cloud-mu 1.9.0.pre.beta → 2.0.0.pre.alpha

data/modules/mu/clouds/aws/group.rb

@@ -40,7 +40,7 @@ module MU
         # Called automatically by {MU::Deploy#createResources}
         def create
           begin
-            MU::Cloud::AWS.iam.get_group(
+            MU::Cloud::AWS.iam(credentials: @config['credentials']).get_group(
               group_name: @mu_name,
               path: @config['path']
             )
@@ -50,7 +50,7 @@ module MU
           rescue Aws::IAM::Errors::NoSuchEntity => e
             @config['path'] ||= "/"+@deploy.deploy_id+"/"
             MU.log "Creating IAM group #{@config['path']}#{@mu_name}"
-            MU::Cloud::AWS.iam.create_group(
+            MU::Cloud::AWS.iam(credentials: @config['credentials']).create_group(
               group_name: @mu_name,
               path: @config['path']
             )
@@ -72,7 +72,7 @@ module MU
               if found.size == 1
                 userdesc = found.values.first
                 MU.log "Adding IAM user #{userdesc.path}#{userdesc.user_name} to group #{@mu_name}", MU::NOTICE
-                MU::Cloud::AWS.iam.add_user_to_group(
+                MU::Cloud::AWS.iam(credentials: @config['credentials']).add_user_to_group(
                   user_name: userid,
                   group_name: @mu_name
                 )
@@ -85,7 +85,7 @@ module MU
               extras = cloud_desc.users.map { |u| u.user_name } - @config['members']
               extras.each { |user_name|
                 MU.log "Purging user #{user_name} from IAM group #{@cloud_id}", MU::NOTICE
-                MU::Cloud::AWS.iam.remove_user_from_group(
+                MU::Cloud::AWS.iam(credentials: @config['credentials']).remove_user_from_group(
                   user_name: user_name,
                   group_name: @cloud_id
                 )
@@ -110,7 +110,7 @@ module MU
         # Fetch the AWS API description of this group
         # return [Struct]
         def cloud_desc
-          MU::Cloud::AWS.iam.get_group(
+          MU::Cloud::AWS.iam(credentials: @config['credentials']).get_group(
             group_name: @mu_name
           )
         end
@@ -123,29 +123,36 @@ module MU
           descriptor
         end
 
+        # Does this resource type exist as a global (cloud-wide) artifact, or
+        # is it localized to a region/zone?
+        # @return [Boolean]
+        def self.isGlobal?
+          true
+        end
+
         # Remove all groups associated with the currently loaded deployment.
         # @param noop [Boolean]: If true, will only print what would be done
         # @param ignoremaster [Boolean]: If true, will remove resources not flagged as originating from this Mu server
         # @param region [String]: The cloud provider region
         # @return [void]
-        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, flags: {})
-          resp = MU::Cloud::AWS.iam.list_groups(
+        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
+          resp = MU::Cloud::AWS.iam(credentials: credentials).list_groups(
             path_prefix: "/"+MU.deploy_id+"/"
           )
           if resp and resp.groups
             resp.groups.each { |g|
               MU.log "Deleting IAM group #{g.path}#{g.group_name}"
               if !noop
-                desc = MU::Cloud::AWS.iam.get_group(
+                desc = MU::Cloud::AWS.iam(credentials: credentials).get_group(
                   group_name: g.group_name
                 )
                 desc.users.each { |u|
-                  MU::Cloud::AWS.iam.remove_user_from_group(
+                  MU::Cloud::AWS.iam(credentials: credentials).remove_user_from_group(
                     user_name: u.user_name,
                     group_name: g.group_name
                   )
                 }
-                MU::Cloud::AWS.iam.delete_group(
+                MU::Cloud::AWS.iam(credentials: credentials).delete_group(
                   group_name: g.group_name
                 )
               end
@@ -158,10 +165,10 @@ module MU
         # @param region [String]: The cloud provider region.
         # @param flags [Hash]: Optional flags
         # @return [OpenStruct]: The cloud provider's complete descriptions of matching group group.
-        def self.find(cloud_id: nil, region: MU.curRegion, flags: {})
+        def self.find(cloud_id: nil, region: MU.curRegion, credentials: nil, flags: {})
           found = nil
           begin
-            resp = MU::Cloud::AWS.iam.get_group(
+            resp = MU::Cloud::AWS.iam(credentials: credentials).get_group(
               group_name: cloud_id
             )
             found ||= {}

data/modules/mu/clouds/aws/habitat.rb

@@ -0,0 +1,153 @@
+# Copyright:: Copyright (c) 2019 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module MU
+  class Cloud
+    class AWS
+      # Creates an AWS account as configured in {MU::Config::BasketofKittens::habitats}
+      class Habitat < MU::Cloud::Habitat
+        @deploy = nil
+        @config = nil
+
+        attr_reader :mu_name
+        attr_reader :config
+        attr_reader :cloud_id
+
+        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
+        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::habitats}
+        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
+          @deploy = mommacat
+          @config = MU::Config.manxify(kitten_cfg)
+          @cloud_id ||= cloud_id
+          @mu_name ||= @deploy.getResourceName(@config["name"], max_length: 63)
+        end
+
+        # Called automatically by {MU::Deploy#createResources}
+        def create
+          if !@config['email']
+            avail_chars = 62 - $MU_CFG['mu_admin_email'].size
+            alias_str = @deploy.getResourceName(@config["name"], max_length: avail_chars, need_unique_string: true) 
+            @config['email'] ||= $MU_CFG['mu_admin_email'].sub(/(\+.*?)?@/, "+"+alias_str+"@")
+          end
+
+          MU.log "Creating AWS account #{@mu_name} with contact email #{@config['email']}"
+          resp = MU::Cloud::AWS.orgs(credentials: @config['credentials']).create_account(
+            account_name: @mu_name,
+            email: @config['email']
+          )
+
+          createid = resp.create_account_status.id
+
+          begin
+            resp = MU::Cloud::AWS.orgs(credentials: @config['credentials']).describe_create_account_status(
+              create_account_request_id: createid
+            )
+            createstatus = resp.create_account_status.state
+            if !["SUCCEEDED", "IN_PROGRESS"].include?(resp.create_account_status.state)
+              raise MuError, "Failed to create account #{@mu_name}: #{resp.create_account_status.failure_reason}"
+            end
+            if resp.create_account_status.state == "IN_PROGRESS"
+              sleep 10
+            end
+          end while resp.create_account_status.state == "IN_PROGRESS"
+
+          MU.log "Creation of account #{@mu_name} (#{resp.create_account_status.account_id}) complete"
+        end
+
+        # Return the cloud descriptor for the Habitat
+        def cloud_desc
+          MU::Cloud::AWS::Habitat.find(cloud_id: @cloud_id).values.first
+        end
+
+        # Canonical Amazon Resource Number for this resource
+        # @return [String]
+        def arn
+          nil
+        end
+
+        # Return the metadata for this account configuration
+        # @return [Hash]
+        def notify
+          {
+          }
+        end
+
+        # Does this resource type exist as a global (cloud-wide) artifact, or
+        # is it localized to a region/zone?
+        # @return [Boolean]
+        def self.isGlobal?
+          true
+        end
+
+        # Remove all AWS accounts associated with the currently loaded deployment. Try to, anyway.
+        # @param noop [Boolean]: If true, will only print what would be done
+        # @param ignoremaster [Boolean]: If true, will remove resources not flagged as originating from this Mu server
+        # @param region [String]: The cloud provider region
+        # @return [void]
+        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
+        end
+
+        # Locate an existing account
+        # @param cloud_id [String]: The cloud provider's identifier for this resource.
+        # @param region [String]: The cloud provider region.
+        # @param flags [Hash]: Optional flags
+        # @return [OpenStruct]: The cloud provider's complete descriptions of matching account
+        def self.find(cloud_id: nil, region: MU.curRegion, credentials: nil, flags: {})
+          {}
+        end
+
+        # Cloud-specific configuration properties.
+        # @param config [MU::Config]: The calling MU::Config object
+        # @return [Array<Array,Hash>]: List of required fields, and json-schema Hash of cloud-specific configuration parameters for this resource
+        def self.schema(config)
+          toplevel_required = []
+          schema = {
+            "email" => {
+              "type" => "string",
+              "description" => "AWS accounts require a unique contact email address. If not provided, Mu will generate an alias to the global mu_admin_email using the +foo SMTP mechanism."
+            }
+          }
+          [toplevel_required, schema]
+        end
+
+        # Cloud-specific pre-processing of {MU::Config::BasketofKittens::habitats}, bare and unvalidated.
+        # @param habitat [Hash]: The resource to process and validate
+        # @param configurator [MU::Config]: The overall deployment configurator of which this resource is a member
+        # @return [Boolean]: True if validation succeeded, False otherwise
+        def self.validateConfig(habitat, configurator)
+          ok = true
+
+          if !habitat["email"]
+            MU.log "No email address specified in habitat #{habitat['name']}, and AWS requires a unique contact email. Will generate an alias to #{$MU_CFG['mu_admin_email']} at run time.", MU::NOTICE
+          end
+
+          # Figure out what account we're calling from, and then figure out if
+          # it's the organization's master account- the only place from which
+          # we can create accounts.
+          user_list = MU::Cloud::AWS.iam(credentials:  habitat['credentials']).list_users.users
+          acct_num = MU::Cloud::AWS.iam(credentials:  habitat['credentials']).list_users.users.first.arn.split(/:/)[4]
+
+          parentorg = MU::Cloud::AWS::Folder.find(credentials: habitat['credentials']).values.first
+          if acct_num != parentorg.master_account_id
+            MU.log "The Organization master account for habitat #{habitat["name"]} is #{parentorg.master_account_id}, but my credentials (#{ habitat['credentials'] ?  habitat['credentials'] : "default"}) are for a non-master account (#{acct_num}). AWS accounts can only be created and managed with credentials from an Organization's master account.", MU::ERR
+            ok = false
+          end
+
+          ok
+        end
+
+      end
+    end
+  end
+end

