aws-sdk-utils 0.0.5 → 0.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: cd63040fe954adff72101373ea6976cf5344a14a
-  data.tar.gz: 58dc77c2acf00dd5a5751998666b7f147ab5dd1e
+  metadata.gz: dcde772fb63322ea4c57c8f4578898dc05e2aa8a
+  data.tar.gz: ec27fb8da8367e39837598da893fad40be6cc959
 SHA512:
-  metadata.gz: 8b6c27bece1ac6dd0803699e83983e6b9e2006e2509f6c170f10eff6f9b07e077d9e8a6370f0fee0169c699433fae178a3390e9c2d113ff7623873ce8dcb84e1
-  data.tar.gz: 652018550f25932a05c904907be5977f070c9c5dd0a66abb1866f872f6afbdbaa94e5b7a93faaabdd5a2cc89f6ddbf1ae13f2cfc42f39524e2637efcc31b2226
+  metadata.gz: 93204c776fc345624600d8fc18147f3d0307fb7abb72ecb1f9ecb9724240366c9e8457c669f4997da7e4428c7aa178a1369f18f6a39813db450a0b15fd2624c4
+  data.tar.gz: f61f02e3d0a141c1de16c1a797cfd28292b3978a9bc7bcad6ef20c48dedb86258adeaf04541abef977b4f697c96bfd6340f55978c05f0f19d1e07dd112528a93

data/bin/cfndsl_converge

@@ -7,12 +7,14 @@ opts = Trollop::options do
   opt :path_to_stack, '', type: :string, required: true
   opt :stack_name, '', type: :string, required: true
   opt :path_to_yaml, '', type: :string, required: false
+  opt :fail_on_changes_to_immutable_resource, '', type: :boolean, default: false, required: false
 end
 
 bindings = opts[:path_to_yaml].nil? ? nil : YAML.load_file(opts[:path_to_yaml])
 
 outputs = CfndslConverger.new.converge(stack_name: opts[:stack_name],
                                        path_to_stack: opts[:path_to_stack],
-                                       bindings: bindings)
+                                       bindings: bindings,
+                                       fail_on_changes_to_immutable_resource: opts[:fail_on_changes_to_immutable_resource])
 
 puts outputs.to_yaml

data/lib/aws-sdk-utils.rb

@@ -1,3 +1,4 @@
 require_relative 'cloudformation_converger'
 require_relative 'lambda_alias_switcher'
-require_relative 'waf_util'
+require_relative 'waf_util'
+require_relative 'cfndsl_converger'

data/lib/cfndsl_converger.rb

@@ -1,6 +1,7 @@
 require 'aws-sdk'
 require 'cfndsl'
 require 'tempfile'
+require 'changeset_util'
 
 class CfndslConverger
 
@@ -18,7 +19,8 @@ class CfndslConverger
 
   def converge(stack_name:,
                path_to_stack:,
-               bindings: nil)
+               bindings: nil,
+               fail_on_changes_to_immutable_resource: false)
     extras = []
     unless bindings.nil?
       temp_file = Tempfile.new('cfnstackfortesting')
@@ -33,8 +35,19 @@ class CfndslConverger
                                           extras,
                                           verbose)
 
-    outputs = converge_stack stack_name: stack_name,
-                             stack_body: model.to_json
+    if fail_on_changes_to_immutable_resource
+      unsafe_logical_resource_id = ChangesetUtil.new.immutable_resources_that_would_change stack_name: stack_name,
+                                                                                           template_body: model.to_json
+      if unsafe_logical_resource_id.nil?
+        outputs = converge_stack stack_name: stack_name,
+                                 stack_body: model.to_json
+      else
+        raise "update would modify or delete immutable resource #{unsafe_logical_resource_id}"
+      end
+    else
+      outputs = converge_stack stack_name: stack_name,
+                               stack_body: model.to_json
+    end
     outputs
   end
 

data/lib/changeset_util.rb

@@ -0,0 +1,76 @@
+require_relative 'cloudformation_tag_parser'
+require 'aws-sdk'
+
+class ChangesetUtil
+
+  def immutable_resources_that_would_change(stack_name:,
+                                            template_body:)
+
+    potentially_unsafe_changes = changes_that_modify_or_remove stack_name: stack_name,
+                                                               template_body: template_body
+
+    logical_resource_ids = potentially_unsafe_changes.map { |change| change.resource_change.logical_resource_id }
+
+    logical_resource_ids.each do |logical_resource_id|
+      tags = CloudFormationTagParser.new.tags cloudformation_json: template_body,
+                                              logical_resource_id: logical_resource_id
+      if tags.find { |tag| tag['Key'] == 'immutable' and tag['Value'] == 'true' }
+        return logical_resource_id
+      end
+    end
+    nil
+  end
+
+
+  ##
+  # hmmmm how to handle parameters?  if it uses the previous value...?
+  #
+  def changes_that_modify_or_remove(stack_name:,
+                                    template_body:,
+                                    parameters: [])
+
+    change_set_name = "changeSet#{Time.now.to_i}"
+    client_token = "clientToken#{Time.now.to_i}"
+
+    create_change_set_response = cloudformation_client.create_change_set stack_name: stack_name,
+                                                                         template_body: template_body,
+                                                                         capabilities: %w(CAPABILITY_IAM),
+                                                                         change_set_name: change_set_name,
+                                                                         client_token: client_token,
+                                                                         parameters: convert_parameters(parameters)
+
+    change_set_id = create_change_set_response.id
+
+    describe_change_set_response = describe_change_set change_set_id: change_set_id
+
+    describe_change_set_response.changes.select { |change| %w(Modify Remove).include? change.resource_change.action }
+  end
+
+  private
+
+  def describe_change_set(change_set_id:)
+    done = false
+    while not done
+      describe_change_set_response = cloudformation_client.describe_change_set change_set_name: change_set_id
+      done = %w(CREATE_COMPLETE FAILED).include?(describe_change_set_response.status)
+      sleep 10 unless done
+    end
+    describe_change_set_response
+  end
+
+  def cloudformation_client
+    Aws::CloudFormation::Client.new
+  end
+
+  def convert_parameters(parameters)
+    result = []
+    parameters.each do |key, value|
+      result << {
+        parameter_key: key,
+        parameter_value: value,
+        use_previous_value: false
+      }
+    end
+    result
+  end
+end

data/lib/cloudformation_tag_parser.rb

@@ -0,0 +1,22 @@
+require 'json'
+
+class CloudFormationTagParser
+
+  def tags(cloudformation_json:,
+           logical_resource_id:)
+
+    cloudformation = JSON.load(cloudformation_json)
+    if cloudformation['Resources'].nil?
+      raise 'malformed json, must have Resources key at least'
+    end
+
+    resource = cloudformation['Resources'][logical_resource_id]
+    if resource.nil?
+      raise "logical resource id #{logical_resource_id} is not found"
+    end
+
+    # Properties isn't there is a blow error, but jsut ignore that... need a better all-round parser for cfn in the first place
+    tags = resource['Properties']['Tags']
+    tags.nil? ? [] : tags
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-utils
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 0.0.6
 platform: ruby
 authors:
 - someguy
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-03-22 00:00:00.000000000 Z
+date: 2016-03-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.2.17
+        version: 2.2.31
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.2.17
+        version: 2.2.31
 - !ruby/object:Gem::Dependency
   name: cfndsl
   requirement: !ruby/object:Gem::Requirement
@@ -64,7 +64,9 @@ files:
 - bin/yaml_get
 - lib/aws-sdk-utils.rb
 - lib/cfndsl_converger.rb
+- lib/changeset_util.rb
 - lib/cloudformation_converger.rb
+- lib/cloudformation_tag_parser.rb
 - lib/lambda_alias_switcher.rb
 - lib/waf_util.rb
 homepage: https://github.com/stelligent/aws-sdk-utils