qontract-reconcile 0.10.2.dev268__py3-none-any.whl → 0.10.2.dev269__py3-none-any.whl

{qontract_reconcile-0.10.2.dev268.dist-info → qontract_reconcile-0.10.2.dev269.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev268
+Version: 0.10.2.dev269
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile

{qontract_reconcile-0.10.2.dev268.dist-info → qontract_reconcile-0.10.2.dev269.dist-info}/RECORD

@@ -8,7 +8,7 @@ reconcile/aws_iam_password_reset.py,sha256=FpAqAXngmLFqkOtOjrz_i90qteUyLHJL0GMjo
 reconcile/aws_support_cases_sos.py,sha256=PDhilxQ4TBxVnxUPIUdTbKEaNUI0wzPiEsB91oHT2fY,3384
 reconcile/blackbox_exporter_endpoint_monitoring.py,sha256=O1wFp52EyF538c6txaWBs8eMtUIy19gyHZ6VzJ6QXS8,3512
 reconcile/checkpoint.py,sha256=gjtS8g6KIyKFYlHMSZjAqDUOlVh83nh4go-9yNrhWZU,5016
-reconcile/cli.py,sha256=C4x30JxgSmKfqhOliWlJaBMsJjtLkd7UpWC9c5wjB4A,112236
+reconcile/cli.py,sha256=ysDzZ-LRzO5D2FfderoNFx_NmYbxfd2iCYaGOhz6Z90,112239
 reconcile/closedbox_endpoint_monitoring_base.py,sha256=_OKz7K7HHw0-gzxeEma8PcUCtd70pRBy7JMoaAm8IVU,4940
 reconcile/cluster_deployment_mapper.py,sha256=5gumAaRCcFXsabUJ1dnuUy9WrP_FEEM5JnOnE8ch9sE,2326
 reconcile/dashdotdb_base.py,sha256=83ZWIf5JJk3P_D69y2TmXRcQr6ELJGlv10OM0h7fJVs,4767
@@ -138,7 +138,7 @@ reconcile/automated_actions/config/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQe
 reconcile/automated_actions/config/integration.py,sha256=EbVJGyEAFf91dHiIlnwbetbqZ3Y7HJOez2Fnexzd550,13853
 reconcile/aws_account_manager/README.md,sha256=_XFM3GZNHUzv--e_navqJuaUWpjC6QrHfulreHynFf0,262
 reconcile/aws_account_manager/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/aws_account_manager/integration.py,sha256=XTamC824imAezzVoQhhwdMOawNcPCOghR_y7i_8bpJI,15343
+reconcile/aws_account_manager/integration.py,sha256=WEbcvF8GocFHJrlz3mmXSOyYHIUrrHxq_SKaImgJQ2c,15346
 reconcile/aws_account_manager/merge_request_manager.py,sha256=q8t-YwD4y_4UpxdoG9TQrEbDpjlzasOQIynFoCjP2OE,3947
 reconcile/aws_account_manager/metrics.py,sha256=YB10ea4kIGwJfs5N14RF-RoXPb-QQWaDBz1jLZ3YWE0,917
 reconcile/aws_account_manager/reconciler.py,sha256=oSuR3xrN6fihmJUl79HSDxH5-MsR7Sfpf7eqiMlwwRg,17141
@@ -669,10 +669,10 @@ reconcile/utils/acs/base.py,sha256=4UsDrCpAOuddL3PKNuIQYoJP1BtZQNNB8_KEX0lXneg,2
