Current File : //lib/python2.7/site-packages/salt/states/boto_kms.pyc
�
���^c @@ s� d Z d d l m Z m Z m Z d d l j j Z d d l m Z d � Z
d d d e e e
d d d d d �
Z d � Z d � Z d � Z d
� Z d � Z d S( u�
Manage KMS keys, key policies and grants.
.. versionadded:: 2015.8.0
Be aware that this interacts with Amazon's services, and so may incur charges.
This module uses ``boto``, which can be installed via package, or pip.
This module accepts explicit kms credentials but can also utilize
IAM roles assigned to the instance through Instance Profiles. Dynamic
credentials are then automatically obtained from AWS API and no further
configuration is necessary. More information available `here
<http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html>`_.
If IAM roles are not used you need to specify them either in a pillar file or
in the minion's config file:
.. code-block:: yaml
elb.keyid: GKTADJGHEIQSXMKKRBJ08H
elb.key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
It's also possible to specify ``key``, ``keyid`` and ``region`` via a profile,
either passed in as a dict, or as a string to pull from pillars or minion
config:
.. code-block:: yaml
myprofile:
keyid: GKTADJGHEIQSXMKKRBJ08H
key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
region: us-east-1
.. code-block:: yaml
Ensure mykey key exists:
boto_kms.key_present:
- name: mykey
- region: us-east-1
# Using a profile from pillars
Ensure mykey key exists:
boto_kms.key_present:
- name: mykey
- region: us-east-1
- profile: myprofile
# Passing in a profile
Ensure mykey key exists:
boto_key.key_present:
- name: mykey
- region: us-east-1
- profile:
keyid: GKTADJGHEIQSXMKKRBJ08H
key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
i ( t absolute_importt print_functiont unicode_literalsN( t SaltInvocationErrorc C@ s d t k r d St S( u)
Only load if boto is available.
u boto_kms.describe_keyu boto_kms( t __salt__t False( ( ( s8 /usr/lib/python2.7/site-packages/salt/states/boto_kms.pyt __virtual__@ s c C@ sO | s t d � � n | r: t | t � r: t d � � n t | t � sX t d � � n t | t � sv t d � � n t | t � s� t d � � n i | d 6t d 6d d 6i d
6} t | | | | | | | | |
| �
}
t j | d
|
d
� | d
<d j | d |
d g � | d <|
d sK|
d | d <| d t k rK| Sn | S( u,
Ensure the KMS key exists. KMS keys can not be deleted, so this function
must be used to ensure the key is enabled or disabled.
name
Name of the key.
policy
Key usage policy.
description
Description of the key.
key_usage
Specifies the intended use of the key. Can only be set on creation,
defaults to ENCRYPT_DECRYPT, which is also the only supported option.
grants
A list of grants to apply to the key. Not currently implemented.
manage_grants
Whether or not to manage grants. False by default, which will not
manage any grants.
key_rotation
Whether or not key rotation is enabled for the key. False by default.
enabled
Whether or not the key is enabled. True by default.
region
Region to connect to.
key
Secret key to be used.
keyid
Access key to be used.
profile
A dict with region, key and keyid, or a pillar key (string)
that contains a dict with region, key and keyid.
u policy is a required argument.u manage_grants must be a list.u$ manage_grants must be true or false.u# key_rotation must be true or false.u enabled must be true or false.u nameu resultu u commentu changesu (
R t
isinstancet listt boolt Truet _key_presentt
dictupdatet updatet joinR ( t namet policyt descriptiont key_usaget grantst
manage_grantst key_rotationt enabledt regiont keyt keyidt profilet rett _ret( ( s8 /usr/lib/python2.7/site-packages/salt/states/boto_kms.pyt key_presentG s* 8" !
