def _make_resource_statement(resource_group_info, logical_resource_name,
metadata_key):
try:
response = discovery_utils.try_with_backoff(
lambda: resource_group_info.get_client().describe_stack_resource(
StackName=resource_group_info.stack_arn,
LogicalResourceId=logical_resource_name))
print 'describe_stack_resource(LogicalResourceId="{}", StackName="{}") response: {}'.format(
logical_resource_name, resource_group_info.stack_arn, response)
except Exception as e:
print 'describe_stack_resource(LogicalResourceId="{}", StackName="{}") error: {}'.format(
logical_resource_name, resource_group_info.stack_arn,
getattr(e, 'response', e))
raise e
resource = response['StackResourceDetail']
metadata = discovery_utils.get_cloud_canvas_metadata(
resource, metadata_key)
if metadata is None:
return None
metadata_actions = metadata.get('Action', None)
if metadata_actions is None:
raise ValidationError(
'No Action was specified for CloudCanvas Access metdata on the {} resource in stack {}.'
.format(logical_resource_name, resource_group_info.stack_arn))
if not isinstance(metadata_actions, list):
metadata_actions = [metadata_actions]
for action in metadata_actions:
if not isinstance(action, basestring):
raise ValidationError(
'Non-string Action specified for CloudCanvas Access metadata on the {} resource in stack {}.'
.format(logical_resource_name, resource_group_info.stack_arn))
if 'PhysicalResourceId' not in resource:
return None
if 'ResourceType' not in resource:
return None
resource = discovery_utils.get_resource_arn(resource_group_info.stack_arn,
resource['ResourceType'],
resource['PhysicalResourceId'])
resource_suffix = metadata.get('ResourceSuffix', None)
if resource_suffix is not None:
resource += resource_suffix
return {
'Sid': logical_resource_name + 'Access',
'Effect': 'Allow',
'Action': metadata_actions,
'Resource': resource
}
def _make_resource_statement(cf, stack_arn, policy_name, logical_resource_name,
policy_metadata_filter):
print 'describe_stack_resource on resource {} in stack {}.'.format(
logical_resource_name, stack_arn)
try:
res = discovery_utils.try_with_backoff(
lambda: cf.describe_stack_resource(
StackName=stack_arn, LogicalResourceId=logical_resource_name))
print 'describe_stack_resource {} result: {}'.format(
logical_resource_name, res)
except Exception as e:
print 'describe_stack_resource {} error: {}'.format(
logical_resource_name, getattr(e, 'response', e))
raise e
resource = res['StackResourceDetail']
metadata = _get_metadata_for_role(resource, policy_name,
policy_metadata_filter)
if metadata is None:
return
metadata_actions = metadata.get('Action', None)
if metadata_actions is None:
raise ValidationError(
'No Action was specified for CloudCanvas {} metdata on the {} resource in stack {}.'
.format(policy_name, resource['LogicalResourceId'], stack_arn))
if not isinstance(metadata_actions, list):
metadata_actions = [metadata_actions]
for action in metadata_actions:
if not isinstance(action, basestring):
raise ValidationError(
'Non-string Action specified for CloudCanvas {} metadata on the {} resource in stack {}.'
.format(policy_name, resource['LogicalResourceId'], stack_arn))
resource = discovery_utils.get_resource_arn(stack_arn,
resource['ResourceType'],
resource['PhysicalResourceId'])
resource_suffix = metadata.get('ResourceSuffix', None)
if resource_suffix is not None:
resource += resource_suffix
return {
'Sid': logical_resource_name + 'Access',
'Effect': 'Allow',
'Action': metadata_actions,
'Resource': resource
}
def _make_resource_statement(feature_info, logical_resource_name):
try:
response = feature_info.get_client().describe_stack_resource(
StackName=feature_info.stack_arn,
LogicalResourceId=logical_resource_name)
print 'describe_stack_resource(LogicalResourceId="{}", StackName="{}") response: {}'.format(
logical_resource_name, feature_info.stack_arn, response)
except Exception as e:
print 'describe_stack_resource(LogicalResourceId="{}", StackName="{}") error: {}'.format(
logical_resource_name, feature_info.stack_arn, e)
raise e
resource = response['StackResourceDetail']
metadata = discovery_utils.get_cloud_canvas_metadata(
resource, 'PlayerAccess')
if metadata is None:
return None
metadata_actions = metadata.get('Action', None)
if metadata_actions is None:
raise ValidationError(
'No Action was specified for CloudCanvas PlayerAccess metdata on the {} resource in stack {}.'
