subiam 1.2.1 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5f32814fa2db9f3e157767104fe4da0752b40120
-  data.tar.gz: 677bf6d1e8fdbf6b0a9e13e7527add9ad8f8b69d
+  metadata.gz: 9e9c53dfa71f2d449b85caa531f6d97915c6413b
+  data.tar.gz: c73ef382a5339c7d728ebf2c28a4cfdfe96ef4da
 SHA512:
-  metadata.gz: e3cc7e53244ab488c971c4f7ff583db303889cb76e951e2254174642e3a16d9663f7a009569e595101b397293fa4e9e3835236b2c055f2d4880f9f17c6ddd5f9
-  data.tar.gz: 6c74f7af2951620201979b7f16551724c95c8df036b47f76f8896ad0845310c7beb257b6c8ca1ad214c5f8da9017efab3989486bec2208800d9d51b8e20f3f00
+  metadata.gz: 2e9b69459246c5e88d7980df906f8424069eb6cc40481115d88585e5d771ed988bca742722721c1b6c1caeb0e7708e605788ec469e1407f379ad34fc3f4d2373
+  data.tar.gz: bbfcdf2e17ca809dcb682e24074c152c1dc1d9a0d1885ba3cce57f89c3784fe42f80b3acfddf0230b71de2c288e95b5846185625b8764189606f4f39f569e655

data/README.md

@@ -7,6 +7,9 @@ It defines the state of IAM using DSL, and updates IAM according to DSL.
 It's forked from Miam. Miam is designed to manage all IAM entities in the AWS account. Subiam is not so. Subiam is designed to manage sub part of IAM entities in the AWS account. For example around MySQL instances / around web servers / around lambda functions / around monitoring systems.
 
 **Notice**
+* `>= 1.3.0`
+  * Specify default region: `ap-northeast-1`. User does't have to specify region unless using isolated AWS region like GovCloud.
+
 * `>= 1.2.0`
   * Add helper methods: `arn_policy_by_aws`, `arn_policy_by_current_account`
 
@@ -41,7 +44,6 @@ Or install it yourself as:
 ```sh
 export AWS_ACCESS_KEY_ID='...'
 export AWS_SECRET_ACCESS_KEY='...'
-export AWS_REGION='us-east-1'
 vi subiam-xxx.rb
 subiam -a --dry-run subiam-xxx.rb
 subiam -a subiam-xxx.rb
@@ -55,22 +57,24 @@ Usage: subiam [options]
         --credentials-path PATH
     -k, --access-key ACCESS_KEY
     -s, --secret-key SECRET_KEY
-    -r, --region REGION
+    -r, --region REGION              default: ap-northeast-1
     -a, --apply
-    -f, --file FILE
+    -f, --file FILE                  Specify the file path to apply.
         --dry-run
         --account-output FILE
     -e, --export
-    -o, --output FILE
+    -o, --output FILE                Specify the file path to export current IAM settings.
         --split
         --split-more
-        --format=FORMAT
+        --format FORMAT
+                                     ruby or json. (default: ruby)
         --export-concurrency N
         --ignore-login-profile
         --no-color
         --no-progress
         --debug
         --enable-delete
+                                     Enable to delete top level elements. (default: false)
 ```
 
 ## IAM definition files example
@@ -144,47 +148,28 @@ template "ec2-assume-role-attrs" do
 end
 ```
 
-
-## Use management policy
-
-```ruby
-user "foo", path: '/' do
-  attached_managed_policies(
-    'arn:aws:iam::0123456789:policy/MyPolicy',
-
-    arn_policy_by_current_account("MyPolicy2"),
-    # == "arn:aws:iam::0123456789:policy/MyPolicy2'
-
-    arn_policy_by_aws("AdministratorAccess")
-    # == 'arn:aws:iam::aws:policy/AdministratorAccess'
-  )
-end
-```
-
-
----
-old examples (but works if add `target`)
+## General example (User / Group / Role)
 
 ```ruby
 import 'other/iamfile'
 
