||||||
import {awsAppConfigSchema} from '../cloud-spi/appConfigSchema'
|
import {awsAppConfigSchema} from '../cloud-spi/appConfigSchema'
|
||||||
import {awsEventBridgeSchema} from '../cloud-spi/eventbridgeSchema'
|
import {awsEventBridgeSchema} from '../cloud-spi/eventbridgeSchema'
|
||||||
@@ -823,6 +824,34 @@ describe('cloud schema routes', () => {
|
|||||||
expect(calls).toEqual([['enabled', 'E123', false], ['invalidate', 'E123', ['/*']]])
|
expect(calls).toEqual([['enabled', 'E123', false], ['invalidate', 'E123', ['/*']]])
|
||||||
})
|
})
|
||||||
|
|
||||||
|
test('downloads, exports and revokes a certificate through the ACM adapter', async () => {
|
||||||
|
const calls: unknown[] = []
|
||||||
|
const app = appWithRoutes([mockAdapter('aws', {
|
||||||
|
service: 'certificates',
|
||||||
|
schema: awsCertificatesSchema,
|
||||||
|
getCertificatePem: async (id) => {
|
||||||
|
calls.push(['pem', id])
|
||||||
|
return {certificate: 'CERT', certificateChain: null}
|
||||||
|
},
|
||||||
|
exportCertificate: async (id, passphrase) => {
|
||||||
|
calls.push(['export', id, passphrase])
|
||||||
|
return {certificate: 'CERT', certificateChain: null, privateKey: 'KEY'}
|
||||||
|
},
|
||||||
|
revokeCertificate: async (id, reason) => {
|
||||||
|
calls.push(['revoke', id, reason])
|
||||||
|
return {id, name: 'a.test', cloud: 'aws', service: 'certificates', type: 'certificate', region: null, createdAt: null, status: 'REVOKED', metadata: {}}
|
||||||
|
},
|
||||||
|
})])
|
||||||
|
const json = (body: unknown) => ({method: 'POST', headers: {'content-type': 'application/json'}, body: JSON.stringify(body)})
|
||||||
|
const base = '/api/clouds/aws/services/certificates/resources/c1'
|
||||||
|
|
||||||
|
expect(await (await app.request(`${base}/pem`)).json()).toEqual({certificate: 'CERT', certificateChain: null})
|
||||||
|
expect((await (await app.request(`${base}/export`, json({passphrase: 'secret'}))).json()).privateKey).toBe('KEY')
|
||||||
|
const revoked = await app.request(`${base}/revoke`, json({}))
|
||||||
|
expect((await revoked.json()).status).toBe('REVOKED')
|
||||||
|
expect(calls).toEqual([['pem', 'c1'], ['export', 'c1', 'secret'], ['revoke', 'c1', 'UNSPECIFIED']])
|
||||||
|
})
|
||||||
|
|
||||||
test('clears the SES mailbox through the email adapter', async () => {
|
test('clears the SES mailbox through the email adapter', async () => {
|
||||||
let cleared = false
|
let cleared = false
|
||||||
const app = appWithRoutes([mockAdapter('aws', {
|
const app = appWithRoutes([mockAdapter('aws', {
|
||||||
|
|||||||
@@ -2,6 +2,7 @@ import {Hono} from 'hono'
|
|||||||
import type {Context} from 'hono'
|
import type {Context} from 'hono'
|
||||||
import type {
|
import type {
|
||||||
AlarmStateValue,
|
AlarmStateValue,
|
||||||
|
CertificateRevocationReason,
|
||||||
CloudProvider,
|
CloudProvider,
|
||||||
CloudServiceType,
|
CloudServiceType,
|
||||||
CreateDatabaseSnapshotInput,
|
CreateDatabaseSnapshotInput,
|
||||||
@@ -525,6 +526,33 @@ export function createCloudRoutes(injectedService?: CloudProxyService) {
|
|||||||
})
|
})
|
||||||
})
|
})
|
||||||
|
|
||||||
|
app.get('/:cloud/services/certificates/resources/:id/pem', async (c) => {
|
||||||
|
const cloud = c.req.param('cloud') as CloudProvider
|
||||||
|
if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
|
||||||
|
|
||||||
|
return withRuntime(c, async () => c.json(await svc(c).getCertificatePem(cloud, c.req.param('id'))))
|
||||||
|
})
|
||||||
|
|
||||||
|
app.post('/:cloud/services/certificates/resources/:id/export', async (c) => {
|
||||||
|
const cloud = c.req.param('cloud') as CloudProvider
|
||||||
|
if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
|
||||||
|
|
||||||
|
return withRuntime(c, async () => {
|
||||||
|
const body = await c.req.json<{passphrase?: string}>()
|
||||||
|
return c.json(await svc(c).exportCertificate(cloud, c.req.param('id'), body.passphrase as string))
|
||||||
|
})
|
||||||
|
})
|
||||||
|
|
||||||
|
app.post('/:cloud/services/certificates/resources/:id/revoke', async (c) => {
|
||||||
|
const cloud = c.req.param('cloud') as CloudProvider
|
||||||
|
if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
|
||||||
|
|
||||||
|
return withRuntime(c, async () => {
|
||||||
|
const body = await c.req.json<{reason?: CertificateRevocationReason}>()
|
||||||
|
return c.json(await svc(c).revokeCertificate(cloud, c.req.param('id'), body.reason ?? 'UNSPECIFIED'))
|
||||||
|
})
|
||||||
|
})
|
||||||
|
|
||||||
app.get('/:cloud/services/k8s/resources/:id/nodegroups', async (c) => {
|
app.get('/:cloud/services/k8s/resources/:id/nodegroups', async (c) => {
|
||||||
const cloud = c.req.param('cloud') as CloudProvider
|
const cloud = c.req.param('cloud') as CloudProvider
|
||||||
if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
|
if (!isCloudProvider(cloud)) return c.json({error: 'Unknown cloud'}, 404)
|
||||||
|
|||||||
@@ -93,6 +93,9 @@ import type {
|
|||||||
UserPoolSignInTestResult,
|
UserPoolSignInTestResult,
|
||||||
UserPoolClientSettings,
|
UserPoolClientSettings,
