convection 0.0.1 → 0.2.1

data/lib/convection/model/template/resource/aws_iam_instance_profile.rb

@@ -0,0 +1,21 @@
+require_relative '../resource'
+
+module Convection
+  module Model
+    class Template
+      class Resource
+        ##
+        # AWS::IAM::IstanceProfile
+        ##
+        class IAMInstanceProfile < Resource
+          type 'AWS::IAM::InstanceProfile'
+          property :path, 'Path'
+
+          ## List of references to AWS::IAM::Roles.
+          ## Currently, a maximum of one role can be assigned to an instance profile.
+          property :role, 'Roles', :type => :list
+        end
+      end
+    end
+  end
+end

data/lib/convection/model/template/resource/aws_iam_policy.rb

@@ -1,18 +1,7 @@
+require 'forwardable'
 require_relative '../resource'
 
 module Convection
-  module DSL
-    ## Add DSL method to template namespace
-    module Template
-      def iam_policy(name, &block)
-        r = Model::Template::Resource::IAMPolicy.new(name, self)
-        r.instance_exec(&block) if block
-
-        resources[name] = r
-      end
-    end
-  end
-
   module Model
     class Template
       class Resource
@@ -20,23 +9,38 @@ module Convection
         # AWS::IAM::Policy
         ##
         class IAMPolicy < Resource
-          def initialize(*args)
-            super
+          extend Forwardable
 
-            type 'AWS::IAM::Policy'
-            @properties['Roles'] = []
-          end
+          type 'AWS::IAM::Policy'
+          property :group, 'Groups', :type => :list,
+                                     :transform => (proc do |resource|
+                                       depends_on(resource)
+                                       resource
+                                     end)
+          property :role, 'Roles', :type => :list,
+                                   :transform => (proc do |resource|
+                                     depends_on(resource)
+                                     resource
+                                   end)
+          property :user, 'Users', :type => :list,
+                                   :transform => (proc do |resource|
+                                     depends_on(resource)
+                                     resource
+                                   end)
 
-          def role(value)
-            @properties['Roles'] << value
-          end
+          attr_reader :document
+          def_delegators :@document, :allow, :id, :version, :statement
+          def_delegator :@document, :name, :policy_name
 
-          def name(value)
-            property('PolicyName', value)
+          def initialize(*args)
+            super
+            @document = Model::Mixin::Policy.new(:template => @template)
           end
 
-          def policy_document(value)
-            property('PolicyDocument', value)
+          def render
+            super.tap do |r|
+              document.render(r['Properties'])
+            end
           end
         end
       end

data/lib/convection/model/template/resource/aws_iam_role.rb

@@ -2,13 +2,86 @@ require_relative '../resource'
 
 module Convection
   module DSL
-    ## Add DSL method to template namespace
     module Template
-      def iam_role(name, &block)
-        r = Model::Template::Resource::IAMRole.new(name, self)
-        r.instance_exec(&block) if block
+      module Resource
+        ## Role DSL
+        module IAMRole
+          def policy(policy_name, &block)
+            add_policy = Model::Mixin::Policy.new(:name => policy_name, :template => @template)
+            add_policy.instance_exec(&block) if block
 
-        resources[name] = r
+            policies << add_policy
+          end
+
+          ## Create an IAM Instance Profile for this role
+          def with_instance_profile(&block)
+            profile = Model::Template::Resource::IAMInstanceProfile.new("#{ name }Profile", @template)
+            profile.role(self)
+            profile.path(path)
+
+            profile.instance_exec(&block) if block
+            @instance_profile = profile
+            @template.resources[profile.name] = profile
+          end
+
+          ## Add a canned trust policy for EC2 instances
+          def trust_ec2_instances(&block)
+            @trust_relationship = Model::Mixin::Policy.new(:name => 'trust-ec2-instances', :template => @template)
+            trust_relationship.allow do
+              action 'sts:AssumeRole'
+              principal :Service => 'ec2.amazonaws.com'
+            end
+            trust_relationship.instance_exec(&block) if block
+            trust_relationship
+          end
+
+          ## Add a canned trust policy for Flow Logs
+          def trust_flow_logs(&block)
+            @trust_relationship = Model::Mixin::Policy.new(:name => 'trust-flow-logs', :template => @template)
+            trust_relationship.allow do
+              action 'sts:AssumeRole'
+              principal :Service => 'vpc-flow-logs.amazonaws.com'
+            end
+            trust_relationship.instance_exec(&block) if block
+            trust_relationship
+          end
+
+          ## Add a canned trust policy for Cloudtrail
+          def trust_cloudtrail(&block)
+            @trust_relationship =
+              Model::Mixin::Policy.new(:name => 'trust-cloudtrail-instances', :template => @template)
+
+            trust_relationship.allow do
+              action 'sts:AssumeRole'
+              principal :Service => 'cloudtrail.amazonaws.com'
+            end
+
+            trust_relationship.instance_exec(&block) if block
+            trust_relationship
+          end
+
+          ## Add a policy to allow instance to self-terminate
+          def allow_instance_termination(&block)
+            with_instance_profile if instance_profile.nil?
+
+            term_policy = Model::Template::Resource::IAMPolicy.new("#{ name }TerminationPolicy", @template)
+            term_policy.policy_name('allow-instance-termination')
+
+            parent_role = self
+            term_policy.allow do
+              action 'ec2:TerminateInstances'
+              resource '*'
+              condition :StringEquals => {
+                'ec2:InstanceProfile' => get_att(parent_role.instance_profile.name, 'Arn')
+              }
+            end
+            term_policy.role(self)
+            term_policy.depends_on(instance_profile)
+
+            term_policy.instance_exec(&block) if block
+            @template.resources[term_policy.name] = term_policy
+          end
+        end
       end
     end
   end
@@ -20,23 +93,19 @@ module Convection
         # AWS::IAM::Role
         ##
         class IAMRole < Resource
-          def initialize(*args)
-            super
+          include DSL::Template::Resource::IAMRole
 
-            type 'AWS::IAM::Role'
-            @properties['Policies'] = []
-          end
+          type 'AWS::IAM::Role'
+          property :path, 'Path'
+          property :policies, 'Policies', :type => :list
 
-          def path(value)
-            property('Path', value)
-          end
-
-          def policies(value)
-            @properties['Policies'] << value
-          end
+          attr_accessor :trust_relationship
+          attr_reader :instance_profile
 
-          def assume_role_policy_document(value)
-            property('AssumeRolePolicyDocument', value)
+          def render
+            super.tap do |r|
+              r['Properties']['AssumeRolePolicyDocument'] = trust_relationship.document unless trust_relationship.nil?
+            end
           end
         end
       end

data/lib/convection/model/template/resource/aws_iam_user.rb

@@ -0,0 +1,53 @@
+require_relative '../resource'
+
+module Convection
+  module DSL
+    module Template
+      module Resource
+        ## Role DSL
+        module IAMUser
+          def policy(policy_name, &block)
+            add_policy = Model::Mixin::Policy.new(:name => policy_name, :template => @template)
+            add_policy.instance_exec(&block) if block
+
+            policies << add_policy
+          end
+
+          def with_key(serial = 0, &block)
+            key = Model::Template::Resource::IAMAccessKey.new("#{ name }Key", @template)
+            key.user_name = self
+            key.serial = serial
+
+            key.depends_on(self)
+
+            key.with_output("#{ name }Id", key.reference)
+            key.with_output("#{ name }Secret", get_att(key.name, 'SecretAccessKey'))
+
+            key.instance_exec(&block) if block
+
+            @template.resources[key.name] = key
+          end
+        end
+      end
+    end
+  end
+
+  module Model
+    class Template
+      class Resource
+        ##
+        # AWS::IAM::User
+        ##
+        class IAMUser < Resource
+          include DSL::Template::Resource::IAMUser
+
+          type 'AWS::IAM::User'
+          property :path, 'Path'
+          property :login_profile, 'LoginProfile'
+          property :group, 'Groups', :type => :list
+          property :policies, 'Policies', :type => :list
+        end
+      end
+    end
+  end
+end

data/lib/convection/model/template/resource/aws_logs_loggroup.rb

@@ -0,0 +1,33 @@
+require_relative '../resource'
+
+module Convection
+  module Model
+    class Template
+      class Resource
+        ##
+        # AWS::Logs::LogGroup
+        ##
+        class LogGroup < Resource
+          property :retention_in_days, 'RetentionInDays'
+
+          def initialize(*args)
+            super
+            type 'AWS::Logs::LogGroup'
+          end
+        end
+      end
+    end
+  end
+
+  module DSL
+    ## Add DSL method to template namespace
+    module Template
+      def logs_log_group(name, &block)
+        r = Model::Template::Resource::LogGroup.new(name, self)
+
+        r.instance_exec(&block) if block
+        resources[name] = r
+      end
+    end
+  end
+end

data/lib/convection/model/template/resource/aws_rds_db_instance.rb

@@ -0,0 +1,59 @@
+require_relative '../resource'
+
+module Convection
+  module Model
+    class Template
+      class Resource
+        ##
+        # AWS::RDS::DBInstance
+        ##
+        class RDSDBInstance < Resource
+          include Model::Mixin::Taggable
+
+          type 'AWS::RDS::DBInstance', :rds_instance
+          property :identifier, 'DBInstanceIdentifier'
+          property :source_identifier, 'SourceDBInstanceIdentifier'
+          property :instance_class, 'DBInstanceClass'
+          property :engine, 'Engine'
+          property :engine_version, 'EngineVersion'
+          property :license_model, 'LicenseModel'
+          property :storage_type, 'StorageType'
+          property :storage_encrypted, 'StorageEncrypted'
+          property :iops, 'Iops'
+          property :port, 'Port'
+          property :master, 'SourceDBInstanceIdentifier'
+
+          property :database_name, 'DBName'
+          property :master_username, 'MasterUsername'
+          property :master_password, 'MasterUserPassword'
+
+          property :parameter_group, 'DBParameterGroupName'
+          property :option_group, 'OptionGroupName'
+
+          property :storage_encrypted, 'StorageEncrypted'
+          property :kms_key_id, 'KmsKeyId'
+          property :allocated_storage, 'AllocatedStorage'
+          property :allow_major_version_upgrade, 'AllowMajorVersionUpgrade'
+          property :auto_minor_version_upgrade, 'AutoMinorVersionUpgrade'
+          property :snapshot_identifier, 'DBSnapshotIdentifier'
+          property :backup_retention_period, 'BackupRetentionPeriod'
+          property :preferred_backup_window, 'PreferredBackupWindow'
+          property :preferred_maintenance_window, 'PreferredMaintenanceWindow'
+
+          property :availability_zone, 'AvailabilityZone'
+          property :multi_az, 'MultiAZ'
+          property :publicly_accessible, 'PubliclyAccessible'
+          property :subnet_group, 'DBSubnetGroupName'
+          property :security_group, 'DBSecurityGroups', :type => :list
+          property :vpc_security_group, 'VPCSecurityGroups', :type => :list
+
+          def render(*args)
+            super.tap do |resource|
+              render_tags(resource)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/convection/model/template/resource/aws_rds_db_parameter_group.rb

@@ -0,0 +1,27 @@
+require_relative '../resource'
+
+module Convection
+  module Model
+    class Template
+      class Resource
+        ##
+        # AWS::RDS::DBParameterGroup
+        ##
+        class RDSDBParameterGroup < Resource
+          include Model::Mixin::Taggable
+
+          type 'AWS::RDS::DBParameterGroup', :rds_parameter_group
+          property :description, 'Description'
+          property :family, 'Family'
+          property :parameter, 'Parameters', :type => :hash
+
+          def render(*args)
+            super.tap do |resource|
+              render_tags(resource)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/convection/model/template/resource/aws_rds_db_security_group.rb

@@ -0,0 +1,40 @@
+require_relative '../resource'
+
+module Convection
+  module Model
+    class Template
+      class Resource
+        ##
+        # AWS::RDS::DBSecurityGroup
+        ##
+        class RDSDBSecurityGroup < Resource
+          include Model::Mixin::Taggable
+
+          type 'AWS::RDS::DBSecurityGroup', :rds_security_group
+          property :description, 'GroupDescription'
+          property :vpc, 'EC2VpcId'
+          property :ingress, 'DBSecurityGroupIngress', :type => :list
+
+          def ec2_security_group(group, owner)
+            ingress(
+              :EC2SecurityGroupName => group,
+              :EC2SecurityGroupOwnerId => owner
+            )
+          end
+
+          def cidr_ip(cidr_block)
+            ingress(
+              :CIDRIP => cidr_block
+            )
+          end
+
+          def render(*args)
+            super.tap do |resource|
+              render_tags(resource)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/convection/model/template/resource/aws_rds_db_subnet_group.rb

@@ -0,0 +1,26 @@
+require_relative '../resource'
+
+module Convection
+  module Model
+    class Template
+      class Resource
+        ##
+        # AWS::RDS::DBSubnetGroup
+        ##
+        class RDSDBSubnetGroup < Resource
+          include Model::Mixin::Taggable
+
+          type 'AWS::RDS::DBSubnetGroup', :rds_subnet_group
+          property :subnet, 'SubnetIds', :type => :list
+          property :description, 'DBSubnetGroupDescription'
+
+          def render(*args)
+            super.tap do |resource|
+              render_tags(resource)
+            end
+          end
+        end
+      end
+    end
+  end
+end