WIP: Update UI to Support Explicit AWS Credential Types #5139
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Support the new explicit credential types in roles
To do:
* [ ] Update entry of role_arns and policy_arns to be a real list, rather
than expecting users to enter them in comma-separated
* [ ] Some sort of handling of no policy_document since iam_user
and assumed_role don't need it. Right now it looks like it always
tries to add an empty json doc (`{}`)
* [ ] Eliminate distinction between generate IAM creds and STS creds
* [ ] Fix weird bug where the role offers to "Generate Certificate" in
the popup
The UI code doesn't seem to want to gracefully handle the case of an
empty JSON string, and instead wants to handle `{}`. Because that is
never a valid AWS policy document, when it is passed in, treat it as
unsetting the policy_document variable.
Merged
|
@joelthompson I tried pushing to this branch, but was unable to (is that something GH allows? I'm not certain...) - either way, for now I pushed up #5193 - thanks for starting on this! We'll be testing that manually later today - the story around testing the various 3rd party engines is a bit sad now, but it's something we plan to make better and run like we do with the rest of the tests currently. |
|
Huh, I do have the "Allow edits from maintainers" checked... oh well, thanks for finishing the swing on this! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
UI support for #4360 -- because it contains some backwards incompatibilities in reading role data, the UI no longer works to manage roles. It can be used for creating roles and generating credentials, but not viewing role details, and editing the role looks ugly as well.
Definitely need some help if I'm going to finish the swing on this, UI work isn't my forte (I'm much more comfortable digging around the nitty gritty details of crypto code...).
I'm sure there's a lot I'm going wrong, but the current list of bugs I'm aware of are:
credential_typedoesn't get recognized. That's becausecredential_typeis a bit weird. It gets set as a singular value, but read out as a list, ascredential_typesfor backwards compatibility reasons (see the discussion starting at RFC on Refactor of AWS Secret Backend #4229 (comment) for more details on the why). I'm not sure how to make a Handlebars helper in an Ember app to implement some sort of ArrayContains method).role_arnsitems don't get saved when I try to update them.policy_arnsis entered as a comma-separated value, but it should be a real list. Waiting to figure out the previous item before tackling this one.discarding changes. This doesn't seem like the right behavior.