newrelic-lambda integrations install uses arbitrary ingest key

[rittneje]

Description

The newrelic-lambda integrations install attempts to dynamically fetch the ingest key using the user key.

newrelic-lambda-cli/newrelic_lambda_cli/api.py

Lines 93 to 116 in 6b5d8d4

	def get_license_key(self):
	"""
	Fetch the license key for the NR Account
	"""
	res = self.query(
	"""
	query ($accountId: Int!) {
	actor {
	apiAccess {
	keySearch(query: {types: INGEST, scope: {accountIds: [$accountId]}}) {
	keys {
	key
	}
	}
	}
	}
	}
	""",
	accountId=self.account_id,
	)
	try:
	return res["actor"]["apiAccess"]["keySearch"]["keys"][0]["key"]
	except (KeyError, IndexError):
	return None

In modern times, it is possible to have multiple ingest keys, which means this code just picks one arbitrarily.

This in turn leads to issues, because no one expects it to use an ingest key that was intended for another purpose, and which could therefore be revoked later on without realizing the implication.

Steps to Reproduce

See above

Expected Behavior

There ought to be a command line parameter to indicate which ingest key to inject into the NewRelicLogIngestion stack. The CLI should either mandate this parameter is provided, or at least fail if it isn't and there are multiple license keys in the account. (The former is preferred.)

Relevant Logs / Console output

n/a

Your Environment

n/a

Additional context

n/a

[Newrelic-Boomi]

https://new-relic.atlassian.net/browse/NR-484222

[Newrelic-Boomi]

https://new-relic.atlassian.net/browse/TP-36891

[Sashwatdas123]

We recognise the importance of explicitly defining ingest key. This enhancement will be treated as a feature request, which will be scheduled based on our current priorities.