data/modules/mu/clouds/aws/loadbalancer.rb

@@ -47,7 +47,7 @@ module MU
         # Called automatically by {MU::Deploy#createResources}
         def create
           if @config["zones"] == nil
-            @config["zones"] = MU::Cloud::AWS.listAZs(@config['region'])
+            @config["zones"] = MU::Cloud::AWS.listAZs(region: @config['region'])
             MU.log "Using zones from #{@config['region']}", MU::DEBUG, details: @config['zones']
           end
 
@@ -128,15 +128,15 @@ module MU
           begin
             if @config['classic']
               MU.log "Creating Elastic Load Balancer #{@mu_name}", details: lb_options
-              lb = MU::Cloud::AWS.elb(@config['region']).create_load_balancer(lb_options)
+              lb = MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).create_load_balancer(lb_options)
             else
               MU.log "Creating Application Load Balancer #{@mu_name}", details: lb_options
-              lb = MU::Cloud::AWS.elb2(@config['region']).create_load_balancer(lb_options).load_balancers.first
+              lb = MU::Cloud::AWS.elb2(region: @config['region'], credentials: @config['credentials']).create_load_balancer(lb_options).load_balancers.first
               begin
                 if lb.state.code != "active"
                   MU.log "Waiting for ALB #{@mu_name} to enter 'active' state", MU::NOTICE
                   sleep 20
-                  lb = MU::Cloud::AWS.elb2(@config['region']).describe_load_balancers(
+                  lb = MU::Cloud::AWS.elb2(region: @config['region'], credentials: @config['credentials']).describe_load_balancers(
                     names: [@mu_name]
                   ).load_balancers.first
                 end
@@ -176,7 +176,7 @@ module MU
           if zones_to_try.size < @config["zones"].size
             zones_to_try.each { |zone|
               begin
-                MU::Cloud::AWS.elb(@config['region']).enable_availability_zones_for_load_balancer(
+                MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).enable_availability_zones_for_load_balancer(
                   load_balancer_name: @mu_name,
                   availability_zones: [zone]
                 )
@@ -189,7 +189,7 @@ module MU
           @targetgroups = {}
           if !@config['healthcheck'].nil? and @config['classic']
             MU.log "Configuring custom health check for ELB #{@mu_name}", details: @config['healthcheck']
-            MU::Cloud::AWS.elb(@config['region']).configure_health_check(
+            MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).configure_health_check(
                 load_balancer_name: @mu_name,
                 health_check: {
                     target: @config['healthcheck']['target'],
@@ -231,9 +231,9 @@ module MU
                   end
                 end
 
