Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix: Allow ACM lookups beyond 100 certs #250

Merged
merged 1 commit into from
Aug 27, 2024
Merged

Fix: Allow ACM lookups beyond 100 certs #250

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 15 additions & 8 deletions efopen/ef_aws_resolver.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,24 +80,31 @@ def acm_certificate_arn(self, lookup, default=None):
- if no certs were issued by Amazon, returns ARN of an arbitrary matching certificate
- certificates issued by Amazon take precedence over certificates not issued by Amazon
"""
# @todo: Only searches the first 100 certificates in the account

cert_summaries = []
try:
# This a region-specific client, so we'll make a new client in the right place using existing SESSION
region_name, domain_name = lookup.split("/")
acm_client = EFAwsResolver.__CLIENTS["SESSION"].client(service_name="acm", region_name=region_name)
response = acm_client.list_certificates(
CertificateStatuses=['ISSUED'],
MaxItems=100
)
next_token = None
while True:
response = acm_client.list_certificates(
CertificateStatuses=['ISSUED'],
MaxItems=100,
NextToken=next_token
)
cert_summaries.extend(response["CertificateSummaryList"])
if response.get("NextToken"):
next_token = response["NextToken"]
else:
break
Comment on lines +88 to +99
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
next_token = None
while True:
response = acm_client.list_certificates(
CertificateStatuses=['ISSUED'],
MaxItems=100,
NextToken=next_token
)
cert_summaries.extend(response["CertificateSummaryList"])
if response.get("NextToken"):
next_token = response["NextToken"]
else:
break
response =
acm_client.get_paginator('list_certificates').paginate(CertificateStatuses=['ISSUED']).build_full_result()

Boto3 has some cool built in paginator stuff, while loop works tho

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The version ef-open uses doesn't seem to have ACM paginators

except Exception:
return default
# No certificates
if len(response["CertificateSummaryList"]) < 1:
if not cert_summaries:
return default
# One or more certificates - find cert with latest IssuedAt date or an arbitrary cert if none are dated
best_match_cert = None
for cert_handle in response["CertificateSummaryList"]:
for cert_handle in cert_summaries:
if cert_handle["DomainName"] == domain_name:
cert = acm_client.describe_certificate(CertificateArn=cert_handle["CertificateArn"])["Certificate"]
# Patch up cert if there is no IssuedAt (i.e. cert was not issued by Amazon)
Expand Down
Loading