feat!: Add store configuration support for SSM store

store/nullstore.go

@@ -13,6 +13,16 @@
 	return &NullStore{}
 }
 
+func (s *NullStore) Config(ctx context.Context) (StoreConfig, error) {
+	return StoreConfig{
+		Version: LatestStoreConfigVersion,
+	}, nil
+}
+
+func (s *NullStore) SetConfig(ctx context.Context, config StoreConfig) error {
+	return errors.New("SetConfig is not implemented for Null Store")
+}
+
 func (s *NullStore) Write(ctx context.Context, id SecretId, value string) error {
 	return errors.New("Write is not implemented for Null Store")
 }

store/s3store.go

@@ -72,6 +72,16 @@
 	}, nil
 }
 
+func (s *S3Store) Config(ctx context.Context) (StoreConfig, error) {
+	return StoreConfig{
+		Version: LatestStoreConfigVersion,
+	}, nil
+}
+
+func (s *S3Store) SetConfig(ctx context.Context, config StoreConfig) error {
+	return errors.New("Not implemented for S3 Store")
+}
+
 func (s *S3Store) Write(ctx context.Context, id SecretId, value string) error {
 	index, err := s.readLatest(ctx, id.Service)
 	if err != nil {

store/secretsmanagerstore.go

@@ -114,6 +114,16 @@
 	}, nil
 }
 
+func (s *SecretsManagerStore) Config(ctx context.Context) (StoreConfig, error) {
+	return StoreConfig{
+		Version: LatestStoreConfigVersion,
+	}, nil
+}
+
+func (s *SecretsManagerStore) SetConfig(ctx context.Context, config StoreConfig) error {
+	return errors.New("Not implemented for Secrets Manager Store")
+}
+
 // Write writes a given value to a secret identified by id. If the secret
 // already exists, then write a new version.
 func (s *SecretsManagerStore) Write(ctx context.Context, id SecretId, value string) error {

store/secretsmanagerstore_test.go

@@ -477,3 +477,13 @@ func uniqueID() string {
 	_, _ = rand.Read(uuid)
 	return fmt.Sprintf("%x", uuid)
 }
+
+func TestSecretsManagerStoreConfig(t *testing.T) {
+	store := &SecretsManagerStore{}
+
+	config, err := store.Config(context.Background())
+
+	assert.NoError(t, err)
+	assert.Equal(t, LatestStoreConfigVersion, config.Version)
+	assert.Empty(t, config.RequiredTags)
+}

store/ssmstore.go

@@ -2,6 +2,7 @@
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
@@ -93,6 +94,49 @@
 	return fromEnv
 }
 
+const (
+	storeConfigKey = "store-config"
+)
+
+var (
+	storeConfigID = SecretId{
+		Service: ChamberService,
+		Key:     storeConfigKey,
+	}
+)
+
+func (s *SSMStore) Config(ctx context.Context) (StoreConfig, error) {
+	configSecret, err := s.readLatest(ctx, storeConfigID)
+	if err != nil {
+		if err == ErrSecretNotFound {
+			return StoreConfig{
+				Version: LatestStoreConfigVersion,
+			}, nil
+		} else {
+			return StoreConfig{}, err
+		}
+	}
+
+	var config StoreConfig
+	if err := json.Unmarshal([]byte(*configSecret.Value), &config); err != nil {
+		return StoreConfig{}, fmt.Errorf("failed to unmarshal store config: %w", err)
+	}
+	return config, nil
+}
+
+func (s *SSMStore) SetConfig(ctx context.Context, config StoreConfig) error {
+	configBytes, err := json.Marshal(config)
+	if err != nil {
+		return fmt.Errorf("failed to marshal store config: %w", err)
+	}
+
+	err = s.write(ctx, storeConfigID, string(configBytes), nil)
+	if err != nil {
+		return fmt.Errorf("failed to write store config: %w", err)
+	}
+	return nil
+}
+
 // Write writes a given value to a secret identified by id.  If the secret
 // already exists, then write a new version.
 func (s *SSMStore) Write(ctx context.Context, id SecretId, value string) error {

