cloud-mu 3.1.2 → 3.2.0

data/modules/mu/{clouds → providers}/aws/dnszone.rb

@@ -344,8 +344,8 @@ module MU
               )
             rescue Aws::Route53::Errors::LastVPCAssociation => e
               MU.log e.inspect, MU::WARN
-            rescue Aws::Route53::Errors::VPCAssociationNotFound => e
-              MU.log "VPC #{vpc_id} access to zone #{id} already revoked", MU::WARN
+            rescue Aws::Route53::Errors::VPCAssociationNotFound
+              MU.log "VPC #{vpc_id} access to zone #{id} already revoked", MU::NOTICE
             end
           end
         end
@@ -366,10 +366,10 @@ module MU
         # @param location [Hash<String>]: A parsed Hash of {MU::Config::BasketofKittens::dnszones::records::geo_location}.
         # @param set_identifier [String]: A unique string to differentiate otherwise-similar records. Normally auto-generated, should not need to specify.
         # @param alias_zone [String]: Zone ID of the target's hosted zone, when creating an alias (type R53ALIAS)
-        def self.manageRecord(id, name, type, targets: nil, aliases: nil,
+        def self.manageRecord(id, name, type, targets: nil,
             ttl: 7200, delete: false, sync_wait: true, failover: nil,
             healthcheck: nil, region: nil, weight: nil, overwrite: true,
-            location: nil, set_identifier: nil, alias_zone: nil)
+            location: nil, set_identifier: nil, alias_zone: nil, noop: false)
 
           MU.setVar("curRegion", region) if !region.nil?
           zone = MU::Cloud::DNSZone.find(cloud_id: id).values.first
@@ -380,6 +380,11 @@ module MU
           action = "UPSERT" if overwrite
           action = "DELETE" if delete
 
+          record_sets = MU::Cloud::AWS.route53.list_resource_record_sets(
+            hosted_zone_id: id,
+            start_record_name: name
+          ).resource_record_sets if delete
+
           if type == "R53ALIAS"
             target_zone = id
             target_name = targets[0].downcase
@@ -413,7 +418,15 @@ module MU
             }
           else
             rrsets = []
-            if !targets.nil?
+            if delete
+              record_sets.each { |r|
+                if r.name == name and r.type == type
+                  rrsets = MU.structToHash(r.resource_records)
+                end
+              }
+            end
+
+            if !targets.nil? and (!delete or rrsets.empty?)
               targets.each { |target|
                 rrsets << {value: target}
               }
@@ -426,6 +439,7 @@ module MU
               resource_records: rrsets
             }
 
+
             if !healthcheck.nil?
               base_rrset[:health_check_id] = healthcheck
             end
@@ -445,12 +459,13 @@ module MU
 
           # Doing an UPSERT with a new set_identifier will fail with a record already exist error, so lets try and get it from an existing record. 
           # This can be an issue with multiple secondary failover records
-          if (location || failover || region || weight) && set_identifier.nil?
-            record_sets = MU::Cloud::AWS.route53.list_resource_record_sets(
+          if (location || failover || region || weight) and set_identifier.nil?
+            record_sets ||= MU::Cloud::AWS.route53.list_resource_record_sets(
               hosted_zone_id: id,
               start_record_name: name
             ).resource_record_sets
 
+          
             record_sets.each { |r|
               if r.name == name
                 if location && location == r.location
@@ -497,18 +512,23 @@ module MU
             MU.log "Adding DNS record #{name} => #{targets} (#{type}) to #{id}", details: params
           end
 
-          begin
+          return if noop
+
+          on_retry = Proc.new { |e|
+            if (delete and e.message.match(/but it was not found/)) or
+               (!delete and e.message.match(/(it|name) already exists/))
+              MU.log e.message, MU::DEBUG, details: params
+              return
+            elsif e.class == Aws::Route53::Errors::InvalidChangeBatch
+              MU.log "Problem managing entry for #{name}", MU::ERR, details: params
+              raise MuError, e.inspect
+            end
+          }
+
+          change_id = nil
+          MU.retrier([Aws::Route53::Errors::PriorRequestNotComplete, Aws::Route53::Errors::InvalidChangeBatch], wait: 15, max: 10, on_retry: on_retry) {
             change_id = MU::Cloud::AWS.route53.change_resource_record_sets(params).change_info.id
-          rescue Aws::Route53::Errors::PriorRequestNotComplete => e
-            sleep 10
-            retry
-          rescue Aws::Route53::Errors::InvalidChangeBatch, Aws::Route53::Errors::InvalidInput, Exception => e
-            return if e.message.match(/ but it already exists/) and !delete
-            MU.log "Failed to change DNS records, #{e.inspect}", MU::ERR, details: params
-            raise e if !delete
-            MU.log "Record #{name} (#{type}) in #{id} can't be deleted. Already removed? #{e.inspect}", MU::WARN, details: params if delete
-            return
-          end
+          }
 
           if sync_wait
             attempts = 0
@@ -535,23 +555,27 @@ module MU
         # @param delete [Boolean]: Remove this entry instead of creating it.
         # @param cloudclass [Object]: The resource's Mu class.
         # @param sync_wait [Boolean]: Wait for DNS entry to propagate across zone.
-        def self.genericMuDNSEntry(name: nil, target: nil, cloudclass: nil, noop: false, delete: false, sync_wait: true)
-          return nil if name.nil? or target.nil? or cloudclass.nil?
-          mu_zone = MU::Cloud::DNSZone.find(cloud_id: "platform-mu").values.first
+        def self.genericMuDNSEntry(name: nil, target: nil, cloudclass: nil, noop: false, delete: false, sync_wait: true, credentials: nil)
+          return nil if name.nil? or cloudclass.nil?
+          return nil if target.nil? and !delete
+          mu_zone = MU::Cloud::DNSZone.find(cloud_id: "platform-mu", credentials: credentials).values.first
           raise MuError, "Couldn't isolate platform-mu DNS zone" if mu_zone.nil?
 