-target /^monitoring-/
+target /.*/ # managing IAMs whole account
 
-user "monitoring-bob", :path => "/monitoring-user/" do
-  login_profile :password_reset_required=>true
+user "monitoring-bob", path: "/monitoring-user/" do
+  login_profile password_reset_required: true
 
   groups(
     "Admin"
   )
 
   policy "bob-policy" do
-    {"Version"=>"2012-10-17",
-     "Statement"=>
-      [{"Action"=>
+    {Version: "2012-10-17",
+     Statement:
+      [{Action:
          ["s3:Get*",
           "s3:List*"],
-        "Effect"=>"Allow",
-        "Resource"=>"*"}]}
+        Effect: "Allow",
+        Resource: "*"}]}
   end
 
   attached_managed_policies(
@@ -192,31 +177,31 @@ user "monitoring-bob", :path => "/monitoring-user/" do
   )
 end
 
-user "mary", :path => "/staff/" do
-  # login_profile :password_reset_required=>true
+user "mary", path: "/staff/" do
+  # login_profile password_reset_required: true
 
   groups(
     # no group
   )
 
   policy "s3-readonly" do
-    {"Version"=>"2012-10-17",
-     "Statement"=>
-      [{"Action"=>
+    {Version: "2012-10-17",
+     Statement:
+      [{Action:
          ["s3:Get*",
           "s3:List*"],
-        "Effect"=>"Allow",
-        "Resource"=>"*"}]}
+        Effect: "Allow",
+        Resource: "*"}]}
   end
 
   policy "route53-readonly" do
-    {"Version"=>"2012-10-17",
-     "Statement"=>
-      [{"Action"=>
+    {Version: "2012-10-17",
+     Statement:
+      [{Action:
          ["route53:Get*",
           "route53:List*"],
-        "Effect"=>"Allow",
-        "Resource"=>"*"}]}
+        Effect: "Allow",
+        Resource: "*"}]}
   end
 
   attached_managed_policies(
@@ -225,45 +210,43 @@ user "mary", :path => "/staff/" do
   )
 end
 
-group "Admin", :path => "/admin/" do
+group "Admin", path: "/admin/" do
   policy "Admin" do
-    {"Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+    {Statement: [{Effect: "Allow", Action: "*", Resource: "*"}]}
   end
 end
 
-role "S3", :path => "/" do
+role "S3", path: "/" do
   instance_profiles(
     "S3"
   )
 
   assume_role_policy_document do
-    {"Version"=>"2012-10-17",
-     "Statement"=>
-      [{"Sid"=>"",
-        "Effect"=>"Allow",
-        "Principal"=>{"Service"=>"ec2.amazonaws.com"},
-        "Action"=>"sts:AssumeRole"}]}
+    {Version: "2012-10-17",
+     Statement:
+      [{Sid: "",
+        Effect: "Allow",
+        Principal: {Service: "ec2.amazonaws.com"},
+        Action: "sts:AssumeRole"}]}
   end
 
   policy "S3-role-policy" do
-    {"Version"=>"2012-10-17",
-     "Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+    {Version: "2012-10-17",
+     Statement: [{Effect: "Allow", Action: "*", Resource: "*"}]}
   end
 end
 
-instance_profile "S3", :path => "/"
+instance_profile "S3", path: "/"
 ```
 
 ## Rename
 
 ```ruby
-import 'other/iamfile'
-
-user "bob2", :path => "/developer/", :renamed_from => "bob" do
+user "bob2", path: "/developer/", renamed_from: "bob" do
   # ...
 end
 
-group "Admin2", :path => "/admin/". :renamed_from => "Admin" do
+group "Admin2", path: "/admin/", renamed_from: "Admin" do
   # ...
 end
 ```
@@ -271,8 +254,8 @@ end
 ## Managed Policy attach/detach
 
