mirror of
https://github.com/Infisical/infisical.git
synced 2025-07-05 04:29:09 +00:00
Compare commits
10 Commits
daniel/upd
...
infisical/
Author | SHA1 | Date | |
---|---|---|---|
2bd4770fb4 | |||
31905fab6e | |||
784acf16d0 | |||
114b89c952 | |||
81420198cb | |||
0ff18e277f | |||
e093f70301 | |||
8e2ff18f35 | |||
3fbfecf7a9 | |||
9087def21c |
@ -81,11 +81,14 @@ export const getAwsConnectionConfig = async (appConnection: TAwsConnectionConfig
|
|||||||
};
|
};
|
||||||
|
|
||||||
export const validateAwsConnectionCredentials = async (appConnection: TAwsConnectionConfig) => {
|
export const validateAwsConnectionCredentials = async (appConnection: TAwsConnectionConfig) => {
|
||||||
const awsConfig = await getAwsConnectionConfig(appConnection);
|
let resp: AWS.STS.GetCallerIdentityResponse & {
|
||||||
const sts = new AWS.STS(awsConfig);
|
$response: AWS.Response<AWS.STS.GetCallerIdentityResponse, AWS.AWSError>;
|
||||||
let resp: Awaited<ReturnType<ReturnType<typeof sts.getCallerIdentity>["promise"]>>;
|
};
|
||||||
|
|
||||||
try {
|
try {
|
||||||
|
const awsConfig = await getAwsConnectionConfig(appConnection);
|
||||||
|
const sts = new AWS.STS(awsConfig);
|
||||||
|
|
||||||
resp = await sts.getCallerIdentity().promise();
|
resp = await sts.getCallerIdentity().promise();
|
||||||
} catch (e: unknown) {
|
} catch (e: unknown) {
|
||||||
throw new BadRequestError({
|
throw new BadRequestError({
|
||||||
@ -93,7 +96,7 @@ export const validateAwsConnectionCredentials = async (appConnection: TAwsConnec
|
|||||||
});
|
});
|
||||||
}
|
}
|
||||||
|
|
||||||
if (resp.$response.httpResponse.statusCode !== 200)
|
if (resp?.$response.httpResponse.statusCode !== 200)
|
||||||
throw new InternalServerError({
|
throw new InternalServerError({
|
||||||
message: `Unable to validate credentials: ${
|
message: `Unable to validate credentials: ${
|
||||||
resp.$response.error?.message ??
|
resp.$response.error?.message ??
|
||||||
|
BIN
docs/images/app-connections/aws/access-key-create-policy.png
Normal file
BIN
docs/images/app-connections/aws/access-key-create-policy.png
Normal file
Binary file not shown.
After Width: | Height: | Size: 509 KiB |
BIN
docs/images/app-connections/aws/assume-role-create-policy.png
Normal file
BIN
docs/images/app-connections/aws/assume-role-create-policy.png
Normal file
Binary file not shown.
After Width: | Height: | Size: 522 KiB |
@ -9,10 +9,6 @@ Infisical supports two methods for connecting to AWS.
|
|||||||
<Tab title="Assume Role (Recommended)">
|
<Tab title="Assume Role (Recommended)">
|
||||||
Infisical will assume the provided role in your AWS account securely, without the need to share any credentials.
|
Infisical will assume the provided role in your AWS account securely, without the need to share any credentials.
|
||||||
|
|
||||||
**Prerequisites:**
|
|
||||||
|
|
||||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
|
||||||
|
|
||||||
<Accordion title="Self-Hosted Instance">
|
<Accordion title="Self-Hosted Instance">
|
||||||
To connect your self-hosted Infisical instance with AWS, you need to set up an AWS IAM User account that can assume the configured AWS IAM Role.
|
To connect your self-hosted Infisical instance with AWS, you need to set up an AWS IAM User account that can assume the configured AWS IAM Role.
|
||||||
|
|
||||||
@ -47,8 +43,8 @@ Infisical supports two methods for connecting to AWS.
|
|||||||

|

|
||||||
</Step>
|
</Step>
|
||||||
<Step title="Set Up Connection Keys">
|
<Step title="Set Up Connection Keys">
|
||||||
1. Set the access key as **INF_APP_CONNECTION_AWS_CLIENT_ID**.
|
1. Set the access key as **INF_APP_CONNECTION_AWS_ACCESS_KEY_ID**.
|
||||||
2. Set the secret key as **INF_APP_CONNECTION_AWS_CLIENT_SECRET**.
|
2. Set the secret key as **INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY**.
|
||||||
</Step>
|
</Step>
|
||||||
</Steps>
|
</Steps>
|
||||||
</Accordion>
|
</Accordion>
|
||||||
@ -63,7 +59,11 @@ Infisical supports two methods for connecting to AWS.
