def add_key_user_grant(s3_conn, bucket_name, key_name, permission, canonical_ids):
"""
Boto wrapper that provides a quick way to add a canonical
user grant to a key.
:type permission: string
:param permission: Name of the bucket where the key resides
:type permission: string
:param permission: Name of the key to add the permission to
:type permission: string
:param permission: The permission being granted. Should be one of:
(READ, WRITE, READ_ACP, WRITE_ACP, FULL_CONTROL).
:type user_id: list of strings
:param canonical_ids: A list of strings with canonical user ids associated
with the AWS account your are granting the permission to.
"""
b = get_bucket(s3_conn, bucket_name)
if b:
try:
k = Key(b, key_name)
if k.exists():
for c_id in canonical_ids:
log.debug("Adding '%s' permission for key '%s' for user '%s'" % (
permission, key_name, c_id))
k.add_user_grant(permission, c_id)
return True
except S3ResponseError as e:
log.error("Could not add permission '%s' for bucket '%s': %s" % (
permission, bucket_name, e))
return False
def do_emit(self):
servo.log.debug('Trying to emit access log of %d entries' % len(self._logs))
print 'Trying to emit access log of %d entries' % len(self._logs)
aws_access_key_id = config.get_access_key_id()
aws_secret_access_key = config.get_secret_access_key()
security_token = config.get_security_token()
conn = boto.connect_s3(aws_access_key_id=aws_access_key_id, aws_secret_access_key=aws_secret_access_key, security_token=security_token, is_secure=False, port=8773, path='/services/objectstorage', host= config.get_objectstorage_service_host(), calling_format='boto.s3.connection.OrdinaryCallingFormat')
if not conn:
raise Exception('Could not connect to object storage (S3) service')
key_name = self.generate_log_file_name()
tmpfile = tempfile.mkstemp()
fd = os.fdopen(tmpfile[0],'w')
tmpfile_path = tmpfile[1]
for line in self._logs:
fd.write(line+'\n')
fd.close()
bucket = conn.get_bucket(self.bucket_name)
k = Key(bucket)
k.key = key_name
k.set_contents_from_filename(tmpfile_path)
k.add_user_grant('FULL_CONTROL', config.get_owner_account_id())
os.unlink(tmpfile_path)
servo.log.debug('Access logs were emitted successfully: s3://%s/%s' % (self.bucket_name,key_name))
