File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/__pycache__/aws.cpython-310.pyc
Back
o ;j>O � @ sd d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl m m Z ddlmZ ddlZddlZddlZddlm mZ e�e�ZdZdZ g d�Z dZ dZ d Z d a!d a"d a#d a$d a%i Z&da'd d � Z(d&dd�Z)dd� Z*dd� Z+d'dd�Z,e ddddd dddf dd�Z-dd� Z.d d � Z/ d(d d!�Z0d"d#� Z1d)d$d%�Z2dS )*z� Connection library for AWS .. versionadded:: 2015.5.0 This is a base library used by a number of AWS services. :depends: requests � N)�datetime� us-east-1z 2016-11-15)ZRequestLimitExceededZ InsufficientInstanceCapacityZ InternalErrorZ UnavailableZInsufficientAddressCapacityZ$InsufficientReservedInstanceCapacitygffffff@� z use-instance-role-credentials� c C s t �t�dd| �� dS )az backoff an exponential amount of time to throttle requests during "API Rate Exceeded" failures as suggested by the AWS documentation here: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/query-api-troubleshooting.html and also here: https://docs.aws.amazon.com/general/latest/gr/api-retries.html Failure to implement this approach results in a failure rate of >30% when using salt-cloud with "--parallel" when creating 50 or more instances with a fixed delay of 2 seconds. A failure rate of >10% is observed when using the salt-api with an asynchronous client specified (runner_async). � � N)�time�sleep�random�uniform)�attempts� r �B/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/aws.py�sleep_exponential_backoff7 s r Tc C sz i }t dur t |d< tjd| � �ddi|td�}|jdkr7|r7tjdd d idditd �}|ja |jr7t| d �S |� � |S ) an Get the instance metadata at the provided path The path argument will be prepended by http://169.254.169.254/latest/ If using IMDSv2 with tokens required, the token will be fetched and used for subsequent requests (unless refresh_token_if_needed is False, in which case this will fail if tokens are required and no token was already cached) NzX-aws-ec2-metadata-tokenz http://169.254.169.254/latest/�httpr )�proxies�headers�timeouti� z'http://169.254.169.254/latest/api/tokenz$X-aws-ec2-metadata-token-ttl-secondsZ21600)r r r F) �__IMDS_Token__�requests�get�AWS_METADATA_TIMEOUT� status_code�put�text�ok� get_metadata�raise_for_status)�pathZrefresh_token_if_neededr �resultZ token_resultr r r r F s* �� r c C sL d}| d t ks| d t krwtrtt�� �d�k rqz td�}|j}W n tjj tjj fy: | d | d df Y S w z td|� ��}W n tjj tjj fy\ | d | d df Y S w |� � }|d a |d a |d a|d at t tf}n | d | d df}| �d �d ur�| �� }|�d d � t�d | �d �� t|| �d �dd�}|S )aB Return the credentials for AWS signing. This could be just the id and key specified in the provider configuration, or if the id or key is set to the literal string 'use-instance-role-credentials' creds will pull the instance role credentials from the meta data, cache them, and provide them instead. r �id�key�%Y-%m-%dT%H:%M:%SZz#meta-data/iam/security-credentials/r � AccessKeyId�SecretAccessKey�Token� Expiration�role_arnNzAssuming the role: %sr )r' �location)� IROLE_CODE�__Expiration__r �utcnow�strftimer r r � exceptions� HTTPError�ConnectionError�json�__AccessKeyId__�__SecretAccessKey__� __Token__r �copy�pop�log�info� assumed_creds)�providerZret_credentialsr Zrole�dataZprovider_shadowr r r �credsl s> � �� �r; c C s� t �� }|�d�}t|�\}}} |�� } || d< d| d< d| d< |� | d< || d< t| �� �} ttt| j | ���} t j � tt | | ���} d �| �d �|�d �| �d ��}t�||tj�}t�|�� �}|�� | d < | d krq| | d < | S )z� Sign a query against AWS services using Signature Version 2 Signing Process. This is documented at: http://docs.aws.amazon.com/general/latest/gr/signature-version-2.html r" ZAWSAccessKeyId�2ZSignatureVersionZ HmacSHA256ZSignatureMethodZ Timestamp�Versionz {} {} / {}�utf-8Z Signaturer Z SecurityToken)r r+ r, r; r4 �sorted�keys�list�mapr �urllib�parse� urlencode�zip�format�encode�hmac�new�hashlib�sha256�binascii� b2a_base64�digest�strip)�method�endpoint�paramsr9 �aws_api_version�timenow� timestamp� access_key_id�secret_access_key�token�params_with_headersr@ �values� querystring� canonicalZhashed�sigr r r �sig2� s. � r_ c C s: t �d�}t�t�� �� �}t�t �� � D ]\}}|d | dkr$t |= q|t v r8t | }|d |d |d fS d}|� dt j �d d i�d �d d � } td d |d| |ddd�|dd| d|dd� \} } d| d< tjd | | ddtd�} | jdkr~t�d| j� | �� | �� } | d d d }|t |< |d |d |d fS ) Nz[^a-z0-9A-Z+=,.@-]r& �x r# r$ Z SessionTokenz 2011-06-15r �root_dirr �? �GETzsts.amazonaws.comZ AssumeRolezd{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1", "Effect":"Allow","Action":"*","Resource":"*"}]}Z3600)r= �ActionZRoleSessionNameZRoleArn�PolicyZDurationSeconds�/�stszhttps://sts.amazonaws.com/)rS rT r: �uri� prov_dict�productr( � requesturlzapplication/jsonZAcceptT)r r: Zverifyr i� zAssumeRole response: %sZAssumeRoleResponseZAssumeRoleResultZ Credentials)�re�compiler �mktimer r+ � timetupler4 �deepcopy�__AssumeCache__�items�sub�saltZconfigZget_id�sig4r �requestr r r6 r7 �contentr r0 )ri r' r( Zvalid_session_name_re�nowr! r; �c�versionZ session_namer rk r Zrespr: r r r r8 � sb ���� �� r8 �ec2rf c % C s t �� } | du rt|�\}}}n t|| |d�\}}}|du r!t� }|du r't}|�� }|dvr3||d< t|�� �}t t |j |��}t j �t t||����dd�}| �d�}| �d�}i }t| t�re| �� }| sntjj�| �} ||d < ||d < | |d < g }g }|d kr�||d < t|�� tjd�D ]}|�� }|�|� d|| �� � �� |�|� q�d� |�d } d� |�} d} d� | ||| | | f�} d� |||df�} d� | || tjj�| �f�}!t ||||�}"t � |"|!� d�t!j"��#� }#d�$| || | |#�}$|$|d< |� d|� �}||fS )a_ Sign a query against AWS services using Signature Version 4 Signing Process. This is documented at: http://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html http://docs.aws.amazon.com/general/latest/gr/sigv4-signed-request-examples.html http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html N)r( )Zs3Zssmr= �+z%20z%Y%m%dT%H%M%SZz%Y%m%dz X-Amz-date�hostzx-amz-content-sha256r zX-Amz-security-token)r! �:� �;zAWS4-HMAC-SHA256rf � aws4_requestr> z3{} Credential={}/{}, SignedHeaders={}, Signature={}Z Authorization�?)%r r+ r; r8 �get_region_from_metadata�DEFAULT_LOCATIONr4 r? r@ rA rB r rC rD rE rF �replacer, � isinstance�dictrt �utilsZ hashutilsZ sha256_digest�str�lower�appendrP �join�_sig_keyrI rJ rH rK rL � hexdigestrG )%rQ rR rS ri rT r( rj rh rk r: r r' Z payload_hashrU rW rX rY rZ r@ r[ r\ ZamzdateZ datestampZ new_headersZa_canonical_headersZa_signed_headers�headerZ lower_headerZcanonical_headersZsigned_headers� algorithmZcanonical_requestZcredential_scopeZstring_to_signZ signing_keyZ signatureZauthorization_headerr r r ru s� � � �� ���ru c C s t �| |�d�tj��� S )z� Key derivation functions. See: http://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html#signature-v4-examples-python r> )rI rJ rH rK rL rO )r! �msgr r r �_signv s r� c C sF t d| �d�|�}|rt ||�}t ||�}nt ||�}t |d�}|S )z� Get a signature key. See: http://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html#signature-v4-examples-python ZAWS4r> r� )r� rH )r! Z date_stampZ regionNameZ serviceNameZkDateZkRegionZkServiceZkSigningr r r r� s r� Fr< c C s� | du ri } |du r i }|� dd| f�} |� di �} |du r=| � | d i �� | i �} | r<tt| �� ��d }| � || �}n | � |i �� | i �} | � dd�}|sTt|| �}|du r�|so| � d| � d |� d |� ��}d |� d �}n#tj�|�j}|d kr�d �|�}t � |� |du r�d|i|fS d|iS t � d|� d}| � d| � | � d�t ��}| � dd�s�| � |i �� di �� di �| d< | � |i �� di �� di �| d< | dkr�t ||| | ||| |d�\}}i }n t||| | |�}i }d}|tk �r�t � d|� t �d|� z tj |||td�}t � d |j� t �d |j� |�� W n� tjj�y� } zet�|jj�}t � |�}|� d i �� d i �� d d �}|tk �rg|�rg|t v �rg|d7 }t � d!|jj|||� t |� W Y d}~q�t � d"|jj||� |du �r�d|i|fW Y d}~S d|iW Y d}~S d}~ww t � d"|jj||� |du �r�d|i|fS d|iS t�|j�}|d }|du �r�|}|�r�t |�D ]\} } | j!�"d#�} | d |k�r�|| }�q�g } |D ] } | �#t � | �� �q�|du �r�| |fS | S )$a� Perform a query against AWS services using Signature Version 2 Signing Process. This is documented at: http://docs.aws.amazon.com/general/latest/gr/signature-version-2.html Regions and endpoints are documented at: http://docs.aws.amazon.com/general/latest/gr/rande.html Default ``product`` is ``ec2``. Valid ``product`` names are: .. code-block:: yaml - autoscaling (Auto Scaling) - cloudformation (CloudFormation) - ec2 (Elastic Compute Cloud) - elasticache (ElastiCache) - elasticbeanstalk (Elastic BeanStalk) - elasticloadbalancing (Elastic Load Balancing) - elasticmapreduce (Elastic MapReduce) - iam (Identity and Access Management) - importexport (Import/Export) - monitoring (CloudWatch) - rds (Relational Database Service) - simpledb (SimpleDB) - sns (Simple Notification Service) - sqs (Simple Queue Service) N�function� providersr r � service_urlz amazonaws.comrR �.zhttps://rf r zqCould not find a valid endpoint in the requesturl: {}. Looking for something like https://some.aws.endpoint/?argsT�errorzUsing AWS endpoint: %src rT Z _api_versionr r{ r! �4)rk zAWS Request: %szAWS Request Parameters: %s)r rS r z AWS Response Status Code: %szAWS Response Text: %sZErrors�ErrorZCodezFAWS Response Status Code and Error: [%s %s] %s; Attempts remaining: %sz.AWS Response Status Code and Error: [%s %s] %s�})$r rA r@ � get_locationrC rD �urlparse�netlocrG r6 r� �debug�DEFAULT_AWS_API_VERSIONru r_ �AWS_MAX_RETRIESZtracer r r r r r- r. �ETZ fromstring�responserw �xmlZto_dict�AWS_RETRY_CODESr � enumerate�tag�splitr� ) rS Zsetnamerk r( Z return_urlZ return_root�optsr9 rR rj Zsigverr� r� ri Zdriverr� Z endpoint_errrQ rT r rZ r r �exc�rootr: Zerr_coderr �idx�item�comps�retr r r �query� s� * � � � � � � � �� � � r� c C s� t dkr t�d� dS t dkrt S ztd�} W n tjjy, tjddd� da Y dS w z | �� d }|a t W S t t fyI t�d � Y dS w ) zh Try to get region from instance identity document and cache it .. versionadded:: 2015.5.6 zdo-not-get-from-metadatazDPreviously failed to get AWS region from metadata. Not trying again.Nr z"dynamic/instance-identity/documentz0Failed to get AWS region from instance metadata.T)�exc_info�regionz-Failed to decode JSON from instance metadata.) � __Location__r6 r� r r r- ZRequestException�warningr0 � ValueError�KeyError)r r� r r r r� I s, � � �r� c C sN | du ri } | � d�}|du r|dur|� d�}|du r t� }|du r%t}|S )z� Return the region to use, in this order: opts['location'] provider['location'] get_region_from_metadata() DEFAULT_LOCATION Nr( )r r� r� )r� r9 r� r r r r� n s r� )T)N) NNNNFFNNNr{ r< )NN)3�__doc__rM r4 rK rI �loggingr rl r � urllib.parserC Zxml.etree.ElementTreeZetreeZ ElementTreer� r r Z salt.configrt Zsalt.utils.hashutilsZsalt.utils.xmlutilr� Zxmlutilr� � getLogger�__name__r6 r� r� r� r r� r) r1 r2 r3 r* r� rq r r r r; r_ r8 ru r� r� r� r� r� r r r r �<module> s| &4 (B �q � ;%
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings