cloud-mu 1.9.0.pre.beta → 2.0.0.pre.alpha

data/modules/mu/clouds/aws/role.rb

@@ -39,7 +39,7 @@ module MU
             @config['iam_policies'].each { |policy|
               policy_name = @mu_name+"-"+policy.keys.first.upcase
               MU.log "Creating IAM policy #{policy_name}"
-              resp = MU::Cloud::AWS.iam.create_policy(
+              resp = MU::Cloud::AWS.iam(credentials: @config['credentials']).create_policy(
                 policy_name: policy_name,
                 path: "/"+@deploy.deploy_id+"/",
                 policy_document: JSON.generate(policy.values.first),
@@ -50,7 +50,7 @@ module MU
 
           if !@config['bare_policies']
             MU.log "Creating IAM role #{@mu_name}"
-            resp = MU::Cloud::AWS.iam.create_role(
+            resp = MU::Cloud::AWS.iam(credentials: @config['credentials']).create_role(
               path: "/"+@deploy.deploy_id+"/",
               role_name: @mu_name,
               description: "Generated by Mu",
@@ -62,14 +62,13 @@ module MU
 
         # Called automatically by {MU::Deploy#createResources}
         def groom
-
           if @config['policies']
             @config['iam_policies'] ||= []
             @config['iam_policies'].concat(convert_policies_to_iam)
           end
 
           if !@config['bare_policies']
-            resp = MU::Cloud::AWS.iam.get_role(
+            resp = MU::Cloud::AWS.iam(credentials: @config['credentials']).get_role(
               role_name: @mu_name
             ).role
             ext_tags = resp.tags.map { |t| t.to_h }
@@ -78,64 +77,74 @@ module MU
 
             if tag_param.size > 0
               MU.log "Updating tags on IAM role #{@mu_name}", MU::NOTICE, details: tag_param
-              MU::Cloud::AWS.iam.tag_role(role_name: @mu_name, tags: tag_param)
+              MU::Cloud::AWS.iam(credentials: @config['credentials']).tag_role(role_name: @mu_name, tags: tag_param)
             end
           end
 
-          if @config['iam_policies']
+
+          if @config['iam_policies'] or @config['import']
             attached_policies = []
-            configured_policies = @config['iam_policies'].map { |p|
-              @mu_name+"-"+p.keys.first.upcase
-            }
+            configured_policies = []
+
+            if @config['iam_policies']
+              configured_policies = @config['iam_policies'].map { |p|
+                @mu_name+"-"+p.keys.first.upcase
+              }
+            end
+
             if @config['import']
+              MU.log "Attaching canned #{@config['import'].size > 1 ? "policies" : "policy"} #{@config['import'].join(", ")} to role #{@mu_name}", MU::NOTICE, details: @config['credentials']
               configured_policies.concat(@config['import'].map { |p| p.gsub(/.*?\/([^:\/]+)$/, '\1') })
             end
 
             if !@config['bare_policies']
-              attached_policies = MU::Cloud::AWS.iam.list_attached_role_policies(
+              attached_policies = MU::Cloud::AWS.iam(credentials: @config['credentials']).list_attached_role_policies(
                 role_name: @mu_name
               ).attached_policies
               attached_policies.each { |a|
                 if !configured_policies.include?(a.policy_name)
                   MU.log "Removing IAM policy #{a.policy_name} from role #{@mu_name}", MU::NOTICE
-                  MU::Cloud::AWS::Role.purgePolicy(a.policy_arn)
+                  MU::Cloud::AWS::Role.purgePolicy(a.policy_arn, @config['credentials'])
                 end
               }
             end
 
-            @config['iam_policies'].each { |policy|
-              policy_name = @mu_name+"-"+policy.keys.first.upcase
+            if @config['iam_policies']
+              @config['iam_policies'].each { |policy|
+                policy_name = @mu_name+"-"+policy.keys.first.upcase
 
-              arn = "arn:"+(MU::Cloud::AWS.isGovCloud? ? "aws-us-gov" : "aws")+":iam::"+MU.account_number+":policy/#{@deploy.deploy_id}/#{policy_name}"
-              resp = begin
-                desc = MU::Cloud::AWS.iam.get_policy(policy_arn: arn)
+                arn = "arn:"+(MU::Cloud::AWS.isGovCloud? ? "aws-us-gov" : "aws")+":iam::"+MU::Cloud::AWS.credToAcct(@config['credentials'])+":policy/#{@deploy.deploy_id}/#{policy_name}"
+                resp = begin
+                  desc = MU::Cloud::AWS.iam(credentials: @config['credentials']).get_policy(policy_arn: arn)
 
-                version = MU::Cloud::AWS.iam.get_policy_version(
-                  policy_arn: arn,
-                  version_id: desc.policy.default_version_id
-                )
-                if version.policy_version.document != URI.encode(JSON.generate(policy.values.first), /[^a-z0-9\-]/i)
-                  MU.log "Updating IAM policy #{policy_name}", MU::NOTICE, details: policy.values.first
-                  update_policy(arn, policy.values.first)
-                  MU::Cloud::AWS.iam.get_policy(policy_arn: arn)
-                else
-                  desc
-                end
+                  version = MU::Cloud::AWS.iam(credentials: @config['credentials']).get_policy_version(
+                    policy_arn: arn,
+                    version_id: desc.policy.default_version_id
+                  )
+                  if version.policy_version.document != URI.encode(JSON.generate(policy.values.first), /[^a-z0-9\-]/i)
+                    MU.log "Updating IAM policy #{policy_name}", MU::NOTICE, details: policy.values.first
+                    update_policy(arn, policy.values.first)
+                    MU::Cloud::AWS.iam(credentials: @config['credentials']).get_policy(policy_arn: arn)
+                  else
+                    desc
+                  end
 
-              rescue Aws::IAM::Errors::NoSuchEntity => e
-                MU.log "Creating IAM policy #{policy_name}", details: policy.values.first
-                MU::Cloud::AWS.iam.create_policy(
-                  policy_name: policy_name,
-                  path: "/"+@deploy.deploy_id+"/",
-                  policy_document: JSON.generate(policy.values.first),
-                  description: "Generated from inline policy document for Mu role #{@mu_name}"
-                )
-              end
+                rescue Aws::IAM::Errors::NoSuchEntity => e
+                  MU.log "Creating IAM policy #{policy_name}", details: policy.values.first
+                  MU::Cloud::AWS.iam(credentials: @config['credentials']).create_policy(
+                    policy_name: policy_name,
+                    path: "/"+@deploy.deploy_id+"/",
+                    policy_document: JSON.generate(policy.values.first),
+                    description: "Generated from inline policy document for Mu role #{@mu_name}"
+                  )
+                end
 
-            }
+              }
+            end
           end
 
-          if !@config['bare_policies'] and @config['iam_policies']
+          if !@config['bare_policies'] and
+             (@config['iam_policies'] or @config['import'])
             bindTo("role", @mu_name)
           end
         end
@@ -158,22 +167,22 @@ module MU
         def cloud_desc
           desc = {}
           if @config['bare_policies']
-            desc["policies"] = MU::Cloud::AWS.iam.list_policies(
+            desc["policies"] = MU::Cloud::AWS.iam(credentials: @config['credentials']).list_policies(
               path_prefix: "/"+MU.deploy_id+"/"
             ).policies
             desc["policies"].reject! { |p|
               !p.policy_name.match(/^#{Regexp.quote(@mu_name)}-/)
             }
           else
-            desc["role"] = MU::Cloud::AWS.iam.get_role(
+            desc["role"] = MU::Cloud::AWS.iam(credentials: @config['credentials']).get_role(
               role_name: @mu_name
             ).role
             if @config['iam_policies']
               desc["policies"] = []
-              MU::Cloud::AWS.iam.list_attached_role_policies(
+              MU::Cloud::AWS.iam(credentials: @config['credentials']).list_attached_role_policies(
                 role_name: @mu_name
               ).attached_policies.each { |p|
-                desc["policies"] << MU::Cloud::AWS.iam.get_policy(
+                desc["policies"] << MU::Cloud::AWS.iam(credentials: @config['credentials']).get_policy(
                   policy_arn: p.policy_arn
                 ).policy
               }
@@ -201,7 +210,7 @@ module MU
           my_policies = cloud_desc["policies"]
           my_policies.each { |p|
             if p.policy_name == policy
-              old = MU::Cloud::AWS.iam.get_policy_version(
+              old = MU::Cloud::AWS.iam(credentials: @config['credentials']).get_policy_version(
                 policy_arn: p.arn,
                 version_id: p.default_version_id
               ).policy_version
@@ -209,9 +218,17 @@ module MU
               need_update = false
               doc["Statement"].each { |s|
                 targets.each { |target|
-# XXX resolve mu_type targets to ARNs
-                  if !s["Resource"].include?(target)
-                    s["Resource"] << target
+                  targetstr = if target['type']
+                    sibling = @deploy.findLitterMate(
+                      name: target["identifier"],
+                      type: target["type"]
+                    )
+                    sibling.cloudobj.arn
+                  else
+                    target['identifier']
+                  end
+                  if sibling and !s["Resource"].include?(targetstr)
+                    s["Resource"] << targetstr
                     need_update = true
                   end
                 }
@@ -226,34 +243,34 @@ module MU
 
