cloud-mu 2.1.0beta → 3.0.0beta

data/modules/mu/clouds/aws/folder.rb

@@ -17,18 +17,11 @@ module MU
     class AWS
       # A log as configured in {MU::Config::BasketofKittens::logs}
       class Folder < MU::Cloud::Folder
-        @deploy = nil
-        @config = nil
-        attr_reader :mu_name
-        attr_reader :config
-        attr_reader :cloud_id
 
-        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
-        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::logs}
-        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
-          @deploy = mommacat
-          @config = MU::Config.manxify(kitten_cfg)
-          @cloud_id ||= cloud_id
+        # Initialize this cloud resource object. Calling +super+ will invoke the initializer defined under {MU::Cloud}, which should set the attribtues listed in {MU::Cloud::PUBLIC_ATTRS} as well as applicable dependency shortcuts, like +@vpc+, for us.
+        # @param args [Hash]: Hash of named arguments passed via Ruby's double-splat
+        def initialize(**args)
+          super
           @mu_name ||= @deploy.getResourceName(@config["name"])
         end
 

data/modules/mu/clouds/aws/function.rb

@@ -17,21 +17,11 @@ module MU
     class AWS
       # A function as configured in {MU::Config::BasketofKittens::functions}
       class Function < MU::Cloud::Function
-        @deploy = nil
-        @config = nil
-        attr_reader :mu_name
-        attr_reader :config
-        attr_reader :cloud_id
-
-        @cloudformation_data = {}
-        attr_reader :cloudformation_data
-
-        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
-        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::functions}
-        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
-          @deploy = mommacat
-          @config = MU::Config.manxify(kitten_cfg)
-          @cloud_id ||= cloud_id
+
+        # Initialize this cloud resource object. Calling +super+ will invoke the initializer defined under {MU::Cloud}, which should set the attribtues listed in {MU::Cloud::PUBLIC_ATTRS} as well as applicable dependency shortcuts, like +@vpc+, for us.
+        # @param args [Hash]: Hash of named arguments passed via Ruby's double-splat
+        def initialize(**args)
+          super
           @mu_name ||= @deploy.getResourceName(@config["name"])
         end
 
@@ -245,7 +235,7 @@ module MU
                 }
               ]
             })
-          when 'apigateway'
+#          when 'apigateway'
 # XXX this is actually happening in ::Endpoint... maybe...            
 #            MU.log "Creation of API Gateway integrations not yet implemented, you'll have to do this manually", MU::WARN, details: "(because we'll basically have to implement all of APIG for this)"
           end 

data/modules/mu/clouds/aws/group.rb

@@ -17,19 +17,11 @@ module MU
     class AWS
       # A group as configured in {MU::Config::BasketofKittens::groups}
       class Group < MU::Cloud::Group
-        @deploy = nil
-        @config = nil
-        attr_reader :mu_name
-        attr_reader :config
-        attr_reader :cloud_id
-
-        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
-        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::groups}
-        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
-          @deploy = mommacat
-          @config = MU::Config.manxify(kitten_cfg)
-          @cloud_id ||= cloud_id
 
+        # Initialize this cloud resource object. Calling +super+ will invoke the initializer defined under {MU::Cloud}, which should set the attribtues listed in {MU::Cloud::PUBLIC_ATTRS} as well as applicable dependency shortcuts, like +@vpc+, for us.
+        # @param args [Hash]: Hash of named arguments passed via Ruby's double-splat
+        def initialize(**args)
+          super
           @mu_name ||= if @config['unique_name']
             @deploy.getResourceName(@config["name"])
           else