|
|||||||
4. Optionally, enable **Require external ID** and enter your **Organization ID** to further enhance security.
|
4. Optionally, enable **Require external ID** and enter your **Organization ID** to further enhance security.
|
||||||
</Step>
|
</Step>
|
||||||
|
|
||||||
<Step title="Add Required Permissions for the IAM Role">
|
<Step title="Add Required Permissions to the IAM Role">
|
||||||
|
Navigate to your IAM role permissions and click **Create Inline Policy**.
|
||||||
|
|
||||||
|

|
||||||
|
|
||||||
Depending on your use case, add one or more of the following policies to your IAM Role:
|
Depending on your use case, add one or more of the following policies to your IAM Role:
|
||||||
|
|
||||||
<Tabs>
|
<Tabs>
|
||||||
@ -199,22 +199,13 @@ Infisical supports two methods for connecting to AWS.
|
|||||||
<Tab title="Access Key">
|
<Tab title="Access Key">
|
||||||
Infisical will use the provided **Access Key ID** and **Secret Key** to connect to your AWS instance.
|
Infisical will use the provided **Access Key ID** and **Secret Key** to connect to your AWS instance.
|
||||||
|
|
||||||
**Prerequisites:**
|
|
||||||
|
|
||||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
|
||||||
|
|
||||||
<Steps>
|
<Steps>
|
||||||
<Step title="Create the Managing User IAM Role for Infisical">
|
<Step title="Add Required Permissions to the IAM User">
|
||||||
1. Navigate to the [Create IAM Role](https://console.aws.amazon.com/iamv2/home#/roles/create?step=selectEntities) page in your AWS Console.
|
Navigate to your IAM user permissions and click **Create Inline Policy**.
|
||||||

|
|
||||||
|
|
||||||
2. Select **AWS Account** as the **Trusted Entity Type**.
|

|
||||||
3. Choose **Another AWS Account** and enter **381492033652** (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.
|
|
||||||
4. Optionally, enable **Require external ID** and enter your **Organization ID** to further enhance security.
|
|
||||||
</Step>
|
|
||||||
|
|
||||||
<Step title="Add Required Permissions for the IAM Role">
|
Depending on your use case, add one or more of the following policies to your user:
|
||||||
Depending on your use case, add one or more of the following policies to your IAM Role:
|
|
||||||
|
|
||||||
<Tabs>
|
<Tabs>
|
||||||
<Tab title="Secret Sync">
|
<Tab title="Secret Sync">
|
||||||
|
@ -9,10 +9,6 @@ Infisical supports two methods for connecting to GitHub.
|
|||||||
<Tab title="GitHub App (Recommended)">
|
<Tab title="GitHub App (Recommended)">
|
||||||
Infisical will use a GitHub App with finely grained permissions to connect to GitHub.
|
Infisical will use a GitHub App with finely grained permissions to connect to GitHub.
|
||||||
|
|
||||||
**Prerequisites:**
|
|
||||||
|
|
||||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
|
||||||
|
|
||||||
<Accordion title="Self-Hosted Instance">
|
<Accordion title="Self-Hosted Instance">
|
||||||
Using the GitHub integration with app authentication on a self-hosted instance of Infisical requires configuring an application on GitHub
|
Using the GitHub integration with app authentication on a self-hosted instance of Infisical requires configuring an application on GitHub
|
||||||
and registering your instance with it.
|
and registering your instance with it.
|
||||||
@ -61,9 +57,9 @@ Infisical supports two methods for connecting to GitHub.
|
|||||||
|
|
||||||
- `INF_APP_CONNECTION_GITHUB_APP_CLIENT_ID`: The **Client ID** of your GitHub application.
|
- `INF_APP_CONNECTION_GITHUB_APP_CLIENT_ID`: The **Client ID** of your GitHub application.
|
||||||
- `INF_APP_CONNECTION_GITHUB_APP_CLIENT_SECRET`: The **Client Secret** of your GitHub application.
|
- `INF_APP_CONNECTION_GITHUB_APP_CLIENT_SECRET`: The **Client Secret** of your GitHub application.
|
||||||
- `INF_APP_CONNECTION_GITHUB_APP_CLIENT_SLUG`: The **Slug** of your GitHub application. This is the one found in the URL.
|
- `INF_APP_CONNECTION_GITHUB_APP_SLUG`: The **Slug** of your GitHub application. This is the one found in the URL.
|
||||||
- `INF_APP_CONNECTION_GITHUB_APP_CLIENT_APP_ID`: The **App ID** of your GitHub application.