-                tg_resp = MU::Cloud::AWS.elb2(@config['region']).create_target_group(tg_descriptor)
+                tg_resp = MU::Cloud::AWS.elb2(region: @config['region'], credentials: @config['credentials']).create_target_group(tg_descriptor)
                 @targetgroups[tg['name']] = tg_resp.target_groups.first
-                MU::Cloud::AWS.elb2(@config['region']).add_tags(
+                MU::Cloud::AWS.elb2(region: @config['region'], credentials: @config['credentials']).add_tags(
                   resource_arns: [tg_resp.target_groups.first.target_group_arn],
                   tags: lb_options[:tags]
                 )
@@ -268,7 +268,7 @@ module MU
                   "ELBSecurityPolicy-TLS-1-2-2017-01"
                 end
               end
-              listen_resp = MU::Cloud::AWS.elb2(@config['region']).create_listener(listen_descriptor).listeners.first
+              listen_resp = MU::Cloud::AWS.elb2(region: @config['region'], credentials: @config['credentials']).create_listener(listen_descriptor).listeners.first
               if !l['rules'].nil?
                 l['rules'].each { |rule|
                   rule_descriptor = {
@@ -283,14 +283,14 @@ module MU
                       :type => a['action']
                     }
                   }
-                  MU::Cloud::AWS.elb2(@config['region']).create_rule(rule_descriptor)
+                  MU::Cloud::AWS.elb2(region: @config['region'], credentials: @config['credentials']).create_rule(rule_descriptor)
                 }
               end
             }
           else
             @config["listeners"].each { |l|
               if l['ssl_certificate_id']
-                resp = MU::Cloud::AWS.elb(@config['region']).set_load_balancer_policies_of_listener(
+                resp = MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).set_load_balancer_policies_of_listener(
                   load_balancer_name: @cloud_id, 
                   load_balancer_port: l['lb_port'], 
                   policy_names: [
@@ -323,7 +323,7 @@ module MU
           if @config['cross_zone_unstickiness'] 
             MU.log "Enabling cross-zone un-stickiness on #{lb.dns_name}"
             if @config['classic']
-              MU::Cloud::AWS.elb(@config['region']).modify_load_balancer_attributes(
+              MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).modify_load_balancer_attributes(
                 load_balancer_name: @mu_name,
                 load_balancer_attributes: {
                   cross_zone_load_balancing: {
@@ -333,7 +333,7 @@ module MU
               )
             else
               @targetgroups.each_pair { |tg_name, tg|
-                MU::Cloud::AWS.elb2(@config['region']).modify_target_group_attributes(
+                MU::Cloud::AWS.elb2(region: @config['region'], credentials: @config['credentials']).modify_target_group_attributes(
                   target_group_arn: tg.target_group_arn,
                   attributes: [
                     {
@@ -349,7 +349,7 @@ module MU
           if !@config['idle_timeout'].nil?
             MU.log "Setting idle timeout to #{@config['idle_timeout']} #{lb.dns_name}"
             if @config['classic']
-              MU::Cloud::AWS.elb(@config['region']).modify_load_balancer_attributes(
+              MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).modify_load_balancer_attributes(
                 load_balancer_name: @mu_name,
                 load_balancer_attributes: {
                   connection_settings: {
@@ -358,7 +358,7 @@ module MU
                 }
               )
             else
-              MU::Cloud::AWS.elb2(@config['region']).modify_load_balancer_attributes(
+              MU::Cloud::AWS.elb2(region: @config['region'], credentials: @config['credentials']).modify_load_balancer_attributes(
                 load_balancer_arn: lb.load_balancer_arn,
                 attributes: [
                   {
@@ -374,7 +374,7 @@ module MU
             if @config['classic']
               if @config['connection_draining_timeout'] >= 0
                 MU.log "Setting connection draining timeout to #{@config['connection_draining_timeout']} on #{lb.dns_name}"
-                MU::Cloud::AWS.elb(@config['region']).modify_load_balancer_attributes(
+                MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).modify_load_balancer_attributes(
                     load_balancer_name: @mu_name,
                     load_balancer_attributes: {
                         connection_draining: {
@@ -385,7 +385,7 @@ module MU
                 )
               else
                 MU.log "Disabling connection draining on #{lb.dns_name}"
-                MU::Cloud::AWS.elb(@config['region']).modify_load_balancer_attributes(
+                MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).modify_load_balancer_attributes(
                     load_balancer_name: @mu_name,
                     load_balancer_attributes: {
                         connection_draining: {
@@ -403,7 +403,7 @@ module MU
                 MU.log "Disabling connection draining on #{lb.dns_name}"
               end
               @targetgroups.each_pair { |tg_name, tg|
-                MU::Cloud::AWS.elb2(@config['region']).modify_target_group_attributes(
+                MU::Cloud::AWS.elb2(region: @config['region'], credentials: @config['credentials']).modify_target_group_attributes(
                   target_group_arn: tg.target_group_arn,
                   attributes: [
                     {
@@ -419,7 +419,7 @@ module MU
           if !@config['access_log'].nil?
             MU.log "Setting access log params for #{lb.dns_name}", details: @config['access_log']
             if @config['classic']
-              MU::Cloud::AWS.elb(@config['region']).modify_load_balancer_attributes(
+              MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).modify_load_balancer_attributes(
                 load_balancer_name: @mu_name,
                 load_balancer_attributes: {
                   access_log: {
@@ -431,7 +431,7 @@ module MU
                 }
               )
             else
-              MU::Cloud::AWS.elb2(@config['region']).modify_load_balancer_attributes(
+              MU::Cloud::AWS.elb2(region: @config['region'], credentials: @config['credentials']).modify_load_balancer_attributes(
                 load_balancer_arn: lb.load_balancer_arn,
                 attributes: [
                   {
@@ -461,7 +461,7 @@ module MU
               if !@config['lb_cookie_stickiness_policy']['timeout'].nil?
                 cookie_policy[:cookie_expiration_period] = @config['lb_cookie_stickiness_policy']['timeout']
               end
-              MU::Cloud::AWS.elb(@config['region']).create_lb_cookie_stickiness_policy(cookie_policy)
+              MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).create_lb_cookie_stickiness_policy(cookie_policy)
               lb_policy_names = Array.new
               lb_policy_names << @config['lb_cookie_stickiness_policy']['name']
               listener_policy = {
@@ -471,12 +471,12 @@ module MU
               lb_options[:listeners].each do |listener|
                 if listener[:protocol].upcase == 'HTTP' or listener[:protocol].upcase == 'HTTPS'
                   listener_policy[:load_balancer_port] = listener[:load_balancer_port]
-                  MU::Cloud::AWS.elb(@config['region']).set_load_balancer_policies_of_listener(listener_policy)
+                  MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).set_load_balancer_policies_of_listener(listener_policy)
                 end
               end
             else
               @targetgroups.each_pair { |tg_name, tg|
-                MU::Cloud::AWS.elb2(@config['region']).modify_target_group_attributes(
+                MU::Cloud::AWS.elb2(region: @config['region'], credentials: @config['credentials']).modify_target_group_attributes(
                   target_group_arn: tg.target_group_arn,
                   attributes: [
                     {
@@ -505,7 +505,7 @@ module MU
                 policy_name: @config['app_cookie_stickiness_policy']['name'],
                 cookie_name: @config['app_cookie_stickiness_policy']['cookie']
               }
-              MU::Cloud::AWS.elb(@config['region']).create_app_cookie_stickiness_policy(cookie_policy)
+              MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).create_app_cookie_stickiness_policy(cookie_policy)
               lb_policy_names = Array.new
               lb_policy_names << @config['app_cookie_stickiness_policy']['name']
               listener_policy = {
@@ -515,7 +515,7 @@ module MU
               lb_options[:listeners].each do |listener|
                 if listener[:protocol].upcase == 'HTTP' or listener[:protocol].upcase == 'HTTPS'
                   listener_policy[:load_balancer_port] = listener[:load_balancer_port]
-                  MU::Cloud::AWS.elb(@config['region']).set_load_balancer_policies_of_listener(listener_policy)
+                  MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).set_load_balancer_policies_of_listener(listener_policy)
                 end
               end
             else
@@ -549,7 +549,7 @@ module MU
         # @return [String]
         def arn
           if @config['classic']
-            "arn:"+(MU::Cloud::AWS.isGovCloud?(@config["region"]) ? "aws-us-gov" : "aws")+":elasticloadbalancing:"+@config['region']+":"+MU.account_number+":loadbalancer/"+@cloud_id
+            "arn:"+(MU::Cloud::AWS.isGovCloud?(@config["region"]) ? "aws-us-gov" : "aws")+":elasticloadbalancing:"+@config['region']+":"+MU::Cloud::AWS.credToAcct(@config['credentials'])+":loadbalancer/"+@cloud_id
           else
             cloud_desc.load_balancer_arn
           end
@@ -558,12 +558,12 @@ module MU
         # Wrapper for cloud_desc method that deals with elb vs. elb2 resources.
         def cloud_desc
           if @config['classic']
-            resp = MU::Cloud::AWS.elb(@config['region']).describe_load_balancers(
+            resp = MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).describe_load_balancers(
               load_balancer_names: [@cloud_id]
             ).load_balancer_descriptions.first
             return resp
           else
-            resp = MU::Cloud::AWS.elb2(@config['region']).describe_load_balancers(
+            resp = MU::Cloud::AWS.elb2(region: @config['region'], credentials: @config['credentials']).describe_load_balancers(
               names: [@cloud_id]
             ).load_balancers.first
             if @targetgroups.nil? and !@deploy.nil? and
@@ -571,7 +571,7 @@ module MU
                 @deploy.deployment['loadbalancers'][@config['name']].has_key?("targetgroups")
               @targetgroups = {}
               @deploy.deployment['loadbalancers'][@config['name']]["targetgroups"].each_pair { |tg_name, tg_arn|
-                @targetgroups[tg_name] = MU::Cloud::AWS.elb2(@config['region']).describe_target_groups(target_group_arns: [tg_arn]).target_groups.first
+                @targetgroups[tg_name] = MU::Cloud::AWS.elb2(region: @config['region'], credentials: @config['credentials']).describe_target_groups(target_group_arns: [tg_arn]).target_groups.first
               }
             end
 