|
||||||
DistributionInvalidation,
|
DistributionInvalidation,
|
||||||
|
CertificatePem,
|
||||||
|
CertificateRevocationReason,
|
||||||
|
ExportedCertificate,
|
||||||
AlarmHistoryItem,
|
AlarmHistoryItem,
|
||||||
AlarmStateValue,
|
AlarmStateValue,
|
||||||
MetricSeries,
|
MetricSeries,
|
||||||
@@ -942,6 +945,24 @@ export class CloudProxyService {
|
|||||||
return adapter.createDistributionInvalidation(distributionId, paths)
|
return adapter.createDistributionInvalidation(distributionId, paths)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
async getCertificatePem(cloud: CloudProvider, certificateId: string): Promise<CertificatePem> {
|
||||||
|
const adapter = this.requireAdapter(cloud, 'certificates')
|
||||||
|
if (!adapter.getCertificatePem) throw new NotSupportedError(`Downloading certificates is not supported for ${cloud}/certificates`)
|
||||||
|
return adapter.getCertificatePem(certificateId)
|
||||||
|
}
|
||||||
|
|
||||||
|
async exportCertificate(cloud: CloudProvider, certificateId: string, passphrase: string): Promise<ExportedCertificate> {
|
||||||
|
const adapter = this.requireAdapter(cloud, 'certificates')
|
||||||
|
if (!adapter.exportCertificate) throw new NotSupportedError(`Exporting certificates is not supported for ${cloud}/certificates`)
|
||||||
|
return adapter.exportCertificate(certificateId, passphrase)
|
||||||
|
}
|
||||||
|
|
||||||
|
async revokeCertificate(cloud: CloudProvider, certificateId: string, reason: CertificateRevocationReason): Promise<CloudResource> {
|
||||||
|
const adapter = this.requireAdapter(cloud, 'certificates')
|
||||||
|
if (!adapter.revokeCertificate) throw new NotSupportedError(`Revoking certificates is not supported for ${cloud}/certificates`)
|
||||||
|
return adapter.revokeCertificate(certificateId, reason)
|
||||||
|
}
|
||||||
|
|
||||||
async describeUserPoolClient(cloud: CloudProvider, poolId: string, clientId: string): Promise<UserPoolClientSettings> {
|
async describeUserPoolClient(cloud: CloudProvider, poolId: string, clientId: string): Promise<UserPoolClientSettings> {
|
||||||
const adapter = this.requireAdapter(cloud, 'userpools')
|
const adapter = this.requireAdapter(cloud, 'userpools')
|
||||||
if (!adapter.describeUserPoolClient) throw new NotSupportedError(`App client settings are not supported for ${cloud}/userpools`)
|
if (!adapter.describeUserPoolClient) throw new NotSupportedError(`App client settings are not supported for ${cloud}/userpools`)
|
||||||
|
|||||||
@@ -150,6 +150,11 @@ export const apiEndpointKeys = {
|
|||||||
state: "clouds.services.monitoring.state",
|
state: "clouds.services.monitoring.state",
|
||||||
actions: "clouds.services.monitoring.actions",
|
actions: "clouds.services.monitoring.actions",
|
||||||
},
|
},
|
||||||
|
certificates: {
|
||||||
|
pem: "clouds.services.certificates.pem",
|
||||||
|
export: "clouds.services.certificates.export",
|
||||||
|
revoke: "clouds.services.certificates.revoke",
|
||||||
|
},
|
||||||
cdn: {
|
cdn: {
|
||||||
enabled: "clouds.services.cdn.enabled",
|
enabled: "clouds.services.cdn.enabled",
|
||||||
invalidations: "clouds.services.cdn.invalidations",
|
invalidations: "clouds.services.cdn.invalidations",
|
||||||
@@ -926,6 +931,27 @@ export const endpointRegistry: EndpointRegistry = new Map([
|
|||||||
[apiEndpointKeys.clouds.monitoring.history, {path: "/clouds/:cloud/services/monitoring/resources/:id/history", method: "GET"}],
|
[apiEndpointKeys.clouds.monitoring.history, {path: "/clouds/:cloud/services/monitoring/resources/:id/history", method: "GET"}],
|
||||||
[apiEndpointKeys.clouds.monitoring.state, {path: "/clouds/:cloud/services/monitoring/resources/:id/state", method: "PUT"}],
|
[apiEndpointKeys.clouds.monitoring.state, {path: "/clouds/:cloud/services/monitoring/resources/:id/state", method: "PUT"}],
|
||||||
[apiEndpointKeys.clouds.monitoring.actions, {path: "/clouds/:cloud/services/monitoring/resources/:id/actions", method: "PUT"}],
|
[apiEndpointKeys.clouds.monitoring.actions, {path: "/clouds/:cloud/services/monitoring/resources/:id/actions", method: "PUT"}],
|
||||||
|
[
|
||||||
|
apiEndpointKeys.clouds.certificates.pem,
|
||||||
|
{
|
||||||
|
path: "/clouds/:cloud/services/certificates/resources/:id/pem",
|
||||||
|
method: "GET",
|
||||||
|
},
|
||||||
|
],
|
||||||
|
[
|
||||||
|
apiEndpointKeys.clouds.certificates.export,
|
||||||
|
{
|
||||||
|
path: "/clouds/:cloud/services/certificates/resources/:id/export",
|
||||||
|
method: "POST",
|
||||||
|
},
|
||||||
|
],
|
||||||
|
[
|
||||||
|
apiEndpointKeys.clouds.certificates.revoke,
|
||||||
|
{
|
||||||
|
path: "/clouds/:cloud/services/certificates/resources/:id/revoke",
|
||||||
|
method: "POST",
|
||||||
|
},
|
||||||
|
],
|
||||||
[
|
[
|
||||||
apiEndpointKeys.clouds.cdn.enabled,
|
apiEndpointKeys.clouds.cdn.enabled,
|
||||||
{
|
{
|
||||||
|
|||||||
@@ -33,6 +33,9 @@ import type {
|
|||||||
UserPoolSignInTestResult,
|
UserPoolSignInTestResult,
|
||||||
UserPoolClientSettings,
|
UserPoolClientSettings,
|
||||||
DistributionInvalidation,
|
DistributionInvalidation,
|
||||||
|
CertificatePem,
|
||||||
|
CertificateRevocationReason,
|
||||||
|
ExportedCertificate,
|
||||||
AlarmHistoryItem,
|
AlarmHistoryItem,
|
||||||
AlarmStateValue,
|
AlarmStateValue,
|
||||||
MetricSeries,
|
MetricSeries,
|
||||||
@@ -1679,6 +1682,44 @@ export async function testWebSocketApi(cloud: CloudProvider, apiId: string, inpu
|
|||||||
return res.data;
|
return res.data;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
export async function getCertificatePem(
|
||||||
|
cloud: CloudProvider,
|
||||||
|
certificateId: string,
|
||||||
|
): Promise<CertificatePem> {
|
||||||
|
const res = await apiClient.call<CertificatePem>(
|
||||||
|
apiEndpointKeys.clouds.certificates.pem,
|
||||||
|
requestOptions(cloud, "certificates"),
|
||||||
|
{ cloud, id: certificateId },
|
||||||
|
);
|
||||||
|
return res.data;
|
||||||
|
}
|
||||||
|
|
||||||
|
export async function exportCertificate(
|
||||||
|
cloud: CloudProvider,
|
||||||
|
certificateId: string,
|
||||||
|
passphrase: string,
|
||||||
|
): Promise<ExportedCertificate> {
|
||||||
|
const res = await apiClient.call<ExportedCertificate, { passphrase: string }>(
|
||||||
|
apiEndpointKeys.clouds.certificates.export,
|
||||||
|
requestOptions(cloud, "certificates", { body: { passphrase } }),
|
||||||
|
{ cloud, id: certificateId },
|
||||||
|
);
|
||||||
|
return res.data;
|
||||||
|
}
|
||||||
|
|
||||||
|
export async function revokeCertificate(
|
||||||
|
cloud: CloudProvider,
|
||||||
|
certificateId: string,
|
||||||
|
reason: CertificateRevocationReason,
|
||||||
|
): Promise<CloudResource> {
|
||||||
|
const res = await apiClient.call<CloudResource, { reason: CertificateRevocationReason }>(
|
||||||
|
apiEndpointKeys.clouds.certificates.revoke,
|
||||||
|
requestOptions(cloud, "certificates", { body: { reason } }),
|
||||||
|
{ cloud, id: certificateId },
|
||||||
|
);
|
||||||
|
return res.data;
|
||||||
|
}
|
||||||
|
|
||||||
export async function setDistributionEnabled(
|
export async function setDistributionEnabled(
|
||||||
cloud: CloudProvider,
|
cloud: CloudProvider,
|
||||||
distributionId: string,
|
distributionId: string,
|
||||||
|
|||||||
@@ -0,0 +1,88 @@
|
|||||||
|
import {QueryClient, QueryClientProvider} from '@tanstack/react-query'
|
||||||
|
import {render, screen, within} from '@testing-library/react'
|
||||||
|
import userEvent from '@testing-library/user-event'
|
||||||
|
import {beforeEach, expect, test, vi} from 'vitest'
|
||||||
|
import {CertificatePanel} from './CertificatePanel'
|
||||||
|
import type {CloudResource} from '@/types/resource'
|
||||||
|
|
||||||
|
const api = vi.hoisted(() => ({
|
||||||
|
getCloudResource: vi.fn(),
|
||||||
|
getCertificatePem: vi.fn(),
|
||||||
|
exportCertificate: vi.fn(),
|
||||||
|
revokeCertificate: vi.fn(),
|
||||||
|
}))
|
||||||
|
|
||||||
|
vi.mock('@/api/cloudProxyClient', () => api)
|
||||||
|
vi.mock('@/lib/accountStore', () => ({useAccountId: () => '000000000000'}))
|
||||||
|
|
||||||
|
const ID = '5ed9dc37-d9fb-456e-911e-e87f091480ba'
|
||||||
|
function certificate(metadata: Record<string, unknown> = {}, status = 'ISSUED'): CloudResource {
|
||||||
|
return {
|
||||||
|
id: ID, name: 'notes.thecloud.localhost', cloud: 'aws', service: 'certificates', type: 'certificate',
|
||||||
|
region: 'us-east-1', createdAt: null, status,
|
||||||
|
metadata: {
|
||||||
|
certificateType: 'Amazon issued', exportable: false, inUseBy: [],
|
||||||
|
domainValidations: [{domainName: 'notes.thecloud.localhost', status: 'SUCCESS', method: 'DNS', record: {name: '_a1.notes.thecloud.localhost.', type: 'CNAME', value: '_e8.acm-validations.aws.'}}],
|
||||||
|
...metadata,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function renderPanel(resource: CloudResource) {
|
||||||
|
api.getCloudResource.mockResolvedValue(resource)
|
||||||
|
const client = new QueryClient({defaultOptions: {queries: {retry: false}}})
|
||||||
|
return render(<QueryClientProvider client={client}><CertificatePanel resource={resource} runtimeReachable/></QueryClientProvider>)
|
||||||
|
}
|
||||||
|
|
||||||
|
beforeEach(() => {
|
||||||
|
vi.clearAllMocks()
|
||||||
|
api.getCertificatePem.mockResolvedValue({certificate: '-----BEGIN CERTIFICATE-----\nLEAF', certificateChain: '-----BEGIN CERTIFICATE-----\nCA'})
|
||||||
|
api.exportCertificate.mockResolvedValue({certificate: 'LEAF', certificateChain: null, privateKey: '-----BEGIN ENCRYPTED PRIVATE KEY-----'})
|
||||||
|
api.revokeCertificate.mockResolvedValue(certificate({exportable: true}, 'REVOKED'))
|
||||||
|
})
|
||||||
|
|
||||||
|
test('shows the validation records and that nothing uses the certificate', async () => {
|
||||||
|
renderPanel(certificate())
|
||||||
|
|
||||||
|
expect(await screen.findByText('_a1.notes.thecloud.localhost.')).toBeInTheDocument()
|
||||||
|
expect(screen.getByText('_e8.acm-validations.aws.')).toBeInTheDocument()
|
||||||
|
expect(screen.getByText(/Nothing uses this certificate/)).toBeInTheDocument()
|
||||||
|
// Export and revoke exist only for certificates requested as exportable, as on AWS.
|
||||||
|
expect(screen.queryByRole('form', {name: 'Export certificate'})).not.toBeInTheDocument()
|
||||||
|
expect(screen.queryByRole('form', {name: 'Revoke certificate'})).not.toBeInTheDocument()
|
||||||
|
})
|
||||||
|
|
||||||
|
test('lists what uses the certificate, since ACM will not delete it then', async () => {
|
||||||
|
renderPanel(certificate({inUseBy: ['arn:aws:elasticloadbalancing:us-east-1:000000000000:loadbalancer/app/web/1']}))
|
||||||
|
|
||||||
|
expect(await screen.findByText('arn:aws:elasticloadbalancing:us-east-1:000000000000:loadbalancer/app/web/1')).toBeInTheDocument()
|
||||||
|
expect(screen.getByText(/will not delete the certificate/)).toBeInTheDocument()
|
||||||
|
})
|
||||||
|
|
||||||
|
test('gets the certificate and chain as downloadable PEM files', async () => {
|
||||||
|
const user = userEvent.setup()
|
||||||
|
renderPanel(certificate())
|
||||||
|
|
||||||
|
await user.click(await screen.findByRole('button', {name: 'Get certificate'}))
|
||||||
|
expect(await screen.findByRole('textbox', {name: 'Certificate'})).toHaveValue('-----BEGIN CERTIFICATE-----\nLEAF')
|
||||||
|
expect(screen.getByRole('textbox', {name: 'Certificate chain'})).toHaveValue('-----BEGIN CERTIFICATE-----\nCA')
|
||||||
|
expect(screen.getByRole('link', {name: /notes.thecloud.localhost.pem/})).toHaveAttribute('download', 'notes.thecloud.localhost.pem')
|
||||||
|
})
|
||||||
|
|
||||||
|
test('exports an exportable certificate with the passphrase, then revokes it', async () => {
|
||||||
|
const user = userEvent.setup()
|
||||||
|
vi.spyOn(window, 'confirm').mockReturnValue(true)
|
||||||
|
renderPanel(certificate({exportable: true}))
|
||||||
|
|
||||||
|
const exportForm = await screen.findByRole('form', {name: 'Export certificate'})
|
||||||
|
await user.type(within(exportForm).getByLabelText(/Passphrase/), 'open-sesame')
|
||||||
|
await user.click(within(exportForm).getByRole('button', {name: 'Export'}))
|
||||||
|
expect(api.exportCertificate).toHaveBeenCalledWith('aws', ID, 'open-sesame')
|
||||||
|
expect(await screen.findByRole('textbox', {name: 'Private key (encrypted)'})).toHaveValue('-----BEGIN ENCRYPTED PRIVATE KEY-----')
|
||||||
|
|
||||||
|
const revokeForm = screen.getByRole('form', {name: 'Revoke certificate'})
|
||||||
|
await user.selectOptions(within(revokeForm).getByLabelText('Reason'), 'SUPERSEDED')
|
||||||
|
await user.click(within(revokeForm).getByRole('button', {name: 'Revoke'}))
|
||||||
|
expect(api.revokeCertificate).toHaveBeenCalledWith('aws', ID, 'SUPERSEDED')
|
||||||
|
expect(await screen.findByText(/Certificate revoked/)).toBeInTheDocument()
|
||||||
|
})
|
||||||
@@ -0,0 +1,166 @@
|
|||||||
|
import {Download, RefreshCw} from 'lucide-react'
|
||||||
|
import {useMutation, useQuery, useQueryClient} from '@tanstack/react-query'
|
||||||
|
import {useEffect, useState} from 'react'
|
||||||
|
import {exportCertificate, getCertificatePem, getCloudResource, revokeCertificate} from '@/api/cloudProxyClient'
|
||||||
|
import {CopyValueButton} from '@/components/CopyValueButton'
|
||||||
|
import {useAccountId} from '@/lib/accountStore'
|
||||||
|
import {formatDateTime} from '@/lib/format'
|
||||||
|
import type {CertificatePem, CertificateRevocationReason, CloudResource, ExportedCertificate} from '@/types/resource'
|
||||||
|
|
||||||
|
type Props = {
|
||||||
|
resource?: CloudResource
|
||||||
|
runtimeReachable: boolean
|
||||||
|
}
|
||||||
|
|
||||||
|
type DomainValidation = {domainName: string; status: string | null; method: string | null; record: {name: string; type: string; value: string} | null}
|
||||||
|
|
||||||
|
const REVOCATION_REASONS: Array<{value: CertificateRevocationReason; label: string}> = [
|
||||||
|
{value: 'UNSPECIFIED', label: 'Unspecified'},
|
||||||
|
{value: 'KEY_COMPROMISE', label: 'Key compromise'},
|
||||||
|
{value: 'SUPERSEDED', label: 'Superseded'},
|
||||||
|
{value: 'AFFILIATION_CHANGED', label: 'Affiliation changed'},
|
||||||
|
{value: 'CESSATION_OF_OPERATION', label: 'Cessation of operation'},
|
||||||
|
{value: 'PRIVILEGE_WITHDRAWN', label: 'Privilege withdrawn'},
|
||||||
|
{value: 'CA_COMPROMISE', label: 'CA compromise'},
|
||||||
|
]
|
||||||
|
|
||||||
|
export function CertificatePanel({resource, runtimeReachable}: Props) {
|
||||||
|
const accountId = useAccountId()
|
||||||
|
const queryClient = useQueryClient()
|
||||||
|
const [passphrase, setPassphrase] = useState('')
|
||||||
|
const [reason, setReason] = useState<CertificateRevocationReason>('UNSPECIFIED')
|
||||||
|
const [pem, setPem] = useState<CertificatePem | ExportedCertificate | null>(null)
|
||||||
|
const [notice, setNotice] = useState('')
|
||||||
|
const certificateKey = ['acm-certificate', accountId, resource?.id]
|
||||||
|
|
||||||
|
// The table row is a ListCertificates summary; validation records and users come from DescribeCertificate.
