Current File : //usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyc
�
���^c
@@ s� d Z d d l m Z m Z m Z d d l Z d d l j j Z d d l m
Z
d d l Z d d l
m Z e j e � Z d � Z d d d d d d e d d d d e d � Z d d d d d d d � Z d d d d d � Z d d d d d
� Z d � Z d d d d d e d � Z d d d d d d
� Z d d d d d � Z d d d d d � Z d d d d d � Z d d d d d � Z d d d d d � Z d d d d d � Z! d S( uq
Manage IAM roles
================
.. versionadded:: 2014.7.0
This module uses ``boto``, which can be installed via package, or pip.
This module accepts explicit IAM credentials but can also utilize
IAM roles assigned to the instance through Instance Profiles. Dynamic
credentials are then automatically obtained from AWS API and no further
configuration is necessary. More information available `here
<http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html>`_.
If IAM roles are not used you need to specify them either in a pillar file or
in the minion's config file:
.. code-block:: yaml
iam.keyid: GKTADJGHEIQSXMKKRBJ08H
iam.key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
It's also possible to specify ``key``, ``keyid`` and ``region`` via a profile, either
passed in as a dict, or as a string to pull from pillars or minion config:
.. code-block:: yaml
myprofile:
keyid: GKTADJGHEIQSXMKKRBJ08H
key: askjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
region: us-east-1
Creating a role will automatically create an instance profile and associate it
with the role. This is the default behavior of the AWS console.
.. code-block:: yaml
myrole:
boto_iam_role.present:
- region: us-east-1
- key: GKTADJGHEIQSXMKKRBJ08H
- keyid: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
- policies_from_pillars:
- shared_iam_bootstrap_policy
- policies:
MySQSPolicy:
Statement:
- Action:
- sqs:*
Effect: Allow
Resource:
- arn:aws:sqs:*:*:*
Sid: MyPolicySQS1
MyS3Policy:
Statement:
- Action:
- s3:GetObject
Effect: Allow
Resource:
- arn:aws:s3:*:*:mybucket/*
# Using a credentials profile from pillars
myrole:
boto_iam_role.present:
- profile: myiamprofile
# Passing in a credentials profile
myrole:
boto_iam_role.present:
- profile:
key: GKTADJGHEIQSXMKKRBJ08H
keyid: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
region: us-east-1
If ``delete_policies: False`` is specified, existing policies that are not in
the given list of policies will not be deleted. This allows manual modifications
on the IAM role to be persistent. This functionality was added in 2015.8.0.
.. note::
When using the ``profile`` parameter and ``region`` is set outside of
the profile group, region is ignored and a default region will be used.
If ``region`` is missing from the ``profile`` data set, ``us-east-1``
will be used as the default region.
i ( t absolute_importt print_functiont unicode_literalsN( t OrderedDict( t sixc C@ s d t k r d St S( u)
Only load if boto is available.
u boto_iam.role_existsu
boto_iam_role( t __salt__t False( ( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyt __virtual__c s c
C@ s� i | d 6t d 6d d 6i d 6}
i } | r} t d | � } | r} | d | d <| j d g � | d j | d � q} n | r� | d | d <| j d g � | d j | d � n t | | | | | |
| � } | s� i } n | s� g } n | sg } n i } x+ | D]# } t d | � } | j | � qW| j | � | d |
d <d j |
d | d g � |
d <| d s�| d |
d <|
d t k r�|
Sn | r�t | | | |
| � } t j |
d | d � |
d <d j |
d | d g � |
d <| d s/| d |
d <|
d t k r/|
Sn t
| | | |
| � } t j |
d | d � |
d <d j |
d | d g � |
d <| d s�| d |
d <|
d t k r�|
Sq�n t | | | | |
| | � } t j |
d | d � |
d <d j |
d | d g � |
d <| d s0| d |
d <n t | | | | |
| � } t j |
d | d � |
d <d j |
d | d g � |
d <| d s�| d |
d <n |
S(
u
Ensure the IAM role exists.
name
Name of the IAM role.
policy_document
The policy that grants an entity permission to assume the role.
(See https://boto.readthedocs.io/en/latest/ref/iam.html#boto.iam.connection.IAMConnection.create_role)
policy_document_from_pillars
A pillar key that contains a role policy document. The statements
defined here will be appended with the policy document statements
defined in the policy_document argument.
.. versionadded:: 2017.7.0
path
The path to the role/instance profile.
