Add wsARN for SNS Config

config/notifiers.go

@@ -897,14 +897,15 @@ type SNSConfig struct {
 
 	HTTPConfig *commoncfg.HTTPClientConfig `yaml:"http_config,omitempty" json:"http_config,omitempty"`
 
-	APIUrl      string            `yaml:"api_url,omitempty" json:"api_url,omitempty"`
-	Sigv4       sigv4.SigV4Config `yaml:"sigv4" json:"sigv4"`
-	TopicARN    string            `yaml:"topic_arn,omitempty" json:"topic_arn,omitempty"`
-	PhoneNumber string            `yaml:"phone_number,omitempty" json:"phone_number,omitempty"`
-	TargetARN   string            `yaml:"target_arn,omitempty" json:"target_arn,omitempty"`
-	Subject     string            `yaml:"subject,omitempty" json:"subject,omitempty"`
-	Message     string            `yaml:"message,omitempty" json:"message,omitempty"`
-	Attributes  map[string]string `yaml:"attributes,omitempty" json:"attributes,omitempty"`
+	APIUrl       string            `yaml:"api_url,omitempty" json:"api_url,omitempty"`
+	Sigv4        sigv4.SigV4Config `yaml:"sigv4" json:"sigv4"`
+	TopicARN     string            `yaml:"topic_arn,omitempty" json:"topic_arn,omitempty"`
+	PhoneNumber  string            `yaml:"phone_number,omitempty" json:"phone_number,omitempty"`
+	TargetARN    string            `yaml:"target_arn,omitempty" json:"target_arn,omitempty"`
+	Subject      string            `yaml:"subject,omitempty" json:"subject,omitempty"`
+	Message      string            `yaml:"message,omitempty" json:"message,omitempty"`
+	Attributes   map[string]string `yaml:"attributes,omitempty" json:"attributes,omitempty"`
+	WorkspaceArn string            `yaml:"workspace_arn,omitempty" json:"workspace_arn,omitempty"`
 }
 
 // UnmarshalYAML implements the yaml.Unmarshaler interface.

go.mod

@@ -6,13 +6,10 @@ require (
 	github.com/KimMachineGun/automemlimit v0.7.5
 	github.com/alecthomas/kingpin/v2 v2.4.0
 	github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b
+	github.com/aws/aws-sdk-go v1.55.8
 	github.com/aws/aws-sdk-go-v2 v1.41.1
 	github.com/aws/aws-sdk-go-v2/config v1.32.7
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.7
 	github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.6
-	github.com/aws/aws-sdk-go-v2/service/sns v1.39.11
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6
-	github.com/aws/smithy-go v1.24.0
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/cespare/xxhash/v2 v2.3.0
 	github.com/coder/quartz v0.3.0
@@ -34,6 +31,7 @@ require (
 	github.com/matttproud/golang_protobuf_extensions v1.0.4
 	github.com/oklog/run v1.2.0
 	github.com/oklog/ulid/v2 v2.1.1
+	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.23.2
 	github.com/prometheus/common v0.67.5
 	github.com/prometheus/exporter-toolkit v0.15.1
@@ -63,6 +61,7 @@ require (
 
 require (
 	github.com/armon/go-metrics v0.4.1 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.7 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
@@ -72,6 +71,8 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
+	github.com/aws/smithy-go v1.24.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/coreos/go-systemd/v22 v22.6.0 // indirect
@@ -105,6 +106,7 @@ require (
 	github.com/hashicorp/go-msgpack/v2 v2.1.5 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/jpillora/backoff v1.0.0 // indirect
 	github.com/julienschmidt/httprouter v1.3.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect

go.sum

@@ -77,6 +77,8 @@ github.com/armon/go-metrics v0.4.1 h1:hR91U9KYmb6bLBYLQjyM+3j+rcd/UhE+G78SFnF8gJ
 github.com/armon/go-metrics v0.4.1/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+3JqfkOG4=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ=
+github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
 github.com/aws/aws-sdk-go-v2 v1.41.1 h1:ABlyEARCDLN034NhxlRUSZr4l71mh+T5KAeGh6cerhU=
 github.com/aws/aws-sdk-go-v2 v1.41.1/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
 github.com/aws/aws-sdk-go-v2/config v1.32.7 h1:vxUyWGUwmkQ2g19n7JY/9YL8MfAIl7bTesIUykECXmY=
@@ -99,8 +101,6 @@ github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.6 h1:l4mxH8imZoflVEWWa
 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.35.6/go.mod h1:1qwmvfRBGTQ5shUxu+eQO/S2+O6o6SxbvcvtN62kmc0=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 h1:VrhDvQib/i0lxvr3zqlUwLwJP4fpmpyD9wYG1vfSu+Y=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.5/go.mod h1:k029+U8SY30/3/ras4G/Fnv/b88N4mAfliNn08Dem4M=
-github.com/aws/aws-sdk-go-v2/service/sns v1.39.11 h1:Ke7RS0NuP9Xwk31prXYcFGA1Qfn8QmNWcxyjKPcXZdc=
-github.com/aws/aws-sdk-go-v2/service/sns v1.39.11/go.mod h1:hdZDKzao0PBfJJygT7T92x2uVcWc/htqlhrjFIjnHDM=
 github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 h1:v6EiMvhEYBoHABfbGB4alOYmCIrcgyPPiBE1wZAEbqk=
 github.com/aws/aws-sdk-go-v2/service/sso v1.30.9/go.mod h1:yifAsgBxgJWn3ggx70A3urX2AN49Y5sJTD1UQFlfqBw=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 h1:gd84Omyu9JLriJVCbGApcLzVR3XtmC4ZDPcAI6Ftvds=
@@ -389,6 +389,10 @@ github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/jessevdk/go-flags v1.6.1 h1:Cvu5U8UGrLay1rZfv/zP7iLpSHGUZ/Ou68T0iX1bBK4=
 github.com/jessevdk/go-flags v1.6.1/go.mod h1:Mk8T1hIAWpOiJiHa9rJASDK2UGWji0EuPGBnNLMooyc=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -478,6 +482,7 @@ github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCko
 github.com/pelletier/go-toml/v2 v2.0.5/go.mod h1:OMHamSCAODeSsVrwwvcJOaoN0LIUIaFVNZzmWyNfXas=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=

