Paths

Table of Contentst

Differential D9279

[services-lib] Add fn to verify services token
ClosedPublic
Actions

Authored by bartek on Sep 25 2023, 5:44 AM.

Tags

None

Referenced Files

	Unknown Object (File)
	Sun, Jun 30, 1:42 PM

	Unknown Object (File)
	Sun, Jun 30, 1:42 PM

	Unknown Object (File)
	Sun, Jun 30, 1:41 PM

	Unknown Object (File)
	Sun, Jun 30, 1:40 PM

	Unknown Object (File)
	Sat, Jun 29, 1:49 PM

	Unknown Object (File)
	Mon, Jun 24, 3:12 AM

	Unknown Object (File)
	Mon, Jun 24, 1:33 AM

	Unknown Object (File)
	Sat, Jun 22, 11:55 PM

View All 32 Files

Subscribers

Details

Reviewers

varun
michal
• jon

Commits

rCOMM8af116318d45: [services-lib] Add fn to verify services token

Summary

This diff adds logic to access and verify service-to-service token held in AWS secrets manager.
AWS uses "tags" to version secrets. The current version of the secret is tagged AWSCURRENT. Previous version from before rotation is tagged with AWSPREVIOUS.

Depends on D9277

Test Plan

Verified that the secret is accessible.
Validation logic works for token with tag AWSCURRENT (set in terraform, also set by default in AWS).
Rotated the secret (changed manually so last_rotated() replaced with last_changed()) and verified the old token is invalid.
Increased the protection period to 1 hour and verified that the old token is still valid.

Diff Detail

Repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

bartek created this revision.Sep 25 2023, 5:44 AM

bartek held this revision as a draft.

Herald added a reviewer: • jon. · View Herald TranscriptSep 25 2023, 5:44 AM

Herald added subscribers: tomek, ashoat. · View Herald Transcript

bartek added a child revision: D9280: [services-lib] Introduce AuthService for token verification.Sep 25 2023, 5:47 AM

bartek published this revision for review.Sep 25 2023, 5:58 AM

Harbormaster completed remote builds in B22818: Diff 31388.Sep 25 2023, 6:01 AM

varun requested changes to this revision.Sep 25 2023, 11:08 AM

varun added inline comments.

services/comm-services-lib/src/auth/service.rs
64 ↗	(On Diff #31388)	i'm confused why we aren't using the `constant_time_eq` functon here

This revision now requires changes to proceed.Sep 25 2023, 11:08 AM

bartek requested review of this revision.Sep 25 2023, 11:26 AM

bartek added inline comments.

services/comm-services-lib/src/auth/service.rs
64 ↗	(On Diff #31388)	This type implements `PartialEq` from D9242 - constant time eq is done there

how often are we rotating the token?

This revision is now accepted and ready to land.Sep 25 2023, 12:34 PM

michal accepted this revision.Sep 26 2023, 1:41 AM

michal added inline comments.

services/comm-services-lib/src/auth/service.rs
11–17 ↗	(On Diff #31388)	Potentially this could be an enum but doesn't really matter

Closed by commit rCOMM8af116318d45: [services-lib] Add fn to verify services token (authored by bartek). · Explain WhyOct 2 2023, 6:27 AM

This revision was automatically updated to reflect the committed changes.

bartek added a commit: rCOMM8af116318d45: [services-lib] Add fn to verify services token.

how often are we rotating the token?

This question does not appear to have been answered

In D9279#273116, @varun wrote:

how often are we rotating the token?

We're not rotating it yet - there's a separate task for this: ENG-4943. Currently, the token is generated by Terraform in D9276

In D9279#274672, @ashoat wrote:

how often are we rotating the token?

This question does not appear to have been answered

Sorry, I had answer written but apparently I didn't click "Submit" 🤦‍♂️ hopefully @varun got the answer when reviewing D9276

Revision Contents
Changeset List

Path

Size

services/

backup/

blob/

comm-services-lib/

1 line

src/

auth/

2 lines

75 lines

commtest/

feature-flags/

reports/

Diff 31594

services/backup/Cargo.lock

Loading...

services/blob/Cargo.lock

Loading...

services/comm-services-lib/Cargo.lock

Loading...

services/comm-services-lib/Cargo.toml

Loading...

services/comm-services-lib/src/auth/mod.rs

Loading...

services/comm-services-lib/src/auth/service.rs

Loading...

services/commtest/Cargo.lock

Loading...

services/feature-flags/Cargo.lock

Loading...

services/reports/Cargo.lock

Loading...