Skip to content

[#375] Allow cross-account AWS IAM role assumption into opt-in regions #376

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
choopka wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[#375] Allow cross-account AWS IAM role assumption into opt-in regions #376

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 35 additions & 8 deletions src/main/java/com/cloudbees/jenkins/plugins/amazonecs/ECSCloud.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,7 @@ public class ECSCloud extends Cloud {
private final String cluster;
private String regionName;
private String assumedRoleArn;
private String authRegion;
@CheckForNull
private String tunnel;
private String jenkinsUrl;
Expand Down Expand Up @@ -121,7 +122,7 @@ public ECSCloud(String name, String cluster, ECSService ecsService) {

synchronized ECSService getEcsService() {
if (ecsService == null) {
ecsService = new ECSService(credentialsId, assumedRoleArn, regionName);
ecsService = new ECSService(credentialsId, assumedRoleArn, authRegion, regionName);
}
return ecsService;
}
Expand Down Expand Up @@ -164,6 +165,11 @@ public String getAssumedRoleArn() {
return assumedRoleArn;
}


public String getAuthRegion() {
return authRegion;
}

@DataBoundSetter
public void setRegionName(String regionName) {
this.regionName = regionName;
Expand All @@ -173,6 +179,11 @@ public void setRegionName(String regionName) {
public void setAssumedRoleArn(String assumedRoleArn) {
this.assumedRoleArn = assumedRoleArn;
}

@DataBoundSetter
public void setAuthRegion(String authRegion) {
this.authRegion = authRegion;
}

public String getTunnel() {
return tunnel;
Expand Down Expand Up @@ -428,12 +439,20 @@ public Node call() throws Exception {
}
}

public static Region getRegion(String regionName) {
if (StringUtils.isNotEmpty(regionName)) {
return RegionUtils.getRegion(regionName);
} else {
return Region.getRegion(Regions.US_EAST_1);
public ListBoxModel doFillAuthRegionItems() {

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing permission check

Potential missing permission check in ECSCloud#doFillAuthRegionItems

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing POST/RequirePOST annotation

Potential CSRF vulnerability: If ECSCloud#doFillAuthRegionItems connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST
final ListBoxModel options = new ListBoxModel();
for (Region region : RegionUtils.getRegions()) {
options.add(region.getName());
}
return options;
}

public ListBoxModel doFillRegionNameItems() {

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing permission check

Potential missing permission check in ECSCloud#doFillRegionNameItems

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing POST/RequirePOST annotation

Potential CSRF vulnerability: If ECSCloud#doFillRegionNameItems connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST
final ListBoxModel options = new ListBoxModel();
for (Region region : RegionUtils.getRegions()) {
options.add(region.getName());
}
return options;
}

public String getJenkinsUrl() {
Expand Down Expand Up @@ -507,9 +526,17 @@ public ListBoxModel doFillRegionNameItems() {
}
return options;
}

public ListBoxModel doFillAuthRegionItems() {

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing permission check

Potential missing permission check in DescriptorImpl#doFillAuthRegionItems

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing POST/RequirePOST annotation

Potential CSRF vulnerability: If DescriptorImpl#doFillAuthRegionItems connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST
final ListBoxModel options = new ListBoxModel();
for (Region region : RegionUtils.getRegions()) {
options.add(region.getName());
}
return options;
}

public ListBoxModel doFillClusterItems(@QueryParameter String credentialsId, @QueryParameter String assumedRoleArn, @QueryParameter String regionName) {
ECSService ecsService = new ECSService(credentialsId, assumedRoleArn, regionName);
public ListBoxModel doFillClusterItems(@QueryParameter String credentialsId, @QueryParameter String assumedRoleArn, @QueryParameter String authRegion, @QueryParameter String regionName) {
ECSService ecsService = new ECSService(credentialsId, assumedRoleArn, authRegion, regionName);
try {
final AmazonECS client = ecsService.getAmazonECSClient();
final List<String> allClusterArns = new ArrayList<String>();
Expand Down
10 changes: 8 additions & 2 deletions src/main/java/com/cloudbees/jenkins/plugins/amazonecs/ECSService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ public class ECSService extends BaseAWSService {
@Nonnull
private final Supplier<AmazonECS> clientSupplier;

public ECSService(String credentialsId, String assumedRoleArn, String regionName) {
public ECSService(String credentialsId, String assumedRoleArn, String authRegion, String regionName) {
this.clientSupplier = () -> {
AmazonECSClientBuilder builder = AmazonECSClientBuilder
.standard()
Expand All @@ -94,7 +94,13 @@ public ECSService(String credentialsId, String assumedRoleArn, String regionName
.withCredentials(credentials);
}
else if (StringUtils.isNotBlank(assumedRoleArn)) {
builder.withCredentials(getCredentialsForRole(assumedRoleArn, regionName));
if (StringUtils.isNotBlank(authRegion)) {
builder.withCredentials(getCredentialsForRole(assumedRoleArn, authRegion));
}
else {
builder.withCredentials(getCredentialsForRole(assumedRoleArn, regionName));
}

