Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[#375] Allow cross-account AWS IAM role assumption into opt-in regions #376

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
+54 −11
Open

[#375] Allow cross-account AWS IAM role assumption into opt-in regions #376

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 35 additions & 8 deletions src/main/java/com/cloudbees/jenkins/plugins/amazonecs/ECSCloud.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,7 @@
private final String cluster;
private String regionName;
private String assumedRoleArn;
private String authRegion;
@CheckForNull
private String tunnel;
private String jenkinsUrl;
Expand Down Expand Up @@ -121,7 +122,7 @@

synchronized ECSService getEcsService() {
if (ecsService == null) {
ecsService = new ECSService(credentialsId, assumedRoleArn, regionName);
ecsService = new ECSService(credentialsId, assumedRoleArn, authRegion, regionName);
}
return ecsService;
}
Expand Down Expand Up @@ -164,6 +165,11 @@
return assumedRoleArn;
}


public String getAuthRegion() {
return authRegion;

Check warning on line 170 in src/main/java/com/cloudbees/jenkins/plugins/amazonecs/ECSCloud.java

View check run for this annotation

ci.jenkins.io / Code Coverage

Not covered line 

Line 170 is not covered by tests
}

@DataBoundSetter
public void setRegionName(String regionName) {
this.regionName = regionName;
Expand All @@ -173,6 +179,11 @@
public void setAssumedRoleArn(String assumedRoleArn) {
this.assumedRoleArn = assumedRoleArn;
}

@DataBoundSetter
public void setAuthRegion(String authRegion) {
this.authRegion = authRegion;
}

public String getTunnel() {
return tunnel;
Expand Down Expand Up @@ -428,12 +439,20 @@
}
}

public static Region getRegion(String regionName) {
if (StringUtils.isNotEmpty(regionName)) {
return RegionUtils.getRegion(regionName);
} else {
return Region.getRegion(Regions.US_EAST_1);
public ListBoxModel doFillAuthRegionItems() {

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing permission check Warning

Potential missing permission check in ECSCloud#doFillAuthRegionItems

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing POST/RequirePOST annotation Warning

Potential CSRF vulnerability: If ECSCloud#doFillAuthRegionItems connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST
final ListBoxModel options = new ListBoxModel();
for (Region region : RegionUtils.getRegions()) {
options.add(region.getName());
}
return options;
}

public ListBoxModel doFillRegionNameItems() {

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing permission check Warning

Potential missing permission check in ECSCloud#doFillRegionNameItems

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing POST/RequirePOST annotation Warning

Potential CSRF vulnerability: If ECSCloud#doFillRegionNameItems connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST
final ListBoxModel options = new ListBoxModel();
for (Region region : RegionUtils.getRegions()) {
options.add(region.getName());
}
return options;
}

public String getJenkinsUrl() {
Expand Down Expand Up @@ -489,7 +508,7 @@
public static final String DEFAULT_ALLOWED_OVERRIDES = "";
private static String CLOUD_NAME_PATTERN = "[a-z|A-Z|0-9|_|-]{1,127}";
private static final int DEFAULT_MAXIMUM_AGENTS = 0; //Unlimited
private static final int DEFAULT_NUM_EXECUTORS = 1;

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing permission check Warning

Potential missing permission check in DescriptorImpl#doFillClusterItems

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing POST/RequirePOST annotation Warning

Potential CSRF vulnerability: If DescriptorImpl#doFillClusterItems connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST

@Override
public String getDisplayName() {
Expand All @@ -507,9 +526,17 @@
}
return options;
}

public ListBoxModel doFillAuthRegionItems() {

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing permission check Warning

Potential missing permission check in DescriptorImpl#doFillAuthRegionItems

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing POST/RequirePOST annotation Warning

Potential CSRF vulnerability: If DescriptorImpl#doFillAuthRegionItems connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST
final ListBoxModel options = new ListBoxModel();
for (Region region : RegionUtils.getRegions()) {
options.add(region.getName());
}
return options;
}

public ListBoxModel doFillClusterItems(@QueryParameter String credentialsId, @QueryParameter String assumedRoleArn, @QueryParameter String regionName) {
ECSService ecsService = new ECSService(credentialsId, assumedRoleArn, regionName);
public ListBoxModel doFillClusterItems(@QueryParameter String credentialsId, @QueryParameter String assumedRoleArn, @QueryParameter String authRegion, @QueryParameter String regionName) {
ECSService ecsService = new ECSService(credentialsId, assumedRoleArn, authRegion, regionName);

Check warning on line 539 in src/main/java/com/cloudbees/jenkins/plugins/amazonecs/ECSCloud.java

View check run for this annotation

ci.jenkins.io / Code Coverage

Not covered lines 

Lines 443-539 are not covered by tests
try {
final AmazonECS client = ecsService.getAmazonECSClient();
final List<String> allClusterArns = new ArrayList<String>();
Expand Down
10 changes: 8 additions & 2 deletions src/main/java/com/cloudbees/jenkins/plugins/amazonecs/ECSService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@
@Nonnull
private final Supplier<AmazonECS> clientSupplier;

public ECSService(String credentialsId, String assumedRoleArn, String regionName) {
public ECSService(String credentialsId, String assumedRoleArn, String authRegion, String regionName) {
this.clientSupplier = () -> {
AmazonECSClientBuilder builder = AmazonECSClientBuilder
.standard()
Expand All @@ -94,7 +94,13 @@
.withCredentials(credentials);
}
else if (StringUtils.isNotBlank(assumedRoleArn)) {
builder.withCredentials(getCredentialsForRole(assumedRoleArn, regionName));
if (StringUtils.isNotBlank(authRegion)) {
builder.withCredentials(getCredentialsForRole(assumedRoleArn, authRegion));

