cloudconsolelink 4.1.1__tar.gz → 4.2.0__tar.gz

{cloudconsolelink-4.1.1/cloudconsolelink.egg-info → cloudconsolelink-4.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudconsolelink
-Version: 4.1.1
+Version: 4.2.0
 Summary: Generate console links for cloud resources
 Home-page: https://github.com/Cloudanix/cloud-console-links
 Maintainer: Cloudanix
@@ -31,7 +31,8 @@ Dynamic: provides-extra
 Dynamic: summary
 
 # What is cloudconsolelink?
-This project for generate console links for AWS, GCP and Azure cloud resources
+This project for generate console links for AWS, GCP, Azure and OCI cloud resources, and web links for
+GitHub, GitLab, Bitbucket and Azure DevOps entities
 
 # Install
 Run ```pip install cloudconsolelink``` to install our code
@@ -65,6 +66,12 @@ make check
 #### For GCP
 ```from cloudconsolelink.clouds.gcp import GCPLinker```
 
+#### For OCI
+```from cloudconsolelink.clouds.oci import OCILinker```
+
+#### For GitHub, GitLab, Bitbucket, Azure DevOps
+```from cloudconsolelink.clouds.git import GitLinker```
+
 #### For container images (ECR, GAR/GCR, ACR, Docker Hub, OCIR)
 ```from cloudconsolelink.clouds.registry import image_console_link```
 
@@ -141,6 +148,21 @@ console_link = image_console_link(
 )
 ```
 
+#### Git providers:
+```python
+from cloudconsolelink.clouds.git import GitLinker
+
+git = GitLinker()
+
+git.get_console_link("github", "branch", owner="acme", repo="api", branch="main")
+# https://github.com/acme/api/tree/main
+
+# Self-hosted GitHub Enterprise / GitLab: pass base_url
+git.get_console_link("gitlab", "project", base_url="https://gitlab.acme.com", project_path="platform/api")
+# https://gitlab.acme.com/platform/api
+```
+Resource names per provider are the keys of `LINKS` in `cloudconsolelink/clouds/git/__init__.py`.
+
 ## get_console_link() parameters description:
 
 ### AWS:
@@ -187,6 +209,8 @@ console_link = image_console_link(
   31) firestore_collection_name
   32) cloud_run_service_name
 
+The full, current list of GCP resource names is the `resources` dict in `cloudconsolelink/clouds/gcp/__init__.py`.
+
 
 # Who uses cloudconsolelink?
 1. [Cloudanix](https://www.cloudanix.com/)

{cloudconsolelink-4.1.1 → cloudconsolelink-4.2.0}/README.md

@@ -1,5 +1,6 @@
 # What is cloudconsolelink?
-This project for generate console links for AWS, GCP and Azure cloud resources
+This project for generate console links for AWS, GCP, Azure and OCI cloud resources, and web links for
+GitHub, GitLab, Bitbucket and Azure DevOps entities
 
 # Install
 Run ```pip install cloudconsolelink``` to install our code
@@ -33,6 +34,12 @@ make check
 #### For GCP
 ```from cloudconsolelink.clouds.gcp import GCPLinker```
 
+#### For OCI
+```from cloudconsolelink.clouds.oci import OCILinker```
+
+#### For GitHub, GitLab, Bitbucket, Azure DevOps
+```from cloudconsolelink.clouds.git import GitLinker```
+
 #### For container images (ECR, GAR/GCR, ACR, Docker Hub, OCIR)
 ```from cloudconsolelink.clouds.registry import image_console_link```
 
@@ -109,6 +116,21 @@ console_link = image_console_link(
 )
 ```
 
+#### Git providers:
+```python
+from cloudconsolelink.clouds.git import GitLinker
+
+git = GitLinker()
+
+git.get_console_link("github", "branch", owner="acme", repo="api", branch="main")
+# https://github.com/acme/api/tree/main
+
+# Self-hosted GitHub Enterprise / GitLab: pass base_url
+git.get_console_link("gitlab", "project", base_url="https://gitlab.acme.com", project_path="platform/api")
+# https://gitlab.acme.com/platform/api
+```
+Resource names per provider are the keys of `LINKS` in `cloudconsolelink/clouds/git/__init__.py`.
+
 ## get_console_link() parameters description:
 
 ### AWS:
@@ -155,6 +177,8 @@ console_link = image_console_link(
   31) firestore_collection_name
   32) cloud_run_service_name
 
+The full, current list of GCP resource names is the `resources` dict in `cloudconsolelink/clouds/gcp/__init__.py`.
+
 
 # Who uses cloudconsolelink?
 1. [Cloudanix](https://www.cloudanix.com/)

{cloudconsolelink-4.1.1 → cloudconsolelink-4.2.0}/cloudconsolelink/clouds/aws/__init__.py

@@ -2,9 +2,14 @@ import logging
 import re
 import urllib.parse
 from typing import Dict
+from typing import Optional
 
-from .errors import ARNTooShortError, InvalidARNError, InvalidPartitionError, InvalidServiceError
-from .links import HOME_URLS, get_links
+from .errors import ARNTooShortError
+from .errors import InvalidARNError
+from .errors import InvalidPartitionError
+from .errors import InvalidServiceError
+from .links import get_links
+from .links import HOME_URLS
 
 logger = logging.getLogger(__name__)
 
@@ -20,16 +25,19 @@ def _render(template: str, data: Dict, arn: str = "") -> str:
     produce spaces inside expressions). Unknown expressions render as empty string.
     """
     resource = str(data.get("resource", ""))
+    region = str(data.get("region", ""))
     ctx: Dict[str, str] = {
+        **_resource_part_ctx(resource),
         'data.get("region","")': str(data.get("region", "")),
         'data.get("console","")': str(data.get("console", "")),
         'data.get("resource","")': resource,
         'data.get("account","")': str(data.get("account", "")),
         'data.get("service","")': str(data.get("service", "")),
-        'get_arn_string(data)': get_arn_string(data),
+        "get_arn_string(data)": get_arn_string(data),
         'get_resource_path(data.get("resource",""))': get_resource_path(resource),
         "arn": arn,
-        "region": str(data.get("region", "")),
+        "partition": str(data.get("partition", "")),
+        "region": region,
         "console": str(data.get("console", "")),
         "resource": resource,
         "account": str(data.get("account", "")),
@@ -37,12 +45,50 @@ def _render(template: str, data: Dict, arn: str = "") -> str:
     }
 
     def _sub(m: re.Match) -> str:
-        expr = re.sub(r"\s+", "", m.group(1))  # collapse whitespace from line continuations
+        expr = re.sub(
+            r"\s+",
+            "",
+            m.group(1),
+        )  # collapse whitespace from line continuations
         if expr not in ctx:
             logger.debug("Unknown template expression %r", expr)
         return ctx.get(expr, "")
 
-    return _EXPR_RE.sub(_sub, template).replace(" ", "")
+    link = _EXPR_RE.sub(_sub, template).replace(" ", "")
+    return link if region else _drop_empty_region(link)
+
+
+def _resource_part_ctx(resource: str) -> Dict[str, str]:
+    """Template keys for the pieces of a path-style resource.
+
+    resource_part(N) is the Nth "/"-separated segment (ecs "service/cluster/svc" -> cluster, svc),
+    resource_tail is everything after the first "/" (autoscaling "uuid:autoScalingGroupName/name" -> name),
+    log_group_id is the log group name in the double-encoded form the CloudWatch console expects.
+    """
+    raw = urllib.parse.unquote(resource)
+    parts = raw.split("/")
+    ctx = {
+        f"resource_part({i})": urllib.parse.quote(part, safe="")
+        for i, part in enumerate(parts)
+    }
+    ctx["resource_tail"] = urllib.parse.quote(raw.split("/", 1)[-1], safe="")
+    log_group = raw[: -len(":*")] if raw.endswith(":*") else raw
+    ctx["log_group_id"] = urllib.parse.quote(
+        urllib.parse.quote(log_group, safe=""),
+        safe="",
+    ).replace("%", "$")
+    return ctx
+
+
+def _drop_empty_region(link: str) -> str:
+    """Remove the empty region a region-less ARN (IAM, Route 53, SSO, ...) leaves in a template.
+
+    "https://.console..." becomes "https://console..." and a bare "region=" query parameter is dropped.
+    """
+    link = link.replace("https://.", "https://", 1)
+    link = link.replace("?region=&", "?")
+    link = re.sub(r"[?&]region=(?=#|$)", "", link)
+    return re.sub(r"&region=(?=&)", "", link)
 
 
 def get_console(partition: str) -> str:
@@ -126,6 +172,10 @@ class AWSLinker:
         }
 
         resource_tokens = tokens[5:]
+        # API Gateway ARNs are paths: arn:aws:apigateway:us-east-1::/restapis/abc123. Drop the
+        # leading "/" so the first segment is the resource type, as in every other path-style ARN.
+        if resource_tokens and resource_tokens[0].startswith("/"):
+            resource_tokens[0] = resource_tokens[0][1:]
 
         console = get_console(str(data.get("partition", "")))
         if not console:
@@ -169,14 +219,41 @@ class AWSLinker:
             logger.debug(f"Invalid AWS ARN {arn}")
             raise InvalidARNError(f"Invalid AWS ARN {arn}")
 
