cloud-governance 1.1.389__tar.gz → 1.1.391__tar.gz

{cloud_governance-1.1.389/cloud_governance.egg-info → cloud_governance-1.1.391}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloud-governance
-Version: 1.1.389
+Version: 1.1.391
 Summary: Cloud Governance Tool
 Home-page: https://github.com/redhat-performance/cloud-governance
 Author: Red Hat

{cloud_governance-1.1.389 → cloud_governance-1.1.391}/cloud_governance/common/clouds/aws/iam/iam_operations.py

@@ -318,3 +318,47 @@ class IAMOperations:
             logger.info(f"Access key '{access_key_id}' is already inactive for user '{username}'")
 
         logger.info(f"Access key deactivation processed for user '{username}'.")
+
+    def get_instance_profiles_for_role(self, role_name: str):
+        """
+        This method returns instance profiles associated with a given IAM role.
+        :param role_name: The name of the IAM role.
+        :return: A list of instance profiles.
+        """
+        instance_profiles = []
+        try:
+            # list_instance_profiles_for_role is paginated, use Utils to handle pagination
+            instance_profiles = self.utils.get_details_resource_list(
+                func_name=self.iam_client.list_instance_profiles_for_role,
+                input_tag='InstanceProfiles',
+                check_tag='Marker',
+                RoleName=role_name
+            )
+        except Exception as err:
+            logger.error(f"Failed to list instance profiles for role '{role_name}': {err}")
+        return instance_profiles
+
+    def remove_role_from_instance_profiles(self, role_name: str):
+        """
+        This method removes the specified IAM role from all associated instance profiles.
+        :param role_name: The name of the role to remove.
+        :return: True if removal from all profiles is successful, False otherwise.
+        """
+        instance_profiles = self.get_instance_profiles_for_role(role_name=role_name)
+        if not instance_profiles:
+            return True
+
+        success = True
+        for ip in instance_profiles:
+            instance_profile_name = ip.get('InstanceProfileName')
+            try:
+                self.iam_client.remove_role_from_instance_profile(
+                    InstanceProfileName=instance_profile_name,
+                    RoleName=role_name
+                )
+                logger.info(f"Successfully removed role '{role_name}' from instance profile '{instance_profile_name}'")
+            except Exception as err:
+                logger.error(
+                    f"Failed to remove role '{role_name}' from instance profile '{instance_profile_name}': {err}")
+                success = False
+        return success

{cloud_governance-1.1.389 → cloud_governance-1.1.391}/cloud_governance/policy/aws/empty_roles.py

@@ -15,7 +15,7 @@ class EmptyRoles(AWSPolicyOperations):
 
     def run_policy_operations(self):
         """
-        This method returns all Empty buckets
+        This method returns all Empty roles.
         :return:
         :rtype:
         """
@@ -33,7 +33,33 @@ class EmptyRoles(AWSPolicyOperations):
             try:
                 if not cluster_tag and len(inline_policies) == 0 and len(attached_policies) == 0 and \
                     self.get_skip_policy_value(tags=tags) not in ('NOTDELETE', 'SKIP'):
+
                     cleanup_days = self.get_clean_up_days_count(tags=tags)
+                    # Step 1: Remove role from all instance profiles if attached (for empty roles)
+                    instance_profiles = self._iam_operations.get_instance_profiles_for_role(role_name=role_name)
+                    detachment_success = True
+                    if instance_profiles:
+                        logger.info(
+                            f"Role '{role_name}' is empty (no policies) but attached to instance profile(s): "
+                            f"{[ip['InstanceProfileName'] for ip in instance_profiles]}. Detaching now...")
+
+                        # Call the new method to handle detachment if dry_run = 'no'
+                        if self._dry_run == 'no':
+                            detachment_success = self._iam_operations.remove_role_from_instance_profiles(
+                                role_name=role_name)
+                            logger.warning(f"LIVE RUN: Detachment attempted. Success: {detachment_success}")
+                        else:
+                            logger.info(f"DRY RUN: Skipping actual detachment of role '{role_name}'.")
+
+                        if not detachment_success:
+                            # Skip deletion if detachment failed
+                            logger.info(
+                                f"Failed to detach role '{role_name}' from all instance profiles. Skipping deletion.")
+                            self.update_resource_day_count_tag(resource_id=role_name, cleanup_days=cleanup_days,
+                                                               tags=tags)
+                            continue
+
+                    # Step 2: Proceed with deletion
                     cleanup_result = self.verify_and_delete_resource(resource_id=role_name, tags=tags,
                                                                      clean_up_days=cleanup_days)
                     resource_data = self._get_es_schema(resource_id=role_name,
@@ -50,8 +76,10 @@ class EmptyRoles(AWSPolicyOperations):
                                                         resource_state="Empty",
                                                         unit_price=0)
                     empty_roles.append(resource_data)
+
                 if not cleanup_result:
                     self.update_resource_day_count_tag(resource_id=role_name, cleanup_days=cleanup_days, tags=tags)
+
             except Exception as e:
                 logger.error(f'Exception raised while processing the empty roles operation on {role_name}, {e}')
         return empty_roles

