AWS: check validity of KSM key before creating a new encrypted disk.

Godeps/Godeps.json

@@ -307,6 +307,11 @@
 			"Rev": "63ce630574a5ec05ecd8e8de5cea16332a5a684d"
 		},
 		{
+			"ImportPath": "github.com/aws/aws-sdk-go/service/kms",
+			"Comment": "v1.6.10",
+			"Rev": "63ce630574a5ec05ecd8e8de5cea16332a5a684d"
+		},
+		{
 			"ImportPath": "github.com/aws/aws-sdk-go/service/route53",
 			"Comment": "v1.6.10",
 			"Rev": "63ce630574a5ec05ecd8e8de5cea16332a5a684d"

pkg/cloudprovider/providers/aws/BUILD

@@ -41,6 +41,7 @@ go_library(
         "//vendor/github.com/aws/aws-sdk-go/service/autoscaling:go_default_library",
         "//vendor/github.com/aws/aws-sdk-go/service/ec2:go_default_library",
         "//vendor/github.com/aws/aws-sdk-go/service/elb:go_default_library",
+        "//vendor/github.com/aws/aws-sdk-go/service/kms:go_default_library",
         "//vendor/github.com/golang/glog:go_default_library",
         "//vendor/github.com/prometheus/client_golang/prometheus:go_default_library",
         "//vendor/gopkg.in/gcfg.v1:go_default_library",
@@ -69,6 +70,7 @@ go_test(
         "//vendor/github.com/aws/aws-sdk-go/service/autoscaling:go_default_library",
         "//vendor/github.com/aws/aws-sdk-go/service/ec2:go_default_library",
         "//vendor/github.com/aws/aws-sdk-go/service/elb:go_default_library",
+        "//vendor/github.com/aws/aws-sdk-go/service/kms:go_default_library",
         "//vendor/github.com/golang/glog:go_default_library",
         "//vendor/github.com/stretchr/testify/assert:go_default_library",
         "//vendor/github.com/stretchr/testify/mock:go_default_library",

pkg/cloudprovider/providers/aws/aws.go

@@ -38,6 +38,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/aws/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/service/kms"
 	"github.com/golang/glog"
 	"github.com/prometheus/client_golang/prometheus"
 
@@ -203,6 +204,7 @@ type Services interface {
 	LoadBalancing(region string) (ELB, error)
 	Autoscaling(region string) (ASG, error)
 	Metadata() (EC2Metadata, error)
+	KeyManagement(region string) (KMS, error)
 }
 
 // EC2 is an abstraction over AWS', to allow mocking/other implementations
@@ -273,6 +275,12 @@ type ASG interface {
 	DescribeAutoScalingGroups(*autoscaling.DescribeAutoScalingGroupsInput) (*autoscaling.DescribeAutoScalingGroupsOutput, error)
 }
 
+// KMS is a simple pass-through of the Key Management Service client interface,
+// which allows for testing.
+type KMS interface {
+	DescribeKey(*kms.DescribeKeyInput) (*kms.DescribeKeyOutput, error)
+}
+
 // EC2Metadata is an abstraction over the AWS metadata service.
 type EC2Metadata interface {
 	// Query the EC2 metadata service (used to discover instance-id etc)
@@ -370,6 +378,7 @@ type Cloud struct {
 	ec2      EC2
 	elb      ELB
 	asg      ASG
+	kms      KMS
 	metadata EC2Metadata
 	cfg      *CloudConfig
 	region   string
@@ -568,6 +577,20 @@ func (p *awsSDKProvider) Metadata() (EC2Metadata, error) {
 	return client, nil
 }
 
+func (p *awsSDKProvider) KeyManagement(regionName string) (KMS, error) {
+	awsConfig := &aws.Config{
+		Region:      &regionName,
+		Credentials: p.creds,
+	}
+	awsConfig = awsConfig.WithCredentialsChainVerboseErrors(true)
+
+	kmsClient := kms.New(session.New(awsConfig))
+
+	p.addHandlers(regionName, &kmsClient.Handlers)
+
+	return kmsClient, nil
+}
+
 // stringPointerArray creates a slice of string pointers from a slice of strings
 // Deprecated: consider using aws.StringSlice - but note the slightly different behaviour with a nil input
 func stringPointerArray(orig []string) []*string {
@@ -877,11 +900,17 @@ func newAWSCloud(config io.Reader, awsServices Services) (*Cloud, error) {
 		return nil, fmt.Errorf("error creating AWS autoscaling client: %v", err)
 	}
 