-        if not links.get(data["service"], {}).get(data["resourceType"], None):
+        # An SNS subscription ARN is the topic ARN plus a subscription id: sns:...:topic:uuid.
+        if data["service"] == "sns" and len(resource_tokens) == 2:
+            data["resourceType"] = "subscription"
+
+        template = _find_template(
+            links[data["service"]],
+            str(data["resourceType"]),
+            str(data["resource"]),
+        )
+        if not template:
             logger.debug(
                 f"AWS service {data['service']} resource type {data['resourceType']} not supported",
             )
             return get_service_home_link(data)
 
         data["resource"] = urllib.parse.quote(str(data["resource"]))
-        return _render(links[data["service"]][data["resourceType"]], data, arn)
+        return _render(template, data, arn)
+
+
+def _find_template(
+    service_links: Dict,
+    resource_type: str,
+    resource: str,
+) -> Optional[str]:
+    """Pick the template for a resource, preferring a "type/sub-type" key over the plain type.
+
+    Some ARNs carry their real kind one level down: apigateway "restapis/{id}/stages/{stage}" (sub-type in
+    the second segment) or wafv2 "regional/webacl/{name}/{id}" (sub-type in the first segment).
+    """
+    parts = resource.split("/")
+    for sub_type in parts[1:2] + parts[:1] if len(parts) > 1 else []:
+        template = service_links.get(f"{resource_type}/{sub_type}")
+        if template:
+            return template
+    return service_links.get(resource_type)
 
 
 __all__ = [

{cloudconsolelink-4.1.1 → cloudconsolelink-4.2.0}/cloudconsolelink/clouds/aws/links.py

@@ -42,12 +42,15 @@ def get_links() -> Dict:
             "apps": 'https://{data.get("region", "")}.{data.get("console", "")}/amplify/home?region={data.get("region", "")}#/{data.get("resource", "")}',
         },
         "apigateway": {  # Manage Amazon API Gateway
-            "restapis": 'https://{data.get("region", "")}.{data.get("console", "")}/apigateway/home?region={data.get("region", "")}\
-                #/{data.get("resource", "")}/resources/',
+            "restapis": 'https://{data.get("region", "")}.{data.get("console", "")}/apigateway/main/apis/\
+                {resource_part(0)}/resources?api={resource_part(0)}&region={data.get("region", "")}',
+            "restapis/stages": 'https://{data.get("region", "")}.{data.get("console", "")}/apigateway/main/apis/\
+                {resource_part(0)}/stages?api={resource_part(0)}&region={data.get("region", "")}',
             "stages": 'https://{data.get("region", "")}.{data.get("console", "")}/apigateway/\
                         home?region={data.get("region", "")}#/{data.get("resource", "")}',
-            "apis": 'https://{data.get("region", "")}.{data.get("console", "")}/apigateway/home?region={data.get("region", "")}\
-                    #/{data.get("resource", "")}/resources/',
+            # HTTP and WebSocket APIs (API Gateway v2)
+            "apis": 'https://{data.get("region", "")}.{data.get("console", "")}/apigateway/main/api-detail?\
+                    api={resource_part(0)}&region={data.get("region", "")}',
             "stage": 'https://{data.get("region", "")}.{data.get("console", "")}/apigateway/\
                         home?region={data.get("region", "")}#/{data.get("resource", "")}',
             "clientcertificates": 'https://{data.get("region", "")}.{data.get("console", "")}/apigateway/home?region={data.get("region", "")}#/client-certificates',
@@ -95,7 +98,7 @@ def get_links() -> Dict:
             "workgroup": 'https://{data.get("region", "")}.{data.get("console", "")}/athena/home?region={data.get("region", "")}#/workgroups/details/{data.get("resource", "")}',
         },
         "autoscaling": {  # Amazon EC2 Auto Scaling
-            "autoScalingGroup": 'https://{data.get("region", "")}.{data.get("console", "")}/ec2/home?region={data.get("region", "")}#AutoScalingGroupDetails:id={data.get("resource", "")}',
+            "autoScalingGroup": 'https://{data.get("region", "")}.{data.get("console", "")}/ec2/home?region={data.get("region", "")}#AutoScalingGroupDetails:id={resource_tail}',
             "launchConfiguration": 'https://{data.get("region", "")}.{data.get("console", "")}/ec2/home?region={data.get("region", "")}#LaunchConfigurations:',
         },
         "aws-marketplace": {  # AWS Marketplace Catalog
@@ -238,6 +241,8 @@ def get_links() -> Dict:
             "aggregation-authorization": 'https://{data.get("region", "")}.{data.get("console", "")}/config/home?region={data.get("region", "")}#/aggregations',
             "config-aggregator": 'https://{data.get("region", "")}.{data.get("console", "")}/config/home?region={data.get("region", "")}#/aggregations',
             "config-rule": 'https://{data.get("region", "")}.{data.get("console", "")}/config/home?region={data.get("region", "")}#/rules/rule-details/{data.get("resource", "")}',
+            "configuration-recorder": 'https://{data.get("region", "")}.{data.get("console", "")}/config/home?region={data.get("region", "")}#/settings',
+            "delivery-channel": 'https://{data.get("region", "")}.{data.get("console", "")}/config/home?region={data.get("region", "")}#/settings',
             "conformance-pack": 'https://{data.get("region", "")}.{data.get("console", "")}/config/home?region={data.get("region", "")}#/conformance-packs/details/{data.get("resource", "")}',
             "organization-config-rule": 'https://{data.get("region", "")}.{data.get("console", "")}/config/home?region={data.get("region", "")}#/rules',
             "organization-conformance-pack": 'https://{data.get("region", "")}.{data.get("console", "")}/config/home?region={data.get("region", "")}#/conformance-packs',
@@ -345,7 +350,7 @@ def get_links() -> Dict:
             "table": 'https://{data.get("region", "")}.{data.get("console", "")}/dynamodbv2/home?region=\
                 {data.get("region", "")}#table?name={data.get("resource", "")}',
             "secondary_indexes": 'https://{data.get("region", "")}.{data.get("console", "")}/dynamodbv2/\
-                                home?region=us-east-1#table?initialTagKey=&name={data.get("resource", "")}&tab=indexes',
+                                home?region={data.get("region", "")}#table?initialTagKey=&name={data.get("resource", "")}&tab=indexes',
         },
         "ec2": {  # AWS Systems Manager
             "capacity-reservation": 'https://{data.get("region", "")}.{data.get("console", "")}/ec2/home?region={data.get("region", "")}#CapacityReservationDetails:capacityReservationId={data.get("resource", "")}',