notify/sns/aws_round_tripper.go

@@ -0,0 +1,34 @@
+package sns
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/aws/aws-sdk-go/aws/arn"
+	"github.com/prometheus/alertmanager/config"
+)
+
+type confusedDeputyRoundTripper struct {
+	workspaceArn arn.ARN
+	rt           http.RoundTripper
+}
+
+func (rt *confusedDeputyRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	req.Header.Set("x-amz-delegation-source-account", rt.workspaceArn.AccountID)
+	req.Header.Set("x-amz-delegation-source-arn", rt.workspaceArn.String())
+	return rt.rt.RoundTrip(req)
+}
+
+// newConfusedDeputyRoundTripper adds confused deputy headers
+func newConfusedDeputyRoundTripper(c *config.SNSConfig, rt http.RoundTripper) (http.RoundTripper, error) {
+	if c.WorkspaceArn == "" {
+		return rt, nil
+	}
+
+	arn, err := arn.Parse(c.WorkspaceArn)
+
+	if err != nil {
+		return nil, fmt.Errorf("%s is not a valid arn", c.WorkspaceArn)
+	}
+	return &confusedDeputyRoundTripper{arn, rt}, nil
+}

notify/sns/aws_round_tripper_test.go

@@ -0,0 +1,97 @@
+package sns
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/prometheus/alertmanager/config"
+	commoncfg "github.com/prometheus/common/config"
+)
+
+func TestRoundTripperWithArnNotConfigured(t *testing.T) {
+	var testCases = []struct {
+		name                 string
+		snsConfig            config.SNSConfig
+		expectedHeaders      map[string]string
+		deniedHeaders        []string
+		expectedErrorMessage string
+	}{
+		{
+			name: "Workspace invalid Arn configured",
+			snsConfig: config.SNSConfig{
+				WorkspaceArn: "arn:--Invalid",
+			},
+			expectedHeaders:      map[string]string{},
+			deniedHeaders:        []string{},
+			expectedErrorMessage: "arn:--Invalid is not a valid arn",
+		},
+		{
+			name:            "Workspace Arn not configured",
+			snsConfig:       config.SNSConfig{},
+			expectedHeaders: map[string]string{},
+			deniedHeaders: []string{
+				"x-amz-source-account",
+				"x-amz-source-arn",
+				"x-amz-delegation-source-arn",
+				"x-amz-delegation-source-account",
+			},
+		},
+		{
+			name: "Workspace Arn configured",
+			snsConfig: config.SNSConfig{
+				WorkspaceArn: "arn:aws:aps:us-west-2:948363459592:workspace/ws-de4908b6-950e-4c4c-9e49-ec68169bc4c7",
+			},
+			expectedHeaders: map[string]string{
+				"x-amz-delegation-source-account": "948363459592",
+				"x-amz-delegation-source-arn":     "arn:aws:aps:us-west-2:948363459592:workspace/ws-de4908b6-950e-4c4c-9e49-ec68169bc4c7",
+			},
+			deniedHeaders: []string{},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			testServer := newTestServer(func(w http.ResponseWriter, r *http.Request) {
+				for _, name := range tc.deniedHeaders {
+					if _, ok := r.Header[name]; ok {
+						t.Fatalf("Header %s should not be set", name)
+					}
+				}
+
+				for key, value := range tc.expectedHeaders {
+					if r.Header.Get(key) != value {
+						t.Fatalf("The received Headers (%s) does not contain all expected headers (%s).", r.Header, tc.expectedHeaders)
+						return
+					}
+				}
+			})
+
+			defer testServer.Close()
+
+			client, err := commoncfg.NewClientFromConfig(commoncfg.HTTPClientConfig{}, "test")
+
+			if err != nil && err.Error() != tc.expectedErrorMessage {
+				t.Fatal(err.Error())
+			}
+
+			client.Transport, err = newConfusedDeputyRoundTripper(&tc.snsConfig, client.Transport)
+
+			if err != nil && err.Error() != tc.expectedErrorMessage {
+				t.Fatal(err.Error())
+			}
+
+			_, err = client.Get(testServer.URL)
+
+			if err != nil && err.Error() != tc.expectedErrorMessage {
+				t.Fatal(err.Error())
+			}
+		})
+	}
+}
+
+func newTestServer(handler func(w http.ResponseWriter, r *http.Request)) *httptest.Server {
+	testServer := httptest.NewUnstartedServer(http.HandlerFunc(handler))
+	testServer.Start()
+	return testServer
+}