 reconcile/utils/acs/policies.py,sha256=jpbi3qpGkBD_X6MfzsX12dPajUbmACmhIOz_0rDvYzs,5489
 reconcile/utils/acs/rbac.py,sha256=ugsLM9Pb7FbUbdq85E3VzXGMaB9ZovXob7tdWCxwqZ8,8808
 reconcile/utils/aws_api_typed/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/utils/aws_api_typed/account.py,sha256=f1UQul336_9rC_iCdzkbTQkhcFh5BjIZsf3X18SACfY,2048
+reconcile/utils/aws_api_typed/account.py,sha256=4UfsVcOKIkR1b6bYlr6lcnYk5A6T-KZWUi1mZoLL40c,3376
 reconcile/utils/aws_api_typed/api.py,sha256=1h_dQXnE7FUAZi4RRgBEU7nbyAz8awRo0cpuilXyhHE,9239
 reconcile/utils/aws_api_typed/dynamodb.py,sha256=AKUbz8HGzmSq4cnpjJe7PgqsikMkjbpbzUD2UJv2b58,383
-reconcile/utils/aws_api_typed/iam.py,sha256=LrHCFRIB5h5GcAD_4Bfb9tOZqH961LI1r03-EuUWfmI,2243
+reconcile/utils/aws_api_typed/iam.py,sha256=uuK5JzVmlWpokyixhd_Oy2pBr_31z_d4Gz7bPeDK71E,2864
 reconcile/utils/aws_api_typed/organization.py,sha256=rmZkm14t30Bm0ctMTtCNzcDrTjOFkal1TO0pHncNxcg,5513
 reconcile/utils/aws_api_typed/s3.py,sha256=J2uOTtEFgMyKT22pa4DbFnV7zfg575m2DeidQaeselM,1034
 reconcile/utils/aws_api_typed/service_quotas.py,sha256=ywPligZTxGgDhJ4TjWzXg5MbQ4j1iGUxonngII_KOHo,3022
@@ -797,7 +797,7 @@ tools/saas_promotion_state/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJ
 tools/saas_promotion_state/saas_promotion_state.py,sha256=oF7C4hpIgyMTwTRm3Aun3cDCHIjVar65JoLp6NcJHlU,3909
 tools/sre_checkpoints/__init__.py,sha256=CDaDaywJnmRCLyl_NCcvxi-Zc0hTi_3OdwKiFOyS39I,145
 tools/sre_checkpoints/util.py,sha256=zEDbGr18ZeHNQwW8pUsr2JRjuXIPz--WAGJxZo9sv_Y,894
-qontract_reconcile-0.10.2.dev268.dist-info/METADATA,sha256=tDfzT1dkLIg6YlPz3iT9K-MvZ2rJOTdMSGsUJ8c3Fzs,24501
-qontract_reconcile-0.10.2.dev268.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-qontract_reconcile-0.10.2.dev268.dist-info/entry_points.txt,sha256=5i9l54La3vQrDLAdwDKQWC0iG4sV9RRfOb1BpvzOWLc,698
-qontract_reconcile-0.10.2.dev268.dist-info/RECORD,,
+qontract_reconcile-0.10.2.dev269.dist-info/METADATA,sha256=Wzl-5Z8F3fPHuNHeOahSh8r4e1Nk-KKbpKlVrcaRheI,24501
+qontract_reconcile-0.10.2.dev269.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+qontract_reconcile-0.10.2.dev269.dist-info/entry_points.txt,sha256=5i9l54La3vQrDLAdwDKQWC0iG4sV9RRfOb1BpvzOWLc,698
+qontract_reconcile-0.10.2.dev269.dist-info/RECORD,,

