File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/states/__pycache__/boto_iam_role.cpython-310.pyc
Back
o ;j�k � @ s� d Z ddlZddlmZ ddlZddlm mZ e� e �Z dd� Z d!dd�Z d"d d �Zd#d d �Zd#d d�Zdd� Z d$dd�Z d%dd�Zd#dd�Zd#dd�Zd#dd�Zd#dd �Zd#d d �Z d#d d �ZdS )&aq Manage IAM roles ================ .. versionadded:: 2014.7.0 This module uses ``boto``, which can be installed via package, or pip. This module accepts explicit IAM credentials but can also utilize IAM roles assigned to the instance through Instance Profiles. Dynamic credentials are then automatically obtained from AWS API and no further configuration is necessary. More information available `here <http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html>`_. If IAM roles are not used you need to specify them either in a pillar file or in the minion's config file: .. code-block:: yaml iam.keyid: GKTADJGHEIQSXMKKRBJ08H iam.key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs It's also possible to specify ``key``, ``keyid`` and ``region`` via a profile, either passed in as a dict, or as a string to pull from pillars or minion config: .. code-block:: yaml myprofile: keyid: GKTADJGHEIQSXMKKRBJ08H key: askjghsdfjkghWupUjasdflkdfklgjsdfjajkghs region: us-east-1 Creating a role will automatically create an instance profile and associate it with the role. This is the default behavior of the AWS console. .. code-block:: yaml myrole: boto_iam_role.present: - region: us-east-1 - key: GKTADJGHEIQSXMKKRBJ08H - keyid: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs - policies_from_pillars: - shared_iam_bootstrap_policy - policies: MySQSPolicy: Statement: - Action: - sqs:* Effect: Allow Resource: - arn:aws:sqs:*:*:* Sid: MyPolicySQS1 MyS3Policy: Statement: - Action: - s3:GetObject Effect: Allow Resource: - arn:aws:s3:*:*:mybucket/* # Using a credentials profile from pillars myrole: boto_iam_role.present: - profile: myiamprofile # Passing in a credentials profile myrole: boto_iam_role.present: - profile: key: GKTADJGHEIQSXMKKRBJ08H keyid: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs region: us-east-1 If ``delete_policies: False`` is specified, existing policies that are not in the given list of policies will not be deleted. This allows manual modifications on the IAM role to be persistent. This functionality was added in 2015.8.0. .. note:: When using the ``profile`` parameter and ``region`` is set outside of the profile group, region is ignored and a default region will be used. If ``region`` is missing from the ``profile`` data set, ``us-east-1`` will be used as the default region. � N)� OrderedDictc C s dt v rdS dS )z) Only load if boto is available. �boto_iam.role_existsZ boto_iam_role)Fz#boto_iam module could not be loaded)�__salt__� r r �M/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/boto_iam_role.py� __virtual__b s r Tc C s� | ddi d�} i }|r(t d |�}|r(|d |d< |�dg � |d �|d � |r?|d |d< |�dg � |d �|d � t| |||| | | �}|sMi }|sQg }|sUg }i }|D ] }t d |�}|�|� qY|�|� |d | d< d�| d |d g�| d < |d s�|d | d < | d d u r�| S |r�t| || | | �}t�| d |d �| d< d�| d |d g�| d < |d s�|d | d < | d d u r�| S t| || | | �}t�| d |d �| d< d�| d |d g�| d < |d s�|d | d < | d d u r�| S t | ||| | | | �}t�| d |d �| d< d�| d |d g�| d < |d �s'|d | d < t | ||| | | �}t�| d |d �| d< d�| d |d g�| d < |d �sT|d | d < | S ) a Ensure the IAM role exists. name Name of the IAM role. policy_document The policy that grants an entity permission to assume the role. (See https://boto.readthedocs.io/en/latest/ref/iam.html#boto.iam.connection.IAMConnection.create_role) policy_document_from_pillars A pillar key that contains a role policy document. The statements defined here will be appended with the policy document statements defined in the policy_document argument. .. versionadded:: 2017.7.0 path The path to the role/instance profile. (See https://boto.readthedocs.io/en/latest/ref/iam.html#boto.iam.connection.IAMConnection.create_role) policies A dict of IAM role policies. policies_from_pillars A list of pillars that contain role policy dicts. Policies in the pillars will be merged in the order defined in the list and key conflicts will be handled by later defined keys overriding earlier defined keys. The policies defined here will be merged with the policies defined in the policies argument. If keys conflict, the keys in the policies argument will override the keys defined in policies_from_pillars. managed_policies A list of (AWS or Customer) managed policies to be attached to the role. create_instance_profile A boolean of whether or not to create an instance profile and associate it with this role. region Region to connect to. key Secret key to be used. keyid Access key to be used. profile A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid. delete_policies Deletes existing policies that are not in the given list of policies. Default value is ``True``. If ``False`` is specified, existing policies will not be deleted allowing manual modifications on the IAM role to be persistent. .. versionadded:: 2015.8.0 T� ��name�result�comment�changesz pillar.get�VersionZ Statementr � r r F) r � setdefault�extend� _role_present�update�join�_instance_profile_present� dictupdate� _instance_profile_associated�_policies_present�_policies_attached)r �policy_documentZ policy_document_from_pillars�path�policiesZpolicies_from_pillars�managed_policiesZcreate_instance_profile�region�key�keyid�profile�delete_policies�ret�_policy_documentZ from_pillars�_retZ _policies�policy�_policyr r r �presentk st K � r( c C s� ddi d�}t d | ||||�}|sZtd r$d| � d�|d< d |d < |S t d | ||||||�} | rLd d i|d d < d | i|d d< d| � d�|d< |S d|d < d| � d�|d< |S | � d�|d< |smt d ||||�} n|} tjj�t|d �t| ��r�td r�d} d�|d | �|d< d |d < |S t d | | ||||�} | r�d} d�|d | �|d< d|d i|d d < d| i|d d< |S d|d < d} d�|d | �|d< |S ) NTr �r r r zboto_iam.describe_role�test� IAM role � is set to be created.r r zboto_iam.create_role�roler �old�new� created.F�Failed to create z IAM role.z role present.zboto_iam.build_policyZassume_role_policy_documentz*Assume role policy document to be updated.z{} {}z"boto_iam.update_assume_role_policyz$Assume role policy document updated.r z$Failed to update assume role policy.)r �__opts__�salt�utilsZ dictdifferZ deep_diff� _sort_policy�format) r r r r r r r! r# r- �createdr$ �msg�updatedr r r r � s^ �#� �� � � ��r c C s� ddi d�}t d | ||||�}|sVtd r$d| � d�|d< d |d < |S t d | ||||�}|rJd d i|d d < d | i|d d< d| � d�|d< |S d|d < d| � d�|d< |S )NTr r) � boto_iam.instance_profile_existsr* �Instance profile r, r r z boto_iam.create_instance_profile�instance_profiler r. r/ r0 Fr1 � instance profile.�r r2 )r r r r r! r# �existsr7 r r r r 1 s( � ��r c C s� ddi d�}t d | | ||||�}|sWtd r%d| � d�|d< d |d < |S t d | | ||||�}|rLd d i|d d < d di|d d< d| � d�|d< |S d|d < d�| �|d< |S )NTr r) �boto_iam.profile_associatedr* r; z is set to be associated.r r z"boto_iam.associate_profile_to_role�profile_associatedr r. r/ z associated.Fz7Failed to associate {0} instance profile with {0} role.�r r2 r6 �r r r r r! r# Z is_associatedZ associatedr r r r H s* � ���r c C s@ t | t�rtdd� | D ��S t | ttf�r dd� | �� D �S | S )a List-type sub-items in policies don't happen to be order-sensitive, but compare operations will render them unequal, leading to non-idempotent state runs. We'll sort any list-type subitems before comparison to reduce the likelihood of false negatives. c s s � | ]}t |�V qd S )N�r5 )�.0�ir r r � <genexpr>i s � z _sort_policy.<locals>.<genexpr>c S s i | ] \}}|t |��qS r rD )rE �k�vr r r � <dictcomp>k s z _sort_policy.<locals>.<dictcomp>)� isinstance�list�sorted�dictr �items)�docr r r r5 a s r5 c C s� ddi d�}i }g } |� � D ]\} } td | | ||||�} | | kr%| || < qtd | ||||�} | D ] } |r?| |vr?| �| � q2|sD| r�t| �}|�|� td rbd�d�|�| �|d < d |d < |S d | i|d d < |� � D ]4\} } td | | | ||||�}|s�td | ||||�} d | i|d d< d|d < d�| | �|d < | S qn| D ]1} td | | ||||�}|s�td | ||||�} d | i|d d< d|d < d�| | �|d < | S q�td | ||||�} d | i|d d< d�d�| �| �|d < |S )NTr r) zboto_iam.get_role_policy�boto_iam.list_role_policiesr* �&{} policies to be modified on role {}.�, r r r r r. zboto_iam.create_role_policyr/ F�"Failed to add policy {} to role {}�boto_iam.delete_role_policy�'Failed to remove policy {} from role {}� {} policies modified on role {}.)rO r �appendrL r r2 r6 r )r r r r r r! r" r# Zpolicies_to_createZpolicies_to_delete� policy_namer& r' �_list� _to_modify� policy_set� policy_unsetr r r r o s~ �� � �� ��� � ��� � �r c C sr ddi d�}g }g }|p g D ]+} t d | d||||d�} d} | �dg �D ] } | | �d �kr1d} nq$| s9|�| � qt d | ||||d �} d d � | D �}| D ]}|�d�|vrf|�d�|vrf|�|�d�� qN|sl|�r7t|�}|�|� td r�d�d�|�| �|d< d |d< |S d|i|d d< |D ]:}t d || ||||d�}|s�t d | ||||d �} dd � | D �}d|i|d d< d|d< d �|| �|d< | S q�|D ];}t d || ||||d�}|�s t d | ||||d �} d d � | D �}d|i|d d< d|d< d �|| �|d< | S q�t d | ||||d �} d d � | D �}t� |� d|i|d d< d!�d�|�| �|d< |S )"NTr r) z!boto_iam.list_entities_for_policyZRole)Z entity_filterr r r r! FZ policy_roles� role_name�$boto_iam.list_attached_role_policies�r r r r! c S � g | ]}|� d ��qS �� policy_arn��get�rE �xr r r � <listcomp>� � z&_policies_attached.<locals>.<listcomp>rY rc r* rR rS r r r r r. zboto_iam.attach_role_policy�r^ r r r r! c S ra rb rd rf r r r rh � ri r/ rT �boto_iam.detach_role_policyc S ra rb rd rf r r r rh ri rV c S ra rb rd rf r r r rh ri rW ) r re rX rL r r2 r6 r �log�debug)r r r r r r! r# Zpolicies_to_attachZpolicies_to_detachr& Zentities�foundZroledictrZ � oldpoliciesZ policy_datar[ rY r\ � newpoliciesr] r r r r � s� �� � �� �� ��� � ��� � �r c C s� | ddi d�}t | ||||�}|d |d< d�|d |d g�|d< |d s4|d |d< |d du r4|S t| ||||�}|d |d< d�|d |d g�|d< |d sa|d |d< |d du ra|S t| ||||�}t�|d |d �|d< d�|d |d g�|d< |d s�|d |d< |d du r�|S t| ||||�}t�|d |d �|d< d�|d |d g�|d< |d s�|d |d< |d du r�|S t| ||||�}t�|d |d �|d< d�|d |d g�|d< |d s�|d |d< |S ) aW Ensure the IAM role is deleted. name Name of the IAM role. region Region to connect to. key Secret key to be used. keyid Access key to be used. profile A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid. Tr r r r r r F)�_policies_absentr �_policies_detached� _instance_profile_disassociatedr r �_instance_profile_absent� _role_absent)r r r r r! r# r% r r r �absent sF rv c C �� ddi d�}t d | ||||�}|rXtd r$d| � d�|d< d |d < |S t d | ||||�}|rJd | i|d d < d d i|d d< d| � d�|d< |S d|d < d| � d�|d< |S | � d�|d< |S )NTr r) r r* r+ � is set to be removed.r r zboto_iam.delete_roler- r r. r/ � removed.F�Failed to delete z iam role.z role does not exist.r> �r r r r r! r# r? Zdeletedr r r ru L s$ ��ru c C rw )NTr r) r: r* r; rx r r z boto_iam.delete_instance_profiler< r r. r/ ry Frz r= z! instance profile does not exist.r> r{ r r r rt b s, � ���rt c C s ddi d�}t d | ||||�}|s d| � d�|d< |S td r1d �d �|�| �|d< d |d < |S d |i|d d< |D ]1}t d | |||||�}|slt d | ||||�}d |i|d d< d|d < d�|| �|d< | S q;t d | ||||�}d |i|d d< d�d �|�| �|d< |S )NTr r) rQ zNo policies in role �.r r* z'{} policies to be removed from role {}.rS r r r r. rU r/ FrT z!{} policies removed from role {}.�r r2 r6 r ) r r r r r! r# rZ rY r] r r r rq | s> � � ��� rq c C sN ddi d�}t d | ||||d�}dd� |D �}|s$d| � d �|d < |S td r9d �d �|�| �|d < d |d< |S d|i|d d< |D ]<}t d || ||||d�} | st d | ||||d�}dd� |D �} d| i|d d< d|d< d|� d| � �|d < | S qCt d | ||||d�}dd� |D �} d| i|d d< d�d �| �| �|d < |S )NTr r) r_ rj c S ra rb rd rf r r r rh � ri z&_policies_detached.<locals>.<listcomp>z No attached policies in role r| r r* z({} policies to be detached from role {}.rS r r r r. rk r` c S ra rb rd rf r r r rh � ri r/ FzFailed to detach z from role c S ra rb rd rf r r r rh � ri z"{} policies detached from role {}.r} ) r r r r r! r# rZ ro rc r] rp r r r rr � sL � � � �� � �rr c C s� ddi d�}t d | | ||||�}|rVtd r$d�| �|d< d |d< |S t d | | ||||�}|rKd di|d d < d d i|d d< d| � d�|d< |S d |d< d�| �|d< |S )NTr r) r@ r* z/Instance profile {} is set to be disassociated.r r z'boto_iam.disassociate_profile_from_rolerA r r. Fr/ r; z disassociated.z:Failed to disassociate {0} instance profile from {0} role.rB rC r r r rs � s2 �� ����rs ) NNNNNNTNNNNT)NNNNNN)NNNN)NNNNNT)NNNNN)�__doc__�logging� collectionsr Zsalt.utils.dictdifferr3 Zsalt.utils.dictupdater4 r � getLogger�__name__rl r r( r r r r5 r r rv ru rt rq rr rs r r r r �<module> s^ X � � < �G � ^ 9 !)�
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings