def _get_metadata_for_role(resource, policy_name, policy_metadata_filter):
metadata = discovery_utils.get_cloud_canvas_metadata(resource, policy_name)
if metadata is None:
return None
if isinstance(metadata, dict):
metadata = [metadata]
if not isinstance(metadata, list):
raise ValidationError(
'{} metadata not an object or list on resource {} in stack {}.'.
format(policy_name, resource['LogicalResourceId'], stack_arn))
entry_found = None
for entry in metadata:
try:
entry_accepted = policy_metadata_filter(entry)
except ValidationError as e:
raise ValidationError(
'Invalid {} metadata entry was found on resource {} in stack {}. {}'
.format(policy_name, logical_resource_name, stack_arn,
e.message))
if entry_accepted:
if entry_found is not None:
raise ValidationError(
'More than one applicable {} metadata entry was found on resource {} in stack {}.'
.format(policy_name, logical_resource_name, stack_arn))
entry_found = entry
return entry_found
def _make_resource_statement(resource_group_info, logical_resource_name,
metadata_key):
try:
response = discovery_utils.try_with_backoff(
lambda: resource_group_info.get_client().describe_stack_resource(
StackName=resource_group_info.stack_arn,
LogicalResourceId=logical_resource_name))
print 'describe_stack_resource(LogicalResourceId="{}", StackName="{}") response: {}'.format(
logical_resource_name, resource_group_info.stack_arn, response)
except Exception as e:
print 'describe_stack_resource(LogicalResourceId="{}", StackName="{}") error: {}'.format(
logical_resource_name, resource_group_info.stack_arn,
getattr(e, 'response', e))
raise e
resource = response['StackResourceDetail']
metadata = discovery_utils.get_cloud_canvas_metadata(
resource, metadata_key)
if metadata is None:
return None
metadata_actions = metadata.get('Action', None)
if metadata_actions is None:
raise ValidationError(
'No Action was specified for CloudCanvas Access metdata on the {} resource in stack {}.'
.format(logical_resource_name, resource_group_info.stack_arn))
if not isinstance(metadata_actions, list):
metadata_actions = [metadata_actions]
for action in metadata_actions:
if not isinstance(action, basestring):
raise ValidationError(
'Non-string Action specified for CloudCanvas Access metadata on the {} resource in stack {}.'
.format(logical_resource_name, resource_group_info.stack_arn))
if 'PhysicalResourceId' not in resource:
return None
if 'ResourceType' not in resource:
return None
resource = discovery_utils.get_resource_arn(resource_group_info.stack_arn,
resource['ResourceType'],
resource['PhysicalResourceId'])
resource_suffix = metadata.get('ResourceSuffix', None)
if resource_suffix is not None:
resource += resource_suffix
return {
'Sid': logical_resource_name + 'Access',
'Effect': 'Allow',
'Action': metadata_actions,
'Resource': resource
}
def _make_resource_statement(feature_info, logical_resource_name):
try:
response = feature_info.get_client().describe_stack_resource(
StackName=feature_info.stack_arn,
LogicalResourceId=logical_resource_name)
print 'describe_stack_resource(LogicalResourceId="{}", StackName="{}") response: {}'.format(
logical_resource_name, feature_info.stack_arn, response)
except Exception as e:
print 'describe_stack_resource(LogicalResourceId="{}", StackName="{}") error: {}'.format(
logical_resource_name, feature_info.stack_arn, e)
raise e
resource = response['StackResourceDetail']
metadata = discovery_utils.get_cloud_canvas_metadata(
resource, 'PlayerAccess')
if metadata is None:
return None
metadata_actions = metadata.get('Action', None)
if metadata_actions is None:
raise ValidationError(
'No Action was specified for CloudCanvas PlayerAccess metdata on the {} resource in stack {}.'
.format(logical_resource_name, feature_info.stack_arn))
if not isinstance(metadata_actions, list):
metadata_actions = [metadata_actions]
for action in metadata_actions:
if not isinstance(action, basestring):
raise ValidationError(
'Non-string Action specified for CloudCanvas PlayerAccess metadata on the {} resource in stack {}.'