|
||||||
|
const certificateQuery = useQuery({
|
||||||
|
queryKey: certificateKey,
|
||||||
|
queryFn: ({signal}) => getCloudResource('aws', 'certificates', resource?.id ?? '', signal),
|
||||||
|
enabled: Boolean(resource) && runtimeReachable,
|
||||||
|
})
|
||||||
|
|
||||||
|
useEffect(() => {
|
||||||
|
setPassphrase('')
|
||||||
|
setReason('UNSPECIFIED')
|
||||||
|
setPem(null)
|
||||||
|
setNotice('')
|
||||||
|
}, [resource?.id])
|
||||||
|
|
||||||
|
const refresh = () => Promise.all([
|
||||||
|
queryClient.invalidateQueries({queryKey: certificateKey}),
|
||||||
|
queryClient.invalidateQueries({queryKey: ['cloud-resources', 'aws', 'certificates']}),
|
||||||
|
])
|
||||||
|
|
||||||
|
const pemMutation = useMutation({
|
||||||
|
mutationFn: () => getCertificatePem('aws', resource?.id ?? ''),
|
||||||
|
onSuccess: setPem,
|
||||||
|
})
|
||||||
|
const exportMutation = useMutation({
|
||||||
|
mutationFn: () => exportCertificate('aws', resource?.id ?? '', passphrase),
|
||||||
|
onSuccess: (exported) => {
|
||||||
|
setPem(exported)
|
||||||
|
setPassphrase('')
|
||||||
|
setNotice('Exported. The private key is encrypted with your passphrase.')
|
||||||
|
},
|
||||||
|
})
|
||||||
|
const revokeMutation = useMutation({
|
||||||
|
mutationFn: () => revokeCertificate('aws', resource?.id ?? '', reason),
|
||||||
|
onSuccess: () => {
|
||||||
|
setNotice('Certificate revoked. It can no longer be renewed or exported.')
|
||||||
|
return refresh()
|
||||||
|
},
|
||||||
|
})
|
||||||
|
|
||||||
|
if (!resource) {
|
||||||
|
return <section className="table-panel"><div className="empty compact"><h3>Select a certificate</h3><p>Choose a certificate to see its validation records, where it is used, and to download or export it.</p></div></section>
|
||||||
|
}
|
||||||
|
|
||||||
|
const certificate = certificateQuery.data ?? resource
|
||||||
|
const metadata = certificate.metadata
|
||||||
|
const validations = list<DomainValidation>(metadata.domainValidations)
|
||||||
|
const inUseBy = list<string>(metadata.inUseBy)
|
||||||
|
const exportable = metadata.exportable === true
|
||||||
|
const issued = certificate.status === 'ISSUED'
|
||||||
|
const pending = pemMutation.isPending || exportMutation.isPending || revokeMutation.isPending
|
||||||
|
const disabled = !runtimeReachable || pending
|
||||||
|
const error = certificateQuery.error ?? pemMutation.error ?? exportMutation.error ?? revokeMutation.error
|
||||||
|
const fileStem = certificate.name.replace(/^\*\./, 'wildcard.').replace(/[^a-z0-9.-]/gi, '_')
|
||||||
|
|
||||||
|
return <section className="table-panel" style={{marginTop: 16}} aria-label={`Certificate ${certificate.name}`}>
|
||||||
|
<div className="input-row resource-table-bar">
|
||||||
|
<div><p className="eyebrow">Certificate</p><span className="muted">{certificate.status ?? 'Unknown'} · {String(metadata.certificateType ?? '')}{exportable ? ' · exportable' : ''}{metadata.notAfter ? ` · expires ${formatDateTime(String(metadata.notAfter))}` : ''}</span></div>
|
||||||
|
<div className="cdn-actions">
|
||||||
|
<button className="button" type="button" disabled={disabled} onClick={() => { setNotice(''); pemMutation.mutate() }}><Download size={14}/>{pemMutation.isPending ? 'Loading' : 'Get certificate'}</button>
|
||||||
|
<button className="button" type="button" disabled={!runtimeReachable || certificateQuery.isFetching} onClick={() => { void refresh() }}><RefreshCw size={14}/>{certificateQuery.isFetching ? 'Loading' : 'Refresh'}</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
{validations.length > 0 && <>
|
||||||
|
<div className="input-row resource-table-bar"><div><p className="eyebrow">Domains</p><span className="muted">On AWS, each name is validated by the CNAME record below before the certificate is issued. TheCloud issues it straight away.</span></div></div>
|
||||||
|
<div className="cognito-table"><table className="table"><thead><tr><th>Domain</th><th>Validation</th><th>CNAME name</th><th>CNAME value</th></tr></thead><tbody>{validations.map((validation) => (
|
||||||
|
<tr key={validation.domainName}>
|
||||||
|
<td className="mono">{validation.domainName}</td>
|
||||||
|
<td><code>{validation.status ?? '—'}</code>{validation.method ? ` ${validation.method}` : ''}</td>
|
||||||
|
<td className="mono dns-values">{validation.record ? <span className="copy-value">{validation.record.name}<CopyValueButton value={validation.record.name} label="CNAME name"/></span> : '—'}</td>
|
||||||
|
<td className="mono dns-values">{validation.record ? <span className="copy-value">{validation.record.value}<CopyValueButton value={validation.record.value} label="CNAME value"/></span> : '—'}</td>
|
||||||
|
</tr>
|
||||||
|
))}</tbody></table></div>
|
||||||
|
</>}
|
||||||
|
|
||||||
|