 ```ruby
-user "bob", :path => "/developer/" do
-  login_profile :password_reset_required=>true
+user "bob", path: "/developer/" do
+  login_profile password_reset_required: true
 
   groups(
     "Admin"
@@ -291,14 +274,14 @@ end
 ## Custom Managed Policy
 
 ```ruby
-managed_policy "my-policy", :path=>"/" do
-  {"Version"=>"2012-10-17",
-   "Statement"=>
-    [{"Effect"=>"Allow", "Action"=>"directconnect:Describe*", "Resource"=>"*"}]}
+managed_policy "my-policy", path: "/" do
+  {Version: "2012-10-17",
+   Statement:
+    [{Effect: "Allow", Action: "directconnect:Describe*", Resource: "*"}]}
 end
 
-user "bob", :path => "/developer/" do
-  login_profile :password_reset_required=>true
+user "bob", path: "/developer/" do
+  login_profile password_reset_required: true
 
   groups(
     "Admin"
@@ -332,6 +315,7 @@ $ cat iam.json
       "policies": {
       ...
 
+$ vi iam.json # add target
 $ subiam -a -f iam.json --dry-run
 Apply `iam.json` to IAM (dry-run)
    ᗧ 100%
@@ -343,29 +327,29 @@ No change
 ```ruby
 template "common-policy" do
   policy "my-policy" do
-    {"Version"=>context.version,
-     "Statement"=>
-      [{"Action"=>
+    {Version: context.version,
+     Statement:
+      [{Action:
          ["s3:Get*",
           "s3:List*"],
-        "Effect"=>"Allow",
-        "Resource"=>"*"}]}
+        Effect: "Allow",
+        Resource: "*"}]}
   end
 end
 
 template "common-role-attrs" do
   assume_role_policy_document do
-    {"Version"=>context.version,
-     "Statement"=>
-      [{"Sid"=>"",
-        "Effect"=>"Allow",
-        "Principal"=>{"Service"=>"ec2.amazonaws.com"},
-        "Action"=>"sts:AssumeRole"}]}
+    {Version: context.version,
+     Statement:
+      [{Sid: "",
+        Effect: "Allow",
+        Principal: {Service: "ec2.amazonaws.com"},
+        Action: "sts:AssumeRole"}]}
   end
 end
 
-user "bob", :path => "/developer/" do
-  login_profile :password_reset_required=>true
+user "bob", path: "/developer/" do
+  login_profile password_reset_required: true
 
   groups(
     "Admin"
@@ -374,8 +358,8 @@ user "bob", :path => "/developer/" do
   include_template "common-policy", version: "2012-10-17"
 end
 
-user "mary", :path => "/staff/" do
-  # login_profile :password_reset_required=>true
+user "mary", path: "/staff/" do
+  # login_profile password_reset_required: true
 
   groups(
     # no group
@@ -390,7 +374,7 @@ user "mary", :path => "/staff/" do
   )
 end
 
-role "S3", :path => "/" do
+role "S3", path: "/" do
   instance_profiles(
     "S3"
   )
@@ -398,11 +382,27 @@ role "S3", :path => "/" do
   include_template "common-role-attrs"
 
