From 4e51348ff2bd164c13a0d5fda748627b5c85ce04 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A1n=20Jes=C3=BAs=20Pe=C3=B1a=20Rodr=C3=ADguez?= Date: Wed, 15 Jan 2025 10:14:44 +0100 Subject: [PATCH] feat(provider-secret): make existing external_id field mandatory (#6510) --- api/src/backend/api/specs/v1.yaml | 32 +++++++++++++-------------- api/src/backend/api/v1/serializers.py | 13 +++++------ 2 files changed, 22 insertions(+), 23 deletions(-) diff --git a/api/src/backend/api/specs/v1.yaml b/api/src/backend/api/specs/v1.yaml index 3629261415..d48c4805b9 100644 --- a/api/src/backend/api/specs/v1.yaml +++ b/api/src/backend/api/specs/v1.yaml @@ -7276,6 +7276,9 @@ components: type: string description: The Amazon Resource Name (ARN) of the role to assume. Required for AWS role assumption. + external_id: + type: string + description: An identifier to enhance security for role assumption. aws_access_key_id: type: string description: The AWS access key ID. Only required if the environment @@ -7294,10 +7297,6 @@ components: maximum: 43200 default: 3600 description: The duration (in seconds) for the role session. - external_id: - type: string - description: An optional identifier to enhance security for - role assumption; may be required by the role administrator. role_session_name: type: string description: |- @@ -7310,6 +7309,7 @@ components: pattern: ^[a-zA-Z0-9=,.@_-]+$ required: - role_arn + - external_id - type: object title: Azure Static Credentials properties: @@ -8487,6 +8487,9 @@ components: type: string description: The Amazon Resource Name (ARN) of the role to assume. Required for AWS role assumption. + external_id: + type: string + description: An identifier to enhance security for role assumption. aws_access_key_id: type: string description: The AWS access key ID. Only required if the environment @@ -8504,10 +8507,6 @@ components: maximum: 43200 default: 3600 description: The duration (in seconds) for the role session. - external_id: - type: string - description: An optional identifier to enhance security for role - assumption; may be required by the role administrator. role_session_name: type: string description: |- @@ -8520,6 +8519,7 @@ components: pattern: ^[a-zA-Z0-9=,.@_-]+$ required: - role_arn + - external_id - type: object title: Azure Static Credentials properties: @@ -8668,6 +8668,9 @@ components: type: string description: The Amazon Resource Name (ARN) of the role to assume. Required for AWS role assumption. + external_id: + type: string + description: An identifier to enhance security for role assumption. aws_access_key_id: type: string description: The AWS access key ID. Only required if the environment @@ -8686,10 +8689,6 @@ components: maximum: 43200 default: 3600 description: The duration (in seconds) for the role session. - external_id: - type: string - description: An optional identifier to enhance security for - role assumption; may be required by the role administrator. role_session_name: type: string description: |- @@ -8702,6 +8701,7 @@ components: pattern: ^[a-zA-Z0-9=,.@_-]+$ required: - role_arn + - external_id - type: object title: Azure Static Credentials properties: @@ -8867,6 +8867,9 @@ components: type: string description: The Amazon Resource Name (ARN) of the role to assume. Required for AWS role assumption. + external_id: + type: string + description: An identifier to enhance security for role assumption. aws_access_key_id: type: string description: The AWS access key ID. Only required if the environment @@ -8884,10 +8887,6 @@ components: maximum: 43200 default: 3600 description: The duration (in seconds) for the role session. - external_id: - type: string - description: An optional identifier to enhance security for role - assumption; may be required by the role administrator. role_session_name: type: string description: |- @@ -8900,6 +8899,7 @@ components: pattern: ^[a-zA-Z0-9=,.@_-]+$ required: - role_arn + - external_id - type: object title: Azure Static Credentials properties: diff --git a/api/src/backend/api/v1/serializers.py b/api/src/backend/api/v1/serializers.py index a47cb27035..8405b1dfdc 100644 --- a/api/src/backend/api/v1/serializers.py +++ b/api/src/backend/api/v1/serializers.py @@ -1010,7 +1010,7 @@ class KubernetesProviderSecret(serializers.Serializer): class AWSRoleAssumptionProviderSecret(serializers.Serializer): role_arn = serializers.CharField() - external_id = serializers.CharField(required=False) + external_id = serializers.CharField() role_session_name = serializers.CharField(required=False) session_duration = serializers.IntegerField( required=False, min_value=900, max_value=43200 @@ -1057,6 +1057,10 @@ class AWSRoleAssumptionProviderSecret(serializers.Serializer): "description": "The Amazon Resource Name (ARN) of the role to assume. Required for AWS role " "assumption.", }, + "external_id": { + "type": "string", + "description": "An identifier to enhance security for role assumption.", + }, "aws_access_key_id": { "type": "string", "description": "The AWS access key ID. Only required if the environment lacks pre-configured " @@ -1078,11 +1082,6 @@ class AWSRoleAssumptionProviderSecret(serializers.Serializer): "default": 3600, "description": "The duration (in seconds) for the role session.", }, - "external_id": { - "type": "string", - "description": "An optional identifier to enhance security for role assumption; may be " - "required by the role administrator.", - }, "role_session_name": { "type": "string", "description": "An identifier for the role session, useful for tracking sessions in AWS logs. " @@ -1096,7 +1095,7 @@ class AWSRoleAssumptionProviderSecret(serializers.Serializer): "pattern": "^[a-zA-Z0-9=,.@_-]+$", }, }, - "required": ["role_arn"], + "required": ["role_arn", "external_id"], }, { "type": "object",