ysde/grafana-backup-tool

AWS credentials in shell environment overwrites backupSettings.json

HoukasaurusRex opened this issue · 0 comments

Description

When invoking grafana-backup in a shell environment that currently has AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY loaded by default, these will overwrite the key and secret set in the config file.

Expected Behaviour

I think it makes more sense to use the keys in backupSettings.json if provided and default to using AWS credentials in the environment if not provided.

The workaround for running on an aws lambda otherwise is setting the env vars in the current runtime before invoking like:

import os
import json
from grafana_backup.save import main as save
from grafana_backup.grafanaSettings import main as conf
from config import grafana_config

def handler(event = {}, context = {}):
    grafana_backup_settings = grafana_config['grafana_backup_settings']

    # Set env vars with vars in settings
    os.environ['AWS_ACCESS_KEY_ID'] = grafana_backup_settings['aws']['access_key_id']
    os.environ['AWS_SECRET_ACCESS_KEY'] = grafana_backup_settings['aws']['secret_access_key']

    config_dir = grafana_config['config_dir']
    grafana_backup_settings_filepath = os.path.abspath(os.path.join(config_dir, 'grafana-backup.json'))
    grafana_backup_settings_json = json.dumps(grafana_backup_settings, indent=4)
    if not os.path.exists(config_dir):
        os.makedirs(config_dir)
    with open(grafana_backup_settings_filepath, 'w') as grafana_backup_file:
        grafana_backup_file.write(grafana_backup_settings_json)
    settings = conf(grafana_backup_settings_filepath)
    save({}, settings)
    return {
        'success': True
    }

Which is not ideal for environments that rely on the reserved AWS credential environment variables for things like deployments as is the case with AWS lambda