miam 0.2.3 → 0.2.5.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: bb232253b3506a0387caa0817c099a76b0d5ec5f
-  data.tar.gz: e10d873066aef538049bb703bf2977064c1ab586
+SHA256:
+  metadata.gz: b0a35750c70a9a9f30ff1a1482a3da3a66c994e691fa3802b2c54992408415df
+  data.tar.gz: c33e5e326f59da9810b8735620cea049cc619b013b1e3525d86416e44dd91af1
 SHA512:
-  metadata.gz: d07415f6abcf2efa6d0572bf61302ee6d5334cc76f2a7739dbde62cf8b3b0cc0ceece4cf9613bbcc66776e0ad3758bfb5cf75196a286cfe47d95de467f02fa33
-  data.tar.gz: eb2ecd520a5d43173249082dfdb29dd0b31fa36acc254cb356a57b04d9dd2befc4caaae70f4a7376189ffda32395b425195f7f014c0f223501dc1ac96d324f9b
+  metadata.gz: ce11c734155e09c454e913ec7dc2d7ea8eb68cf60b0eb7803f0e01ae5b2469c865172e4a0a87f2e0ebb71d72fe9653b0b009d21a23913a4cd763b0ebbd1e6b72
+  data.tar.gz: e6001cb1c8c03903846f4d936e130f198fec72a695e086ab5ed36a8795be9891bd6f5143f4876b123d7cc5c27e50a846dc20f8a2ce521c66c61ed60546cea6d3

data/.rspec

@@ -1,4 +1,5 @@
 --require rspec/instafail
---format RSpec::Instafail
+--format documentation
+#RSpec::Instafail
 --colour
 --require spec_helper

data/.travis.yml

@@ -1,12 +1,14 @@
 sudo: false
 language: ruby
+cache: bundler
 rvm:
-- 2.0.0
+- 2.3.4
 script:
 - bundle install
-- bundle exec rake
+- travis_wait 60 bundle exec rake
 env:
   global:
-  - secure: "Ec8bwSfp06anSzLJpGhkKjPz9EocMwl7H8t2LKoI3bKV/cz9JU0GhhUdUUmg3mCFH9+8/YGLzcbFKcxZIqnDK7ukdgTGsnGDevnctis0QwM7/nKHdkaK8JWhCx41TUXOqoiCKkNEnm1EbDtrILt4rJwb0BGXGnPjv6nLAyvdE2Y="
-  - secure: "Ky5Dpxc7SIqbQ4Y10m/jik/rVdeGMeh1439m3KB+tiV/Bz1hhWv4+If150ajLjbmWCZBPMLhxrTL0EePoyqYXpOGHvINvYM+/XCPcpP4iYkaTzr1MVIOMpa8A8aAOOgQWoGOwfyWoxfrYzv/TRvtMietnm+dZwVcbbkQ4ut7oa4="
+  - secure: c5kyaYSGrKMg3bsVMCnIYe2w/3jJ4rxkoIwM06YGLmw5lPW0twWgpwpuBsGf6WKvDLv0eQjGq3B0I1DqHmdYHq4dQ+PdsvWg0kQUpzWpKD2ccVXevyPeDs5pC1UcLtDUpRk0Rv1Hpo4v5kiT2zsmLx29Z6F4n7agtzqK5Q2vdPs=
+  - secure: ipdvAzZ5EwTQui8CyINqRYLFNNe4ZyZP617xEmUS3YalhRMOEZ+NSq7BlqliE4IJPg8YlQjT5q35xFtREIr/KYS1tmU1/nFA68GC/9T+uJAsc3LSmUoYMn8Ot3654u1SjlZ86benyToZ2MgHglmHigS46SOoxBpqHrKMUW9RUz0=
   - AWS_REGION=ap-northeast-1
+  - APPLY_WAIT=10

data/README.md

@@ -5,7 +5,7 @@ Miam is a tool to manage IAM.
 It defines the state of IAM using DSL, and updates IAM according to DSL.
 