store/ssmstore_test.go

@@ -3,6 +3,7 @@ package store
 import (
 	"context"
 	"errors"
+	"fmt"
 	"os"
 	"sort"
 	"strings"
@@ -853,3 +854,59 @@ type ByKeyRaw []RawSecret
 func (a ByKeyRaw) Len() int           { return len(a) }
 func (a ByKeyRaw) Swap(i, j int)      { a[i], a[j] = a[j], a[i] }
 func (a ByKeyRaw) Less(i, j int) bool { return a[i].Key < a[j].Key }
+
+func TestSSMStoreConfig(t *testing.T) {
+	storeConfigName := fmt.Sprintf("/%s/%s", ChamberService, storeConfigKey)
+	parameters := map[string]mockParameter{
+		storeConfigName: {
+			currentParam: &types.Parameter{
+				Name:  aws.String(storeConfigName),
+				Type:  types.ParameterTypeSecureString,
+				Value: aws.String(`{"version":"2","requiredTags":["key1", "key2"]}`),
+			},
+			meta: &types.ParameterMetadata{
+				Name:             aws.String(storeConfigName),
+				Description:      aws.String("1"),
+				LastModifiedDate: aws.Time(time.Now()),
+				LastModifiedUser: aws.String("test"),
+			},
+		},
+	}
+	store := NewTestSSMStore(parameters)
+
+	config, err := store.Config(context.Background())
+
+	assert.NoError(t, err)
+	assert.Equal(t, "2", config.Version)
+	assert.Equal(t, []string{"key1", "key2"}, config.RequiredTags)
+}
+
+func TestSSMStoreConfig_Missing(t *testing.T) {
+	parameters := map[string]mockParameter{}
+	store := NewTestSSMStore(parameters)
+
+	config, err := store.Config(context.Background())
+
+	assert.NoError(t, err)
+	assert.Equal(t, LatestStoreConfigVersion, config.Version)
+	assert.Empty(t, config.RequiredTags)
+}
+
+func TestSSMStoreSetConfig(t *testing.T) {
+	parameters := map[string]mockParameter{}
+	store := NewTestSSMStore(parameters)
+
+	config := StoreConfig{
+		Version:      "2.1",
+		RequiredTags: []string{"key1.1", "key2.1"},
+	}
+	err := store.SetConfig(context.Background(), config)
+
+	assert.NoError(t, err)
+
+	config, err = store.Config(context.Background())
+
+	assert.NoError(t, err)
+	assert.Equal(t, "2.1", config.Version)
+	assert.Equal(t, []string{"key1.1", "key2.1"}, config.RequiredTags)
+}

store/store.go

@@ -15,6 +15,18 @@ func ReservedService(service string) bool {
 	return service == ChamberService
 }
 
+const (
+	LatestStoreConfigVersion = "1"
+)
+
+// StoreConfig holds configuration information for a store. WARNING: Despite
+// its public visibility, the contents of this struct are subject to change at
+// any time, and are not part of the public interface for chamber.
+type StoreConfig struct {
+	Version      string   `json:"version"`
+	RequiredTags []string `json:"requiredTags,omitempty"`
+}
+
 type ChangeEventType int
 
 const (
@@ -73,6 +85,8 @@ type ChangeEvent struct {
 
 // Store is an interface for a secret store.
 type Store interface {
+	Config(ctx context.Context) (StoreConfig, error)
+	SetConfig(ctx context.Context, config StoreConfig) error
 	Write(ctx context.Context, id SecretId, value string) error
 	WriteWithTags(ctx context.Context, id SecretId, value string, tags map[string]string) error
 	Read(ctx context.Context, id SecretId, version int) (Secret, error)