79 lines
3.3 KiB
Bash
Executable File
79 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Ship one immutable audit-head anchor to a real S3 Object Lock bucket.
|
|
# The key contains the head hash, so retries are idempotent and no mutable
|
|
# "latest" object is trusted. AWS credentials are resolved by the runtime
|
|
# workload identity; this script neither accepts nor prints credential values.
|
|
#
|
|
# Required: CASAN_S3_BUCKET, CASAN_S3_REGION, CASAN_S3_KMS_KEY_ID
|
|
# Optional: CASAN_S3_PREFIX=audit-anchors, CASAN_S3_RETENTION_DAYS=365
|
|
# Usage: audit-ship-s3.sh [audit-head-file]
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/casan-paths.sh"
|
|
|
|
fail() { echo "AUDIT_S3_SHIP_FAIL $*" >&2; exit 1; }
|
|
[[ "${CASAN_PROFILE:-}" == "prod" ]] || fail "profile_must_be_prod"
|
|
command -v aws >/dev/null 2>&1 || fail "aws_cli_required"
|
|
|
|
BUCKET="${CASAN_S3_BUCKET:-}"
|
|
REGION="${CASAN_S3_REGION:-}"
|
|
KMS_KEY_ID="${CASAN_S3_KMS_KEY_ID:-}"
|
|
PREFIX="${CASAN_S3_PREFIX:-audit-anchors}"
|
|
RETENTION_DAYS="${CASAN_S3_RETENTION_DAYS:-365}"
|
|
HEAD_FILE="${1:-$CASAN_STATE_ROOT/logs/audit/audit-head.txt}"
|
|
|
|
[[ "$BUCKET" =~ ^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$ ]] || fail "invalid_bucket"
|
|
[[ "$REGION" =~ ^[a-z]{2}-[a-z]+-[0-9]+$ ]] || fail "invalid_region"
|
|
case "$KMS_KEY_ID" in ''|*replace-with*|*example.com*) fail "invalid_kms_key_id";; esac
|
|
[[ "$RETENTION_DAYS" =~ ^[1-9][0-9]*$ ]] || fail "invalid_retention_days"
|
|
[[ -s "$HEAD_FILE" ]] || fail "missing_head file=$HEAD_FILE"
|
|
|
|
HEAD="$(tr -d '[:space:]' < "$HEAD_FILE")"
|
|
[[ "$HEAD" =~ ^[a-f0-9]{64}$ ]] || fail "invalid_head"
|
|
|
|
LOCK_JSON="$(aws s3api get-object-lock-configuration --bucket "$BUCKET" --region "$REGION" --output json 2>/dev/null)" \
|
|
|| fail "object_lock_configuration_unavailable"
|
|
python3 - "$LOCK_JSON" "$RETENTION_DAYS" <<'PY' || fail "bucket_compliance_retention_not_sufficient"
|
|
import json, sys
|
|
cfg = json.loads(sys.argv[1]).get("ObjectLockConfiguration", {})
|
|
if cfg.get("ObjectLockEnabled") != "Enabled":
|
|
raise SystemExit(1)
|
|
rule = cfg.get("Rule", {}).get("DefaultRetention", {})
|
|
if rule.get("Mode") != "COMPLIANCE":
|
|
raise SystemExit(1)
|
|
days = int(rule.get("Days", 0)) + int(rule.get("Years", 0)) * 365
|
|
if days < int(sys.argv[2]):
|
|
raise SystemExit(1)
|
|
PY
|
|
|
|
RETAIN_UNTIL="$(python3 - "$RETENTION_DAYS" <<'PY'
|
|
from datetime import datetime, timedelta, timezone
|
|
import sys
|
|
print((datetime.now(timezone.utc) + timedelta(days=int(sys.argv[1]))).strftime('%Y-%m-%dT%H:%M:%SZ'))
|
|
PY
|
|
)"
|
|
DAY="$(date -u +%Y/%m/%d)"
|
|
KEY="${PREFIX%/}/${DAY}/${HEAD}.json"
|
|
# An unchanged head must not attempt to overwrite a COMPLIANCE-retained object.
|
|
# A successful lookup is a durable idempotency proof for timer retries.
|
|
if aws s3api head-object --bucket "$BUCKET" --key "$KEY" --region "$REGION" >/dev/null 2>&1; then
|
|
echo "AUDIT_S3_ANCHOR_ALREADY_PRESENT bucket=$BUCKET key=$KEY mode=COMPLIANCE"
|
|
exit 0
|
|
fi
|
|
TMP="$(mktemp)"
|
|
trap 'rm -f "$TMP"' EXIT
|
|
python3 - "$HEAD" "$RETAIN_UNTIL" > "$TMP" <<'PY'
|
|
import json, sys
|
|
print(json.dumps({"audit_head": sys.argv[1], "retention_until": sys.argv[2]}, sort_keys=True))
|
|
PY
|
|
|
|
aws s3api put-object \
|
|
--bucket "$BUCKET" --key "$KEY" --body "$TMP" --region "$REGION" \
|
|
--object-lock-mode COMPLIANCE --object-lock-retain-until-date "$RETAIN_UNTIL" \
|
|
--server-side-encryption aws:kms --ssekms-key-id "$KMS_KEY_ID" >/dev/null \
|
|
|| fail "put_object_failed"
|
|
|
|
echo "AUDIT_S3_ANCHOR_SHIPPED bucket=$BUCKET key=$KEY retention_until=$RETAIN_UNTIL mode=COMPLIANCE"
|