<div className="input-row resource-table-bar"><div><p className="eyebrow">In use by</p><span className="muted">{inUseBy.length > 0 ? 'ACM will not delete the certificate until these stop using it.' : 'Nothing uses this certificate, so it can be deleted.'}</span></div></div>
|
||||||
|
{inUseBy.length > 0 && <ul className="certificate-users">{inUseBy.map((arn) => <li key={arn} className="mono">{arn}</li>)}</ul>}
|
||||||
|
|
||||||
|
{exportable && issued && <>
|
||||||
|
<div className="input-row resource-table-bar"><div><p className="eyebrow">Export</p><span className="muted">Download the certificate with its private key, encrypted with a passphrase, to use on a server outside AWS.</span></div></div>
|
||||||
|
<form className="dynamic-form" aria-label="Export certificate" onSubmit={(event) => { event.preventDefault(); setNotice(''); exportMutation.mutate() }}>
|
||||||
|
<label className="dynamic-field"><span>Passphrase</span>
|
||||||
|
<input className="input" type="password" autoComplete="new-password" value={passphrase} onChange={(event) => setPassphrase(event.target.value)} disabled={disabled} minLength={4} maxLength={128} required/>
|
||||||
|
<small className="muted">4 to 128 characters, without #, $ or %. You need it to decrypt the key.</small>
|
||||||
|
</label>
|
||||||
|
<div><button className="button primary" type="submit" disabled={disabled || passphrase.length < 4}>{exportMutation.isPending ? 'Exporting' : 'Export'}</button></div>
|
||||||
|
</form>
|
||||||
|
</>}
|
||||||
|
|
||||||
|
{exportable && certificate.status !== 'REVOKED' && <>
|
||||||
|
<div className="input-row resource-table-bar"><div><p className="eyebrow">Revoke</p><span className="muted">Revoking cannot be undone. Use it if the private key leaked or the certificate is no longer needed.</span></div></div>
|
||||||
|
<form className="dynamic-form" aria-label="Revoke certificate" onSubmit={(event) => {
|
||||||
|
event.preventDefault()
|
||||||
|
setNotice('')
|
||||||
|
if (window.confirm(`Revoke the certificate for ${certificate.name}? This cannot be undone.`)) revokeMutation.mutate()
|
||||||
|
}}>
|
||||||
|
<label className="dynamic-field"><span>Reason</span>
|
||||||
|
<select className="input" value={reason} onChange={(event) => setReason(event.target.value as CertificateRevocationReason)} disabled={disabled}>
|
||||||
|
{REVOCATION_REASONS.map((option) => <option key={option.value} value={option.value}>{option.label}</option>)}
|
||||||
|
</select>
|
||||||
|
</label>
|
||||||
|
<div><button className="button danger" type="submit" disabled={disabled}>{revokeMutation.isPending ? 'Revoking' : 'Revoke'}</button></div>
|
||||||
|
</form>
|
||||||
|
</>}
|
||||||
|
|
||||||
|
{pem && <div className="certificate-pem">
|
||||||
|
<PemBlock label="Certificate" value={pem.certificate} file={`${fileStem}.pem`}/>
|
||||||
|
{pem.certificateChain && <PemBlock label="Certificate chain" value={pem.certificateChain} file={`${fileStem}-chain.pem`}/>}
|
||||||
|
{'privateKey' in pem && <PemBlock label="Private key (encrypted)" value={pem.privateKey} file={`${fileStem}-key.pem`}/>}
|
||||||
|
</div>}
|
||||||
|
|
||||||
|
{notice && <p className="cognito-outcome cognito-outcome--ok" role="status">{notice}</p>}
|
||||||
|
{error instanceof Error && <p className="error-text compact-text" role="alert">{error.message}</p>}
|
||||||
|
</section>
|
||||||
|
}
|
||||||
|
|
||||||
|
function PemBlock({label, value, file}: {label: string; value: string; file: string}) {
|
||||||
|
const href = `data:application/x-pem-file;charset=utf-8,${encodeURIComponent(value)}`
|
||||||
|
return <div className="certificate-pem-block">
|
||||||
|
<div className="certificate-pem-head">
|
||||||
|
<strong>{label}</strong>
|
||||||
|
<CopyValueButton value={value} label={label}/>
|
||||||
|
<a className="button" href={href} download={file}><Download size={13}/> {file}</a>
|
||||||
|
</div>
|
||||||
|
<textarea className="textarea code-textarea small" rows={6} value={value} readOnly aria-label={label}/>
|
||||||
|
</div>
|
||||||
|
}
|
||||||
|
|
||||||
|
function list<T>(value: unknown): T[] {
|
||||||
|
return Array.isArray(value) ? value as T[] : []
|
||||||
|
}
|
||||||
@@ -68,6 +68,7 @@ import { LoadBalancerListenerPanel } from "@/components/LoadBalancerListenerPane
|
|||||||
import { CognitoUsersPanel } from "@/components/CognitoUsersPanel";
|
import { CognitoUsersPanel } from "@/components/CognitoUsersPanel";
|
||||||
import { Route53RecordsPanel } from "@/components/Route53RecordsPanel";
|
import { Route53RecordsPanel } from "@/components/Route53RecordsPanel";
|
||||||
import { CloudFrontPanel } from "@/components/CloudFrontPanel";
|
import { CloudFrontPanel } from "@/components/CloudFrontPanel";
|
||||||
|
import { CertificatePanel } from "@/components/CertificatePanel";
|
||||||
import { CloudWatchAlarmPanel } from "@/components/CloudWatchAlarmPanel";
|
import { CloudWatchAlarmPanel } from "@/components/CloudWatchAlarmPanel";
|
||||||
import { CloudWatchMetricsExplorer } from "@/components/CloudWatchMetricsExplorer";
|
import { CloudWatchMetricsExplorer } from "@/components/CloudWatchMetricsExplorer";
|
||||||
import { WorkflowExecutionDebugger } from "@/components/WorkflowExecutionDebugger";
|
import { WorkflowExecutionDebugger } from "@/components/WorkflowExecutionDebugger";
|
||||||
@@ -987,6 +988,9 @@ export function DynamicResourceView({
|
|||||||
{service === "dns" && cloud === "aws" && (
|
{service === "dns" && cloud === "aws" && (
|
||||||
<Route53RecordsPanel resource={activeSelected} runtimeReachable={canUseRuntime} />
|
<Route53RecordsPanel resource={activeSelected} runtimeReachable={canUseRuntime} />
|
||||||
)}
|
)}
|
||||||
|
{service === "certificates" && cloud === "aws" && (
|
||||||
|
<CertificatePanel resource={activeSelected} runtimeReachable={canUseRuntime} />
|
||||||
|
)}
|
||||||
{service === "cdn" && cloud === "aws" && (
|
{service === "cdn" && cloud === "aws" && (
|
||||||
<CloudFrontPanel resource={activeSelected} runtimeReachable={canUseRuntime} />
|
<CloudFrontPanel resource={activeSelected} runtimeReachable={canUseRuntime} />
|
||||||
)}
|
)}
|
||||||
|
|||||||
@@ -6,6 +6,7 @@ import {
|
|||||||
Container,
|
Container,
|
||||||
Database,
|
Database,
|
||||||
Earth,
|
Earth,
|
||||||
|
FileBadge,
|
||||||
Globe,
|
Globe,
|
||||||
HardDrive,
|
HardDrive,
|
||||||
Hammer,
|
Hammer,
|
||||||
@@ -36,6 +37,7 @@ import codeDeployIcon from '../../../../aws-icons-svg/Developer-Tools/CodeDeploy
|
|||||||
import cognitoIcon from '../../../../aws-icons-svg/Security-Identity-Compliance/Cognito.svg'
|
import cognitoIcon from '../../../../aws-icons-svg/Security-Identity-Compliance/Cognito.svg'
|
||||||
import route53Icon from '../../../../aws-icons-svg/Networking-Content-Delivery/Route-53.svg'
|
import route53Icon from '../../../../aws-icons-svg/Networking-Content-Delivery/Route-53.svg'
|
||||||
import cloudFrontIcon from '../../../../aws-icons-svg/Networking-Content-Delivery/CloudFront.svg'
|
import cloudFrontIcon from '../../../../aws-icons-svg/Networking-Content-Delivery/CloudFront.svg'
|
||||||
|
import certificateManagerIcon from '../../../../aws-icons-svg/Security-Identity-Compliance/Certificate-Manager.svg'
|
||||||
import cloudWatchIcon from '../../../../aws-icons-svg/Management-Governance/CloudWatch.svg'
|
import cloudWatchIcon from '../../../../aws-icons-svg/Management-Governance/CloudWatch.svg'
|
||||||
import cloudFormationIcon from '@/assets/aws-services/cloudformation.svg'
|
import cloudFormationIcon from '@/assets/aws-services/cloudformation.svg'
|
||||||
import cloudWatchLogsIcon from '@/assets/aws-services/cloudwatch-logs.svg'
|
import cloudWatchLogsIcon from '@/assets/aws-services/cloudwatch-logs.svg'
|
||||||
@@ -95,6 +97,7 @@ const SERVICE_ICONS: Record<string, LucideIcon> = {
|
|||||||
userpools: UsersRound,
|
userpools: UsersRound,
|
||||||
dns: Globe,
|
dns: Globe,
|
||||||
cdn: Earth,
|
cdn: Earth,
|
||||||
|
certificates: FileBadge,
|
||||||
monitoring: Activity,
|
monitoring: Activity,
|
||||||
loadbalancing: Scale,
|
loadbalancing: Scale,
|
||||||
parameters: SlidersHorizontal,
|
parameters: SlidersHorizontal,
|
||||||
@@ -142,6 +145,7 @@ const AWS_SERVICE_ICON_ASSETS: Record<string, string> = {
|
|||||||
userpools: cognitoIcon,
|
userpools: cognitoIcon,
|
||||||
dns: route53Icon,
|
dns: route53Icon,
|
||||||
cdn: cloudFrontIcon,
|
cdn: cloudFrontIcon,
|
||||||
|
certificates: certificateManagerIcon,
|
||||||
monitoring: cloudWatchIcon,
|
monitoring: cloudWatchIcon,
|
||||||
workflows: stepFunctionsIcon,
|
workflows: stepFunctionsIcon,
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -6610,3 +6610,9 @@ tr[aria-current="true"] td { background: var(--hover-md); }
|
|||||||
.metric-chart-table { margin-top: 8px; }
|
.metric-chart-table { margin-top: 8px; }
|
||||||
.metric-chart-table summary { cursor: pointer; color: var(--text-3); font-size: 12px; }
|
.metric-chart-table summary { cursor: pointer; color: var(--text-3); font-size: 12px; }
|
||||||
.metric-chart-table table { margin-top: 8px; }
|
.metric-chart-table table { margin-top: 8px; }
|
||||||
|
|
||||||
|
/* ACM: the resources using a certificate, and its PEM blocks. */
|
||||||
|
.certificate-users { margin: 0; padding: 0 16px 12px 32px; display: grid; gap: 4px; overflow-wrap: anywhere; }
|
||||||
|
.certificate-pem { display: grid; gap: 12px; padding: 0 16px 16px; }
|
||||||
|
.certificate-pem-block { display: grid; gap: 6px; min-width: 0; }
|
||||||
|
.certificate-pem-head { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; }
|
||||||
|
|||||||
@@ -337,6 +337,25 @@ export interface AlarmHistoryItem {
|
|||||||
summary: string
|
summary: string
|
||||||
}
|
}
|
||||||
|
|
||||||
|
export interface CertificatePem {
|
||||||
|
certificate: string
|
||||||
|
certificateChain: string | null
|
||||||
|
}
|
||||||
|
|
||||||
|
/** The private key is PEM, encrypted with the passphrase given to export. */