@@ -600,7 +600,7 @@ module MU
         # @param targetgroups [Array<String>] The target group(s) of which this node should be made a member. Not applicable to classic LoadBalancers. If not supplied, the node will be registered to all available target groups on this LoadBalancer.
         def registerNode(instance_id, targetgroups: nil)
           if @config['classic'] or !@config.has_key?("classic")
-            MU::Cloud::AWS.elb(@config['region']).register_instances_with_load_balancer(
+            MU::Cloud::AWS.elb(region: @config['region'], credentials: @config['credentials']).register_instances_with_load_balancer(
               load_balancer_name: @cloud_id,
               instances: [
                 {instance_id: instance_id}
@@ -615,7 +615,7 @@ module MU
               targetgroups = @targetgroups.keys
             end
             targetgroups.each { |tg|
-              MU::Cloud::AWS.elb2(@config['region']).register_targets(
+              MU::Cloud::AWS.elb2(region: @config['region'], credentials: @config['credentials']).register_targets(
                 target_group_arn: @targetgroups[tg].target_group_arn,
                 targets: [
                   {id: instance_id}
@@ -625,12 +625,19 @@ module MU
           end
         end
 
+        # Does this resource type exist as a global (cloud-wide) artifact, or
+        # is it localized to a region/zone?
+        # @return [Boolean]
+        def self.isGlobal?
+          false
+        end
+
         # Remove all load balancers associated with the currently loaded deployment.
         # @param noop [Boolean]: If true, will only print what would be done
         # @param ignoremaster [Boolean]: If true, will remove resources not flagged as originating from this Mu server
         # @param region [String]: The cloud provider region
         # @return [void]
-        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, flags: {})
+        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
           raise MuError, "Can't touch ELBs without MU-ID" if MU.deploy_id.nil? or MU.deploy_id.empty?
 
