aws-sdk-v1 1.52.0

data/lib/aws/iam/signing_certificate.rb

@@ -0,0 +1,186 @@
+# Copyright 2011-2013 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# Licensed under the Apache License, Version 2.0 (the "License"). You
+# may not use this file except in compliance with the License. A copy of
+# the License is located at
+#
+#     http://aws.amazon.com/apache2.0/
+#
+# or in the "license" file accompanying this file. This file is
+# distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
+# ANY KIND, either express or implied. See the License for the specific
+# language governing permissions and limitations under the License.
+
+module AWS
+  class IAM
+
+    # Signing certificates can be activated and deactivated.
+    # By default, newly-uploaded certifictes are active.
+    #
+    #     certificate = iam.signing_certificates.upload(cert_body)
+    #     certificate.status
+    #     #=> :active
+    #
+    #     certificate.deactivate!
+    #     certificate.active?
+    #     #=> false
+    #
+    # ## Contents
+    #
+    # You can access the certificate contents you uploaded:
+    #
+    #     > puts certificate.contents
+    #     -----BEGIN CERTIFICATE-----
+    #     MIICdzCCAeCgAwIBAgIFGS4fY6owDQYJKoZIhvcNAQEFBQAwUzELMAkGA1UEBhMC
+    #     ......
+    #     Glli79yh87PRi0vNDlFEoHXNynkvC/c4TiWruZ4haM9BR9EdWr1DBNNu73ui093K
+    #     F9TbdXSWdgMl7E0=
+    #     -----END CERTIFICATE-----
+    #
+    # ## User
+    #
+    # A certificate can also return the user it belongs to.  If the certificate
+    # belongs to the AWS account, then {#user} will return `nil`.
+    #
+    #     user = iam.users['someuser'].signing_certificates.first
+    #     user.name
+    #     #=> 'someuser'
+    #
+    # @attr_reader [String] contents Returns the contents of this
+    #   signing certificate.
+    #
+    # @attr_reader [Time] upload_date
+    #
+    # @attr_reader [Symbol] status The status of this signing
+    #   certificate.  Status may be `:active` or `:inactive`.
+    #
+    class SigningCertificate < Resource
+
+      # @param [String] certificate_id The id of the signing certificate.
+      # @param [Hash] options
+      # @option options [User] :user
+      def initialize certificate_id, options = {}
+        @id = certificate_id
+        @user = options[:user]
+        @user ? super(@user, options) : super(options)
+      end
+
+      # @return [String] Returns the signing certificate's ID.
+      attr_reader :id
+
+      # @return [User,nil] Returns the user this cerficiate belongs to.
+      #   Returns `nil` if the cerficiate is a root credential for the
+      #   account.  If the configured credentials belong to an IAM user,
+      #   then that user is the implied owner.
+      attr_reader :user
+
+      attribute :contents, :from => :certificate_body, :static => true
+
+      # @attr_reader [Time] upload_date
+      attribute :upload_date, :static => true
+
+      mutable_attribute :status, :to_sym => true
+
+      protected :status=
+
+      populates_from(
+        :upload_signing_certificate,
+        :update_signing_certificate
+      ) do |resp|
+        resp.certificate if matches_response_object?(resp.certificate)
+      end
+
+      populates_from(:list_signing_certificates) do |resp|
+        resp.certificates.find {|c| matches_response_object?(c) }
+      end
+
+      # @return [String,nil] Returns the name of the user this certificate
+      #   belogns to.  If the certificate belongs to the account, `nil` is
+      #   returned.
+      def user_name
+        @user ? @user.name : nil
+      end
+
+      # @return [Boolean] Returns true if this signing certificate is active.
+      def active?
+        status == :active
+      end
+
+      # @return [Boolean] Returns true if this signing certificate is inactive.
+      def inactive?
+        status == :inactive
+      end
+
+      # Activates this signing cerificate.
+      #
+      # @example
+      #   signing_certificate.activate!