   policy "S3-role-policy" do
-    {"Version"=>"2012-10-17",
-     "Statement"=>[{"Effect"=>"Allow", "Action"=>"*", "Resource"=>"*"}]}
+    {Version: "2012-10-17",
+     Statement: [{Effect: "Allow", Action: "*", Resource: "*"}]}
   end
 end
 ```
 
+## Use management policy
+
+```ruby
+user "foo", path: '/' do
+  attached_managed_policies(
+    'arn:aws:iam::0123456789:policy/MyPolicy',
+
+    arn_policy_by_current_account("MyPolicy2"),
+    # == "arn:aws:iam::0123456789:policy/MyPolicy2'
+
+    arn_policy_by_aws("AdministratorAccess")
+    # == 'arn:aws:iam::aws:policy/AdministratorAccess'
+  )
+end
+```
+
 ## Similar tools
 * [Codenize.tools](http://codenize.tools/)

data/bin/subiam

@@ -36,26 +36,26 @@ ARGV.options do |opt|
     credentials_path = nil
     format_passed = false
 
-    opt.on('-p', '--profile PROFILE_NAME')          {|v| profile_name                   = v                                     }
-    opt.on(''  , '--credentials-path PATH')         {|v| credentials_path               = v                                     }
-    opt.on('-k', '--access-key ACCESS_KEY')         {|v| access_key                     = v                                     }
-    opt.on('-s', '--secret-key SECRET_KEY')         {|v| secret_key                     = v                                     }
-    opt.on('-r', '--region REGION')                 {|v| region                         = v                                     }
-    opt.on('-a', '--apply')                         {    mode                           = :apply                                }
-    opt.on('-f', '--file FILE')                     {|v| file                           = v                                     }
-    opt.on(''  , '--dry-run')                       {    options[:dry_run]              = true                                  }
-    opt.on(''  , '--account-output FILE')           {|v| options[:password_manager]     = Subiam::PasswordManager.new(v, options) }
-    opt.on('-e', '--export')                        {    mode                           = :export                               }
-    opt.on('-o', '--output FILE')                   {|v| output_file                    = v                                     }
-    opt.on(''  , '--split')                         {    split                          = true                                  }
-    opt.on(''  , '--split-more')                    {    split                          = :more                                 }
-    opt.on('',   '--format=FORMAT', [:ruby, :json]) {|v| format_passed = true; options[:format] = v                             }
-    opt.on(''  , '--export-concurrency N', Integer) {|v| options[:export_concurrency]   = v                                     }
-    opt.on(''  , '--ignore-login-profile')          {    options[:ignore_login_profile] = true                                  }
-    opt.on(''  , '--no-color')                      {    options[:color]                = false                                 }
-    opt.on(''  , '--no-progress')                   {    options[:no_progress]          = true                                  }
-    opt.on(''  , '--debug')                         {    options[:debug]                = true                                  }
-    opt.on(''  , '--enable-delete')                 {    options[:enable_delete]        = true                                  }
+    opt.on('-p', '--profile PROFILE_NAME') { |v| profile_name = v }
+    opt.on('', '--credentials-path PATH') { |v| credentials_path = v }
+    opt.on('-k', '--access-key ACCESS_KEY') { |v| access_key = v }
+    opt.on('-s', '--secret-key SECRET_KEY') { |v| secret_key = v }
+    opt.on('-r', '--region REGION', 'default: ap-northeast-1') { |v| region = v }
+    opt.on('-a', '--apply') { mode = :apply }
+    opt.on('-f', '--file FILE', 'Specify the file path to apply.') { |v| file = v }
+    opt.on('', '--dry-run') { options[:dry_run] = true }
+    opt.on('', '--account-output FILE') { |v| options[:password_manager] = Subiam::PasswordManager.new(v, options) }
+    opt.on('-e', '--export') { mode = :export }
+    opt.on('-o', '--output FILE', 'Specify the file path to export current IAM settings.') { |v| output_file = v }
+    opt.on('', '--split') { split = true }
+    opt.on('', '--split-more') { split = :more }
+    opt.on('', '--format FORMAT', [:ruby, :json], 'ruby or json. (default: ruby)') { |v| format_passed = true; options[:format] = v }
+    opt.on('', '--export-concurrency N', Integer) { |v| options[:export_concurrency] = v }
+    opt.on('', '--ignore-login-profile') { options[:ignore_login_profile] = true }
+    opt.on('', '--no-color') { options[:color] = false }
+    opt.on('', '--no-progress') { options[:no_progress] = true }
+    opt.on('', '--debug') { options[:debug] = true }
+    opt.on('', '--enable-delete', 'Enable to delete top level elements. (default: false)') { options[:enable_delete] = true }
     opt.parse!
 
     aws_opts = {}
@@ -76,7 +76,12 @@ ARGV.options do |opt|
       exit 1
     end
 
-    aws_opts[:region] = region if region
+    if region
+      aws_opts[:region] = region
+    elsif !ENV['AWS_REGION']
+      aws_opts[:region] = 'ap-northeast-1' # default region
+    end
+
     Aws.config.update(aws_opts)
 
     if not format_passed and [file, output_file].any? {|i| i =~ /\.json\z/ }

data/lib/subiam/client.rb

@@ -60,7 +60,7 @@ class Subiam::Client
     expected = load_file(file)
 
     unless expected[:target]
-      raise "Required setting on DSL `target` not found"
+      raise "Target not found."
     end
     @target = expected[:target]
 

data/lib/subiam/version.rb

@@ -1,3 +1,3 @@
 module Subiam
-  VERSION = '1.2.1'
+  VERSION = '1.3.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: subiam
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.3.0
 platform: ruby
 authors:
 - Genki Sugawara
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-05-26 00:00:00.000000000 Z
+date: 2016-05-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-core