Check warning on line 98 in src/main/java/com/cloudbees/jenkins/plugins/amazonecs/ECSService.java

View check run for this annotation

ci.jenkins.io / Code Coverage

Not covered lines 

Lines 97-98 are not covered by tests
}
else {
builder.withCredentials(getCredentialsForRole(assumedRoleArn, regionName));
}

}

LOGGER.log(Level.FINE, "Selected Region: {0}", regionName);
Expand Down
3 changes: 2 additions & 1 deletion src/main/java/com/cloudbees/jenkins/plugins/amazonecs/ECSTaskTemplate.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1429,10 +1429,11 @@
public ListBoxModel doFillProviderItems(
@RelativePath("../..") @QueryParameter String credentialsId,
@RelativePath("../..") @QueryParameter String assumedRoleArn,
@RelativePath("../..") @QueryParameter String authRegion,
@RelativePath("../..") @QueryParameter String regionName,
@RelativePath("../..") @QueryParameter String cluster
){
ECSService ecsService = new ECSService(credentialsId, assumedRoleArn, regionName);
ECSService ecsService = new ECSService(credentialsId, assumedRoleArn, authRegion, regionName);

Check warning on line 1436 in src/main/java/com/cloudbees/jenkins/plugins/amazonecs/ECSTaskTemplate.java

View check run for this annotation

ci.jenkins.io / Code Coverage

Not covered line 

Line 1436 is not covered by tests
final AmazonECS client = ecsService.getAmazonECSClient();
final List<Cluster> allClusters = new ArrayList<Cluster>();
DescribeClustersResult result = client.describeClusters(new DescribeClustersRequest().withClusters(cluster));
Expand Down
4 changes: 4 additions & 0 deletions src/main/resources/com/cloudbees/jenkins/plugins/amazonecs/ECSCloud/config.jelly
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,10 @@
<f:textbox />
</f:entry>

<f:entry field="authRegion" title="${%Amazon IAM Auth Region}" description="AWS regionName for credentials authentication. If not specified, use us-east-1.">
<f:select />
</f:entry>

<f:entry field="regionName" title="${%Amazon ECS Region Name}" description="AWS regionName for ECS. If not specified, use us-east-1.">
<f:select />
</f:entry>
Expand Down
5 changes: 5 additions & 0 deletions src/test/java/com/cloudbees/jenkins/plugins/amazonecs/ECSCloudTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,7 @@ public void getProvisioningCapacity_returnsRemainingMaxAgentsWhenWorkloadExceeds
ECSCloud sut = new ECSCloud("mycloud", "", "", "mycluster");
sut.setMaxAgents(14);
sut.setTemplates(templates);
sut.setAuthRegion("eu-west-1");
sut.setRegionName("eu-west-1");
sut.setNumExecutors(1);
sut.setJenkinsUrl("http://jenkins.local");
Expand All @@ -192,6 +193,7 @@ public void getProvisioningCapacity_returnsExcessWorkloadWithoutMaxAgents () {
ECSCloud sut = new ECSCloud("mycloud", "", "", "mycluster");
sut.setMaxAgents(0);
sut.setTemplates(templates);
sut.setAuthRegion("eu-west-1");
sut.setRegionName("eu-west-1");
sut.setJenkinsUrl("http://jenkins.local");
sut.setSlaveTimeoutInSeconds(5);
Expand All @@ -213,6 +215,7 @@ public void getProvisioningCapacity_returnsExcessWorkloadWhenWorkloadDoesNotExce
ECSCloud sut = new ECSCloud("mycloud", "", "", "mycluster");
sut.setMaxAgents(10);
sut.setTemplates(templates);
sut.setAuthRegion("eu-west-1");
sut.setRegionName("eu-west-1");
sut.setJenkinsUrl("http://jenkins.local");
sut.setSlaveTimeoutInSeconds(5);
Expand All @@ -234,6 +237,7 @@ public void getProvisioningCapacity_returnsZeroWhenOverflowEncountered () {
ECSCloud sut = new ECSCloud("mycloud", "", "", "mycluster");
sut.setMaxAgents(10);
sut.setTemplates(templates);
sut.setAuthRegion("eu-west-1");
sut.setRegionName("eu-west-1");
sut.setJenkinsUrl("http://jenkins.local");
sut.setSlaveTimeoutInSeconds(5);
Expand All @@ -255,6 +259,7 @@ public void getProvisioningCapacity_returnsZeroWhenCurrentAgentsGreaterThanMaxAg
ECSCloud sut = new ECSCloud("mycloud", "", "", "mycluster");
sut.setMaxAgents(1);
sut.setTemplates(templates);
sut.setAuthRegion("eu-west-1");
sut.setRegionName("eu-west-1");
sut.setJenkinsUrl("http://jenkins.local");
sut.setSlaveTimeoutInSeconds(5);
Expand Down
Loading