data/modules/mu/clouds/aws/habitat.rb

@@ -17,19 +17,11 @@ module MU
     class AWS
       # Creates an AWS account as configured in {MU::Config::BasketofKittens::habitats}
       class Habitat < MU::Cloud::Habitat
-        @deploy = nil
-        @config = nil
-
-        attr_reader :mu_name
-        attr_reader :config
-        attr_reader :cloud_id
-
-        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
-        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::habitats}
-        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
-          @deploy = mommacat
-          @config = MU::Config.manxify(kitten_cfg)
-          @cloud_id ||= cloud_id
+
+        # Initialize this cloud resource object. Calling +super+ will invoke the initializer defined under {MU::Cloud}, which should set the attribtues listed in {MU::Cloud::PUBLIC_ATTRS} as well as applicable dependency shortcuts, like +@vpc+, for us.
+        # @param args [Hash]: Hash of named arguments passed via Ruby's double-splat
+        def initialize(**args)
+          super
           @mu_name ||= @deploy.getResourceName(@config["name"], max_length: 63)
         end
 
@@ -137,6 +129,12 @@ module MU
           [toplevel_required, schema]
         end
 
+        # @param account_number [String]
+        # @return [Boolean]
+        def self.isLive?(account_number, credentials = nil)
+          true
+        end
+
         # Figure out what account we're calling from, and then figure out if
         # it's the organization's master account- the only place from which
         # we can create accounts, amongst other things.

data/modules/mu/clouds/aws/loadbalancer.rb

@@ -18,30 +18,15 @@ module MU
       # A load balancer as configured in {MU::Config::BasketofKittens::loadbalancers}
       class LoadBalancer < MU::Cloud::LoadBalancer
 
-        @deploy = nil
         @lb = nil
-        attr_reader :mu_name
-        attr_reader :config
-        attr_reader :cloud_id
         attr_reader :targetgroups
 
-        @cloudformation_data = {}
-        attr_reader :cloudformation_data
-
-        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
-        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::loadbalancers}
-        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
-          @deploy = mommacat
-          @config = MU::Config.manxify(kitten_cfg)
-          @cloud_id ||= cloud_id
-          if !mu_name.nil?
-            @mu_name = mu_name
-          elsif @config['scrub_mu_isms']
-            @mu_name = @config['name']
-          else
-            @mu_name = @deploy.getResourceName(@config["name"], max_length: 32, need_unique_string: true)
-            @mu_name.gsub!(/[^\-a-z0-9]/i, "-") # AWS ELB naming rules
-          end
+        # Initialize this cloud resource object. Calling +super+ will invoke the initializer defined under {MU::Cloud}, which should set the attribtues listed in {MU::Cloud::PUBLIC_ATTRS} as well as applicable dependency shortcuts, like +@vpc+, for us.
+        # @param args [Hash]: Hash of named arguments passed via Ruby's double-splat
+        def initialize(**args)
+          super
+          @mu_name ||= @deploy.getResourceName(@config["name"], max_length: 32, need_unique_string: true)
+          @mu_name.gsub!(/[^\-a-z0-9]/i, "-") # AWS ELB naming rules
         end
 
         # Called automatically by {MU::Deploy#createResources}
@@ -208,8 +193,12 @@ module MU
                   :name => tg_name,
                   :protocol => tg['proto'],
                   :vpc_id => @vpc.cloud_id,
-                  :port => tg['port']
+                  :port => tg['port'],
+                  :target_type  => 'instance'
                 }
+                if tg['target_type'] && tg['target_type'] != 'instance'
+                  tg_descriptor[:target_type] = tg['target_type']
+                end
                 if tg['httpcode']
                   tg_descriptor[:matcher] = {
                     :http_code => tg['httpcode']
@@ -644,7 +633,9 @@ module MU
         # @param region [String]: The cloud provider region
         # @return [void]
         def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
-          raise MuError, "Can't touch ELBs without MU-ID" if MU.deploy_id.nil? or MU.deploy_id.empty?
+          if (MU.deploy_id.nil? or MU.deploy_id.empty?) and (!flags or !flags["vpc_id"])
+            raise MuError, "Can't touch ELBs without MU-ID or vpc_id flag"
+          end
 
