Current File : //lib/python2.7/site-packages/salt/states/boto_secgroup.pyo
�
���^c @@ sZ d Z d d l m Z m Z m Z d d l Z d d l Z d d l j j Z d d l
m Z d d l m
Z
e j e � Z d � Z d d d d e e d d d d d d � Z d d d d d d d � Z d � Z d
� Z d � Z e d d d d d d d � Z e d d d d d d d
� Z d d d d d d d � Z d d d d d d d � Z d S( uR
Manage Security Groups
======================
.. versionadded:: 2014.7.0
Create and destroy Security Groups. Be aware that this interacts with Amazon's
services, and so may incur charges.
This module uses ``boto``, which can be installed via package, or pip.
This module accepts explicit EC2 credentials but can also utilize
IAM roles assigned to the instance through Instance Profiles. Dynamic
credentials are then automatically obtained from AWS API and no further
configuration is necessary. More information available `here
<http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html>`_.
If IAM roles are not used you need to specify them either in a pillar file or
in the minion's config file:
.. code-block:: yaml
secgroup.keyid: GKTADJGHEIQSXMKKRBJ08H
secgroup.key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
It's also possible to specify ``key``, ``keyid`` and ``region`` via a profile, either
passed in as a dict, or as a string to pull from pillars or minion config:
.. code-block:: yaml
myprofile:
keyid: GKTADJGHEIQSXMKKRBJ08H
key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
region: us-east-1
.. code-block:: yaml
Ensure mysecgroup exists:
boto_secgroup.present:
- name: mysecgroup
- description: My security group
- vpc_name: myvpc
- rules:
- ip_protocol: tcp
from_port: 80
to_port: 80
cidr_ip:
- 10.0.0.0/8
- 192.168.0.0/16
- ip_protocol: tcp
from_port: 8080
to_port: 8090
cidr_ip:
- 10.0.0.0/8
- 192.168.0.0/16
- ip_protocol: icmp
from_port: -1
to_port: -1
source_group_name: mysecgroup
- ip_protocol: tcp
from_port: 8080
to_port: 8080
source_group_name: MyOtherSecGroup
source_group_name_vpc: MyPeeredVPC
- rules_egress:
- ip_protocol: all
from_port: -1
to_port: -1
cidr_ip:
- 10.0.0.0/8
- 192.168.0.0/16
- tags:
SomeTag: 'My Tag Value'
SomeOtherTag: 'Other Tag Value'
- region: us-east-1
- keyid: GKTADJGHEIQSXMKKRBJ08H
- key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
# Using a profile from pillars
Ensure mysecgroup exists:
boto_secgroup.present:
- name: mysecgroup
- description: My security group
- profile: myprofile
# Passing in a profile
Ensure mysecgroup exists:
boto_secgroup.present:
- name: mysecgroup
- description: My security group
- profile:
keyid: GKTADJGHEIQSXMKKRBJ08H
key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
region: us-east-1
.. note::
When using the ``profile`` parameter and ``region`` is set outside of
the profile group, region is ignored and a default region will be used.
If ``region`` is missing from the ``profile`` data set, ``us-east-1``
will be used as the default region.
i ( t absolute_importt print_functiont unicode_literalsN( t SaltInvocationError( t sixc C@ s d t k r d St S( u)
Only load if boto is available.
u boto_secgroup.existsu
boto_secgroup( t __salt__t False( ( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_secgroup.pyt __virtual__x s c
C@ s� i | d 6t d 6d d 6i d 6}
t | | d | d | d | d | d
|
d | �} | d |
d <d j |
d | d g � |
d <| d s� | d |
d <|
d t k r� |
S|
d d k r� |
Sn | d k rft | | | d | d | d | d | d
|
d | �} t j |
d | d � |
d <d j |
d | d g � |
d <| d sf| d |
d <qfn | d k rt | | | d | d | d | d | d
|
d | �} t j |
d | d � |
d <d j |
d | d g � |
d <| d s| d |
d <qn t d
| d | d | d | d | d | d
|
d | � } t j |
d | d � |
d <d j |
d | d g � |
d <| d s�| d |
d <n |
S( u�
Ensure the security group exists with the specified rules.
name
Name of the security group.
description
A description of this security group.
vpc_id
The ID of the VPC to create the security group in, if any. Exclusive with vpc_name.
vpc_name
The name of the VPC to create the security group in, if any. Exclusive with vpc_id.
