Check the entropy pool and seed it with KMS if desired
(config, logger)
| 39 | |
| 40 | |
| 41 | def check_entropy(config, logger): |
| 42 | """ |
| 43 | Check the entropy pool and seed it with KMS if desired |
| 44 | """ |
| 45 | region = os.environ['AWS_REGION'] |
| 46 | kms_client = boto3.client('kms', region_name=region) |
| 47 | entropy_minimum_bits = config.getint(BLESS_OPTIONS_SECTION, ENTROPY_MINIMUM_BITS_OPTION) |
| 48 | random_seed_bytes = config.getint(BLESS_OPTIONS_SECTION, RANDOM_SEED_BYTES_OPTION) |
| 49 | |
| 50 | with open('/proc/sys/kernel/random/entropy_avail', 'r') as f: |
| 51 | entropy = int(f.read()) |
| 52 | logger.debug(entropy) |
| 53 | if entropy < entropy_minimum_bits: |
| 54 | logger.info( |
| 55 | 'System entropy was {}, which is lower than the entropy_' |
| 56 | 'minimum {}. Using KMS to seed /dev/urandom'.format( |
| 57 | entropy, entropy_minimum_bits)) |
| 58 | response = kms_client.generate_random( |
| 59 | NumberOfBytes=random_seed_bytes) |
| 60 | random_seed = response['Plaintext'] |
| 61 | with open('/dev/urandom', 'w') as urandom: |
| 62 | urandom.write(random_seed) |
| 63 | |
| 64 | |
| 65 | def setup_lambda_cache(ca_private_key_password, config_file): |
no outgoing calls
no test coverage detected