File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/states/__pycache__/boto_secgroup.cpython-310.pyc
Back
o ;j́ � @ s� d Z ddlZddlZddlm mZ ddlmZ e�e �Z dd� Z ddd�Z dd d �Z d d � Zd d� Zdd� Z ddd�Z ddd�Z ddd�Z ddd�ZdS ) aR Manage Security Groups ====================== .. versionadded:: 2014.7.0 Create and destroy Security Groups. Be aware that this interacts with Amazon's services, and so may incur charges. This module uses ``boto``, which can be installed via package, or pip. This module accepts explicit EC2 credentials but can also utilize IAM roles assigned to the instance through Instance Profiles. Dynamic credentials are then automatically obtained from AWS API and no further configuration is necessary. More information available `here <http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html>`_. If IAM roles are not used you need to specify them either in a pillar file or in the minion's config file: .. code-block:: yaml secgroup.keyid: GKTADJGHEIQSXMKKRBJ08H secgroup.key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs It's also possible to specify ``key``, ``keyid`` and ``region`` via a profile, either passed in as a dict, or as a string to pull from pillars or minion config: .. code-block:: yaml myprofile: keyid: GKTADJGHEIQSXMKKRBJ08H key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs region: us-east-1 .. code-block:: yaml Ensure mysecgroup exists: boto_secgroup.present: - name: mysecgroup - description: My security group - vpc_name: myvpc - rules: - ip_protocol: tcp from_port: 80 to_port: 80 cidr_ip: - 10.0.0.0/8 - 192.168.0.0/16 - ip_protocol: tcp from_port: 8080 to_port: 8090 cidr_ip: - 10.0.0.0/8 - 192.168.0.0/16 - ip_protocol: icmp from_port: -1 to_port: -1 source_group_name: mysecgroup - ip_protocol: tcp from_port: 8080 to_port: 8080 source_group_name: MyOtherSecGroup source_group_name_vpc: MyPeeredVPC - rules_egress: - ip_protocol: all from_port: -1 to_port: -1 cidr_ip: - 10.0.0.0/8 - 192.168.0.0/16 - tags: SomeTag: 'My Tag Value' SomeOtherTag: 'Other Tag Value' - region: us-east-1 - keyid: GKTADJGHEIQSXMKKRBJ08H - key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs # Using a profile from pillars Ensure mysecgroup exists: boto_secgroup.present: - name: mysecgroup - description: My security group - profile: myprofile # Passing in a profile Ensure mysecgroup exists: boto_secgroup.present: - name: mysecgroup - description: My security group - profile: keyid: GKTADJGHEIQSXMKKRBJ08H key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs region: us-east-1 .. note:: When using the ``profile`` parameter and ``region`` is set outside of the profile group, region is ignored and a default region will be used. If ``region`` is missing from the ``profile`` data set, ``us-east-1`` will be used as the default region. � N)�SaltInvocationErrorc C s dt v rdS dS )z) Only load if boto is available. �boto_secgroup.existsZ boto_secgroup)Fz(boto_secgroup module could not be loaded)�__salt__� r r �M/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/boto_secgroup.py� __virtual__s s r Tc C s� | ddi d�} t | ||||| | | d�}|d | d< d�| d |d g�| d< |d s@|d | d< | d d u r8| S | d d u r@| S |d urtt| |||||| | | d� }t�| d |d �| d< d�| d |d g�| d< |d st|d | d< |d ur�t| |||||| | | d� }t�| d |d �| d< d�| d |d g�| d< |d s�|d | d< t| | |||| | | d �}t�| d |d �| d< d�| d |d g�| d< |d s�|d | d< | S ) a� Ensure the security group exists with the specified rules. name Name of the security group. description A description of this security group. vpc_id The ID of the VPC to create the security group in, if any. Exclusive with vpc_name. vpc_name The name of the VPC to create the security group in, if any. Exclusive with vpc_id. .. versionadded:: 2016.3.0 .. versionadded:: 2015.8.2 rules A list of ingress rule dicts. If not specified, ``rules=None``, the ingress rules will be unmanaged. If set to an empty list, ``[]``, then all ingress rules will be removed. rules_egress A list of egress rule dicts. If not specified, ``rules_egress=None``, the egress rules will be unmanaged. If set to an empty list, ``[]``, then all egress rules will be removed. delete_ingress_rules Some tools (EMR comes to mind) insist on adding rules on-the-fly, which salt will happily remove on the next run. Set this param to False to avoid deleting rules which were added outside of salt. delete_egress_rules Some tools (EMR comes to mind) insist on adding rules on-the-fly, which salt will happily remove on the next run. Set this param to False to avoid deleting rules which were added outside of salt. region Region to connect to. key Secret key to be used. keyid Access key to be used. profile A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key, and keyid. tags List of key:value pairs of tags to set on the security group .. versionadded:: 2016.3.0 T� ��name�result�comment�changes��vpc_id�vpc_name�region�key�keyid�profiler � r r FN)r �tagsr r r r r r )�_security_group_present�join�_rules_present� dictupdate�update�_rules_egress_present� _tags_present)r � descriptionr r �rules� rules_egress�delete_ingress_rules�delete_egress_rulesr r r r r �retZ_retr r r �present| s� H� � � � r$ c C s� ddi d�}t d | ||||||�} | sltd r&d| � d�|d< d |d < |S t d | |||||||d �} | r^d d i|d d< t d | d ||||||d�} d | i|d d< d| � d�|d< |S d|d < d| � d�|d< |S d| � d�|d< |S )z� given a group name or a group name and vpc id (or vpc name): 1. determine if the group exists 2. if the group does not exist, creates the group 3. return the group's configuration and any changes made Tr �r r r r �test�Security group z is set to be created.r Nr zboto_secgroup.create)r r r r r r r r �secgroupr �old�boto_secgroup.get_config�r �group_idr r r r r r �newz created.FzFailed to create � security group.z present.�r �__opts__) r r r r r r r r r# �exists�created�sgr r r r sN �� � ��r c C s� g }| D ]d}|� d�}|� d�}|� d�}|r/t|t�s/|D ]}|�� }||d< |�|� q q|rIt|t�sI|D ]}|�� }||d< |�|� q8q|rct|t�sc|D ]} |�� }| |d< |�|� qRq|�|� q|S )a Split rules with lists into individual rules. We accept some attributes as lists or strings. The data we get back from the execution module lists rules as individual rules. We need to split the provided rules into individual rules to compare them. �cidr_ip�source_group_name�source_group_group_id)�get� isinstance�str�copy�append) r �split�ruler4 � group_namer, �ip�_ruler Z_idr r r � _split_rulesA s2 � � � rA c C s� |� d�du r d|d< |� d�du rd|d< | d |d krvt| d �t|d �krvt| d �t|d �krv|� d�}|rF|| � d�krFdS |� d�}|rV|| � d�krVdS |� d �}|rf|| � d �krfdS |� d �}|rv|| � d �krvdS d S ) z� Check to see if two rules are the same. Needed to compare rules fetched from boto, since they may not completely match rules defined in sls files but may be functionally equivalent. Z from_portN���Zto_port� ip_protocolr4 TZsource_group_owner_idr6 r5 F)r7 r9 )r= r@ Z_cidr_ipZ _owner_id� _group_idZ _group_namer r r � _check_ruleb s( rE c C sn g }g }| D ]~}z t |�d��}W n ty td��w g d�}||vr7|� �� r0t|�dkr7td�|���|dkr?d|d< |�dd �}|�d d �}|�d d �} |r[| sW|r[td ��| rc|rctd ��|sm| sm|smtd��d} |D ] } t|| �r|d} nqq| s�|�|� q|D ] } d} | D ] }t|| �r�d} nq�| s�| � d d � |�| � q�t � d|� t � d|� ||fS )z� given a list of desired rules (rules) and existing rules (_rules) return a list of rules to delete (to_delete) and to create (to_create) rC zTip_protocol, to_port, and from_port are required arguments for security group rules.) Ztcp�6� ZudpZ17� Zicmp�1� �all�-1rB � z8Invalid ip_protocol {} specified in security group rule.rK rL r4 Nr5 r6 zLcidr_ip and source groups can not both be specified in security group rules.ziEither source_group_group_id or source_group_name can be specified in security group rules, but not both.z_cidr_ip, source_group_group_id, or source_group_name must be provided for security group rules.FTzRules to be deleted: %szRules to be created: %s) r9 r7 �KeyErrorr �isdigit�int�formatrE r; �pop�log�debug) r Z_rules� to_delete� to_creater= rC Zsupported_protocolsr4 r> r, Z rule_foundr@ r r r �_get_rule_changes� sx ��� �� �� � � � � � rW c C sr ddi d�} t d | d||||||d�} | s#| � d�| d< d | d < | S t|�}|s+|rm|D ]?} | �d d�} | rl|} |}| �d d�}|rG|} d}t d | || ||||d�}|s]td�| ���d| d < |rh| �d � || d< q-t|| d �\}}|rz|ng }|s�|�r7td r�d�| t� |�t� |��}|| d< d| d < | S |r�d}|D ]} t d | f||||||d�| ��}|s�d }q�|r�d| � d�| d< n d�| �| d< d | d < |�rd}|D ]} t d | f||||||d�| ��}|s�d }q�|�rd� | d d| � d�g�| d< nd� | d d | � d�g�| d< d | d < d| d i| d d < t d | d||||||d�} d| d i| d d < | S ) a' given a group name or group name and vpc_id (or vpc name): 1. get lists of desired rule changes (using _get_rule_changes) 2. authorize/create rules missing rules 3. if delete_ingress_rules is True, delete/revoke non-requested rules 4. return 'old' and 'new' group rules Tr r% r* Nr+ �5 security group configuration could not be retrieved.r Fr r5 �source_group_name_vpc�boto_secgroup.get_group_id�r r r r r r r �=source_group_name {} does not map to a valid source group id.r6 r r& �iSecurity group {} set to have rules modified. To be created: {} To be deleted: {}�boto_secgroup.revoker zRemoved rules on r. z,Failed to remove rules on {} security group.�boto_secgroup.authorizer zCreated rules on zFailed to create rules on r r) r- � r rA r7 r rQ rR rW r0 �pprintZpformatr )r r r! r r r r r r r# r3 r= �_source_group_name�_group_vpc_name� _group_vpc_id�_source_group_name_vpcrD rU rV �msg�deleted�_deletedr2 �_createdr r r r � s� � � � � ����� ����� � � � ��� r c C s� ddi d�} t d | d||||||d�} | s#| � d�| d< d | d < | S t|�}|s+|rm|D ]?} | �d d�} | rl|} |}| �d d�}|rG|} d}t d | || ||||d�}|s]td�| ���d| d < |rh| �d � || d< q-t|| d �\}}|rz|ng }|s�|�rFtd r�d�| t� |�t� |��}|| d< d| d < | S |r�d}|D ]} t d | f||||||dd�| ��}|s�d }q�|r�d� | d d| � d�g�| d< nd� | d d�| �g�| d< d | d < |�r$d}|D ]} t d | f||||||dd�| ��}|s�d }q�|�rd� | d d| � d�g�| d< nd� | d d �| �g�| d< d | d < d| d i| d d < t d | d||||||d�} d| d i| d d < | S ) a given a group name or group name and vpc_id (or vpc name): 1. get lists of desired rule changes (using _get_rule_changes) 2. authorize/create missing rules 3. if delete_egress_rules is True, delete/revoke non-requested rules 4. return 'old' and 'new' group rules Tr r% r* Nr+ rX r Fr r5 rY rZ r[ r\ r6 r r& r] r^ )r r r r r r Zegressr zRemoved egress rule on r. z2Failed to remove egress rule on {} security group.r_ zCreated egress rules on z3Failed to create egress rules on {} security group.r r) r- r` )r r r" r r r r r r r# r3 r= rb rc rd re rD rU rV rf rg rh r2 ri r r r r q s � � � � ���� � � � ������ � � � ����� r c C s� | ddi d�}t d | d||||||d�}|ratd r)d| � d �|d < d|d < |S t d | d||||||d�} | rSd |i|d d< d di|d d< d| � d�|d < |S d|d < d| � d�|d < |S | � d�|d < |S )a� Ensure a security group with the specified name does not exist. name Name of the security group. vpc_id The ID of the VPC to remove the security group from, if any. Exclusive with vpc_name. vpc_name The name of the VPC to remove the security group from, if any. Exclusive with vpc_name. .. versionadded:: 2016.3.0 region Region to connect to. key Secret key to be used. keyid Access key to be used. profile A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid. .. versionadded:: 2016.3.0 Tr r r* Nr+ r& r' z is set to be removed.r r zboto_secgroup.deleter( r r) r- z deleted.FzFailed to delete r. z security group does not exist.r/ ) r r r r r r r r# r3 rg r r r �absent sH � � ��rj c C s� ddi d�}|�r�t d | d||||||d�} | s&| � d�|d< d |d < |S |} i } g } | �d �r[| d D ]%} | |vrE| | vrD| �| � q5|| | d | krU|| | | < | �| � q5| r�td r�d �t| �dkrkdndd�| ��}d�|d |g�|d< d|d < nLt d | | d||||||d� }|s�d |d < d�|d d�| �g�|d< |S d|d vr�t� |d dd i ii�|d< | D ]}| d | |d d d |< q�| s�| �r�td �r'| r�d�t| � � �dkr�dndd�| � � ��}d�|d |g�|d< d|d < | �r&d�t| � � �dk�rdndd�| � � ��}d�|d |g�|d< d|d < n�t� | | �}t d || d||||||d� }|�sRd |d < d }d�|d |g�|d< |S d|d v�rgt� |d dd i ii�|d< d |d v�r|t� |d d d i ii�|d< |D ].}|| |d d d |< d | v �r�| d �r�|| d v �r�| d | |d d d |< �q~| �s�| �s�| �s�d�|d d g�|d< |S ) z6 helper function to validate tags are correct Tr r% r* Nr+ rX r Fr r r& z*The following tag{} set to be removed: {}.rJ zs arez isz, r zboto_secgroup.delete_tags)r r, r r r r r r z#Error attempting to delete tags {}.r) r z(The following tag{} set to be added: {}.z+The following tag {} set to be updated: {}.z values arezvalue iszboto_secgroup.set_tagsz Error attempting to set tags.r- zTags are already set.) r r7 r; rR r0 rQ �lenr r r �keys)r r r r r r r r r# r3 Z tags_to_addZtags_to_updateZtags_to_removeZ existing_tagrf Ztemp_retZrem_tagZall_tag_changes�tagr r r r W s� � � � � � ��� � �� �� � �� �r ) NNNNTTNNNNN)NNNNNN)TNNNNNN)�__doc__�loggingra Zsalt.utils.dictupdate�utilsr Zsalt.exceptionsr � getLogger�__name__rS r r$ r rA rE rW r r rj r r r r r �<module> sr i � �9!%^ � � �K�
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings