s3-secure 0.4.2 → 0.5.0

data/lib/s3_secure/help/lifecycle/remove.md

@@ -0,0 +1,5 @@
+## Examples
+
+    $ s3-secure lifecycle remove a-test-bucket-in-us-east-1
+    Removed the s3-secure-automated-cleanup lifecycle rule on bucket a-test-bucket-in-us-east-1
+    $

data/lib/s3_secure/help/lifecycle/show.md

@@ -0,0 +1,13 @@
+## Examples
+
+    $ s3-secure lifecycle show a-test-bucket-in-us-east-1
+    This S3 bucket has lifecycle rules
+    Bucket lifecycle details:
+    {:rules=>
+      [{:expiration=>{:expired_object_delete_marker=>true},
+        :id=>"s3-secure-automated-cleanup",
+        :prefix=>"/bar",
+        :status=>"Enabled",
+        :noncurrent_version_expiration=>{:noncurrent_days=>365},
+        :abort_incomplete_multipart_upload=>{:days_after_initiation=>30}}]}
+    $

data/lib/s3_secure/help/policy/list.md

@@ -0,0 +1,5 @@
+## Examples
+
+    s3-secure policy list             # shows all buckets with and without polices
+    s3-secure policy list --policy    # only shows buckets with policy
+    s3-secure policy list --no-policy # only shows buckets without policy

data/lib/s3_secure/lifecycle.rb

@@ -0,0 +1,31 @@
+module S3Secure
+  class Lifecycle < Command
+    desc "list", "List bucket lifecycles"
+    long_desc Help.text("lifecycle/list")
+    option :format, desc: "Format options: #{CliFormat.formats.join(', ')}"
+    option :lifecycle, desc: "Filter for lifecycle: all, true, false"
+    def list
+      List.new(options).run
+    end
+
+    desc "show BUCKET", "show bucket lifecycle"
+    long_desc Help.text("lifecycle/show")
+    def show(bucket)
+      Show.new(options.merge(bucket: bucket)).run
+    end
+
+    desc "add BUCKET", "add bucket lifecycle"
+    long_desc Help.text("lifecycle/add")
+    option :additive, type: :boolean, desc: "Force adding another lifecycle rule even if one exists. Note, may fail, need a different prefix filter"
+    option :prefix, desc: "Filter prefix. Used with additive mode."
+    def add(bucket)
+      Add.new(options.merge(bucket: bucket)).run
+    end
+
+    desc "remove BUCKET", "remove bucket lifecycle"
+    long_desc Help.text("lifecycle/remove")
+    def remove(bucket)
+      Remove.new(options.merge(bucket: bucket)).run
+    end
+  end
+end

data/lib/s3_secure/lifecycle/add.rb

@@ -0,0 +1,33 @@
+class S3Secure::Lifecycle
+  class Add < Base
+    RULE_ID = Base::RULE_ID
+
+    def run
+      show = Show.new(@options)
+      if @options[:additive]
+        current_rules = show.get_lifecycle_rules(@bucket)
+        builder = Builder.new(current_rules)
+        rules = builder.rules_with_addition(@options[:prefix])
+        if current_rules.size == rules.size
+          puts "WARN: rule wasnt added because a #{RULE_ID} already exists".color(:yellow)
+        else
+          s3.put_bucket_lifecycle_configuration(
+            bucket: @bucket, # required
+            lifecycle_configuration: {rules: rules}
+          )
+        end
+      elsif show.any?
+        puts "Bucket #{@bucket} is has a lifecycle policy already."
+        return
+      else
+        options = {
+          bucket: @bucket, # required
+          lifecycle_configuration: {rules: [Builder::DEFAULT_RULE]}
+        }
+        s3.put_bucket_lifecycle_configuration(options)
+      end
+
+      puts "Added lifecycle policy to bucket #{@bucket}"
+    end
+  end
+end

data/lib/s3_secure/lifecycle/base.rb

@@ -0,0 +1,5 @@
+class S3Secure::Lifecycle
+  class Base < S3Secure::AbstractBase
+    RULE_ID = "s3-secure-automated-cleanup"
+  end
+end

data/lib/s3_secure/lifecycle/builder.rb

@@ -0,0 +1,47 @@
+class S3Secure::Lifecycle
+  class Builder
+    # Note: put_bucket_lifecycle_configuration and put_bucket_lifecycle understand different payloads.
+    # put_bucket_lifecycle is old and shouldnt be used
+    RULE_ID = Base::RULE_ID
+    DEFAULT_RULE = {
+      expiration: {expired_object_delete_marker: true},
+      id: RULE_ID,
+      status: "Enabled",
+      prefix: "",
+      noncurrent_version_expiration: {noncurrent_days: 365},
+      abort_incomplete_multipart_upload: {days_after_initiation: 30}
+    }
+
+    def initialize(rules)
+      @rules = rules || []
+    end
+
+    def has?(id)
+      !!@rules.detect { |rule| rule[:id] == id }
+    end
+
+    def rules_with_addition(prefix=nil)
+      rules = @rules.dup
+      unless has?(RULE_ID)
+        rule = DEFAULT_RULE
+        rule[:prefix] = prefix if prefix
+        rules << rule
+      end
+      rules
+    end
+
+    def rules_with_removal
+      rules = @rules.dup
+      rules.delete_if { |rule| rule[:id] == RULE_ID }
+      rules
+    end
+
+    def build(type)
+      if type == :remove
+        remove_lifecycle
+      else
+        add_lifecycle
+      end
+    end
+  end
+end

data/lib/s3_secure/lifecycle/list.rb

@@ -0,0 +1,24 @@
+class S3Secure::Lifecycle
+  class List < Base
+    def run
+      presenter = CliFormat::Presenter.new(@options)
+      presenter.header = ["Bucket", "Has Lifecycle Rules?"]
+
+      buckets.each do |bucket|
+        $stderr.puts "Getting lifecycle policy for bucket #{bucket.color(:green)}"
+
+        show = Show.new(bucket: bucket)
+        row = [bucket, show.any?]
+        if @options[:lifecycle].nil?
+          presenter.rows << row # always show policy
+        elsif @options[:lifecycle]
+          presenter.rows << row if status # only show if bucket has some encryption rules
+        else
+          presenter.rows << row unless status # only show if bucket doesnt have any encryption rules
+        end
+      end
+
+      presenter.show
+    end
+  end
+end

data/lib/s3_secure/lifecycle/remove.rb

@@ -0,0 +1,28 @@
+class S3Secure::Lifecycle
+  class Remove < Base
+    RULE_ID = Base::RULE_ID
+
+    def run
+      show = Show.new(@options)
+      unless show.has?(RULE_ID)
+        puts "Bucket #{@bucket} already does not have the #{RULE_ID} lifecycle rule."
+        return
+      end
+
+      builder = Builder.new(show.get_lifecycle_rules(@bucket))
+      rules = builder.rules_with_removal
+      if rules.empty?
+        s3.delete_bucket_lifecycle(bucket: @bucket)
+      else
+        # update config with removal
+        s3.put_bucket_lifecycle_configuration(
+          bucket: @bucket, # required
+          # content_md5: "ContentMD5",
+          lifecycle_configuration: {rules: rules}
+        )
+      end
+
+      puts "Removed the #{RULE_ID} lifecycle rule on bucket #{@bucket}"
+    end
+  end
+end

data/lib/s3_secure/lifecycle/show.rb

@@ -0,0 +1,40 @@
+class S3Secure::Lifecycle
+  class Show < Base
+    RULE_ID = Base::RULE_ID
+
+    def run
+      if any?
+        puts "This S3 bucket has lifecycle rules"
+      else
+        puts "This S3 bucket does not have lifecycle rules"
+      end
+
+      if any?
+        puts "Bucket lifecycle details: "
+        pp get_lifecycle(@bucket).to_h
+      end
+    end
+
+    def any?
+      rules = get_lifecycle_rules(@bucket)
+      !!(rules && !rules.empty?)
+    end
+
+    def has?(rule_id)
+      rules = get_lifecycle_rules(@bucket)
+      rules && rules.detect { |rule| rule[:id] == rule_id }
+    end
+
+    def get_lifecycle(bucket)
+      s3.get_bucket_lifecycle_configuration(bucket: bucket) # resp
+    rescue Aws::S3::Errors::NoSuchLifecycleConfiguration
+    end
+    memoize :get_lifecycle
+
+    # Also used by add and remove
+    def get_lifecycle_rules(bucket)
+      resp = get_lifecycle(bucket)
+      resp.rules.map(&:to_h) if resp
+    end
+  end
+end

data/lib/s3_secure/policy.rb

@@ -2,6 +2,8 @@ module S3Secure
   class Policy < Command
     desc "list", "List bucket policies"
     long_desc Help.text("policy/list")
+    option :format, desc: "Format options: #{CliFormat.formats.join(', ')}"
+    option :policy, type: :boolean, desc: "Filter for policy: all, true, false"
     def list
       List.new(options).run
     end

data/lib/s3_secure/policy/enforce.rb

@@ -6,12 +6,9 @@ class S3Secure::Policy
     end
 
     def run
-      @s3 = s3_regional_client(@bucket)
+      show = S3Secure::Policy::Show.new(@options)
 
-      list = S3Secure::Policy::List.new(@options)
-      list.set_s3(@s3)
-
-      bucket_policy = list.get_policy(@bucket)
+      bucket_policy = show.policy
       document = Document.new(@bucket, bucket_policy)
       if document.has?(@sid)
         puts "Bucket policy for #{@bucket} has ForceSSLOnlyAccess policy statement already:"
@@ -24,7 +21,7 @@ class S3Secure::Policy
         #    put_bucket_policy returns #<struct Aws::EmptyStructure>
         #
         policy_document = document.policy_document(@sid)
-        @s3.put_bucket_policy(
+        s3.put_bucket_policy(
           bucket: @bucket,
           policy: policy_document,
         )

data/lib/s3_secure/policy/list.rb

@@ -1,29 +1,25 @@
 class S3Secure::Policy
   class List < Base
     def run
+      presenter = CliFormat::Presenter.new(@options)
+      presenter.header = ["Bucket", "Has Policy?"]
+
       buckets.each do |bucket|
-        @s3 = s3_regional_client(bucket)
-        puts "Policy for bucket #{bucket.color(:green)}"
-        policy = get_policy(bucket)
+        $stderr.puts "Getting policy for bucket #{bucket.color(:green)}"
+        show = Show.new(bucket: bucket)
+        policy = show.policy
 
-        if policy
-          puts policy
+        row = [bucket, !!policy]
+        if @options[:policy].nil?
+          presenter.rows << row # always show policy
+        elsif @options[:policy]
+          presenter.rows << row if policy # only show if bucket has a policy
         else
-          puts "Bucket does not have a bucket policy"
+          presenter.rows << row unless policy # only show if bucket doesnt have a policy
         end
       end
-    end
-
-    def get_policy(bucket)
-      resp = @s3.get_bucket_policy(bucket: bucket)
-      data = JSON.load(resp.policy.read) # String
-      JSON.pretty_generate(data)
-    rescue Aws::S3::Errors::NoSuchBucketPolicy
-    end
 
-    # Useful when calling List outside of the list CLI
-    def set_s3(client)
-      @s3 = client
+      presenter.show
     end
   end
 end

data/lib/s3_secure/policy/show.rb

@@ -1,12 +1,6 @@
 class S3Secure::Policy
   class Show < Base
     def run
-      @s3 = s3_regional_client(@bucket)
-
-      list = S3Secure::Policy::List.new(@options)
-      list.set_s3(@s3)
-
-      policy = list.get_policy(@bucket)
       if policy
         puts "Bucket #{@bucket} is configured with this policy:"
         puts policy
@@ -15,5 +9,13 @@ class S3Secure::Policy
         puts "Bucket #{@bucket} is not configured bucket policy"
       end
     end
+
+    def policy
+      resp = s3.get_bucket_policy(bucket: @bucket)
+      data = JSON.load(resp.policy.read) # String
+      JSON.pretty_generate(data)
+    rescue Aws::S3::Errors::NoSuchBucketPolicy
+    end
+    memoize :policy
   end
 end

data/lib/s3_secure/policy/unforce.rb

@@ -6,12 +6,9 @@ class S3Secure::Policy
     end
 
     def run
-      @s3 = s3_regional_client(@bucket)
+      show = S3Secure::Policy::Show.new(@options)
 
-      list = S3Secure::Policy::List.new(@options)
-      list.set_s3(@s3)
-
-      bucket_policy = list.get_policy(@bucket)
+      bucket_policy = show.policy
       document = Document.new(@bucket, bucket_policy, remove: true)
       if document.has?(@sid)
         # Set encryption rules
@@ -23,12 +20,12 @@ class S3Secure::Policy
         policy_document = document.policy_document(@sid)
 
         if policy_document
-          @s3.put_bucket_policy(
+          s3.put_bucket_policy(
             bucket: @bucket,
             policy: policy_document,
           )
         else
-          @s3.delete_bucket_policy(bucket: @bucket)
+          s3.delete_bucket_policy(bucket: @bucket)
         end
 
         puts "Remove bucket policy statement from bucket #{@bucket}:"

data/lib/s3_secure/remediate_all.rb

@@ -0,0 +1,11 @@
+module S3Secure
+  class RemediateAll < AbstractBase
+    def run
+      Encryption::Enable.new(bucket: @bucket).run
+      Policy::Enforce.new(bucket: @bucket, sid: "ForceSSLOnlyAccess").run
+      Versioning::Enable.new(bucket: @bucket).run
+      Lifecycle::Add.new(bucket: @bucket).run
+      AccessLogs::Enable.new(bucket: @bucket).run
+    end
+  end
+end

data/lib/s3_secure/summary/items.rb

@@ -44,9 +44,7 @@ class S3Secure::Summary
 
   private
     def ssl?(bucket)
-      s3 = s3_regional_client(bucket)
       list = S3Secure::Policy::List.new(@options)
-      list.set_s3(s3)
 
       bucket_policy = list.get_policy(bucket)
       document = S3Secure::Policy::Document.new(bucket, bucket_policy)

data/lib/s3_secure/version.rb

@@ -1,3 +1,3 @@
 module S3Secure
-  VERSION = "0.4.2"
+  VERSION = "0.5.0"
 end

data/lib/s3_secure/versioning.rb

@@ -0,0 +1,29 @@
+module S3Secure
+  class Versioning < Command
+    desc "list", "List bucket versionings"
+    long_desc Help.text("versioning/list")
+    option :format, desc: "Format options: #{CliFormat.formats.join(', ')}"
+    option :versioning, desc: "Filter for versioning: all, true, false"
+    def list
+      List.new(options).run
+    end
+
+    desc "show BUCKET", "show bucket versioning"
+    long_desc Help.text("versioning/show")
+    def show(bucket)
+      Show.new(options.merge(bucket: bucket)).run
+    end
+
+    desc "enable BUCKET", "enable bucket versioning"
+    long_desc Help.text("versioning/enable")
+    def enable(bucket)
+      Enable.new(options.merge(bucket: bucket)).run
+    end
+
+    desc "disable BUCKET", "disable bucket versioning"
+    long_desc Help.text("versioning/disable")
+    def disable(bucket)
+      Disable.new(options.merge(bucket: bucket)).run
+    end
+  end
+end

data/lib/s3_secure/versioning/base.rb

@@ -0,0 +1,4 @@
+class S3Secure::Versioning
+  class Base < S3Secure::AbstractBase
+  end
+end