+      #   signing_certificate.status
+      #   # => :active
+      #
+      # @return [nil]
+      def activate!
+        self.status = 'Active'
+        nil
+      end
+
+      # Deactivates this signing cerificate.
+      #
+      # @example
+      #   signing_certificate.deactivate!
+      #   signing_certificate.status
+      #   # => :inactive
+      #
+      # @return [nil]
+      def deactivate!
+        self.status = 'Inactive'
+        nil
+      end
+
+      # Deletes the signing certificate.
+      def delete
+        client.delete_signing_certificate(resource_options)
+        nil
+      end
+
+      # @return [Boolean] Returns `true` if the resource exists.
+      def exists?
+        exists = false
+        SigningCertificateCollection.new(:config => config).each do |cert|
+          if cert.id == self.id
+            exists = true
+            break
+          end
+        end
+        exists
+      end
+
+      # @api private
+      protected
+      def resource_identifiers
+        identifiers = []
+        identifiers << [:certificate_id, id]
+        identifiers << [:user_name, user.name] if user
+        identifiers
+      end
+
+      # IAM does not provide a request for "get signing certificate".
+      # Also note, we do not page the response. This is because
+      # restrictions on how many certificates an account / user may
+      # have is fewer than one page of results.
+      # @api private
+      protected
+      def get_resource attribute = nil
+        options = user ? { :user_name => user.name } : {}
+        client.list_signing_certificates(options)
+      end
+
+      # @api private
+      protected
+      def matches_response_object? obj
+        user_name = obj.respond_to?(:user_name) ? obj.user_name : nil
+        obj.certificate_id == self.id and user_name == self.user_name
+      end
+
+    end
+  end
+end

data/lib/aws/iam/signing_certificate_collection.rb

@@ -0,0 +1,131 @@
+# Copyright 2011-2013 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# Licensed under the Apache License, Version 2.0 (the "License"). You
+# may not use this file except in compliance with the License. A copy of
+# the License is located at
+#
+#     http://aws.amazon.com/apache2.0/
+#
+# or in the "license" file accompanying this file. This file is
+# distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
+# ANY KIND, either express or implied. See the License for the specific
+# language governing permissions and limitations under the License.
+
+module AWS
+  class IAM
+
+    # This is the primary interface for uploading X.509 signing certificates
+    # to an AWS account or an IAM user.
+    #
+    #     iam = AWS::IAM.new
+    #
+    #     # upload a certificate for the AWS account:
+    #     iam.signing_certificates.upload(<<-CERT)
+    #     -----BEGIN CERTIFICATE-----
+    #     MIICdzCCAeCgAwIBAgIFGS4fY6owDQYJKoZIhvcNAQEFBQAwUzELMAkGA1UEBhMC
+    #     ......
+    #     Glli79yh87PRi0vNDlFEoHXNynkvC/c4TiWruZ4haM9BR9EdWr1DBNNu73ui093K
+    #     F9TbdXSWdgMl7E0=
+    #     -----END CERTIFICATE-----
+    #     CERT
+    #
+    # If you want to work with an IAM user's certificates just use the
+    # signing certificate interface on a user:
+    #
+    #     user = iam.users['someuser']
+    #     user.signing_certificates.upload(cert_body)
+    #
+    class SigningCertificateCollection
+
+      include Collection
+
+      # @param [Hash] options
+      # @option options [User] :user (nil) When `:user` is provided the
+      #   collection will represents the signing certificates belonging only
+      #   to that user.  When `:user` is omitted the collection will manage
+      #   root credentials on the AWS account (instead those belonging to a
+      #   particular user).
+      def initialize options = {}
+        @user = options[:user]
+        @user ? super(@user, options) : super(options)
+      end
+
+      # @return [User,nil] Returns the user this collection belongs to.
+      #   Returns `nil` if the collection represents the root credentials
+      #   for the account.  If the configured credentials belong to an
+      #   IAM user, then that user is the implied owner.