+	kms, err := awsServices.KeyManagement(regionName)
+	if err != nil {
+		return nil, fmt.Errorf("error creating AWS key management client: %v", err)
+	}
+
 	awsCloud := &Cloud{
 		ec2:      ec2,
 		elb:      elb,
 		asg:      asg,
 		metadata: metadata,
+		kms:      kms,
 		cfg:      cfg,
 		region:   regionName,
 
@@ -1788,6 +1817,14 @@ func (c *Cloud) CreateDisk(volumeOptions *VolumeOptions) (KubernetesVolumeID, er
 	request.VolumeType = aws.String(createType)
 	request.Encrypted = aws.Bool(volumeOptions.Encrypted)
 	if len(volumeOptions.KmsKeyId) > 0 {
+		if missing, err := c.checkEncryptionKey(volumeOptions.KmsKeyId); err != nil {
+			if missing {
+				// KSM key is missing, provisioning would fail
+				return "", err
+			}
+			// Log checkEncryptionKey error and try provisioning anyway.
+			glog.Warningf("Cannot check KSM key %s: %v", volumeOptions.KmsKeyId, err)
+		}
 		request.KmsKeyId = aws.String(volumeOptions.KmsKeyId)
 		request.Encrypted = aws.Bool(true)
 	}
@@ -1819,6 +1856,23 @@ func (c *Cloud) CreateDisk(volumeOptions *VolumeOptions) (KubernetesVolumeID, er
 	return volumeName, nil
 }
 
+// checkEncryptionKey tests that given encryption key exists.
+func (c *Cloud) checkEncryptionKey(keyId string) (missing bool, err error) {
+	input := &kms.DescribeKeyInput{
+		KeyId: aws.String(keyId),
+	}
+	_, err = c.kms.DescribeKey(input)
+	if err == nil {
+		return false, nil
+	}
+	if awsError, ok := err.(awserr.Error); ok {
+		if awsError.Code() == "NotFoundException" {
+			return true, fmt.Errorf("KMS key %s not found: %q", keyId, err)
+		}
+	}
+	return false, fmt.Errorf("Error checking KSM key %s: %q", keyId, err)
+}
+
 // DeleteDisk implements Volumes.DeleteDisk
 func (c *Cloud) DeleteDisk(volumeName KubernetesVolumeID) (bool, error) {
 	awsDisk, err := newAWSDisk(c, volumeName)

pkg/cloudprovider/providers/aws/aws_test.go

@@ -26,6 +26,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/aws/aws-sdk-go/service/elb"
+	"github.com/aws/aws-sdk-go/service/kms"
 
 	"github.com/aws/aws-sdk-go/service/autoscaling"
 	"github.com/golang/glog"
@@ -123,6 +124,7 @@ type FakeAWSServices struct {
 	elb      *FakeELB
 	asg      *FakeASG
 	metadata *FakeMetadata
+	kms      *FakeKMS
 }
 
 func NewFakeAWSServices() *FakeAWSServices {
@@ -132,6 +134,7 @@ func NewFakeAWSServices() *FakeAWSServices {
 	s.elb = &FakeELB{aws: s}
 	s.asg = &FakeASG{aws: s}
 	s.metadata = &FakeMetadata{aws: s}
+	s.kms = &FakeKMS{aws: s}
 
 	s.networkInterfacesMacs = []string{"aa:bb:cc:dd:ee:00", "aa:bb:cc:dd:ee:01"}
 	s.networkInterfacesVpcIDs = []string{"vpc-mac0", "vpc-mac1"}
@@ -179,6 +182,10 @@ func (s *FakeAWSServices) Metadata() (EC2Metadata, error) {
 	return s.metadata, nil
 }
 
+func (s *FakeAWSServices) KeyManagement(region string) (KMS, error) {
+	return s.kms, nil
+}
+
 func TestNewAWSCloud(t *testing.T) {
 	tests := []struct {
 		name string
@@ -511,6 +518,15 @@ func (a *FakeASG) DescribeAutoScalingGroups(*autoscaling.DescribeAutoScalingGrou
 	panic("Not implemented")
 }
 
