cloud-governance 1.1.388__tar.gz → 1.1.390__tar.gz

{cloud_governance-1.1.388/cloud_governance.egg-info → cloud_governance-1.1.390}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloud-governance
-Version: 1.1.388
+Version: 1.1.390
 Summary: Cloud Governance Tool
 Home-page: https://github.com/redhat-performance/cloud-governance
 Author: Red Hat

{cloud_governance-1.1.388 → cloud_governance-1.1.390}/cloud_governance/common/clouds/aws/iam/iam_operations.py

@@ -318,3 +318,47 @@ class IAMOperations:
             logger.info(f"Access key '{access_key_id}' is already inactive for user '{username}'")
 
         logger.info(f"Access key deactivation processed for user '{username}'.")
+
+    def get_instance_profiles_for_role(self, role_name: str):
+        """
+        This method returns instance profiles associated with a given IAM role.
+        :param role_name: The name of the IAM role.
+        :return: A list of instance profiles.
+        """
+        instance_profiles = []
+        try:
+            # list_instance_profiles_for_role is paginated, use Utils to handle pagination
+            instance_profiles = self.utils.get_details_resource_list(
+                func_name=self.iam_client.list_instance_profiles_for_role,
+                input_tag='InstanceProfiles',
+                check_tag='Marker',
+                RoleName=role_name
+            )
+        except Exception as err:
+            logger.error(f"Failed to list instance profiles for role '{role_name}': {err}")
+        return instance_profiles
+
+    def remove_role_from_instance_profiles(self, role_name: str):
+        """
+        This method removes the specified IAM role from all associated instance profiles.
+        :param role_name: The name of the role to remove.
+        :return: True if removal from all profiles is successful, False otherwise.
+        """
+        instance_profiles = self.get_instance_profiles_for_role(role_name=role_name)
+        if not instance_profiles:
+            return True
+
+        success = True
+        for ip in instance_profiles:
+            instance_profile_name = ip.get('InstanceProfileName')
+            try:
+                self.iam_client.remove_role_from_instance_profile(
+                    InstanceProfileName=instance_profile_name,
+                    RoleName=role_name
+                )
+                logger.info(f"Successfully removed role '{role_name}' from instance profile '{instance_profile_name}'")
+            except Exception as err:
+                logger.error(
+                    f"Failed to remove role '{role_name}' from instance profile '{instance_profile_name}': {err}")
+                success = False
+        return success

{cloud_governance-1.1.388 → cloud_governance-1.1.390}/cloud_governance/policy/aws/empty_roles.py

@@ -15,7 +15,7 @@ class EmptyRoles(AWSPolicyOperations):
 
     def run_policy_operations(self):
         """
-        This method returns all Empty buckets
+        This method returns all Empty roles.
         :return:
         :rtype:
         """
@@ -33,7 +33,33 @@ class EmptyRoles(AWSPolicyOperations):
             try:
                 if not cluster_tag and len(inline_policies) == 0 and len(attached_policies) == 0 and \
                     self.get_skip_policy_value(tags=tags) not in ('NOTDELETE', 'SKIP'):
+
                     cleanup_days = self.get_clean_up_days_count(tags=tags)
+                    # Step 1: Remove role from all instance profiles if attached (for empty roles)
+                    instance_profiles = self._iam_operations.get_instance_profiles_for_role(role_name=role_name)
+                    detachment_success = True
+                    if instance_profiles:
+                        logger.info(
+                            f"Role '{role_name}' is empty (no policies) but attached to instance profile(s): "
+                            f"{[ip['InstanceProfileName'] for ip in instance_profiles]}. Detaching now...")
+
+                        # Call the new method to handle detachment if dry_run = 'no'
+                        if self._dry_run == 'no':
+                            detachment_success = self._iam_operations.remove_role_from_instance_profiles(
+                                role_name=role_name)
+                            logger.warning(f"LIVE RUN: Detachment attempted. Success: {detachment_success}")
+                        else:
+                            logger.info(f"DRY RUN: Skipping actual detachment of role '{role_name}'.")
+
+                        if not detachment_success:
+                            # Skip deletion if detachment failed
+                            logger.info(
+                                f"Failed to detach role '{role_name}' from all instance profiles. Skipping deletion.")
+                            self.update_resource_day_count_tag(resource_id=role_name, cleanup_days=cleanup_days,
+                                                               tags=tags)
+                            continue
+
+                    # Step 2: Proceed with deletion
                     cleanup_result = self.verify_and_delete_resource(resource_id=role_name, tags=tags,
                                                                      clean_up_days=cleanup_days)
                     resource_data = self._get_es_schema(resource_id=role_name,
@@ -50,8 +76,10 @@ class EmptyRoles(AWSPolicyOperations):
                                                         resource_state="Empty",
                                                         unit_price=0)
                     empty_roles.append(resource_data)
+
                 if not cleanup_result:
                     self.update_resource_day_count_tag(resource_id=role_name, cleanup_days=cleanup_days, tags=tags)
+
             except Exception as e:
                 logger.error(f'Exception raised while processing the empty roles operation on {role_name}, {e}')
         return empty_roles

{cloud_governance-1.1.388 → cloud_governance-1.1.390/cloud_governance.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloud-governance
-Version: 1.1.388
+Version: 1.1.390
 Summary: Cloud Governance Tool
 Home-page: https://github.com/redhat-performance/cloud-governance
 Author: Red Hat

{cloud_governance-1.1.388 → cloud_governance-1.1.390}/setup.py

@@ -2,7 +2,7 @@ from codecs import open
 from os import path
 from setuptools import setup, find_packages
 
-__version__ = '1.1.388'
+__version__ = '1.1.390'
 
 here = path.abspath(path.dirname(__file__))