def instance_present(name, instance_name=None, instance_id=None, image_id=None, image_name=None, tags=None, key_name=None, security_groups=None, user_data=None, instance_type=None, placement=None, kernel_id=None, ramdisk_id=None, vpc_id=None, vpc_name=None, monitoring_enabled=None, subnet_id=None, subnet_name=None, private_ip_address=None, block_device_map=None, disable_api_termination=None, instance_initiated_shutdown_behavior=None, placement_group=None, client_token=None, security_group_ids=None, security_group_names=None, additional_info=None, tenancy=None, instance_profile_arn=None, instance_profile_name=None, ebs_optimized=None, network_interfaces=None, attributes=None, target_state=None, public_ip=None, allocation_id=None, allocate_eip=False, region=None, key=None, keyid=None, profile=None): ### TODO - implement 'target_state={running, stopped}' ''' Ensure an EC2 instance is running with the given attributes and state. name (string) - The name of the state definition. Recommended that this match the instance_name attribute (generally the FQDN of the instance). instance_name (string) - The name of the instance, generally its FQDN. Exclusive with 'instance_id'. instance_id (string) - The ID of the instance (if known). Exclusive with 'instance_name'. image_id (string) – The ID of the AMI image to run. image_name (string) – The name of the AMI image to run. tags (dict) - Tags to apply to the instance. key_name (string) – The name of the key pair with which to launch instances. security_groups (list of strings) – The names of the EC2 classic security groups with which to associate instances user_data (string) – The Base64-encoded MIME user data to be made available to the instance(s) in this reservation. instance_type (string) – The EC2 instance size/type. Note that only certain types are compatible with HVM based AMIs. placement (string) – The Availability Zone to launch the instance into. kernel_id (string) – The ID of the kernel with which to launch the instances. ramdisk_id (string) – The ID of the RAM disk with which to launch the instances. vpc_id (string) - The ID of a VPC to attach the instance to. vpc_name (string) - The name of a VPC to attach the instance to. monitoring_enabled (bool) – Enable detailed CloudWatch monitoring on the instance. subnet_id (string) – The ID of the subnet within which to launch the instances for VPC. subnet_name (string) – The name of the subnet within which to launch the instances for VPC. private_ip_address (string) – If you’re using VPC, you can optionally use this parameter to assign the instance a specific available IP address from the subnet (e.g., 10.0.0.25). block_device_map (boto.ec2.blockdevicemapping.BlockDeviceMapping) – A BlockDeviceMapping data structure describing the EBS volumes associated with the Image. disable_api_termination (bool) – If True, the instances will be locked and will not be able to be terminated via the API. instance_initiated_shutdown_behavior (string) – Specifies whether the instance stops or terminates on instance-initiated shutdown. Valid values are: - 'stop' - 'terminate' placement_group (string) – If specified, this is the name of the placement group in which the instance(s) will be launched. client_token (string) – Unique, case-sensitive identifier you provide to ensure idempotency of the request. Maximum 64 ASCII characters. security_group_ids (list of strings) – The IDs of the VPC security groups with which to associate instances. security_group_names (list of strings) – The names of the VPC security groups with which to associate instances. additional_info (string) – Specifies additional information to make available to the instance(s). tenancy (string) – The tenancy of the instance you want to launch. An instance with a tenancy of ‘dedicated’ runs on single-tenant hardware and can only be launched into a VPC. Valid values are:”default” or “dedicated”. NOTE: To use dedicated tenancy you MUST specify a VPC subnet-ID as well. instance_profile_arn (string) – The Amazon resource name (ARN) of the IAM Instance Profile (IIP) to associate with the instances. instance_profile_name (string) – The name of the IAM Instance Profile (IIP) to associate with the instances. ebs_optimized (bool) – Whether the instance is optimized for EBS I/O. This optimization provides dedicated throughput to Amazon EBS and a tuned configuration stack to provide optimal EBS I/O performance. This optimization isn’t available with all instance types. network_interfaces (boto.ec2.networkinterface.NetworkInterfaceCollection) – A NetworkInterfaceCollection data structure containing the ENI specifications for the instance. attributes (dict) - Instance attributes and value to be applied to the instance. Available options are: - instanceType - A valid instance type (m1.small) - kernel - Kernel ID (None) - ramdisk - Ramdisk ID (None) - userData - Base64 encoded String (None) - disableApiTermination - Boolean (true) - instanceInitiatedShutdownBehavior - stop|terminate - blockDeviceMapping - List of strings - ie: [‘/dev/sda=false’] - sourceDestCheck - Boolean (true) - groupSet - Set of Security Groups or IDs - ebsOptimized - Boolean (false) - sriovNetSupport - String - ie: ‘simple’ target_state (string) - The desired target state of the instance. Available options are: - running - stopped Note that this option is currently UNIMPLEMENTED. public_ip: (string) - The IP of a previously allocated EIP address, which will be attached to the instance. EC2 Classic instances ONLY - for VCP pass in an allocation_id instead. allocation_id: (string) - The ID of a previously allocated EIP address, which will be attached to the instance. VPC instances ONLY - for Classic pass in a public_ip instead. allocate_eip: (bool) - Allocate and attach an EIP on-the-fly for this instance. Note you'll want to releaase this address when terminating the instance, either manually or via the 'release_eip' flag to 'instance_absent'. region (string) - Region to connect to. key (string) - Secret key to be used. keyid (string) - Access key to be used. profile (variable) - A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid. .. versionadded:: 2016.3.0 ''' ret = {'name': name, 'result': True, 'comment': '', 'changes': {} } _create = False running_states = ('pending', 'rebooting', 'running', 'stopping', 'stopped') changed_attrs = {} if not exactly_one((image_id, image_name)): raise SaltInvocationError('Exactly one of image_id OR ' 'image_name must be provided.') if (public_ip or allocation_id or allocate_eip) and not exactly_one((public_ip, allocation_id, allocate_eip)): raise SaltInvocationError('At most one of public_ip, allocation_id OR ' 'allocate_eip may be provided.') if not instance_id: try: instance_id = __salt__['boto_ec2.get_id'](name=instance_name if instance_name else name, tags=tags, region=region, key=key, keyid=keyid, profile=profile, in_states=running_states) except CommandExecutionError as e: ret['result'] = None ret['comment'] = 'Couldn\'t determine current status of instance {0}.'.format(instance_name) return ret exists = __salt__['boto_ec2.exists'](instance_id=instance_id, region=region, key=key, keyid=keyid, profile=profile) if not exists: _create = True else: instances = __salt__['boto_ec2.find_instances'](instance_id=instance_id, region=region, key=key, keyid=keyid, profile=profile, return_objs=True, in_states=running_states) if not len(instances): _create = True if image_name: args = {'ami_name': image_name, 'region': region, 'key': key, 'keyid': keyid, 'profile': profile} image_ids = __salt__['boto_ec2.find_images'](**args) if len(image_ids): image_id = image_ids[0] else: image_id = image_name if _create: if __opts__['test']: ret['comment'] = 'The instance {0} is set to be created.'.format(name) ret['result'] = None return ret r = __salt__['boto_ec2.run'](image_id, instance_name if instance_name else name, tags=tags, key_name=key_name, security_groups=security_groups, user_data=user_data, instance_type=instance_type, placement=placement, kernel_id=kernel_id, ramdisk_id=ramdisk_id, vpc_id=vpc_id, vpc_name=vpc_name, monitoring_enabled=monitoring_enabled, subnet_id=subnet_id, subnet_name=subnet_name, private_ip_address=private_ip_address, block_device_map=block_device_map, disable_api_termination=disable_api_termination, instance_initiated_shutdown_behavior=instance_initiated_shutdown_behavior, placement_group=placement_group, client_token=client_token, security_group_ids=security_group_ids, security_group_names=security_group_names, additional_info=additional_info, tenancy=tenancy, instance_profile_arn=instance_profile_arn, instance_profile_name=instance_profile_name, ebs_optimized=ebs_optimized, network_interfaces=network_interfaces, region=region, key=key, keyid=keyid, profile=profile) if not r or 'instance_id' not in r: ret['result'] = False ret['comment'] = 'Failed to create instance {0}.'