Class: SDM::Client

Inherits:
Object
  • Object
show all
Defined in:
lib/strongdm.rb

Overview

Client bundles all the services together and initializes them.

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(api_access_key, api_secret_key, host: "api.strongdm.com:443", insecure: false, retry_rate_limit_errors: true, page_limit: 50) ⇒ Client

Creates a new strongDM API client.

Raises:

  • (TypeError) 


36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
 
# File 'lib/strongdm.rb', line 36

def initialize(api_access_key, api_secret_key, host: "api.strongdm.com:443", insecure: false, retry_rate_limit_errors: true, page_limit: 50)
  raise TypeError, "client access key must be a string" unless api_access_key.kind_of?(String)
  raise TypeError, "client secret key must be a string" unless api_secret_key.kind_of?(String)
  raise TypeError, "client host must be a string" unless host.kind_of?(String)
  @api_access_key = api_access_key.strip
  @api_secret_key = Base64.strict_decode64(api_secret_key.strip)
  @max_retries = DEFAULT_MAX_RETRIES
  @base_retry_delay = DEFAULT_BASE_RETRY_DELAY
  @max_retry_delay = DEFAULT_MAX_RETRY_DELAY
  @page_limit = page_limit
  @expose_rate_limit_errors = (not retry_rate_limit_errors)
  @snapshot_time = nil
  begin
    if insecure
      @channel = GRPC::Core::Channel.new(host, {}, :this_channel_is_insecure)
    else
      cred = GRPC::Core::ChannelCredentials.new()
      @channel = GRPC::Core::Channel.new(host, {}, cred)
    end
  rescue => exception
    raise Plumbing::convert_error_to_porcelain(exception)
  end
  @access_requests = AccessRequests.new(@channel, self)
  @access_request_events_history = AccessRequestEventsHistory.new(@channel, self)
  @access_requests_history = AccessRequestsHistory.new(@channel, self)
  @account_attachments = AccountAttachments.new(@channel, self)
  @account_attachments_history = AccountAttachmentsHistory.new(@channel, self)
  @account_grants = AccountGrants.new(@channel, self)
  @account_grants_history = AccountGrantsHistory.new(@channel, self)
  @account_permissions = AccountPermissions.new(@channel, self)
  @account_resources = AccountResources.new(@channel, self)
  @account_resources_history = AccountResourcesHistory.new(@channel, self)
  @accounts = Accounts.new(@channel, self)
  @accounts_history = AccountsHistory.new(@channel, self)
  @activities = Activities.new(@channel, self)
  @approval_workflow_approvers = ApprovalWorkflowApprovers.new(@channel, self)
  @approval_workflow_approvers_history = ApprovalWorkflowApproversHistory.new(@channel, self)
  @approval_workflow_steps = ApprovalWorkflowSteps.new(@channel, self)
  @approval_workflow_steps_history = ApprovalWorkflowStepsHistory.new(@channel, self)
  @approval_workflows = ApprovalWorkflows.new(@channel, self)
  @approval_workflows_history = ApprovalWorkflowsHistory.new(@channel, self)
  @control_panel = ControlPanel.new(@channel, self)
  @identity_aliases = IdentityAliases.new(@channel, self)
  @identity_aliases_history = IdentityAliasesHistory.new(@channel, self)
  @identity_sets = IdentitySets.new(@channel, self)
  @identity_sets_history = IdentitySetsHistory.new(@channel, self)
  @nodes = Nodes.new(@channel, self)
  @nodes_history = NodesHistory.new(@channel, self)
  @organization_history = OrganizationHistory.new(@channel, self)
  @peering_group_nodes = PeeringGroupNodes.new(@channel, self)
  @peering_group_peers = PeeringGroupPeers.new(@channel, self)
  @peering_group_resources = PeeringGroupResources.new(@channel, self)
  @peering_groups = PeeringGroups.new(@channel, self)
  @policies = Policies.new(@channel, self)
  @policies_history = PoliciesHistory.new(@channel, self)
  @queries = Queries.new(@channel, self)
  @remote_identities = RemoteIdentities.new(@channel, self)
  @remote_identities_history = RemoteIdentitiesHistory.new(@channel, self)
  @remote_identity_groups = RemoteIdentityGroups.new(@channel, self)
  @remote_identity_groups_history = RemoteIdentityGroupsHistory.new(@channel, self)
  @replays = Replays.new(@channel, self)
  @resources = Resources.new(@channel, self)
  @resources_history = ResourcesHistory.new(@channel, self)
  @role_resources = RoleResources.new(@channel, self)
  @role_resources_history = RoleResourcesHistory.new(@channel, self)
  @roles = Roles.new(@channel, self)
  @roles_history = RolesHistory.new(@channel, self)
  @secret_store_healths = SecretStoreHealths.new(@channel, self)
  @secret_stores = SecretStores.new(@channel, self)
  @secret_stores_history = SecretStoresHistory.new(@channel, self)
  @workflow_approvers = WorkflowApprovers.new(@channel, self)
  @workflow_approvers_history = WorkflowApproversHistory.new(@channel, self)
  @workflow_assignments = WorkflowAssignments.new(@channel, self)
  @workflow_assignments_history = WorkflowAssignmentsHistory.new(@channel, self)
  @workflow_roles = WorkflowRoles.new(@channel, self)
  @workflow_roles_history = WorkflowRolesHistory.new(@channel, self)
  @workflows = Workflows.new(@channel, self)
  @workflows_history = WorkflowsHistory.new(@channel, self)
end