}

LOGGER.log(Level.FINE, "Selected Region: {0}", regionName);
Expand Down
3 changes: 2 additions & 1 deletion src/main/java/com/cloudbees/jenkins/plugins/amazonecs/ECSTaskTemplate.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1429,10 +1429,11 @@ public static class DescriptorImpl extends Descriptor<CapacityProviderStrategyEn
public ListBoxModel doFillProviderItems(
@RelativePath("../..") @QueryParameter String credentialsId,
@RelativePath("../..") @QueryParameter String assumedRoleArn,
@RelativePath("../..") @QueryParameter String authRegion,
@RelativePath("../..") @QueryParameter String regionName,
@RelativePath("../..") @QueryParameter String cluster
){
ECSService ecsService = new ECSService(credentialsId, assumedRoleArn, regionName);
ECSService ecsService = new ECSService(credentialsId, assumedRoleArn, authRegion, regionName);
final AmazonECS client = ecsService.getAmazonECSClient();
final List<Cluster> allClusters = new ArrayList<Cluster>();
DescribeClustersResult result = client.describeClusters(new DescribeClustersRequest().withClusters(cluster));
Expand Down
4 changes: 4 additions & 0 deletions src/main/resources/com/cloudbees/jenkins/plugins/amazonecs/ECSCloud/config.jelly
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,10 @@
<f:textbox />
</f:entry>

<f:entry field="authRegion" title="${%Amazon IAM Auth Region}" description="AWS regionName for credentials authentication. If not specified, use us-east-1.">
<f:select />
</f:entry>

<f:entry field="regionName" title="${%Amazon ECS Region Name}" description="AWS regionName for ECS. If not specified, use us-east-1.">
<f:select />
</f:entry>
Expand Down
5 changes: 5 additions & 0 deletions src/test/java/com/cloudbees/jenkins/plugins/amazonecs/ECSCloudTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,7 @@ public void getProvisioningCapacity_returnsRemainingMaxAgentsWhenWorkloadExceeds
ECSCloud sut = new ECSCloud("mycloud", "", "", "mycluster");
sut.setMaxAgents(14);
sut.setTemplates(templates);
sut.setAuthRegion("eu-west-1");
sut.setRegionName("eu-west-1");
sut.setNumExecutors(1);
sut.setJenkinsUrl("http://jenkins.local");
Expand All @@ -192,6 +193,7 @@ public void getProvisioningCapacity_returnsExcessWorkloadWithoutMaxAgents () {
ECSCloud sut = new ECSCloud("mycloud", "", "", "mycluster");
sut.setMaxAgents(0);
sut.setTemplates(templates);
sut.setAuthRegion("eu-west-1");
sut.setRegionName("eu-west-1");
sut.setJenkinsUrl("http://jenkins.local");
sut.setSlaveTimeoutInSeconds(5);
Expand All @@ -213,6 +215,7 @@ public void getProvisioningCapacity_returnsExcessWorkloadWhenWorkloadDoesNotExce
ECSCloud sut = new ECSCloud("mycloud", "", "", "mycluster");
sut.setMaxAgents(10);
sut.setTemplates(templates);
sut.setAuthRegion("eu-west-1");
sut.setRegionName("eu-west-1");
sut.setJenkinsUrl("http://jenkins.local");
sut.setSlaveTimeoutInSeconds(5);
Expand All @@ -234,6 +237,7 @@ public void getProvisioningCapacity_returnsZeroWhenOverflowEncountered () {
ECSCloud sut = new ECSCloud("mycloud", "", "", "mycluster");
sut.setMaxAgents(10);
sut.setTemplates(templates);
sut.setAuthRegion("eu-west-1");
sut.setRegionName("eu-west-1");
sut.setJenkinsUrl("http://jenkins.local");
sut.setSlaveTimeoutInSeconds(5);
Expand All @@ -255,6 +259,7 @@ public void getProvisioningCapacity_returnsZeroWhenCurrentAgentsGreaterThanMaxAg
ECSCloud sut = new ECSCloud("mycloud", "", "", "mycluster");
sut.setMaxAgents(1);
sut.setTemplates(templates);
sut.setAuthRegion("eu-west-1");
sut.setRegionName("eu-west-1");
sut.setJenkinsUrl("http://jenkins.local");
sut.setSlaveTimeoutInSeconds(5);
Expand Down