cmonson_2ndwatch_awspec 0.85.3

data/lib/awspec/type/rds_account_attributes.rb

@@ -0,0 +1,7 @@
+module Awspec::Type
+  class RdsAccountAttributes < AccountAttributeBase
+    def resource_via_client
+      @resource_via_client ||= find_rds_account_attributes
+    end
+  end
+end

data/lib/awspec/type/rds_db_cluster_parameter_group.rb

@@ -0,0 +1,34 @@
+module Awspec::Type
+  class RdsDbClusterParameterGroup < ResourceBase
+    def resource_via_client
+      return @resource_via_client if @resource_via_client
+
+      parameters = {}
+      res = rds_client.describe_db_cluster_parameters({
+                                                        db_cluster_parameter_group_name: @display_name
+                                                      })
+
+      loop do
+        res.parameters.each do |param|
+          parameters[param.parameter_name] = param.parameter_value
+        end
+        (res.respond_to?(:next_page?) && res.next_page? && res = res.next_page) || break
+      end
+
+      @resource_via_client ||= parameters
+    end
+
+    def id
+      @id ||= @display_name unless resource_via_client.empty?
+    end
+
+    def method_missing(name)
+      param_name = name.to_s
+      if resource_via_client.include?(param_name)
+        resource_via_client[param_name].to_s
+      else
+        super
+      end
+    end
+  end
+end

data/lib/awspec/type/rds_db_parameter_group.rb

@@ -0,0 +1,34 @@
+module Awspec::Type
+  class RdsDbParameterGroup < ResourceBase
+    def resource_via_client
+      return @resource_via_client if @resource_via_client
+
+      parameters = {}
+      res = rds_client.describe_db_parameters({
+                                                db_parameter_group_name: @display_name
+                                              })
+
+      loop do
+        res.parameters.each do |param|
+          parameters[param.parameter_name] = param.parameter_value
+        end
+        (res.next_page? && res = res.next_page) || break
+      end
+
+      @resource_via_client ||= parameters
+    end
+
+    def id
+      @id ||= @display_name unless resource_via_client.empty?
+    end
+
+    def method_missing(name)
+      param_name = name.to_s
+      if resource_via_client.include?(param_name)
+        resource_via_client[param_name].to_s
+      else
+        super
+      end
+    end
+  end
+end

data/lib/awspec/type/resource_base.rb

@@ -0,0 +1,24 @@
+module Awspec::Type
+  class ResourceBase < Base
+    attr_reader :id, :resource_via_client
+
+    def initialize(display_name = nil)
+      @display_name = display_name
+      @id = nil
+    end
+
+    def exists?
+      id
+    end
+
+    def id
+      raise 'this method must be override!'
+    end
+
+    def self.aws_resource(resource)
+      define_method :resource do
+        @resource ||= Awspec::ResourceReader.new(resource.new(id))
+      end
+    end
+  end
+end

data/lib/awspec/type/route53_hosted_zone.rb

@@ -0,0 +1,35 @@
+module Awspec::Type
+  class Route53HostedZone < ResourceBase
+    def resource_via_client
+      @resource_via_client ||= find_hosted_zone(@display_name)
+    end
+
+    def id
+      @id ||= resource_via_client.id if resource_via_client
+    end
+
+    def resource_via_client_record_sets
+      @resource_via_client_record_sets ||= select_record_sets_by_hosted_zone_id(id)
+    end
+
+    def has_record_set?(name, type, value, options = {})
+      name.gsub!(/\*/, '\\\052') # wildcard support
+      ret = resource_via_client_record_sets.find do |record_set|
+        # next if record_set.type != type.upcase
+        next unless record_set.type.casecmp(type) == 0
+        if !record_set.resource_records.empty?
+          sorted = record_set.resource_records.map { |r| r.value }.sort.join("\n")
+          ttl = options[:ttl] || record_set[:ttl]
+          record_set.name == name && \
+          value.split("\n").sort.join("\n") == sorted && \
+          record_set.ttl == ttl
+        else
+          # ALIAS
+          record_set.name == name && \
+          record_set.alias_target.dns_name == options[:alias_dns_name] && \
+          record_set.alias_target.hosted_zone_id == options[:alias_hosted_zone_id]
+        end
+      end
+    end
+  end
+end

data/lib/awspec/type/route_table.rb

@@ -0,0 +1,78 @@
+module Awspec::Type
+  class RouteTable < ResourceBase
+    aws_resource Aws::EC2::RouteTable
+    tags_allowed
+
+    def resource_via_client
+      @resource_via_client ||= find_route_table(@display_name)
+    end
+
+    def id
+      @id ||= resource_via_client.route_table_id if resource_via_client
+    end
+
+    def has_route?(destination,
+                   gateway_id = nil,
+                   instance_id = nil,
+                   vpc_peering_connection_id = nil,
+                   nat_gateway_id = nil)
+      resource_via_client.routes.find do |route|
+        if destination
+          next false unless [route.destination_cidr_block, route.destination_prefix_list_id].include?(destination)
+        end
+        next target_gateway?(route, gateway_id) if gateway_id
+        next target_instance?(route, instance_id) if instance_id
+        next target_vpc_peering_connection?(route, vpc_peering_connection_id) if vpc_peering_connection_id
+        next target_nat?(route, nat_gateway_id) if nat_gateway_id
+      end
+    end
+
+    def has_subnet?(subnet_id)
+      subnet = find_subnet(subnet_id)
+      return false unless subnet
+      resource_via_client.associations.find do |a|
+        a.subnet_id == subnet.subnet_id
+      end
+    end
+
+    private
+
+    def target_gateway?(route, gateway_id)
+      # * gateway
+      return true if route.gateway_id == gateway_id
+      # internet gateway
+      igw = find_internet_gateway(gateway_id)
+      return true if igw && igw.internet_gateway_id == route.gateway_id
+      # vpn gateway
+      vgw = find_vpn_gateway(gateway_id)
+      return true if vgw && vgw.vpn_gateway_id == route.gateway_id
+      # customer gateway
+      cgw = find_customer_gateway(gateway_id)
+      return true if cgw && cgw.customer_gateway_id == route.gateway_id
+      # nat gateway
+      return true if route.nat_gateway_id == gateway_id
+      false
+    end
+
+    def target_instance?(route, instance_id)
+      # instance
+      return true if route.instance_id == instance_id
+      instance = find_ec2(instance_id)
+      return true if instance && instance.instance_id == route.instance_id
+      false
+    end
+
+    def target_nat?(route, nat_gateway_id)
+      # nat
+      route.nat_gateway_id == nat_gateway_id
+    end
+
+    def target_vpc_peering_connection?(route, vpc_peering_connection_id)
+      # vpc_peering_connection_id
+      return true if route.vpc_peering_connection_id == vpc_peering_connection_id
+      connection = find_vpc_peering_connection(vpc_peering_connection_id)
+      return true if connection && connection.vpc_peering_connection_id == route.vpc_peering_connection_id
+      false
+    end
+  end
+end

data/lib/awspec/type/s3_bucket.rb

@@ -0,0 +1,112 @@
+module Awspec::Type
+  class S3Bucket < ResourceBase
+    aws_resource Aws::S3::Bucket
+
+    def resource_via_client
+      @resource_via_client ||= find_bucket(@display_name)
+    end
+
+    def id
+      @id ||= @display_name if resource_via_client
+    end
+
+    def has_object?(key)
+      res = s3_client.head_object({
+                                    bucket: id,
+                                    key: key.sub(%r(\A/), '')
+                                  })
+      res
+    rescue
+      false
+    end
+
+    def has_acl_grant?(grantee:, permission:)
+      @acl = find_bucket_acl(id)
+      @acl.grants.find do |grant|
+        grant.permission == permission &&
+          (grant.grantee.display_name == grantee || grant.grantee.uri == grantee || grant.grantee.id == grantee)
+      end
+    end
+
+    def acl_owner
+      @acl = find_bucket_acl(id)
+      @acl.owner.display_name
+    end
+
+    def acl_grants_count
+      @acl = find_bucket_acl(id)
+      @acl.grants.count
+    end
+
+    def has_cors_rule?(allowed_headers: [],
+                       allowed_methods:,
+                       allowed_origins:,
+                       expose_headers: [],
+                       max_age_seconds: nil)
+      cors_rules.any? do |rule|
+        (rule.allowed_headers - allowed_headers).empty? &&
+          (rule.allowed_methods - allowed_methods).empty? &&
+          (rule.allowed_origins - allowed_origins).empty? &&
+          (rule.expose_headers - expose_headers).empty? &&
+          rule.max_age_seconds == max_age_seconds
+      end
+    end
+
+    def cors_rules_count
+      cors_rules.count
+    end
+
+    def has_policy?(policy)
+      bp = find_bucket_policy(id)
+      if bp
+        JSON.parse(bp.policy.read, array_class: Set) == JSON.parse(policy, array_class: Set)
+      else
+        false
+      end
+    end
+
+    def has_tag?(key, value)
+      tag = find_bucket_tag(id, key)
+      return nil if tag.value != value
+      tag
+    end
+
+    def has_logging_enabled?(target_bucket: nil, target_prefix: nil)
+      bl = find_bucket_logging(id)
+      le = bl ? bl.logging_enabled : nil
+
+      return false if le.nil?
+      return false if target_bucket && target_bucket != le.target_bucket
+      return false if target_prefix && target_prefix != le.target_prefix
+      true
+    end
+
+    def has_versioning_enabled?
+      bv = find_bucket_versioning(id)
+      bv ? (bv.status == 'Enabled') : false
+    end
+
+    def has_lifecycle_rule?(rule)
+      lifecycle_configuration_rules.any? do |lc_rule|
+        rule.each { |key, value| lc_rule[key] == value }
+      end
+    end
+
+    def has_mfa_delete_enabled?
+      bv = find_bucket_versioning(id)
+      bv ? (bv.mfa_delete == 'Enabled') : false
+    end
+
+    private
+
+    def cors_rules
+      cors = find_bucket_cors(id)
+      cors ? cors.cors_rules : []
+    end
+
+    def lifecycle_configuration_rules
+      blc = find_bucket_lifecycle_configuration(id)
+      blc ? blc.rules : []
+    end
+  end
+end

data/lib/awspec/type/security_group.rb

@@ -0,0 +1,137 @@
+module Awspec::Type
+  class SecurityGroup < ResourceBase
+    aws_resource Aws::EC2::SecurityGroup
+    tags_allowed
+
+    def resource_via_client
+      @resource_via_client ||= find_security_group(@display_name)
+    end
+
+    def id
+      @id ||= resource_via_client.group_id if resource_via_client
+    end
+
+    def opened?(port = nil, protocol = nil, cidr = nil)
+      return inbound_opened?(port, protocol, cidr) if @inbound
+      outbound_opened?(port, protocol, cidr)
+    end
+
+    def opened_only?(port = nil, protocol = nil, cidr = nil)
+      return inbound_opened_only?(port, protocol, cidr) if @inbound
+      outbound_opened_only?(port, protocol, cidr)
+    end
+
+    def inbound_opened?(port = nil, protocol = nil, cidr = nil)
+      resource_via_client.ip_permissions.find do |permission|
+        cidr_opened?(permission, cidr) && protocol_opened?(permission, protocol) && port_opened?(permission, port)
+      end
+    end
+
+    def inbound_opened_only?(port = nil, protocol = nil, cidr = nil)
+      permissions = resource_via_client.ip_permissions.select do |permission|
+        protocol_opened?(permission, protocol) && port_opened?(permission, port)
+      end
+      cidrs = []
+      permissions.each do |permission|
+        permission.ip_ranges.select { |ip_range| cidrs.push(ip_range.cidr_ip) }
+      end
+      cidrs == Array(cidr)
+    end
+
+    def outbound_opened?(port = nil, protocol = nil, cidr = nil)
+      resource_via_client.ip_permissions_egress.find do |permission|
+        cidr_opened?(permission, cidr) && protocol_opened?(permission, protocol) && port_opened?(permission, port)
+      end
+    end
+
+    def outbound_opened_only?(port = nil, protocol = nil, cidr = nil)
+      permissions = resource_via_client.ip_permissions_egress.select do |permission|
+        protocol_opened?(permission, protocol) && port_opened?(permission, port)
+      end
+      cidrs = []
+      permissions.each do |permission|
+        permission.ip_ranges.select { |ip_range| cidrs.push(ip_range.cidr_ip) }
+      end
+      cidrs == Array(cidr)
+    end
+
+    def inbound
+      @inbound = true
+      self
+    end
+
+    def outbound
+      @inbound = false
+      self
+    end
+
+    def ip_permissions_count
+      resource_via_client.ip_permissions.count
+    end
+    alias_method :inbound_permissions_count, :ip_permissions_count
+
+    def ip_permissions_egress_count
+      resource_via_client.ip_permissions_egress.count
+    end
+    alias_method :outbound_permissions_count, :ip_permissions_egress_count
+
+    def inbound_rule_count
+      resource_via_client.ip_permissions.reduce(0) do |sum, permission|
+        sum += permission.ip_ranges.count + permission.user_id_group_pairs.count
+      end
+    end
+
+    def outbound_rule_count
+      resource_via_client.ip_permissions_egress.reduce(0) do |sum, permission|
+        sum += permission.ip_ranges.count + permission.user_id_group_pairs.count
+      end
+    end
+
+    private
+
+    def cidr_opened?(permission, cidr)
+      return true unless cidr
+      ret = permission.ip_ranges.select do |ip_range|
+        ip_range.cidr_ip == cidr
+      end
+      return true if ret.count > 0
+      ret = permission.user_id_group_pairs.select do |sg|
+        # Compare the sg group_name if the remote group is in another account.
+        # find_security_group call doesn't return info on a remote security group.
+        if !sg.user_id.nil? && (sg.user_id != resource_via_client.owner_id)
+          next (sg.group_name == cidr) || (sg.group_id == cidr)
+        end
+        next true if sg.group_id == cidr
+        sg2 = find_security_group(sg.group_id)
+        next true if sg2.group_name == cidr
+        sg2.tags.find do |tag|
+          tag.key == 'Name' && tag.value == cidr
+        end
+      end
+      ret.count > 0
+    end
+
+    def protocol_opened?(permission, protocol)
+      return true unless protocol
+      return false if protocol == 'all' && permission.ip_protocol != '-1'
+      return true if permission.ip_protocol == '-1'
+      permission.ip_protocol == protocol
+    end
+
+    def port_opened?(permission, port)
+      return true unless port
+      return true unless permission.from_port
+      return true unless permission.to_port
+      port_between?(port, permission.from_port, permission.to_port)
+    end
+
+    def port_between?(port, from_port, to_port)
+      if port.is_a?(String) && port.include?('-')
+        f, t = port.split('-')
+        from_port == f.to_i && to_port == t.to_i
+      else
+        port.between?(from_port, to_port)
+      end
+    end
+  end
+end