Current File : //lib/python2.7/site-packages/salt/modules/boto_secgroup.pyc
�
���^c @@ s� d Z d d l m Z m Z m Z d d l Z d d l m Z m Z d d l j
j Z d d l Z
e j e � Z d d l m Z y; d d l Z d d l Z e j d � j e j � e Z Wn e k
r� e Z n Xd � Z d d d d d d d d d � Z d d d d d d d � Z d
� Z d d d d d d d d d d � Z d � Z! d d d d d d d d
� Z" d d d d d d d � Z# d d d d d d d � Z$ d d d d d d d d d � Z% d d d d d d d � Z& d d d d d d d d d � Z' d d d d d d d d d d d d d d d e d � Z( d d d d d d d d d d d d d d d e d � Z) d d d d d d d d d � Z* d d d d d d d d d � Z+ d d d d d d d d d � Z, d S( u�
Connection module for Amazon Security Groups
.. versionadded:: 2014.7.0
:configuration: This module accepts explicit ec2 credentials but can
also utilize IAM roles assigned to the instance through Instance Profiles.
Dynamic credentials are then automatically obtained from AWS API and no
further configuration is necessary. More Information available at:
.. code-block:: text
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html
If IAM roles are not used you need to specify them either in a pillar or
in the minion's config file:
.. code-block:: yaml
secgroup.keyid: GKTADJGHEIQSXMKKRBJ08H
secgroup.key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
A region may also be specified in the configuration:
.. code-block:: yaml
secgroup.region: us-east-1
If a region is not specified, the default is us-east-1.
It's also possible to specify key, keyid and region via a profile, either
as a passed in dict, or as a string to pull from pillars or minion config:
.. code-block:: yaml
myprofile:
keyid: GKTADJGHEIQSXMKKRBJ08H
key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
region: us-east-1
:depends: boto
i ( t absolute_importt print_functiont unicode_literalsN( t CommandExecutionErrort SaltInvocationError( t sixu botoc C@ sH t j j j d d d t � } | t k rD t d t d d t �n | S( ug
Only load if boto libraries exist and if boto libraries are greater than
a given version.
t boto_veru 2.4.0t check_boto3u boto.assign_funcsu ec2t pack( t saltt utilst versionst check_boto_reqst Falset Truet __utils__t __name__t __salt__( t
has_boto_reqs( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt __virtual__H s
c
C@ so t d | d | d | d | � } t | d | d | d | d | d | d | d | d | �} | rg t St Sd S(
u|
Check to see if a security group exists.
CLI example::
salt myminion boto_secgroup.exists mysecgroup
t regiont keyt keyidt profilet namet vpc_idt vpc_namet group_idN( t _get_connt
_get_groupR R
(
R R R R R R R R t connt group( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt exists[ s ! c C@ s8 t d d | d | d | d | d | � } | j d � S( Nu boto_vpc.get_idR R R R R u id( R t get( R R R R R R t data( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt _vpc_name_to_ido s c C@ s� g } x� | D]� } | j d � } | j d � } | j d � } | j d � } x` | D]X } i | d 6| d 6| d 6} x' t j | � D] \ } }
|
| | <q� W| j | � qV Wq
W| S( u7
Split rules with combined grants into individual rules.
Amazon returns a set of rules with the same protocol, from and to ports
together as a single rule with a set of grants. Authorizing and revoking
rules, however, is done as a split set of rules. This function splits the
rules up.
u ip_protocolu to_portu from_portu grants( R! R t iteritemst append( t rulest splitt rulet ip_protocolt to_portt from_portt grantst grantt _ruleR t val( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt _split_rulesv s
c C@ s� | r | r t d � � n | r y1 t d | d | d | d | d | d | � } Wq t j j k
r{ } t j | � d SXn | r�| d k r#t j d | � i | d 6}
| j d
|
� } x! | D] } | j d k r� | Sq� Wt
| � d k rt d � � n t
| � d k r | d
Sd S| r�t j d | | � i | d 6| d 6}
| j d
|
� } t
| � d k r|| d
Sd Sq�d Snn | r�y | j d | g � }
Wn' t j j k
r�} t j | � d SXt
|
� d k r�|
d
Sd Sn d Sd S( u�
Get a group object given a name, name and vpc_id/vpc_name or group_id. Return
a boto.ec2.securitygroup.SecurityGroup object if the group is found, else
return None.