|
- `INF_APP_CONNECTION_GITHUB_APP_ID`: The **App ID** of your GitHub application.
|
||||||
- `INF_APP_CONNECTION_GITHUB_APP_CLIENT_PRIVATE_KEY`: The **Private Key** of your GitHub application.
|
- `INF_APP_CONNECTION_GITHUB_APP_PRIVATE_KEY`: The **Private Key** of your GitHub application.
|
||||||
|
|
||||||
Once added, restart your Infisical instance and use the GitHub integration via app authentication.
|
Once added, restart your Infisical instance and use the GitHub integration via app authentication.
|
||||||
</Step>
|
</Step>
|
||||||
@ -100,10 +96,6 @@ Infisical supports two methods for connecting to GitHub.
|
|||||||
<Tab title="OAuth">
|
<Tab title="OAuth">
|
||||||
Infisical will use an OAuth App to connect to GitHub.
|
Infisical will use an OAuth App to connect to GitHub.
|
||||||
|
|
||||||
**Prerequisites:**
|
|
||||||
|
|
||||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
|
||||||
|
|
||||||
<Accordion title="Self-Hosted Instance">
|
<Accordion title="Self-Hosted Instance">
|
||||||
Using the GitHub integration on a self-hosted instance of Infisical requires configuring an OAuth application in GitHub
|
Using the GitHub integration on a self-hosted instance of Infisical requires configuring an OAuth application in GitHub
|
||||||
and registering your instance with it.
|
and registering your instance with it.
|
||||||
|
@ -347,16 +347,26 @@
|
|||||||
"group": "App Connections",
|
"group": "App Connections",
|
||||||
"pages": [
|
"pages": [
|
||||||
"integrations/app-connections/overview",
|
"integrations/app-connections/overview",
|
||||||
"integrations/app-connections/aws",
|
{
|
||||||
"integrations/app-connections/github"
|
"group": "Connections",
|
||||||
|
"pages": [
|
||||||
|
"integrations/app-connections/aws",
|
||||||
|
"integrations/app-connections/github"
|
||||||
|
]
|
||||||
|
}
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"group": "Secret Syncs",
|
"group": "Secret Syncs",
|
||||||
"pages": [
|
"pages": [
|
||||||
"integrations/secret-syncs/overview",
|
"integrations/secret-syncs/overview",
|
||||||
"integrations/secret-syncs/aws-parameter-store",
|
{
|
||||||
"integrations/secret-syncs/github"
|
"group": "Syncs",
|
||||||
|
"pages": [
|
||||||
|
"integrations/secret-syncs/aws-parameter-store",
|
||||||
|
"integrations/secret-syncs/github"
|
||||||
|
]
|
||||||
|
}
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
@ -289,34 +289,36 @@ export const SecretSyncsTable = ({ secretSyncs }: Props) => {
|
|||||||
</DropdownMenuTrigger>
|
</DropdownMenuTrigger>
|
||||||
<DropdownMenuContent className="thin-scrollbar max-h-[70vh] overflow-y-auto" align="end">
|
<DropdownMenuContent className="thin-scrollbar max-h-[70vh] overflow-y-auto" align="end">
|
||||||
<DropdownMenuLabel>Status</DropdownMenuLabel>
|
<DropdownMenuLabel>Status</DropdownMenuLabel>
|
||||||
{Object.values(SecretSyncStatus).map((status) => (
|
{[SecretSyncStatus.Running, SecretSyncStatus.Succeeded, SecretSyncStatus.Failed].map(
|
||||||
<DropdownMenuItem
|
(status) => (
|
||||||
onClick={(e) => {
|
<DropdownMenuItem
|
||||||
e.preventDefault();
|
onClick={(e) => {
|
||||||
setFilters((prev) => ({
|
e.preventDefault();
|
||||||
...prev,
|
setFilters((prev) => ({
|
||||||
status: prev.status.includes(status)
|
...prev,
|
||||||
? prev.status.filter((s) => s !== status)
|
status: prev.status.includes(status)
|
||||||
: [...prev.status, status]
|
? prev.status.filter((s) => s !== status)
|
||||||
}));
|
: [...prev.status, status]
|
||||||
}}
|
}));
|
||||||
key={status}
|
}}
|
||||||
icon={
|
key={status}
|
||||||
filters.status.includes(status) && (
|
icon={
|
||||||
<FontAwesomeIcon className="text-primary" icon={faCheckCircle} />
|
filters.status.includes(status) && (
|
||||||
)
|
<FontAwesomeIcon className="text-primary" icon={faCheckCircle} />
|
||||||
}
|
)
|
||||||
iconPos="right"
|
}
|
||||||
>
|
iconPos="right"
|
||||||
<div className="flex items-center gap-2">
|
>
|
||||||
<FontAwesomeIcon
|
<div className="flex items-center gap-2">
|
||||||
icon={STATUS_ICON_MAP[status].icon}
|
<FontAwesomeIcon
|
||||||
className={STATUS_ICON_MAP[status].className}
|
icon={STATUS_ICON_MAP[status].icon}
|
||||||
/>
|
className={STATUS_ICON_MAP[status].className}
|
||||||
<span className="capitalize">{STATUS_ICON_MAP[status].name}</span>
|
/>
|
||||||
</div>
|
<span className="capitalize">{STATUS_ICON_MAP[status].name}</span>
|
||||||
</DropdownMenuItem>
|
</div>
|
||||||
))}
|
</DropdownMenuItem>
|
||||||
|
)
|
||||||
|
)}
|
||||||
<DropdownMenuLabel>Service</DropdownMenuLabel>
|
<DropdownMenuLabel>Service</DropdownMenuLabel>
|
||||||
{secretSyncs.length ? (
|
{secretSyncs.length ? (
|
||||||
[...new Set(secretSyncs.map(({ destination }) => destination))].map((destination) => {
|
[...new Set(secretSyncs.map(({ destination }) => destination))].map((destination) => {
|
||||||
|
@ -4,7 +4,7 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
|
|||||||
import { format } from "date-fns";
|
import { format } from "date-fns";
|
||||||
|
|
||||||
import { ProjectPermissionCan } from "@app/components/permissions";
|
import { ProjectPermissionCan } from "@app/components/permissions";
|
||||||
import { SecretSyncLabel } from "@app/components/secret-syncs";
|
import { SecretSyncLabel, SecretSyncStatusBadge } from "@app/components/secret-syncs";
|
||||||
import { IconButton } from "@app/components/v2";
|
import { IconButton } from "@app/components/v2";
|
||||||
import { ProjectPermissionSub } from "@app/context";
|
import { ProjectPermissionSub } from "@app/context";
|
||||||
import { ProjectPermissionSecretSyncActions } from "@app/context/ProjectPermissionContext/types";
|
import { ProjectPermissionSecretSyncActions } from "@app/context/ProjectPermissionContext/types";
|
||||||
@ -57,6 +57,11 @@ export const SecretSyncDetailsSection = ({ secretSync, onEditDetails }: Props) =
|
|||||||
<div className="space-y-3">
|
<div className="space-y-3">
|
||||||
<SecretSyncLabel label="Name">{name}</SecretSyncLabel>
|
<SecretSyncLabel label="Name">{name}</SecretSyncLabel>
|
||||||
<SecretSyncLabel label="Description">{description}</SecretSyncLabel>
|
<SecretSyncLabel label="Description">{description}</SecretSyncLabel>
|
||||||
|
{syncStatus && (
|
||||||
|
<SecretSyncLabel label="Status">
|
||||||
|
<SecretSyncStatusBadge status={syncStatus} />
|
||||||
|
</SecretSyncLabel>
|
||||||
|
)}
|
||||||
{lastSyncedAt && (
|
{lastSyncedAt && (
|
||||||
<SecretSyncLabel label="Last Synced">
|
<SecretSyncLabel label="Last Synced">
|
||||||
{format(new Date(lastSyncedAt), "yyyy-MM-dd, hh:mm aaa")}
|
{format(new Date(lastSyncedAt), "yyyy-MM-dd, hh:mm aaa")}
|
||||||
|
@ -19,7 +19,7 @@ const schema = z.object({
|
|||||||
environmentName: z
|
environmentName: z
|
||||||
.string()
|
.string()
|
||||||
.min(1, { message: "Environment Name field must be at least 1 character" }),
|
.min(1, { message: "Environment Name field must be at least 1 character" }),
|
||||||
environmentSlug: slugSchema()
|
environmentSlug: slugSchema({ max: 64 })
|
||||||
});
|
});
|
||||||
|
|
||||||
export type FormData = z.infer<typeof schema>;
|
export type FormData = z.infer<typeof schema>;
|
||||||
|
@ -17,7 +17,7 @@ type Props = {
|
|||||||
|
|
||||||
const schema = z.object({
|
const schema = z.object({
|
||||||
name: z.string(),
|
name: z.string(),
|
||||||
slug: slugSchema({ min: 1 })
|
slug: slugSchema({ min: 1, max: 64 })
|
||||||
});
|
});
|
||||||
|
|
||||||
export type FormData = z.infer<typeof schema>;
|
export type FormData = z.infer<typeof schema>;
|
||||||
|
Reference in New Issue
Block a user