sqs-notify

#!/bin/bash

set -e

# readonly resourcetier="$1"
# readonly sqs_queue_url="$2"
# readonly host1="$3"
# readonly host2="$4"
# readonly ttl_mins="15m"
readonly DEFAULT_resourcetier="$TF_VAR_resourcetier"
readonly DEFAULT_USE_LIMIT="4"
readonly DEFAULT_TTL_MINS="30m"
readonly VAULT_ADDR=https://vault.service.consul:8200
# readonly append_json="{}"

function print_usage {
  echo
  echo "Usage: sqs-notify [OPTIONS]"
  echo
  echo "This script can be used to send a message to an sqs queue with credentials to make a vault request.  SSH access to a vault client is required."
  echo
  # echo "Options:"
  # echo
  # echo -e "  --version\t\tThe version of Vault to install. Optional if download-url is provided."
  # echo -e "  --download-url\t\tUrl to exact Vault package to be installed. Optional if version is provided."
  # echo -e "  --path\t\tThe path where Vault should be installed. Optional. Default: $DEFAULT_INSTALL_PATH."
  # echo -e "  --user\t\tThe user who will own the Vault install directories. Optional. Default: $DEFAULT_VAULT_USER."
  echo
  echo "Example:"
  echo
  echo "  sqs-notify --sqs-queue-url https://mysqsurl --host1 centos@hostname1 --host2 centos@hostname2 --token-policy deadline_client --token-use-limit 4"
}

function log {
  local -r level="$1"
  local -r message="$2"
  local -r timestamp=$(date +"%Y-%m-%d %H:%M:%S")
  >&2 echo -e "${timestamp} [${level}] [$SCRIPT_NAME] ${message}"
}

function log_info {
  local -r message="$1"
  log "INFO" "$message"
}

function log_warn {
  local -r message="$1"
  log "WARN" "$message"
}

function log_error {
  local -r message="$1"
  log "ERROR" "$message"
}

function error_if_empty {
  if [[ -z "$2" ]]; then
    log_error "$1"
    print_usage
    exit 1
  fi
  return
}

function assert_not_empty {
  local -r arg_name="$1"
  local -r arg_value="$2"

  if [[ -z "$arg_value" ]]; then
    log_error "The value for '$arg_name' cannot be empty"
    print_usage
    exit 1
  fi
}

function assert_either_or {
  local -r arg1_name="$1"
  local -r arg1_value="$2"
  local -r arg2_name="$3"
  local -r arg2_value="$4"

  if [[ -z "$arg1_value" && -z "$arg2_value" ]]; then
    log_error "Either the value for '$arg1_name' or '$arg2_name' must be passed, both cannot be empty"
    print_usage
    exit 1
  fi
}

function purge_queue {
  local -r sqs_queue_url="$1"

  # If only one message, drain it.
  local queue_msgs
  queue_msgs="$(aws sqs get-queue-attributes --queue-url $sqs_queue_url --attribute-names ApproximateNumberOfMessages | jq -r '.Attributes.ApproximateNumberOfMessages')"
  if [[ "$queue_msgs" -eq 1 ]]; then 
    log "...Draining single existing message in queue."
    local msg
    msg="$(aws sqs receive-message --queue-url $sqs_queue_url)"
    if [[ ! -z "$msg" ]]; then
      log "...Get Receipt handle from msg: $msg"
      local reciept_handle
      reciept_handle="$(echo "$msg" | jq -r '.Messages[] | .ReceiptHandle')"
      
      output=$(aws sqs delete-message --queue-url $sqs_queue_url --receipt-handle $reciept_handle) && exit_status=0 || exit_status=$?

      if [[ $exit_status -eq 0 ]]; then
        log "Message deleted. output: $output"
      else
        log "Failed to delete message. reciept_handle: $reciept_handle" # see https://github.com/aws/aws-sdk-js/issues/1279 and https://github.com/aws/aws-sdk-java/issues/705#issuecomment-240207306
      fi
    fi
  fi