           # Check for tags matching the current deploy identifier on an elb or 
           # elb2 resource.
@@ -692,19 +683,36 @@ module MU
             begin
               tags = []
               matched = false
-              if classic
-                matched = self.checkForTagMatch(lb.load_balancer_name, region, ignoremaster, credentials, classic)
+              if flags and flags['vpc_id']
+                matched = true if lb.vpc_id == flags['vpc_id']
               else
-                matched = self.checkForTagMatch(lb.load_balancer_arn, region, ignoremaster, credentials, classic)
+                if classic
+                  matched = self.checkForTagMatch(lb.load_balancer_name, region, ignoremaster, credentials, classic)
+                else
+                  matched = self.checkForTagMatch(lb.load_balancer_arn, region, ignoremaster, credentials, classic)
+                end
               end
               if matched
                 if !MU::Cloud::AWS.isGovCloud?
                   MU::Cloud::AWS::DNSZone.genericMuDNSEntry(name: lb.load_balancer_name, target: lb.dns_name, cloudclass: MU::Cloud::LoadBalancer, delete: true) if !noop
                 end
-                MU.log "Removing Elastic Load Balancer #{lb.load_balancer_name}"
                 if classic
-                  MU::Cloud::AWS.elb(credentials: credentials, region: region).delete_load_balancer(load_balancer_name: lb.load_balancer_name) if !noop
+                  MU.log "Removing Elastic Load Balancer #{lb.load_balancer_name}"
+                  if !noop
+                    MU::Cloud::AWS.elb(credentials: credentials, region: region).delete_load_balancer(load_balancer_name: lb.load_balancer_name)
+                    stillhere = true
+                    begin
+                      ext_check = MU::Cloud::AWS.elb(credentials: credentials, region: region).describe_load_balancers(load_balancer_names: [lb.load_balancer_name])
+                      if !ext_check or
+                         !ext_check.load_balancer_descriptions or
+                         !ext_check.load_balancer_descriptions[0]
+                        sleep 3
+                      else stillhere = false
+                      end
+                    end while stillhere
+                  end
                 else
+                  MU.log "Removing Application Load Balancer #{lb.load_balancer_name}"
                   MU::Cloud::AWS.elb2(credentials: credentials, region: region).describe_listeners(
                     load_balancer_arn: lb.load_balancer_arn
                   ).listeners.each { |l|
@@ -765,6 +773,10 @@ module MU
                   "proto" => {
                     "type" => "string",
                     "enum" => ["HTTP", "HTTPS", "TCP", "SSL"],
+                  },
+                  "target_type " => {
+                    "type" => "string",
+                    "enum" => ["instance", "ip", "lambda"],
                   }
                 }
               }

data/modules/mu/clouds/aws/log.rb

@@ -17,19 +17,11 @@ module MU
     class AWS
       # A logging facility as configured in {MU::Config::BasketofKittens::logs}
       class Log < MU::Cloud::Log
-        @deploy = nil
-        @config = nil
-
-        attr_reader :mu_name
-        attr_reader :config
-        attr_reader :cloud_id
-
-        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
-        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::logs}
-        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
-          @deploy = mommacat
-          @config = MU::Config.manxify(kitten_cfg)
-          @cloud_id ||= cloud_id
+
+        # Initialize this cloud resource object. Calling +super+ will invoke the initializer defined under {MU::Cloud}, which should set the attribtues listed in {MU::Cloud::PUBLIC_ATTRS} as well as applicable dependency shortcuts, like +@vpc+, for us.
+        # @param args [Hash]: Hash of named arguments passed via Ruby's double-splat
+        def initialize(**args)
+          super
           @mu_name ||= @deploy.getResourceName(@config["name"])
         end
 

data/modules/mu/clouds/aws/msg_queue.rb

@@ -17,27 +17,12 @@ module MU
     class AWS
       # A MsgQueue as configured in {MU::Config::BasketofKittens::msg_queues}
       class MsgQueue < MU::Cloud::MsgQueue
-        @deploy = nil
-        @config = nil
-        attr_reader :mu_name
-        attr_reader :config
-        attr_reader :cloud_id
-
-        @cloudformation_data = {}
-        attr_reader :cloudformation_data
-
-        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
-        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::msg_queues}
-        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
-          @deploy = mommacat
-          @config = MU::Config.manxify(kitten_cfg)
-          @cloud_id ||= cloud_id
-          if mu_name
-            @mu_name = mu_name
-            cloud_desc if !@cloud_id
-          else
-            @mu_name ||= @deploy.getResourceName(@config["name"])
-          end
+
+        # Initialize this cloud resource object. Calling +super+ will invoke the initializer defined under {MU::Cloud}, which should set the attribtues listed in {MU::Cloud::PUBLIC_ATTRS} as well as applicable dependency shortcuts, like +@vpc+, for us.
+        # @param args [Hash]: Hash of named arguments passed via Ruby's double-splat
+        def initialize(**args)
+          super
+          @mu_name ||= @deploy.getResourceName(@config["name"])
         end
 
         # Called automatically by {MU::Deploy#createResources}
@@ -62,9 +47,9 @@ module MU
           tagQueue
 
           cur_attrs = notify
-          if cur_attrs["Policy"]
-            MU.log "FECK", MU::WARN, details: JSON.parse(cur_attrs["Policy"]).to_yaml
-          end
+#          if cur_attrs["Policy"]
+#            MU.log "FECK", MU::WARN, details: JSON.parse(cur_attrs["Policy"]).to_yaml
+#          end
           new_attrs = genQueueAttrs
 
           changed = false

data/modules/mu/clouds/aws/nosqldb.rb

@@ -17,22 +17,14 @@ module MU
     class AWS
       # Support for AWS DynamoDB
       class NoSQLDB < MU::Cloud::NoSQLDB
-        @deploy = nil
-        @config = nil
 
         @@region_cache = {}
         @@region_cache_semaphore = Mutex.new
 
-        attr_reader :mu_name
-        attr_reader :config
-        attr_reader :cloud_id
-
-        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
-        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::logs}
-        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
-          @deploy = mommacat
-          @config = MU::Config.manxify(kitten_cfg)
-          @cloud_id ||= cloud_id
+        # Initialize this cloud resource object. Calling +super+ will invoke the initializer defined under {MU::Cloud}, which should set the attribtues listed in {MU::Cloud::PUBLIC_ATTRS} as well as applicable dependency shortcuts, like +@vpc+, for us.
+        # @param args [Hash]: Hash of named arguments passed via Ruby's double-splat
+        def initialize(**args)
+          super
           @mu_name ||= @deploy.getResourceName(@config["name"])
         end
 

data/modules/mu/clouds/aws/notifier.rb

@@ -17,19 +17,11 @@ module MU
     class AWS
       # Support for AWS SNS
       class Notifier < MU::Cloud::Notifier
-        @deploy = nil
-        @config = nil
-
-        attr_reader :mu_name
-        attr_reader :config
-        attr_reader :cloud_id
-
-        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
-        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::logs}
-        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
-          @deploy = mommacat
-          @config = MU::Config.manxify(kitten_cfg)
-          @cloud_id ||= cloud_id
+
+        # Initialize this cloud resource object. Calling +super+ will invoke the initializer defined under {MU::Cloud}, which should set the attribtues listed in {MU::Cloud::PUBLIC_ATTRS} as well as applicable dependency shortcuts, like +@vpc+, for us.
+        # @param args [Hash]: Hash of named arguments passed via Ruby's double-splat
+        def initialize(**args)
+          super
           @mu_name ||= @deploy.getResourceName(@config["name"])
         end
 
@@ -87,6 +79,7 @@ module MU
         # Canonical Amazon Resource Number for this resource
         # @return [String]
         def arn
+          @cloud_id ||= @mu_name
           "arn:"+(MU::Cloud::AWS.isGovCloud?(@config["region"]) ? "aws-us-gov" : "aws")+":sns:"+@config['region']+":"+MU::Cloud::AWS.credToAcct(@config['credentials'])+":"+@cloud_id
         end
 

data/modules/mu/clouds/aws/role.rb

@@ -17,20 +17,11 @@ module MU
     class AWS
       # A user as configured in {MU::Config::BasketofKittens::roles}
       class Role < MU::Cloud::Role
-        @deploy = nil
-        @config = nil
-        attr_reader :mu_name
-        attr_reader :config
-        attr_reader :cloud_id
-
-        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
-        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::roles}
-        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
-          @deploy = mommacat
-          @config = MU::Config.manxify(kitten_cfg)
-          @cloud_id ||= cloud_id
-          @mu_name = mu_name
-          @cloud_id ||= @mu_name # should be the same
+
+        # Initialize this cloud resource object. Calling +super+ will invoke the initializer defined under {MU::Cloud}, which should set the attribtues listed in {MU::Cloud::PUBLIC_ATTRS} as well as applicable dependency shortcuts, like +@vpc+, for us.
+        # @param args [Hash]: Hash of named arguments passed via Ruby's double-splat
+        def initialize(**args)
+          super
           @mu_name ||= @deploy.getResourceName(@config["name"])
         end
 
@@ -132,8 +123,17 @@ module MU
                     version_id: desc.policy.default_version_id
                   )
 
-                  if version.policy_version.document != URI.encode(JSON.generate(policy.values.first), /[^a-z0-9\-]/i)
-                    MU.log "Updating IAM policy #{policy_name}", MU::NOTICE, details: policy.values.first
+                  if version.policy_version.document != URI.encode_www_form(JSON.generate(policy.values.first), /[^a-z0-9\-]/i)
+                    # Special exception- we don't want to overwrite extra rules
+                    # in MuSecrets policies, because our siblings might have 
+                    # (will have) injected those and they should stay.
+                    if policy.size == 1 and policy["MuSecrets"]
+                      ext = JSON.parse(URI.decode_www_form(version.policy_version.document))
+                      if (ext["Statement"][0]["Resource"] & policy["MuSecrets"]["Statement"][0]["Resource"]).sort == policy["MuSecrets"]["Statement"][0]["Resource"].sort
+                        next
+                      end
+                    end
+                    MU.log "Updating IAM policy #{policy_name}", MU::NOTICE, details: policy
                     update_policy(arn, policy.values.first)
                     MU::Cloud::AWS.iam(credentials: @config['credentials']).get_policy(policy_arn: arn)
                   else
@@ -271,40 +271,55 @@ module MU
             policy_arn: policy_arn
           )
           attachments.policy_users.each { |u|
-            MU::Cloud::AWS.iam(credentials: credentials).detach_user_policy(
-              user_name: u.user_name,
-              policy_arn: policy_arn
-            )
+            begin
+              MU::Cloud::AWS.iam(credentials: credentials).detach_user_policy(
+                user_name: u.user_name,
+                policy_arn: policy_arn
+              )
+            rescue ::Aws::IAM::Errors::NoSuchEntity
+            end
           }
           attachments.policy_groups.each { |g|
-            MU::Cloud::AWS.iam(credentials: credentials).detach_group_policy(
-              group_name: g.group_name,
-              policy_arn: policy_arn
-            )
+            begin
+              MU::Cloud::AWS.iam(credentials: credentials).detach_group_policy(
+                group_name: g.group_name,
+                policy_arn: policy_arn
+              )
+            rescue ::Aws::IAM::Errors::NoSuchEntity
+            end
           }
           attachments.policy_roles.each { |r|
-            MU::Cloud::AWS.iam(credentials: credentials).detach_role_policy(
-              role_name: r.role_name,
-              policy_arn: policy_arn
-            )
+            begin
+              MU::Cloud::AWS.iam(credentials: credentials).detach_role_policy(
+                role_name: r.role_name,
+                policy_arn: policy_arn
+              )
+            rescue ::Aws::IAM::Errors::NoSuchEntity
+            end
           }
           versions = MU::Cloud::AWS.iam(credentials: credentials).list_policy_versions(
             policy_arn: policy_arn,
           ).versions
           versions.each { |v|
             next if v.is_default_version
-            MU::Cloud::AWS.iam(credentials: credentials).delete_policy_version(
-              policy_arn: policy_arn,
-              version_id: v.version_id
-            )
+            begin
+              MU::Cloud::AWS.iam(credentials: credentials).delete_policy_version(
+                policy_arn: policy_arn,
+                version_id: v.version_id
+              )
+            rescue ::Aws::IAM::Errors::NoSuchEntity
+            end
           }
 
           # Delete the policy, unless it's one of the global canned ones owned
           # by AWS
           if !policy_arn.match(/^arn:aws:iam::aws:/)
-            MU::Cloud::AWS.iam(credentials: credentials).delete_policy(
-              policy_arn: policy_arn
-            )
+            begin
+              MU::Cloud::AWS.iam(credentials: credentials).delete_policy(
+                policy_arn: policy_arn
+              )
+            rescue ::Aws::IAM::Errors::NoSuchEntity
+            end
           end
         end
 
@@ -340,11 +355,25 @@ module MU
             }
           end
 
+          deleteme = []
           resp = MU::Cloud::AWS.iam(credentials: credentials).list_roles(
             path_prefix: "/"+MU.deploy_id+"/"
           )
-          if resp and resp.roles
-            resp.roles.each { |r|
+          deleteme.concat(resp.roles) if resp and resp.roles
+          if flags and flags["known"]
+            resp = MU::Cloud::AWS.iam(credentials: credentials).list_roles(
+              max_items: 1000
+            )
+            if resp and resp.roles
+              resp.roles.each { |r|
+                deleteme << r if flags["known"].include?(r.role_name)
+              }
+            end
+            deleteme.uniq!
+          end
+
+          if deleteme.size > 0
+            deleteme.each { |r|
               MU.log "Deleting IAM role #{r.role_name}"
               if !noop
                 # purgePolicy won't touch roles we don't own, so gently detach
@@ -444,7 +473,7 @@ module MU
                   path_prefix: "/"+@deploy.deploy_id+"/",
                   user_name: entityname
                 )
-                if !resp or !resp.attached_policies.map { |p| p.policy_name }.include?(p.policy_name)
+                if !resp or !resp.attached_policies.map { |a_p| a_p.policy_name }.include?(p.policy_name)
                   MU.log "Attaching IAM policy #{p.policy_name} to user #{entityname}", MU::NOTICE
                   MU::Cloud::AWS.iam(credentials: @config['credentials']).attach_user_policy(
                     policy_arn: p.arn,
@@ -456,7 +485,7 @@ module MU
                   path_prefix: "/"+@deploy.deploy_id+"/",
                   group_name: entityname
                 )
-                if !resp or !resp.attached_policies.map { |p| p.policy_name }.include?(p.policy_name)
+                if !resp or !resp.attached_policies.map { |a_p| a_p.policy_name }.include?(p.policy_name)
                   MU.log "Attaching policy #{p.policy_name} to group #{entityname}", MU::NOTICE
                   MU::Cloud::AWS.iam(credentials: @config['credentials']).attach_group_policy(
                     policy_arn: p.arn,
@@ -468,7 +497,7 @@ module MU
                   role_name: entityname
                 )
 
-                if !resp or !resp.attached_policies.map { |p| p.policy_name }.include?(p.policy_name)
+                if !resp or !resp.attached_policies.map { |a_p| a_p.policy_name }.include?(p.policy_name)
                   MU.log "Attaching policy #{p.policy_name} to role #{entityname}", MU::NOTICE
                   MU::Cloud::AWS.iam(credentials: @config['credentials']).attach_role_policy(
                     policy_arn: p.arn,