u: The params 'vpc_id' and 'vpc_name' are mutually exclusive.R R R R R R u getting group for %su
group-namet filtersi u8 Security group belongs to more VPCs, specify the VPC ID!i u! getting group for %s in vpc_id %su vpc_idt group_idsN( R R# t botot exceptiont BotoServerErrort logt debugt Nonet get_all_security_groupsR t lenR ( R R R R R R R R R t et group_filtert filtered_groupsR t groups( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyR � sP
c C@ s� g } x�| D]{} t j d | | j � d d d d g } t j � } x1| D])} t | | � } | so qN n | d k r/g } x� | D]� } t j d | � i d d 6d d
6d d 6d
d
6}
t j � } xB t j |
� D]1 \ } }
t | | � } | sq� n | | |
<q� W| j | � q� W| | d <qN | d k rNt | � | | <qN | d k rmt | � | | <qN | | | <qN W| j | � q
W| S( Nu examining rule %s for group %su ip_protocolu from_portu to_portu grantsu examining grant %s foru source_group_nameu nameu source_group_owner_idu owner_idu source_group_group_idu group_idu cidr_ip(
R6 R7 t idt odictt OrderedDictt getattrR R$ R% t int( t sgR& t _rulesR( t attrsR. t attrR/ t _grantsR- t g_attrst _grantt g_attrt
g_attr_mapt g_val( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt _parse_rules� s@
c
C@ s� t d | d | d | d | � } t | t j � r? | g } n t | t j � r] | g } n d d d d d d
d d d
d g
} g } y� | j d | d | d | � }
x� |
D]� } i } x� | D]� }
t | |
d � } |
d
k r� | j } nL |
d k rt | | � } n. |
d k r>g | � D] } | j ^ q&} n | | |
<q� W| | g 7} q� W| SWn' t
j j k
r�} t
j | � g SXd S( u�
Return a list of all Security Groups matching the given criteria and filters.
Note that the 'groupnames' argument only functions correctly for EC2 Classic
and default VPC Security Groups. To find groups by name in other VPCs you'll
want to use the 'group-name' filter instead.
Valid keys for the filters argument are:
description - The description of the security group.
egress.ip-permission.prefix-list-id - The ID (prefix) of the AWS service to which the security group allows access.
group-id - The ID of the security group.
group-name - The name of the security group.
ip-permission.cidr - A CIDR range that has been granted permission.
ip-permission.from-port - The start of port range for the TCP and UDP protocols, or an ICMP type number.
ip-permission.group-id - The ID of a security group that has been granted permission.
ip-permission.group-name - The name of a security group that has been granted permission.
ip-permission.protocol - The IP protocol for the permission (tcp | udp | icmp or a protocol number).
ip-permission.to-port - The end of port range for the TCP and UDP protocols, or an ICMP code.
ip-permission.user-id - The ID of an AWS account that has been granted permission.
owner-id - The AWS account ID of the owner of the security group.
tag-key - The key of a tag assigned to the security group.
tag-value - The value of a tag assigned to the security group.
vpc-id - The ID of the VPC specified when the security group was created.
CLI example::
salt myminion boto_secgroup.get_all_security_groups filters='{group-name: mygroup}'
R R R R u descriptionu idu instancesu nameu owner_idu regionu rulesu rules_egressu tagsu vpc_idt
groupnamesR2 R1 N( u rulesu rules_egress( R t
isinstanceR t string_typesR9 RB R8 R RN R? R3 R4 R5 R6 R7 ( RO R2 R1 R R R R R t interestingt rett rt gt nt at vt iR; ( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyR9 � s8 !
"
c C@ s� t d | d | d | d | � } | j d � rD t j d | � | St d | d | d | d
| d | d | d | d | � } t | d d � S(
u�
Get a Group ID given a Group Name or Group Name and VPC ID
CLI example::
salt myminion boto_secgroup.get_group_id mysecgroup
R R R R u sg-u0 group %s is a group id. get_group_id not called.R R R R u idN( R t
startswithR6 R7 R RB R8 ( R R R R R R R R R ( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt get_group_id- s ! c
C@ s� t j d | � g } xu | D]m } t d | d | d | d | d | d | d | � } | st t d j | � � � q | j t j | � � q Wt j d
| � | S( u�
Given a list of security groups and a vpc_id, convert_to_group_ids will
convert all list items in the given list to security group ids.
