Skip to content

Commit 7f314be

Browse files
danotorreydanotorrey
authored
Add AWS Kinesis input permission checks (#26878)
* Add needed AWS Kinesis input permission checks * Add change log * Add CloudTrailResource permissions
1 parent 0271892 commit 7f314be

4 files changed

Lines changed: 20 additions & 10 deletions

File tree

‎changelog/unreleased/pr-26878.toml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
type = "fixed"
2+
message = "Added needed input create permissions checks for the AWS CloudWatch and Kinesis input API endpoints."
3+
4+
pulls = ["26878"]

‎graylog2-server/src/main/java/org/graylog/aws/inputs/cloudtrail/api/CloudTrailResource.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
import org.apache.shiro.authz.annotation.RequiresAuthentication;
3737
import org.apache.shiro.authz.annotation.RequiresPermissions;
3838
import org.graylog.aws.AWS;
39+
import org.graylog.aws.inputs.cloudtrail.CloudTrailInput;
3940
import org.graylog.aws.inputs.cloudtrail.api.requests.CloudTrailCreateInputRequest;
4041
import org.graylog.aws.inputs.cloudtrail.api.requests.CloudTrailRequestImpl;
4142
import org.graylog.integrations.audit.IntegrationsAuditEventTypes;
@@ -72,6 +73,7 @@ public CloudTrailResource(MessageInputFactory messageInputFactory, CloudTrailDri
7273
@Path("/check_credentials")
7374
@Operation(summary = "Validate input credentials")
7475
@NoAuditEvent("This does not change any data")
76+
@RequiresPermissions({RestPermissions.INPUTS_CREATE, RestPermissions.INPUT_TYPES_CREATE + ":" + CloudTrailInput.TYPE})
7577
public String checkCredentials(@RequestBody(required = true)
7678
@Valid @NotNull CloudTrailRequestImpl request) throws Exception {
7779
return cloudTrailDriver.checkCredentials(request);
@@ -80,6 +82,7 @@ public String checkCredentials(@RequestBody(required = true)
8082
@GET
8183
@Path("/getawsregions")
8284
@Operation(summary = "Get all available AWS regions")
85+
@RequiresPermissions({RestPermissions.INPUTS_CREATE, RestPermissions.INPUT_TYPES_CREATE + ":" + CloudTrailInput.TYPE})
8386
public Map<String, String> getAWSRegions() {
8487
return AWS.buildRegionChoices();
8588
}
@@ -89,7 +92,7 @@ public Map<String, String> getAWSRegions() {
8992
@Path("/inputs")
9093
@Operation(summary = "Create a new CloudTrail input")
9194
@AuditEvent(type = IntegrationsAuditEventTypes.AWS_CLOUDTRAIL_INPUT_CREATE)
92-
@RequiresPermissions({RestPermissions.INPUTS_CREATE, RestPermissions.INPUT_TYPES_CREATE + ":org.graylog.aws.inputs.cloudtrail.CloudTrailInput"})
95+
@RequiresPermissions({RestPermissions.INPUTS_CREATE, RestPermissions.INPUT_TYPES_CREATE + ":" + CloudTrailInput.TYPE})
9396
public Response create(@Parameter @QueryParam("setup_wizard") @DefaultValue("false") boolean isSetupWizard,
9497
@RequestBody(required = true)
9598
@Valid @NotNull CloudTrailCreateInputRequest request) throws Exception {

‎graylog2-server/src/main/java/org/graylog/integrations/aws/resources/AWSResource.java‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
import org.apache.shiro.authz.annotation.RequiresPermissions;
4343
import org.graylog.integrations.audit.IntegrationsAuditEventTypes;
4444
import org.graylog.integrations.aws.AWSPermissions;
45+
import org.graylog.integrations.aws.inputs.AWSInput;
4546
import org.graylog.integrations.aws.resources.requests.AWSInputCreateRequest;
4647
import org.graylog.integrations.aws.resources.requests.AWSRequestImpl;
4748
import org.graylog.integrations.aws.resources.requests.KinesisRequest;
@@ -89,7 +90,7 @@ public AWSResource(AWSService awsService, KinesisService kinesisService, CloudWa
8990
@Timed
9091
@Path("/regions")
9192
@Operation(summary = "Get all available AWS regions")
92-
@RequiresPermissions(AWSPermissions.AWS_READ)
93+
@RequiresPermissions({AWSPermissions.AWS_READ, RestPermissions.INPUTS_CREATE, RestPermissions.INPUT_TYPES_CREATE + ":" + AWSInput.TYPE})
9394
public RegionsResponse getAwsRegions() {
9495
return awsService.getAvailableRegions();
9596
}
@@ -98,7 +99,7 @@ public RegionsResponse getAwsRegions() {
9899
@Timed
99100
@Path("/cloudwatch/log_groups")
100101
@Operation(summary = "Get all available AWS CloudWatch log groups names for the specified region.")
101-
@RequiresPermissions(AWSPermissions.AWS_READ)
102+
@RequiresPermissions({AWSPermissions.AWS_READ, RestPermissions.INPUTS_CREATE, RestPermissions.INPUT_TYPES_CREATE + ":" + AWSInput.TYPE})
102103
@NoAuditEvent("This does not change any data")
103104
public LogGroupsResponse getLogGroupNames(@RequestBody(required = true) @Valid @NotNull AWSRequestImpl request) {
104105
return cloudWatchService.getLogGroupNames(request);
@@ -108,7 +109,7 @@ public LogGroupsResponse getLogGroupNames(@RequestBody(required = true) @Valid @
108109
@Timed
109110
@Path("/kinesis/streams")
110111
@Operation(summary = "Get all available Kinesis streams for the specified region.")
111-
@RequiresPermissions(AWSPermissions.AWS_READ)
112+
@RequiresPermissions({AWSPermissions.AWS_READ, RestPermissions.INPUTS_CREATE, RestPermissions.INPUT_TYPES_CREATE + ":" + AWSInput.TYPE})
112113
@NoAuditEvent("This does not change any data")
113114
public StreamsResponse getKinesisStreams(@RequestBody(required = true) @Valid @NotNull AWSRequestImpl request) throws ExecutionException {
114115
return kinesisService.getKinesisStreamNames(request);
@@ -118,7 +119,7 @@ public StreamsResponse getKinesisStreams(@RequestBody(required = true) @Valid @N
118119
@Timed
119120
@Path("/kinesis/stream_arn")
120121
@Operation(summary = "Get stream ARN for the specified stream and region.")
121-
@RequiresPermissions(AWSPermissions.AWS_READ)
122+
@RequiresPermissions({AWSPermissions.AWS_READ, RestPermissions.INPUTS_CREATE, RestPermissions.INPUT_TYPES_CREATE + ":" + AWSInput.TYPE})
122123
@NoAuditEvent("This does not change any data")
123124
public Response getStreamArn(@RequestBody(required = true) @Valid @NotNull KinesisRequest request) {
124125
String response;
@@ -140,7 +141,7 @@ public Response getStreamArn(@RequestBody(required = true) @Valid @NotNull Kines
140141
@ApiResponse(responseCode = "202", description = "AWS log retrieval health check completed successfully",
141142
content = @Content(schema = @Schema(implementation = KinesisHealthCheckResponse.class)))
142143
})
143-
@RequiresPermissions(AWSPermissions.AWS_READ)
144+
@RequiresPermissions({AWSPermissions.AWS_READ, RestPermissions.INPUTS_CREATE, RestPermissions.INPUT_TYPES_CREATE + ":" + AWSInput.TYPE})
144145
@NoAuditEvent("This does not change any data")
145146
public Response kinesisHealthCheck(@RequestBody(required = true) @Valid @NotNull KinesisRequest heathCheckRequest) throws ExecutionException, IOException {
146147

@@ -153,7 +154,7 @@ public Response kinesisHealthCheck(@RequestBody(required = true) @Valid @NotNull
153154
@Path("/inputs")
154155
@Operation(summary = "Create a new AWS input.")
155156
@AuditEvent(type = IntegrationsAuditEventTypes.KINESIS_INPUT_CREATE)
156-
@RequiresPermissions({RestPermissions.INPUTS_CREATE, RestPermissions.INPUT_TYPES_CREATE + ":org.graylog.integrations.aws.inputs.AWSInput"})
157+
@RequiresPermissions({RestPermissions.INPUTS_CREATE, RestPermissions.INPUT_TYPES_CREATE + ":" + AWSInput.TYPE})
157158
public Response create(@Parameter @QueryParam("setup_wizard") @DefaultValue("false") boolean isSetupWizard,
158159
@RequestBody(required = true)
159160
@Valid @NotNull AWSInputCreateRequest saveRequest) throws Exception {

