| 12 | |
| 13 | |
| 14 | class BlessLambdaCache: |
| 15 | region = None |
| 16 | config = None |
| 17 | ca_private_key_password = None |
| 18 | ca_private_key_password_error = None |
| 19 | |
| 20 | def __init__(self, ca_private_key_password=None, |
| 21 | config_file=None): |
| 22 | """ |
| 23 | |
| 24 | :param ca_private_key_password: For local testing, if the password is provided, skip the KMS |
| 25 | decrypt. |
| 26 | :param config_file: The config file to load the SSH CA private key from, and additional settings. |
| 27 | """ |
| 28 | # AWS Region determines configs related to KMS |
| 29 | if 'AWS_REGION' in os.environ: |
| 30 | self.region = os.environ['AWS_REGION'] |
| 31 | else: |
| 32 | self.region = 'us-west-2' |
| 33 | |
| 34 | # Load the deployment config values |
| 35 | self.config = BlessConfig(self.region, config_file=config_file) |
| 36 | |
| 37 | password_ciphertext_b64 = self.config.getpassword() |
| 38 | |
| 39 | # decrypt ca private key password |
| 40 | if ca_private_key_password is None: |
| 41 | kms_client = boto3.client('kms', region_name=self.region) |
| 42 | try: |
| 43 | ca_password = kms_client.decrypt( |
| 44 | CiphertextBlob=base64.b64decode(password_ciphertext_b64)) |
| 45 | self.ca_private_key_password = ca_password['Plaintext'] |
| 46 | except ClientError as e: |
| 47 | self.ca_private_key_password_error = str(e) |
| 48 | else: |
| 49 | self.ca_private_key_password = ca_private_key_password |
no outgoing calls
no test coverage detected