Current File : //usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyc
�
���^c @@ s d Z d d l m Z m Z m Z d d l Z d d l Z d d l j j
Z
d d l Z d d l Z e j
e � Z y; d d l Z d d l Z e j
d � j e j � e Z Wn e e f k
r� e Z n Xd � Z d � Z d d d d d � Z d d d d d d d d d � Z d d d d d d d d � Z d d d d d d d
� Z d d d d d � Z d d d d d � Z! d d d d d
� Z" d d d d d � Z# d d d d d � Z$ d d d d d � Z% d d d d d � Z& d d d d d d d � Z' d d d d d d d d d � Z( d d d d d d d d d � Z) d d d d d d � Z* d d d d d � Z+ d d d d d � Z, d d d d d d d � Z- d d d d d d d � Z. d d d d d � Z/ d d d d d d d d � Z0 d d d d d � Z1 d d d d d � Z2 d S( ur
Connection module for Amazon KMS
.. versionadded:: 2015.8.0
:configuration: This module accepts explicit kms credentials but can also utilize
IAM roles assigned to the instance through Instance Profiles. Dynamic
credentials are then automatically obtained from AWS API and no further
configuration is necessary. More Information available at::
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html
If IAM roles are not used you need to specify them either in a pillar or
in the minion's config file::
kms.keyid: GKTADJGHEIQSXMKKRBJ08H
kms.key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
A region may also be specified in the configuration::
kms.region: us-east-1
If a region is not specified, the default is us-east-1.
It's also possible to specify key, keyid and region via a profile, either
as a passed in dict, or as a string to pull from pillars or minion config:
myprofile:
keyid: GKTADJGHEIQSXMKKRBJ08H
key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
region: us-east-1
:depends: boto
i ( t absolute_importt print_functiont unicode_literalsNu botoc C@ s t j j j d d d t � S( u,
Only load if boto libraries exist.
t boto_veru 2.38.0t check_boto3( t saltt utilst versionst check_boto_reqst False( ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyt __virtual__@ s c C@ s7 t j j j t � t r3 t d t d d t �n d S( Nu boto.assign_funcsu kmst pack( R R t compatt pack_dundert __name__t HAS_BOTOt __utils__t __salt__( t opts( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyt __init__J s c C@ s� t d | d | d | d | � } i } y | j | | � t | d <Wn7 t j j k
r~ } t | d <t d | � | d <n X| S( u
Create a display name for a key.
CLI example::
salt myminion boto_kms.create_alias 'alias/mykey' key_id
t regiont keyt keyidt profileu resultu boto.get_erroru error( t _get_connt create_aliast Truet botot exceptiont BotoServerErrorR R ( t
alias_namet
target_key_idR R R R t connt rt e( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyR P s !
c
C@ s� t d | d | d | d | � }
| j d � r? t | � } n i } y2 |
j | | d | d | d | d | �| d
<Wn- t j j k
r� } t d | � | d <n X| S(
u�
Adds a grant to a key to specify who can access the key and under what
conditions.
CLI example::
salt myminion boto_kms.create_grant 'alias/mykey' 'arn:aws:iam::1111111:/role/myrole' operations='["Encrypt","Decrypt"]'
R R R R u alias/t retiring_principalt
operationst constraintst grant_tokensu grantu boto.get_erroru error( R t
startswitht _get_key_idt create_grantR R R R (
t key_idt grantee_principalR# R$ R% R& R R R R R R! R" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyR) e s !c C@ s� t d | d | d | d | � } i } t j j j | � } y- | j | d | d | �}
|
d | d <Wn- t j j k
r� } t d | � | d
<n X| S( u�
Creates a master key.
CLI example::
salt myminion boto_kms.create_key '{"Statement":...}' "My master key"
R R R R t descriptiont key_usageu KeyMetadatau key_metadatau boto.get_erroru error(
R R t serializerst jsont serializet
create_keyR R R R ( t policyR, R- R R R R R R! t _policyt key_metadataR" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyR1 � s ! c C@ s� t d | d | d | d | � } i } y- | j | d | d | �} | d | d <Wn- t j j k
r� }
t d |
� | d
<n X| S( um
Decrypt ciphertext.
CLI example::
salt myminion boto_kms.decrypt encrypted_ciphertext
R R R R t encryption_contextR& u Plaintextu plaintextu boto.get_erroru error( R t decryptR R R R ( t ciphertext_blobR5 R& R R R R R R! t plaintextR" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyR6 � s ! c C@ s� t d | d | d | d | � } i } y | j | � } t | d <WnS t j j k
r� } t | t j j j � r� t
| d <| St d | � | d <n X| S( uw
Check for the existence of a key.
CLI example::
salt myminion boto_kms.key_exists 'alias/mykey'
R R R R u resultu boto.get_erroru error( R t describe_keyR R R R t
isinstancet kmst
exceptionst NotFoundExceptionR R ( R* R R R R R R! R" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyt
key_exists� s !
c C@ s$ t | | | | | � d } | d S( u&
From an alias, get a key_id.
u key_metadatau KeyId( R9 ( t aliasR R R R R4 ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyR( � s c C@ s| t d | d | d | d | � } i } y! | j | � } | d | d <Wn- t j j k
rw } t d | � | d <n X| S( u}
Get detailed information about a key.
CLI example::
salt myminion boto_kms.describe_key 'alias/mykey'
R R R R u KeyMetadatau key_metadatau boto.get_erroru error( R R9 R R R R ( R* R R R R R R! R" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyR9 � s !c C@ s� t d | d | d | d | � } i } y | j | � } t | d <Wn7 t j j k
r} } t | d <t d | � | d <n X| S( ul
Mark key as disabled.
CLI example::
salt myminion boto_kms.disable_key 'alias/mykey'
R R R R u resultu boto.get_erroru error( R t disable_keyR R R R R R ( R* R R R R R R! R" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyR@ � s !
c C@ s� t d | d | d | d | � } i } y | j | � } t | d <Wn7 t j j k
r} } t | d <t d | � | d <n X| S( u�
Disable key rotation for specified key.
CLI example::
salt myminion boto_kms.disable_key_rotation 'alias/mykey'
R R R R u resultu boto.get_erroru error( R t disable_key_rotationR R R R R R ( R* R R R R R R! R" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyRA � s !
c C@ s� t d | d | d | d | � } i } y | j | � } t | d <Wn7 t j j k
r} } t | d <t d | � | d <n X| S( uj
Mark key as enabled.
CLI example::
salt myminion boto_kms.enable_key 'alias/mykey'
R R R R u resultu boto.get_erroru error( R t
enable_keyR R R R R R ( R* R R R R R R! R" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyRB s !
c C@ s� t d | d | d | d | � } i } y | j | � } t | d <Wn7 t j j k
r} } t | d <t d | � | d <n X| S( u�
Disable key rotation for specified key.
CLI example::
salt myminion boto_kms.enable_key_rotation 'alias/mykey'
R R R R u resultu boto.get_erroru error( R t enable_key_rotationR R R R R R ( R* R R R R R R! R" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyRC & s !
c C@ s� t d | d | d | d | � } i } y0 | j | | d | d | �}
|
d | d <Wn- t j j k
r� } t d | � | d
<n X| S( u�
Encrypt plaintext into cipher text using specified key.
CLI example::
salt myminion boto_kms.encrypt 'alias/mykey' 'myplaindata' '{"aws:username":"myuser"}'
R R R R R5 R& u CiphertextBlobu
ciphertextu boto.get_erroru error( R t encryptR R R R ( R* R8 R5 R& R R R R R R! t
ciphertextR" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyRD ; s ! c
C@ s� t d | d | d | d | � } i }
y5 | j | d | d | d | d | �} | |
d <Wn- t j j k
r� } t d
| � |
d <n X|
S( u�
Generate a secure data key.
CLI example::
salt myminion boto_kms.generate_data_key 'alias/mykey' number_of_bytes=1024 key_spec=AES_128
R R R R R5 t number_of_bytest key_specR& u data_keyu boto.get_erroru error( R t generate_data_keyR R R R (
R* R5 RF RG R& R R R R R R! t data_keyR" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyRH T s
! c
C@ s� t d | d | d | d | � } i }
y5 | j | d | d | d | d | �} | |
d <Wn- t j j k
r� } t d
| � |
d <n X|
S( u�
Generate a secure data key without a plaintext copy of the key.
CLI example::
salt myminion boto_kms.generate_data_key_without_plaintext 'alias/mykey' number_of_bytes=1024 key_spec=AES_128
R R R R R5 RF RG R& u data_keyu boto.get_erroru error( R t# generate_data_key_without_plaintextR R R R (
R* R5 RF RG R& R R R R R R! RI R" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyRJ o s ! c C@ s| t d | d | d | d | � } i } y! | j | � } | d | d <Wn- t j j k
rw } t d | � | d <n X| S( u{
Generate a random string.
CLI example::
salt myminion boto_kms.generate_random number_of_bytes=1024
R R R R u Plaintextu randomu boto.get_erroru error( R t generate_randomR R R R ( RF R R R R R R! t randomR" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyRK � s !c
C@ s� t d | d | d | d | � } i } y< | j | | � } t j j j | d d t j �| d <Wn- t j j
k
r� } t d | � | d <n X| S(
u�
Get the policy for the specified key.
CLI example::
salt myminion boto_kms.get_key_policy 'alias/mykey' mypolicy
R R R R u Policyt object_pairs_hooku
key_policyu boto.get_erroru error( R t get_key_policyR R. R/ t deserializet odictt OrderedDictR R R R (
R* t policy_nameR R R R R R! t
key_policyR" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyRN � s !
c C@ s| t d | d | d | d | � } i } y! | j | � } | d | d <Wn- t j j k
rw } t d | � | d <n X| S( u�
Get status of whether or not key rotation is enabled for a key.
CLI example::
salt myminion boto_kms.get_key_rotation_status 'alias/mykey'
R R R R u KeyRotationEnabledu resultu boto.get_erroru error( R t get_key_rotation_statusR R R R ( R* R R R R R R! t key_rotation_statusR" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyRT � s !c C@ s� t d | d | d | d | � } | j d � r? t | � } n i } y~ g } d
}
xa t r� | j | d | d |
�} x | d D] } | j | � q� Wd | k r� | d }
qW PqW W| | d
<Wn- t j j k
r� }
t
d |
� | d <n X| S( uy
List grants for the specified key.
CLI example::
salt myminion boto_kms.list_grants 'alias/mykey'
R R R R u alias/t limitt markeru Grantsu
NextMarkeru grantsu boto.get_erroru errorN( R R' R( t NoneR t list_grantst appendR R R R ( R* RV RW R R R R R R! t _grantst next_markert grantst grantR" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyRY � s* !
c C@ s� t d | d | d | d | � } | j d � r? t | � } n i } y- | j | d | d | �} | d | d <Wn- t j j k
r� }
t d
|
� | d <n X| S( u�
List key_policies for the specified key.
CLI example::
salt myminion boto_kms.list_key_policies 'alias/mykey'
R R R R u alias/RV RW u PolicyNamesu key_policiesu boto.get_erroru error( R R' R( t list_key_policiesR R R R ( R* RV RW R R R R R R! t key_policiesR" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyR_ � s ! c
C@ s� t d | d | d | d | � } i } y0 | j | | t j j j | � � t | d <Wn7 t j j k
r� } t
| d <t d | � | d <n X| S( u�
Attach a key policy to the specified key.
CLI example::
salt myminion boto_kms.put_key_policy 'alias/mykey' default '{"Statement":...}'
R R R R u resultu boto.get_erroru error( R t put_key_policyR R. R/ R0 R R R R R R (
R* RR R2 R R R R R R! R" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyRa s !"
c
C@ s� t d | d | d | d | � } i }
y) | j | | | | | � } | |
d <Wn- t j j k
r } t d | � |
d <n X|
S( u�
Reencrypt encrypted data with a new master key.
CLI example::
salt myminion boto_kms.re_encrypt 'encrypted_data' 'alias/mynewkey' default '{"Statement":...}'
R R R R u
ciphertextu boto.get_erroru error( R t
re_encryptR R R R (
R7 t destination_key_idt source_encryption_contextt destination_encryption_contextR& R R R R R R! RE R" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyRb s c C@ s� t d | d | d | d | � } | j d � r? t | � } n i } y | j | | � t | d <Wn7 t j j k
r� } t | d <t d | � | d <n X| S( u�
Revoke a grant from a key.
CLI example::
salt myminion boto_kms.revoke_grant 'alias/mykey' 8u89hf-j09j...
R R R R u alias/u resultu boto.get_erroru error(
R R' R( t revoke_grantR R R R R R ( R* t grant_idR R R R R R! R" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyRf ; s !
c C@ s� t d | d | d | d | � } i } y | j | | � t | d <Wn7 t j j k
r~ } t | d <t d | � | d <n X| S( u�
Update a key's description.
CLI example::
salt myminion boto_kms.update_key_description 'alias/mykey' 'My key'
R R R R u resultu boto.get_erroru error( R t update_key_descriptionR R R R R R ( R* R, R R R R R R! R" ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyRh R s !
(3 t __doc__t
__future__R R R t loggingt salt.utils.compatR t salt.utils.odictR RP t salt.serializers.jsont salt.utils.versionst getLoggerR t logR t boto.kmst setLevelt CRITICALR R t ImportErrort AttributeErrorR R
R RX R R) R1 R6 R> R( R9 R@ RA RB RC RD RH RJ RK RN RT RY R_ Ra Rb Rf Rh ( ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/boto_kms.pyt <module># sx
"
Mini Shell