  # If queue still contains messages, purge.

  queue_msgs="$(aws sqs get-queue-attributes --queue-url $sqs_queue_url --attribute-names ApproximateNumberOfMessages | jq -r '.Attributes.ApproximateNumberOfMessages')"
  if [[ ! "$queue_msgs" -eq 0 ]]; then 
    log "...Purge multiple existing messages in queue."
    aws sqs purge-queue --queue-url $sqs_queue_url
    echo "...Waiting 60 seconds to purge queue of old data. ApproximateNumberOfMessages: $queue_msgs"
    sleep 60
  fi
}

# This would need to be appended.
  # "openvpn_admin_pw" : $openvpn_admin_pw, 
# openvpn_admin_pw="$(vault kv get -field=value -address="$VAULT_ADDR" -format=json $resourcetier/network/openvpn_admin_pw)"

function construct_message {
  local -r host1="$1"
  local -r host2="$2"
  local -r token="$3"
  local -r ttl_mins="$4"
  local -r append_json="$5"

  message_content="$(cat <<EOF
{
  "host1" : "$host1",
  "host2" : "$host2",
  "token" : "$token"
}
EOF
)"
  message_content=$(echo $message_content | jq ". + $append_json")

  echo "$message_content"
}

function main {
  local resourcetier="$DEFAULT_resourcetier"
  local sqs_queue_url=""
  local host1=""
  local host2=""
  local append_json="{}"
  local ttl_mins="$DEFAULT_TTL_MINS"
  local use_limit="$DEFAULT_USE_LIMIT"
  local purge_only="false"

  while [[ $# > 0 ]]; do
    local key="$1"

    case "$key" in
      --resourcetier)
        resourcetier="$2"
        shift
        ;;
      --sqs-queue-url)
        sqs_queue_url="$2"
        shift
        ;;
      --host1)
        host1="$2"
        shift
        ;;
      --host2)
        host2="$2"
        shift
        ;;
      --append-json)
        append_json="$2"
        shift
        ;;
      --token) # provide either token, or policy.
        token="$2"
        shift
        ;;
      --token-policy) # if policy is used, you must have permission to create a token with the provided policy.
        token_policy="$2"
        shift
        ;;
      --token-use-limit) # the default use limit is adequate for a single host to request a deadline certificate as an example.  Some operations may require a higher use limit.
        use_limit="$2"
        shift
        ;;
      --purge-only)
        purge_only="true"
        ;;
      --help)
        print_usage
        exit
        ;;
      *)
        log_error "Unrecognized argument: $key"
        print_usage
        exit 1
        ;;
    esac

    shift
  done

  assert_not_empty "--sqs-queue-url" "$sqs_queue_url"

  if [[ "$purge_only" == "true" ]]; then
    purge_queue "$sqs_queue_url"
  else
    error_if_empty "Argument resourcetier or env var TF_VAR_resourcetier not provided" "$resourcetier"
    assert_not_empty "--host1" "$host1"
    assert_not_empty "--host2" "$host2"
    assert_either_or "--token" "$token" "--token-policy" "$token_policy"

    purge_queue "$sqs_queue_url"

    # printf "\n...Waiting for consul vpn service before attempting SQS notify.\n\n"
    # until consul catalog services | grep -m 1 "vpn"; do sleep 10 ; done

    echo ""
    echo "...Using SQS queue to notify remote clients of credential endpoint.  SSH certs must be configured to use the endpoint."
    echo "host1: $host1"
    echo "host2: $host2"
    echo ""

    if [[ ! -z "$token_policy" ]]; then # if token policy was provided, generate a token, else token must have been provided
      token="$(vault token create -address="$VAULT_ADDR" -policy=$token_policy -explicit-max-ttl=$ttl_mins -ttl=$ttl_mins -use-limit=$use_limit -field=token)"
    fi

    message_content="$(construct_message "$host1" "$host2" "$token" "$ttl_mins" "$append_json")"

    aws sqs send-message --queue-url $sqs_queue_url --message-body "$message_content" --message-group-id "$resourcetier"
  fi
}

main "$@"