cloud-governance 1.1.389__py3-none-any.whl → 1.1.390__py3-none-any.whl

cloud_governance/common/clouds/aws/iam/iam_operations.py

@@ -318,3 +318,47 @@ class IAMOperations:
             logger.info(f"Access key '{access_key_id}' is already inactive for user '{username}'")
 
         logger.info(f"Access key deactivation processed for user '{username}'.")
+
+    def get_instance_profiles_for_role(self, role_name: str):
+        """
+        This method returns instance profiles associated with a given IAM role.
+        :param role_name: The name of the IAM role.
+        :return: A list of instance profiles.
+        """
+        instance_profiles = []
+        try:
+            # list_instance_profiles_for_role is paginated, use Utils to handle pagination
+            instance_profiles = self.utils.get_details_resource_list(
+                func_name=self.iam_client.list_instance_profiles_for_role,
+                input_tag='InstanceProfiles',
+                check_tag='Marker',
+                RoleName=role_name
+            )
+        except Exception as err:
+            logger.error(f"Failed to list instance profiles for role '{role_name}': {err}")
+        return instance_profiles
+
+    def remove_role_from_instance_profiles(self, role_name: str):
+        """
+        This method removes the specified IAM role from all associated instance profiles.
+        :param role_name: The name of the role to remove.
+        :return: True if removal from all profiles is successful, False otherwise.
+        """
+        instance_profiles = self.get_instance_profiles_for_role(role_name=role_name)
+        if not instance_profiles:
+            return True
+
+        success = True
+        for ip in instance_profiles:
+            instance_profile_name = ip.get('InstanceProfileName')
+            try:
+                self.iam_client.remove_role_from_instance_profile(
+                    InstanceProfileName=instance_profile_name,
+                    RoleName=role_name
+                )
+                logger.info(f"Successfully removed role '{role_name}' from instance profile '{instance_profile_name}'")
+            except Exception as err:
+                logger.error(
+                    f"Failed to remove role '{role_name}' from instance profile '{instance_profile_name}': {err}")
+                success = False
+        return success

cloud_governance/policy/aws/empty_roles.py

@@ -15,7 +15,7 @@ class EmptyRoles(AWSPolicyOperations):
 
     def run_policy_operations(self):
         """
-        This method returns all Empty buckets
+        This method returns all Empty roles.
         :return:
         :rtype:
         """
@@ -33,7 +33,33 @@ class EmptyRoles(AWSPolicyOperations):
             try:
                 if not cluster_tag and len(inline_policies) == 0 and len(attached_policies) == 0 and \
                     self.get_skip_policy_value(tags=tags) not in ('NOTDELETE', 'SKIP'):
+
                     cleanup_days = self.get_clean_up_days_count(tags=tags)
+                    # Step 1: Remove role from all instance profiles if attached (for empty roles)
+                    instance_profiles = self._iam_operations.get_instance_profiles_for_role(role_name=role_name)
+                    detachment_success = True
+                    if instance_profiles:
+                        logger.info(
+                            f"Role '{role_name}' is empty (no policies) but attached to instance profile(s): "
+                            f"{[ip['InstanceProfileName'] for ip in instance_profiles]}. Detaching now...")
+
+                        # Call the new method to handle detachment if dry_run = 'no'
+                        if self._dry_run == 'no':
+                            detachment_success = self._iam_operations.remove_role_from_instance_profiles(
+                                role_name=role_name)
+                            logger.warning(f"LIVE RUN: Detachment attempted. Success: {detachment_success}")
+                        else:
+                            logger.info(f"DRY RUN: Skipping actual detachment of role '{role_name}'.")
+
+                        if not detachment_success:
+                            # Skip deletion if detachment failed
+                            logger.info(
+                                f"Failed to detach role '{role_name}' from all instance profiles. Skipping deletion.")
+                            self.update_resource_day_count_tag(resource_id=role_name, cleanup_days=cleanup_days,
+                                                               tags=tags)
+                            continue
+
+                    # Step 2: Proceed with deletion
                     cleanup_result = self.verify_and_delete_resource(resource_id=role_name, tags=tags,
                                                                      clean_up_days=cleanup_days)
                     resource_data = self._get_es_schema(resource_id=role_name,
@@ -50,8 +76,10 @@ class EmptyRoles(AWSPolicyOperations):
                                                         resource_state="Empty",
                                                         unit_price=0)
                     empty_roles.append(resource_data)
+
                 if not cleanup_result:
                     self.update_resource_day_count_tag(resource_id=role_name, cleanup_days=cleanup_days, tags=tags)
+
             except Exception as e:
                 logger.error(f'Exception raised while processing the empty roles operation on {role_name}, {e}')
         return empty_roles

