feat: cloud integration — WAF v2, Secrets Manager, CloudTrail retention, DynamoDB PITR, SQS DLQ alarms #28
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| 1.3.0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,105 @@ | ||
| import json | ||
| import logging | ||
| import os | ||
| from typing import Any | ||
|
|
||
| logger = logging.getLogger(__name__) | ||
|
|
||
| _APP_SECRETS_CACHE: dict[str, Any] | None = None | ||
| _APP_SECRETS_CACHE_ARN: str | None = None | ||
|
|
||
|
|
||
| def _get_app_secrets() -> dict[str, Any]: | ||
| """Fetch and cache the shared app secret bundle from Secrets Manager.""" | ||
| global _APP_SECRETS_CACHE, _APP_SECRETS_CACHE_ARN | ||
|
|
||
| secret_arn = os.environ.get("SECRET_ARN", "").strip() | ||
| if not secret_arn: | ||
| return {} | ||
|
|
||
| if ( | ||
| _APP_SECRETS_CACHE is not None | ||
| and _APP_SECRETS_CACHE_ARN == secret_arn | ||
| ): | ||
| return _APP_SECRETS_CACHE | ||
|
|
||
| import boto3 | ||
| from botocore.exceptions import BotoCoreError, ClientError | ||
|
|
||
| try: | ||
| region = os.environ.get("AWS_REGION_NAME", "eu-west-3") | ||
| client = boto3.client("secretsmanager", region_name=region) | ||
| resp = client.get_secret_value(SecretId=secret_arn) | ||
| data = json.loads(resp["SecretString"]) | ||
| if not isinstance(data, dict): | ||
| raise ValueError("secret payload must be a JSON object") | ||
| except ( | ||
| ClientError, | ||
| BotoCoreError, | ||
| json.JSONDecodeError, | ||
| KeyError, | ||
| ValueError, | ||
| ) as exc: | ||
| raise RuntimeError( | ||
| f"Failed to load application secrets from {secret_arn}: {exc}" | ||
| ) from exc | ||
|
|
||
| _APP_SECRETS_CACHE = data | ||
| _APP_SECRETS_CACHE_ARN = secret_arn | ||
| return data | ||
|
|
||
|
|
||
| def _resolve_secret_key() -> str: | ||
| """Return the Flask SECRET_KEY. | ||
|
|
||
| When running on AWS Lambda the ``SECRET_ARN`` environment variable points | ||
| to a Secrets Manager secret that holds the key as a JSON object | ||
| ``{"SECRET_KEY": "..."}`` alongside other credentials. We fetch the value | ||
| at startup so the plaintext key is never stored as a Lambda environment | ||
| variable (where it is visible in the AWS console). | ||
|
|
||
| Falls back to the ``SECRET_KEY`` environment variable (or the insecure | ||
| development default) when ``SECRET_ARN`` is absent — this preserves | ||
| backward-compatibility for local development and unit tests. | ||
| """ | ||
| secret_arn = os.environ.get("SECRET_ARN", "").strip() | ||
| if secret_arn: | ||
| secret_key = _get_app_secrets().get("SECRET_KEY") | ||
| if secret_key: | ||
| return secret_key | ||
|
|
||
| env_secret_key = os.environ.get("SECRET_KEY", "") | ||
| if env_secret_key: | ||
| logger.warning( | ||
| "SECRET_ARN is set but SECRET_KEY was not found in Secrets Manager; " | ||
| "falling back to SECRET_KEY env var" | ||
| ) | ||
| return env_secret_key | ||
|
|
||
| raise RuntimeError( | ||
| "SECRET_ARN is set but SECRET_KEY could not be resolved from Secrets " | ||
| "Manager and no SECRET_KEY env fallback is configured" | ||
| ) | ||
| return os.environ.get("SECRET_KEY", "dev-secret-key-change-in-production") | ||
|
There was a problem hiding this comment.
When Useful? React with 👍 / 👎. |
||
|
|
||
|
|
||
| def _resolve_msal_client_secret() -> str: | ||
| """Return the MSAL client secret from Secrets Manager or env var.""" | ||
| secret_arn = os.environ.get("SECRET_ARN", "").strip() | ||
| if secret_arn: | ||
| msal_client_secret = _get_app_secrets().get("MSAL_CLIENT_SECRET") | ||
| if msal_client_secret: | ||
| return msal_client_secret | ||
|
|
||
| logger.warning( | ||
| "SECRET_ARN is set but MSAL_CLIENT_SECRET was not found in Secrets " | ||
| "Manager; falling back to MSAL_CLIENT_SECRET env var" | ||
| ) | ||
| return os.environ.get("MSAL_CLIENT_SECRET", "") | ||
|
Comment on lines
+52
to
+98
There was a problem hiding this comment. Both |
||
|
|
||
|
|
||
| class Config: | ||
| SECRET_KEY = _resolve_secret_key() | ||
|
|
||
| # Flask-WTF CSRF — allow requests through CloudFront where the Referer | ||
| # header is the CloudFront domain, not the API Gateway origin. | ||
|
|
@@ -54,7 +151,7 @@ class Config: | |
| # Set all three variables to enable the "Sign in with Microsoft" button. | ||
| # Leave them empty (default) to disable SSO entirely. | ||
| MSAL_CLIENT_ID = os.environ.get('MSAL_CLIENT_ID', '') | ||
| MSAL_CLIENT_SECRET = _resolve_msal_client_secret() | ||
| # e.g. "https://login.microsoftonline.com/<tenant-id>/v2.0" or | ||
| # "https://login.microsoftonline.com/common/v2.0" for multi-tenant. | ||
| MSAL_AUTHORITY = os.environ.get( | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This entry says
MSAL_CLIENT_SECRETwas removed from plaintext Lambda env vars and that Lambda receives onlySECRET_ARN, butphishing-platform-infra/terraform/lambda.tfstill setsMSAL_CLIENT_SECRET = var.msal_client_secretin the environment. Either update the infrastructure to actually remove it, or adjust the changelog to reflect the current behavior.