           # Check for tags matching the current deploy identifier on an elb or 
@@ -639,14 +646,14 @@ module MU
           # @param region [String]: The cloud provider region
           # @param ignoremaster [Boolean]: Whether to ignore the MU-MASTER-IP tag
           # @param classic [Boolean]: Whether to look for a classic ELB instead of an ALB (ELB2)
-          def self.checkForTagMatch(arn, region, ignoremaster, classic = false)
+          def self.checkForTagMatch(arn, region, ignoremaster, credentials, classic = false)
             tags = []
             if classic
-              tags = MU::Cloud::AWS.elb(region).describe_tags(
+              tags = MU::Cloud::AWS.elb(credentials: credentials, region: region).describe_tags(
                 load_balancer_names: [arn]
               ).tag_descriptions.first.tags
             else
-              tags = MU::Cloud::AWS.elb2(region).describe_tags(
+              tags = MU::Cloud::AWS.elb2(credentials: credentials, region: region).describe_tags(
                 resource_arns: [arn]
               ).tag_descriptions.first.tags
             end
@@ -669,8 +676,8 @@ module MU
           end
 
 
-          resp = MU::Cloud::AWS.elb(region).describe_load_balancers
-          resp2 = MU::Cloud::AWS.elb2(region).describe_load_balancers
+          resp = MU::Cloud::AWS.elb(credentials: credentials, region: region).describe_load_balancers
+          resp2 = MU::Cloud::AWS.elb2(credentials: credentials, region: region).describe_load_balancers
           (resp.load_balancer_descriptions + resp2.load_balancers).each { |lb|
             classic = true
             if lb.class.name != "Aws::ElasticLoadBalancing::Types::LoadBalancerDescription" and !lb.type.nil? and lb.type == "application"
@@ -680,9 +687,9 @@ module MU
               tags = []
               matched = false
               if classic
-                matched = self.checkForTagMatch(lb.load_balancer_name, region, ignoremaster, classic)
+                matched = self.checkForTagMatch(lb.load_balancer_name, region, ignoremaster, credentials, classic)
               else
-                matched = self.checkForTagMatch(lb.load_balancer_arn, region, ignoremaster, classic)
+                matched = self.checkForTagMatch(lb.load_balancer_arn, region, ignoremaster, credentials, classic)
               end
               if matched
                 if !MU::Cloud::AWS.isGovCloud?
@@ -690,35 +697,35 @@ module MU
                 end
                 MU.log "Removing Elastic Load Balancer #{lb.load_balancer_name}"
                 if classic
-                  MU::Cloud::AWS.elb(region).delete_load_balancer(load_balancer_name: lb.load_balancer_name) if !noop
+                  MU::Cloud::AWS.elb(credentials: credentials, region: region).delete_load_balancer(load_balancer_name: lb.load_balancer_name) if !noop
                 else
-                  MU::Cloud::AWS.elb2(region).describe_listeners(
+                  MU::Cloud::AWS.elb2(credentials: credentials, region: region).describe_listeners(
                     load_balancer_arn: lb.load_balancer_arn
                   ).listeners.each { |l|
                     MU.log "Removing ALB Listener #{l.listener_arn}"
-                    MU::Cloud::AWS.elb2(region).delete_listener(
+                    MU::Cloud::AWS.elb2(credentials: credentials, region: region).delete_listener(
                       listener_arn: l.listener_arn
                     ) if !noop
                   }
-                  tgs = MU::Cloud::AWS.elb2(region).describe_target_groups.target_groups
+                  tgs = MU::Cloud::AWS.elb2(credentials: credentials, region: region).describe_target_groups.target_groups
                   begin
                     if lb.state.code == "provisioning"
                       MU.log "Waiting for ALB #{lb.load_balancer_name} to leave 'provisioning' state", MU::NOTICE
                       sleep 45
-                      lb = MU::Cloud::AWS.elb2(region).describe_load_balancers(
+                      lb = MU::Cloud::AWS.elb2(credentials: credentials, region: region).describe_load_balancers(
                         load_balancer_arns: [lb.load_balancer_arn]
                       ).load_balancers.first
                     end
                   end while lb.state.code == "provisioning"
-                  MU::Cloud::AWS.elb2(region).delete_load_balancer(load_balancer_arn: lb.load_balancer_arn) if !noop
+                  MU::Cloud::AWS.elb2(credentials: credentials, region: region).delete_load_balancer(load_balancer_arn: lb.load_balancer_arn) if !noop
 