reconcile/aws_account_manager/integration.py

@@ -53,7 +53,7 @@ class AwsAccountMgmtIntegrationParams(PydanticRunParams):
     )
     # To avoid the accidental deletion of the resource file, explicitly set the
     # qontract.cli option in the integration extraArgs!
-    account_tmpl_resource: str = "/aws-account-manager/account-tmpl.yml"
+    account_tmpl_resource: str = "/aws-account-manager/account-tmpl.yml.j2"
     template_collection_root_path: str = "data/templating/collections/aws-account"
 
 

reconcile/cli.py

@@ -969,7 +969,7 @@ def aws_saml_roles(
     "--account-tmpl-resource",
     help="Resource name of the account template-collection template in the app-interface.",
     required=True,
-    default="/aws-account-manager/account-tmpl.yml",
+    default="/aws-account-manager/account-tmpl.yml.j2",
 )
 @click.option(
     "--template-collection-root-path",

reconcile/utils/aws_api_typed/account.py

@@ -1,11 +1,14 @@
+import logging
 from enum import StrEnum
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
     from mypy_boto3_account import AccountClient
+    from mypy_boto3_account.type_defs import AlternateContactTypeDef
 else:
-    AccountClient = object
+    AccountClient = AlternateContactTypeDef = object
 
+import botocore
 from pydantic import BaseModel
 
 
@@ -22,6 +25,9 @@ class Region(BaseModel):
     status: OptStatus
 
 
+log = logging.getLogger(__name__)
+
+
 class AWSApiAccount:
     def __init__(self, client: AccountClient) -> None:
         self.client = client
@@ -30,13 +36,39 @@ class AWSApiAccount:
         self, name: str, title: str, email: str, phone_number: str
     ) -> None:
         """Set the security contact for the account."""
-        self.client.put_alternate_contact(
-            AlternateContactType="SECURITY",
-            EmailAddress=email,
-            Name=name,
-            Title=title,
-            PhoneNumber=phone_number,
-        )
+        try:
+            self.client.put_alternate_contact(
+                AlternateContactType="SECURITY",
+                EmailAddress=email,
+                Name=name,
+                Title=title,
+                PhoneNumber=phone_number,
+            )
+        except botocore.exceptions.ClientError as e:
+            if e.response["Error"]["Code"] != "AccessDenied":
+                raise
+
+            # This exception is raised if the user does not have permission to perform this action.
+            # Let's see if the current security contact is already set to the same values.
+            current_contact = self.get_security_contact()
+            if (
+                not current_contact
+                or current_contact["EmailAddress"] != email
+                or current_contact["Name"] != name
+                or current_contact["Title"] != title
+                or current_contact["PhoneNumber"] != phone_number
+            ):
+                raise
+
+    def get_security_contact(self) -> AlternateContactTypeDef | None:
+        """Get the security contact for the account."""
+        try:
+            return self.client.get_alternate_contact(AlternateContactType="SECURITY")[
+                "AlternateContact"
+            ]
+        except self.client.exceptions.ResourceNotFoundException:
+            log.warning("Security contact not set.")
+            return None
 
     def list_regions(self) -> list[Region]:
         """List all regions in the account."""

reconcile/utils/aws_api_typed/iam.py

@@ -1,5 +1,6 @@
 from typing import TYPE_CHECKING
 
+import botocore
 from pydantic import BaseModel, Field
 
 if TYPE_CHECKING:
@@ -40,10 +41,12 @@ class AWSApiIam:
         try:
             user = self.client.create_user(UserName=user_name)
             return AWSUser(**user["User"])
-        except self.client.exceptions.EntityAlreadyExistsException:
-            raise AWSEntityAlreadyExistsError(
-                f"User {user_name} already exists"
-            ) from None
+        except botocore.exceptions.ClientError as e:
+            if e.response["Error"]["Code"] == "EntityAlreadyExists":
+                raise AWSEntityAlreadyExistsError(
+                    f"User {user_name} already exists"
+                ) from e
+            raise
 
     def attach_user_policy(self, user_name: str, policy_arn: str) -> None:
         """Attach a policy to a user."""
@@ -60,8 +63,15 @@ class AWSApiIam:
         """Set the account alias."""
         try:
             self.client.create_account_alias(AccountAlias=account_alias)
-        except self.client.exceptions.EntityAlreadyExistsException:
-            if self.get_account_alias() != account_alias:
-                raise ValueError(
-                    "Account alias already exists for another AWS account. Choose another one!"
-                ) from None
+        except botocore.exceptions.ClientError as e:
+            if e.response["Error"]["Code"] == "EntityAlreadyExists":
+                if self.get_account_alias() != account_alias:
+                    raise ValueError(
+                        "Account alias already exists for another AWS account. Choose another one!"
+                    ) from e
+            elif e.response["Error"]["Code"] == "AccessDenied":
+                # AccessDeniedException can occur if the user does not have permission to create an account alias.
+                # This can happen if the alias is already set and we don't have permission to change it.
+                # If the existing alias is the one we want, we can ignore the error.
+                if self.get_account_alias() != account_alias:
+                    raise