+type FakeKMS struct {
+	aws *FakeAWSServices
+	mock.Mock
+}
+
+func (kms *FakeKMS) DescribeKey(*kms.DescribeKeyInput) (*kms.DescribeKeyOutput, error) {
+	panic("Not implemented")
+}
+
 func mockInstancesResp(selfInstance *ec2.Instance, instances []*ec2.Instance) (*Cloud, *FakeAWSServices) {
 	awsServices := NewFakeAWSServices()
 	awsServices.instances = instances

vendor/BUILD

@@ -38,6 +38,7 @@ filegroup(
         "//vendor/github.com/aws/aws-sdk-go/service/ec2:all-srcs",
         "//vendor/github.com/aws/aws-sdk-go/service/ecr:all-srcs",
         "//vendor/github.com/aws/aws-sdk-go/service/elb:all-srcs",
+        "//vendor/github.com/aws/aws-sdk-go/service/kms:all-srcs",
         "//vendor/github.com/aws/aws-sdk-go/service/route53:all-srcs",
         "//vendor/github.com/aws/aws-sdk-go/service/sts:all-srcs",
         "//vendor/github.com/beorn7/perks/quantile:all-srcs",

vendor/github.com/aws/aws-sdk-go/service/kms/BUILD

+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "api.go",
+        "service.go",
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//vendor/github.com/aws/aws-sdk-go/aws:go_default_library",
+        "//vendor/github.com/aws/aws-sdk-go/aws/awsutil:go_default_library",
+        "//vendor/github.com/aws/aws-sdk-go/aws/client:go_default_library",
+        "//vendor/github.com/aws/aws-sdk-go/aws/client/metadata:go_default_library",
+        "//vendor/github.com/aws/aws-sdk-go/aws/request:go_default_library",
+        "//vendor/github.com/aws/aws-sdk-go/aws/signer/v4:go_default_library",
+        "//vendor/github.com/aws/aws-sdk-go/private/protocol:go_default_library",
+        "//vendor/github.com/aws/aws-sdk-go/private/protocol/jsonrpc:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+    visibility = ["//visibility:public"],
+)

vendor/github.com/aws/aws-sdk-go/service/kms/service.go

+// THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT.
+
+package kms
+
+import (
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/client"
+	"github.com/aws/aws-sdk-go/aws/client/metadata"
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/aws/signer/v4"
+	"github.com/aws/aws-sdk-go/private/protocol/jsonrpc"
+)
+
+// AWS Key Management Service (AWS KMS) is an encryption and key management
+// web service. This guide describes the AWS KMS operations that you can call
+// programmatically. For general information about AWS KMS, see the AWS Key
+// Management Service Developer Guide (http://docs.aws.amazon.com/kms/latest/developerguide/).
+//
+// AWS provides SDKs that consist of libraries and sample code for various programming
+// languages and platforms (Java, Ruby, .Net, iOS, Android, etc.). The SDKs
+// provide a convenient way to create programmatic access to AWS KMS and other
+// AWS services. For example, the SDKs take care of tasks such as signing requests
+// (see below), managing errors, and retrying requests automatically. For more
+// information about the AWS SDKs, including how to download and install them,
+// see Tools for Amazon Web Services (http://aws.amazon.com/tools/).
+//
+// We recommend that you use the AWS SDKs to make programmatic API calls to
+// AWS KMS.
+//
+// Clients must support TLS (Transport Layer Security) 1.0. We recommend TLS
+// 1.2. Clients must also support cipher suites with Perfect Forward Secrecy
+// (PFS) such as Ephemeral Diffie-Hellman (DHE) or Elliptic Curve Ephemeral
+// Diffie-Hellman (ECDHE). Most modern systems such as Java 7 and later support
+// these modes.
+//
+// Signing Requests
+//
+// Requests must be signed by using an access key ID and a secret access key.
+// We strongly recommend that you do not use your AWS account (root) access
+// key ID and secret key for everyday work with AWS KMS. Instead, use the access
+// key ID and secret access key for an IAM user, or you can use the AWS Security
+// Token Service to generate temporary security credentials that you can use
+// to sign requests.
+//
+// All AWS KMS operations require Signature Version 4 (http://docs.aws.amazon.com/general/latest/gr/signature-version-4.html).
+//
+// Logging API Requests
+//
+// AWS KMS supports AWS CloudTrail, a service that logs AWS API calls and related
+// events for your AWS account and delivers them to an Amazon S3 bucket that
+// you specify. By using the information collected by CloudTrail, you can determine
+// what requests were made to AWS KMS, who made the request, when it was made,
+// and so on. To learn more about CloudTrail, including how to turn it on and
+// find your log files, see the AWS CloudTrail User Guide (http://docs.aws.amazon.com/awscloudtrail/latest/userguide/).
+//
+// Additional Resources
+//
+// For more information about credentials and request signing, see the following:
+//
+//    * AWS Security Credentials (http://docs.aws.amazon.com/general/latest/gr/aws-security-credentials.html)
+//    - This topic provides general information about the types of credentials
+//    used for accessing AWS.
+//
+//    * Temporary Security Credentials (http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html)
+//    - This section of the IAM User Guide describes how to create and use temporary
+//    security credentials.
+//
+//    * Signature Version 4 Signing Process (http://docs.aws.amazon.com/general/latest/gr/signature-version-4.html)
+//    - This set of topics walks you through the process of signing a request
+//    using an access key ID and a secret access key.
+//
+// Commonly Used APIs
+//
+// Of the APIs discussed in this guide, the following will prove the most useful
+// for most applications. You will likely perform actions other than these,
+// such as creating keys and assigning policies, by using the console.
+//
+//    * Encrypt
+//
+//    * Decrypt
+//
+//    * GenerateDataKey
+//
+//    * GenerateDataKeyWithoutPlaintext
+// The service client's operations are safe to be used concurrently.
+// It is not safe to mutate any of the client's properties though.
+// Please also see https://docs.aws.amazon.com/goto/WebAPI/kms-2014-11-01
+type KMS struct {
+	*client.Client
+}
+
+// Used for custom client initialization logic
+var initClient func(*client.Client)
+
+// Used for custom request initialization logic
+var initRequest func(*request.Request)
+
+// Service information constants
+const (
+	ServiceName = "kms"       // Service endpoint prefix API calls made to.
+	EndpointsID = ServiceName // Service ID for Regions and Endpoints metadata.
+)
+
+// New creates a new instance of the KMS client with a session.
+// If additional configuration is needed for the client instance use the optional
+// aws.Config parameter to add your extra config.
+//
+// Example:
+//     // Create a KMS client from just a session.
+//     svc := kms.New(mySession)
+//
+//     // Create a KMS client with additional configuration
+//     svc := kms.New(mySession, aws.NewConfig().WithRegion("us-west-2"))
+func New(p client.ConfigProvider, cfgs ...*aws.Config) *KMS {
+	c := p.ClientConfig(EndpointsID, cfgs...)
+	return newClient(*c.Config, c.Handlers, c.Endpoint, c.SigningRegion, c.SigningName)
+}
+
+// newClient creates, initializes and returns a new service client instance.
+func newClient(cfg aws.Config, handlers request.Handlers, endpoint, signingRegion, signingName string) *KMS {
+	svc := &KMS{
+		Client: client.New(
+			cfg,
+			metadata.ClientInfo{
+				ServiceName:   ServiceName,
+				SigningName:   signingName,
+				SigningRegion: signingRegion,
+				Endpoint:      endpoint,
+				APIVersion:    "2014-11-01",
+				JSONVersion:   "1.1",
+				TargetPrefix:  "TrentService",
+			},
+			handlers,
+		),
+	}
+
+	// Handlers
+	svc.Handlers.Sign.PushBackNamed(v4.SignRequestHandler)
+	svc.Handlers.Build.PushBackNamed(jsonrpc.BuildHandler)
+	svc.Handlers.Unmarshal.PushBackNamed(jsonrpc.UnmarshalHandler)
+	svc.Handlers.UnmarshalMeta.PushBackNamed(jsonrpc.UnmarshalMetaHandler)
+	svc.Handlers.UnmarshalError.PushBackNamed(jsonrpc.UnmarshalErrorHandler)
+
+	// Run custom client initialization if present
+	if initClient != nil {
+		initClient(svc.Client)
+	}
+
+	return svc
+}
+
+// newRequest creates a new request for a KMS operation and runs any
+// custom request initialization.
+func (c *KMS) newRequest(op *request.Operation, params, data interface{}) *request.Request {
+	req := c.NewRequest(op, params, data)
+
+	// Run custom request initialization if present
+	if initRequest != nil {
+		initRequest(req)
+	}
+
+	return req
+}