build-cloud 0.0.19 → 0.0.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: cc7f2cfe58332d3cb280dec151be0991e2aa506f
-  data.tar.gz: db1c91275e4b9ef9974d3cb45c44d791de3f371f
+  metadata.gz: a52e42a2f9f37f73e8cb750ff3d71454eed4a51f
+  data.tar.gz: 4445d3159b1cfbcd1808ca5bc182f65a97a4c54a
 SHA512:
-  metadata.gz: 7291602cf9fbe70d4843522c29fea8f3f8495e41c056b5ee0fed5025570d70dc57dbf75daef844066d5f9af56e7906935a5da9eb7c9b1c97d7653fe5c4775be9
-  data.tar.gz: 0c680371b065004833014c0eca17277d3a8924af68c277fe5166d6f4ea8bc359d491d55491e7ece13372814403aa649fdd1a15981a1b12a1060570ec9d60b33a
+  metadata.gz: f53a03aaecae0169ca975f7a79bf88b4ba0e206fcef9f41b2556a7863cdea98dfdc5f10af358899bbab3da5381d4df008e4060654e6cdc4f66af03843d7e4234
+  data.tar.gz: dd3fb1f7f7fc8da8c70b78ab8afaedc25f18d462e0ee0da0a6bd7432728b944b3afa55de8e49b262bd641c0b622b5d8d572896d796d59c221fd4f64ddb5b1675

data/CHANGELOG.md

@@ -1,5 +1,7 @@
 # Changelog
 
+2016-07-08 - version 0.0.20 - Add support for creating Users, Groups and lifecycle management of their policies. Add support for creating and deleting custom Managed Policies, no lifecycle support for policy versions. Improve IAM role support, lifecycle support for policies: now removes and updates role policies if they change/removed. Add policy lifecycle to S3 buckets.
+
 2016-06-17 - version 0.0.19 - add sqs support
 
 2016-06-16 - version 0.0.18 - fix cache parameter group creation for elasticache

data/bin/build-cloud

@@ -22,7 +22,10 @@ require 'build-cloud/dbparametergroup'
 require 'build-cloud/cachesubnetgroup'
 require 'build-cloud/cachecluster'
 require 'build-cloud/cacheparametergroup'
+require 'build-cloud/iammanagedpolicy'
+require 'build-cloud/iamgroup'
 require 'build-cloud/iamrole'
+require 'build-cloud/iamuser'
 require 'build-cloud/s3bucket'
 require 'build-cloud/instance'
 require 'build-cloud/ebsvolume'

data/build-cloud.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = "build-cloud"
-  spec.version       = "0.0.19"
+  spec.version       = "0.0.20"
   spec.authors       = ["The Scale Factory"]
   spec.email         = ["info@scalefactory.com"]
   spec.summary       = %q{Tools for building resources in AWS}

data/lib/build-cloud.rb

@@ -162,6 +162,9 @@ class BuildCloud
             :cache_clusters         => BuildCloud::CacheCluster,
             :cache_parameter_groups => BuildCloud::CacheParameterGroup,
             :iam_roles              => BuildCloud::IAMRole,
+            :iam_managed_policies   => BuildCloud::IAMManagedPolicy,
+            :iam_groups             => BuildCloud::IAMGroup,
+            :iam_users              => BuildCloud::IAMUser,
             :s3_buckets             => BuildCloud::S3Bucket,
             :instances              => BuildCloud::Instance,
             :ebs_volumes            => BuildCloud::EBSVolume,
@@ -176,7 +179,10 @@ class BuildCloud
             :dhcp_options_sets,
             :vpcs,
             :internet_gateways,
+            :iam_managed_policies,
             :iam_roles,
+            :iam_users,
+            :iam_groups,
             :subnets,
             :db_subnet_groups,
             :cache_subnet_groups,

data/lib/build-cloud/iamgroup.rb

@@ -0,0 +1,248 @@
+class BuildCloud::IAMGroup
+    
+    require 'json'
+
+    include ::BuildCloud::Component
+
+    @@objects = []
+
+    def initialize ( fog_interfaces, log, options = {} )
+
+        @iam     = fog_interfaces[:iam]
+        @log     = log
+        @options = options
+
+        @log.debug( options.inspect )
+
+        required_options(:name)
+
+    end
+
+    def create
+        
+        policies = @options.delete(:policies)
+        users = @options.delete(:users)
+        
+        unless exists?
+
+            @log.info( "Creating new IAM group #{@options[:name]}" )
+
+            group = @iam.groups.new( @options )
+            group.save
+
+            @log.debug( group.inspect )
+            
+        end
+        
+        rationalise_policies ( policies )
+        rationalise_users ( users )
+        
+    end
+
+    def read
+        @iam.groups.select { |r| r.name == @options[:name] }.first
+    end
+    
+    
+    def rationalise_policies( policies )
+
+        policies = {} if policies.nil?
+
+        managed_policies_to_add  = []
+        group_policies_to_add  = []
+        current_managed_policies = []
+        current_group_policies = []
+        
+        fog_object.attached_policies.each do |p|
+            current_managed_policies << { :arn => p.arn }
+        end
+        
+        # fog_object.policies doesn't return id/policy name
+        @iam.list_group_policies(fog_object.name).body['PolicyNames'].each do |pn|
+            p = @iam.get_group_policy(pn, fog_object.name).body
+            policy = { :document => p['Policy']['PolicyDocument'], :id => p['PolicyName'] }
+            current_group_policies << policy
+        end
+
+        # Build add lists
+        policies.each do |p|
+            @log.debug("Policy action on is #{p}")
+            if p[:arn]
+                @log.debug("For group #{fog_object.name} checking managed policy #{p[:arn]}")
+                # Assume adding policy
+                add_policy = true
+                current_managed_policies.each do |cmp|
+                    add_policy = false if cmp[:arn] == p[:arn]
+                end
+                if add_policy   
+                    @log.debug("Adding #{p[:arn]} to list" ) 
+                    managed_policies_to_add << { :arn => p[:arn] }
+                end
+            elsif p[:id]
+                @log.debug("For group #{fog_object.name} checking policy #{p[:id]}")
+                # Assume adding policy
+                pa = {
+                    :document => JSON.parse(p[:document]),
+                    :id       => p[:id],
+                }
+                group_policies_to_add << pa
+            end
+        end
+        
+        policies.each do |p|
+            # If we find a current policy that matches the desired policy, then
+            # remove that from the list of current policies - we will remove any
+            # remaining policies
+            if p[:arn]
+                current_managed_policies.delete_if do |c|
+                    if c[:arn] == p[:arn]
+                        @log.debug( "#{p[:arn]} already exists" )
+                        true # so that delete_if removes the list item
+                    else
+                        false
+                    end
+                end
+            elsif p[:id]
+                current_group_policies.delete_if do |c|
+                    if c[:id] == p[:id]
+                        @log.debug( "#{p[:id]} already exists" )
+                        
+                        # Remove from the policies to add if the policy documents match
+                        group_policies_to_add.delete_if do |a|
+                            if (c[:id] == a[:id]) and
+                               (c[:document] == a[:document])
+                                @log.debug("#{p[:id]} is a match" )
+                                true
+                            else
+                                false
+                            end
+                        end
+                        true # so that delete_if removes the list item
+                    else
+                        false
+                    end
+                end
+            end
+        end
+
+        # At the end of this loop, anything left in the user_current_policies list
+        # represents a policy that's present on the infra, but should be deleted
+        # (since there's no matching desired policy), so delete those.
+        # Changing a rule maps to "delete old rule, create new one".
+
+        current_group_policies.each do |p|
+            @log.debug( "Removing policy #{p.inspect}" )
+            @log.info( "For group #{fog_object.name} removing policy #{p[:id]}" )
+            @iam.delete_group_policy(fog_object.name, p[:id])
+        end
+
+        group_policies_to_add.each do |p|
+            @log.debug( "For group #{fog_object.name} adding/updating policy #{p}" )
+            @log.info( "For group #{fog_object.name} adding/updating policy #{p[:id]}" )
+            @iam.put_group_policy( fog_object.name, p[:id], p[:document] )
+        end
+        
+        # And the same for managed policies, but we just detatch them:
+        current_managed_policies.each do |p|
+            @log.debug( "Detatching policy #{p.inspect}" )
+            @log.info( "For group #{fog_object.name} detatcing policy #{p[:arn]}" )
+            @iam.detach_group_policy(fog_object.name, p[:arn])
+        end
+        
+        managed_policies_to_add.each do |p|
+            @log.debug( "For group #{fog_object.name} attaching policy #{p}" )
+            @log.info( "For group #{fog_object.name} attaching policy #{p[:arn]}" )
+            @iam.attach_group_policy(fog_object.name, p[:arn])
+        end
+        
+    end
+    
+    def rationalise_users( users )
+
+        users = {} if users.nil?
+
+        users_to_add  = []
+        current_users = []
+        
+        @log.debug("Users info: #{@iam.get_group(@options[:name]).body['Users'].inspect}")
+        # can't use fog_object.users as always empty
+        @iam.get_group(@options[:name]).body['Users'].each do |u|
+            current_users << { :id => u['UserName']}
+        end
+        
+        @log.debug("Current users: #{current_users}")
+        # Build list of users to add
+        users.each do |u|
+            @log.debug("User acting on is #{u}")
+            @log.debug("For group #{fog_object.name} checking user #{u}")
+            
+            # Assume adding user
+            add_user = true
+            current_users.each do |cmu|
+                add_user = false if cmu[:id] == u
+            end
+            if add_user
+                # If we find a user that's not currently present we prepare to add it
+                @log.debug("Adding #{u} to list" )
+                users_to_add << { :id => u }
+            end
+        end
+        
+        # Find users to remove
+        users.each do |u|
+            # If we find a current user that matches the desired user, then
+            # remove that from the list of current users - we will remove any
+            # remaining users
+            current_users.delete_if do |c|
+                if c[:id] == u
+                    @log.debug( "#{u} already exists" )
+                    true # so that delete_if removes the list item
+                else
+                    false
+                end
+            end
+        end
+
+        # At the end of this loop, anything left in the current_users list
+        # represents a group that's present on the user, but should be removed
+        # (since there's no matching desired group), so delete those.
+
+        current_users.each do |u|
+            @log.debug( "Removing group #{u.inspect} from #{u}" )
+            @log.info( "For group #{fog_object.name} removing user #{u[:id]}" )
+            @iam.remove_user_from_group(fog_object.name, u[:id])
+        end
+        
+        users_to_add.each do |u|
+            @log.debug( "For group #{fog_object.name} attaching user #{u}" )
+            @log.info( "For group #{fog_object.name} attaching user #{u[:id]}" )
+            fog_object.add_user(u[:id])
+        end
+        fog_object.save
+    end
+
+    alias_method :fog_object, :read
+
+    def delete
+
+        return unless exists?
+        @log.info( "Deleting IAM group for #{@options[:name]}" )
+
+        #detach all policies
+        fog_object.attached_policies.each do |p|
+            fog_object.detach(p)
+        end
+        
+        fog_object.policies.each do |p|
+            @iam.delete_user_policy(@options[:id], p.id)
+        end
+        
+        #remove all users
+        fog_object.users.each do |u|
+            @iam.remove_user_from_group(fog_object.name, u.id)
+        end
+            
+        fog_object.destroy
+    end
+
+end

data/lib/build-cloud/iammanagedpolicy.rb

@@ -0,0 +1,56 @@
+
+# IAM Managed Policy is not updated once created, because fog doesn't support policy versioning right now
+
+class BuildCloud::IAMManagedPolicy
+    
+    require 'json'
+
+    include ::BuildCloud::Component
+
+    @@objects = []
+
+    def initialize ( fog_interfaces, log, options = {} )
+
+        @iam     = fog_interfaces[:iam]
+        @log     = log
+        @options = options
+
+        @log.debug( options.inspect )
+
+        required_options(:name, :policy_document)
+
+    end
+
+        
+    def create
+
+        unless exists?
+
+            @log.info( "Creating new IAM policy #{@options[:name]}" )
+            
+            policy = @iam.create_policy(@options[:name],JSON.parse(@options[:policy_document]), @options[:policy_path], @options[:policy_description])
+            
+            @log.debug( policy.inspect )
+
+        else
+            policy = fog_object
+        end
+
+    end
+
+    def read
+        @iam.managed_policies.select { |r| r.name == @options[:name] }.first
+    end
+
+    alias_method :fog_object, :read
+
+    def delete
+
+        return unless exists?
+
+        @log.info( "Deleting IAM managed policy #{@options[:name]}" )
+        @fog.delete_policy(fog_object['Arn'])
+
+    end
+
+end

data/lib/build-cloud/iamrole.rb

@@ -19,43 +19,143 @@ class BuildCloud::IAMRole
     end
 
     def create
-        
-        return if exists?
-
-        @log.info( "Creating new IAM role for #{@options[:rolename]}" )
 
         policies = @options.delete(:policies)
 
-        # Genuinely don't think I've understood the data model with 
-        # this stuff.  In particular how roles, instance profiles etc. relate
-        #
-        # It does what we need right now though, and can be revisited if necessary
+        unless exists?
 
-        role = @iam.roles.new( @options )
-        role.save
+            @log.info( "Creating new IAM role for #{@options[:rolename]}" )
 
-        @log.debug( role.inspect )
+            # Genuinely don't think I've understood the data model with 
+            # this stuff.  In particular how roles, instance profiles etc. relate
+            #
+            # It does what we need right now though, and can be revisited if necessary
 
-        @iam.create_instance_profile( @options[:rolename] )
+            role = @iam.roles.new( @options )
+            role.save
 
-        policies.each do |policy|
+            @log.debug( role.inspect )
 
-            @log.debug( "Adding policy #{policy}" )
+            @iam.create_instance_profile( @options[:rolename] )
 
-            policy_document = JSON.parse( policy[:policy_document] )
-
-            @iam.put_role_policy( @options[:rolename], policy[:policy_name],
-                policy_document )
+            @iam.add_role_to_instance_profile( @options[:rolename], @options[:rolename] )
 
         end
 
-        @iam.add_role_to_instance_profile( @options[:rolename], @options[:rolename] )
+        rationalise_policies( policies )
 
