cucloud 0.2.0 → 0.3.0

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    YzQ3Y2ZmNTA0ZGNkMjllZWY2ZDAzNTZhMWU2OTJkMDYxMGQ3Mjg5ZQ==
+    NzdhZDFlN2ZmYzFjMzhmMmM4ZTBlMTM5MzZiMDM5MmJlODY3MWQyOQ==
   data.tar.gz: !binary |-
-    ZTk0NDQ1YWViYjc5YTAzZGZhMjc3MTI5ZTg5ZDE3MzgzMWJjMzM1NQ==
+    OWQxMWUyODJjODRhMjFlYWY0OTdlN2QyMDNlYjMxOGEyOWQ4YWY5Mw==
 SHA512:
   metadata.gz: !binary |-
-    N2Y2Zjg0YzA2M2YyZWUwNWNkMTAwNjUyZmQ5OTU4N2NjNmZhMDZiODg4NzMz
-    M2NlYzIzZGIxMjNmNTcyNDhmOThjMmE1ODc2OWRhNGVhODBkNGNjZDA3Mzdl
-    NzAxZDNhNjcwMjUzMTRhMDMxMjlmNTg2Yjc0MTRjMDA0Mzg3MWI=
+    M2NjYjg2MWRhOWMwMTg4NzA3YTRkNDZjNGNhNWMzNDNjZjYyOTU3ZWUwNzM3
+    MmY1OWE1ZTczMDEwYWFkNWQxMjZkZGNmYmQ0OGYyZmQ0ODQyZDZmOWIzNGE2
+    YjMwNzY0NmE2YzQ3Y2Y4YjdiMTE1ZjIxMGEyYjMzMzA1ZWUwZTQ=
   data.tar.gz: !binary |-
-    ZTg4YjMwNTNlYWRmNDljNThlNTRiZDIzMmIwMjUwNmZlYjkwZDU0MjIzMWVh
-    NjVkZjc0YTc1YTgyZTQzMDg3ZTQxNjcyOTlkMTFiNjkwYTM1Y2FkNTZlYWUz
-    MDFlZWEwNmY1N2VjZmZkYmM0YzE3OWMyMDMzZjRlMmFkNGZlNzA=
+    ZmQxYzg0ZTcxY2I5NDZmMWVlMWQ3YTYyYjdjNjE3N2IwYmRkMDAxZjRkZGU3
+    MDEyZDFkZjY5ODI1Mzk2MGQ4ZDBjMTRmY2U5MmE1Zjg4ODI4NWIwYmViNjk0
+    ZWI3ZjRlNjIzMTY3ZjY5YWNmNTg0YTFhYjMwNWFhYjE0YjdlZGI=

data/.rubocop.yml

@@ -9,3 +9,7 @@ Metrics/MethodLength:
 
 Metrics/AbcSize:
   Max: 50
+
+# disable get/set warnings - many of our methods are performing API calls and get_ seems appropriate naming
+Style/AccessorMethodName:
+  Enabled: false

data/.travis.yml

@@ -13,3 +13,7 @@ deploy:
   on:
     tags: true
     repo: CU-CloudCollab/cucloud_ruby
+notifications:
+  hipchat:
+    rooms:
+      secure: poxd8oy6KvYQe2yfe6vms84iW/HzPAQyt07r1Z2GhEjaW5Oof5Gi/FPl/j6L3im/ymy8KPuCN4MI0ZjglIq0qRuiFJai107uhgxZb0+31DOfM2DL0OFJOWfmm1rI8mLdyfQ1KYYx7115vtE4ZBqxSb3q3o66/3CISGfQR1dmHx8jT1ABGBf5fPLhxvu6BLnxgsdGQWFC/Va7DHhhUb//R0dZIENNy0WOJlaAjgm00Dp96sDHe+h3hzYuNA3ZCU6dos2nyKT0FrNDzcfofCaPkekUkb/Dm8LDup/HXeg4DM7a+MfKcn6NUjUcTx28o+rAggDPpDxIr4f38rsDFKip47CGrO3jhVK0Q1lOO6/gWUnGn1Ec0sB9uCNHlSa860oINw7eU3kC38DwBcspMItRpDo6eBkdh7irEibu14+FtCq/QgHjDghLNfJb/Zw4zo5Ip+yDbmDtdDXA7T7t4DXD/2T4UKKc9FvjTmv224QFi5XQUOiIUDNGjCvhqVDKKZv9KuYspiBy0xoxroGtWR4dqqZwlikvTKsSGIJASTZHlmZ3vfzrAWzHfC0twWZ2kmkM8j6V81lZqCxfv6xRj7fKw68B7LahfuBsQUpgWEnBcZ8qnMyRuIeq7Rm7cqkL/7ZG7cpoCRXaXRMGQZ2sUgZkWQ9RuTFTzaa6jUFZGFpnufs=

data/README.md

@@ -1,4 +1,4 @@
-# Cucloud ![Build Status](https://api.travis-ci.org/CU-CloudCollab/cucloud_ruby.svg)
+# Cucloud ![Build Status](https://api.travis-ci.org/CU-CloudCollab/cucloud_ruby.svg) [![Gem Version](https://badge.fury.io/rb/cucloud.svg)](https://badge.fury.io/rb/cucloud) [![Coverage Status](https://coveralls.io/repos/github/CU-CloudCollab/cucloud_ruby/badge.svg?branch=master)](https://coveralls.io/github/CU-CloudCollab/cucloud_ruby?branch=master)
 
 The cucloud module is intended to serve as a lightweight wrapper around the AWS SDK that can be used to share common functionality across various AWS utilities and tools that we develop at Cornell.  Goals:
 

data/cucloud.gemspec

@@ -11,12 +11,12 @@ Gem::Specification.new do |spec|
 
   spec.email         = ['shawn.bower@gmail.com', 'bmh67@cornell.edu', 'sr523@cornell.edu']
 
-  spec.summary       = 'The cucloud module is intended to provide functionality requiring more customization than ' \
-                       'could otherwise be simply accomplished with a cloud specific command line interface, e.g. ' \
-                       'AWS CLI'
-  spec.description   = 'The cucloud module is intended to provide functionality requiring more customization than ' \
-                       'could otherwise be simply accomplished with a cloud specific command line interface, e.g. ' \
-                       'AWS CLI'
+  spec.summary       = 'The cucloud module is intended to serve as a lightweight wrapper around the AWS SDK that ' \
+                       'can be used to share common functionality across various AWS utilities and tools that we ' \
+                       'develop at Cornell'
+  spec.description   = 'The cucloud module is intended to serve as a lightweight wrapper around the AWS SDK that ' \
+                       'can be used to share common functionality across various AWS utilities and tools that we ' \
+                       'develop at Cornell'
   spec.homepage      = 'https://github.com/CU-CloudCollab/cucloud_ruby'
 
   spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
@@ -28,6 +28,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'uuid', '~> 2.3'
 
   spec.add_development_dependency 'bundler', '~> 1.11'
+  spec.add_development_dependency 'coveralls'
   spec.add_development_dependency 'rake', '~> 10.0'
   spec.add_development_dependency 'rspec', '~> 3.0'
   spec.add_development_dependency 'rubocop', '~> 0.40.0'

data/lib/cucloud.rb

@@ -5,11 +5,32 @@ module Cucloud
   require 'cucloud/version'
   require 'cucloud/ec2_utils'
   require 'cucloud/asg_utils'
+  require 'cucloud/ssm_utils'
+  require 'cucloud/iam_utils'
 
   DEFAULT_REGION = 'us-east-1'.freeze
 
   Aws.config = { region: DEFAULT_REGION }
 
+  CORNELL_SAML_X509 = %(<ds:X509Certificate>MIIDSDCCAjCgAwIBAgIVAOZ8NfBem6sHcI7F39sYmD/JG4YDMA0GCSqGSIb3DQEB
+BQUAMCIxIDAeBgNVBAMTF3NoaWJpZHAuY2l0LmNvcm5lbGwuZWR1MB4XDTA5MTEy
+MzE4NTI0NFoXDTI5MTEyMzE4NTI0NFowIjEgMB4GA1UEAxMXc2hpYmlkcC5jaXQu
+Y29ybmVsbC5lZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCTURo9
+90uuODo/5ju3GZThcT67K3RXW69jwlBwfn3png75Dhyw9Xa50RFv0EbdfrojH1P1
+9LyfCjubfsm9Z7FYkVWSVdPSvQ0BXx7zQxdTpE9137qj740tMJr7Wi+iWdkyBQS/
+bCNhuLHeNQor6NXZoBgX8HvLy4sCUb/4v7vbp90HkmP3FzJRDevzgr6PVNqWwNqp
+tZ0vQHSF5D3iBNbxq3csfRGQQyVi729XuWMSqEjPhhkf1UjVcJ3/cG8tWbRKw+W+
+OIm71k+99kOgg7IvygndzzaGDVhDFMyiGZ4njMzEJT67sEq0pMuuwLMlLE/86mSv
+uGwO2Qacb1ckzjodAgMBAAGjdTBzMFIGA1UdEQRLMEmCF3NoaWJpZHAuY2l0LmNv
+cm5lbGwuZWR1hi5odHRwczovL3NoaWJpZHAuY2l0LmNvcm5lbGwuZWR1L2lkcC9z
+aGliYm9sZXRoMB0GA1UdDgQWBBSQgitoP2/rJMDepS1sFgM35xw19zANBgkqhkiG
+9w0BAQUFAAOCAQEAaFrLOGqMsbX1YlseO+SM3JKfgfjBBL5TP86qqiCuq9a1J6B7
+Yv+XYLmZBy04EfV0L7HjYX5aGIWLDtz9YAis4g3xTPWe1/bjdltUq5seRuksJjyb
+prGI2oAv/ShPBOyrkadectHzvu5K6CL7AxNTWCSXswtfdsuxcKo65tO5TRO1hWlr
+7Pq2F+Oj2hOvcwC0vOOjlYNe9yRE9DjJAzv4rrZUg71R3IEKNjfOF80LYPAFD2Sp
+p36uB6TmSYl1nBmS5LgWF4EpEuODPSmy4sIV6jl1otuyI/An2dOcNqcgu7tYEXLX
+C8N6DXggDWPtPRdpk96UW45huvXudpZenrcd7A==</ds:X509Certificate>).freeze
+
   def region
     @region
   end

data/lib/cucloud/ec2_utils.rb

@@ -6,9 +6,10 @@ module Cucloud
     UBUNTU_PATCH_COMMAND = 'apt-get update; apt-get -y upgrade; reboot'.freeze
     AMAZON_PATCH_COMMAND = 'yum update -y; reboot & disown '.freeze
 
-    def initialize(ec2_client = Aws::EC2::Client.new)
+    def initialize(ec2_client = Aws::EC2::Client.new, ssm_utils = Cucloud::SSMUtils.new)
       ## DI for testing purposes
       @ec2 = ec2_client
+      @ssm_utils = ssm_utils
     end
 
     def get_instance(instance)
@@ -82,18 +83,6 @@ module Cucloud
       end
     end
 
-    def send_patch_command(patch_instances, command)
-      ssm = Aws::SSM::Client.new(region: 'us-east-1')
-
-      ssm.send_command(instance_ids: patch_instances, # required
-                       document_name: 'AWS-RunShellScript', # required
-                       timeout_seconds: 600,
-                       comment: 'Patch It!',
-                       parameters: {
-                         'commands' => [command]
-                       })
-    end
-
     # rubocop:disable Metrics/CyclomaticComplexity
     # rubocop:disable Metrics/PerceivedComplexity
     # @todo consider refactoring/breaking out functionality so that complexity metrics pass
@@ -119,8 +108,8 @@ module Cucloud
         end
       end
 
-      send_patch_command(ubuntu_patch_instances, UBUNTU_PATCH_COMMAND) if ubuntu_patch_instances.any?
-      send_patch_command(amazon_patch_instances, AMAZON_PATCH_COMMAND) if amazon_patch_instances.any?
+      @ssm_utils.send_patch_command(ubuntu_patch_instances, UBUNTU_PATCH_COMMAND) if ubuntu_patch_instances.any?
+      @ssm_utils.send_patch_command(amazon_patch_instances, AMAZON_PATCH_COMMAND) if amazon_patch_instances.any?
 
       all_instances
     end

data/lib/cucloud/iam_utils.rb

@@ -0,0 +1,177 @@
+module Cucloud
+  # Utilities library for interacting with IAM
+  class IamUtils
+    # Define some error classes
+    class UnknownComparisonOperatorError < StandardError
+    end
+
+    def initialize(iam_client = Aws::IAM::Client.new)
+      @iam = iam_client
+    end
+
+    # Get the alias set for this account if it exists
+    # @return [String] Account alias (nil if not set)
+    def get_account_alias
+      # https://docs.aws.amazon.com/sdkforruby/api/Aws/IAM/Client.html#list_account_aliases-instance_method
+      # https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html
+      # Per user guide: Account can have only one alias
+
+      @iam.list_account_aliases.account_aliases[0]
+    end
+
+    # Get report about IAM entity usage and quotas in this account
+    # @return [Hash<String,Integer>] A hash of key value pairs containing information about IAM entity usage and quotas.
+    def get_account_summary
+      # https://docs.aws.amazon.com/sdkforruby/api/Aws/IAM/Client.html#get_account_summary-instance_method
+      # return https://docs.aws.amazon.com/sdkforruby/api/Aws/IAM/Types/GetAccountSummaryResponse.html#summary_map-instance_method
+      @iam.get_account_summary.summary_map
+    end
+
+    # Does this account's root user have any API keys?
+    # @return [Boolean]
+    def root_user_has_api_key?
+      get_account_summary['AccountAccessKeysPresent'] > 0
+    end
+
+    # Does this account's root user have MFA enabled?
+    # @return [Boolean]
+    def root_user_mfa_enabled?
+      get_account_summary['AccountMFAEnabled'] > 0
+    end
+
+    # Does this account have multiple identity providers configured?
+    # @return [Boolean]
+    def multiple_providers_configured?
+      get_account_summary['Providers'] > 1
+    end
+
+    # Get password policy for this account
+    # @return [Aws::IAM::Types::PasswordPolicy]
+    def get_account_password_policy
+      # https://docs.aws.amazon.com/sdkforruby/api/Aws/IAM/Client.html#get_account_password_policy-instance_method
+      @iam.get_account_password_policy.password_policy
+    end
+
+    # Check password policy against an options hash of audit criteria
+    #
+    # Policy format - Array of checks
+    # example input: [{ key: "minimum_password_length", operator: "GT", value: 15 }]
+    # example output: [{ key: "minimum_password_length", passes: true }]
+    # @param [Array<Hash>] Policy against which to audit
+    # @return [Array<Hash>] Results of each audit check
+    # rubocop:disable Metrics/CyclomaticComplexity
+    # disable complexity check here - doesn't seem worth breaking this function up
+    def audit_password_policy(audit_criteria = [])
+      policy_hash = get_account_password_policy.to_h
+
+      audit_array = []
+      audit_criteria.each do |check|
+        case check[:operator]
+        when 'EQ'
+          audit_array << {
+            key: check[:key],
+            passes: policy_hash[check[:key].to_sym].nil? ? false : policy_hash[check[:key].to_sym] == check[:value]
+          }
+        when 'LTE'
+          audit_array << {
+            key: check[:key],
+            passes: policy_hash[check[:key].to_sym].nil? ? false : policy_hash[check[:key].to_sym] <= check[:value]
+          }
+        when 'GTE'
+          audit_array << {
+            key: check[:key],
+            passes: policy_hash[check[:key].to_sym].nil? ? false : policy_hash[check[:key].to_sym] >= check[:value]
+          }
+        else
+          raise UnknownComparisonOperatorError.new, "Unknown operator #{check[:operator]}"
+        end
+      end
+
+      audit_array
+    end
+    # rubocop:enable Metrics/CyclomaticComplexity
+
+    # Get SAML providers configured for this account
+    # @return [Array<Hash>] Array of hashes in form { arn: <String>, metadata: <String> }
+    def get_saml_providers
+      # https://docs.aws.amazon.com/sdkforruby/api/Aws/IAM/Client.html#list_saml_providers-instance_method
+      # returns https://docs.aws.amazon.com/sdkforruby/api/Aws/IAM/Types/SAMLProviderListEntry.html
+      # https://docs.aws.amazon.com/sdkforruby/api/Aws/IAM/Client.html#get_saml_provider-instance_method
+
+      provider_array = []
+      @iam.list_saml_providers.saml_provider_list.each do |provider|
+        provider_array << {
+          arn: provider.arn,
+          saml_metadata_document: @iam.get_saml_provider(saml_provider_arn: provider.arn).saml_metadata_document
+        }
+      end
+
+      provider_array
+    end
+
+    # Is the Cornell SAML Identity Provider configured on this account?
+    # @return [Boolean]
+    def cornell_provider_configured?
+      get_saml_providers.select { |provider| provider[:saml_metadata_document].include? CORNELL_SAML_X509 }.any?
+    end
+
+    # Get users that are configured on this account
+    # @return [Array<Hash>] Array of user hashes - base user type + added lookups for convenience
+    def get_users
+      # https://docs.aws.amazon.com/sdkforruby/api/Aws/IAM/Client.html#list_users-instance_method
+      user_array = []
+      @iam.list_users.users.each do |user|
+        user_array << {
+          base_data: user, # https://docs.aws.amazon.com/sdkforruby/api/Aws/IAM/Types/User.html
+          has_password: user_has_password?(user.user_name)
+        }
+      end
+      user_array
+    end
+
+    # Does this user have a password configured?
+    # @param [String] Username
+    # @return [Boolean]
+    def user_has_password?(user_name)
+      # https://docs.aws.amazon.com/sdkforruby/api/Aws/IAM/Client.html#get_login_profile-instance_method
+      password = true
+
+      begin
+        @iam.get_login_profile(user_name: user_name)
+      rescue Aws::IAM::Errors::NoSuchEntity
+        password = false
+      end
+
+      password
+    end
+
+    # Get access keys for user
+    # @param [String] Username
+    # @return [Array<Hash>] Array of key hashes - base key data + helper calculations for key age and active/inactive
+    def get_user_access_keys(user_name)
+      # https://docs.aws.amazon.com/sdkforruby/api/Aws/IAM/Client.html#list_access_keys-instance_method
+      keys = []
+      @iam.list_access_keys(user_name: user_name).access_key_metadata.each do |key|
+        keys << {
+          base_data: key,
+          active: key.status == 'Active',
+          days_old: (Time.now - key.create_date).to_i / (24 * 60 * 60)
+        }
+      end
+
+      keys
+    end
+
+    # Get active access keys on account that are older than specified age (in days)
+    # @param [Integer] Days old
+    # @return [Array<Hash>]
+    def get_active_keys_older_than_n_days(n)
+      keys = []
+      get_users.each do |user|
+        keys << get_user_access_keys(user[:base_data].user_name).select { |k| k[:days_old] > n && k[:active] }
+      end
+
+      keys.flatten
+    end
+  end
+end

data/lib/cucloud/ssm_utils.rb

@@ -0,0 +1,20 @@
+module Cucloud
+  # SSMUtils class - for interacting with the simple server management service
+  class SSMUtils
+    def initialize(ssm_client = Aws::SSM::Client.new)
+      @ssm = ssm_client
+    end
+
+    def send_patch_command(patch_instances, command)
+      @ssm.send_command(
+        instance_ids: patch_instances, # required
+        document_name: 'AWS-RunShellScript', # required
+        timeout_seconds: 600,
+        comment: 'Patch It!',
+        parameters: {
+          'commands' => [command]
+        }
+      )
+    end
+  end
+end

data/lib/cucloud/version.rb

@@ -1,5 +1,5 @@
 module Cucloud
   # Disable mutable constant warning - freezing this oddly breaks bundler
   # rubocop:disable Style/MutableConstant
-  VERSION = '0.2.0'
+  VERSION = '0.3.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cucloud
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - sbower
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-07-13 00:00:00.000000000 Z
+date: 2016-07-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk
@@ -54,6 +54,20 @@ dependencies:
     - - ~>
       - !ruby/object:Gem::Version
         version: '1.11'
+- !ruby/object:Gem::Dependency
+  name: coveralls
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -110,9 +124,9 @@ dependencies:
     - - ~>
       - !ruby/object:Gem::Version
         version: 0.9.0
-description: The cucloud module is intended to provide functionality requiring more
-  customization than could otherwise be simply accomplished with a cloud specific
-  command line interface, e.g. AWS CLI
+description: The cucloud module is intended to serve as a lightweight wrapper around
+  the AWS SDK that can be used to share common functionality across various AWS utilities
+  and tools that we develop at Cornell
 email:
 - shawn.bower@gmail.com
 - bmh67@cornell.edu
@@ -137,6 +151,8 @@ files:
 - lib/cucloud/asg_utils.rb
 - lib/cucloud/ec2_utils.rb
 - lib/cucloud/elb_utils.rb
+- lib/cucloud/iam_utils.rb
+- lib/cucloud/ssm_utils.rb
 - lib/cucloud/version.rb
 homepage: https://github.com/CU-CloudCollab/cucloud_ruby
 licenses: []
@@ -160,7 +176,7 @@ rubyforge_project:
 rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
-summary: The cucloud module is intended to provide functionality requiring more customization
-  than could otherwise be simply accomplished with a cloud specific command line interface,
-  e.g. AWS CLI
+summary: The cucloud module is intended to serve as a lightweight wrapper around the
+  AWS SDK that can be used to share common functionality across various AWS utilities
+  and tools that we develop at Cornell
 test_files: []