cyberark / conjur

CyberArk Conjur automatically secures secrets used by privileged users and machine identities
https://conjur.org
Other
778 stars 123 forks source link

No indication of missing rotator #984

Open hughsaunders opened 5 years ago

hughsaunders commented 5 years ago

Describe the bug

When adding a rotation/rotator annotation to a variable, there's no error message or warning for specifying an unknown rotator. This means rotation may not be happening as expected if a user has a typo in a rotator name.

How to Reproduce

Steps to reproduce the behavior:

  1. Deploy 5.3.0-rc1-20190424181635-9a23768
  2. Create and load a rotation policy:
     - !policy
       id: iam_rotation
       body:
         - !variable region
         - !variable access_key_id
         - !variable secret_key_proxy
         - !variable
           id: secret_access_key
           annotations:
             rotation/rotator: aws/not_a_rotator
             rotation/ttl: PT15M # 15 Minutes
  3. Set the initial values for the variables via cli
  4. Find secret_access_key in the UI, and click Rotate Now, observe nothing happening.

Expected Behaviour

When loading a policy that references a rotator that is unknown to conjur, the user should warned, either by rejecting the policy load, or loading with a warning.

hughsaunders commented 5 years ago

There is an error reported in the logs:

2019-04-26T13:14:56.000+00:00 56acfafb5756 conjur-rotation: rake aborted!
2019-04-26T13:14:56.000+00:00 56acfafb5756 conjur-rotation: Rotation::MasterRotator::ScheduledRotation::RotatorNotFound: 'aws/secret_key' is not an installed rotator
2019-04-26T13:14:56.000+00:00 56acfafb5756 conjur-rotation: Tasks: TOP => expiration:watch
2019-04-26T13:14:56.000+00:00 56acfafb5756 conjur-rotation: (See full trace by running task with --trace)

However, I think this deserves a UI warning as well as log messages.