{cloud_governance-1.1.389.dist-info → cloud_governance-1.1.390.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloud-governance
-Version: 1.1.389
+Version: 1.1.390
 Summary: Cloud Governance Tool
 Home-page: https://github.com/redhat-performance/cloud-governance
 Author: Red Hat

{cloud_governance-1.1.389.dist-info → cloud_governance-1.1.390.dist-info}/RECORD

@@ -51,7 +51,7 @@ cloud_governance/common/clouds/aws/dynamodb/dynamodb_operations.py,sha256=eeV3Yg
 cloud_governance/common/clouds/aws/ec2/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cloud_governance/common/clouds/aws/ec2/ec2_operations.py,sha256=0ibMvf7nqyK9MCRhxrg11xnOPELqsZIQsZUgd6_neKc,24680
 cloud_governance/common/clouds/aws/iam/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-cloud_governance/common/clouds/aws/iam/iam_operations.py,sha256=cQWh1iJdlQCGVcZcQF6aDt8fQrKnv6n-361xALNQ7QQ,11732
+cloud_governance/common/clouds/aws/iam/iam_operations.py,sha256=rrtMIw50VugdRJLOQhXEj2BB9FcscIt-mQfCF2qWb9U,13719
 cloud_governance/common/clouds/aws/price/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cloud_governance/common/clouds/aws/price/price.py,sha256=Ju76WniNTVujQPi6QFRgLt6Jd8gsxL2FOnN7c1et5F0,6403
 cloud_governance/common/clouds/aws/price/resources_pricing.py,sha256=k-hucUvxpZfF126wLQQwJt3BzNQiOoSU1x6gjIQ_4cM,6253
@@ -159,7 +159,7 @@ cloud_governance/policy/aws/cost_explorer_payer_billings.py,sha256=EuTry807RRw0S
 cloud_governance/policy/aws/cost_over_usage.py,sha256=-XEZGNlu7KIGSpEDJgQVcc2fNrPALqrKqgGGV3vbdVM,5998
 cloud_governance/policy/aws/ebs_in_use.py,sha256=7vGV2qobV14rzC7tJnJiafC3oAhnY_TTvd53oEtaN4Q,616
 cloud_governance/policy/aws/ec2_stop.py,sha256=FXQNkHmiMCEw6Pz6CalIIVYFRsV24RT5TewqFazyP8M,9641
-cloud_governance/policy/aws/empty_roles.py,sha256=EhsepFRbjU82PjJQ1hADqBM_RO1Ukr-Q4DZAz3bM4ho,3155
+cloud_governance/policy/aws/empty_roles.py,sha256=gEBaribxBnM_seP8rcifaVdf-Gz-JT2sc1aNKl8AcxA,4804
 cloud_governance/policy/aws/ip_unattached.py,sha256=OnHlTIKSgyxwdAgU9jBApdvDQpzHgECjSodN6KoXWqU,3176
 cloud_governance/policy/aws/monthly_report.py,sha256=cSeOfdU5u2BMUR1RmxTrrxpMSlOCG0oqKUeSqwdU_jY,6830
 cloud_governance/policy/aws/optimize_resources_report.py,sha256=zG7w8KHF7Z25jxYGgDadyXp0jcxSREsRCOmQP8lZMNc,6003
@@ -265,8 +265,8 @@ cloud_governance/policy/policy_runners/elasticsearch/__init__.py,sha256=47DEQpj8
 cloud_governance/policy/policy_runners/elasticsearch/upload_elastic_search.py,sha256=pOwUJWXjJbyTy8iv3Ap8xJGnqQe-5lZgoR8-vGfAVos,1881
 cloud_governance/policy/policy_runners/ibm/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cloud_governance/policy/policy_runners/ibm/policy_runner.py,sha256=V0E_f7F3hXit0aSq4BlfX1Jd4vjR2NEvOWsJ5upvZ4o,1302
-cloud_governance-1.1.389.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-cloud_governance-1.1.389.dist-info/METADATA,sha256=VAMZ4oVE8jWRMIijCUQ_Z-ELk-0DQ0BVivKPpOypVRo,11384
-cloud_governance-1.1.389.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-cloud_governance-1.1.389.dist-info/top_level.txt,sha256=jfB1fgj7jvx3YZkZA4G6hFeS1RHO7J7XtnbjuMNMRww,17
-cloud_governance-1.1.389.dist-info/RECORD,,
+cloud_governance-1.1.390.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+cloud_governance-1.1.390.dist-info/METADATA,sha256=GLZTMm4vq-oCFA2AzpHw8V2EK8uIthdudCidFvCRmpY,11384
+cloud_governance-1.1.390.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+cloud_governance-1.1.390.dist-info/top_level.txt,sha256=jfB1fgj7jvx3YZkZA4G6hFeS1RHO7J7XtnbjuMNMRww,17
+cloud_governance-1.1.390.dist-info/RECORD,,