+      attr_reader :user
+
+      # @param [String] certificate_body The contents of the signing
+      #   certificate.
+      # @return [SigningCertificate] Returns the newly created signing
+      #   certificate.
+      def upload certificate_body
+
+        options = {}
+        options[:certificate_body] = certificate_body
+        options[:user_name] = user.name if user
+
+        resp = client.upload_signing_certificate(options)
+
+        SigningCertificate.new_from(:upload_signing_certificate,
+          resp.certificate, resp.certificate.certificate_id, new_options)
+
+      end
+
+      alias_method :create, :upload
+
+      # @param [String] certificate_id The ID of the signing certificate.
+      # @return [SigningCertificate] Returns a reference to the signing
+      #   certificate with the given certificate ID.
+      def [] certificate_id
+        SigningCertificate.new(certificate_id.to_s, new_options)
+      end
+
+      # Deletes all of the signing certificates from this collection.
+      # @return [nil]
+      def clear
+        each do |certificate|
+          certificate.delete
+        end
+        nil
+      end
+
+      # Yields once for each signing certificate.
+      #
+      # You can limit the number of certificates yielded using `:limit`.
+      #
+      # @param [Hash] options
+      # @option options [Integer] :limit The maximum number of certificates
+      #   to yield.
+      # @option options [Integer] :batch_size The maximum number of
+      #   certificates received each service reqeust.
+      # @yieldparam [SigningCertificate] signing_certificate
+      # @return [nil]
+      def each options = {}, &block
+        each_options = options.dup
+        each_options[:user_name] = user.name if user
+        super(each_options, &block)
+      end
+
+      # @api private
+      protected
+      def each_item response, &block
+        response.certificates.each do |item|
+
+          cert = SigningCertificate.new_from(:list_signing_certificates,
+            item, item.certificate_id, new_options)
+
+          yield(cert)
+
+        end
+      end
+
+      # @api private
+      protected
+      def new_options
+        user ? { :user => user } : { :config => config }
+      end
+
+    end
+  end
+end

data/lib/aws/iam/user.rb

@@ -0,0 +1,200 @@
+# Copyright 2011-2013 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"). You
+# may not use this file except in compliance with the License. A copy of
+# the License is located at
+#
+#     http://aws.amazon.com/apache2.0/
+#
+# or in the "license" file accompanying this file. This file is
+# distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
+# ANY KIND, either express or implied. See the License for the specific
+# language governing permissions and limitations under the License.
+
+module AWS
+  class IAM
+
+
+    # Represents an IAM User.  Each AWS account can have many users.  Users
+    # can be organized (optionally) into groups.  Users (and groups) can be
+    # given policies that affect that they can do.
+    #
+    # ## Creating A User
+    #
+    #     iam = AWS::IAM.new
+    #     user = iam.users.create('johndoe')
+    #
+    # ## Renaming a User
+    #
+    # You can only edit a user's name and path (both of which will modify
+    # the user's ARN).
+    #
+    #     user = iam.users['johndoe']
+    #     user.name = 'newname'
+    #
+    # ## User Path
+    #
+    # When you create a user you can assign a path.  Paths must begin and
+    # end with a forward slash (/).
+    #
+    #     user = iam.users.create('newuser', :path => '/developers/ruby/')
+    #
+    # Paths are a useful tool for organizing/tagging users.  You can later
+    # enumerate users by their path prefixes:
+    #
+    #     iam.users.each(:path_prefix => '/developers').each do |developer|
+    #       puts developer.name
+    #     end
+    #
+    # ## Login Profile
+    #
+    # A login profile is required for an IAM user to use the AWS Management
+    # console (web interface).  See {LoginProfile} for more information.
+    #
+    # ## Deleting Users
+    #
+    # In order to delete a user you must first remove it from all of its
+    # groups and delete all of its signing certificates.  Once this is done:
+    #
+    # @attr [String] user_name
+    #
+    # @attr [String] path
+    #
+    # @attr_reader [String] id
+    #
+    # @attr_reader [DateTime] create_date
+    #
+    # @attr_reader [String] arn
+    #
+    class User < Resource
+
+      prefix_update_attributes
+
+      # @param [String] name The IAM user name for this user.
+      # @param [Hash] options
+      def initialize name, options = {}
+        options[:name] = name
+        super(options)
+      end
+
+      # @attr [String] The IAM user name.
+      mutable_attribute :name, :static => true, :from => :user_name
+
+      # @attr_reader [String] The user's unique ID.
+      attribute :id, :static => true, :from => :user_id
+
+      # @attr_reader [Time] When the user was created.
+      attribute :create_date, :static => true
+
+      # @attr_reader [String] The user's ARN (Amazon Resource Name).
+      attribute :arn
+
+      # @attr [String] The path for this user.  Paths are used to
+      #   identify which division or part of an organization the user
+      #   belongs to.
+      mutable_attribute :path
+
+      populates_from(:create_user, :get_user) do |resp|
+        resp[:user] if resp[:user][:user_name] == name
+      end
+
+      populates_from(:list_users, :get_group) do |resp|
+        resp[:users].find{|u| u[:user_name] == name }
+      end
+
+      # Deletes this user.
+      # @return [nil]
+      def delete
+        client.delete_user(resource_options)
+        nil
+      end
+
+      # Deletes the current user, after:
+      # * deleting its login profile
+      # * removing it from all groups
+      # * deleting all of its access keys
+      # * deleting its mfa devices
+      # * deleting its signing certificates
+      def delete!
+        groups.clear
+        access_keys.clear
+        policies.clear
+        mfa_devices.clear
+        signing_certificates.clear
+        login_profile.delete if login_profile.exists?
+        delete
+      end
+
+      # Returns a collection that represents all policies for this user.
+      #
+      #     user.policies.each do |policy|
+      #       puts policy.name
+      #     end
+      #
+      # @return [PolicyCollection] Returns a collection that represents
+      #   all policies for this user.
+      def policies
+        UserPolicyCollection.new(self)
+      end
+
+      # Returns a collection that represents the signing certificates
+      # belonging to this user.
+      #
+      #     user.signing_certificates.each do |cert|
+      #       # ...
+      #     end
+      #
+      # If you need to access the signing certificates of this AWS account,
+      # see {IAM#signing_certificates}.
+      #
+      # @return [SigningCertificateCollection] Returns a collection that
+      #   represents signing certificates for this user.
+      def signing_certificates
+        SigningCertificateCollection.new(:user => self, :config => config)
+      end
+
+      # @return [MFADeviceCollection] Returns a collection that represents
+      #   all MFA devices assigned to this user.
+      def mfa_devices
+        MFADeviceCollection.new(self)
+      end
+
+      # A login profile is a user name and password that enables a
+      # user to log in to the {http://aws.amazon.com/console AWS
+      # Management Console}.  The object returned by this method
+      # allows you to set or delete the password.  For example:
+      #
+      #     user.login_profile.password = "TheNewPassword"
+      #
+      # @return [LoginProfile] Returns the login profile for this user.
+      def login_profile
+        LoginProfile.new(self)
+      end
+
+      # Returns a collection that represents the access keys for this user.
+      #
+      #     user.access_keys.each do |access_key|
+      #       puts access_key.id
+      #     end
+      #
+      # @return [AccessKeyCollection] Returns a collection that represents all
+      #   access keys for this user.
+      def access_keys
+        AccessKeyCollection.new(:user => self)
+      end
+
+      # Returns a collection that includes all of the groups the user is in.
+      # @return [UserGroupCollection]
+      def groups
+        UserGroupCollection.new(self)
+      end
+
+      # @api private
+      protected
+      def resource_identifiers
+        [[:user_name, name]]
+      end
+
+    end
+  end
+end