| | | 1 | | namespace Envilder.Infrastructure; |
| | | 2 | | |
| | | 3 | | using Amazon; |
| | | 4 | | using Amazon.Runtime.CredentialManagement; |
| | | 5 | | using Amazon.SimpleSystemsManagement; |
| | | 6 | | using global::Azure.Identity; |
| | | 7 | | using global::Azure.Security.KeyVault.Secrets; |
| | | 8 | | using global::Envilder.Domain.Ports; |
| | | 9 | | using global::Envilder.Infrastructure.Aws; |
| | | 10 | | using global::Envilder.Infrastructure.Azure; |
| | | 11 | | using System; |
| | | 12 | | |
| | | 13 | | /// <summary> |
| | | 14 | | /// Creates the appropriate <see cref="ISecretProvider"/> implementation |
| | | 15 | | /// based on the map file configuration and optional runtime overrides. |
| | | 16 | | /// </summary> |
| | | 17 | | internal static class SecretProviderFactory |
| | | 18 | | { |
| | 1 | 19 | | private static readonly RegionEndpoint FallbackRegion = RegionEndpoint.USEast1; |
| | | 20 | | |
| | | 21 | | /// <summary> |
| | | 22 | | /// Creates an <see cref="ISecretProvider"/> for the provider specified in |
| | | 23 | | /// <paramref name="config"/>. When <paramref name="options"/> is provided, |
| | | 24 | | /// its values take precedence over <paramref name="config"/>. |
| | | 25 | | /// </summary> |
| | | 26 | | /// <param name="config">Configuration from the <c>$config</c> section of a map file.</param> |
| | | 27 | | /// <param name="options">Optional runtime overrides (e.g. CLI flags).</param> |
| | | 28 | | /// <returns>A ready-to-use secret provider.</returns> |
| | | 29 | | /// <exception cref="InvalidOperationException"> |
| | | 30 | | /// Thrown when Azure is selected but no Vault URL is provided. |
| | | 31 | | /// </exception> |
| | | 32 | | public static ISecretProvider Create(MapFileConfig config, EnvilderOptions? options = null) |
| | | 33 | | { |
| | 1 | 34 | | if (config is null) |
| | | 35 | | { |
| | 1 | 36 | | throw new ArgumentNullException(nameof(config)); |
| | | 37 | | } |
| | | 38 | | |
| | 1 | 39 | | var provider = options?.Provider ?? config.Provider; |
| | 1 | 40 | | var profile = options?.Profile ?? config.Profile; |
| | 1 | 41 | | var vaultUrl = options?.VaultUrl ?? config.VaultUrl; |
| | | 42 | | |
| | 1 | 43 | | ValidateCrossProviderConfig(provider, profile, vaultUrl); |
| | | 44 | | |
| | 1 | 45 | | return provider switch |
| | 1 | 46 | | { |
| | 1 | 47 | | SecretProviderType.Azure => CreateAzureSecretProvider(vaultUrl), |
| | 1 | 48 | | _ => CreateAwsSecretProvider(profile), |
| | 1 | 49 | | }; |
| | | 50 | | } |
| | | 51 | | |
| | | 52 | | private static void ValidateCrossProviderConfig( |
| | | 53 | | SecretProviderType? provider, |
| | | 54 | | string? profile, |
| | | 55 | | string? vaultUrl) |
| | | 56 | | { |
| | 1 | 57 | | var isAzure = provider == SecretProviderType.Azure; |
| | | 58 | | |
| | 1 | 59 | | if (isAzure && !string.IsNullOrWhiteSpace(profile)) |
| | | 60 | | { |
| | 1 | 61 | | throw new InvalidOperationException( |
| | 1 | 62 | | "AWS profile cannot be used with Azure Key Vault provider."); |
| | | 63 | | } |
| | | 64 | | |
| | 1 | 65 | | if (!isAzure && !string.IsNullOrWhiteSpace(vaultUrl)) |
| | | 66 | | { |
| | 1 | 67 | | throw new InvalidOperationException( |
| | 1 | 68 | | "Vault URL cannot be used with AWS SSM provider."); |
| | | 69 | | } |
| | 1 | 70 | | } |
| | | 71 | | |
| | | 72 | | private static AzureKeyVaultSecretProvider CreateAzureSecretProvider(string? vaultUrl) |
| | | 73 | | { |
| | 1 | 74 | | if (string.IsNullOrWhiteSpace(vaultUrl)) |
| | | 75 | | { |
| | 1 | 76 | | throw new InvalidOperationException("Vault URL must be provided for Azure Key Vault provider."); |
| | | 77 | | } |
| | | 78 | | |
| | 1 | 79 | | var secretClient = new SecretClient(new Uri(vaultUrl), new DefaultAzureCredential()); |
| | 1 | 80 | | return new(secretClient); |
| | | 81 | | } |
| | | 82 | | |
| | | 83 | | private static AwsSsmSecretProvider CreateAwsSecretProvider(string? profile) |
| | | 84 | | { |
| | 1 | 85 | | if (!string.IsNullOrWhiteSpace(profile)) |
| | | 86 | | { |
| | 1 | 87 | | var profilesLocation = Environment.GetEnvironmentVariable("AWS_SHARED_CREDENTIALS_FILE"); |
| | 1 | 88 | | var chain = new CredentialProfileStoreChain(profilesLocation); |
| | 1 | 89 | | if (chain.TryGetAWSCredentials(profile, out var credentials)) |
| | | 90 | | { |
| | 1 | 91 | | var region = ResolveProfileRegion(chain, profile!); |
| | 1 | 92 | | return new(new AmazonSimpleSystemsManagementClient(credentials, region)); |
| | | 93 | | } |
| | | 94 | | |
| | 1 | 95 | | throw new InvalidOperationException( |
| | 1 | 96 | | $"AWS profile '{profile}' was not found in the credential store."); |
| | | 97 | | } |
| | | 98 | | |
| | 1 | 99 | | return new(new AmazonSimpleSystemsManagementClient()); |
| | | 100 | | } |
| | | 101 | | |
| | | 102 | | private static RegionEndpoint ResolveProfileRegion(CredentialProfileStoreChain chain, string profile) |
| | | 103 | | { |
| | 1 | 104 | | if (chain.TryGetProfile(profile, out var credentialProfile) && credentialProfile.Region != null) |
| | | 105 | | { |
| | 0 | 106 | | return credentialProfile.Region; |
| | | 107 | | } |
| | | 108 | | |
| | 1 | 109 | | return ResolveRegion(); |
| | | 110 | | } |
| | | 111 | | |
| | | 112 | | /// <summary> |
| | | 113 | | /// Resolves the AWS region from environment variables (<c>AWS_REGION</c> or |
| | | 114 | | /// <c>AWS_DEFAULT_REGION</c>), falling back to <c>us-east-1</c> when neither is set. |
| | | 115 | | /// </summary> |
| | | 116 | | private static RegionEndpoint ResolveRegion() |
| | | 117 | | { |
| | 1 | 118 | | var regionName = Environment.GetEnvironmentVariable("AWS_REGION") |
| | 1 | 119 | | ?? Environment.GetEnvironmentVariable("AWS_DEFAULT_REGION"); |
| | | 120 | | |
| | 1 | 121 | | return string.IsNullOrWhiteSpace(regionName) |
| | 1 | 122 | | ? FallbackRegion |
| | 1 | 123 | | : RegionEndpoint.GetBySystemName(regionName); |
| | | 124 | | } |
| | | 125 | | } |