@@ -387,7 +392,7 @@ def get_links() -> Dict:
             "traffic-mirror-session": 'https://{data.get("region", "")}.{data.get("console", "")}/vpcconsole/home?region={data.get("region", "")}#TrafficMirrorSessions:',
             "traffic-mirror-target": 'https://{data.get("region", "")}.{data.get("console", "")}/vpcconsole/home?region={data.get("region", "")}#TrafficMirrorTargets:',
             "transit-gateway": 'https://{data.get("region", "")}.{data.get("console", "")}/vpcconsole/home?region={data.get("region", "")}#TransitGateways:transitGatewayId={data.get("resource", "")}',
-            "transit-gateway-attachment": 'https://{data.get("region", "")}.{data.get("console", "")}/vpcconsole/home?region={data.get("region", "")}#TransitGatewayAttachments:',
+            "transit-gateway-attachment": 'https://{data.get("region", "")}.{data.get("console", "")}/vpcconsole/home?region={data.get("region", "")}#TransitGatewayAttachmentDetails:transitGatewayAttachmentId={data.get("resource", "")}',
             "transit-gateway-multicast-domain": 'https://{data.get("region", "")}.{data.get("console", "")}/vpcconsole/home?region={data.get("region", "")}#TransitGatewayMulticastDomains:',
             "transit-gateway-route-table": 'https://{data.get("region", "")}.{data.get("console", "")}/vpcconsole/home?region={data.get("region", "")}#TransitGatewayRouteTables:',
             "volume": 'https://{data.get("region", "")}.{data.get("console", "")}/ec2\
@@ -414,19 +419,19 @@ def get_links() -> Dict:
                 {data.get("account", "")}/{data.get("resource", "")}?region={data.get("region", "")}',
         },
         "ecs": {  # Amazon Elastic Container Service
-            "cluster": 'https://{data.get("region", "")}.{data.get("console", "")}/ecs/home?region={data.get("region", "")}#/clusters/{data.get("resource", "")}',
-            "container-instance": 'https://{data.get("region", "")}.{data.get("console", "")}/ecs/home?region={data.get("region", "")}#/clusters/{data.get("resource", "")}/containerInstances',
-            "service": 'https://{data.get("region", "")}.{data.get("console", "")}/ecs/home?region={data.get("region", "")}#/clusters/{data.get("resource", "")}/services',
-            "task": 'https://{data.get("region", "")}.{data.get("console", "")}/ecs/home?region={data.get("region", "")}#/clusters/{data.get("resource", "")}/tasks',
-            "task-definition": 'https://{data.get("region", "")}.{data.get("console", "")}/ecs\
-                    /home?region={data.get("region", "")}#/taskDefinitions/{data.get("resource", "")}',
+            # Resource paths are cluster/<id>; the classic #/clusters console is retired, so these use /ecs/v2.
+            "cluster": 'https://{data.get("region", "")}.{data.get("console", "")}/ecs/v2/clusters/{resource_part(0)}?region={data.get("region", "")}',
+            "container-instance": 'https://{data.get("region", "")}.{data.get("console", "")}/ecs/v2/clusters/{resource_part(0)}/infrastructure?region={data.get("region", "")}',
+            "service": 'https://{data.get("region", "")}.{data.get("console", "")}/ecs/v2/clusters/{resource_part(0)}/services/{resource_part(1)}?region={data.get("region", "")}',
+            "task": 'https://{data.get("region", "")}.{data.get("console", "")}/ecs/v2/clusters/{resource_part(0)}/tasks/{resource_part(1)}?region={data.get("region", "")}',
+            "task-definition": 'https://{data.get("region", "")}.{data.get("console", "")}/ecs/v2/task-definitions/{resource_part(0)}?region={data.get("region", "")}',
             "task-set": None,  # task-set is a sub-resource of service, no direct deep-link
         },
         "eks": {  # Amazon Elastic Container Service for Kubernetes
             "cluster": 'https://{data.get("region", "")}.{data.get("console", "")}/eks/home?region={data.get\
                 ("region", "")}#/clusters/{data.get("resource", "")}',
             "fargateprofile": 'https://{data.get("region", "")}.{data.get("console", "")}/eks/home?region={data.get("region", "")}#/clusters/{data.get("resource", "")}/fargate-profiles',
-            "nodegroup": 'https://{data.get("region", "")}.{data.get("console", "")}/eks/home?region={data.get("region", "")}#/clusters/{data.get("resource", "")}/nodegroups',
+            "nodegroup": 'https://{data.get("region", "")}.{data.get("console", "")}/eks/home?region={data.get("region", "")}#/clusters/{resource_part(0)}/nodegroups/{resource_part(1)}',
         },
         "elastic-inference": {  # Amazon Elastic Inference (retired April 2024)
             "elastic-inference-accelerator": None,  # service retired
@@ -456,10 +461,20 @@ def get_links() -> Dict:
             "file-system": 'https://{data.get("region", "")}.{data.get("console", "")}/efs/home?region={data.get("region", "")}#/file-systems/{data.get("resource", "")}',
         },
         "elasticloadbalancing": {  # AWS WAF V2
-            "listener": 'https://{data.get("region", "")}.{data.get("console", "")}/ec2/home?region={data.get("region", "")}#LoadBalancers:',
+            # A listener (listener/app/<lb>/<lb-id>/<id>) links to its load balancer's page.
+            "listener": 'https://{data.get("region", "")}.{data.get("console", "")}/ec2/home?region={data.get("region", "")}\
+                #LoadBalancer:loadBalancerArn=arn:{partition}:elasticloadbalancing:{data.get("region", "")}:\
+                {data.get("account", "")}:loadbalancer/{resource_part(0)}/{resource_part(1)}/{resource_part(2)}',
             "listener-rule": None,  # sub-resource of listener, no direct deep-link
+            # Classic load balancers (loadbalancer/<name>) have no ARN-addressable page.
             "loadbalancer": 'https://{data.get("region", "")}.{data.get("console", "")}/ec2/\
                         home?region={data.get("region", "")}#LoadBalancers:sort=loadBalancerName',
+            "loadbalancer/app": 'https://{data.get("region", "")}.{data.get("console", "")}/ec2/home?region=\
+                {data.get("region", "")}#LoadBalancer:loadBalancerArn={arn}',
+            "loadbalancer/net": 'https://{data.get("region", "")}.{data.get("console", "")}/ec2/home?region=\
+                {data.get("region", "")}#LoadBalancer:loadBalancerArn={arn}',
+            "loadbalancer/gwy": 'https://{data.get("region", "")}.{data.get("console", "")}/ec2/home?region=\
+                {data.get("region", "")}#LoadBalancer:loadBalancerArn={arn}',
             "targetgroup": 'https://{data.get("region", "")}.{data.get("console", "")}/ec2/home?region={data.get("region", "")}#TargetGroups:targetGroupArn={arn}',
         },
         "elasticmapreduce": {  # Amazon Elastic MapReduce
@@ -484,6 +499,8 @@ def get_links() -> Dict:
                         home?region={data.get("region", "")}#opensearch/domains/{data.get("resource", "")}',
             "reserved_instance": 'https://{data.get("region", "")}.{data.get("console", "")}/esv3/\
                         home?region={data.get("region", "")}#opensearch/reserved-instances',
+            "reserved-instances": 'https://{data.get("region", "")}.{data.get("console", "")}/esv3/\
+                        home?region={data.get("region", "")}#opensearch/reserved-instances',
         },
         "events": {  # Amazon EventBridge
             "event-bus": 'https://{data.get("region", "")}.{data.get("console", "")}/events/home?region={data.get("region", "")}#/eventbus/{data.get("resource", "")}',
@@ -585,7 +602,7 @@ def get_links() -> Dict:
             "saml-provider": 'https://{data.get("console", "")}/iamv2/home#/identity-providers',
             "server-certificate": 'https://{data.get("console", "")}/iam/home?#/server-certificates',
             "sms-mfa": None,  # no direct console deep-link for SMS MFA device
-            "user": 'https://{data.get("console", "")}/iam/home?#/users/{data.get("resource", "")}',
+            "user": 'https://{data.get("console", "")}/iam/home?#/users/{get_resource_path(data.get("resource", ""))}',
             "access_keys": 'https://{data.get("console", "")}/iam/home#/users/{data.get("resource", "")}?section=security_credentials',
             "policy_statement": 'https://{data.get("console", "")}/iam/home?#/policies/{get_arn_string(data)}',
         },
@@ -729,7 +746,7 @@ def get_links() -> Dict:
             "StaticIp": "https://lightsail.aws.amazon.com/ls/webapp/home/static-ips",
         },
         "logs": {  # Amazon CloudWatch Logs
-            "log-group": 'https://{data.get("region", "")}.{data.get("console", "")}/cloudwatch/home?region={data.get("region", "")}#logsV2:log-groups/log-group/{data.get("resource", "")}',
+            "log-group": 'https://{data.get("region", "")}.{data.get("console", "")}/cloudwatch/home?region={data.get("region", "")}#logsV2:log-groups/log-group/{log_group_id}',
         },
         "lookoutequipment": {  # Amazon Lookout for Equipment
             "dataset": 'https://{data.get("region", "")}.{data.get("console", "")}/lookoutequipment/home?region={data.get("region", "")}#/datasets/{data.get("resource", "")}',
@@ -850,7 +867,7 @@ def get_links() -> Dict:
         "organizations": {  # AWS Organizations
             "account": 'https://{data.get("console", "")}/organizations/v2/home/accounts/{data.get("resource", "")}',
             "handshake": None,  # no direct console deep-link for handshakes
-            "organization": 'https://{data.get("region", "")}.{data.get("console", "")}/organizations/v2/home/accounts/{data.get("resource", "")}',
+            "organization": 'https://{data.get("console", "")}/organizations/v2/home',
             "ou": 'https://{data.get("console", "")}/organizations/v2/home/roots',
             "policy": 'https://{data.get("console", "")}/organizations/v2/home/policies/{data.get("resource", "")}',
