CarterPerez-dev
|
7e23f58fbb
|
feat(rotators): AWS Secrets Manager rotator with SigV4 signer + secrets client
SigV4 implementation per AWS reference: canonical request -> string-to-sign
-> HMAC-derived signing key (kSecret -> kDate -> kRegion -> kService ->
kSigning) -> HMAC-SHA256 signature. Includes session token (STS) support.
SecretsManagerClient wraps PutSecretValue, GetSecretValue,
UpdateSecretVersionStage with custom endpoint support (LocalStack).
AWS API errors surface as AwsApiError carrying HTTP status + AWS __type.
AwsSecretsRotator implements 4-step contract:
- generate: PutSecretValue with AWSPENDING stage, captures version_id
- apply: no-op (PutSecretValue already exposed it)
- verify: GetSecretValue by version_id, byte-equal SecretString check
- commit: UpdateSecretVersionStage move AWSCURRENT to new + remove from old
- rollback_apply: UpdateSecretVersionStage remove AWSPENDING from new version
13 unit specs verify SigV4 idempotence + format, client methods (with
WebMock), rotator's full 4-step path, verify-mismatch, rollback_apply,
and can_rotate? gating.
|
2026-04-29 01:02:40 -04:00 |
|
CarterPerez-dev
|
8ebdd3fee7
|
feat(cre): source tree skeleton with empty module dirs and CI workflow
- src/cre.cr entry point + version.cr
- Empty module dirs: cli, tui, engine, events, rotators, policy, audit, crypto, persistence, notifiers, compliance, config, domain, aws, vault, github, demo
- spec/ unit + integration + fixtures structure mirroring src/
- spec_helper.cr with stdlib spec + cre require
- GitHub Actions CI: format, unit matrix (Crystal 1.19/1.20/nightly x ubuntu/macos), integration with PG service, build job
|
2026-04-28 23:54:59 -04:00 |