         # Delete an IAM policy, along with attendant versions and attachments.
         # @param policy_arn [String]: The ARN of the policy to purge
-        def self.purgePolicy(policy_arn)
-          attachments = MU::Cloud::AWS.iam.list_entities_for_policy(
+        def self.purgePolicy(policy_arn, credentials)
+          attachments = MU::Cloud::AWS.iam(credentials: credentials).list_entities_for_policy(
             policy_arn: policy_arn
           )
           attachments.policy_users.each { |u|
-            MU::Cloud::AWS.iam.detach_user_policy(
+            MU::Cloud::AWS.iam(credentials: credentials).detach_user_policy(
               user_name: u.user_name,
               policy_arn: policy_arn
             )
           }
           attachments.policy_groups.each { |g|
-            MU::Cloud::AWS.iam.detach_group_policy(
+            MU::Cloud::AWS.iam(credentials: credentials).detach_group_policy(
               group_name: g.group_name,
               policy_arn: policy_arn
             )
           }
           attachments.policy_roles.each { |r|
-            MU::Cloud::AWS.iam.detach_role_policy(
+            MU::Cloud::AWS.iam(credentials: credentials).detach_role_policy(
               role_name: r.role_name,
               policy_arn: policy_arn
             )
           }
-          versions = MU::Cloud::AWS.iam.list_policy_versions(
+          versions = MU::Cloud::AWS.iam(credentials: credentials).list_policy_versions(
             policy_arn: policy_arn,
           ).versions
           versions.each { |v|
             next if v.is_default_version
-            MU::Cloud::AWS.iam.delete_policy_version(
+            MU::Cloud::AWS.iam(credentials: credentials).delete_policy_version(
               policy_arn: policy_arn,
               version_id: v.version_id
             )
@@ -262,51 +279,69 @@ module MU
           # Delete the policy, unless it's one of the global canned ones owned
           # by AWS
           if !policy_arn.match(/^arn:aws:iam::aws:/)
-            MU::Cloud::AWS.iam.delete_policy(
+            MU::Cloud::AWS.iam(credentials: credentials).delete_policy(
               policy_arn: policy_arn
             )
           end
         end
 
+        # Does this resource type exist as a global (cloud-wide) artifact, or
+        # is it localized to a region/zone?
+        # @return [Boolean]
+        def self.isGlobal?
+          true
+        end
+
         # Remove all roles associated with the currently loaded deployment.
         # @param noop [Boolean]: If true, will only print what would be done
         # @param ignoremaster [Boolean]: If true, will remove resources not flagged as originating from this Mu server
         # @param region [String]: The cloud provider region
         # @return [void]
-        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, flags: {})
+        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
 
-          resp = MU::Cloud::AWS.iam.list_policies(
+          resp = MU::Cloud::AWS.iam(credentials: credentials).list_policies(
             path_prefix: "/"+MU.deploy_id+"/"
           )
           if resp and resp.policies
             resp.policies.each { |policy|
               MU.log "Deleting IAM policy /#{MU.deploy_id}/#{policy.policy_name}"
               if !noop
-                purgePolicy(policy.arn)
+                purgePolicy(policy.arn, credentials)
               end
             }
           end
 
-          resp = MU::Cloud::AWS.iam.list_roles(
+          resp = MU::Cloud::AWS.iam(credentials: credentials).list_roles(
             path_prefix: "/"+MU.deploy_id+"/"
           )
           if resp and resp.roles
             resp.roles.each { |r|
               MU.log "Deleting IAM role #{r.role_name}"
               if !noop
+                # purgePolicy won't touch roles we don't own, so gently detach
+                # those first
+                detachables = MU::Cloud::AWS.iam(credentials: credentials).list_attached_role_policies(
+                  role_name: r.role_name
+                ).attached_policies
+                detachables.each { |rp|
+                  MU::Cloud::AWS.iam(credentials: credentials).detach_role_policy(
+                    role_name: r.role_name,
+                    policy_arn: rp.policy_arn
+                  )
+                }
 
                 begin
-                  MU::Cloud::AWS.iam.remove_role_from_instance_profile(
+                  MU::Cloud::AWS.iam(credentials: credentials).remove_role_from_instance_profile(
                     instance_profile_name: r.role_name,
                     role_name: r.role_name
                   )
-                  MU::Cloud::AWS.iam.delete_instance_profile(instance_profile_name: r.role_name)
+                  MU::Cloud::AWS.iam(credentials: credentials).delete_instance_profile(instance_profile_name: r.role_name)
                 rescue Aws::IAM::Errors::ValidationError => e
                   MU.log "Cleaning up IAM role #{r.role_name}: #{e.inspect}", MU::WARN
                 rescue Aws::IAM::Errors::NoSuchEntity => e
                 end
 
-                MU::Cloud::AWS.iam.delete_role(
+                MU::Cloud::AWS.iam(credentials: credentials).delete_role(
                   role_name: r.role_name
                 )
               end
@@ -320,7 +355,7 @@ module MU
         # @param region [String]: The cloud provider region.
         # @param flags [Hash]: Optional flags
         # @return [OpenStruct]: The cloud provider's complete descriptions of matching user group.
-        def self.find(cloud_id: nil, region: MU.curRegion, flags: {})
+        def self.find(cloud_id: nil, region: MU.curRegion, credentials: nil, flags: {})
           found = nil
 
           found
@@ -331,13 +366,22 @@ module MU
         def bindTo(entitytype, entityname)
           if entitytype == "instance_profile"
             begin
-              MU::Cloud::AWS.iam.add_role_to_instance_profile(
-                instance_profile_name: entityname,
-                role_name: @mu_name
-              )
+              resp = MU::Cloud::AWS.iam(credentials: @config['credentials']).get_instance_profile(
+                instance_profile_name: entityname
+              ).instance_profile
+
+              if !resp.roles.map { |r| r.role_name}.include?(@mu_name)
+                MU::Cloud::AWS.iam(credentials: @config['credentials']).add_role_to_instance_profile(
+                  instance_profile_name: entityname,
+                  role_name: @mu_name
+                )
+              end
+            rescue Exception => e
+              MU.log "Error binding role #{@mu_name} to instance profile #{entityname}: #{e.message}", MU::ERR
+              raise e
             end
           elsif ["user", "group", "role"].include?(entitytype)
-            mypolicies = MU::Cloud::AWS.iam.list_policies(
+            mypolicies = MU::Cloud::AWS.iam(credentials: @config['credentials']).list_policies(
               path_prefix: "/"+@deploy.deploy_id+"/"
             ).policies
             mypolicies.reject! { |p|
@@ -347,47 +391,57 @@ module MU
             if @config['import']
               @config['import'].each { |policy|
                 if !policy.match(/^arn:/i)
-                  policy = "arn:"+(MU::Cloud::AWS.isGovCloud?(@config["region"]) ? "aws-us-gov" : "aws")+":iam::aws:policy/"+policy
+                  p_arn = "arn:"+(MU::Cloud::AWS.isGovCloud?(@config["region"]) ? "aws-us-gov" : "aws")+":iam::aws:policy/"+policy
+                end
+                retried = false
+                begin
+                  mypolicies << MU::Cloud::AWS.iam(credentials: @config['credentials']).get_policy(
+                    policy_arn: p_arn
+                  ).policy
+                rescue Aws::IAM::Errors::NoSuchEntity => e
+                  if !retried
+                    p_arn = "arn:"+(MU::Cloud::AWS.isGovCloud?(@config["region"]) ? "aws-us-gov" : "aws")+":iam::aws:policy/service-role/"+policy
+                    retried = true
+                    retry
+                  end
+                  raise e
                 end
-                mypolicies << MU::Cloud::AWS.iam.get_policy(
-                  policy_arn: policy
-                ).policy
               }
             end
 
             mypolicies.each { |p|
               if entitytype == "user"
-                resp = MU::Cloud::AWS.iam.list_attached_user_policies(
+                resp = MU::Cloud::AWS.iam(credentials: @config['credentials']).list_attached_user_policies(
                   path_prefix: "/"+@deploy.deploy_id+"/",
                   user_name: entityname
                 )
                 if !resp or !resp.attached_policies.map { |p| p.policy_name }.include?(p.policy_name)
                   MU.log "Attaching IAM policy #{p.policy_name} to user #{entityname}", MU::NOTICE
-                  MU::Cloud::AWS.iam.attach_user_policy(
+                  MU::Cloud::AWS.iam(credentials: @config['credentials']).attach_user_policy(
                     policy_arn: p.arn,
                     user_name: entityname
                   )
                 end
               elsif entitytype == "group"
-                resp = MU::Cloud::AWS.iam.list_attached_group_policies(
+                resp = MU::Cloud::AWS.iam(credentials: @config['credentials']).list_attached_group_policies(
                   path_prefix: "/"+@deploy.deploy_id+"/",
                   group_name: entityname
                 )
                 if !resp or !resp.attached_policies.map { |p| p.policy_name }.include?(p.policy_name)
                   MU.log "Attaching policy #{p.policy_name} to group #{entityname}", MU::NOTICE
-                  MU::Cloud::AWS.iam.attach_group_policy(
+                  MU::Cloud::AWS.iam(credentials: @config['credentials']).attach_group_policy(
                     policy_arn: p.arn,
                     group_name: entityname
                   )
                 end
               elsif entitytype == "role"
-                resp = MU::Cloud::AWS.iam.list_attached_role_policies(
+                resp = MU::Cloud::AWS.iam(credentials: @config['credentials']).list_attached_role_policies(
                   role_name: entityname
                 )
 
                 if !resp or !resp.attached_policies.map { |p| p.policy_name }.include?(p.policy_name)
                   MU.log "Attaching policy #{p.policy_name} to role #{entityname}", MU::NOTICE
-                  MU::Cloud::AWS.iam.attach_role_policy(
+                  MU::Cloud::AWS.iam(credentials: @config['credentials']).attach_role_policy(
                     policy_arn: p.arn,
                     role_name: entityname
                   )
@@ -407,18 +461,19 @@ module MU
           end
 
           resp = begin
-            MU::Cloud::AWS.iam.create_instance_profile(
+            MU.log "Creating instance profile #{@mu_name} #{@config['credentials']}"
+            MU::Cloud::AWS.iam(credentials: @config['credentials']).create_instance_profile(
               instance_profile_name: @mu_name
             )
           rescue Aws::IAM::Errors::EntityAlreadyExists => e
-            MU::Cloud::AWS.iam.get_instance_profile(
+            MU::Cloud::AWS.iam(credentials: @config['credentials']).get_instance_profile(
               instance_profile_name: @mu_name
             )
           end
 
           # make sure it's really there before moving on
           begin
-            MU::Cloud::AWS.iam.get_instance_profile(instance_profile_name: @mu_name)
+            MU::Cloud::AWS.iam(credentials: @config['credentials']).get_instance_profile(instance_profile_name: @mu_name)
           rescue Aws::IAM::Errors::NoSuchEntity => e
             MU.log e.inspect, MU::WARN
             sleep 10
@@ -469,6 +524,12 @@ module MU
                     "description" => "Type of entity which will be permitted to assume this role. See +entity_id+ for details.",
                     "enum" => ["service", "aws", "federated"]+aws_resource_types
                   },
+                  "assume_method" => {
+                    "type" => "string",
+                    "description" => "https://docs.aws.amazon.com/STS/latest/APIReference/API_Operations.html",
+                    "enum" => ["basic", "saml", "web"],
+                    "default" => "basic"
+                  },
                   "entity_id" => {
                     "type" => "string",
                     "description" => "An identifier appropriate for the +entity_type+ which is allowed to assume this role- see details for valid formats.\n
@@ -501,15 +562,24 @@ module MU
 
