fix: [CPCAP-11583] S3 secret usage in backup-daemon

services/backup-daemon/docker/granular/configs.py

@@ -19,6 +19,7 @@
 
 _SECRET_BASE_PATH = "/var/run/secrets/postgresql/"
 _PG_USER_CREDS_PATH = _SECRET_BASE_PATH + "postgres-credentials/"
+_AWS_CREDS_PATH = _SECRET_BASE_PATH + "s3-storage-credentials/"
 
 _PROTECTED_DATABASES = ['template0', 'template1', 'postgres',
                         'rdsadmin',  # aws rds
@@ -105,6 +106,14 @@ def postgres_password():
     return read_secret_file(_PG_USER_CREDS_PATH + "password", '')
 
 
+def aws_access_key_id():
+    return read_secret_file(_AWS_CREDS_PATH + "key_id", "")
+
+
+def aws_secret_access_key():
+    return read_secret_file(_AWS_CREDS_PATH + "access_key", "")
+
+
 def postgresql_no_role_password_flag():
     if is_external_pg():
         return "--no-role-passwords"

services/backup-daemon/docker/granular/storage_s3.py

@@ -112,8 +112,8 @@ def get_s3_client(self):
             "s3",
             region_name=alias.get("region") if alias else (os.getenv("AWS_DEFAULT_REGION") if os.getenv("AWS_DEFAULT_REGION") else None),
             endpoint_url=alias.get("s3Url") if alias else os.getenv("AWS_S3_ENDPOINT_URL"),
-            aws_access_key_id=alias.get("accessKeyId") if alias else os.getenv("AWS_ACCESS_KEY_ID"),
-            aws_secret_access_key=alias.get("accessKeySecret") if alias else os.getenv("AWS_SECRET_ACCESS_KEY"),
+            aws_access_key_id=alias.get("accessKeyId") if alias else configs.aws_access_key_id(),
+            aws_secret_access_key=alias.get("accessKeySecret") if alias else configs.aws_secret_access_key(),
             verify=(False if os.getenv("AWS_S3_UNTRUSTED_CERT", "false").lower() == "true" else None),
         )
 

services/backup-daemon/docker/postgres/aws-s3-backup.sh

@@ -29,6 +29,7 @@ BACKUP_NAME="pg_${PG_CLUSTER_NAME}_backup_${BACKUP_ID}.tar.gz"
 
 SECRET_BASE_PATH="/var/run/secrets/postgresql/"
 PG_USER_CREDS_PATH="${SECRET_BASE_PATH}postgres-credentials/"
+AWS_CREDS_PATH="${SECRET_BASE_PATH}s3-storage-credentials/"
 
 function read_secret_file() {
   local path="$1"
@@ -50,7 +51,8 @@ function read_secret_file() {
 
 POSTGRES_USER=$(read_secret_file "${PG_USER_CREDS_PATH}username" "postgres")
 POSTGRES_PASSWORD=$(read_secret_file "${PG_USER_CREDS_PATH}password" "")
-
+AWS_ACCESS_KEY_ID=$(read_secret_file "${AWS_CREDS_PATH}key_id" "")
+AWS_SECRET_ACCESS_KEY=$(read_secret_file "${AWS_CREDS_PATH}access_key" "")
 
 function log() {
   log_module "$1" "aws-s3-backup" "$2"

services/backup-daemon/docker/postgres/storage_s3.py

@@ -18,7 +18,7 @@
 import botocore
 import hashlib
 import io
-
+import utils
 import urllib3
 
 import botocore.exceptions
@@ -261,8 +261,8 @@ def get_s3_resource():
         return boto3.resource("s3",
                               region_name=os.getenv("AWS_DEFAULT_REGION") if os.getenv("AWS_DEFAULT_REGION") else None,
                               endpoint_url=os.getenv("AWS_S3_ENDPOINT_URL"),
-                              aws_access_key_id=os.getenv("AWS_ACCESS_KEY_ID"),
-                              aws_secret_access_key=os.getenv("AWS_SECRET_ACCESS_KEY"),
+                              aws_access_key_id=utils.read_secret_file(f"{utils.AWS_CREDS_PATH}/key_id", ""),
+                              aws_secret_access_key=utils.read_secret_file(f"{utils.AWS_CREDS_PATH}/access_key", ""),
                               verify=(False if os.getenv("AWS_S3_UNTRUSTED_CERT", "false").lower() == "true" else None))
 
     @staticmethod

services/backup-daemon/docker/postgres/utils.py

@@ -18,7 +18,9 @@
 
 log = logging.getLogger("utils")
 
+_SECRET_BASE_PATH = "/var/run/secrets/postgresql/"
 POSTGRES_CREDS_PATH = '/var/run/secrets/postgresql/postgres-credentials'
+AWS_CREDS_PATH = _SECRET_BASE_PATH + "s3-storage-credentials"
 
 def execute_query(conn_properties, query):
     conn = None