c
C@ s i t d 6d d 6i d 6}
d j | � } t d | | | | | � } d | k r{ t |
d <d j | d d � |
d <|
S| d s�t d
r� d |
d <d |
d <|
St d | | | | | | | � }
d |
k r� t |
d <d
j |
d d � |
d <|
S|
d } | d } t d | | | | | | � } d | k rit |
d <d j | | d d � |
d <|
Si d d 6|
d d <i | d 6|
d d <d j | � |
d <nmt d | | | | | � } d | k r�t |
d <d j | d d � |
d <|
S| d } t | | | | | | � } t j |
d | d � |
d <d j |
d | d g � |
d <| d s�| d |
d <|
d t k r�|
Sn t
| | | | | | � } t j |
d | d � |
d <d j |
d | d g � |
d <| d s| d |
d <|
d t k r|
Sn t | | | | | | � } t j |
d | d � |
d <d j |
d | d g � |
d <| d s�| d |
d <|
d t k r�|
Sn t | | | | | | � } t j |
d | d � |
d <d j |
d | d g � |
d <| d s| d |
d <n |
S( Nu resultu u commentu changesu alias/{0}u boto_kms.key_existsu erroru' Error when attempting to find key: {0}.u messageu testu Key is set to be created.u boto_kms.create_keyu Failed to create key: {0}u key_metadatau KeyIdu boto_kms.create_aliasuq Failed to create key alias for key_id {0}. This resource will be left dangling. Please clean manually. Error: {1}u keyu oldu newu Key {0} created.u boto_kms.describe_keyu Failed to update key: {0}.u (
R
t formatR R t __opts__t Nonet _key_descriptionR R
R t _key_policyt _key_enabledt
_key_rotation( R R R R R R R R R R R t aliast rt rct key_metadatat
kms_key_idt rnt rdR ( ( s8 /usr/lib/python2.7/site-packages/salt/states/boto_kms.pyR � s�
!
!
!
!
c
C@ s� i t d 6d d 6i d 6} | d } | d | k r9 | St d r[ d | d <d | d <| S| r� t d | | | | | � } d } n" t d
| | | | | � } d } d | k r� t | d <d
j | d d � | d <n d j | � | d <| S( Nu resultu u commentu changesu KeyIdu Enabledu testu' Key set to have enabled status updated.u boto_kms.enable_keyu boto_kms.disable_keyu Disabledu erroru) Failed to update key enabled status: {0}.u messageu {0} key.( R
R R R R R (
R( R R R R R R R) t ret event( ( s8 /usr/lib/python2.7/site-packages/salt/states/boto_kms.pyR# s(
c C@ s� i t d 6d d 6i d 6} | d | k r/ | St d rQ d | d <d | d <| St d | d | | | | | � } d
| k r� t | d <d j | d
d � | d <n
d
| d <| S( Nu resultu u commentu changesu Descriptionu testu$ Key set to have description updated.u boto_kms.update_key_descriptionu KeyIdu erroru& Failed to update key description: {0}.u messageu Updated key description.( R
R R R R R ( R( R R R R R R t rdu( ( s8 /usr/lib/python2.7/site-packages/salt/states/boto_kms.pyR! s
c C@ s~ i t d 6d d 6i d 6} | d } t d | | | | | � } | d | k rU | St d rw d | d <d | d <| S| d s� d
| d <d | d <| S| r� t d | | | | | � } n t d | | | | | � } d | k r@d
| d d k rd
}
d | d <|
| d <| St | d <d j | d d � | d <n: i i | d 6d 6i | d 6d 6| d <d j | � | d <| S( Nu resultu u commentu changesu KeyIdu boto_kms.get_key_rotation_statusu testu, Key set to have key rotation policy updated.u Enabledu2 Key is disabled, not changing key rotation policy.u boto_kms.enable_key_rotationu erroru is disabledu messageu Failed to set key rotation: {0}.u key_rotationu oldu newu Set key rotation policy to {0}.( R
R R R R R ( R( R R R R R R R) t rket rkt msg( ( s8 /usr/lib/python2.7/site-packages/salt/states/boto_kms.pyR$ . s>
c
C@ s� i t d 6d d 6i d 6} | d } t d | d | | | | � } | d | k rX | St d r� d
j | d � | d <d | d <| St d | d | | | | | � } d | k r� t | d <d
j | d | d d � | d <n
d | d <| S( Nu resultu u commentu changesu KeyIdu boto_kms.get_key_policyu defaultu
key_policyu testu' {0} Key set to have key policy updated.u boto_kms.put_key_policyu erroru$ {0} Failed to update key policy: {1}u messageu Updated key policy.( R
R R R R R (
R( R R R R R R R) t rkpt rpkp( ( s8 /usr/lib/python2.7/site-packages/salt/states/boto_kms.pyR" Y s"
%
( t __doc__t
__future__R R R t salt.utils.dictupdatet utilsR t salt.exceptionsR R R R R
R R R# R! R$ R" ( ( ( s8 /usr/lib/python2.7/site-packages/salt/states/boto_kms.pyt <module>: s&
G f +
Mini Shell