.format(logical_resource_name, feature_info.stack_arn))
if not isinstance(metadata_actions, list):
metadata_actions = [metadata_actions]
for action in metadata_actions:
if not isinstance(action, basestring):
raise ValidationError(
'Non-string Action specified for CloudCanvas PlayerAccess metadata on the {} resource in stack {}.'
.format(logical_resource_name, feature_info.stack_arn))
if 'PhysicalResourceId' not in resource:
return None
return {
'Sid':
logical_resource_name + 'Access',
'Effect':
'Allow',
'Action':
metadata_actions,
'Resource':
discovery_utils.get_resource_arn(feature_info.stack_arn,
resource['ResourceType'],
resource['PhysicalResourceId'])
}
def _make_resource_statement(feature_info, logical_resource_name):
try:
response = discovery_utils.try_with_backoff(lambda : feature_info.get_client().describe_stack_resource(StackName=feature_info.stack_arn, LogicalResourceId=logical_resource_name))
print 'describe_stack_resource(LogicalResourceId="{}", StackName="{}") response: {}'.format(logical_resource_name, feature_info.stack_arn, response)
except Exception as e:
print 'describe_stack_resource(LogicalResourceId="{}", StackName="{}") error: {}'.format(logical_resource_name, feature_info.stack_arn, getattr(e, 'response', e))
raise e
resource = response['StackResourceDetail']
metadata = discovery_utils.get_cloud_canvas_metadata(resource, 'PlayerAccess')
if metadata is None:
return None
metadata_actions = metadata.get('Action', None)
if metadata_actions is None:
raise ValidationError('No Action was specified for CloudCanvas PlayerAccess metdata on the {} resource in stack {}.'.format(
logical_resource_name,
feature_info.stack_arn))
if not isinstance(metadata_actions, list):
metadata_actions = [ metadata_actions ]
for action in metadata_actions:
if not isinstance(action, basestring):
raise ValidationError('Non-string Action specified for CloudCanvas PlayerAccess metadata on the {} resource in stack {}.'.format(
logical_resource_name,
feature_info.stack_arn))
if 'PhysicalResourceId' not in resource:
return None
if 'ResourceType' not in resource:
return None
resource = discovery_utils.get_resource_arn(feature_info.stack_arn, resource['ResourceType'], resource['PhysicalResourceId'])
resource_suffix = metadata.get('ResourceSuffix', None)
if resource_suffix is not None:
resource += resource_suffix
return {
'Sid': logical_resource_name + 'Access',
'Effect': 'Allow',
'Action': metadata_actions,
'Resource': resource
}
def _make_resource_statement(cf, stack_arn, function_name, logical_resource_name):
print 'describe_stack_resource on resource {} in stack {}.'.format(logical_resource_name, stack_arn)
try:
res = discovery_utils.try_with_backoff(lambda : cf.describe_stack_resource(StackName=stack_arn, LogicalResourceId=logical_resource_name))
print 'describe_stack_resource {} result: {}'.format(logical_resource_name, res)
except Exception as e:
print 'describe_stack_resource {} error: {}'.format(logical_resource_name, getattr(e, 'response', e))
raise e
resource = res['StackResourceDetail']
metadata = _get_metadata_for_function(resource, function_name)
if metadata is None:
return
metadata_actions = metadata.get('Action', None)
if metadata_actions is None:
raise ValidationError('No Action was specified for CloudCanvas FunctionAccess metdata on the {} resource in stack {}.'.format(
resource['LogicalResourceId'],
stack_arn))
if not isinstance(metadata_actions, list):
metadata_actions = [ metadata_actions ]
for action in metadata_actions:
if not isinstance(action, basestring):
raise ValidationError('Non-string Action specified for CloudCanvas FunctionAccess metadata on the {} resource in stack {}.'.format(
resource['LogicalResourceId'],
stack_arn))
resource = discovery_utils.get_resource_arn(stack_arn, resource['ResourceType'], resource['PhysicalResourceId'])
resource_suffix = metadata.get('ResourceSuffix', None)
if resource_suffix is not None:
resource += resource_suffix
return {
'Sid': logical_resource_name + 'Access',
'Effect': 'Allow',
'Action': metadata_actions,
'Resource': resource
}