iSharkFly-Docs
/
packer-cn
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

New map: region_kms_key_ids, allowing custom encryption keys on a per-region basis. Also new tests.

This commit is contained in:
Megan Marsh 2017-05-25 14:42:03 -07:00
parent 4abb541468
commit 7174a7a3d5
2 changed files with 80 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
builder/amazon/common/ami_config.go
View File

@ -22,11 +22,21 @@ type AMIConfig struct {
AMIForceDeleteSnapshot bool `mapstructure:"force_delete_snapshot"`
AMIEncryptBootVolume bool `mapstructure:"encrypt_boot"`
AMIKmsKeyId string `mapstructure:"kms_key_id"`
AMIRegionKmsKeyIds map[string]string `mapstructure:"region_kms_key_ids"`
SnapshotTags map[string]string `mapstructure:"snapshot_tags"`
SnapshotUsers []string `mapstructure:"snapshot_users"`
SnapshotGroups []string `mapstructure:"snapshot_groups"`
}
func stringInSlice(searchstr string, searchslice []string) bool {
for _, item := range searchslice {
if item == searchstr {
return true
}
}
return false
}
func (c *AMIConfig) Prepare(ctx *interpolate.Context) []error {
var errs []error
if c.AMIName == "" {
@ -54,19 +64,47 @@ func (c *AMIConfig) Prepare(ctx *interpolate.Context) []error {
}
}
// Make sure that if we have region_kms_key_ids defined the regions in ami_regions are also in region_kms_key_ids
if len(c.AMIRegionKmsKeyIds) > 0 {
regions_in_key_map := make([]string, 0, len(c.AMIRegionKmsKeyIds))
for reg := range c.AMIRegionKmsKeyIds {
regions_in_key_map = append(regions_in_key_map, reg)
}
if regions_match := stringInSlice(region, regions_in_key_map); !regions_match {
errs = append(errs, fmt.Errorf("Region %s is in ami_regions but not in region_kms_key_ids", region))
}
}
regions = append(regions, region)
}
c.AMIRegions = regions
}
// Make sure that if we have region_kms_key_ids defined the regions in region_kms_key_ids are also in ami_regions
if len(c.AMIRegionKmsKeyIds) > 0 {
for KMS_key_region := range c.AMIRegionKmsKeyIds {
if regions_match := stringInSlice(KMS_key_region, c.AMIRegions); !regions_match {
errs = append(errs, fmt.Errorf("Region %s is in region_kms_key_ids but not in ami_regions", KMS_key_region))
}
}
}
if len(c.AMIUsers) > 0 && c.AMIEncryptBootVolume {
errs = append(errs, fmt.Errorf("Cannot share AMI with encrypted boot volume"))
}
if len(c.SnapshotUsers) > 0 && len(c.AMIKmsKeyId) == 0 && c.AMIEncryptBootVolume {
if len(c.SnapshotUsers) > 0 {
if len(c.AMIKmsKeyId) == 0 && c.AMIEncryptBootVolume {
errs = append(errs, fmt.Errorf("Cannot share snapshot encrypted with default KMS key"))
}
if len(c.AMIRegionKmsKeyIds) > 0 {
for _, KMS_key_region := range c.AMIRegionKmsKeyIds {
if len(KMS_key_region) == 0 {
errs = append(errs, fmt.Errorf("Cannot share snapshot encrypted with default KMS key"))
}
}
}
}
if len(c.AMIName) < 3 || len(c.AMIName) > 128 {
errs = append(errs, fmt.Errorf("AMIName must be between 3 and 128 characters long"))

40
builder/amazon/common/ami_config_test.go
View File

@ -57,6 +57,46 @@ func TestAMIConfigPrepare_regions(t *testing.T) {
}
c.AMISkipRegionValidation = false
c.AMIRegions = []string{"us-east-1", "us-east-2", "us-west-1"}
c.AMIRegionKmsKeyIds = map[string]string{
"us-east-1": "123-456-7890",
"us-west-1": "789-012-3456",
"us-east-2": "456-789-0123",
}
if err := c.Prepare(nil); err != nil {
t.Fatal("shouldn't have error")
}
c.AMIRegions = []string{"us-east-1", "us-west-1"}
c.AMIRegionKmsKeyIds = map[string]string{
"us-east-1": "123-456-7890",
"us-west-1": "789-012-3456",
"us-east-2": "456-789-0123",
}
if err := c.Prepare(nil); err == nil {
t.Fatal("should have error b/c theres a region in the key map that isn't in ami_regions")
}
c.AMIRegions = []string{"us-east-1", "us-west-1", "us-east-2"}
c.AMIRegionKmsKeyIds = map[string]string{
"us-east-1": "123-456-7890",
"us-west-1": "789-012-3456",
}
if err := c.Prepare(nil); err == nil {
t.Fatal("should have error b/c theres a region in in ami_regions that isn't in the key map")
}
c.SnapshotUsers = []string{"foo", "bar"}
c.AMIKmsKeyId = "123-abc-456"
c.AMIEncryptBootVolume = true
c.AMIRegions = []string{"us-east-1", "us-west-1"}
c.AMIRegionKmsKeyIds = map[string]string{
"us-east-1": "123-456-7890",
"us-west-1": "",
}
if err := c.Prepare(nil); err == nil {
t.Fatal("should have error b/c theres a region in in ami_regions that isn't in the key map")
}
}
func TestAMIConfigPrepare_Share_EncryptedBoot(t *testing.T) {