riotgames / key-conjurer Goto Github PK

View Code? Open in Web Editor NEW

166.0 19.0 33.0 5.24 MB

Temporary Credential Service

Home Page: https://technology.riotgames.com/news/key-conjurer-our-policy-least-privilege

License: Apache License 2.0

Go 92.42% Makefile 3.10% HTML 0.79% CSS 0.62% TypeScript 3.06%

aws-lambda sts golang

key-conjurer's Introduction

KeyConjurer

KeyConjurer is a project designed to get rid of permanent AWS credentials.

KeyConjurer is made of three parts:

lambda - Lambda functions used by the CLI to gather data on protected resources.
cli - The CLI interface.
frontend - A static webpage which informs users on how to download and use KeyConjurer.

KeyConjurer is designed to work with Okta as an IdP, supports AWS and Tencent Cloud applications, and is inspired in part by okta-aws-cli. The main difference from okta-aws-cli is that KeyConjurer does not require all users to have access to the Okta administration API - Instead, we use a Lambda function to access the protected resources required.

We use KeyConjurer a lot at Riot, but we can't guarantee any external support for this project. It's use at your own risk. If you encounter a bug or have a feature request, please feel free to raise a pull request or an issue against this repository. You're also welcome to fork the code and modify it as you see fit.

Pre-Deployment Steps

Platform Pre-Deployment Resources

Make an S3 Bucket:

aws s3api create-bucket --bucket <terraform state bucket> --region us-west-2 --create-bucket-configuration LocationConstraint=us-west-2

A VPC w/ Subnets to access service
Setup a KMS key

Setup Build Environment

go 1.20+
node 16.17.0+

Setting Up Your Variable Files

Create prod.env based on example.env.

Configuration

Okta setup

In order to use KeyConjurer, an Okta administrator must configure their tenant appropriately:

A new native OIDC application must be created within your Okta tenant, and the following settings must be configured:
- Scopes: profile openid okta.apps.read
- Authorization Types: Hybrid Flow, Authorization Code, Token Exchange
- Redirection URI: http://localhost:57468
- We recommend you enable Federated Mode on this native application so that users don't need to be explicitly assigned to it.
All AWS and tencent applications must have their Allowed Web SSO Client set to the Client ID of the native OIDC application that was created. This can be configured by going to the Sign On tab for each individual Okta application or managing the application configuration in an IAC provider, like Terraform.

Okta configuration should be configured out of band and is not provided in this repository.

Lambda functions settings

A single lambda function is used to filter applications within the organization to just the ones the user has access to. This function is required because enumerating applications within Okta's API is currently considered an administrative action, and as such, using a users access token to perform this action requires the user to be an administrator on the Okta tenant.

The lambda function has a couple of sensitive values. We use Vault at Riot to store sensitive values. The Lambda function must be configured to access Vault. Secrets can also be retrieved from environment variables directly, but we do not recommend it.

Vault

To use Vault, the following environment variables must be configured:

Variable	Purpose
VAULT_ROLE_NAME	The name of the Vault role to use to acquire credentials
VAULT_SECRET_MOUNT_PATH	The mount path of your Vault secrets mount
VAULT_SECRET_PATH	The path to the Vault secret containing your secrets
VAULT_AWS_AUTH_PATH	The path to the mount on your Vault instance that handles IAM authentication

The Vault secret should contain the following set of key-values - the values are examples and should be replaced as contextually appropriate:

okta_host=https://example.okta.com
okta_token={API TOKEN}

{API_TOKEN} must be replaced with an API token for Okta that has the okta.apps.read scope.

Environment Variables

We advise against using environment variables for secrets in AWS Lambda as they are persisted in plaintext. As such, your Okta API token may be leaked. If you would prefer to use environment variables, however, you must provide the following environment variables to your Lambda configuration:

Variable	Purpose
OKTA_HOST	The hostname of your Okta instance. We'd recommend using a vanity domain, such as https://singlesignon.example.com.
OKTA_TOKEN	A token from Okta that has the `okta.apps.read` scope.
SETTINGS_PROVIDER	This must be set to 'env' for the Lambda functions to read from the environment.

key-conjurer's People

Contributors

Stargazers

Watchers

key-conjurer's Issues

TTL is unitless in the display

Could the TTL display be updated to include the units? I know from experience that the numbers represent hours, but the UI does not make that clear, and coming from a DNS background, my brain keeps wanting it to be seconds.

Users with unauthorized sessions receive cryptic error when retrieving keys

Description

A user who attempts to retrieve session keys using keyconjurer get may receive the error:

Error: failed to fetch SAML assertion

Reproduction steps

Have a user log into KeyConjurer.
Entitle the user to a new AWS application.
Have the user run keyconjurer accounts.
Have the user run keyconjurer get [account name of new application].

Okta may reject a request to exchange tokens using token exchange flow. If it does, the error is silently dropped, and the code continues, ultimately submitting an empty Oauth2 token to the SAML assertion endpoint, which results in the above error.

Resolution

Return an ErrUnauthorized error to the end-user if this occurs during the token exchange endpoint. It's not clear if the response code from Okta is HTTP 500, HTTP 403 or simply a non-200 HTTP response code; Standards indicate that the response code should be HTTP 400. We will simply treat any non-200 status code as an unauthorized error.

Hand back UUID in errors to make logs easier to find.

Ensure Username is baked into every log

Missing AppID edgecase

Repro Steps

Do primary auth
When the account dropdown appears, click on the background (anywhere works just not on the dropdown item itself)
Press "Request Keys"
Receive error

Description of Bug
By not directly selecting an item in the dropdown menu, the event that sets the AppID does not trigger. This puts the UI in a state where it looks like an account has been selected but the programmatic side doesn't see it.

keyconjurer.exe not properly downloading

trying to download keyconjurer from the frontend results in an error and keyconjurer.xml

Add an optional dropdown to pick the region

I frequently find myself clicking the copy button, then pasting all of the commands, then re-running the command that needed AWS environment variables sent.

For a lot of things, this works great, but some of them also need the default region variable, and I forget to set that one.

It would help my workflow a bunch (especially since I don't use AWS often enough to remember what that env variable is without looking it up) if Key Conjurer had an optional dropdown to pick the region, and would add the command to set the region env variable based on that dropdown as well.

If Duo device not found, respond with proper error

App just crashes if there is no Duo Device.

Parsing Bounds Issue for Onelogin MFA Devices

When looking for a Duo device from the Onelogin flow, the device signatures are parsed into an array which is not checked for bounds before further use.

device := &onelogin.Device{} for i, aDevice := range stateTokenResponse.Devices { if aDevice.DeviceType == "Duo Duo Security" { device = &stateTokenResponse.Devices[i] } } signatures := strings.Split(device.SignatureRequest, ":") txSignature := signatures[0] appSignature := signatures[1]

path: api/authenticators/onelogin_duo/authenticator.go
lines: 103-111