 [![Gem Version](https://badge.fury.io/rb/miam.svg)](http://badge.fury.io/rb/miam)
-[![Build Status](https://travis-ci.org/winebarrel/miam.svg?branch=master)](https://travis-ci.org/winebarrel/miam)
+[![Build Status](https://travis-ci.org/codenize-tools/miam.svg?branch=master)](https://travis-ci.org/codenize-tools/miam)
 [![Coverage Status](https://coveralls.io/repos/winebarrel/miam/badge.svg?branch=master&service=github)](https://coveralls.io/github/winebarrel/miam?branch=master)
 
 **Notice**
@@ -22,6 +22,12 @@ It defines the state of IAM using DSL, and updates IAM according to DSL.
   * Sort policy array
 * `>= 0.2.3`
   * Support Custom Managed Policy
+* `>= 0.2.4`
+  * Fix for Password Policy ([RP#22](https://github.com/winebarrel/miam/pull/22))
+  * Fix `--target` option for Policies ([RP#21](https://github.com/winebarrel/miam/pull/21))
+  * Fix for `Rate exceeded` ([PR#23](https://github.com/winebarrel/miam/pull/23))
+  * Fix for non-User credentials  ([PR#17](https://github.com/winebarrel/miam/pull/17))
+  * Add `--exclude` option
 
 ## Installation
 
@@ -71,6 +77,7 @@ Usage: miam [options]
         --format=FORMAT
         --export-concurrency N
         --target REGEXP
+        --exclude REGEXP
         --ignore-login-profile
         --no-color
         --no-progress

data/bin/miam

@@ -19,10 +19,11 @@ MAGIC_COMMENT = <<-EOS
 EOS
 
 options = {
-  :dry_run => false,
-  :format  => :ruby,
-  :color   => true,
-  :debug   => false,
+  :dry_run        => false,
+  :format         => :ruby,
+  :color          => true,
+  :debug          => false,
+  :show_backtrace => false
 }
 
 options[:password_manager] = Miam::PasswordManager.new(account_output, options)
@@ -51,11 +52,14 @@ ARGV.options do |opt|
     opt.on(''  , '--split-more')                    {    split                          = :more                                 }
     opt.on('',   '--format=FORMAT', [:ruby, :json]) {|v| format_passed = true; options[:format] = v                             }
     opt.on(''  , '--export-concurrency N', Integer) {|v| options[:export_concurrency]   = v                                     }
-    opt.on(''  , '--target REGEXP')                 {|v| options[:target]               = Regexp.new(v)                         }
+    opt.on(''  , '--target REGEXP')                 {|v| (options[:target] ||= [])     << Regexp.new(v)                         }
+    opt.on(''  , '--exclude REGEXP')                {|v| (options[:exclude] ||= [])    << Regexp.new(v)                         }
     opt.on(''  , '--ignore-login-profile')          {    options[:ignore_login_profile] = true                                  }
+    opt.on(''  , '--no-access-key')                 {    options[:no_access_key] = true                                         }
     opt.on(''  , '--no-color')                      {    options[:color]                = false                                 }
     opt.on(''  , '--no-progress')                   {    options[:no_progress]          = true                                  }
     opt.on(''  , '--debug')                         {    options[:debug]                = true                                  }
+    opt.on(''  , '--show-backtrace')                {    options[:show_backtrace]       = true                                  }
     opt.parse!
 
     aws_opts = {}
@@ -184,6 +188,7 @@ rescue => e
     raise e
   else
     $stderr.puts("[ERROR] #{e.message}".red)
+    $stderr.puts(e.backtrace.map(&:yellow)) if options[:show_backtrace]
     exit 1
   end
 end

data/lib/miam/client.rb

@@ -2,10 +2,14 @@ class Miam::Client
   include Miam::Logger::Helper
 
   def initialize(options = {})
-    @options = {:format => :ruby}.merge(options)
+    @options = {
+      format: :ruby,
+      exclude: []
+    }.merge(options)
     aws_config = options.delete(:aws_config) || {}
     @iam = Aws::IAM::Client.new(aws_config)
-    @driver = Miam::Driver.new(@iam, options)
+    @sts = Aws::STS::Client.new(aws_config)
+    @driver = Miam::Driver.new(@iam, @sts, options)
     @password_manager = options[:password_manager] || Miam::PasswordManager.new('-', options)
   end
 