           if role['import']
             role['import'].each { |policy|
-              if !policy.match(/^arn:/i)
-                policy = "arn:"+(MU::Cloud::AWS.isGovCloud?(role["region"]) ? "aws-us-gov" : "aws")+":iam::aws:policy/"+policy
+              arn = if !policy.match(/^arn:/i)
+                "arn:"+(MU::Cloud::AWS.isGovCloud?(role["region"]) ? "aws-us-gov" : "aws")+":iam::aws:policy/"+policy
+              else
+                policy
               end
+              retried = false
               begin
-                MU::Cloud::AWS.iam.get_policy(policy_arn: policy)
+                MU::Cloud::AWS.iam(credentials: role['credentials']).get_policy(policy_arn: arn)
               rescue Aws::IAM::Errors::NoSuchEntity => e
-                MU.log "No such canned AWS IAM policy '#{policy}'", MU::ERR
+                if !retried
+                  arn = "arn:"+(MU::Cloud::AWS.isGovCloud?(role["region"]) ? "aws-us-gov" : "aws")+":iam::aws:policy/service-role/"+policy
+                  retried = true
+                  retry
+                end
+                MU.log "No such canned AWS IAM policy '#{arn}'", MU::ERR
                 ok = false
               end
+              policy = arn
             }
           end
 
@@ -524,6 +594,19 @@ module MU
             ok = false
           end
 
+          if role['policies']
+            role['policies'].each { |policy|
+              policy['targets'].each { |target|
+                if target['type']
+                  role['dependencies'] ||= []
+                  role['dependencies'] << {
+                    "name" => target['identifier'],
+                    "type" => target['type']
+                  }
+                end
+              }
+            }
+          end
 
           ok
         end
@@ -540,7 +623,7 @@ module MU
                 "Version" => "2012-10-17",
                 "Statement" => [
                   {
-                    "Sid" => policy["name"],
+                    "Sid" => policy["name"].gsub(/[^0-9A-Za-z]*/, ""),
                     "Effect" => policy['flag'].capitalize,
                     "Action" => [],
                     "Resource" => []
@@ -598,13 +681,18 @@ module MU
           role_policy_doc = {
             "Version" => "2012-10-17",
           }
-# XXX support AssumeRole, AssumeRoleWithSAML, and AssumeRoleWithWebIdentity
+
           statements = []
           if @config['can_assume']
+            act_map = {
+              "basic" => "sts:AssumeRole",
+              "saml" => "sts:AssumeRoleWithSAML",
+              "web" => "sts:AssumeRoleWithWebIdentity"
+            }
             @config['can_assume'].each { |svc|
               statement = {
                 "Effect" => "Allow",
-                "Action" => "sts:AssumeRole",
+                "Action" => act_map[svc['assume_method']],
                 "Principal" => {}
               }
               if ["service", "iam", "federated"].include?(svc["entity_type"])
@@ -632,17 +720,17 @@ module MU
         # Update a policy, handling deletion of old versions as needed
         def update_policy(arn, doc)
           begin
-            MU::Cloud::AWS.iam.create_policy_version(
+            MU::Cloud::AWS.iam(credentials: @config['credentials']).create_policy_version(
               policy_arn: arn,
               set_as_default: true,
               policy_document: JSON.generate(doc)
             )
           rescue Aws::IAM::Errors::LimitExceeded => e
-            delete_version = MU::Cloud::AWS.iam.list_policy_versions(
+            delete_version = MU::Cloud::AWS.iam(credentials: @config['credentials']).list_policy_versions(
               policy_arn: arn,
             ).versions.last.version_id
             MU.log "Purging oldest version (#{delete_version}) of IAM policy #{arn}", MU::NOTICE
-            MU::Cloud::AWS.iam.delete_policy_version(
+            MU::Cloud::AWS.iam(credentials: @config['credentials']).delete_policy_version(
               policy_arn: arn,
               version_id: delete_version
             )