list: add role to s3 lists

fixes: #12

app/models/base.py

@@ -26,6 +26,7 @@ class MirrorList(AbstractConfiguration):
     format = db.Column(db.String(20), nullable=False)
     container = db.Column(db.String(255), nullable=False)
     branch = db.Column(db.String(255), nullable=False)
+    role = db.Column(db.String(255), nullable=True)
     filename = db.Column(db.String(255), nullable=False)
 
     def destroy(self):

app/portal/forms.py

@@ -11,5 +11,3 @@ class EditMirrorForm(FlaskForm):
 class EditProxyForm(FlaskForm):
     origin = SelectField('Origin')
     submit = SubmitField('Save Changes')
-
-

app/portal/list.py

@@ -55,8 +55,6 @@ def list_new(group_id=None):
         ("bca", "Bypass Censorship Analytics"),
         ("bridgelines", "Tor Bridge Lines")
     ]
-    form.container.description = "GitHub Project, GitLab Project or AWS S3 bucket name."
-    form.branch.description = "Ignored for AWS S3."
     if form.validate_on_submit():
         list_ = MirrorList()
         list_.provider = form.provider.data
@@ -64,6 +62,7 @@ def list_new(group_id=None):
         list_.description = form.description.data
         list_.container = form.container.data
         list_.branch = form.branch.data
+        list_.role = form.role.data
         list_.filename = form.filename.data
         list_.created = datetime.utcnow()
         list_.updated = datetime.utcnow()
@@ -85,7 +84,12 @@ class NewMirrorListForm(FlaskForm):
     provider = SelectField('Provider', validators=[DataRequired()])
     format = SelectField('Distribution Method', validators=[DataRequired()])
     description = StringField('Description', validators=[DataRequired()])
-    container = StringField('Container', validators=[DataRequired()])
-    branch = StringField('Branch')
+    container = StringField('Container', validators=[DataRequired()],
+                            description="GitHub Project, GitLab Project or AWS S3 bucket name.")
+    branch = StringField('Git Branch/AWS Region', validators=[DataRequired()],
+                         description="For GitHub/GitLab, set this to the desired branch name, e.g. main. For AWS S3, "
+                                     "set this field to the desired region, e.g. us-east-1.")
+    role = StringField('Role ARN',
+                       description="(Optional) ARN for IAM role to assume for interaction with the S3 bucket.")
     filename = StringField('Filename', validators=[DataRequired()])
     submit = SubmitField('Save Changes')

app/portal/templates/base.html.j2

@@ -88,35 +88,35 @@
                             Onion Services
                         </a>
                     </li>
-                    <li class="nav-item">
-                        <a class="nav-link{% if section == "list" %} active{% endif %}"
-                           href="{{ url_for("portal.list.list_list") }}">
-                            Mirror Lists
-                        </a>
-                    </li>
                     <li class="nav-item">
                         <a class="nav-link{% if section == "bridgeconf" %} active{% endif %}"
                            href="{{ url_for("portal.bridgeconf.bridgeconf_list") }}">
                             Tor Bridges
                         </a>
                     </li>
+                    <li class="nav-item">
+                        <a class="nav-link{% if section == "list" %} active{% endif %}"
+                           href="{{ url_for("portal.list.list_list") }}">
+                            Mirror Lists
+                        </a>
+                    </li>
                 </ul>
                 <h6 class="sidebar-heading d-flex justify-content-between align-items-center px-3 mt-4 mb-1 text-muted">
                     <span>Infrastructure</span>
                 </h6>
                 <ul class="nav flex-column">
-                    <li class="nav-item">
-                        <a class="disabled nav-link{% if section == "eotk" %} active{% endif %}"
-                           href="#">
-                            EOTK Instances
-                        </a>
-                    </li>
                     <li class="nav-item">
                         <a class="nav-link{% if section == "proxy" %} active{% endif %}"
                            href="{{ url_for("portal.proxy.proxy_list") }}">
                             Proxies
                         </a>
                     </li>
+                    <li class="nav-item">
+                        <a class="nav-link{% if section == "eotk" %} active{% endif %}"
+                           href="#">
+                            EOTK Instances
+                        </a>
+                    </li>
                     <li class="nav-item">
                         <a class="nav-link{% if section == "bridge" %} active{% endif %}"
                            href="{{ url_for("portal.bridge.bridge_list") }}">

app/terraform/list/s3.py

@@ -20,14 +20,21 @@ class ListS3Automation(ListAutomation):
       }
     }
 
+    {% for list in lists %}
     provider "aws" {
       access_key = "{{ aws_access_key }}"
       secret_key = "{{ aws_secret_key }}"
-      region = "us-east-1"
+      region = "{{ list.branch }}"
+      {% if list.role %}
+      assume_role {
+        role_arn = "{{ list.role }}"
+      }
+      {% endif %}
+      alias = "list_{{ list.id }}"
     }
 
-    {% for list in lists %}
     resource "aws_s3_object" "object_{{ list.id }}" {
+      provider            = aws.list_{{ list.id }}
       bucket              = "{{ list.container }}"
       key                 = "{{ list.filename }}"
       source              = "{{ list.format }}.json"

migrations/versions/7155ba7dec60_add_role_for_s3_lists.py

@@ -0,0 +1,32 @@
+"""add role for s3 lists
+
+Revision ID: 7155ba7dec60
+Revises: 0a0a65db7f01
+Create Date: 2022-05-11 16:07:30.363508
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = '7155ba7dec60'
+down_revision = '0a0a65db7f01'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    with op.batch_alter_table('mirror_list', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('role', sa.String(length=255), nullable=True))
+
+    # ### end Alembic commands ###
+
+
+def downgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    with op.batch_alter_table('mirror_list', schema=None) as batch_op:
+        batch_op.drop_column('role')
+
+    # ### end Alembic commands ###