Page MenuHomePhabricator
Differential D9279

[services-lib] Add fn to verify services token
ClosedPublic
Actions

Authored by bartek on Sep 25 2023, 5:44 AM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Nov 20, 11:46 AM
Unknown Object (File)
Sun, Oct 27, 4:14 AM
Unknown Object (File)
Oct 15 2024, 1:13 AM
Unknown Object (File)
Oct 13 2024, 7:54 PM
Unknown Object (File)
Oct 13 2024, 7:54 PM
Unknown Object (File)
Oct 13 2024, 7:54 PM
Unknown Object (File)
Oct 13 2024, 7:48 PM
Unknown Object (File)
Oct 5 2024, 8:41 PM
View All 55 Files
Subscribers
ashoat
tomek

Details

Reviewers
varun
michal
• jon
Commits
rCOMM8af116318d45: [services-lib] Add fn to verify services token
Summary

This diff adds logic to access and verify service-to-service token held in AWS secrets manager.
AWS uses "tags" to version secrets. The current version of the secret is tagged AWSCURRENT. Previous version from before rotation is tagged with AWSPREVIOUS.

Depends on D9277

Test Plan
  • Verified that the secret is accessible.
  • Validation logic works for token with tag AWSCURRENT (set in terraform, also set by default in AWS).
  • Rotated the secret (changed manually so last_rotated() replaced with last_changed()) and verified the old token is invalid.
  • Increased the protection period to 1 hour and verified that the old token is still valid.

Diff Detail

Repository
rCOMM Comm
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

bartek created this revision.Sep 25 2023, 5:44 AM
bartek held this revision as a draft.
Herald added a reviewer: • jon. · View Herald TranscriptSep 25 2023, 5:44 AM
Herald added subscribers: tomek, ashoat. · View Herald Transcript
bartek added a child revision: D9280: [services-lib] Introduce AuthService for token verification.Sep 25 2023, 5:47 AM
bartek published this revision for review.Sep 25 2023, 5:58 AM
Harbormaster completed remote builds in B22818: Diff 31388.Sep 25 2023, 6:01 AM
varun requested changes to this revision.Sep 25 2023, 11:08 AM
varun added inline comments.
services/comm-services-lib/src/auth/service.rs
64 ↗(On Diff #31388)

i'm confused why we aren't using the constant_time_eq functon here

This revision now requires changes to proceed.Sep 25 2023, 11:08 AM
bartek requested review of this revision.Sep 25 2023, 11:26 AM
bartek added inline comments.
services/comm-services-lib/src/auth/service.rs
64 ↗(On Diff #31388)

This type implements PartialEq from D9242 - constant time eq is done there

varun accepted this revision.Sep 25 2023, 12:34 PM

how often are we rotating the token?

This revision is now accepted and ready to land.Sep 25 2023, 12:34 PM
michal accepted this revision.Sep 26 2023, 1:41 AM
michal added inline comments.
services/comm-services-lib/src/auth/service.rs
11–17 ↗(On Diff #31388)

Potentially this could be an enum but doesn't really matter

Closed by commit rCOMM8af116318d45: [services-lib] Add fn to verify services token (authored by bartek). · Explain WhyOct 2 2023, 6:27 AM
This revision was automatically updated to reflect the committed changes.
bartek added a commit: rCOMM8af116318d45: [services-lib] Add fn to verify services token.
ashoat added a comment.Oct 3 2023, 9:25 AM

how often are we rotating the token?

This question does not appear to have been answered

bartek added a comment.Oct 4 2023, 2:25 AM
In D9279#273116, @varun wrote:

how often are we rotating the token?

We're not rotating it yet - there's a separate task for this: ENG-4943. Currently, the token is generated by Terraform in D9276

bartek added a comment.Oct 4 2023, 2:28 AM
In D9279#274672, @ashoat wrote:

how often are we rotating the token?

This question does not appear to have been answered

Sorry, I had answer written but apparently I didn't click "Submit" 🤦‍♂️ hopefully @varun got the answer when reviewing D9276

Revision Contents
Changeset List

PathSize
services/
backup/
blob/
comm-services-lib/
1 line
src/
auth/
2 lines
75 lines
commtest/
feature-flags/
reports/

Diff 31594

View Options

services/backup/Cargo.lock

Loading...
View Options

services/blob/Cargo.lock

Loading...
View Options

services/comm-services-lib/Cargo.lock

Loading...
View Options

services/comm-services-lib/Cargo.toml

Loading...
View Options

services/comm-services-lib/src/auth/mod.rs

Loading...
View Options

services/comm-services-lib/src/auth/service.rs

Loading...
View Options

services/commtest/Cargo.lock

Loading...
View Options

services/feature-flags/Cargo.lock

Loading...
View Options

services/reports/Cargo.lock

Loading...