|
||||||
|
export interface ExportedCertificate extends CertificatePem {
|
||||||
|
privateKey: string
|
||||||
|
}
|
||||||
|
|
||||||
|
export type CertificateRevocationReason =
|
||||||
|
| 'UNSPECIFIED'
|
||||||
|
| 'KEY_COMPROMISE'
|
||||||
|
| 'CA_COMPROMISE'
|
||||||
|
| 'AFFILIATION_CHANGED'
|
||||||
|
| 'SUPERSEDED'
|
||||||
|
| 'CESSATION_OF_OPERATION'
|
||||||
|
| 'PRIVILEGE_WITHDRAWN'
|
||||||
|
|
||||||
export interface DistributionInvalidation {
|
export interface DistributionInvalidation {
|
||||||
id: string
|
id: string
|
||||||
status: string
|
status: string
|
||||||
|
|||||||
@@ -28,6 +28,7 @@ export type KubernetesActionName =
|
|||||||
| 'deleteFargateProfile'
|
| 'deleteFargateProfile'
|
||||||
export type ItemActionName = 'list' | 'get' | 'put' | 'delete' | 'query'
|
export type ItemActionName = 'list' | 'get' | 'put' | 'delete' | 'query'
|
||||||
export type DistributionActionName = 'setEnabled' | 'createInvalidation'
|
export type DistributionActionName = 'setEnabled' | 'createInvalidation'
|
||||||
|
export type CertificateActionName = 'download' | 'export' | 'revoke'
|
||||||
export type MonitoringActionName = 'listMetrics' | 'getMetricData' | 'alarmHistory' | 'setAlarmState' | 'setAlarmActions'
|
export type MonitoringActionName = 'listMetrics' | 'getMetricData' | 'alarmHistory' | 'setAlarmState' | 'setAlarmActions'
|
||||||
export type UserPoolActionName = 'updateUser' | 'setUserGroups' | 'listGroups' | 'createGroup' | 'deleteGroup' | 'testSignIn' | 'describeClient' | 'updateClientOAuth'
|
export type UserPoolActionName = 'updateUser' | 'setUserGroups' | 'listGroups' | 'createGroup' | 'deleteGroup' | 'testSignIn' | 'describeClient' | 'updateClientOAuth'
|
||||||
export type CapabilityStatus = 'available' | 'blocked' | 'partial' | 'coming_soon'
|
export type CapabilityStatus = 'available' | 'blocked' | 'partial' | 'coming_soon'
|
||||||
@@ -91,6 +92,7 @@ export interface ServiceSchema {
|
|||||||
itemActions?: Array<CapabilitySchema<ItemActionName> | ItemActionName>
|
itemActions?: Array<CapabilitySchema<ItemActionName> | ItemActionName>
|
||||||
userPoolActions?: Array<CapabilitySchema<UserPoolActionName>>
|
userPoolActions?: Array<CapabilitySchema<UserPoolActionName>>
|
||||||
distributionActions?: Array<CapabilitySchema<DistributionActionName>>
|
distributionActions?: Array<CapabilitySchema<DistributionActionName>>
|
||||||
|
certificateActions?: Array<CapabilitySchema<CertificateActionName>>
|
||||||
monitoringActions?: Array<CapabilitySchema<MonitoringActionName>>
|
monitoringActions?: Array<CapabilitySchema<MonitoringActionName>>
|
||||||
}
|
}
|
||||||
filters: FieldSchema[]
|
filters: FieldSchema[]
|
||||||
|
|||||||
Generated
+18
@@ -10,6 +10,9 @@ importers:
|
|||||||
|
|
||||||
packages/api:
|
packages/api:
|
||||||
dependencies:
|
dependencies:
|
||||||
|
'@aws-sdk/client-acm':
|
||||||
|
specifier: ^3.1146.0
|
||||||
|
version: 3.1156.0
|
||||||
'@aws-sdk/client-api-gateway':
|
'@aws-sdk/client-api-gateway':
|
||||||
specifier: ^3.1076.0
|
specifier: ^3.1076.0
|
||||||
version: 3.1096.0
|
version: 3.1096.0
|
||||||
@@ -298,6 +301,10 @@ packages:
|
|||||||
resolution: {integrity: sha512-USI1N1d+NbCcfjeiYLKIl94PSYykl5IIjj4X3WqdL33Ln5qktA6sjXYct0o/gG2Cte7cuzbXKkDBkzUA4VPHrg==}
|
resolution: {integrity: sha512-USI1N1d+NbCcfjeiYLKIl94PSYykl5IIjj4X3WqdL33Ln5qktA6sjXYct0o/gG2Cte7cuzbXKkDBkzUA4VPHrg==}
|
||||||
engines: {node: '>=20.0.0'}
|
engines: {node: '>=20.0.0'}
|
||||||
|
|
||||||
|
'@aws-sdk/client-acm@3.1156.0':
|
||||||
|
resolution: {integrity: sha512-vRy8mVgYOO1E/YXDlBuXCUKsmNKkVjKFIW2ZS30kWZydbS6CnqFxNkMajDzqJcm+PZ74rwgnhNHsJkc+UIEMzQ==}
|
||||||
|
engines: {node: '>=20.0.0'}
|
||||||
|
|
||||||
'@aws-sdk/client-api-gateway@3.1096.0':
|
'@aws-sdk/client-api-gateway@3.1096.0':
|
||||||
resolution: {integrity: sha512-RPzDojG3/YTdOMWGQ9mhE51db0IxL8YSjN9fKe5UawwgGrLa915ik71SMYk4z7hywkANuPTqRtt/kNJ863/j0g==}
|
resolution: {integrity: sha512-RPzDojG3/YTdOMWGQ9mhE51db0IxL8YSjN9fKe5UawwgGrLa915ik71SMYk4z7hywkANuPTqRtt/kNJ863/j0g==}
|
||||||
engines: {node: '>=20.0.0'}
|
engines: {node: '>=20.0.0'}
|
||||||
@@ -2896,6 +2903,17 @@ snapshots:
|
|||||||
'@smithy/types': 4.19.0
|
'@smithy/types': 4.19.0
|
||||||
tslib: 2.8.1
|
tslib: 2.8.1
|
||||||
|
|
||||||
|
'@aws-sdk/client-acm@3.1156.0':
|
||||||
|
dependencies:
|
||||||
|
'@aws-sdk/core': 3.978.5
|
||||||
|
'@aws-sdk/credential-provider-node': 3.972.88
|
||||||
|
'@aws-sdk/types': 3.975.0
|
||||||
|
'@smithy/core': 3.36.2
|
||||||
|
'@smithy/fetch-http-handler': 5.8.0
|
||||||
|
'@smithy/node-http-handler': 4.12.1
|
||||||
|
'@smithy/types': 4.19.0
|
||||||
|
tslib: 2.8.1
|
||||||
|
|
||||||
'@aws-sdk/client-api-gateway@3.1096.0':
|
'@aws-sdk/client-api-gateway@3.1096.0':
|
||||||
dependencies:
|
dependencies:
|
||||||
'@aws-sdk/core': 3.977.1
|
'@aws-sdk/core': 3.977.1
|
||||||
|
|||||||
Reference in New Issue
Block a user