@@ -57,6 +61,7 @@ class Miam::Client
 
   def walk(file)
     expected = load_file(file)
+    @options[:exclude] += expected[:exclude]
 
     actual, group_users, instance_profile_roles = Miam::Exporter.export(@iam, @options)
     updated = pre_walk_managed_policies(expected[:policies], actual[:policies])
@@ -86,7 +91,7 @@ class Miam::Client
         updated = walk_user(user_name, expected_attrs, actual_attrs) || updated
       else
         actual_attrs = @driver.create_user(user_name, expected_attrs)
-        access_key = @driver.create_access_key(user_name)
+        access_key = @driver.create_access_key(user_name) unless @options[:no_access_key]
 
         if access_key
           @password_manager.puts_password(user_name, access_key[:access_key_id], access_key[:secret_access_key])
@@ -129,7 +134,7 @@ class Miam::Client
     end
 
     if expected_login_profile and not actual_login_profile
-      expected_login_profile[:password] ||= @password_manager.identify(user_name, :login_profile)
+      expected_login_profile[:password] ||= @password_manager.identify(user_name, :login_profile, @driver.password_policy)
       @driver.create_login_profile(user_name, expected_login_profile)
       updated = true
     elsif not expected_login_profile and actual_login_profile
@@ -137,7 +142,7 @@ class Miam::Client
       updated = true
     elsif expected_login_profile != actual_login_profile
       if @options[:ignore_login_profile]
-        log(:warn, "User `#{user_name}`: difference of loging profile has been ignored: expected=#{expected_login_profile.inspect}, actual=#{actual_login_profile.inspect}", :color => :yellow)
+        log(:warn, "User `#{user_name}`: difference of login profile has been ignored: expected=#{expected_login_profile.inspect}, actual=#{actual_login_profile.inspect}", :color => :yellow)
       else
         @driver.update_login_profile(user_name, expected_login_profile, actual_login_profile)
         updated = true
@@ -254,17 +259,45 @@ class Miam::Client
       log(:warn, "Role `#{role_name}`: 'path' cannot be updated", :color => :yellow)
     end
 
-    updated = walk_assume_role_policy(role_name, expected_attrs[:assume_role_policy_document], actual_attrs[:assume_role_policy_document])
+    updated = walk_role_settings(role_name, {max_session_duration: expected_attrs[:max_session_duration]}, {max_session_duration: actual_attrs[:max_session_duration]})
+    updated = walk_assume_role_policy(role_name, expected_attrs[:assume_role_policy_document], actual_attrs[:assume_role_policy_document]) || updated
     updated = walk_role_instance_profiles(role_name, expected_attrs[:instance_profiles], actual_attrs[:instance_profiles]) || updated
     updated = walk_attached_managed_policies(:role, role_name, expected_attrs[:attached_managed_policies], actual_attrs[:attached_managed_policies]) || updated
     walk_policies(:role, role_name, expected_attrs[:policies], actual_attrs[:policies]) || updated
   end
 
+  def walk_role_settings(role_name, expected_settings, actual_settings)
+    updated = false
+
+    if expected_settings != actual_settings
+      @driver.update_role_settings(role_name, expected_settings, actual_settings)
+      updated = true
+    end
+
+    updated
+  end
+
   def walk_assume_role_policy(role_name, expected_assume_role_policy, actual_assume_role_policy)
     updated = false
     expected_assume_role_policy.sort_array!
     actual_assume_role_policy.sort_array!
 
+    # With only one entity granted
+    # On IAM
+    #   (1) Statement => [ { Principal => AWS => arn } ]
+    # Should be able to specify like:
+    #   (2) Statement => [ { Principal => AWS => [arn] } ]
+    # Actually (1) is reflected when config (2) is applied
+    expected_arp_stmt = expected_assume_role_policy.fetch('Statement', [])
+    expected_arp_stmt = expected_arp_stmt.select {|i| i.key?('Principal') }
+
+    expected_arp_stmt.each do |stmt|
+      stmt['Principal'].each do |k, v|
+        entities = Array(v)
+        stmt['Principal'][k] = entities.first if entities.length < 2
+      end
+    end
+
     if expected_assume_role_policy != actual_assume_role_policy
       @driver.update_assume_role_policy(role_name, expected_assume_role_policy, actual_assume_role_policy)
       updated = true
@@ -445,6 +478,7 @@ class Miam::Client
     updated = false
 
     expected.each do |policy_name, expected_attrs|
+      next unless target_matched?(policy_name)
       actual_attrs = actual.delete(policy_name)
 
       if actual_attrs
@@ -452,7 +486,7 @@ class Miam::Client
           log(:warn, "ManagedPolicy `#{policy_name}`: 'path' cannot be updated", :color => :yellow)
         end
 
-        updated = walk_managed_policy(policy_name, expected_attrs[:document], actual_attrs[:document]) || updated
+        updated = walk_managed_policy(policy_name, actual_attrs[:path], expected_attrs[:document], actual_attrs[:document]) || updated
       else
         @driver.create_managed_policy(policy_name, expected_attrs)
         updated = true
@@ -462,13 +496,13 @@ class Miam::Client
     updated
   end
 
-  def walk_managed_policy(policy_name, expected_document, actual_document)
+  def walk_managed_policy(policy_name, policy_path, expected_document, actual_document)
     updated = false
     expected_document.sort_array!
     actual_document.sort_array!
 
     if expected_document != actual_document
-      @driver.update_managed_policy(policy_name, expected_document, actual_document)
+      @driver.update_managed_policy(policy_name, policy_path, expected_document, actual_document)
       updated = true
     end
 
@@ -479,7 +513,8 @@ class Miam::Client
     updated = false
 
     actual.each do |policy_name, actual_attrs|
-      @driver.delete_managed_policy(policy_name)
+      next unless target_matched?(policy_name)
+      @driver.delete_managed_policy(policy_name, actual_attrs[:path])
       updated = true
     end
 
@@ -505,11 +540,17 @@ class Miam::Client
   end
 
   def target_matched?(name)
+    result = true
+
+    if @options[:exclude]
+      result &&= @options[:exclude].all? {|r| name !~ r }
+    end
+
     if @options[:target]
-      name =~ @options[:target]
-    else
-      true
+      result &&= @options[:target].any? {|r| name =~ r}
     end
+
+    result
   end
 
   def exec_by_format(proc_by_format)

data/lib/miam/driver.rb

@@ -4,9 +4,11 @@ class Miam::Driver
   MAX_POLICY_SIZE = 2048
   MAX_POLICY_VERSIONS = 5
 
-  def initialize(iam, options = {})
+  def initialize(iam, sts, options = {})
     @iam = iam
+    @sts = sts
     @options = options
+    @account_id = nil
   end
 
   def create_user(user_name, attrs)
@@ -67,6 +69,14 @@ class Miam::Driver
         @iam.delete_signing_certificate(:user_name => user_name, :certificate_id => certificate_id)
       end
 
+      mfa_devices = @iam.list_mfa_devices(:user_name => user_name).map {|resp|
+        resp.mfa_devices
+      }.flatten
+
+      mfa_devices.each do |md|
+        @iam.deactivate_mfa_device(:user_name => user_name, :serial_number => md.serial_number)
+      end
+
       @iam.delete_user(:user_name => user_name)
     end
   end
@@ -168,6 +178,7 @@ class Miam::Driver
       params = {
         :role_name => role_name,
         :assume_role_policy_document => encode_document(assume_role_policy_document),
+        :max_session_duration => attrs.fetch(:max_session_duration)
       }
 
       params[:path] = attrs[:path] if attrs[:path]
@@ -179,6 +190,7 @@ class Miam::Driver
       :assume_role_policy_document => assume_role_policy_document,
       :policies => {},
       :attached_managed_policies => [],
+      :max_session_duration => attrs.fetch(:max_session_duration),
     }
 
     new_role_attrs[:path] = attrs[:path] if attrs[:path]
@@ -227,6 +239,14 @@ class Miam::Driver
     end
   end
 
+  def update_role_settings(role_name, new_settings, old_settings)
+    log(:info, "Update Role `#{role_name}` > Settings", :color => :green)
+    log(:info, Miam::Utils.diff(old_settings, new_settings, :color => @options[:color]), :color => false)
+    unless_dry_run do
+      @iam.update_role(new_settings.merge(role_name: role_name))
+    end
+  end
+
   def update_assume_role_policy(role_name, policy_document, old_policy_document)
     log(:info, "Update Role `#{role_name}` > AssumeRolePolicy", :color => :green)
     log(:info, Miam::Utils.diff(old_policy_document, policy_document, :color => @options[:color]), :color => false)
@@ -338,7 +358,7 @@ class Miam::Driver
     type_s = type.slice(0, 1).upcase + type.slice(1..-1)
 
     log(:info, "Update #{type_s} `#{name}`", :color => :green)
-    log(:info, "  detach policies=#{policies.join(',')}", :color => :green)
+    log(:info, "  detach policies=#{policies.join(',')}", :color => :red)
 
     unless_dry_run do
       policies.each do |arn|
@@ -377,12 +397,12 @@ class Miam::Driver
     end
   end
 
-  def delete_managed_policy(policy_name)
+  def delete_managed_policy(policy_name, policy_path)
     log(:info, "Delete ManagedPolicy `#{policy_name}`", :color => :red)
 
     unless_dry_run do
       policy_versions = @iam.list_policy_versions(
-        :policy_arn => policy_arn(policy_name),
+        :policy_arn => policy_arn(policy_name, policy_path),
         :max_items => MAX_POLICY_VERSIONS
       )
 
@@ -390,24 +410,24 @@ class Miam::Driver
         pv.is_default_version
       }.each {|pv|
         @iam.delete_policy_version(
-          :policy_arn => policy_arn(policy_name),
+          :policy_arn => policy_arn(policy_name, policy_path),
           :version_id => pv.version_id
         )
       }
 
       @iam.delete_policy(
-        :policy_arn => policy_arn(policy_name)
+        :policy_arn => policy_arn(policy_name, policy_path)
       )
     end
   end
 
-  def update_managed_policy(policy_name, policy_document, old_policy_document)
+  def update_managed_policy(policy_name, policy_path, policy_document, old_policy_document)
     log(:info, "Update ManagedPolicy `#{policy_name}`", :color => :green)
     log(:info, Miam::Utils.diff(old_policy_document, policy_document, :color => @options[:color]), :color => false)
 
     unless_dry_run do
       policy_versions = @iam.list_policy_versions(
-        :policy_arn => policy_arn(policy_name),
+        :policy_arn => policy_arn(policy_name, policy_path),
         :max_items => MAX_POLICY_VERSIONS
       )
 
@@ -417,19 +437,27 @@ class Miam::Driver
         }.sort_by {|pv| pv.version_id[1..-1].to_i }.first
 
         @iam.delete_policy_version(
-          :policy_arn => policy_arn(policy_name),
+          :policy_arn => policy_arn(policy_name, policy_path),
           :version_id => delete_policy_version.version_id
         )
       end
 
       @iam.create_policy_version(
-        :policy_arn => policy_arn(policy_name),
+        :policy_arn => policy_arn(policy_name, policy_path),
         :policy_document => encode_document(policy_document),
         set_as_default: true
       )
     end
   end
 
+  def password_policy
+    return @password_policy if instance_variable_defined?(:@password_policy)
+
+    @password_policy = @iam.get_account_password_policy.password_policy
+  rescue Aws::IAM::Errors::NoSuchEntity
+    @password_policy = nil
+  end
+
   private
 
   def encode_document(policy_document)
@@ -455,11 +483,13 @@ class Miam::Driver
     yield unless @options[:dry_run]
   end
 
-  def user_id
-    @user_id ||= @iam.get_user.user.user_id
+  def account_id
+    # https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
+    # http://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
+    @account_id ||= @sts.get_caller_identity.account
   end
 
-  def policy_arn(policy_name)
-    "arn:aws:iam::#{user_id}:policy/#{policy_name}"
+  def policy_arn(policy_name, policy_path)
+    File.join("arn:aws:iam::#{account_id}:policy", policy_path, policy_name)
   end
 end

data/lib/miam/dsl/context/role.rb

@@ -4,7 +4,7 @@ class Miam::DSL::Context::Role
   def initialize(context, name, &block)
     @role_name = name
     @context = context.merge(:role_name => name)
-    @result = {:instance_profiles => [], :policies => {}, :attached_managed_policies => []}
+    @result = {:instance_profiles => [], :max_session_duration => 3600, :policies => {}, :attached_managed_policies => []}
     instance_eval(&block)
   end
 
@@ -22,6 +22,10 @@ class Miam::DSL::Context::Role
     @result[:instance_profiles].concat(profiles.map(&:to_s))
   end
 
+  def max_session_duration(duration)
+    @result[:max_session_duration] = duration
+  end
+
   def assume_role_policy_document
     if @result[:assume_role_policy_document]
       raise "Role `#{@role_name}` > AssumeRolePolicyDocument: already defined"

data/lib/miam/dsl/context.rb

@@ -12,7 +12,7 @@ class Miam::DSL::Context
   def initialize(path, options = {}, &block)
     @path = path
     @options = options
-    @result = {:users => {}, :groups => {}, :roles => {}, :instance_profiles => {}, :policies => {}}
+    @result = {:users => {}, :groups => {}, :roles => {}, :instance_profiles => {}, :policies => {}, :exclude => []}
 
     @context = Hashie::Mash.new(
       :path => path,
@@ -41,6 +41,10 @@ class Miam::DSL::Context
     end
   end
 
+  def exclude(pattern)
+    @result[:exclude] << pattern
+  end
+
   def user(name, user_options = {}, &block)
     name = name.to_s
 

data/lib/miam/dsl/converter.rb

@@ -95,6 +95,8 @@ end
 role #{role_name.inspect}, #{Miam::Utils.unbrace(role_options.inspect)} do
   #{output_role_instance_profiles(attrs[:instance_profiles])}
 
+  #{output_role_max_session_duration(attrs[:max_session_duration])}
+
   #{output_assume_role_policy_document(attrs[:assume_role_policy_document])}
 
   #{output_policies(attrs[:policies])}
@@ -122,6 +124,12 @@ end
     }.select {|i| i }.join("\n")
   end
 
+  def output_role_max_session_duration(max_session_duration)
+    <<-EOS.strip
+      max_session_duration #{max_session_duration}
+    EOS
+  end
+
   def output_assume_role_policy_document(assume_role_policy_document)
     assume_role_policy_document = assume_role_policy_document.pretty_inspect
     assume_role_policy_document.gsub!("\n", "\n    ").strip!
@@ -193,10 +201,16 @@ end
   end
 
   def target_matched?(name)
+    result = true
+
+    if @options[:exclude]
+      result &&= @options[:exclude].all? {|r| name !~ r}
+    end
+
     if @options[:target]
-      name =~ @options[:target]
-    else
-      true
+      result &&= @options[:target].any? {|r| name =~ r}
     end
+
+    result
   end
 end

data/lib/miam/exporter.rb

@@ -1,6 +1,7 @@
 # coding: utf-8
 class Miam::Exporter
   AWS_MANAGED_POLICY_PREFIX = 'arn:aws:iam::aws:'
+  AWS_CN_MANAGED_POLICY_PREFIX = 'arn:aws-cn:iam::aws:'
 
   def self.export(iam, options = {})
     self.new(iam, options).export
@@ -143,6 +144,8 @@ class Miam::Exporter
       instance_profiles = role.instance_profile_list.map {|i| i.instance_profile_name }
       policies = export_role_policies(role)
       attached_managed_policies = role.attached_managed_policies.map(&:policy_arn)
+      role_data = @iam.get_role(role_name: role_name).role
+      max_session_duration = role_data.max_session_duration
 
       @mutex.synchronize do
         instance_profiles.each do |instance_profile_name|
@@ -158,6 +161,7 @@ class Miam::Exporter
           :instance_profiles => instance_profiles,
           :policies => policies,
           :attached_managed_policies => attached_managed_policies,
+          :max_session_duration => max_session_duration,
         }
 
         progress
@@ -200,7 +204,7 @@ class Miam::Exporter
     result = {}
 
     Parallel.each(policies, :in_threads => @concurrency) do |policy|
-      if policy.arn.start_with?(AWS_MANAGED_POLICY_PREFIX)
+      if policy.arn.start_with?(AWS_MANAGED_POLICY_PREFIX) or policy.arn.start_with?(AWS_CN_MANAGED_POLICY_PREFIX)
         next
       end
 
@@ -262,10 +266,10 @@ class Miam::Exporter
     @iam.get_account_authorization_details.each do |resp|
       keys.each do |key|
         account_authorization_details[key].concat(resp[key])
+      end
 
-        unless @options[:no_progress]
-          progressbar.increment
-        end
+      unless @options[:no_progress]
+        progressbar.increment
       end
     end
 

data/lib/miam/password_manager.rb

@@ -1,13 +1,19 @@
 class Miam::PasswordManager
   include Miam::Logger::Helper
 
+  LOWERCASES = ('a'..'z').to_a
+  UPPERCASES = ('A'..'Z').to_a
+  NUMBERS = ('0'..'9').to_a
+  SYMBOLS = "!@\#$%^&*()_+-=[]{}|'".split(//)
+
   def initialize(output, options = {})
     @output = output
     @options = options
   end
 
-  def identify(user, type)
-    password = mkpasswd
+  def identify(user, type, policy)
+    password = mkpasswd(policy)
+    log(:debug, "mkpasswd: #{password}")
     puts_password(user, type, password)
     password
   end
@@ -22,8 +28,21 @@ class Miam::PasswordManager
 
   private
 
-  def mkpasswd(len = 8)
-    [*1..9, *'A'..'Z', *'a'..'z'].shuffle.slice(0, len).join
+  def mkpasswd(policy)
+    chars = []
+    len = 8
+
+    if policy
+      len = policy.minimum_password_length if policy.minimum_password_length > len
+      chars << LOWERCASES.shuffle.first if policy.require_lowercase_characters
+      chars << UPPERCASES.shuffle.first if policy.require_uppercase_characters
+      chars << NUMBERS.shuffle.first if policy.require_numbers
+      chars << SYMBOLS.shuffle.first if policy.require_symbols
+
+      len -= chars.length
+    end
+
+    (chars + [*1..9, *'A'..'Z', *'a'..'z'].shuffle.slice(0, len)).shuffle.join
   end
 
   def open_output

data/lib/miam/template_helper.rb

@@ -1,6 +1,8 @@
 module Miam
   module TemplateHelper
     def include_template(template_name, context = {})
+      @template_name = template_name
+      @caller = caller[0]
       tmplt = @context.templates[template_name.to_s]
 
       unless tmplt
@@ -16,5 +18,14 @@ module Miam
     def context
       @context
     end
+
+    def required(*args)
+      missing_args = args.map(&:to_s) - @context.keys.map(&:to_s)
+      unless missing_args.empty?
+        ex = ArgumentError.new("Missing arguments: [#{missing_args.join(", ")}] in template: '#{@template_name}'")
+        ex.set_backtrace(@caller)
+        raise ex
+      end
+    end
   end
 end

data/lib/miam/version.rb

@@ -1,3 +1,3 @@
 module Miam
-  VERSION = '0.2.3'
+  VERSION = '0.2.5.beta1'
 end

data/lib/miam.rb

@@ -5,7 +5,7 @@ require 'pp'
 require 'singleton'
 require 'thread'
 
-require 'aws-sdk-core'
+require 'aws-sdk-iam'
 Aws.use_bundled_cert!
 
 require 'ruby-progressbar'

data/miam.gemspec

@@ -8,11 +8,9 @@ Gem::Specification.new do |spec|
   spec.version       = Miam::VERSION
   spec.authors       = ['Genki Sugawara']
   spec.email         = ['sgwr_dts@yahoo.co.jp']
-  spec.summary       = %q{TODO: Write a short summary. Required.}
-  spec.description   = %q{TODO: Write a longer description. Optional.}
   spec.summary       = %q{Miam is a tool to manage IAM.}
   spec.description   = %q{Miam is a tool to manage IAM. It defines the state of IAM using DSL, and updates IAM according to DSL.}
-  spec.homepage      = 'http://miam.codenize.tools/'
+  spec.homepage      = 'https://github.com/codenize-tools/miam'
   spec.license       = 'MIT'
 
   spec.files         = `git ls-files -z`.split("\x0")
@@ -20,7 +18,7 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ['lib']
 
-  spec.add_dependency 'aws-sdk-core', '>= 2.0.42'
+  spec.add_dependency 'aws-sdk-iam', '~> 1'
   spec.add_dependency 'ruby-progressbar'
   spec.add_dependency 'parallel'
   spec.add_dependency 'term-ansicolor'
@@ -31,4 +29,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'rspec', '>= 3.0.0'
   spec.add_development_dependency 'rspec-instafail'
   spec.add_development_dependency 'coveralls'
+  spec.add_development_dependency 'nokogiri'
 end