Lambda enhancements, environments, secrets and fetch config

[robotdan]

Lambda enhancements, environments, secrets and fetch config

Description

General enhancements.

• Add secret manager similar to GH where you can define one to many environments, and then add secrets to those environments. This should probably just be part of key master?
• Allow a lambda to be assigned a single environment. This allows you to store secrets by the same name in 'dev' and 'prod' and not change your lambda code between the two.
• Allow an API key to be marked as accessible by a lambda, or perhaps just assigned to a single "environment" that then would be available to a lambda.
• Add additional fetch config such as connect and read timeouts.
  • Add connect and read timeout configuration to the fetch request used in a Lambda function #2938
• Other stuff we may be missing?

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

[epbensimpson]

Could be worth thinking about environment variables, e.g. FUSIONAUTH_LAMBDA_MY_VAR? These could then be passed into lambdas via an env argument similar to CloudFlare Module Workers (but with the prefix stripped):

// export FUSIONAUTH_LAMBDA_MY_VAR=foo

function populate(jwt, user, registration, env) {
  jwt.my_claim = env.MY_VAR;
}

Even just making tenant.data available to the lambda would be an improvement.

Our use case: As we're working on multi-region auth, I was looking to add a region claim to the JWT and hoped we could just add a region property to tenant.data and access that in the lambda, but it seems like that's not currently possible.

[mooreds]

Hiya @epbensimpson!

You can pull tenant data via lambda HTTP connect: https://fusionauth.io/docs/v1/tech/lambdas/#using-lambda-http-connect as long as your plan allows access to that feature.

There's an example in that doc about pulling group data vai API, but you could do the same with tenant data. Of course, you have a 'turtles all the way down' issue because you then have to have an API key embedded in the lambda. :)

[epbensimpson]

Hiya @epbensimpson!

You can pull tenant data via lambda HTTP connect: https://fusionauth.io/docs/v1/tech/lambdas/#using-lambda-http-connect as long as your plan allows access to that feature.

There's an example in that doc about pulling group data vai API, but you could do the same with tenant data. Of course, you have a 'turtles all the way down' issue because you then have to have an API key embedded in the lambda. :)

Yeah we don't really want an API key embedded in it, in this case seeing as the value is not sensitive we just replace a placeholder string like {REGION} in the template with the appropriate value before deploying.

[robotdan]

We have discussed how to optionally leverage environment variables in the context of secret management.

To avoid any security issues, I think we'd like still have to create a "secret" in the "secret manager" and the type just may be environment, this way we can map any environment variable into a secret and then make it accessible in a lambda function but require explicit consent by requiring this mapping part.

At least that is how we have discussed it to date.

So in your example, you'd have an environment variable by any name, for example AWS_REGION=us-east-1, and then in the secret manager we'd define a new secret of type environment with a value of of AWS_REGION and the name could be either inherited (eg. AWS_REGION) or named (eg. REGION).

And then in the lambda function you'd access this value by the configured name - in this case REGION or AWS_REGION.

Since lambda functions have named arguments, and we also won't know what other named variables could be declared by the lambda author, it may make sense to access secrets via a namespace or function.

For example {secrets['REGION']} or getSecret('REGION'). Hopefully we can get to this before too long, this will make using HTTP requests in lambda much easier.

[marc-enseo]

I added #2356. This is for us to be able to whitelist the Lambda origin when the cloud instance changes IP address since not static IP can be configured.

[robotdan]

Internal:
Let's discuss priority.

[hgrubst]

Any update on this ? Having to store plain text secrets in lambda is really not ideal. So keen to understand how much of a priority this is and if we can expect anything soon.

[mooreds]

@hgrubst thanks for the feedback. Please upvote this too.

This is not currently in our short term plan, but that does change over time based on customer and community feedback. Here's our general roadmap guidance: https://fusionauth.io/docs/operate/roadmap/roadmap

[sareh]

We're using the fusionauth terraform provider and defining our jwt populate lambda like this:

function populate(jwt) {
  const response = fetch(
    "https://<subdomain>.fusionauth.io/api/group",
    {
      method: "GET",
      headers: {
        "Authorization": env.fusionauth_group_endpoint_api_key,
        "Content-Type": "application/json",
      },
    }
  );
  if (response.status === 200) {
    // a successful response as defined in the Groups API
    var jsonResponse = JSON.parse(response.body);
    console.debug(JSON.stringify({ jsonResponse }, null, 2));
    jwt.groups = jsonResponse.groups;
  } else {
    jwt.groups = [];
  }
}

And it is defined like this:

resource "fusionauth_lambda" "gmd_jwt_populate" {
  name  = "GMD JWT Populate"
  type  = "JWTPopulate"
  debug = var.gmd_jwt_populate_lambda_debug_enabled
  body  = file("${path.module}/../../../lambda/jwt-populate/index.js")
}

Comment (blocking): I'd like to be able to pass in an API key as an environment variable to the lambda. This doesn't currently seem possible. What's the best practice?

Optional (non-blocking): Ideally I'd like for the fusionauth_api_key definition to be extended so that in addition to having a tenant_id that the key is scoped to, we can scope it to a set of lambda_ids, e.g. with this syntax:

resource "fusionauth_api_key" "gmd_group_endpoint" {
  tenant_id   = fusionauth_tenant.main.id
  lambda_ids = [fusionauth_lambda.gmd_jwt_populate.id]
  description = "FusionAuth API Key to be used for lambdas associated with this tenant"
  permissions_endpoints {
    endpoint = "/api/group"
    get      = true
    delete   = true
    patch    = true
    post     = true
    put      = true
  }
}

Then this API key would only be used for a specific tenant and for specific lambdas, and the key would be available in the environment configuration for the lambda itself.