‎graylog2-server/src/main/java/org/graylog/integrations/aws/resources/KinesisSetupResource.java‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
import org.apache.shiro.authz.annotation.RequiresPermissions;
3333
import org.graylog.integrations.audit.IntegrationsAuditEventTypes;
3434
import org.graylog.integrations.aws.AWSPermissions;
35+
import org.graylog.integrations.aws.inputs.AWSInput;
3536
import org.graylog.integrations.aws.resources.requests.CreateLogSubscriptionRequest;
3637
import org.graylog.integrations.aws.resources.requests.CreateRolePermissionRequest;
3738
import org.graylog.integrations.aws.resources.requests.KinesisNewStreamRequest;
@@ -44,6 +45,7 @@
4445
import org.graylog2.plugin.database.users.User;
4546
import org.graylog2.plugin.rest.PluginRestResource;
4647
import org.graylog2.shared.rest.resources.RestResource;
48+
import org.graylog2.shared.security.RestPermissions;
4749
import org.slf4j.Logger;
4850
import org.slf4j.LoggerFactory;
4951

@@ -72,7 +74,7 @@ public KinesisSetupResource(CloudWatchService cloudWatchService, KinesisService
7274
@Timed
7375
@Path("/create_stream")
7476
@Operation(summary = "Step 1: Attempt to create a new kinesis stream and wait for it to be ready.")
75-
@RequiresPermissions(AWSPermissions.AWS_READ)
77+
@RequiresPermissions({AWSPermissions.AWS_READ, RestPermissions.INPUTS_CREATE, RestPermissions.INPUT_TYPES_CREATE + ":" + AWSInput.TYPE})
7678
@AuditEvent(type = IntegrationsAuditEventTypes.KINESIS_SETUP_CREATE_STREAM)
7779
public KinesisNewStreamResponse createNewKinesisStream(@RequestBody(required = true)
7880
@Valid @NotNull KinesisNewStreamRequest request) {
@@ -90,7 +92,7 @@ public KinesisNewStreamResponse createNewKinesisStream(@RequestBody(required = t
9092
@Timed
9193
@Path("/create_subscription_policy")
9294
@Operation(summary = "Step 2: Create AWS IAM policy needed for CloudWatch to write logs to Kinesis")
93-
@RequiresPermissions(AWSPermissions.AWS_READ)
95+
@RequiresPermissions({AWSPermissions.AWS_READ, RestPermissions.INPUTS_CREATE, RestPermissions.INPUT_TYPES_CREATE + ":" + AWSInput.TYPE})
9496
@AuditEvent(type = IntegrationsAuditEventTypes.KINESIS_SETUP_CREATE_POLICY)
9597
public CreateRolePermissionResponse autoKinesisPermissions(@RequestBody(required = true)
9698
@Valid @NotNull CreateRolePermissionRequest request) {
@@ -102,7 +104,7 @@ public CreateRolePermissionResponse autoKinesisPermissions(@RequestBody(required
102104
@Timed
103105
@Path("/create_subscription")
104106
@Operation(summary = "Step 3: Subscribe a Kinesis stream to a CloudWatch log group")
105-
@RequiresPermissions(AWSPermissions.AWS_READ)
107+
@RequiresPermissions({AWSPermissions.AWS_READ, RestPermissions.INPUTS_CREATE, RestPermissions.INPUT_TYPES_CREATE + ":" + AWSInput.TYPE})
106108
@AuditEvent(type = IntegrationsAuditEventTypes.KINESIS_SETUP_CREATE_SUBSCRIPTION)
107109
public CreateLogSubscriptionResponse createSubscription(@RequestBody(required = true)
108110
@Valid @NotNull CreateLogSubscriptionRequest request) {

0 commit comments

Comments
 (0)