def showRoles(ctx, targetRegion, targetEnv, targetRole):
for role in ctx.currentRoles:
roleName = role['RoleName']
if targetRole != None and roleName != targetRole:
continue
region, env, _ = utils.regionEnvAndRole(roleName)
if targetRegion != None and region != targetRegion:
continue
if targetEnv != None and env != targetEnv:
continue
attached = aws_roles.getAttachedPolicies(ctx, roleName)
ctx.log('Role: %s: %d attached policies:' % (roleName, len(attached)))
for policyName in attached:
policyDoc = csm_policies.getAWSPolicyDocument(ctx,policyName)
utils.showPolicyJson(ctx, policyName, ctx.dumps(policyDoc), 15, 120)
ctx.log('')
def updateModelRoles(ctx, targetRegion, targetEnv, targetRole, constrainToModel):
ctxRoles = ctx.model['roles']
for region in ctxRoles:
if targetRegion != None and region != targetRegion:
continue
for env in ctxRoles[region]:
#defaults = None
if targetEnv != None and env != targetEnv:
continue
for role in ctxRoles[region][env]:
if targetRole != None and role != targetRole:
continue
if not aws_roles.isRoleInAWS(ctx, role):
ctx.vlog('Adding missing role to AWS: %s' % role)
aws_roles.createRole(ctx, role)
if ctx.dry_run:
# Since we are not actually creating the role in
# dry_run mode, we can't try to attach policies.
continue
else:
ctx.log('Model role found in AWS: ' + role)
policies = set(ctxRoles[region][env][role])
attached = set(aws_roles.getAttachedPolicies(ctx, role))
missing = policies.difference(attached)
if len(missing) > 0:
for policyName in missing:
ctx.log('-- Attaching policy: %s' % policyName)
aws_roles.attachPolicy(ctx, role, policyName)
if not constrainToModel:
continue
# Remove attached policies that are not in the model
extra = attached.difference(policies)
if len(extra) > 0:
for policyName in extra:
ctx.log('-- Unattaching policy: %s' % policyName)
aws_roles.detachPolicy(ctx, role, policyName)
def compareModelRoles(ctx, targetRegion, targetEnv, targetRole, isAudit, no_diff, diff_type, context_lines):
ctxRoles = ctx.model['roles']
for region in ctxRoles:
if targetRegion != None and region != targetRegion:
continue
for env in ctxRoles[region]:
#defaults = None
if targetEnv != None and env != targetEnv:
continue
for role in ctxRoles[region][env]:
if targetRole != None and role != targetRole:
continue
ctx.log('Model role %-34s' % role, nl=False, bold=True)
if not aws_roles.isRoleInAWS(ctx,role):
ctx.log('NOT FOUND!', fg='red')
continue
ctx.log(' FOUND', bold=True)
policies = set(ctxRoles[region][env][role])
if isAudit:
for policyName in policies:
csm_policies.comparePolicy(ctx, policyName, no_diff, diff_type, context_lines, ' ')
attached = set(aws_roles.getAttachedPolicies(ctx, role))
missing = policies.difference(attached)
if len(missing) > 0:
ctx.log(' -- Model policies not attached:', fg='cyan')
for policyName in missing:
ctx.log(' %s' % policyName)
extra = attached.difference(policies)
if len(extra) > 0:
ctx.log(' -- Attached policies not in model:', fg='cyan')
for policyName in extra:
ctx.log(' %s' % policyName)