(See https://boto.readthedocs.io/en/latest/ref/iam.html#boto.iam.connection.IAMConnection.create_role)
policies
A dict of IAM role policies.
policies_from_pillars
A list of pillars that contain role policy dicts. Policies in the
pillars will be merged in the order defined in the list and key
conflicts will be handled by later defined keys overriding earlier
defined keys. The policies defined here will be merged with the
policies defined in the policies argument. If keys conflict, the keys
in the policies argument will override the keys defined in
policies_from_pillars.
managed_policies
A list of (AWS or Customer) managed policies to be attached to the role.
create_instance_profile
A boolean of whether or not to create an instance profile and associate
it with this role.
region
Region to connect to.
key
Secret key to be used.
keyid
Access key to be used.
profile
A dict with region, key and keyid, or a pillar key (string)
that contains a dict with region, key and keyid.
delete_policies
Deletes existing policies that are not in the given list of policies. Default
value is ``True``. If ``False`` is specified, existing policies will not be deleted
allowing manual modifications on the IAM role to be persistent.
.. versionadded:: 2015.8.0
u nameu resultu u commentu changesu
pillar.getu Versionu Statementu (
t TrueR t
setdefaultt extendt
_role_presentt updatet joinR t _instance_profile_presentt
dictupdatet _instance_profile_associatedt _policies_presentt _policies_attached( t namet policy_documentt policy_document_from_pillarst patht policiest policies_from_pillarst managed_policiest create_instance_profilet regiont keyt keyidt profilet delete_policiest rett _policy_documentt from_pillarst _rett _policiest policyt _policy( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyt presentj st J"
!
!
!
!
!
c
C@ s2 i t d 6d d 6i d 6} t d | | | | | � } | s� t d rh d j | � | d <d | d <| St d | | | | | | | � } | r� i d d 6| d d
<i | d 6| d d <d j | � | d <q.t | d <d
j | � | d <n>d j | � | d <| s%t d | | | | � }
n | }
t j j j t
| d � t
|
� � r.t d r�d } d j | d | � | d <d | d <| St d | |
| | | | � } | rd } d j | d | � | d <i | d d 6| d d
<i |
d 6| d d <q.t | d <d } d j | d | � | d <n | S( Nu resultu u commentu changesu boto_iam.describe_roleu testu" IAM role {0} is set to be created.u boto_iam.create_roleu roleu oldu newu IAM role {0} created.u Failed to create {0} IAM role.u {0} role present.u boto_iam.build_policyu assume_role_policy_documentu* Assume role policy document to be updated.u {0} {1}u" boto_iam.update_assume_role_policyu$ Assume role policy document updated.u policy_documentu$ Failed to update assume role policy.( R R t __opts__t formatt NoneR t saltt utilst
dictdiffert deep_difft _sort_policy(
R R R R R R R R t rolet createdR! t msgt updated( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyR � sR
c C@ s� i t d 6d d 6i d 6} t d | | | | | � } | s� t d rh d j | � | d <d | d <| St d | | | | | � } | r� i d d 6| d d
<i | d 6| d d <d j | � | d <q� t | d <d
j | � | d <n | S( Nu resultu u commentu changesu boto_iam.instance_profile_existsu testu* Instance profile {0} is set to be created.u boto_iam.create_instance_profileu instance_profileu oldu newu Instance profile {0} created.u& Failed to create {0} instance profile.( R R R( R) R* R ( R R R R R R t existsR1 ( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyR + s$
c C@ s� i t d 6d d 6i d 6} t d | | | | | | � } | s� t d rk d j | � | d <d | d <| St d | | | | | | � } | r� i d d 6| d d
<i t d 6| d d <d j | � | d <q� t | d <d
j | � | d <n | S( Nu resultu u commentu changesu boto_iam.profile_associatedu testu- Instance profile {0} is set to be associated.u" boto_iam.associate_profile_to_roleu profile_associatedu oldu newu Instance profile {0} associated.u7 Failed to associate {0} instance profile with {0} role.( R R R( R) R* R ( R R R R R R t
is_associatedt
associated( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyR F s(
c C@ s� t | t � r2 t g | D] } t | � ^ q � St | t t f � r t g t j | � D] \ } } | t | � f ^ qZ � S| S( u
List-type sub-items in policies don't happen to be order-sensitive, but
compare operations will render them unequal, leading to non-idempotent
state runs. We'll sort any list-type subitems before comparison to reduce
the likelihood of false negatives.
( t
isinstancet listt sortedR/ t dictR R t iteritems( t doct it kt v( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyR/ c s
#8c
C@ s� i t d 6d d 6i d 6} i } g } xU t j | � D]D \ }
} t d | |
| | | | � } | | k r7 | | |
<q7 q7 Wt d | | | | | � }
x0 |
D]( }
| r� |
| k r� | j |
� q� q� W| s� | r�t | � } | j | � t d r*d j d j | � | � | d <d | d <| Si |
d
6| d d <x� t j | � D]� \ }
} t d | |
| | | | | � } | sOt d | | | | | � }
i |
d
6| d d
<t | d <d j |
| � | d <| SqOWx� | D]� }
t d | |
| | | | � } | s�t d | | | | | � }
i |
d
6| d d
<t | d <d j |
| � | d <| Sq�Wt d | | | | | � }
i |
d
6| d d
<d j d j |
� | � | d <n | S( Nu resultu u commentu changesu boto_iam.get_role_policyu boto_iam.list_role_policiesu testu( {0} policies to be modified on role {1}.u , u policiesu oldu boto_iam.create_role_policyu newu$ Failed to add policy {0} to role {1}u boto_iam.delete_role_policyu) Failed to remove policy {0} from role {1}u" {0} policies modified on role {1}.( R R R; R t appendR8 R
R( R) R
R* R ( R R R R R R R R t policies_to_createt policies_to_deletet policy_nameR% R& t _listt
_to_modifyt
policy_sett policy_unset( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyR q sp
"c C@ s� i t d 6d d 6i d 6} g } g } x� | p3 g D]� } t d | d d d | d | d
| d | �}
t } x9 |
j d g � D]% } | | j d
� k r� t } Pq� q� W| s4 | j | � q4 q4 Wt d | d | d | d
| d | �}
g |
D] } | j d � ^ q� } xQ |
D]I } | j d � | k r| j d � | k r| j | j d � � qqW| sn| r�t | � } | j | � t d r�d j d j | � | � | d <d | d <| Si | d 6| d d <x� | D]� } t d | d | d | d | d
| d | �} | s�t d | d | d | d
| d | �}
g |
D] } | j d � ^ qC} i | d 6| d d <t | d <d j | | � | d <| Sq�Wx� | D]� } t d | d | d | d | d
| d | �} | s�t d | d | d | d
| d | �}
g |
D] } | j d � ^ q } i | d 6| d d <t | d <d j | | � | d <| Sq�Wt d | d | d | d
| d | �}
g |
D] } | j d � ^ q�} t j | � i | d 6| d d <d j d j | � | � | d <n | S( Nu resultu u commentu changesu! boto_iam.list_entities_for_policyt
entity_filteru RoleR R R R u policy_rolesu role_nameu$ boto_iam.list_attached_role_policiesu
policy_arnu policy_nameu testu( {0} policies to be modified on role {1}.u , u managed_policiesu oldu boto_iam.attach_role_policyt role_nameu newu$ Failed to add policy {0} to role {1}u boto_iam.detach_role_policyu) Failed to remove policy {0} from role {1}u" {0} policies modified on role {1}.(
R R R t getR@ R8 R
R( R) R
R* t logt debug( R R R R R R R t policies_to_attacht policies_to_detachR% t entitiest foundt roledictRD t xt oldpoliciest policy_dataRE RC RF t newpoliciesRG ( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyR � s� !"
!"
!"
!"
"c C@ s� i | d 6t d 6d d 6i d 6} t | | | | | � } | d | d <d j | d | d g � | d <| d s� | d | d <| d t k r� | Sn t | | | | | � } | d | d <d j | d | d g � | d <| d s| d | d <| d t k r| Sn t | | | | | � } t j | d | d � | d <d j | d | d g � | d <| d s�| d | d <| d t k r�| Sn t | | | | | � } t j | d | d � | d <d j | d | d g � | d <| d s| d | d <| d t k r| Sn t | | | | | � } t j | d | d � | d <d j | d | d g � | d <| d s�| d | d <n | S( uW
Ensure the IAM role is deleted.
name
Name of the IAM role.
region
Region to connect to.
key
Secret key to be used.
keyid
Access key to be used.
profile
A dict with region, key and keyid, or a pillar key (string)
that contains a dict with region, key and keyid.
u nameu resultu u commentu changesu (
R t _policies_absentR
R t _policies_detachedt _instance_profile_disassociatedR R t _instance_profile_absentt _role_absent( R R R R R R R# ( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyt absent� sF "!
!
!
!
!
c C@ s i t d 6d d 6i d 6} t d | | | | | � } | r� t d rh d j | � | d <d | d <| St d | | | | | � } | r� i | d 6| d d
<i d d 6| d d <d j | � | d <q� t | d <d
j | � | d <n d j | � | d <| S( Nu resultu u commentu changesu boto_iam.role_existsu testu" IAM role {0} is set to be removed.u boto_iam.delete_roleu roleu oldu newu IAM role {0} removed.u Failed to delete {0} iam role.u {0} role does not exist.( R R R( R) R* R ( R R R R R R R4 t deleted( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyRZ = s&
c C@ s i t d 6d d 6i d 6} t d | | | | | � } | r� t d rh d j | � | d <d | d <| St d | | | | | � } | r� i | d 6| d d
<i d d 6| d d <d j | � | d <q� t | d <d
j | � | d <n d j | � | d <| S( Nu resultu u commentu changesu boto_iam.instance_profile_existsu testu* Instance profile {0} is set to be removed.u boto_iam.delete_instance_profileu instance_profileu oldu newu Instance profile {0} removed.u& Failed to delete {0} instance profile.u$ {0} instance profile does not exist.( R R R( R) R* R ( R R R R R R R4 R\ ( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyRY [ s&
c C@ s i t d 6d d 6i d 6} t d | | | | | � } | sT d j | � | d <| St d r� d j d j | � | � | d <d | d <| Si | d
6| d d <x� | D]� } t d | | | | | | � } | s� t d | | | | | � } i | d
6| d d
<t | d <d j | | � | d <| Sq� Wt d | | | | | � } i | d
6| d d
<d j d j | � | � | d <| S( Nu resultu u commentu changesu boto_iam.list_role_policiesu No policies in role {0}.u testu) {0} policies to be removed from role {1}.u , u policiesu oldu boto_iam.delete_role_policyu newu$ Failed to add policy {0} to role {1}u# {0} policies removed from role {1}.( R R R) R( R
R* R ( R R R R R R RD RC RG ( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyRV y s<
c C@ s i t d 6d d 6i d 6} t d d | d | d | d | d
| � } g | D] } | j d � ^ qM } | s� d j | � | d <| St d
r� d j d j | � | � | d <d | d <| Si | d 6| d d <x� | D]� } t d | | d | d | d | d
| �}
|
s� t d | d | d | d | d
| �} g | D] } | j d � ^ q>} i | d 6| d d <t | d <d j | | � | d <| Sq� Wt d | d | d | d | d
| �} g | D] } | j d � ^ q�} i | d 6| d d <d j d j | � | � | d <| S( Nu resultu u commentu changesu$ boto_iam.list_attached_role_policiesRI R R R R u
policy_arnu! No attached policies in role {0}.u testu* {0} policies to be detached from role {1}.u , u managed_policiesu oldu boto_iam.detach_role_policyu newu" Failed to detach {0} from role {1}u$ {0} policies detached from role {1}.( R R RJ R) R( R
R* R ( R R R R R R RD RR RS t
policy_arnRG RU ( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyRW � sB
!"
!"
!" c C@ s� i t d 6d d 6i d 6} t d | | | | | | � } | r� t d rk d j | � | d <d | d <| St d | | | | | | � } | r� i t d 6| d d
<i t d 6| d d <d j | � | d <q� t | d <d
j | � | d <n | S( Nu resultu u commentu changesu boto_iam.profile_associatedu testu0 Instance profile {0} is set to be disassociated.u' boto_iam.disassociate_profile_from_roleu profile_associatedu oldu newu# Instance profile {0} disassociated.u: Failed to disassociate {0} instance profile from {0} role.( R R R( R) R* R ( R R R R R R R5 R6 ( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyRX � s"
(" t __doc__t
__future__R R R t loggingt salt.utils.dictupdateR, R t salt.utils.odictR t salt.utils.dictdifferR+ t salt.extR t getLoggert __name__RK R R* R R' R R R R/ R R R[ RZ RY RV RW RX ( ( ( s= /usr/lib/python2.7/site-packages/salt/states/boto_iam_role.pyt <module>X s� ~ 3 = H ; # &
Mini Shell