             "root": 'https://{data.get("console", "")}/organizations/v2/home/roots',
@@ -923,8 +940,8 @@ def get_links() -> Dict:
             "ri": 'https://{data.get("region", "")}.{data.get("console", "")}/rds/home?region={data.get("region", "")}#reserved-instances:',
             "secgrp": 'https://{data.get("region", "")}.{data.get("console", "")}/vpc/home?region=\
                 {data.get("region", "")}#SecurityGroup:groupId={data.get("resource", "")}',
-            "snapshot": 'https://{data.get("region", "")}.{data.get("console", "")}/rds/home?region={data.get("region", "")}#db-snapshot:engine=sqlserver-ee;id={arn}',
-            "subgrp": 'https://{data.get("region", "")}.{data.get("console", "")}/rds/home?region={data.get("region", "")}#subnet-groups-list:',
+            "snapshot": 'https://{data.get("region", "")}.{data.get("console", "")}/rds/home?region={data.get("region", "")}#db-snapshot:id={data.get("resource", "")}',
+            "subgrp": 'https://{data.get("region", "")}.{data.get("console", "")}/rds/home?region={data.get("region", "")}#db-subnet-group:id={data.get("resource", "")}',
             "target": None,  # sub-resource of db-proxy, no direct deep-link
             "target-group": None,  # sub-resource of db-proxy, no direct deep-link
         },
@@ -976,14 +993,16 @@ def get_links() -> Dict:
             "change": None,  # internal resource, no direct console page
             "delegationset": 'https://{data.get("console", "")}/route53/home#/hosted-zones',
             "healthcheck": 'https://{data.get("console", "")}/route53/healthchecks/home',
-            "hostedzone": 'https://{data.get("console", "")}/route53/home?#resource-record-sets:\
-            {data.get("resource", "")}',
+            # get_resource_path also accepts the "hostedzone//hostedzone/Z1" ARNs built from the API's zone Id.
+            "hostedzone": 'https://{data.get("console", "")}/route53/v2/hostedzones#ListRecordSets/\
+            {get_resource_path(data.get("resource", ""))}',
             "queryloggingconfig": 'https://{data.get("console", "")}/route53/home#/query-logging',
             "trafficpolicy": 'https://{data.get("console", "")}/route53/trafficflow/home#/policy/\
             {data.get("resource", "")}',
             "trafficpolicyinstance": 'https://{data.get("console", "")}/route53/trafficflow/home#/\
             modify-records/edit/{data.get("resource", "")}',
-            "domains": 'https://{data.get("region", "")}.{data.get("console", "")}/route53/home#DomainListing:',
+            # Route 53 Domains is global: its ARNs carry no region, so the host has none.
+            "domains": 'https://{data.get("console", "")}/route53/home#DomainListing:',
         },
         "route53resolver": {  # Amazon Route 53 Resolver
             "resolver-endpoint": 'https://{data.get("region", "")}.{data.get("console", "")}/route53resolver/home?region={data.get("region", "")}#/endpoints/{data.get("resource", "")}',
@@ -1105,8 +1124,9 @@ def get_links() -> Dict:
             "windowtask": 'https://{data.get("region", "")}.{data.get("console", "")}/systems-manager/maintenance-windows?region={data.get("region", "")}',
         },
         "sso": {  # AWS IAM Identity Center
+            # Identity Center ARNs carry no region; the console opens the instance's home region.
             "instance": 'https://{data.get("region", "")}.{data.get("console", "")}/singlesignon/home?region={data.get("region", "")}',
-            "permissionSet": 'https://{data.get("region", "")}.{data.get("console", "")}/singlesignon/home?region={data.get("region", "")}#/permission-sets/{data.get("resource", "")}',
+            "permissionSet": 'https://{data.get("region", "")}.{data.get("console", "")}/singlesignon/home?region={data.get("region", "")}',
         },
         "states": {  # AWS Step Functions
             "activity": 'https://{data.get("region", "")}.{data.get("console", "")}/states/home?region={data.get("region", "")}#/activities/{arn}',
@@ -1177,6 +1197,11 @@ def get_links() -> Dict:
             "xssmatchset": None,  # WAF Classic condition, no dedicated console deep-link
         },
         "wafv2": {  # AWS WAF V2
+            # Web ACL ARNs: {regional|global}/webacl/<name>/<id>; global (CloudFront) ACLs use region=global.
+            "regional/webacl": 'https://{data.get("region", "")}.{data.get("console", "")}/wafv2/homev2/web-acl/\
+                {resource_part(1)}/{resource_part(2)}/overview?region={data.get("region", "")}',
+            "global/webacl": 'https://{data.get("region", "")}.{data.get("console", "")}/wafv2/homev2/web-acl/\
+                {resource_part(1)}/{resource_part(2)}/overview?region=global',
         },
         "wellarchitected": {  # AWS Well-Architected Tool
             "workload": 'https://{data.get("region", "")}.{data.get("console", "")}/wellarchitected/home?region={data.get("region", "")}#/workload/{data.get("resource", "")}',