{cloud_governance-1.1.389 → cloud_governance-1.1.391}/cloud_governance/policy/policy_operations/aws/zombie_cluster/delete_ec2_resources.py

@@ -269,7 +269,19 @@ class DeleteEC2Resources:
                                 if ip_permission.get('UserIdGroupPairs'):
                                     for user_id_group_pair in ip_permission.get('UserIdGroupPairs'):
                                         if user_id_group_pair.get('GroupId') == resource_id:
-                                            ingress_rule = {'FromPort': ip_permission.get('FromPort'), 'IpProtocol': ip_permission.get('IpProtocol'), 'IpRanges': ip_permission.get('IpRanges'), 'Ipv6Ranges': ip_permission.get('Ipv6Ranges'), 'PrefixListIds': ip_permission.get('PrefixListIds'), 'ToPort': ip_permission.get('ToPort'), 'UserIdGroupPairs': [user_id_group_pair]}
+                                            ingress_rule = {
+                                                'IpProtocol': ip_permission.get('IpProtocol'),
+                                                'IpRanges': ip_permission.get('IpRanges'),
+                                                'Ipv6Ranges': ip_permission.get('Ipv6Ranges'),
+                                                'PrefixListIds': ip_permission.get('PrefixListIds'),
+                                                'UserIdGroupPairs': [user_id_group_pair]
+                                            }
+                                            from_port = ip_permission.get('FromPort')
+                                            to_port = ip_permission.get('ToPort')
+                                            if from_port is not None:
+                                                ingress_rule['FromPort'] = from_port
+                                            if to_port is not None:
+                                                ingress_rule['ToPort'] = to_port
                                             self.client.revoke_security_group_ingress(GroupId=vpc_security_group.get('GroupId'), IpPermissions=[ingress_rule])
                                             logger.info(f'Removed the Ingress rules of Security Group {vpc_security_group.get("GroupId")} :: {ingress_rule}')
                     else:
@@ -281,7 +293,13 @@ class DeleteEC2Resources:
                                         if ip_permission.get('UserIdGroupPairs'):
                                             for user_id_group_pair in ip_permission.get('UserIdGroupPairs'):
                                                 if user_id_group_pair.get('GroupId') == resource_id:
-                                                    self.client.revoke_security_group_ingress(GroupId=vpc_security_group.get('GroupId'), IpPermissions=[ip_permission])
+                                                    cleaned_ip_permission = {k: v for k, v in ip_permission.items() if
+                                                                             v is not None}
+                                                    cleaned_ip_permission['UserIdGroupPairs'] = [user_id_group_pair]
+
+                                                    self.client.revoke_security_group_ingress(
+                                                        GroupId=vpc_security_group.get('GroupId'),
+                                                        IpPermissions=[cleaned_ip_permission])
                                                     logger.info(f'Removed the Ingress rules of Security Group {resource_id} from {vpc_security_group.get("GroupId")}')
             network_interfaces = self.ec2_operations.get_network_interface()
             network_interface_ids = self.__get_cluster_references(resource_id=vpc_id, resource_list=network_interfaces,

{cloud_governance-1.1.389 → cloud_governance-1.1.391/cloud_governance.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloud-governance
-Version: 1.1.389
+Version: 1.1.391
 Summary: Cloud Governance Tool
 Home-page: https://github.com/redhat-performance/cloud-governance
 Author: Red Hat

{cloud_governance-1.1.389 → cloud_governance-1.1.391}/setup.py

@@ -2,7 +2,7 @@ from codecs import open
 from os import path
 from setuptools import setup, find_packages
 
-__version__ = '1.1.389'
+__version__ = '1.1.391'
 
 here = path.abspath(path.dirname(__file__))