     end
 
     def read
         @iam.roles.select { |r| r.rolename == @options[:rolename] }.first
     end
+    
+    
+    def rationalise_policies( policies )
+
+        policies = {} if policies.nil?
+
+        managed_policies_to_add  = []
+        current_policies = []
+        policies_to_add  = []
+
+        # Read all the existing policies from the role object. Turn what we find into
+        # a list of hashes, where the hash parameter names match those that we use
+        # in the YAML description.  This will aid comparison of current vs. desired policies
+
+        policy_names = @iam.list_role_policies(fog_object.rolename).body["PolicyNames"]
+        
+        unless policy_names.nil? 
+
+            policy_names.each do |policy_name|
+
+                c = {
+                    :policy_document => @iam.get_role_policy(fog_object.rolename, policy_name).body["Policy"]["PolicyDocument"],
+                    :policy_name     => policy_name,
+                }
+
+                current_policies << c
+
+            end
+        end
+        
+        # Build add lists
+        policies.each do |p|
+            @log.debug("Policy action on is #{p}")
+            if p[:arn]
+                # Ensure any Managed Policies are attached. Fog support is limited, so always adds
+                @log.debug("For group #{fog_object.rolename} adding managed policy #{p[:arn]}")
+                managed_policies_to_add << { :arn => p[:arn] }
+            elsif p[:policy_name]
+                @log.debug("For role #{fog_object.rolename} checking policy #{p[:policy_name]}")
+                # Assume adding policy
+                pa = {
+                    :policy_document => JSON.parse(p[:policy_document]),
+                    :policy_name     => p[:policy_name],
+                }
+                policies_to_add << pa
+            end
+        end
+
+        
+        policies.each do |p|
+            @log.debug("For role #{fog_object.rolename}  policy #{p.inspect}")
+            
+            # If we find a current policy that matches the desired policy, then
+            # remove that from the list of current policies - we will remove any
+            # remaining policies
+            current_policies.delete_if do |c|
+                if c[:policy_name] == p[:policy_name]
+                    @log.debug( "#{p[:policy_name]} already exists" )
+                    
+                    # Remove from the policies to add if the policy documents match
+                    policies_to_add.delete_if do |a|
+                        if (c[:policy_name] == a[:policy_name]) and
+                           (c[:policy_document] == a[:policy_document])
+                            @log.debug("#{p[:policy_name]} is a match" )
+                            true
+                        else
+                            @log.debug("#{p[:policy_name]} is different" )
+                            @log.debug("new policy is '#{a[:policy_document]}'")
+                            @log.debug("current policy is '#{c[:policy_document]}'")
+                            false
+                        end
+                    end
+                    true # so that delete_if removes the list item
+                else
+                    false
+                end
+            end
+        end
+
+        # At the end of this loop, anything left in the current_policies list
+        # represents a policy that's present on the infra, but should be deleted
+        # (since there's no matching desired policy), so delete those.
+
+        current_policies.each do |p|
+
+            @log.debug( "Removing policy #{p.inspect}" )
+            @log.info( "For role #{fog_object.rolename} removing policy #{p[:policy_name]}" )
+            @iam.delete_role_policy(fog_object.rolename, p[:policy_name])
+
+        end
+
+        policies_to_add.each do |p|
+
+            @log.debug( "For role #{fog_object.rolename} adding/updating policy #{p}" )
+            @log.info( "For role #{fog_object.rolename} adding/updating policy #{p[:policy_name]}" )
+            @iam.put_role_policy( fog_object.rolename, p[:policy_name], p[:policy_document] )
+
+        end
+        
+        # IAM Role Policy support is not complete in fog-aws, always attach policy
+        managed_policies_to_add.each do |p|
+            @log.debug( "For role #{fog_object.rolename} attaching policy #{p}" )
+            @log.info( "For role #{fog_object.rolename} attaching policy #{p[:arn]}" )
+            @iam.attach_role_policy(fog_object.rolename, p[:arn])
+        end
+
+    end
 
     alias_method :fog_object, :read
 
@@ -82,4 +182,3 @@ class BuildCloud::IAMRole
     end
 
 end
-

data/lib/build-cloud/iamuser.rb

@@ -0,0 +1,191 @@
+class BuildCloud::IAMUser
+    
+    require 'json'
+
+    include ::BuildCloud::Component
+
+    @@objects = []
+
+    def initialize ( fog_interfaces, log, options = {} )
+
+        @iam     = fog_interfaces[:iam]
+        @log     = log
+        @options = options
+
+        @log.debug( options.inspect )
+
+        required_options(:id)
+
+    end
+
+    def create
+        
+        policies = @options.delete(:policies)
+        groups = @options.delete(:groups)
+        
+        unless exists?
+
+            @log.info( "Creating new IAM user #{@options[:id]}" )
+
+            user = @iam.users.new( @options )
+            user.save
+
+            @log.debug( user.inspect )
+        else
+            user = fog_object
+        end
+        
+        @log.debug("User is : #{user.inspect}")
+        
+        #if there are :policies: attach and remove any not listed
+        # if a policy is managed then it requires an arn, and to be created under :iam_managed_policies:
+        # or amazons policy arns
+        # if a policy is a user one, then it needs :name: and :document:
+        rationalise_policies( policies )
+        
+        # Users are added to groups under :iam_groups:
+
+    end
+    
+    def rationalise_policies( policies )
+
+        policies = {} if policies.nil?
+
+        managed_policies_to_add  = []
+        user_policies_to_add  = []
+        current_managed_policies = []
+        current_user_policies = []
+        
+        fog_object.attached_policies.each do |p|
+            current_managed_policies << { :arn => p.arn }
+        end
+        
+        fog_object.policies.each do |p|
+            current_user_policies << { :document => p.document, :id => p.id }
+        end
+        
+        # Build add lists
+        policies.each do |p|
+            @log.debug("Policy action on is #{p}")
+            if p[:arn]
+                @log.debug("For user #{fog_object.id} checking managed policy #{p[:arn]}")
+                # Assume adding policy
+                add_policy = true
+                current_managed_policies.each do |cmp|
+                    add_policy = false if cmp[:arn] == p[:arn]
+                end
+                if add_policy   
+                    @log.debug("Adding #{p[:arn]} to list" ) 
+                    managed_policies_to_add << { :arn => p[:arn] }
+                end
+            elsif p[:id]
+                @log.debug("For user #{fog_object.id} checking policy #{p[:id]}")
+                # Assume adding policy
+                pa = {
+                    :document => JSON.parse(p[:document]),
+                    :id       => p[:id],
+                }
+                user_policies_to_add << pa
+            end
+        end
+        
+        policies.each do |p|
+            # If we find a current policy that matches the desired policy, then
+            # remove that from the list of current policies - we will remove any
+            # remaining policies
+            if p[:arn]
+                current_managed_policies.delete_if do |c|
+                    if c[:arn] == p[:arn]
+                        @log.debug( "#{p[:arn]} already exists" )
+                        true # so that delete_if removes the list item
+                    else
+                        false
+                    end
+                end
+            elsif p[:id]
+                current_user_policies.delete_if do |c|
+                    if c[:id] == p[:id]
+                        @log.debug( "#{p[:id]} already exists" )
+                        
+                        # Remove from the policies to add if the policy documents match
+                        user_policies_to_add.delete_if do |a|
+                            if (c[:id] == a[:id]) and
+                               (c[:document] == a[:document])
+                                @log.debug("#{p[:id]} is a match" )
+                                true
+                            else
+                                false
+                            end
+                        end
+                        true # so that delete_if removes the list item
+                    else
+                        false
+                    end
+                end
+            end
+        end
+
+        # At the end of this loop, anything left in the user_current_policies list
+        # represents a policy that's present on the infra, but should be deleted
+        # (since there's no matching desired policy), so delete those.
+        # Changing a rule maps to "delete old rule, create new one".
+
+        current_user_policies.each do |p|
+            @log.debug( "Removing policy #{p.inspect}" )
+            @log.info( "For user #{fog_object.id} removing policy #{p[:id]}" )
+            @iam.delete_user_policy(fog_object.id, p[:id])
+        end
+
+        user_policies_to_add.each do |p|
+            @log.debug( "For user #{fog_object.id} adding/updating policy #{p}" )
+            @log.info( "For user #{fog_object.id} adding/updating policy #{p[:id]}" )
+            @iam.put_user_policy( fog_object.id, p[:id], p[:document] )
+        end
+        
+        # And the same for managed policies, but we just detatch them:
+        current_managed_policies.each do |p|
+            @log.debug( "Detatching policy #{p.inspect}" )
+            @log.info( "For user #{fog_object.id} detatcing policy #{p[:arn]}" )
+            fog_object.detach(p[:arn])
+        end
+        
+        managed_policies_to_add.each do |p|
+            @log.debug( "For user #{fog_object.id} attaching policy #{p}" )
+            @log.info( "For user #{fog_object.id} attaching policy #{p[:arn]}" )
+            mp = @iam.managed_policies.select { |r| r.arn == p[:arn] }.first
+            mp.attach(fog_object)
+        end
+        
+    end
+
+    def read
+        @iam.users.select { |r| r.id == @options[:id] }.first
+    end
+
+    alias_method :fog_object, :read
+
+    def delete
+
+        return unless exists?
+        @log.info( "Deleting IAM users for #{@options[:id]}" )
+
+        #detach all policies
+        #Manged Policies
+        fog_object.attached_policies.each do |p|
+            fog_object.detach(p)
+        end
+        
+        fog_object.policies.each do |p|
+            @iam.delete_user_policy(@options[:id], p.id)
+        end
+
+        #remove from group
+        @iam.list_groups_for_user(@options[:id]).body['GroupsForUser'].each do |g|
+            @iam.remove_user_from_group(g['GroupName'], fog_object.id)
+        end
+        
+        #remove all users
+        fog_object.destroy
+    end
+
+end

data/lib/build-cloud/s3bucket.rb

@@ -18,14 +18,19 @@ class BuildCloud::S3Bucket
 
     def create
         
-        return if exists?
+        policy = @options.delete(:policy)
+        
+        unless exists?
 
-        @log.info( "Creating new S3 bucket #{@options[:key]}" )
+            @log.info( "Creating new S3 bucket #{@options[:key]}" )
 
-        bucket = @s3.directories.new( @options )
-        bucket.save
+            bucket = @s3.directories.new( @options )
+            bucket.save
 
-        @log.debug( bucket.inspect )
+            @log.debug( bucket.inspect )
+        end
+        
+        rationalise_policies( policy )
 
     end
 
@@ -44,6 +49,31 @@ class BuildCloud::S3Bucket
         fog_object.destroy
 
     end
+    
+    def rationalise_policies( policy )
 
-end
+        policy = JSON.parse(policy) unless policy.nil?
+        @log.debug("Policy inspect #{policy.inspect}")
+        
+        begin
+            @log.debug("Inspect #{@s3.get_bucket_policy(fog_object.key)}")
+            current_policy = @s3.get_bucket_policy(fog_object.key)
+        rescue Excon::Errors::NotFound
+            current_policy = nil
+        end
+
+        @log.debug("Current Policy inspect #{current_policy.inspect}")
+        
+        if policy.nil? and current_policy.nil?
+            return
+        elsif policy.nil? and current_policy.any?
+            @log.info("Existing policy here, deleting it")
+            @s3.delete_bucket_policy(fog_object.key)
+        elsif policy != current_policy
+            @log.info( "For bucket #{fog_object.key} adding/updating policy #{p}" )
+            @s3.put_bucket_policy( fog_object.key, policy )
+        end
+        
+    end
 
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: build-cloud
 version: !ruby/object:Gem::Version
-  version: 0.0.19
+  version: 0.0.20
 platform: ruby
 authors:
 - The Scale Factory
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-06-17 00:00:00.000000000 Z
+date: 2016-07-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -93,7 +93,10 @@ files:
 - lib/build-cloud/dbsubnetgroup.rb
 - lib/build-cloud/dhcpoptionsset.rb
 - lib/build-cloud/ebsvolume.rb
+- lib/build-cloud/iamgroup.rb
+- lib/build-cloud/iammanagedpolicy.rb
 - lib/build-cloud/iamrole.rb
+- lib/build-cloud/iamuser.rb
 - lib/build-cloud/instance.rb
 - lib/build-cloud/internetgateway.rb
 - lib/build-cloud/launchconfiguration.rb