 
                   tgs.each { |tg|
-                    if self.checkForTagMatch(tg.target_group_arn, region, ignoremaster)
+                    if self.checkForTagMatch(tg.target_group_arn, region, ignoremaster, credentials)
                       MU.log "Removing Load Balancer Target Group #{tg.target_group_name}"
                       retries = 0
                       begin
-                        MU::Cloud::AWS.elb2(region).delete_target_group(target_group_arn: tg.target_group_arn) if !noop
+                        MU::Cloud::AWS.elb2(credentials: credentials, region: region).delete_target_group(target_group_arn: tg.target_group_arn) if !noop
                       rescue Aws::ElasticLoadBalancingV2::Errors::ResourceInUse => e
                         if retries < 6
                           retries = retries + 1
@@ -833,7 +840,7 @@ module MU
         # @param tag_value [String]: The value of the tag specified by tag_key to match when searching by tag.
         # @param flags [Hash]: Optional flags
         # @return [Array<Hash<String,OpenStruct>>]: The cloud provider's complete descriptions of matching LoadBalancers
-        def self.find(cloud_id: nil, region: MU.curRegion, tag_key: "Name", tag_value: nil, flags: {})
+        def self.find(cloud_id: nil, region: MU.curRegion, tag_key: "Name", tag_value: nil, credentials: nil, flags: {})
           classic = flags['classic'] ? true : false
 
           matches = {}
@@ -841,9 +848,9 @@ module MU
           arn2name = {}
           resp = nil
           if classic
-            resp = MU::Cloud::AWS.elb(region).describe_load_balancers().load_balancer_descriptions
+            resp = MU::Cloud::AWS.elb(region: region, credentials: credentials).describe_load_balancers().load_balancer_descriptions
           else
-            resp = MU::Cloud::AWS.elb2(region).describe_load_balancers().load_balancers
+            resp = MU::Cloud::AWS.elb2(region: region, credentials: credentials).describe_load_balancers().load_balancers
           end
 
           resp.each { |lb|
@@ -859,11 +866,11 @@ module MU
           if !tag_key.nil? and !tag_value.nil? and !tag_key.empty? and list.size > 0
             tag_descriptions = nil
             if classic
-              tag_descriptions = MU::Cloud::AWS.elb(region).describe_tags(
+              tag_descriptions = MU::Cloud::AWS.elb(region: region, credentials: credentials).describe_tags(
                 load_balancer_names: list.keys
               ).tag_descriptions
             else
-              tag_descriptions = MU::Cloud::AWS.elb2(region).describe_tags(
+              tag_descriptions = MU::Cloud::AWS.elb2(region: region, credentials: credentials).describe_tags(
                 resource_arns: list.values.map { |l| l.load_balancer_arn }
               ).tag_descriptions
             end