.format(logical_resource_name, feature_info.stack_arn))
if 'PhysicalResourceId' not in resource:
return None
return {
'Sid':
logical_resource_name + 'Access',
'Effect':
'Allow',
'Action':
metadata_actions,
'Resource':
discovery_utils.get_resource_arn(feature_info.stack_arn,
resource['ResourceType'],
resource['PhysicalResourceId'])
}
def _make_resource_statement(feature_info, logical_resource_name):
try:
response = discovery_utils.try_with_backoff(lambda : feature_info.get_client().describe_stack_resource(StackName=feature_info.stack_arn, LogicalResourceId=logical_resource_name))
print 'describe_stack_resource(LogicalResourceId="{}", StackName="{}") response: {}'.format(logical_resource_name, feature_info.stack_arn, response)
except Exception as e:
print 'describe_stack_resource(LogicalResourceId="{}", StackName="{}") error: {}'.format(logical_resource_name, feature_info.stack_arn, getattr(e, 'response', e))
raise e
resource = response['StackResourceDetail']
metadata = discovery_utils.get_cloud_canvas_metadata(resource, 'PlayerAccess')
if metadata is None:
return None
metadata_actions = metadata.get('Action', None)
if metadata_actions is None:
raise ValidationError('No Action was specified for CloudCanvas PlayerAccess metdata on the {} resource in stack {}.'.format(
logical_resource_name,
feature_info.stack_arn))
if not isinstance(metadata_actions, list):
metadata_actions = [ metadata_actions ]
for action in metadata_actions:
if not isinstance(action, basestring):
raise ValidationError('Non-string Action specified for CloudCanvas PlayerAccess metadata on the {} resource in stack {}.'.format(
logical_resource_name,
feature_info.stack_arn))
if 'PhysicalResourceId' not in resource:
return None
if 'ResourceType' not in resource:
return None
resource = discovery_utils.get_resource_arn(feature_info.stack_arn, resource['ResourceType'], resource['PhysicalResourceId'])
resource_suffix = metadata.get('ResourceSuffix', None)
if resource_suffix is not None:
resource += resource_suffix
return {
'Sid': logical_resource_name + 'Access',
'Effect': 'Allow',
'Action': metadata_actions,
'Resource': resource
}
def _get_metadata_for_function(resource, function_name):
metadata = discovery_utils.get_cloud_canvas_metadata(resource, POLICY_NAME)
if metadata is None:
return None
if isinstance(metadata, dict):
metadata = [ metadata ]
if not isinstance(metadata, list):
raise ValidationError('FunctionAccess metadata not an object or list on resource {} in stack {}.'.format(
logical_resource_name,
stack_arn))
entry_found = None
for entry in metadata:
metadata_function_name = entry.get('FunctionName', None)
if not metadata_function_name:
raise ValidationError('No FunctionName specified for CloudCanvas FunctionAccess metdata on the {} resource in stack {}.'.format(
logical_resource_name,
stack_arn))
if not isinstance(metadata_function_name, basestring):
raise ValidationError('Non-string FunctionName specified for CloudCanvas FunctionAccess metadata on the {} resource in stack {}.'.format(
logical_resource_name,
stack_arn))
if metadata_function_name == function_name:
if entry_found is not None:
raise ValidationError('More than one FunctionAccess metadata entry was found for function {} on resource {} in stack {}.'.format(
function_name,
logical_resource_name,
stack_arn))
entry_found = entry
return entry_found
def _get_metadata_for_function(resource, function_name):
metadata = discovery_utils.get_cloud_canvas_metadata(resource, POLICY_NAME)
if metadata is None:
return None
if isinstance(metadata, dict):
metadata = [metadata]
if not isinstance(metadata, list):
raise ValidationError(
'FunctionAccess metadata not an object or list on resource {} in stack {}.'
.format(logical_resource_name, stack_arn))
entry_found = None
for entry in metadata:
metadata_function_name = entry.get('FunctionName', None)
if not metadata_function_name:
raise ValidationError(
'No FunctionName specified for CloudCanvas FunctionAccess metdata on the {} resource in stack {}.'
.format(logical_resource_name, stack_arn))
if not isinstance(metadata_function_name, basestring):
raise ValidationError(
'Non-string FunctionName specified for CloudCanvas FunctionAccess metadata on the {} resource in stack {}.'
.format(logical_resource_name, stack_arn))
if metadata_function_name == function_name:
if entry_found is not None:
raise ValidationError(
'More than one FunctionAccess metadata entry was found for function {} on resource {} in stack {}.'
.format(function_name, logical_resource_name, stack_arn))
entry_found = entry
return entry_found