Improve searching for configured AWS credentials
The previous approach for finding AWS credentials was pretty naive and
only covered contents of a single file (~/.aws/credentials by
default).
The AWS CLI documentation states various other ways to configure
credentials which weren't covered:
https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#credentials
Even that aren't all ways, a look into the code shows:
https://github.com/boto/botocore/blob/develop/botocore/credentials.py
This commit changes the behavior so the hook will behave in a way
that if the AWS CLI is able to obtain credentials from local files,
the hook will find them as well.
The changes in detail are:
- detect AWS session tokens and handle them like secret keys.
- always search credentials in the default AWS CLI file locations
( ~/.aws/config, ~/.aws/credentials, /etc/boto.cfg and ~/.boto)
- detect AWS credentials configured via environment variables in
AWS_SECRET_ACCESS_KEY, AWS_SECURITY_TOKEN and AWS_SESSION_TOKEN
- check additional configuration files configured via environment
variables (AWS_CREDENTIAL_FILE, AWS_SHARED_CREDENTIALS_FILE and
BOTO_CONFIG)
- print out the first four characters of each secret found in files to
be checked in, to make it easier to figure out, what the secrets
were, which were going to be checked in
- improve error handling for parsing ini-files
- improve tests
There is a major functional change introduced by this commit:
Locations the AWS CLI gets credentials from are always searched and
there is no way to disable them. --credentials-file is still there to
specify one or more additional files to search credentials in. It's
the purpose of this hook to find and check files for found
credentials, so it should work in any case. As this commit also
improves error handling for not-existing or malformed configuration
files, it should be no big deal.
Receiving credentials via the EC2 and ECS meta data services is not
covered intentionally, to not further increase the amount of changes
in this commit and as it's probably an edge case anyway to have this
hook running in such an environment.
diff --git a/tests/detect_aws_credentials_test.py b/tests/detect_aws_credentials_test.py
index 66513fe..410a33f 100644
--- a/tests/detect_aws_credentials_test.py
+++ b/tests/detect_aws_credentials_test.py
@@ -1,13 +1,70 @@
import pytest
+from pre_commit_hooks.detect_aws_credentials import get_aws_credential_files_from_env
+from pre_commit_hooks.detect_aws_credentials import get_aws_secrets_from_env
+from pre_commit_hooks.detect_aws_credentials import get_aws_secrets_from_file
from pre_commit_hooks.detect_aws_credentials import main
from testing.util import get_resource_path
+def test_get_aws_credentials_file_from_env(monkeypatch):
+ """Test that reading credential files names from environment variables works."""
+ monkeypatch.delenv('AWS_CREDENTIAL_FILE', raising=False)
+ monkeypatch.delenv('AWS_SHARED_CREDENTIALS_FILE', raising=False)
+ monkeypatch.delenv('BOTO_CONFIG', raising=False)
+ assert get_aws_credential_files_from_env() == set()
+ monkeypatch.setenv('AWS_CREDENTIAL_FILE', '/foo')
+ assert get_aws_credential_files_from_env() == {'/foo'}
+ monkeypatch.setenv('AWS_SHARED_CREDENTIALS_FILE', '/bar')
+ assert get_aws_credential_files_from_env() == {'/foo', '/bar'}
+ monkeypatch.setenv('BOTO_CONFIG', '/baz')
+ assert get_aws_credential_files_from_env() == {'/foo', '/bar', '/baz'}
+ monkeypatch.setenv('AWS_DUMMY_KEY', 'foobar')
+ assert get_aws_credential_files_from_env() == {'/foo', '/bar', '/baz'}
+
+
+def test_get_aws_secrets_from_env(monkeypatch):
+ """Test that reading secrets from environment variables works."""
+ monkeypatch.delenv('AWS_SECRET_ACCESS_KEY', raising=False)
+ monkeypatch.delenv('AWS_SESSION_TOKEN', raising=False)
+ assert get_aws_secrets_from_env() == set()
+ monkeypatch.setenv('AWS_SECRET_ACCESS_KEY', 'foo')
+ assert get_aws_secrets_from_env() == {'foo'}
+ monkeypatch.setenv('AWS_SESSION_TOKEN', 'bar')
+ assert get_aws_secrets_from_env() == {'foo', 'bar'}
+ monkeypatch.setenv('AWS_SECURITY_TOKEN', 'baz')
+ assert get_aws_secrets_from_env() == {'foo', 'bar', 'baz'}
+ monkeypatch.setenv('AWS_DUMMY_KEY', 'baz')
+ assert get_aws_secrets_from_env() == {'foo', 'bar', 'baz'}
+
+
+@pytest.mark.parametrize(('filename', 'expected_keys'), (
+ ('aws_config_with_secret.ini', {
+ 'z2rpgs5uit782eapz5l1z0y2lurtsyyk6hcfozlb'}),
+ ('aws_config_with_session_token.ini', {'foo'}),
+ ('aws_config_with_secret_and_session_token.ini',
+ {'z2rpgs5uit782eapz5l1z0y2lurtsyyk6hcfozlb', 'foo'}),
+ ('aws_config_with_multiple_sections.ini', {
+ '7xebzorgm5143ouge9gvepxb2z70bsb2rtrh099e',
+ 'z2rpgs5uit782eapz5l1z0y2lurtsyyk6hcfozlb',
+ 'ixswosj8gz3wuik405jl9k3vdajsnxfhnpui38ez',
+ 'foo'}),
+ ('aws_config_without_secrets.ini', set()),
+ ('nonsense.txt', set()),
+ ('ok_json.json', set()),
+))
+def test_get_aws_secrets_from_file(filename, expected_keys):
+ """Test that reading secrets from files works."""
+ keys = get_aws_secrets_from_file(get_resource_path(filename))
+ assert keys == expected_keys
+
+
# Input filename, expected return value
TESTS = (
- ('with_no_secrets.txt', 0),
- ('with_secrets.txt', 1),
+ ('aws_config_with_secret.ini', 1),
+ ('aws_config_with_session_token.ini', 1),
+ ('aws_config_with_multiple_sections.ini', 1),
+ ('aws_config_without_secrets.ini', 0),
('nonsense.txt', 0),
('ok_json.json', 0),
)
@@ -15,24 +72,30 @@
@pytest.mark.parametrize(('filename', 'expected_retval'), TESTS)
def test_detect_aws_credentials(filename, expected_retval):
+ """Test if getting configured AWS secrets from files to be checked in works."""
+
# with a valid credentials file
ret = main((
get_resource_path(filename),
- "--credentials-file=testing/resources/sample_aws_credentials",
+ "--credentials-file=testing/resources/aws_config_with_multiple_sections.ini",
))
assert ret == expected_retval
-def test_non_existent_credentials(capsys):
- # with a non-existent credentials file
+def test_non_existent_credentials(capsys, monkeypatch):
+ """Test behavior with no configured AWS secrets."""
+ monkeypatch.setattr(
+ 'pre_commit_hooks.detect_aws_credentials.get_aws_secrets_from_env',
+ lambda: set())
+ monkeypatch.setattr(
+ 'pre_commit_hooks.detect_aws_credentials.get_aws_secrets_from_file',
+ lambda x: set())
ret = main((
- get_resource_path('with_secrets.txt'),
+ get_resource_path('aws_config_without_secrets.ini'),
"--credentials-file=testing/resources/credentailsfilethatdoesntexist"
))
assert ret == 2
out, _ = capsys.readouterr()
- assert out == (
- 'No aws keys were configured at '
- 'testing/resources/credentailsfilethatdoesntexist\n'
- 'Configure them with --credentials-file\n'
- )
+ assert out == ('No AWS keys were found in the configured credential files '
+ 'and environment variables.\nPlease ensure you have the '
+ 'correct setting for --credentials-file\n')
