Repository navigation
feat(credentials): add sovereign cloud process (#8762) - #373
Gabriel Pezé (gabriel-peze) wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Prowler ignores the Google endpoint and access-token overrides, while the Azure authority override incorrectly redirects managed-identity requests to the login server, causing authentication failures.
4 open issues
What changed in this PR
This PR extends credential resolution and materialization with sovereign and mock cloud settings intended for Prowler and Stratus integrations.
Changes:
- Adds optional AWS, Azure, and GCP endpoint and authentication fields.
- Exports cloud configuration variables and writes Azure CA certificates to temporary files.
- Adds tests for parsing, environment mappings, sensitive-value redaction, and certificate cleanup.
| File | Description |
|---|---|
test/credential/test_credential_resolved.py |
Tests new fields, defaults, certificate decoding, and redaction. |
test/credential/test_credential_materializer.py |
Tests environment overrides and certificate file lifecycle. |
pyoaev/credential/resolved.py |
Adds optional sovereign-cloud fields to credential models. |
pyoaev/credential/materializer.py |
Maps new fields to environment variables and temporary CA files. |
Review effort: Balanced
| if not authority_host.endswith("/"): | ||
| authority_host += "/" | ||
| env["AZURE_AUTHORITY_HOST"] = authority_host | ||
| env["AZURE_POD_IDENTITY_AUTHORITY_HOST"] = authority_host |
There was a problem hiding this comment.
issue (blocking):
I agree with the bot above.
AZURE_POD_IDENTITY_AUTHORITY_HOST is not an Entra authority.
azure-identity uses it as the IMDS base URL, Please set only AZURE_AUTHORITY_HOST, or use a dedicated field
| env["GOOGLE_RESOURCE_MANAGER_CUSTOM_ENDPOINT"] = ( | ||
| secret.gcp_custom_resource_manager_uri | ||
| ) |
| if secret.gcp_custom_token_uri: | ||
| env["GOOGLE_OAUTH2_TOKEN_URI_OVERRIDE"] = secret.gcp_custom_token_uri | ||
| if secret.gcp_custom_iam_uri: | ||
| env["GOOGLE_IAM_CUSTOM_ENDPOINT"] = secret.gcp_custom_iam_uri |
| if secret.gcp_custom_iam_uri: | ||
| env["GOOGLE_IAM_CUSTOM_ENDPOINT"] = secret.gcp_custom_iam_uri | ||
| if secret.gcp_custom_oauth_access_token: | ||
| env["GOOGLE_OAUTH_ACCESS_TOKEN"] = secret.gcp_custom_oauth_access_token |
Christophe Melchior (Kakudou)
left a comment
Christophe Melchior (Kakudou)
left a comment
There was a problem hiding this comment.
Thanks for tho work done on that PR.
Sadly i had to put it in request changes for a little thing, in materializer.py about azure-identity that could lead to missbehaviour.
| if not authority_host.endswith("/"): | ||
| authority_host += "/" | ||
| env["AZURE_AUTHORITY_HOST"] = authority_host | ||
| env["AZURE_POD_IDENTITY_AUTHORITY_HOST"] = authority_host |
There was a problem hiding this comment.
issue (blocking):
I agree with the bot above.
AZURE_POD_IDENTITY_AUTHORITY_HOST is not an Entra authority.
azure-identity uses it as the IMDS base URL, Please set only AZURE_AUTHORITY_HOST, or use a dedicated field
| if secret.gcp_custom_token_uri: | ||
| env["GOOGLE_OAUTH2_TOKEN_URI_OVERRIDE"] = secret.gcp_custom_token_uri | ||
| if secret.gcp_custom_iam_uri: | ||
| env["GOOGLE_IAM_CUSTOM_ENDPOINT"] = secret.gcp_custom_iam_uri |
There was a problem hiding this comment.
question (blocking): Which consumer reads GOOGLE_OAUTH2_TOKEN_URI_OVERRIDE / GOOGLE_IAM_CUSTOM_ENDPOINT / GOOGLE_OAUTH_ACCESS_TOKEN?
google-auth ignores them (from_authorized_user_info hard-codes token_uri, "always overrides") and Prowler reads CLOUDSDK_AUTH_ACCESS_TOKEN.
|
|
||
|
|
||
| def _aws_endpoint_env(endpoint_url: Optional[str]) -> Dict[str, str]: | ||
| # Sovereign or mocked cloud: the same endpoint serves the STS calls. |
There was a problem hiding this comment.
nitpick (non-blocking): AWS_ENDPOINT_URL sends every service to one host. That fits a mock, but not a real sovereign partition (per-service hosts), so the "Sovereign" in the comment is misleading. AWS_ENDPOINT_URL_STS with the same value is redundant too.
| if not authority_host.endswith("/"): | ||
| authority_host += "/" |
There was a problem hiding this comment.
suggestion (non-blocking): Validate the new URL fields at parse time (http(s) scheme, https for the Azure authority, no whitespace/userinfo) and raise InvalidResolvedSecretError, like _ini_value does.
Today "https://host " becomes "https://host /" and fails
| # Java ``byte[]``, sent base64 encoded by the platform. | ||
| azure_requests_certificate: Optional[bytes] = _parsed_with( | ||
| _decode_base64, repr=False, default=None | ||
| ) |
There was a problem hiding this comment.
question: Is azure_requests_certificate guaranteed PEM on the platform side? A Java byte[] is often DER (getEncoded()). Written as .pem, OpenSSL fails to load it and Go silently ends up with an empty root pool. A cheap -----BEGIN check would fail early.
Proposed changes
Testing Instructions
FYI : You can test with floci or another mocked cloud
Related issues