.format(instance_name if instance_name else name) return ret instance_id = r['instance_id'] ret['changes'] = {'old': {}, 'new': {}} ret['changes']['old']['instance_id'] = None ret['changes']['new']['instance_id'] = instance_id # To avoid issues we only allocate new EIPs at instance creation. # This might miss situations where an instance is initially created # created without and one is added later, but the alternative is the # risk of EIPs allocated at every state run. if allocate_eip: if __opts__['test']: ret['comment'] = 'New EIP would be allocated.' ret['result'] = None return ret domain = 'vpc' if vpc_id or vpc_name else None r = __salt__['boto_ec2.allocate_eip_address']( domain=domain, region=region, key=key, keyid=keyid, profile=profile) if not r: ret['result'] = False ret['comment'] = 'Failed to allocate new EIP.' return ret allocation_id = r['allocation_id'] log.info("New EIP with address {0} allocated.".format(r['public_ip'])) else: log.info("EIP not requested.") if public_ip or allocation_id: r = __salt__['boto_ec2.get_eip_address_info']( addresses=public_ip, allocation_ids=allocation_id, region=region, key=key, keyid=keyid, profile=profile) if not r: ret['result'] = False ret['comment'] = 'Failed to lookup EIP {0}.'.format(public_ip if public_ip else allocation_id) return ret ip = r[0]['public_ip'] if r[0].get('instance_id'): if r[0]['instance_id'] != instance_id: ret['result'] = False ret['comment'] = ('EIP {0} is already associated with instance ' '{1}.'.format(public_ip if public_ip else allocation_id, r[0]['instance_id'])) return ret else: if __opts__['test']: ret['comment'] = 'Instance {0} to be updated.'.format(name) ret['result'] = None return ret r = __salt__['boto_ec2.associate_eip_address']( instance_id=instance_id, public_ip=public_ip, allocation_id=allocation_id, region=region, key=key, keyid=keyid, profile=profile) if r: ret['changes']['new']['public_ip'] = ip else: ret['result'] = False ret['comment'] = 'Failed to attach EIP to instance {0}.'.format( instance_name if instance_name else name) return ret if attributes: for k, v in attributes.iteritems(): curr = __salt__['boto_ec2.get_attribute'](k, instance_id=instance_id, region=region, key=key, keyid=keyid, profile=profile) if not isinstance(curr, dict): curr = {} if curr.get(k) == v: continue else: if __opts__['test']: changed_attrs[k] = 'The instance attribute {0} is set to be changed from \'{1}\' to \'{2}\'.'.format( k, curr.get(k), v) continue try: r = __salt__['boto_ec2.set_attribute'](attribute=k, attribute_value=v, instance_id=instance_id, region=region, key=key, keyid=keyid, profile=profile) except SaltInvocationError as e: ret['result'] = False ret['comment'] = 'Failed to set attribute {0} to {1} on instance {2}.'.format(k, v, instance_name) return ret ret['changes'] = ret['changes'] if ret['changes'] else {'old': {}, 'new': {}} ret['changes']['old'][k] = curr.get(k) ret['changes']['new'][k] = v if __opts__['test']: if changed_attrs: ret['changes']['new'] = changed_attrs ret['result'] = None return ret
def subnet_group_present(name, description, subnet_ids=None, subnet_names=None, tags=None, region=None, key=None, keyid=None, profile=None): ''' Ensure DB subnet group exists. name The name for the DB subnet group. This value is stored as a lowercase string. subnet_ids A list of the EC2 Subnet IDs for the DB subnet group. Either subnet_ids or subnet_names must be provided. subnet_names A list of The EC2 Subnet names for the DB subnet group. Either subnet_ids or subnet_names must be provided. description Subnet group description. tags A list of tags. region Region to connect to. key Secret key to be used. keyid Access key to be used. profile A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid. ''' if not exactly_one((subnet_ids, subnet_names)): raise SaltInvocationError('One (but not both) of subnet_ids or ' 'subnet_names must be provided.') ret = {'name': name, 'result': True, 'comment': '', 'changes': {} } if not subnet_ids: subnet_ids = [] if subnet_names: for i in subnet_names: r = __salt__['boto_vpc.get_resource_id']('subnet', name=i, region=region, key=key, keyid=keyid, profile=profile) if 'error' in r: msg = 'Error looking up subnet ids: {0}'.format( r['error']['message']) ret['comment'] = msg ret['result'] = False return ret if r['id'] is None: msg = 'Subnet {0} does not exist.'.format(i) ret['comment'] = msg ret['result'] = False return ret subnet_ids.append(r['id']) exists = __salt__['boto_rds.subnet_group_exists'](name=name, tags=tags, region=region, key=key, keyid=keyid, profile=profile) if not exists: if __opts__['test']: ret['comment'] = 'Subnet group {0} is set to be created.'.format(name) ret['result'] = None return ret created = __salt__['boto_rds.create_subnet_group'](name=name, subnet_ids=subnet_ids, description=description, tags=tags, region=region, key=key, keyid=keyid, profile=profile) if not created: ret['result'] = False ret['comment'] = 'Failed to create {0} subnet group.'.format(name) return ret ret['changes']['old'] = None ret['changes']['new'] = name ret['comment'] = 'Subnet {0} created.'.format(name) return ret ret['comment'] = 'Subnet present.' return ret
def hosted_zone_present(name, Name=None, PrivateZone=False, CallerReference=None, Comment='', VPCs=None, region=None, key=None, keyid=None, profile=None): ''' Ensure a hosted zone exists with the given attributes. name The name of the state definition. Name The name of the domain. This should be a fully-specified domain, and should terminate with a period. This is the name you have registered with your DNS registrar. It is also the name you will delegate from your registrar to the Amazon Route 53 delegation servers returned in response to this request. If not provided, the value of name will be used. PrivateZone Set True if creating a private hosted zone. If true, then 'VPCs' is also required. Comment Any comments you want to include about the hosted zone. CallerReference A unique string that identifies the request and that allows create_hosted_zone() calls to be retried without the risk of executing the operation twice. This helps ensure idempotency across state calls, but can cause issues if a zone is deleted and then an attempt is made to recreate it with the same CallerReference. If not provided, a unique UUID will be generated at each state run, which can potentially lead to duplicate zones being created if the state is run again while the previous zone creation is still in PENDING status (which can occasionally take several minutes to clear). Maximum length of 128. VPCs A list of dicts, each dict composed of a VPCRegion, and either a VPCId or a VPCName. Note that this param is ONLY used if PrivateZone == True VPCId When creating a private hosted zone, either the VPC ID or VPC Name to associate with is required. Exclusive with VPCName. VPCName When creating a private hosted zone, either the VPC ID or VPC Name to associate with is required. Exclusive with VPCId. VPCRegion When creating a private hosted zone, the region of the associated VPC is required. If not provided, an effort will be made to determine it from VPCId or VPCName, if possible. This will fail if a given VPCName exists in multiple regions visible to the bound account, in which case you'll need to provide an explicit value for VPCRegion. ''' Name = Name if Name else name Name = _to_aws_encoding(Name) ret = {'name': name, 'result': True, 'comment': '', 'changes': {}} if not PrivateZone and VPCs: raise SaltInvocationError("Parameter 'VPCs' is invalid when creating a public zone.") if PrivateZone and not VPCs: raise SaltInvocationError("Parameter 'VPCs' is required when creating a private zone.") if VPCs: if not isinstance(VPCs, list): raise SaltInvocationError("Parameter 'VPCs' must be a list of dicts.") for v in VPCs: if not