.. versionadded:: 2016.3.0
.. versionadded:: 2015.8.2
rules
A list of ingress rule dicts. If not specified, ``rules=None``,
the ingress rules will be unmanaged. If set to an empty list, ``[]``,
then all ingress rules will be removed.
rules_egress
A list of egress rule dicts. If not specified, ``rules_egress=None``,
the egress rules will be unmanaged. If set to an empty list, ``[]``,
then all egress rules will be removed.
delete_ingress_rules
Some tools (EMR comes to mind) insist on adding rules on-the-fly, which
salt will happily remove on the next run. Set this param to False to
avoid deleting rules which were added outside of salt.
delete_egress_rules
Some tools (EMR comes to mind) insist on adding rules on-the-fly, which
salt will happily remove on the next run. Set this param to False to
avoid deleting rules which were added outside of salt.
region
Region to connect to.
key
Secret key to be used.
keyid
Access key to be used.
profile
A dict with region, key and keyid, or a pillar key (string)
that contains a dict with region, key, and keyid.
tags
List of key:value pairs of tags to set on the security group
.. versionadded:: 2016.3.0
u nameu resultu u commentu changest vpc_idt vpc_namet regiont keyt keyidt profileu t namet tagsN(
t Truet _security_group_presentt joinR t Nonet _rules_presentt
dictupdatet updatet _rules_egress_presentt
_tags_present( R t descriptionR R t rulest rules_egresst delete_ingress_rulest delete_egress_rulesR
R R R
R t rett _ret( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_secgroup.pyt present sJ G" !
!
!
!
c C@ se i t d 6d d 6i d 6} t d | | | | | | | � } | sNt d rn d j | � | d <d | d <| St d d | d
| d | d | d
| d | d | d | � }
|
r.i d d 6| d d <t d d | d d d
| d | d | d | d | d | � } i | d 6| d d <d j | � | d <qat | d <d j | � | d <n d j | � | d <| S( u�
given a group name or a group name and vpc id (or vpc name):
1. determine if the group exists
2. if the group does not exist, creates the group
3. return the group's configuration and any changes made
u resultu u commentu changesu boto_secgroup.existsu testu( Security group {0} is set to be created.u boto_secgroup.createR R R R R
R R R
u secgroupu oldu boto_secgroup.get_configt group_idu newu Security group {0} created.u$ Failed to create {0} security group.u Security group {0} present.N( R R t __opts__t formatR R ( R R R R R
R R R
R t existst createdt sg( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_secgroup.pyR � s.
"
c
C@ sE g } x8| D]0} | j d � } | j d � } | j d � } | r� t | t j � r� x� | D]) } | j � } | | d <| j | � q` Wq
| r� t | t j � r� x� | D]) } | j � } | | d <| j | � q� Wq
| r0t | t j � r0xA | D]) } | j � } | | d <| j | � q Wq
| j | � q
W| S( u
Split rules with lists into individual rules.
We accept some attributes as lists or strings. The data we get back from
the execution module lists rules as individual rules. We need to split the
provided rules into individual rules to compare them.
u cidr_ipu source_group_nameu source_group_group_id( t gett
isinstanceR t string_typest copyt append(
R t splitt rulet cidr_ipt
group_nameR! t ipt _ruleR t _id( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_secgroup.pyt _split_rules s,
c C@ sc | j d � d k r" d | d <n | j d � d k rD d | d <n | d | d k r_t j | d � t j | d � k r_t j | d � t j | d � k r_| j d � } | r� | | j d � k r� t S| j d � } | r | | j d � k r t S| j d � } | r.| | j d � k r.t S| j d � } | r_| | j d � k r_t Sn t S(
u�
Check to see if two rules are the same. Needed to compare rules fetched
from boto, since they may not completely match rules defined in sls files
but may be functionally equivalent.
u from_porti����u to_portu ip_protocolu cidr_ipu source_group_owner_idu source_group_group_idu source_group_nameN( R' R R t text_typeR R ( R- R1 t _cidr_ipt _owner_idt _group_idt _group_name( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_secgroup.pyt _check_rule2 s(
&&c
C@ sR g } g } x�| D]�} y t j | j d � � } Wn t k
rT t d � � n Xd d d d d d d d
d d d
d g } | | k r� d j | � j � s� t | � d k r� t d j | � � � n | d k r� d
| d <n | j d d � } | j d d � } | j d d � } | r;| s,| r;t d � � n | rV| rVt d � � n | pe| pe| swt d � � n t }
x' | D] } t
| | � r�t }
Pq�q�W|
s | j | � q q Wxd | D]\ } t }
x' | D] } t
| | � r�t }
Pq�q�W|
s�| j
d d � | j | � q�q�Wt j d | � t j d | � | | f S( u�
given a list of desired rules (rules) and existing rules (_rules) return
a list of rules to delete (to_delete) and to create (to_create)
u ip_protocoluT ip_protocol, to_port, and from_port are required arguments for security group rules.u tcpu 6i u udpu 17i u icmpu 1i u allu -1i����u {0}i� u9 Invalid ip_protocol {0} specified in security group rule.u cidr_ipu source_group_nameu source_group_group_iduL cidr_ip and source groups can not both be specified in security group rules.ui Either source_group_group_id or source_group_name can be specified in security group rules, but not both.u_ cidr_ip, source_group_group_id, or source_group_name must be provided for security group rules.u Rules to be deleted: %su Rules to be created: %sN( R R4 R' t KeyErrorR R# t isdigitt intR R R9 R R+ t popt logt debug( R t _rulest to_deletet to_createR- t ip_protocolt supported_protocolsR. R/ R! t
rule_foundR1 ( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_secgroup.pyt _get_rule_changesU sV
(
c C@ s� i t d 6d d 6i d 6} t d d | d d d | d | d
| d | d | d
| � }
|
s d j | � | d <t | d <| St | � } | s� | rxx� | D]� } | j d d � } | r� | }
| } | j d d � } | r� | }
d } n t d d | d | d
|
d | d | d
| d | � } | sDt d j | � � � n d | d <| rd| j d � n | | d <q� q� Wn t | |
d � \ } } | r�| n g } | s�| r�t
d r�d j | t j | � t j | � � } | | d <d | d <| S| r�t } xT | D]L } t d | d | d
| d | d | d
| d | | �} | s t } q q W| rwd j | � | d <q�d j | � | d <t | d <n | r\t } xT | D]L } t d | d | d
| d | d | d
| d | | �} | s�t } q�q�W| r)d j
| d d j | � g � | d <q\d j
| d d j | � g � | d <t | d <n i |
d d 6| d d <t d d | d d d | d | d
| d | d | d
| � }
i |
d d 6| d d <n | S(! u'
given a group name or group name and vpc_id (or vpc name):
1. get lists of desired rule changes (using _get_rule_changes)
2. authorize/create rules missing rules
3. if delete_ingress_rules is True, delete/revoke non-requested rules
4. return 'old' and 'new' group rules
u resultu u commentu changesu boto_secgroup.get_configR R! R
R R R
R R u8 {0} security group configuration could not be retrieved.u source_group_nameu source_group_name_vpcu boto_secgroup.get_group_idu> source_group_name {0} does not map to a valid source group id.u source_group_group_idu rulesu testul Security group {0} set to have rules modified.
To be created: {1}
To be deleted: {2}u boto_secgroup.revokeu$ Removed rules on {0} security group.u- Failed to remove rules on {0} security group.u boto_secgroup.authorizeu u$ Created rules on {0} security group.u- Failed to create rules on {0} security group.u oldu newN( R R R R# R R3 R' R R= RF R" t pprintt pformatR ( R R R R R R
R R R
R R& R- t _source_group_namet _group_vpc_namet
_group_vpc_idt _source_group_name_vpcR7 RA RB t msgt deletedt _deletedR% t _created( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_secgroup.pyR � s� "
" c C@ s i t d 6d d 6i d 6} t d d | d d! d | d | d
| d | d | d
| � }
|
s d j | � | d <t | d <| St | � } | s� | rxx� | D]� } | j d d! � } | r� | }
| } | j d d! � } | r� | }
d! } n t d d | d | d
|
d | d | d
| d | � } | sDt d j | � � � n d! | d <| rd| j d � n | | d <q� q� Wn t | |
d � \ } } | r�| n g } | s�| r t
d r�d j | t j | � t j | � � } | | d <d! | d <| S| r�t } xZ | D]R } t d | d | d
| d | d | d
| d | d t | �} | s t } q q W| r�d j
| d d j | � g � | d <q�d j
| d d j | � g � | d <t | d <n | r�t } xZ | D]R } t d | d | d
| d | d | d
| d | d t | �} | s�t } q�q�W| r[d j
| d d j | � g � | d <q�d j
| d d j | � g � | d <t | d <n i |
d d 6| d d <t d d | d d! d | d | d
| d | d | d
| � }
i |
d d 6| d d <n | S(" u
given a group name or group name and vpc_id (or vpc name):
1. get lists of desired rule changes (using _get_rule_changes)
2. authorize/create missing rules
3. if delete_egress_rules is True, delete/revoke non-requested rules
4. return 'old' and 'new' group rules
u resultu u commentu changesu boto_secgroup.get_configR R! R
R R R
R R u8 {0} security group configuration could not be retrieved.u source_group_nameu source_group_name_vpcu boto_secgroup.get_group_idu> source_group_name {0} does not map to a valid source group id.u source_group_group_idu rules_egressu testul Security group {0} set to have rules modified.
To be created: {1}
To be deleted: {2}u boto_secgroup.revoket egressu u* Removed egress rule on {0} security group.u3 Failed to remove egress rule on {0} security group.u boto_secgroup.authorizeu+ Created egress rules on {0} security group.u4 Failed to create egress rules on {0} security group.u oldu newN( R R R R# R R3 R' R R= RF R" RG RH R ( R R R R R R
R R R
R R& R- RI RJ RK RL R7 RA RB RM RN RO R% RP ( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_secgroup.pyR � s� "
" c
C@ sJ i | d 6t d 6d d 6i d 6} t d d | d d d | d
| d | d | d
| d | � } | r3t d r� d j | � | d <d | d <| St d d | d d d | d
| d | d | d
| d | � } | ri | d 6| d d <i d d 6| d d <d j | � | d <qFt | d <d j | � | d <n d j | � | d <| S( u�
Ensure a security group with the specified name does not exist.
name
Name of the security group.
vpc_id
The ID of the VPC to remove the security group from, if any. Exclusive with vpc_name.
vpc_name
The name of the VPC to remove the security group from, if any. Exclusive with vpc_name.
.. versionadded:: 2016.3.0
region
Region to connect to.
key
Secret key to be used.
keyid
Access key to be used.
profile
A dict with region, key and keyid, or a pillar key (string)
that contains a dict with region, key and keyid.
.. versionadded:: 2016.3.0
u nameu resultu u commentu changesu boto_secgroup.get_configR R! R
R R R
R R u testu( Security group {0} is set to be removed.u boto_secgroup.deleteu secgroupu oldu newu Security group {0} deleted.u$ Failed to delete {0} security group.u" {0} security group does not exist.N( R R R R" R# R (
R R R R
R R R
R R& RN ( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_secgroup.pyt absent[ s( %""
"
c C@ s i t d 6d d 6i d 6} | r t d d | d d" d | d | d
| d | d | d
| � } | s� d j | � | d <t | d <| S| }
i } g } | j d � r xv | d D]g }
|
| k r� |
| k r| j |
� qq� | |
| d |
k r | |
| |
<n |
j |
� q� Wn | rst d r�d j t | � d k rMd n d d j
| � � } d j
| d | g � | d <d" | d <qst d | d | d d" d
| d | d | d | d
| d | �} | st | d <d j
| d d j | � g � | d <| Sd | d k rAt j | d i i i d 6d 6� | d <n x/ | D]$ } | d | | d d d | <qHWn |
s| r�t d rj|
r�d j t |
j
� � d k r�d n d d j
|
j
� � � } d j
| d | g � | d <d" | d <n | r�d j t | j
� � d k r"d n d d j
| j
� � � } d j
| d | g � | d <d" | d <q�q�t j |
| � } t d | d | d d" d
| d | d | d | d
| d | �} | s�t | d <d } d j
| d | g � | d <| Sd | d k r.t j | d i i i d 6d 6� | d <n d | d k rit j | d i i i d 6d 6� | d <n xx | D]m } | | | d d d | <d | k rp| d r�| | d k r�| d | | d d d | <q�q�qpqpWn | r | r |
r d j
| d d! g � | d <q n | S(# u6
helper function to validate tags are correct
u resultu u commentu changesu boto_secgroup.get_configR R! R
R R R
R R u8 {0} security group configuration could not be retrieved.u tagsu testu, The following tag{0} set to be removed: {1}.i u s areu isu , u u boto_secgroup.delete_tagsu$ Error attempting to delete tags {0}.u oldu* The following tag{0} set to be added: {1}.u- The following tag {0} set to be updated: {1}.u
values areu value isu boto_secgroup.set_tagsu Error attempting to set tags.u newu Tags are already set.N( R R R R# R R' R+ R= R" t lenR R R t keys( R R R R R
R R R
R R& t tags_to_addt tags_to_updatet tags_to_removet existing_tagRM t temp_rett rem_tagt all_tag_changest tag( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_secgroup.pyR � s� "
-
+
%
!
!
++
.#( t __doc__t
__future__R R R t loggingRG t salt.utils.dictupdatet utilsR t salt.exceptionsR t salt.extR t getLoggert __name__R> R R R R R R3 R9 RF R R RR R ( ( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_secgroup.pyt <module>i sH
b" ! # C]f 8
Mini Shell