CLI example::
salt myminion boto_secgroup.convert_to_group_ids mysecgroup vpc-89yhh7h
u) security group contents %s pre-conversionR R R R R R R u7 Could not resolve Security Group name {0} to a Group IDu* security group contents %s post-conversion( R6 R7 R[ R t formatR% R t text_type(
R> R R R R R R R2 R R ( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt convert_to_group_ids? s
c
C@ s t d | d | d | d | � } t | d | d | d | d | d | d | d | d | �} | r� t j � }
| j |
d <| j |
d
<| j |
d <| j |
d <| j |
d
<t | | j
� } t | | j � } t | � |
d <t | � |
d <|
Sd Sd S( u�
Get the configuration for a security group.
CLI example::
salt myminion boto_secgroup.get_config mysecgroup
R R R R R R R R u nameu group_idu owner_idu descriptionu tagsu rulesu rules_egressN( R R R@ RA R R? t owner_idt descriptiont tagsRN R& t rules_egressR0 R8 (
R R R R R R R R R RD RS RE t
_rules_egress( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt
get_configY s" !
c C@ s� t d | d | d | d | � } | r� | r� y1 t d | d | d | d | d | d | � } Wq� t j j k
r� } t j | � t SXn | j | | | � }
|
r� t j d | � t
Sd j | � } t j | � t Sd S(
u�
Create a security group.
CLI example::
salt myminion boto_secgroup.create mysecgroup 'My Security Group'
R R R R R R u Created security group %s.u$ Failed to create security group {0}.N(
R R# R3 R4 R5 R6 R7 R
t create_security_groupt infoR R\ t error( R R` R R R R R R R R; t createdt msg( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt createy s !
c C@ s� t d | d | d | d | � } t | d | d | d | d | d | d | d | d | �} | r� | j d | j � }
|
r� t j d | j | j � t Sd
j | � } t j | � t
Sn t j d � t
Sd S(
ul
Delete a security group.
CLI example::
salt myminion boto_secgroup.delete mysecgroup
R R R R R R R R u% Deleted security group %s with id %s.u$ Failed to delete security group {0}.u Security group not found.N( R R t delete_security_groupR? R6 Rf R R R\ Rg R
R7 ( R R R R R R R R R R t deletedRi ( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt delete� s !
c C@ s� t d | d |
d | d | � } t | d | d |
d | d | d | d |
d | d | �} | r�y� d } | s� | j d | d
| d | d | d
| d | d | j d | � } n3 | j d | d | d
| d | d | j d | � } | r
t j d | j | j � t Sd j
| j | j � } t j | � t SWq�t
j j k
r�} | j d k r_t Sd j
| j | j � } t j | � t j | � t SXn t j d � t Sd S( u�
Add a new rule to an existing security group.
CLI example::
salt myminion boto_secgroup.authorize mysecgroup ip_protocol=tcp from_port=80 to_port=80 cidr_ip='['10.0.0.0/8', '192.168.0.0/24']'
R R R R R R R R t src_security_group_namet src_security_group_owner_idR) R+ R* t cidr_ipt src_security_group_group_idt src_group_idu* Added rule to security group %s with id %su5 Failed to add rule to security group {0} with id {1}.u InvalidPermission.Duplicateu% Failed to add rule to security group.N( R R R8 t authorize_security_groupR? t authorize_security_group_egressR6 Rf R R R\ Rg R
R3 R4 t EC2ResponseErrort
error_code( R t source_group_namet source_group_owner_idR) R+ R* Rp R t source_group_group_idR R R R R R t egressR R t addedRi R; ( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt authorize� sH !
c C@ s� t d | d |
d | d | � } t | d | d |
d | d | d | d |
d | d | �} | r�y� d } | s� | j d | d
| d | d | d
| d | d | j d | � } n3 | j d | d | d
| d | d | j d | � } | r
t j d | j | j � t Sd j
| j | j � } t j | � t SWq�t
j j k
r�} d j
| j | j � } t j | � t j | � t SXn t j d � t Sd S( u�
Remove a rule from an existing security group.