isinstance(v, dict) or not exactly_one((v.get('VPCId'), v.get('VPCName'))): raise SaltInvocationError("Parameter 'VPCs' must be a list of dicts, each composed " "of either a 'VPCId' or a 'VPCName', and optionally a " "'VPCRegion', to help distinguish between multitple matches.") # Massage VPCs into something AWS will accept... fixed_vpcs = [] if PrivateZone: for v in VPCs: VPCId = v.get('VPCId') VPCName = v.get('VPCName') VPCRegion = v.get('VPCRegion') VPCs = __salt__['boto_vpc.describe_vpcs'](vpc_id=VPCId, name=VPCName, region=region, key=key, keyid=keyid, profile=profile).get('vpcs', []) if VPCRegion and VPCs: VPCs = [v for v in VPCs if v['region'] == VPCRegion] if not VPCs: ret['comment'] = ('A VPC matching given criteria (vpc: {0} / vpc_region: {1}) not ' 'found.'.format(VPCName or VPCId, VPCRegion)) log.error(ret['comment']) ret['result'] = False return ret if len(VPCs) > 1: ret['comment'] = ('Multiple VPCs matching given criteria (vpc: {0} / vpc_region: ' '{1}) found: {2}.'.format(VPCName or VPCId, VPCRegion, ', '.join([v['id'] for v in VPCs]))) log.error(ret['comment']) ret['result'] = False return ret vpc = VPCs[0] if VPCName: VPCId = vpc['id'] if not VPCRegion: VPCRegion = vpc['region'] fixed_vpcs += [{'VPCId': VPCId, 'VPCRegion': VPCRegion}] create = False update_comment = False add_vpcs = [] del_vpcs = [] args = {'Name': Name, 'PrivateZone': PrivateZone, 'region': region, 'key': key, 'keyid': keyid, 'profile': profile} zone = __salt__['boto3_route53.find_hosted_zone'](**args) if not zone: create = True # Grrrr - can only pass one VPC when initially creating a private zone... # The rest have to be added (one-by-one) later in a separate step. if len(fixed_vpcs) > 1: add_vpcs = fixed_vpcs[1:] fixed_vpcs = fixed_vpcs[:1] CallerReference = CallerReference if CallerReference else str(uuid.uuid4()) # future lint: disable=blacklisted-function else: # Currently the only modifiable traits about a zone are associated VPCs and the comment. zone = zone[0] if PrivateZone: for z in zone.get('VPCs'): if z not in fixed_vpcs: del_vpcs += [z] for z in fixed_vpcs: if z not in zone.get('VPCs'): add_vpcs += [z] if zone['HostedZone']['Config'].get('Comment') != Comment: update_comment = True if not (create or add_vpcs or del_vpcs or update_comment): ret['comment'] = 'Hostd Zone {0} already in desired state'.format(Name) return ret if create: if __opts__['test']: ret['comment'] = 'Route 53 {} hosted zone {} would be created.'.format('private' if PrivateZone else 'public', Name) ret['result'] = None return ret vpc_id = fixed_vpcs[0].get('VPCId') if fixed_vpcs else None vpc_region = fixed_vpcs[0].get('VPCRegion') if fixed_vpcs else None newzone = __salt__['boto3_route53.create_hosted_zone'](Name=Name, CallerReference=CallerReference, Comment=Comment, PrivateZone=PrivateZone, VPCId=vpc_id, VPCRegion=vpc_region, region=region, key=key, keyid=keyid, profile=profile) if newzone: newzone = newzone[0] ret['comment'] = 'Route 53 {} hosted zone {} successfully created'.format('private' if PrivateZone else 'public', Name) log.info(ret['comment']) ret['changes']['new'] = newzone else: ret['comment'] = 'Creation of Route 53 {} hosted zone {} failed'.format('private' if PrivateZone else 'public', Name) log.error(ret['comment']) ret['result'] = False return ret if update_comment: if __opts__['test']: ret['comment'] = 'Route 53 {} hosted zone {} comment would be updated.'.format('private' if PrivateZone else 'public', Name) ret['result'] = None return ret r = __salt__['boto3_route53.update_hosted_zone_comment'](Name=Name, Comment=Comment, PrivateZone=PrivateZone, region=region, key=key, keyid=keyid, profile=profile) if r: r = r[0] msg = 'Route 53 {} hosted zone {} comment successfully updated'.format('private' if PrivateZone else 'public', Name) log.info(msg) ret['comment'] = ' '.join([ret['comment'], msg]) ret['changes']['old'] = zone ret['changes']['new'] = dictupdate.update(ret['changes'].get('new', {}), r) else: ret['comment'] = 'Update of Route 53 {} hosted zone {} comment failed'.format('private' if PrivateZone else 'public', Name) log.error(ret['comment']) ret['result'] = False return ret if add_vpcs or del_vpcs: if __opts__['test']: ret['comment'] = 'Route 53 {} hosted zone {} associated VPCs would be updated.'