Merge pull request spinnaker#8 in SPKR/clouddriver-nflx from restrict…

…-iam-role-tagging to master

* commit '70dae3ffca5a416dfe28d9edeb201d152ef11a1e':
  Support for restricting the set of users that can tag an iam role

clouddriver-nflx/src/main/groovy/com/netflix/spinnaker/clouddriver/internal/RestrictIamRoleTaggingValidator.groovy

@@ -0,0 +1,44 @@
+/*
+ * Copyright 2016 Netflix, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.netflix.spinnaker.clouddriver.internal
+
+import com.netflix.spinnaker.clouddriver.elasticsearch.descriptions.UpsertEntityTagsDescription
+import com.netflix.spinnaker.clouddriver.security.AllowedAccountsValidator
+import com.netflix.spinnaker.config.NetflixConfigurationProperties.OperationRestrictions
+import org.springframework.validation.Errors
+
+class RestrictIamRoleTaggingValidator implements AllowedAccountsValidator {
+  private final OperationRestrictions restrictedOperations
+
+  RestrictIamRoleTaggingValidator(OperationRestrictions restrictedOperations) {
+    this.restrictedOperations = restrictedOperations
+  }
+
+  @Override
+  void validate(String user, Collection<String> allowedAccounts, Object description, Errors errors) {
+    if (!(description instanceof UpsertEntityTagsDescription)) {
+      return
+    }
+
+    def entityType = description.entityRef?.entityType?.toLowerCase()
+    def isAllowed = restrictedOperations.isAllowed("upsertEntityTags__${entityType}" as String, user)
+    if (!isAllowed) {
+      errors.rejectValue("credentials", "unauthorized", "${user} is not authorized to tag iam roles" as String)
+    }
+  }
+}

clouddriver-nflx/src/main/groovy/com/netflix/spinnaker/config/NetflixConfiguration.groovy

@@ -21,13 +21,16 @@ import com.fasterxml.jackson.databind.ObjectMapper
 import com.netflix.spinnaker.clouddriver.aws.security.AmazonClientProvider
 import com.netflix.spinnaker.clouddriver.core.services.Front50Service
 import com.netflix.spinnaker.clouddriver.internal.InvalidIamRoleExceptionHandler
+import com.netflix.spinnaker.clouddriver.internal.RestrictIamRoleTaggingValidator
 import com.netflix.spinnaker.clouddriver.security.AccountCredentialsProvider
 import com.netflix.spinnaker.clouddriver.internal.ApplicationSpecificIamRoleDescriptionPreProcessor
 import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression
+import org.springframework.boot.context.properties.EnableConfigurationProperties
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
 
 @Configuration
+@EnableConfigurationProperties(NetflixConfigurationProperties)
 class NetflixConfiguration {
   @Bean
   @ConditionalOnExpression('${netflix.applicationSpecificIamRoles:true}')
@@ -42,6 +45,11 @@ class NetflixConfiguration {
     )
   }
 
+  @Bean
+  RestrictIamRoleTaggingValidator restrictIAmRoleTaggingValidator(NetflixConfigurationProperties netflixConfigurationProperties) {
+    return new RestrictIamRoleTaggingValidator(netflixConfigurationProperties.operationRestrictions)
+  }
+
   @Bean
   InvalidIamRoleExceptionHandler invalidIamRoleExceptionHandler() {
     return new InvalidIamRoleExceptionHandler()

clouddriver-nflx/src/main/groovy/com/netflix/spinnaker/config/NetflixConfigurationProperties.groovy

@@ -0,0 +1,39 @@
+/*
+ * Copyright 2016 Netflix, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.netflix.spinnaker.config
+
+import org.springframework.boot.context.properties.ConfigurationProperties
+
+@ConfigurationProperties(prefix = "netflix")
+class NetflixConfigurationProperties {
+  OperationRestrictions operationRestrictions = [:]
+
+  static class OperationRestrictions extends HashMap<String, List<String>> {
+    boolean isAllowed(String operationType, String emailAddress) {
+      def operationRestrictions = get(operationType)
+      if (!operationRestrictions) {
+        // attempt a case-insensitive lookup if exact match is not found
+        operationType = keySet().find { it.equalsIgnoreCase(operationType) }
+        operationRestrictions = operationType ? get(operationType) : null
+      }
+
+      // if there are no explicit operation restrictions, access should be granted by default
+      return !operationRestrictions ? true : operationRestrictions.find { it.equalsIgnoreCase(emailAddress) }
+    }
+  }
+}

clouddriver-nflx/src/test/groovy/com/netflix/spinnaker/clouddriver/internal/RestrictIamRoleTaggingValidatorSpec.groovy