cloudconsolelink-4.2.0/cloudconsolelink/clouds/azure/__init__.py

@@ -0,0 +1,160 @@
+import logging
+import re
+from typing import Tuple
+
+
+logger = logging.getLogger(__name__)
+
+PORTAL = "https://portal.azure.com"
+SUBSCRIPTIONS_BLADE = f"{PORTAL}/#view/Microsoft_Azure_Billing/SubscriptionsBlade"
+ACTIVITY_LOG_BLADE = f"{PORTAL}/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/activityLog"
+
+_GUID_RE = re.compile(r"^[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$")
+_PROVIDERS_RE = re.compile(r"/providers/", re.IGNORECASE)
+_AUTHORIZATION_RE = re.compile(r"/providers/microsoft\.authorization/", re.IGNORECASE)
+
+# Nested ARM types the portal opens as resources in their own right, so a link keeps
+# drilling into them instead of stopping at their parent. Keys are lowercase type paths.
+FIRST_CLASS_CHILDREN = {
+    "microsoft.sql/servers/databases",
+    "microsoft.sql/servers/elasticpools",
+    "microsoft.sql/managedinstances/databases",
+    "microsoft.web/sites/slots",
+}
+
+# Nested ARM types with no page of their own: link to the parent blade that lists them.
+# Anything nested and not listed here links to the parent's overview.
+CHILD_BLADES = {
+    "microsoft.network/virtualnetworks/subnets": "subnets",
+    "microsoft.network/routetables/routes": "routes",
+    "microsoft.network/networksecuritygroups/securityrules": "inboundSecurityRules",
+    "microsoft.network/networksecuritygroups/defaultsecurityrules": "inboundSecurityRules",
+    "microsoft.containerservice/managedclusters/agentpools": "nodePools",
+    "microsoft.storage/storageaccounts/blobservices": "containersList",
+    "microsoft.storage/storageaccounts/fileservices": "fileList",
+    "microsoft.storage/storageaccounts/queueservices": "queueList",
+    "microsoft.storage/storageaccounts/tableservices": "tableList",
+    "microsoft.compute/virtualmachines/extensions": "extensions",
+    "microsoft.compute/virtualmachinescalesets/extensions": "extensions",
+    "microsoft.documentdb/databaseaccounts/sqldatabases": "dataExplorer",
+    "microsoft.documentdb/databaseaccounts/mongodbdatabases": "dataExplorer",
+    "microsoft.documentdb/databaseaccounts/cassandrakeyspaces": "dataExplorer",
+    "microsoft.documentdb/databaseaccounts/gremlindatabases": "dataExplorer",
+    "microsoft.documentdb/databaseaccounts/tables": "dataExplorer",
+    "microsoft.web/sites/config": "configuration",
+    "microsoft.web/sites/slots/config": "configuration",
+    "microsoft.containerregistry/registries/replications": "replications",
+    "microsoft.containerregistry/registries/webhooks": "webhooks",
+}
+
+# Provider types with no portal page at all: link to the scope they live under.
+SCOPE_ONLY_TYPES = {
+    "microsoft.security/securitycontacts",
+    "microsoft.network/locations",
+}
+
+
+def _anchor_and_blade(segments: list) -> Tuple[str, str]:
+    """Split `ns/type/name[/childType/childName...]` into the linkable resource and its blade."""
+    type_path = "/".join(segments[:2]).lower()
+    end = 3
+    while (
+        len(segments) > end
+        and f"{type_path}/{segments[end].lower()}" in FIRST_CLASS_CHILDREN
+    ):
+        type_path = f"{type_path}/{segments[end].lower()}"
+        end += 2
+    if len(segments) <= end:
+        return "/".join(segments), "overview"
+    return "/".join(segments[:end]), CHILD_BLADES.get(
+        f"{type_path}/{segments[end].lower()}",
+        "overview",
+    )
+
+
+def _management_link(arm_id: str, domain: str) -> str:
+    base = f"{PORTAL}/#@{domain}/resource"
+    if _GUID_RE.match(arm_id):  # bare subscription id
+        return f"{base}/subscriptions/{arm_id}/overview"
+
+    authorization = _AUTHORIZATION_RE.search(arm_id)
+    if (
+        authorization
+    ):  # role definitions/assignments: the scope's Access control (IAM) blade
+        scope = arm_id[: authorization.start()]
+        return f"{base}{scope}/users" if scope else SUBSCRIPTIONS_BLADE
+
+    parts = _PROVIDERS_RE.split(arm_id, maxsplit=1)
+    if len(parts) == 1:  # subscription or resource group
+        return f"{base}{arm_id}/overview"
+
+    scope, tail = parts
+    segments = tail.split("/")
+    type_path = "/".join(segments[:2]).lower()
+    if type_path == "microsoft.insights/logprofiles":
+        return ACTIVITY_LOG_BLADE
+    if type_path in SCOPE_ONLY_TYPES:
+        return f"{base}{scope}/overview" if scope else SUBSCRIPTIONS_BLADE
+
+    anchor, blade = _anchor_and_blade(segments)
+    return f"{base}{scope}/providers/{anchor}/{blade}"
+
+
+def _key_vault_link(uri: str, domain: str) -> str:
+    for marker, kind in (
+        ("/keys/", "Key"),
+        ("/secrets/", "Secret"),
+        ("/certificates/", "Certificate"),
+    ):
+        if marker in uri:
+            return f"{PORTAL}/#@{domain}/asset/Microsoft_Azure_KeyVault/{kind}/{uri}"
+    return ""
+
+
+class AzureLinker:
+    def get_console_link(
+        self,
+        id: str,
+        app_id: str = "",
+        primary_ad_domain_name: str = "",
+        iam_entity_type: str = "",
+    ) -> str:
+        if not primary_ad_domain_name and not iam_entity_type:
+            logger.debug(
+                "For IAM entity required `iam_entity_type` and for other entity required `primary_ad_domain_name`",
+            )
+            raise ValueError("Invalid parameters provided")
+        iam_entities = {
+            "user": "https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/{id}",
+            "group": "https://portal.azure.com/#blade/Microsoft_AAD_IAM/GroupDetailsMenuBlade/Overview/groupId/{id}",
+            "application": "https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade\
+            /Overview/appId/{id}",
+            "role": "https://portal.azure.com/#@{primary_ad_domain_name}/resource{id}/roles",
+            "service_principal": "https://portal.azure.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Properties/\
+                                objectId/{id}/appId/{app_id}/preferredSingleSignOnMode~/null",
+            "domain": "https://portal.azure.com/#view/Microsoft_AAD_IAM/DomainPropertiesBladeV2/domainName/{id}",
+            "tenant": "https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Overview",
+        }
+
+        if iam_entity_type and id and iam_entities.get(iam_entity_type):
+            return (
+                iam_entities[iam_entity_type]
+                .format(
+                    id=id,
+                    primary_ad_domain_name=primary_ad_domain_name,
+                    app_id=app_id,
+                )
+                .replace(" ", "")
+            )
+
+        elif primary_ad_domain_name and id:
+            if id.startswith("https"):
+                key_vault_link = _key_vault_link(id, primary_ad_domain_name)
+                if key_vault_link:
+                    return key_vault_link
+
+            return _management_link(id, primary_ad_domain_name)
+
+        else:
+            logger.debug("entity id required")
+            raise ValueError("Invalid parameters provided")