secrets2env.py

#!/usr/bin/env python
import argparse
import json
import re

import boto3
import yaml


class SecretsManagerClient(object):
    """Facilitates retrieving and decoding AWS Secrets, currently onlysupports `SecretString`."""
    def __init__(self):
        boto3.setup_default_session()
        self.client = boto3.client('secretsmanager')

    def _get_secret(self, secret_name):
        return self.client.get_secret_value(SecretId=secret_name)

    def get_secret_value(self, secret_name):
        return json.loads(self._get_secret(secret_name)['SecretString'])


class EnvironmentGenerator(object):
    """
    Loads a YAML definition mapping AWS secrets to environment variables,
    and with provided secrets, it renders the environment to STDOUT which can
    be `eval`d or redirected into an env file to be sourced.
    """
    # IEEE Std 1003.1-2001 - http://pubs.opengroup.org/onlinepubs/000095399/basedefs/xbd_chap08.html
    _name_regex = re.compile(r'^[_A-Z]{1}[_A-Z]*$')

    def __init__(self, path_to_definition='./aws-secrets.yml'):
        self.definition_file = path_to_definition

        with open(self.definition_file, 'r') as f:
            self.definition = yaml.safe_load(f.read())

        # make sure environment variable names are valid
        for definition in self.definition:
            assert self._name_regex.match(definition.get('name', '')) is not None, (
                'invalid environment variable name in {}'.format(definition)
            )

    @property
    def required_secrets(self):
        """Return a set of secret names present in definition file."""
        return set([definition['secret'] for definition in self.definition])

    def generate_environment(self, secrets):
        """Format values with provided secrets and generate environment."""
        lines = ['# Autogenerated by {}'.format(__file__)]
        for definition in self.definition:
            secret = secrets[definition['secret']]
            name = definition['name']
            value = definition['value'].format(**secret)

            line = 'export {}=\'{}\''.format(name, value)
            lines.append(line)

        return '\n'.join(lines)


def run():
    parser = argparse.ArgumentParser(description='Generate environment variables from AWS Secrets')
    parser.add_argument(
        '--definition', type=str, default='./aws-secrets.yml', metavar='PATH', help='Path to definition YAML',
    )
    args = parser.parse_args()

    env_generator = EnvironmentGenerator(path_to_definition=args.definition)
    smc = SecretsManagerClient()
    secrets = {name: smc.get_secret_value(name) for name in env_generator.required_secrets}
    print(env_generator.generate_environment(secrets))


if __name__ == '__main__':
    run()