@@ -0,0 +1,53 @@
+/*
+ * Copyright 2016 Netflix, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.netflix.spinnaker.clouddriver.internal
+
+import com.fasterxml.jackson.databind.ObjectMapper
+import com.netflix.spinnaker.clouddriver.elasticsearch.descriptions.UpsertEntityTagsDescription
+import com.netflix.spinnaker.config.NetflixConfigurationProperties
+import org.springframework.validation.Errors
+import spock.lang.Specification
+import spock.lang.Unroll
+
+class RestrictIamRoleTaggingValidatorSpec extends Specification {
+  def errors = Mock(Errors)
+  def objectMapper = new ObjectMapper()
+
+  @Unroll
+  def "should raise exception if authenticated user is not in set of allowed iam role taggers"() {
+    given:
+    def operationRestrictions = new NetflixConfigurationProperties.OperationRestrictions([
+        "upsertEntityTags__iamrole": ["test@test.com"]
+    ])
+    def preProcessor = new RestrictIamRoleTaggingValidator(operationRestrictions)
+
+    when:
+    preProcessor.validate(user, [], objectMapper.convertValue(description, UpsertEntityTagsDescription), errors)
+
+    then:
+    errorsCount * errors.rejectValue("credentials", "unauthorized", _)
+
+    where:
+    user            | description                              || errorsCount
+    null            | [:]                                      || 0
+    "test@test.com" | [entityRef: [entityType: "iamrole"]]     || 0
+    null            | [entityRef: [entityType: "servergroup"]] || 0
+    null            | [entityRef: [entityType: "iamrole"]]     || 1
+    "me@test.com"   | [entityRef: [entityType: "iamrole"]]     || 1
+  }
+}

clouddriver-nflx/src/test/groovy/com/netflix/spinnaker/config/NetflixConfigurationPropertiesSpec.groovy

@@ -0,0 +1,38 @@
+/*
+ * Copyright 2016 Netflix, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package com.netflix.spinnaker.config
+
+import spock.lang.Specification
+
+class NetflixConfigurationPropertiesSpec extends Specification {
+  def "should check against configured operation restrictions"() {
+    given:
+    def configurationProperties = new NetflixConfigurationProperties(
+        operationRestrictions: new NetflixConfigurationProperties.OperationRestrictions([
+            "upsertEntityTags__iamrole": ["test@test.com"]
+        ])
+    )
+
+    expect:
+    configurationProperties.operationRestrictions.isAllowed("upsertEntityTags", "me@test.com")
+    configurationProperties.operationRestrictions.isAllowed("upsertEntityTags__iamrole", "test@test.com")
+    configurationProperties.operationRestrictions.isAllowed("upsertEntityTags__iamrole", "TEST@TEST.COM")   // case-insensitive
+    !configurationProperties.operationRestrictions.isAllowed("upsertEntityTags__iamrole", "me@test.com")
+    !configurationProperties.operationRestrictions.isAllowed("upsertentitytags__iamrole", "me@test.com")    // case-insensitive
+  }
+}

clouddriver-package/root/apps/clouddriver/config/clouddriver.yml

@@ -248,9 +248,25 @@ spring:
 
 netflix:
   applicationSpecificIamRoles: true
+  operationRestrictions:
+    upsertEntityTags__iamrole:
+      - ajordens@netflix.com
+      - cfieber@netflix.com
+      - rzienert@netflix.com
+      - agordon@netflix.com
+      - chrisb@netflix.com
+      - clin@netflix.com
+      - jchabu@netflix.com
+      - rfletcher@netflix.com
+      - zthash@netflix.com
+      - pkelly@netflix.com
+      - nmedida@netflix.com
+      - mgrima@netflix.com
+      - kglisson@netflix.com
+      - jheffner@netflix.com
 
 bastion:
-  proxyCluster: clouddriver-prestaging-b
+  proxyCluster: clouddriver-prestaging-a
   accountIamRole: clouddriverInstanceProfile
 
 aws:
@@ -678,4 +694,4 @@ okHttpClient:
   trustStore: ${user.home}/.spinnaker/truststores/services-truststore.p12
 
 logging:
-  config: ${user.home}/.spinnaker/logback-defaults.xml
+  config: ${user.home}/.spinnaker/logback-defaults.xml