Instance Attribute Details

#access_request_events_history ⇒ Object (readonly)

AccessRequestEventsHistory provides records of all changes to the state of an AccessRequest.

See AccessRequestEventsHistory.



211
212
213
 
# File 'lib/strongdm.rb', line 211

def access_request_events_history
  @access_request_events_history
end

#access_requests ⇒ Object (readonly)

AccessRequests are requests for access to a resource that may match a Workflow.

See AccessRequests.



207
208
209
 
# File 'lib/strongdm.rb', line 207

def access_requests
  @access_requests
end

#access_requests_history ⇒ Object (readonly)

AccessRequestsHistory provides records of all changes to the state of an AccessRequest.

See AccessRequestsHistory.



215
216
217
 
# File 'lib/strongdm.rb', line 215

def access_requests_history
  @access_requests_history
end

#account_attachments ⇒ Object (readonly)

AccountAttachments assign an account to a role.

See AccountAttachments.



219
220
221
 
# File 'lib/strongdm.rb', line 219

def 
  @account_attachments
end

#account_attachments_history ⇒ Object (readonly)

AccountAttachmentsHistory records all changes to the state of an AccountAttachment.

See AccountAttachmentsHistory.



223
224
225
 
# File 'lib/strongdm.rb', line 223

def 
  @account_attachments_history
end

#account_grants ⇒ Object (readonly)

AccountGrants assign a resource directly to an account, giving the account the permission to connect to that resource.

See AccountGrants.



227
228
229
 
# File 'lib/strongdm.rb', line 227

def 
  @account_grants
end

#account_grants_history ⇒ Object (readonly)

AccountGrantsHistory records all changes to the state of an AccountGrant.

See AccountGrantsHistory.



231
232
233
 
# File 'lib/strongdm.rb', line 231

def 
  @account_grants_history
end

#account_permissions ⇒ Object (readonly)

AccountPermissions records the granular permissions accounts have, allowing them to execute relevant commands via StrongDM's APIs.

See AccountPermissions.



236
237
238
 
# File 'lib/strongdm.rb', line 236

def 
  @account_permissions
end

#account_resources ⇒ Object (readonly)

AccountResources enumerates the resources to which accounts have access. The AccountResources service is read-only.

See AccountResources.



241
242
243
 
# File 'lib/strongdm.rb', line 241

def 
  @account_resources
end

#account_resources_history ⇒ Object (readonly)

AccountResourcesHistory records all changes to the state of a AccountResource.

See AccountResourcesHistory.



245
246
247
 
# File 'lib/strongdm.rb', line 245

def 
  @account_resources_history
end

#accounts ⇒ Object (readonly)

Accounts are users that have access to strongDM. There are two types of accounts:

  1. Users: humans who are authenticated through username and password or SSO.
  2. Service Accounts: machines that are authenticated using a service token.
  3. Tokens are access keys with permissions that can be used for authentication.

See Accounts.



252
253
254
 
# File 'lib/strongdm.rb', line 252

def accounts
  @accounts
end

#accounts_history ⇒ Object (readonly)

AccountsHistory records all changes to the state of an Account.

See AccountsHistory.



256
257
258
 
# File 'lib/strongdm.rb', line 256

def accounts_history
  @accounts_history
end

#activities ⇒ Object (readonly)

An Activity is a record of an action taken against a strongDM deployment, e.g. a user creation, resource deletion, sso configuration change, etc. The Activities service is read-only.

See Activities.



262
263
264
 
# File 'lib/strongdm.rb', line 262

def activities
  @activities
end

#api_access_key ⇒ Object (readonly)

API authentication token (read-only).



201
202
203
 
# File 'lib/strongdm.rb', line 201

def api_access_key
  @api_access_key
end

#approval_workflow_approvers ⇒ Object (readonly)

ApprovalWorkflowApprovers link approval workflow approvers to an ApprovalWorkflowStep

See ApprovalWorkflowApprovers.



266
267
268
 
# File 'lib/strongdm.rb', line 266

def approval_workflow_approvers
  @approval_workflow_approvers
end

#approval_workflow_approvers_history ⇒ Object (readonly)

ApprovalWorkflowApproversHistory records all changes to the state of an ApprovalWorkflowApprover.

See ApprovalWorkflowApproversHistory.



270
271
272
 
# File 'lib/strongdm.rb', line 270

def approval_workflow_approvers_history
  @approval_workflow_approvers_history
end

#approval_workflow_steps ⇒ Object (readonly)

ApprovalWorkflowSteps link approval workflow steps to an ApprovalWorkflow

See ApprovalWorkflowSteps.



274
275
276
 
# File 'lib/strongdm.rb', line 274

def approval_workflow_steps
  @approval_workflow_steps
end

#approval_workflow_steps_history ⇒ Object (readonly)

ApprovalWorkflowStepsHistory records all changes to the state of an ApprovalWorkflowStep.

See ApprovalWorkflowStepsHistory.



278
279
280
 
# File 'lib/strongdm.rb', line 278

def approval_workflow_steps_history
  @approval_workflow_steps_history
end

#approval_workflows ⇒ Object (readonly)

ApprovalWorkflows are the mechanism by which requests for access can be viewed by authorized approvers and be approved or denied.

See ApprovalWorkflows.



283
284
285
 
# File 'lib/strongdm.rb', line 283

def approval_workflows
  @approval_workflows
end

#approval_workflows_history ⇒ Object (readonly)

ApprovalWorkflowsHistory records all changes to the state of an ApprovalWorkflow.

See ApprovalWorkflowsHistory.



287
288
289
 
# File 'lib/strongdm.rb', line 287

def approval_workflows_history
  @approval_workflows_history
end

#base_retry_delay ⇒ Object (readonly)

Returns the value of attribute base_retry_delay.



196
197
198
 
# File 'lib/strongdm.rb', line 196

def base_retry_delay
  @base_retry_delay
end

#control_panel ⇒ Object (readonly)

ControlPanel contains all administrative controls.

See SDM::ControlPanel.



291
292
293
 
# File 'lib/strongdm.rb', line 291

def control_panel
  @control_panel
end

#identity_aliases ⇒ Object (readonly)

IdentityAliases assign an alias to an account within an IdentitySet. The alias is used as the username when connecting to a identity supported resource.

See IdentityAliases.



296
297
298
 
# File 'lib/strongdm.rb', line 296

def identity_aliases
  @identity_aliases
end

#identity_aliases_history ⇒ Object (readonly)

IdentityAliasesHistory records all changes to the state of a IdentityAlias.

See IdentityAliasesHistory.



300
301
302
 
# File 'lib/strongdm.rb', line 300

def identity_aliases_history
  @identity_aliases_history
end

#identity_sets ⇒ Object (readonly)

A IdentitySet is a named grouping of Identity Aliases for Accounts. An Account's relationship to a IdentitySet is defined via IdentityAlias objects.

See IdentitySets.



305
306
307
 
# File 'lib/strongdm.rb', line 305

def identity_sets
  @identity_sets
end

#identity_sets_history ⇒ Object (readonly)

IdentitySetsHistory records all changes to the state of a IdentitySet.

See IdentitySetsHistory.



309
310
311
 
# File 'lib/strongdm.rb', line 309

def identity_sets_history
  @identity_sets_history
end

#max_retries ⇒ Object (readonly)

Returns the value of attribute max_retries.



195
196
197
 
# File 'lib/strongdm.rb', line 195

def max_retries
  @max_retries
end

#max_retry_delay ⇒ Object (readonly)

Returns the value of attribute max_retry_delay.



197
198
199
 
# File 'lib/strongdm.rb', line 197

def max_retry_delay
  @max_retry_delay
end

#nodes ⇒ Object (readonly)

Nodes make up the strongDM network, and allow your users to connect securely to your resources. There are two types of nodes:

  • Gateways are the entry points into network. They listen for connection from the strongDM client, and provide access to databases and servers.
  • Relays are used to extend the strongDM network into segmented subnets. They provide access to databases and servers but do not listen for incoming connections.

See Nodes.



315
316
317
 
# File 'lib/strongdm.rb', line 315

def nodes
  @nodes
end

#nodes_history ⇒ Object (readonly)

NodesHistory records all changes to the state of a Node.

See NodesHistory.



319
320
321
 
# File 'lib/strongdm.rb', line 319

def nodes_history
  @nodes_history
end

#organization_history ⇒ Object (readonly)

OrganizationHistory records all changes to the state of an Organization.

See OrganizationHistory.



323
324
325
 
# File 'lib/strongdm.rb', line 323

def organization_history
  @organization_history
end

#page_limit ⇒ Object

Returns the value of attribute page_limit.



198
199
200
 
# File 'lib/strongdm.rb', line 198

def page_limit
  @page_limit
end

#peering_group_nodes ⇒ Object (readonly)

PeeringGroupNodes provides the building blocks necessary to obtain attach a node to a peering group.

See PeeringGroupNodes.



327
328
329
 
# File 'lib/strongdm.rb', line 327

def peering_group_nodes
  @peering_group_nodes
end

#peering_group_peers ⇒ Object (readonly)

PeeringGroupPeers provides the building blocks necessary to link two peering groups.

See PeeringGroupPeers.



331
332
333
 
# File 'lib/strongdm.rb', line 331

def peering_group_peers
  @peering_group_peers
end

#peering_group_resources ⇒ Object (readonly)

PeeringGroupResources provides the building blocks necessary to obtain attach a resource to a peering group.

See PeeringGroupResources.



335
336
337
 
# File 'lib/strongdm.rb', line 335

def peering_group_resources
  @peering_group_resources
end

#peering_groups ⇒ Object (readonly)

PeeringGroups provides the building blocks necessary to obtain explicit network topology and routing.

See PeeringGroups.



339
340
341
 
# File 'lib/strongdm.rb', line 339

def peering_groups
  @peering_groups
end

#policies ⇒ Object (readonly)

Policies are the collection of one or more statements that enforce fine-grained access control for the users of an organization.

See Policies.



344
345
346
 
# File 'lib/strongdm.rb', line 344

def policies
  @policies
end

#policies_history ⇒ Object (readonly)

PoliciesHistory records all changes to the state of a Policy.

See PoliciesHistory.



348
349
350
 
# File 'lib/strongdm.rb', line 348

def policies_history
  @policies_history
end

#queries ⇒ Object (readonly)

A Query is a record of a single client request to a resource, such as a SQL query. Long-running SSH, RDP, or Kubernetes interactive sessions also count as queries. The Queries service is read-only.

See Queries.



354
355
356
 
# File 'lib/strongdm.rb', line 354

def queries
  @queries
end

#remote_identities ⇒ Object (readonly)

RemoteIdentities assign a resource directly to an account, giving the account the permission to connect to that resource.

See RemoteIdentities.



358
359
360
 
# File 'lib/strongdm.rb', line 358

def remote_identities
  @remote_identities
end

#remote_identities_history ⇒ Object (readonly)

RemoteIdentitiesHistory records all changes to the state of a RemoteIdentity.

See RemoteIdentitiesHistory.



362
363
364
 
# File 'lib/strongdm.rb', line 362

def remote_identities_history
  @remote_identities_history
end

#remote_identity_groups ⇒ Object (readonly)

A RemoteIdentityGroup is a named grouping of Remote Identities for Accounts. An Account's relationship to a RemoteIdentityGroup is defined via RemoteIdentity objects.

See RemoteIdentityGroups.



367
368
369
 
# File 'lib/strongdm.rb', line 367

def remote_identity_groups
  @remote_identity_groups
end

#remote_identity_groups_history ⇒ Object (readonly)

RemoteIdentityGroupsHistory records all changes to the state of a RemoteIdentityGroup.

See RemoteIdentityGroupsHistory.



371
372
373
 
# File 'lib/strongdm.rb', line 371

def remote_identity_groups_history
  @remote_identity_groups_history
end

#replays ⇒ Object (readonly)

A Replay captures the data transferred over a long-running SSH, RDP, or Kubernetes interactive session (otherwise referred to as a query). The Replays service is read-only.

See Replays.



376
377
378
 
# File 'lib/strongdm.rb', line 376

def replays
  @replays
end

#resources ⇒ Object (readonly)

Resources are databases, servers, clusters, websites, or clouds that strongDM delegates access to.

See Resources.



381
382
383
 
# File 'lib/strongdm.rb', line 381

def resources
  @resources
end

#resources_history ⇒ Object (readonly)

ResourcesHistory records all changes to the state of a Resource.

See ResourcesHistory.



385
386
387
 
# File 'lib/strongdm.rb', line 385

def resources_history
  @resources_history
end

#role_resources ⇒ Object (readonly)

RoleResources enumerates the resources to which roles have access. The RoleResources service is read-only.

See RoleResources.



390
391
392
 
# File 'lib/strongdm.rb', line 390

def role_resources
  @role_resources
end

#role_resources_history ⇒ Object (readonly)

RoleResourcesHistory records all changes to the state of a RoleResource.

See RoleResourcesHistory.



394
395
396
 
# File 'lib/strongdm.rb', line 394

def role_resources_history
  @role_resources_history
end

#roles ⇒ Object (readonly)

A Role has a list of access rules which determine which Resources the members of the Role have access to. An Account can be a member of multiple Roles via AccountAttachments.

See Roles.



400
401
402
 
# File 'lib/strongdm.rb', line 400

def roles
  @roles
end

#roles_history ⇒ Object (readonly)

RolesHistory records all changes to the state of a Role.

See RolesHistory.



404
405
406
 
# File 'lib/strongdm.rb', line 404

def roles_history
  @roles_history
end

#secret_store_healths ⇒ Object (readonly)

SecretStoreHealths exposes health states for secret stores.

See SecretStoreHealths.



408
409
410
 
# File 'lib/strongdm.rb', line 408

def secret_store_healths
  @secret_store_healths
end

#secret_stores ⇒ Object (readonly)

SecretStores are servers where resource secrets (passwords, keys) are stored.

See SecretStores.



412
413
414
 
# File 'lib/strongdm.rb', line 412

def secret_stores
  @secret_stores
end

#secret_stores_history ⇒ Object (readonly)

SecretStoresHistory records all changes to the state of a SecretStore.

See SecretStoresHistory.



416
417
418
 
# File 'lib/strongdm.rb', line 416

def secret_stores_history
  @secret_stores_history
end

#snapshot_time ⇒ Object

Optional timestamp at which to provide historical data



203
204
205
 
# File 'lib/strongdm.rb', line 203

def snapshot_time
  @snapshot_time
end

#workflow_approvers ⇒ Object (readonly)

WorkflowApprovers is an account or a role with the ability to approve requests bound to a workflow.

See WorkflowApprovers.



420
421
422
 
# File 'lib/strongdm.rb', line 420

def workflow_approvers
  @workflow_approvers
end

#workflow_approvers_history ⇒ Object (readonly)

WorkflowApproversHistory provides records of all changes to the state of a WorkflowApprover.

See WorkflowApproversHistory.



424
425
426
 
# File 'lib/strongdm.rb', line 424

def workflow_approvers_history
  @workflow_approvers_history
end

#workflow_assignments ⇒ Object (readonly)

WorkflowAssignments links a Resource to a Workflow. The assigned resources are those that a user can request access to via the workflow.

See WorkflowAssignments.



429
430
431
 
# File 'lib/strongdm.rb', line 429

def workflow_assignments
  @workflow_assignments
end

#workflow_assignments_history ⇒ Object (readonly)

WorkflowAssignmentsHistory provides records of all changes to the state of a WorkflowAssignment.

See WorkflowAssignmentsHistory.



433
434
435
 
# File 'lib/strongdm.rb', line 433

def workflow_assignments_history
  @workflow_assignments_history
end

#workflow_roles ⇒ Object (readonly)

WorkflowRole links a role to a workflow. The linked roles indicate which roles a user must be a part of to request access to a resource via the workflow.

See WorkflowRoles.



438
439
440
 
# File 'lib/strongdm.rb', line 438

def workflow_roles
  @workflow_roles
end

#workflow_roles_history ⇒ Object (readonly)

WorkflowRolesHistory provides records of all changes to the state of a WorkflowRole

See WorkflowRolesHistory.



442
443
444
 
# File 'lib/strongdm.rb', line 442

def workflow_roles_history
  @workflow_roles_history
end

#workflows ⇒ Object (readonly)

Workflows are the collection of rules that define the resources to which access can be requested, the users that can request that access, and the mechanism for approving those requests which can either be automatic approval or a set of users authorized to approve the requests.

See Workflows.



448
449
450
 
# File 'lib/strongdm.rb', line 448

def workflows
  @workflows
end

#workflows_history ⇒ Object (readonly)

WorkflowsHistory provides records of all changes to the state of a Workflow.

See WorkflowsHistory.



452
453
454
 
# File 'lib/strongdm.rb', line 452

def workflows_history
  @workflows_history
end

Instance Method Details

#close ⇒ Object

Closes this client and releases all resources held by it.



117
118
119
120
121
122
123
 
# File 'lib/strongdm.rb', line 117

def close
  begin
    @channel.close()
  rescue => exception
    raise Plumbing::convert_error_to_porcelain(exception)
  end
end

#sign(method_name, msg_bytes) ⇒ Object 



135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
 
# File 'lib/strongdm.rb', line 135

def sign(method_name, msg_bytes)
  current_utc_date = Time.now.utc
  date = sprintf("%04d-%02d-%02d", current_utc_date.year, current_utc_date.month, current_utc_date.day)

  signing_key = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, @api_secret_key, date)
  signing_key = OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, signing_key, "sdm_api_v1")

  sha_req = Digest::SHA256.new
  sha_req << method_name
  sha_req << "\n"
  sha_req << msg_bytes
  request_hash = sha_req.digest

  return Base64.strict_encode64(OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, signing_key, request_hash))
end

#snapshot_at(snapshot_time) ⇒ Object

Constructs a read-only client that will provide historical data from the provided timestamp. See SnapshotClient.



189
190
191
192
193
 
# File 'lib/strongdm.rb', line 189

def snapshot_at(snapshot_time)
  client = self.clone
  client.snapshot_time = snapshot_time
  return SnapshotClient.new(client)
end