def define_iam_roles():
print '------------------------------'
print 'Preparing Vulnpryer IAM Roles'
print '------------------------------'
# Connect to AWS IAM
try:
iam = boto.iam.connect_to_region(region_name=config.get('general', 'iam_aws_region'), aws_access_key_id=config.get('general', 'aws_access_key_id'), aws_secret_access_key=config.get('general', 'aws_secret_access_key'))
iam.get_account_alias()
except:
print "Check keys and configuration before proceeding."
return False
# Prepare Data Pipeline Roles
update_iam_role(iam, config.get('data_pipeline', 'pipeline_role'), 'iam_policies/datapipeline_vulnpryer_role_trust', 'iam_policies/datapipeline_vulnpryer_role_policy')
update_iam_role(iam, config.get('data_pipeline', 'pipeline_resource_role'), 'iam_policies/datapipeline_vulnpryer_resource_role_trust', 'iam_policies/datapipeline_vulnpryer_resource_role_policy')
# Prepare Opsworks Roles
# update_iam_role(iam, config.get('opsworks', 'opsworks_role'), 'iam_policies/opsworks_vulnpryer_role_trust', 'iam_policies/opsworks_vulnpryer_role_policy')
update_iam_role(iam, config.get('opsworks', 'opsworks_resource_role'), 'iam_policies/opsworks_vulnpryer_resource_role_trust', 'iam_policies/opsworks_vulnpryer_resource_role_policy')
print 'Successfully prepared IAM roles'
return True
def check_credentials(region):
iam = boto.iam.connect_to_region(region)
return iam.get_account_alias()
def check_credentials(region):
iam = boto.iam.connect_to_region(region)
return iam.get_account_alias()
# paginator = iam.get_paginator('list_account_aliases')
# for response in paginator.paginate():
# aliases=(response['AccountAliases'])
# alias=aliases[0]
# print alias
# #if alias not defined or do not have permissions to get it
# except:
# #if can not get actual alias, just use account ID
# alias=account_id
try:
iam = boto.connect_iam(
aws_access_key_id=token.credentials.access_key,
aws_secret_access_key=token.credentials.secret_key,
security_token=token.credentials.session_token)
alias = iam.get_account_alias(
).list_account_aliases_response.list_account_aliases_result.account_aliases[
0]
except:
print_debug("Failed to get alias for :\t" + account_id +
".\tUsing account id as alias. ")
alias = account_id
awailable_role = awailable_role + ',' + alias
if (alias == account or account == ''):
subset_roles.append(awailable_role)
awsroles = subset_roles
#print awsroles
print ""
boto_profiles = {}
if ALL_ACCOUNTS: