1 Commits

Author	SHA1	Message	Date
shankar0123	edf6bee7f8	target(awsacm): SDK-driven AWS Certificate Manager target connector ... Closes Rank 5 (AWS half) of the 2026-05-03 Infisical deep-research deliverable (cowork/infisical-deep-research-results.md Part 5). Pre-fix, certctl had no path to deploy certs to AWS-managed TLS- termination endpoints (ALB / CloudFront / API Gateway / App Runner) — operators terminating TLS at AWS had to use Infisical secret-sync, manual aws-cli imports, or external automation. This commit lands the SDK-driven AWS Certificate Manager target connector that closes the gap end-to-end. Architecture: - internal/connector/target/awsacm/awsacm.go — Connector wraps *acm.Client behind the ACMClient interface seam (mirrors awsacmpca's ACMPCAClient pattern from the issuer side). LoadDefaultConfig handles the standard AWS credential chain (IRSA / EC2 instance profile / SSO / env vars); no embedded creds in connector Config. - Pre-deploy snapshot via DescribeCertificate + GetCertificate so on-import-failure rollback restores the previous cert. Mirrors the Bundle 5 IIS pattern + the Bundle 7/8 WinCertStore / JavaKeystore patterns. Surfaces rollback success/failure via the existing certctl_deploy_rollback_total Prometheus counter label set. - Provenance tags: certctl-managed-by=certctl + certctl- certificate-id=<mc-id> set automatically on every import. ACM strips tags on re-import, so the connector calls AddTagsToCertificate post-import to keep the provenance pair fresh. Operators looking up a cert ARN by managed-cert ID (Terraform data source, CloudFormation output) match against these tags. - DeploymentRequest.KeyPEM held in agent memory only — never written to disk. Aligns with the pull-only deployment model documented in CLAUDE.md. Tests: - awsacm_test.go: 15-subtest happy-path + validation matrix covering ValidateConfig (success / missing-region / malformed- region / malformed-ARN / reserved-tag rejection), DeployCertificate (fresh import / rotate-in-place / rollback- on-serial-mismatch / rollback-also-fails / empty-key-rejected / no-client-rejected), ValidateOnly (returns sentinel), ValidateDeployment (serial match / mismatch / no-ARN-yet). - awsacm_failure_test.go: 5 per-error-class contract tests mirroring the awsacmpca_failure_test.go shape (commit a2a59a8) — AccessDeniedException (smithy.GenericAPIError), ResourceNotFoundException (typed), ThrottlingException (smithy.GenericAPIError, FaultServer preserved), InvalidArgsException (typed, terminal), RequestInProgress Exception (typed). All assert errors.As against the SDK type + operator-actionable substring + connector-side wrap framing. - Coverage on awsacm.go: 54.9% of statements (matches the K8s- Secret + IIS connectors' 50-65% range; rollback-failure paths contribute most of the un-covered surface — those exercise only when the rollback's SDK call also returns an error). - go test -race -count=10 green; no goroutine leaks. Wiring: - internal/domain/connector.go: TargetTypeAWSACM = "AWSACM". - internal/service/target.go: validTargetTypes set extended. - cmd/agent/main.go::createTargetConnector: AWSACM case arm mirroring the KubernetesSecrets shape exactly. Calls awsacm.New(context.Background(), &cfg, a.logger) — the SDK-loading happens here, not lazily, so config errors surface at agent boot. - cmd/agent/agent_test.go::TestCreateTargetConnector_AllSupported Types: AWSACM added to the type matrix + the InvalidJSON matrix. go.mod / go.sum: - github.com/aws/aws-sdk-go-v2/service/acm v1.38.3 (direct). aws-sdk-go-v2 + service/acmpca + smithy-go were already direct from the awsacmpca issuer; this is the distribution-side companion package. Documentation: - docs/connectors.md "AWS Certificate Manager (ACM)" section: config table, IAM policy JSON (5 actions on arn:aws:acm:*:*:certificate/*), IRSA / EC2 instance-profile / SSO auth recipes, atomic-rollback contract, Terraform ALB- attachment snippet, threat model carve-outs (no disk writes, mandatory provenance tags, no long-lived creds in Config), procurement checklist crib (5 bullets paste-able into a security review). Out of scope (intentional, flagged in V3-Pro forward path): - CloudFront / ALB auto-attach (UpdateDistribution requires a different IAM scope than ACM ImportCertificate). - Cross-region ACM replication (ACM is regional; CloudFront forces us-east-1). - Tag-filtered ARN discovery (V2 uses operator-pinned Config.CertificateArn after first deploy; tag-scan path requires acm:ListTagsForCertificate which we deliberately keep off the minimum-IAM-policy surface). - Azure Key Vault (separate cloud, separate connector — Azure half of Rank 5 ships in a follow-on commit). Verified locally: - gofmt clean. - go vet ./internal/connector/target/awsacm/... ./internal/domain/... ./internal/service/... ./cmd/agent/... clean. - go test -short -count=1 ./internal/connector/target/awsacm/... ./internal/domain/... ./cmd/agent/... green (15 + 5 awsacm subtests; all 15 supported target types instantiate via the agent factory). - go test -race -count=10 ./internal/connector/target/awsacm/... green. Reference: cowork/infisical-deep-research-results.md Part 5 Rank 5. Acquisition prompt: cowork/rank-5-aws-acm-azure-kv-target-adapters-prompt.md.	2026-05-03 22:32:45 +00:00