CLI example::
salt myminion boto_secgroup.revoke mysecgroup ip_protocol=tcp from_port=80 to_port=80 cidr_ip='10.0.0.0/8'
R R R R R R R R Rn Ro R) R+ R* Rp Rq Rr u/ Removed rule from security group %s with id %s.u: Failed to remove rule from security group {0} with id {1}.u* Failed to remove rule from security group.N( R R R8 t revoke_security_groupR? t revoke_security_group_egressR6 Rf R R R\ Rg R
R3 R4 Ru ( R Rw Rx R) R+ R* Rp R Ry R R R R R R Rz R R t revokedRi R; ( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt revoke� sD !
c C@ sT t | | f � r! t d � � n t | | | | f � sH t d � � n t d d � } | d | d | d | d | � } i i d 6}
| r� | g |
d
<n | r� | |
d d <n | r� | |
d d <n | r
x7 t j | � D]# \ } } | |
d d
j | � <q� Wn | j |
� }
t j d |
|
� |
rLg |
D] } | j
^ q9Sg Sd S( u�
Given VPC properties, find and return matching VPC ids.
Borrowed from boto_vpc; these could be refactored into a common library
u/ Only one of vpc_name or vpc_id may be provided.uO At least one of the following must be provided: vpc_id, vpc_name, cidr or tags.u boto.get_connection_funcu vpcR R R R u filtersu vpc_idsu cidru tag:Nameu tag:{0}u5 The filters criteria %s matched the following VPCs:%sN( t allR t anyR R R$ R\ t get_all_vpcsR6 R7 R? ( R R t cidrRa R R R R t local_get_connR t filter_parameterst tag_namet tag_valuet vpcst vpc( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt
_find_vpcs s, !
c C@ s� t d | d | d | d | � } t | d | d | d | d | d | d | d | d | �}
|
r� t | t � r� |
j | � q� d } t | � � n d
} t | � � t S( u�
sets tags on a security group
.. versionadded:: 2016.3.0
tags
a dict of key:value pair of tags to set on the security group
name
the name of the security group
group_id
the group id of the security group (in lie of a name/vpc combo)
vpc_name
the name of the vpc to search the named group for
vpc_id
the id of the vpc, in lieu of the vpc_name
region
the amazon region
key
amazon key
keyid
amazon keyid
profile
amazon profile
CLI example:
.. code-block:: bash
salt myminion boto_secgroup.set_tags "{'TAG1': 'Value1', 'TAG2': 'Value2'}" security_group_name vpc_id=vpc-13435 profile=my_aws_profile
R R R R R R R R u' Tags must be a dict of tagname:tagvalueu% The security group could not be found( R R RP t dictt add_tagsR R ( Ra R R R R R R R R R t secgrpRi ( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt set_tagsG s /! c C@ s� t d | d | d | d | � } t | d | d | d | d | d | d | d | d | �}
|
r� t | t � r� i } x | D] } d | | <q W|
j | � q� d }
t |
� � n d
}
t |
� � t S( u�
deletes tags from a security group
.. versionadded:: 2016.3.0
tags
a list of tags to remove
name
the name of the security group
group_id
the group id of the security group (in lie of a name/vpc combo)
vpc_name
the name of the vpc to search the named group for
vpc_id
the id of the vpc, in lieu of the vpc_name
region
the amazon region
key
amazon key
keyid
amazon keyid
profile
amazon profile
CLI example:
.. code-block:: bash
salt myminion boto_secgroup.delete_tags ['TAG_TO_DELETE1','TAG_TO_DELETE2'] security_group_name vpc_id=vpc-13435 profile=my_aws_profile
R R R R R R R R uA Tags must be a list of tagnames to remove from the security groupu% The security group could not be foundN( R R RP t listR8 t remove_tagsR R ( Ra R R R R R R R R R R� t tags_to_removet tagRi ( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt delete_tags� s /!
(- t __doc__t
__future__R R R t loggingt salt.exceptionsR R t salt.utils.odictR
R@ t salt.utils.versionsR t getLoggerR R6 t salt.extR R3 t boto.ec2t setLevelt CRITICALR t HAS_BOTOt ImportErrorR
R R8 R R# R0 R RN R9 R[ R^ Rd Rj Rm R| R� R� R� R� ( ( ( s> /usr/lib/python2.7/site-packages/salt/modules/boto_secgroup.pyt <module>+ s~
; $ = 3 1 ) 9
Mini Shell