Update secret config

Author: devksingh4

Makefile

@@ -41,7 +41,6 @@ build: src/
 				rm -rf node_modules/aws-crt/dist/bin/{darwin*,linux-x64*,linux-arm64-musl} && \
 				rm -rf node_modules/argon2/prebuilds/{darwin*,freebsd*,linux-arm,linux-x64*,win32-x64*} && \
 				rm -rf node_modules/argon2/prebuilds/linux-arm64/argon2.armv8.musl.node"
-
 local:
 	VITE_BUILD_HASH=$(GIT_HASH) yarn run dev
 

src/dirsync/config.ts

@@ -4,18 +4,20 @@ import {
 } from "@aws-sdk/client-secrets-manager";
 import { z } from "zod";
 
-export const CONFIG_SECRET = "infra-core-api-gsuite-dirsync";
+export const CONFIG_SECRET = "infra-core-api-gsuite-dirsync-config";
 
 const SecretsConfigSchema = z.object({
   entraTenantId: z.string().min(1, "entraTenantId is required"),
   entraClientId: z.string().min(1, "entraClientId is required"),
-  entraClientSecret: z.string().min(1, "entraClientSecret is required"),
-  googleDelegatedUser: z
+  entraClientCertificate: z
     .string()
-    .email("googleDelegatedUser must be a valid email"),
-  googleServiceAccountJson: z
-    .string()
-    .min(1, "googleServiceAccountJson is required"),
+    .min(1, "entraClientCertificate is required"),
+  // googleDelegatedUser: z
+  //   .string()
+  //   .email("googleDelegatedUser must be a valid email"),
+  // googleServiceAccountJson: z
+  //   .string()
+  //   .min(1, "googleServiceAccountJson is required"),
   deleteRemovedContacts: z.boolean().default(false),
 });
 

src/dirsync/entra.ts

@@ -1,5 +1,5 @@
 import { Client } from "@microsoft/microsoft-graph-client";
-import { ClientSecretCredential } from "@azure/identity";
+import { ClientCertificateCredential } from "@azure/identity";
 import { parseDisplayName } from "../common/utils.js";
 
 export interface EntraUser {
@@ -24,13 +24,14 @@ interface GraphUser {
 export const createEntraClient = (
   tenantId: string,
   clientId: string,
-  clientSecret: string,
+  clientCertificate: string, // Base64 encoded PFX or PEM certificate
 ): Client => {
-  const credential = new ClientSecretCredential(
-    tenantId,
-    clientId,
-    clientSecret,
-  );
+  // Decode the certificate from base64
+  const certificateBuffer = Buffer.from(clientCertificate, "base64");
+
+  const credential = new ClientCertificateCredential(tenantId, clientId, {
+    certificate: certificateBuffer.toString("utf-8"), // For PEM format
+  });
 
   return Client.initWithMiddleware({
     authProvider: {

src/dirsync/sync.ts

@@ -14,7 +14,7 @@ export const handler = async (
   const entraClient = createEntraClient(
     secretConfig.entraTenantId,
     secretConfig.entraClientId,
-    secretConfig.entraClientSecret,
+    secretConfig.entraClientCertificate,
   );
   const entraUsers = await getAllEntraUsers(entraClient);
   logger.info(`Retrieved ${entraUsers.length} users from Entra ID.`);

terraform/modules/dirsync/main.tf

@@ -43,7 +43,7 @@ resource "aws_iam_policy" "this" {
         Action = ["secretsmanager:GetSecretValue"],
         Effect = "Allow",
         Resource = [
-          "arn:aws:secretsmanager:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:secret:infra-core-api-gsuite-dirsync*",
+          "arn:aws:secretsmanager:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:secret:infra-core-api-gsuite-dirsync-config*",
         ]
       },
     ]