           if !mu_zone.nil? and !MU.myVPC.nil?
             subdomain = cloudclass.cfg_name
             dns_name = name.downcase+"."+subdomain
             dns_name += "."+MU.myInstanceId if MU.myInstanceId
+
             record_type = "CNAME"
             record_type = "A" if target.match(/^\d+\.\d+\.\d+\.\d+/)
             ip = nil
 
-            lookup = MU::Cloud::AWS.route53.list_resource_record_sets(
-                hosted_zone_id: mu_zone.id,
-                start_record_name: "#{dns_name}.platform-mu",
-                start_record_type: record_type
+            records = []
+            lookup = MU::Cloud::AWS.route53(credentials: credentials).list_resource_record_sets(
+              hosted_zone_id: mu_zone.id,
+              start_record_name: "#{dns_name}.platform-mu",
+              start_record_type: record_type,
+              max_items: 1
             ).resource_record_sets
 
             lookup.each { |record|
@@ -572,34 +596,14 @@ module MU
 #						MU.log "'#{dns_name}.platform-mu' does not resolve.", MU::DEBUG, details: e.inspect
 #					end
 
-            if ip == target
-              return "#{dns_name}.platform-mu" if !delete
-            elsif noop
-              return nil
+            if ip == target and !delete
+              return "#{dns_name}.platform-mu"
             end
 
             sync_wait = false if delete
 
             record_type = "R53ALIAS" if cloudclass == MU::Cloud::AWS::LoadBalancer
-            attempts = 0
-            begin
-              MU::Cloud::AWS::DNSZone.manageRecord(mu_zone.id, dns_name, record_type, targets: [target], delete: delete, sync_wait: sync_wait)
-            rescue Aws::Route53::Errors::PriorRequestNotComplete => e
-              MU.log "Route53 was still processing a request, waiting", MU::WARN, details: e
-              sleep 15
-              retry
-            rescue Aws::Route53::Errors::InvalidChangeBatch => e
-              if e.inspect.match(/alias target name does not lie within the target zone/) and attempts < 5
-                MU.log e.inspect, MU::WARN
-                sleep 15
-                attempts = attempts + 1
-                retry
-              elsif !e.inspect.match(/(it|name) already exists/)
-                raise MuError, "Problem managing entry for #{dns_name} -> #{target}: #{e.inspect}"
-              else
-                MU.log "#{dns_name} already exists", MU::DEBUG, details: e.inspect
-              end
-            end
+            MU::Cloud::AWS::DNSZone.manageRecord(mu_zone.id, dns_name, record_type, targets: [target], delete: delete, sync_wait: sync_wait, noop: noop)
             return "#{dns_name}.platform-mu"
           else
             return nil
@@ -663,7 +667,8 @@ module MU
         # Called by {MU::Cleanup}. Locates resources that were created by the
         # currently-loaded deployment, and purges them.
         def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
-          checks_to_clean = []
+          MU.log "AWS::DNSZone.cleanup: need to support flags['known']", MU::DEBUG, details: flags
+
           threads = []
           MU::Cloud::AWS.route53(credentials: credentials).list_health_checks.health_checks.each { |check|
             begin
@@ -692,19 +697,19 @@ module MU
                 threads << Thread.new(check) { |mycheck|
                   MU.dupGlobals(parent_thread_id)
                   Thread.abort_on_exception = true
-                  MU.log "Removing health check #{check.id}"
+                  MU.log "Removing health check #{mycheck.id}"
                   retries = 5
                   begin 
-                    MU::Cloud::AWS.route53(credentials: credentials).delete_health_check(health_check_id: check.id) if !noop
+                    MU::Cloud::AWS.route53(credentials: credentials).delete_health_check(health_mycheck_id: mycheck.id) if !noop
                   rescue Aws::Route53::Errors::NoSuchHealthCheck => e
-                    MU.log "Health Check '#{check.id}' disappeared before I could remove it", MU::WARN, details: e.inspect
+                    MU.log "Health Check '#{mycheck.id}' disappeared before I could remove it", MU::WARN, details: e.inspect
                   rescue Aws::Route53::Errors::InvalidInput => e
                     if e.message.match(/is still referenced from parent health check/) && retries <= 5
                       sleep 5
                       retries += 1
                       retry
                     else
-                      MU.log "Health Check #{check.id} still has a parent health check associated with it, skipping", MU::WARN, details: e.inspect
+                      MU.log "Health Check #{mycheck.id} still has a parent health check associated with it, skipping", MU::WARN, details: e.inspect
                     end
                   end
                 }
@@ -719,7 +724,7 @@ module MU
           }
 
           zones = MU::Cloud::DNSZone.find(deploy_id: MU.deploy_id, region: region)
-          zones.each_pair { |id, zone|
+          zones.values.each { |zone|
             MU.log "Purging DNS Zone '#{zone.name}' (#{zone.id})"
             if !noop
               begin
@@ -727,7 +732,6 @@ module MU
                 rrsets = MU::Cloud::AWS.route53(credentials: credentials).list_resource_record_sets(hosted_zone_id: zone.id)
                 rrsets.resource_record_sets.each { |rrset|
                   next if zone.name == rrset.name and (rrset.type == "NS" or rrset.type == "SOA")
-                  records = []
                   MU::Cloud::AWS.route53(credentials: credentials).change_resource_record_sets(
                       hosted_zone_id: zone.id,
                       change_batch: {
@@ -791,9 +795,9 @@ module MU
         end
 
         # Cloud-specific configuration properties.
-        # @param config [MU::Config]: The calling MU::Config object
+        # @param _config [MU::Config]: The calling MU::Config object
         # @return [Array<Array,Hash>]: List of required fields, and json-schema Hash of cloud-specific configuration parameters for this resource
-        def self.schema(config)
+        def self.schema(_config)
           toplevel_required = []
           schema = {}
           [toplevel_required, schema]
@@ -801,9 +805,9 @@ module MU
 
         # Cloud-specific pre-processing of {MU::Config::BasketofKittens::dnszones}, bare and unvalidated.
         # @param zone [Hash]: The resource to process and validate
-        # @param configurator [MU::Config]: The overall deployment configurator of which this resource is a member
+        # @param _configurator [MU::Config]: The overall deployment configurator of which this resource is a member
         # @return [Boolean]: True if validation succeeded, False otherwise
-        def self.validateConfig(zone, configurator)
+        def self.validateConfig(zone, _configurator)
           ok = true
 
           if !zone["records"].nil?
@@ -821,10 +825,7 @@ module MU
               end
   
               if !record['mu_type'].nil?
-                zone["dependencies"] << {
-                  "type" => record['mu_type'],
-                  "name" => record['target']
-                }
+                MU::Config.addDependency(zone, record['target'], record['mu_type'])
               end
   
               if record.has_key?('healthchecks') && !record['healthchecks'].empty?

data/modules/mu/{clouds → providers}/aws/endpoint.rb

@@ -116,15 +116,15 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @config['credentials
             end
 
             if m['integrate_with']
-              role_arn = if m['iam_role']
-                if m['iam_role'].match(/^arn:/)
-                  m['iam_role']
-                else
-                  sib_role = @deploy.findLitterMate(name: m['iam_role'], type: "roles")
-                  sib_role.cloudobj.arn
+#              role_arn = if m['iam_role']
+#                if m['iam_role'].match(/^arn:/)
+#                  m['iam_role']
+#                else
+#                  sib_role = @deploy.findLitterMate(name: m['iam_role'], type: "roles")
+#                  sib_role.cloudobj.arn
 # XXX make this more like get_role_arn in Function, or just use Role.find?
-                end
-              end
+#                end
+#              end
 
               function_obj = nil
 
@@ -198,13 +198,12 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @config['credentials
           generate_methods
 
           MU.log "Deploying API Gateway #{@config['name']} to #{@config['deploy_to']}"
-          resp = MU::Cloud::AWS.apig(region: @config['region'], credentials: @config['credentials']).create_deployment(
+          MU::Cloud::AWS.apig(region: @config['region'], credentials: @config['credentials']).create_deployment(
             rest_api_id: @cloud_id,
             stage_name: @config['deploy_to']
 #            cache_cluster_enabled: false,
 #            cache_cluster_size: 0.5,
           )
-          deployment_id = resp.id
           # this automatically creates a stage with the same name, so we don't
           # have to deal with that
 
@@ -220,11 +219,14 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @config['credentials
  
         end
 
+        @cloud_desc_cache = nil
         # @return [Struct]
-        def cloud_desc
-          MU::Cloud::AWS.apig(region: @config['region'], credentials: @config['credentials']).get_rest_api(
+        def cloud_desc(use_cache: true)
+          return @cloud_desc_cache if @cloud_desc_cache and use_cache
+          @cloud_desc_cache = MU::Cloud::AWS.apig(region: @config['region'], credentials: @config['credentials']).get_rest_api(
             rest_api_id: @cloud_id
           )
+          @cloud_desc_cache
         end
 
         # Return the metadata for this API
@@ -241,6 +243,9 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @config['credentials
         # @param region [String]: The cloud provider region
         # @return [void]
         def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
+          MU.log "AWS::Endpoint.cleanup: need to support flags['known']", MU::DEBUG, details: flags
+          MU.log "Placeholder: AWS Endpoint artifacts do not support tags, so ignoremaster cleanup flag has no effect", MU::DEBUG, details: ignoremaster
+
           resp = MU::Cloud::AWS.apig(region: region, credentials: credentials).get_rest_apis
           if resp and resp.items
             resp.items.each { |api|
@@ -279,9 +284,9 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @config['credentials
         end
 
         # Cloud-specific configuration properties.
-        # @param config [MU::Config]: The calling MU::Config object
+        # @param _config [MU::Config]: The calling MU::Config object
         # @return [Array<Array,Hash>]: List of required fields, and json-schema Hash of cloud-specific configuration parameters for this resource
-        def self.schema(config)
+        def self.schema(_config)
           toplevel_required = []
           schema = {
             "deploy_to" => {
@@ -467,11 +472,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @config['credentials
           endpoint['methods'].each { |m|
             if m['integrate_with'] and m['integrate_with']['name']
               if m['integrate_with']['type'] != "aws_generic"
-                endpoint['dependencies'] ||= []
-                endpoint['dependencies'] << {
-                  "type" => m['integrate_with']['type'],
-                  "name" => m['integrate_with']['name']
-                }
+                MU::Config.addDependency(endpoint, m['integrate_with']['name'], m['integrate_with']['type'])
               end
 
               m['integrate_with']['backend_http_method'] ||= m['type']
@@ -520,13 +521,8 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @config['credentials
                 end
                 configurator.insertKitten(roledesc, "roles")
 
-                endpoint['dependencies'] ||= []
                 m['iam_role'] = endpoint['name']+"-"+m['integrate_with']['name']
-
-                endpoint['dependencies'] << {
-                  "type" => "role",
-                  "name" => endpoint['name']+"-"+m['integrate_with']['name']
-                }
+                MU::Config.addDependency(endpoint, m['iam_role'], "role")
               end
             end
           }
@@ -538,8 +534,6 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @config['credentials
           ok
         end
 
-        private
-
         def self.cors_option_integrations(path)
           {
             "type" => "OPTIONS",
@@ -585,6 +579,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @config['credentials
             }
           }
         end
+        private_class_method :cors_option_integrations
 
       end
     end

data/modules/mu/{clouds → providers}/aws/firewall_rule.rb

@@ -18,7 +18,7 @@ module MU
     class AWS
       # A firewall ruleset as configured in {MU::Config::BasketofKittens::firewall_rules}
       class FirewallRule < MU::Cloud::FirewallRule
-        require "mu/clouds/aws/vpc"
+        require "mu/providers/aws/vpc"
 
         @admin_sgs = Hash.new
         @admin_sg_semaphore = Mutex.new
@@ -54,13 +54,12 @@ module MU
 
             secgroup = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_security_group(sg_struct)
             @cloud_id = secgroup.group_id
-          rescue Aws::EC2::Errors::InvalidGroupDuplicate => e
+          rescue Aws::EC2::Errors::InvalidGroupDuplicate
             MU.log "EC2 Security Group #{groupname} already exists, using it", MU::NOTICE
             filters = [{name: "group-name", values: [groupname]}]
             filters << {name: "vpc-id", values: [vpc_id]} if !vpc_id.nil?
 
             secgroup = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_security_groups(filters: filters).security_groups.first
-            deploy_id = @deploy.deploy_id if !@deploy_id.nil?
             if secgroup.nil?
               raise MuError, "Failed to locate security group named #{groupname}, even though EC2 says it already exists", caller
             end
@@ -69,24 +68,24 @@ module MU
 
           begin
             MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_security_groups(group_ids: [secgroup.group_id])
-          rescue Aws::EC2::Errors::InvalidGroupNotFound => e
+          rescue Aws::EC2::Errors::InvalidGroupNotFound
             MU.log "#{secgroup.group_id} not yet ready, waiting...", MU::NOTICE
             sleep 10
             retry
           end
 
           MU::Cloud::AWS.createStandardTags(secgroup.group_id, region: @config['region'], credentials: @config['credentials'])
-          MU::MommaCat.createTag(secgroup.group_id, "Name", groupname, region: @config['region'], credentials: @config['credentials'])
+          MU::Cloud::AWS.createTag(secgroup.group_id, "Name", groupname, region: @config['region'], credentials: @config['credentials'])
 
           if @config['optional_tags']
             MU::MommaCat.listOptionalTags.each { |key, value|
-              MU::MommaCat.createTag(secgroup.group_id, key, value, region: @config['region'], credentials: @config['credentials'])
+              MU::Cloud::AWS.createTag(secgroup.group_id, key, value, region: @config['region'], credentials: @config['credentials'])
             }
           end
 
           if @config['tags']
             @config['tags'].each { |tag|
-              MU::MommaCat.createTag(secgroup.group_id, tag['key'], tag['value'], region: @config['region'], credentials: @config['credentials'])
+              MU::Cloud::AWS.createTag(secgroup.group_id, tag['key'], tag['value'], region: @config['region'], credentials: @config['credentials'])
             }
           end
 
@@ -180,7 +179,7 @@ module MU
                 ip_permissions: ec2_rule
               )
             end
-          rescue Aws::EC2::Errors::InvalidPermissionDuplicate => e
+          rescue Aws::EC2::Errors::InvalidPermissionDuplicate
             MU.log "Attempt to add duplicate rule to #{@cloud_id}", MU::DEBUG, details: ec2_rule
             # Ensure that, at least, the description field gets updated on
             # existing rules
@@ -246,7 +245,7 @@ module MU
         # Reverse-map our cloud description into a runnable config hash.
         # We assume that any values we have in +@config+ are placeholders, and
         # calculate our own accordingly based on what's live in the cloud.
-        def toKitten(rootparent: nil, billing: nil, habitats: nil)
+        def toKitten(**_args)
           bok = {
             "cloud" => "AWS",
             "credentials" => @config['credentials'],
@@ -383,9 +382,8 @@ module MU
         # @param region [String]: The cloud provider region
         # @return [void]
         def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
-          filters = nil
-          if flags and flags["vpc_id"]
-            filters = [
+          filters = if flags and flags["vpc_id"]
+            [
               {name: "vpc-id", values: [flags["vpc_id"]]}
             ]
           else
@@ -395,11 +393,12 @@ module MU
             if !ignoremaster
               filters << {name: "tag:MU-MASTER-IP", values: [MU.mu_public_ip]}
             end
+            filters
           end
 
           # Some services create sneaky rogue ENIs which then block removal of
           # associated security groups. Find them and fry them.
-          MU::Cloud::AWS::VPC.purge_interfaces(noop, filters, region: region, credentials: credentials)
+          MU::Cloud.resourceClass("AWS", "VPC").purge_interfaces(noop, filters, region: region, credentials: credentials)
 
           resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_security_groups(
             filters: filters
@@ -409,75 +408,8 @@ module MU
             MU.log "Revoking rules in EC2 Security Group #{sg.group_name} (#{sg.group_id})"
 
             if !noop
-              ingress_to_revoke = Array.new
-              egress_to_revoke = Array.new
-              sg.ip_permissions.each { |hole|
-                ingress_to_revoke << MU.structToHash(hole)
-                ingress_to_revoke.each { |rule|
-                  if !rule[:user_id_group_pairs].nil? and rule[:user_id_group_pairs] .size == 0
-                    rule.delete(:user_id_group_pairs)
-                  elsif !rule[:user_id_group_pairs].nil?
-                    rule[:user_id_group_pairs].each { |group_ref|
-                      group_ref = MU.structToHash(group_ref)
-                      group_ref.delete(:group_name) if group_ref[:group_id]
-                    }
-                  end
-
-                  if !rule[:ip_ranges].nil? and rule[:ip_ranges].size == 0
-                    rule.delete(:ip_ranges)
-                  end
-
-                  if !rule[:prefix_list_ids].nil? and rule[:prefix_list_ids].size == 0
-                    rule.delete(:prefix_list_ids)
-                  end
-                  
-                  if !rule[:ipv_6_ranges].nil? and rule[:ipv_6_ranges].size == 0
-                    rule.delete(:ipv_6_ranges)
-                  end
-                }
-              }
-              sg.ip_permissions_egress.each { |hole|
-                egress_to_revoke << MU.structToHash(hole)
-                egress_to_revoke.each { |rule|
-                  if !rule[:user_id_group_pairs].nil? and rule[:user_id_group_pairs].size == 0
-                    rule.delete(:user_id_group_pairs)
-                  elsif !rule[:user_id_group_pairs].nil?
-                    rule[:user_id_group_pairs].each { |group_ref|
-                      group_ref = MU.structToHash(group_ref)
-                      group_ref.delete(:group_name) if group_ref[:group_id]
-                    }
-                  end
-
-                  if !rule[:ip_ranges].nil? and rule[:ip_ranges].size == 0
-                    rule.delete(:ip_ranges)
-                  end
-
-                  if !rule[:prefix_list_ids].nil? and rule[:prefix_list_ids].size == 0
-                    rule.delete(:prefix_list_ids)
-                  end
-
-                  if !rule[:ipv_6_ranges].nil? and rule[:ipv_6_ranges].size == 0
-                    rule.delete(:ipv_6_ranges)
-                  end
-                }
-              }
-              begin
-
-                if ingress_to_revoke.size > 0
-                  MU::Cloud::AWS.ec2(credentials: credentials, region: region).revoke_security_group_ingress(
-                      group_id: sg.group_id,
-                      ip_permissions: ingress_to_revoke
-                  )
-                end
-                if egress_to_revoke.size > 0
-                  MU::Cloud::AWS.ec2(credentials: credentials, region: region).revoke_security_group_egress(
-                      group_id: sg.group_id,
-                      ip_permissions: egress_to_revoke
-                  )
-                end
-              rescue Aws::EC2::Errors::InvalidPermissionNotFound
-                MU.log "Rule in #{sg.group_id} disappeared before I could remove it", MU::WARN
-              end
+              revoke_rules(sg, region: region, credentials: credentials)
+              revoke_rules(sg, egress: true, region: region, credentials: credentials)
             end
           }
 
@@ -485,61 +417,132 @@ module MU
             next if sg.group_name == "default"
             MU.log "Removing EC2 Security Group #{sg.group_name}"
 
-            retries = 0
-            begin
-              MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_security_group(group_id: sg.group_id) if !noop
-            rescue Aws::EC2::Errors::CannotDelete => e
-              MU.log e.message, MU::WARN
-            rescue Aws::EC2::Errors::InvalidGroupNotFound
-              MU.log "EC2 Security Group #{sg.group_name} disappeared before I could delete it!", MU::WARN
-            rescue Aws::EC2::Errors::DependencyViolation, Aws::EC2::Errors::InvalidGroupInUse
-              if retries < 10
-                MU.log "EC2 Security Group #{sg.group_name} is still in use, waiting...", MU::NOTICE
-                # try to get out from under loose network interfaces with which
-                # we're associated
-                if sg.vpc_id
-                  # get the default SG for this VPC
-                  default_resp = MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_security_groups(
-                    filters: [
-                      { name: "group-name", values: ["default"] },
-                      { name: "vpc-id", values: [sg.vpc_id] }
-                    ]
-                  ).security_groups
-                  if default_resp and default_resp.size == 1
-                    default_sg = default_resp.first.group_id
-                    eni_resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_network_interfaces(
-                      filters: [ {name: "group-id", values: [sg.group_id]} ]
-                    )
-                    if eni_resp and eni_resp.data and
-                       eni_resp.data.network_interfaces
-                      eni_resp.data.network_interfaces.each { |iface|
-                        iface_groups = iface.groups.map { |sg| sg.group_id }
-                        iface_groups.delete(sg.group_id)
-                        iface_groups << default_sg if iface_groups.empty?
-                        MU.log "Attempting to remove #{sg.group_id} from ENI #{iface.network_interface_id}"
+            on_retry = Proc.new {
+              # try to get out from under loose network interfaces with which
+              # we're associated
+              if sg.vpc_id
+                default_sg = MU::Cloud.resourceClass("AWS", "VPC").getDefaultSg(sg.vpc_id, region: region, credentials: credentials)
+                if default_sg
+                  eni_resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_network_interfaces(
+                    filters: [ {name: "group-id", values: [sg.group_id]} ]
+                  )
+                  if eni_resp and eni_resp.data and
+                     eni_resp.data.network_interfaces
+                    eni_resp.data.network_interfaces.each { |iface|
+                      iface_groups = iface.groups.map { |if_sg| if_sg.group_id }
+                      iface_groups.delete(sg.group_id)
+                      iface_groups << default_sg if iface_groups.empty?
+                      MU.log "Attempting to remove #{sg.group_id} (#{sg.group_name}) from ENI #{iface.network_interface_id}"
+                      begin
                         MU::Cloud::AWS.ec2(credentials: credentials, region: region).modify_network_interface_attribute(
                           network_interface_id: iface.network_interface_id,
                           groups: iface_groups
                         )
-                      }
-                    end
+                      rescue ::Aws::EC2::Errors::InvalidNetworkInterfaceIDNotFound
+                        # fine by me
+                      rescue ::Aws::EC2::Errors::AuthFailure
+                        MU.log "Permission denied attempting to trim Security Group list for #{iface.network_interface_id}", MU::WARN, details: iface.groups.map { |g| g.group_name }.join(",")+" => default"
+                      end
+                    }
                   end
                 end
+              end
+            }
 
-                sleep 10
-                retries = retries + 1
-                retry
+            if !noop
+              MU.retrier([Aws::EC2::Errors::DependencyViolation, Aws::EC2::Errors::InvalidGroupInUse], ignoreme: [Aws::EC2::Errors::InvalidGroupNotFound], max: 10, wait: 10, on_retry: on_retry) {
+                begin
+                  MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_security_group(group_id: sg.group_id)
+                rescue Aws::EC2::Errors::CannotDelete => e
+                  MU.log e.message, MU::WARN
+                end
+              }
+            end
+
+          }
+        end
+
+        def self.revoke_rules(sg, egress: false, region: MU.myregion, credentials: nil)
+          holes = sg.send(egress ? :ip_permissions_egress : :ip_permissions)
+
+          to_revoke = []
+
+          holes.each { |hole|
+            to_revoke << MU.structToHash(hole)
+            to_revoke.each { |rule|
+              if !rule[:user_id_group_pairs].nil? and rule[:user_id_group_pairs].size == 0
+                rule.delete(:user_id_group_pairs)
+              elsif !rule[:user_id_group_pairs].nil?
+                rule[:user_id_group_pairs].each { |group_ref|
+                  group_ref = MU.structToHash(group_ref)
+                  group_ref.delete(:group_name) if group_ref[:group_id]
+                }
+              end
+
+              if !rule[:ip_ranges].nil? and rule[:ip_ranges].size == 0
+                rule.delete(:ip_ranges)
+              end
+
+              if !rule[:prefix_list_ids].nil? and rule[:prefix_list_ids].size == 0
+                rule.delete(:prefix_list_ids)
+              end
+
+              if !rule[:ipv_6_ranges].nil? and rule[:ipv_6_ranges].size == 0
+                rule.delete(:ipv_6_ranges)
+              end
+            }
+          }
+
+          if to_revoke.size > 0
+            begin
+              if egress
+                MU::Cloud::AWS.ec2(credentials: credentials, region: region).revoke_security_group_egress(
+                  group_id: sg.group_id,
+                  ip_permissions: to_revoke
+                )
               else
-                MU.log "Failed to delete #{sg.group_name}", MU::ERR
+                MU::Cloud::AWS.ec2(credentials: credentials, region: region).revoke_security_group_ingress(
+                  group_id: sg.group_id,
+                  ip_permissions: to_revoke
+                )
               end
+            rescue Aws::EC2::Errors::InvalidPermissionNotFound
+              MU.log "Rule in #{sg.group_id} disappeared before I could remove it", MU::WARN
             end
+          end
+
+        end
+        private_class_method :revoke_rules
+
+        # Return an AWS-specific chunk of schema commonly used in the +ingress_rules+ parameter of other resource types.
+        # @return [Hash]
+        def self.ingressRuleAddtlSchema
+          {
+            "items" => {
+              "properties" => {
+                "sgs" => {
+                  "type" => "array",
+                  "items" => {
+                    "description" => "Other AWS Security Groups; resources that are associated with this group will have this rule applied to their traffic",
+                    "type" => "string"
+                  }
+                },
+                "lbs" => {
+                  "type" => "array",
+                  "items" => {
+                    "description" => "AWS Load Balancers which will have this rule applied to their traffic",
+                    "type" => "string"
+                  }
+                }
+              }
+            }
           }
         end
 
         # Cloud-specific configuration properties.
-        # @param config [MU::Config]: The calling MU::Config object
+        # @param _config [MU::Config]: The calling MU::Config object
         # @return [Array<Array,Hash>]: List of required fields, and json-schema Hash of cloud-specific configuration parameters for this resource
-        def self.schema(config)
+        def self.schema(_config)
           toplevel_required = []
           schema = {
             "rules" => {
@@ -645,36 +648,16 @@ module MU
 
             if rule['firewall_rules']
               rule['firewall_rules'].each { |sg|
-                if sg.is_a?(MU::Config::Ref) and sg.name
-  	              acl["dependencies"] << {
-    	              "type" => "firewall_rule",
-      	            "name" => sg.name,
-                    "no_create_wait" => true
-	                }
-                elsif sg['name'] and !sg['deploy_id']
-  	              acl["dependencies"] << {
-    	              "type" => "firewall_rule",
-      	            "name" => sg['name'],
-                    "no_create_wait" => true
-	                }
+                if sg['name'] and !sg['deploy_id']
+                  MU::Config.addDependency(acl, sg['name'], "firewall_rule", no_create_wait: true)
                 end
               }
             end
 
             if rule['loadbalancers']
               rule['loadbalancers'].each { |lb|
-                if lb.is_a?(MU::Config::Ref) and lb.name
-  	              acl["dependencies"] << {
-    	              "type" => "loadbalancer",
-      	            "name" => lb.name,
-                    "phase" => "groom"
-	                }
-                elsif lb['name'] and !lb['deploy_id']
-  	              acl["dependencies"] << {
-                    "type" => "loadbalancer",
-                    "name" => lb['name'],
-                    "phase" => "groom"
-	                }
+                if lb['name'] and !lb['deploy_id']
+                  MU::Config.addDependency(acl, lb['name'], "loadbalancer", phase: "groom")
                 end
               }
             end
@@ -716,32 +699,7 @@ module MU
 
         private
 
-        #########################################################################
-        # Manufacture an EC2 security group. The second parameter, rules, is an
-        # "ingress_rules" structure parsed and validated by MU::Config.
-        #########################################################################
-        def setRules(rules, add_to_self: false, ingress: true, egress: false)
-          describe
-          # XXX warn about attempt to set rules before we exist
-          return if rules.nil? or rules.size == 0 or !@cloud_id
-
-          # add_to_self means that this security is a "member" of its own rules
-          # (which is to say, objects that have this SG are allowed in my these
-          # rules)
-          if add_to_self
-            rules.each { |rule|
-              if rule['sgs'].nil? or !rule['sgs'].include?(@cloud_id)
-                new_rule = rule.clone
-                new_rule.delete('hosts')
-                rule['sgs'] = Array.new if rule['sgs'].nil?
-                rule['sgs'] << @cloud_id
-              end
-            }
-          end
-
-          ec2_rules = convertToEc2(rules)
-          ext_permissions = MU.structToHash(cloud_desc.ip_permissions)
-
+        def purge_extraneous_rules(ec2_rules, ext_permissions)
           # Purge any old rules that we're sure we created (check the comment)
           # but which are no longer configured.
           ext_permissions.each { |ext_rule|
@@ -778,97 +736,109 @@ module MU
                 ip_permissions: [ext_rule]
               )
             end
-
           }
+        end
 
-          # Creating an empty security group is ok, so don't freak out if we get
-          # a null rule list.
-          if !ec2_rules.nil?
-            ec2_rules.uniq!
-            retries = 0
-            ec2_rules.each { |rule|
-              haverule = nil
-              different = false
-              ext_permissions.each { |ext_rule|
-                if rule[:from_port] == ext_rule[:from_port] and
-                   rule[:to_port] == ext_rule[:to_port] and
-                   rule[:ip_protocol] == ext_rule[:ip_protocol]
-                  haverule = ext_rule
-                  ext_rule.keys.each { |k|
-                    if ext_rule[k].nil? or ext_rule[k] == []
-                      haverule.delete(k)
-                    end
-                    different = true if rule[k] != ext_rule[k]
-                  }
-                  break
-                end
-              }
-              if haverule and !different
-                MU.log "Security Group rule already up-to-date in #{@mu_name}", MU::DEBUG, details: rule
-                next
+        #########################################################################
+        # Manufacture an EC2 security group. The second parameter, rules, is an
+        # "ingress_rules" structure parsed and validated by MU::Config.
+        #########################################################################
+        def setRules(rules, add_to_self: false, ingress: true, egress: false)
+          # XXX warn about attempt to set rules before we exist
+          return if rules.nil? or rules.size == 0 or !@cloud_id
+
+          # add_to_self means that this security is a "member" of its own rules
+          # (which is to say, objects that have this SG are allowed in my these
+          # rules)
+          if add_to_self
+            rules.each { |rule|
+              if rule['sgs'].nil? or !rule['sgs'].include?(@cloud_id)
+                new_rule = rule.clone
+                new_rule.delete('hosts')
+                rule['sgs'] = Array.new if rule['sgs'].nil?
+                rule['sgs'] << @cloud_id
               end
+            }
+          end
 
-              MU.log "Setting #{ingress ? "ingress" : "egress"} rule in Security Group #{@mu_name} (#{@cloud_id})", MU::NOTICE, details: rule
-              begin
-
-                if ingress
-                  if haverule
-                    begin
-                      MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).revoke_security_group_ingress(
-                        group_id: @cloud_id,
-                        ip_permissions: [haverule]
-                      )
-                    rescue Aws::EC2::Errors::InvalidPermissionNotFound => e
-                    end
+          ec2_rules = convertToEc2(rules)
+          return if ec2_rules.nil?
+
+          ext_permissions = MU.structToHash(cloud_desc(use_cache: false).ip_permissions)
+
+          purge_extraneous_rules(ec2_rules, ext_permissions)
+
+          ec2_rules.uniq!
+          ec2_rules.each { |rule|
+            haverule = nil
+            different = false
+            ext_permissions.each { |ext_rule|
+              if rule[:from_port] == ext_rule[:from_port] and
+                 rule[:to_port] == ext_rule[:to_port] and
+                 rule[:ip_protocol] == ext_rule[:ip_protocol]
+                haverule = ext_rule
+                ext_rule.keys.each { |k|
+                  if ext_rule[k].nil? or ext_rule[k] == []
+                    haverule.delete(k)
                   end
+                  different = true if rule[k] != ext_rule[k]
+                }
+                break
+              end
+            }
+            if haverule and !different
+              MU.log "Security Group rule already up-to-date in #{@mu_name}", MU::DEBUG, details: rule
+              next
+            end
+
+            MU.log "Setting #{ingress ? "ingress" : "egress"} rule in Security Group #{@mu_name} (#{@cloud_id})", MU::NOTICE, details: rule
+
+            MU.retrier([Aws::EC2::Errors::InvalidGroupNotFound], max: 10, wait: 10, ignoreme: [Aws::EC2::Errors::InvalidPermissionDuplicate]) {
+              if ingress
+                if haverule
                   begin
-                    MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).authorize_security_group_ingress(
+                    MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).revoke_security_group_ingress(
                       group_id: @cloud_id,
-                      ip_permissions: [rule]
+                      ip_permissions: [haverule]
                     )
-                  rescue Aws::EC2::Errors::InvalidParameterCombination => e
-                    MU.log "FirewallRule #{@mu_name} had a bogus rule: #{e.message}", MU::ERR, details: rule
-                    raise e
+                  rescue Aws::EC2::Errors::InvalidPermissionNotFound
                   end
                 end
-
-                if egress
-                  if haverule
-                    begin
-                      MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).revoke_security_group_egress(
-                        group_id: @cloud_id,
-                        ip_permissions: [haverule]
-                      )
-                    rescue Aws::EC2::Errors::InvalidPermissionNotFound => e
-                    end
-                  end
-                  MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).authorize_security_group_egress(
+                begin
+                  MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).authorize_security_group_ingress(
                     group_id: @cloud_id,
                     ip_permissions: [rule]
                   )
+                rescue Aws::EC2::Errors::InvalidParameterCombination => e
+                  MU.log "FirewallRule #{@mu_name} had a bogus rule: #{e.message}", MU::ERR, details: rule
+                  raise e
                 end
+              end
 
-              rescue Aws::EC2::Errors::InvalidGroupNotFound => e
-                MU.log "#{@mu_name} (#{@cloud_id}) does not yet exist", MU::WARN
-                retries = retries + 1
-                if retries < 10
-                  sleep 10
-                  retry
-                else
-                  raise MuError, "#{@mu_name} does not exist", e.backtrace
+              if egress
+                if haverule
+                  begin
+                    MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).revoke_security_group_egress(
+                      group_id: @cloud_id,
+                      ip_permissions: [haverule]
+                    )
+                  rescue Aws::EC2::Errors::InvalidPermissionNotFound
+                  end
                 end
-              rescue Aws::EC2::Errors::InvalidPermissionDuplicate => e
-                MU.log "Attempt to add duplicate rule to #{@mu_name}", MU::DEBUG, details: rule
+                MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).authorize_security_group_egress(
+                  group_id: @cloud_id,
+                  ip_permissions: [rule]
+                )
               end
             }
-          end
+          }
 
         end
 
-        #########################################################################
-        # Convert our config languages description of firewall rules into Amazon's.
-        # This rule structure is as defined in MU::Config.
-        #########################################################################
+        #######################################################################
+        # Convert our config languages description of firewall rules into
+        # Amazon's. Our rule structure is as defined in MU::Config.
+        #######################################################################
         def convertToEc2(rules)
           ec2_rules = []
           if rules != nil
@@ -992,8 +962,8 @@ module MU
               ec2_rules << ec2_rule
             }
           end
-          ec2_rules.uniq!
-          return ec2_rules
+
+          ec2_rules.uniq
         end
 
       end #class