.format( 'private' if PrivateZone else 'public', Name) ret['result'] = None return ret all_added = True all_deled = True for vpc in add_vpcs: # Add any new first to avoid the "can't delete last VPC" errors. r = __salt__['boto3_route53.associate_vpc_with_hosted_zone'](Name=Name, VPCId=vpc['VPCId'], VPCRegion=vpc['VPCRegion'], region=region, key=key, keyid=keyid, profile=profile) if not r: all_added = False for vpc in del_vpcs: r = __salt__['boto3_route53.disassociate_vpc_from_hosted_zone'](Name=Name, VPCId=vpc['VPCId'], VPCRegion=vpc['VPCRegion'], region=region, key=key, keyid=keyid, profile=profile) if not r: all_deled = False ret['changes']['old'] = zone ret['changes']['new'] = __salt__['boto3_route53.find_hosted_zone'](**args) if all_added and all_deled: msg = 'Route 53 {} hosted zone {} associated VPCs successfully updated'.format('private' if PrivateZone else 'public', Name) log.info(msg) ret['comment'] = ' '.join([ret['comment'], msg]) else: ret['comment'] = 'Update of Route 53 {} hosted zone {} associated VPCs failed'.format( 'private' if PrivateZone else 'public', Name) log.error(ret['comment']) ret['result'] = False return ret return ret
def eni_present( name, subnet_id=None, subnet_name=None, private_ip_address=None, description=None, groups=None, source_dest_check=True, allocate_eip=False, arecords=None, region=None, key=None, keyid=None, profile=None): ''' Ensure the EC2 ENI exists. .. versionadded:: 2016.3.0 name Name tag associated with the ENI. subnet_id The VPC subnet ID the ENI will exist within. subnet_name The VPC subnet name the ENI will exist within. private_ip_address The private ip address to use for this ENI. If this is not specified AWS will automatically assign a private IP address to the ENI. Must be specified at creation time; will be ignored afterward. description Description of the key. groups A list of security groups to apply to the ENI. source_dest_check Boolean specifying whether source/destination checking is enabled on the ENI. allocate_eip True/False - allocate and associate an EIP to the ENI .. versionadded:: 2016.3.0 arecords A list of arecord dicts with attributes needed for the DNS add_record state. By default the boto_route53.add_record state will be used, which requires: name, zone, ttl, and identifier. See the boto_route53 state for information about these attributes. Other DNS modules can be called by specifying the provider keyword. By default, the private ENI IP address will be used, set 'public: True' in the arecord dict to use the ENI's public IP address .. versionadded:: 2016.3.0 region Region to connect to. key Secret key to be used. keyid Access key to be used. profile A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid. ''' if not exactly_one((subnet_id, subnet_name)): raise SaltInvocationError('One (but not both) of subnet_id or ' 'subnet_name must be provided.') if not groups: raise SaltInvocationError('groups is a required argument.') if not isinstance(groups, list): raise SaltInvocationError('groups must be a list.') if not isinstance(source_dest_check, bool): raise SaltInvocationError('source_dest_check must be a bool.') ret = {'name': name, 'result': True, 'comment': '', 'changes': {}} r = __salt__['boto_ec2.get_network_interface']( name=name, region=region, key=key, keyid=keyid, profile=profile ) if 'error' in r: ret['result'] = False ret['comment'] = 'Error when attempting to find eni: {0}.'.format( r['error']['message'] ) return ret if not r['result']: if __opts__['test']: ret['comment'] = 'ENI is set to be created.' if allocate_eip: ret['comment'] = ' '.join([ret['comment'], 'An EIP is set to be allocated/assocaited to the ENI.']) if arecords: ret['comment'] = ' '.join([ret['comment'], 'A records are set to be created.']) ret['result'] = None return ret result_create = __salt__['boto_ec2.create_network_interface']( name, subnet_id=subnet_id, subnet_name=subnet_name, private_ip_address=private_ip_address, description=description, groups=groups, region=region, key=key, keyid=keyid, profile=profile ) if 'error' in result_create: ret['result'] = False ret['comment'] = 'Failed to create ENI: {0}'.format( result_create['error']['message'] ) return ret r['result'] = result_create['result'] ret['comment'] = 'Created ENI {0}'.format(name) ret['changes']['id'] = r['result']['id'] else: _ret = _eni_attribute( r['result'], 'description', description, region, key, keyid, profile ) ret['changes'] = dictupdate.update(ret['changes'], _ret['changes']) ret['comment'] = _ret['comment'] if not _ret['result']: ret['result'] = _ret['result'] if ret['result'] is False: return ret _ret = _eni_groups( r['result'], groups, region, key, keyid, profile ) ret['changes'] = dictupdate.update(ret['changes'], _ret['changes']) ret['comment'] = ' '.join([ret['comment'], _ret['comment']]) if not _ret['result']: ret['result'] = _ret['result'] if ret['result'] is False: return ret # Actions that need to occur whether creating or updating _ret = _eni_attribute( r['result'], 'source_dest_check', source_dest_check, region, key, keyid, profile ) ret['changes'] = dictupdate.update(ret['changes'], _ret['changes']) ret['comment'] = ' '.join([ret['comment'], _ret['comment']]) if not _ret['result']: ret['result'] = _ret['result'] return ret if allocate_eip: if 'allocationId' not in r['result']: if __opts__['test']: ret['comment'] = ' '.join([ret['comment'], 'An EIP is set to be allocated and assocaited to the ENI.']) else: eip_alloc = __salt__['boto_ec2.allocate_eip_address'](domain=None, region=region, key=key, keyid=keyid, profile=profile) if eip_alloc: _ret = __salt__['boto_ec2.associate_eip_address'](instance_id=None, instance_name=None, public_ip=None, allocation_id=eip_alloc['allocation_id'], network_interface_id=r['result']['id'], private_ip_address=None, allow_reassociation=False, region=region, key=key, keyid=keyid, profile=profile) if not _ret: _ret = __salt__['boto_ec2.release_eip_address'](public_ip=None, allocation_id=eip_alloc['allocation_id'], region=region, key=key, keyid=keyid, profile=profile) ret['result'] = False msg = 'Failed to assocaite the allocated EIP address with the ENI. The EIP {0}'.format('was successfully released.' if _ret else 'was NOT RELEASED.') ret['comment'] = ' '.join([ret['comment'], msg]) return ret else: ret['result'] = False ret['comment'] = ' '.join([ret['comment'], 'Failed to allocate an EIP address']) return ret else: ret['comment'] = ' '.join([ret['comment'], 'An EIP is already allocated/assocaited to the ENI']) if arecords: for arecord in arecords: if 'name' not in arecord: msg = 'The arecord must contain a "name" property.' raise SaltInvocationError(msg) log.debug('processing arecord {0}'.format(arecord)) _ret = None dns_provider = 'boto_route53' arecord['record_type'] = 'A' public_ip_arecord = False if 'public' in arecord: public_ip_arecord = arecord.pop('public') if public_ip_arecord: if 'publicIp' in r['result']: arecord['value'] = r['result']['publicIp'] elif 'public_ip' in eip_alloc: arecord['value'] = eip_alloc['public_ip'] else: msg = 'Unable to add an A record for the public IP address, a public IP address does not seem to be allocated to this ENI.' raise CommandExecutionError(msg) else: arecord['value'] = r['result']['private_ip_address'] if 'provider' in arecord: dns_provider = arecord.pop('provider') if dns_provider == 'boto_route53': if 'profile' not in arecord: arecord['profile'] = profile if 'key' not in arecord: arecord['key'] = key if 'keyid' not in arecord: arecord['keyid'] = keyid if 'region' not in arecord: arecord['region'] = region _ret = __states__['.'.join([dns_provider, 'present'])](**arecord) log.debug('ret from dns_provider.present = {0}'.format(_ret)) ret['changes'] = dictupdate.update(ret['changes'], _ret['changes']) ret['comment'] = ' '.join([ret['comment'], _ret['comment']]) if not _ret['result']: ret['result'] = _ret['result'] if ret['result'] is False: return ret return ret
def hosted_zone_present(name, domain_name=None, private_zone=False, comment='', vpc_id=None, vpc_name=None, vpc_region=None, region=None, key=None, keyid=None, profile=None): ''' Ensure a hosted zone exists with the given attributes. Note that most things cannot be modified once a zone is created - it must be deleted and re-spun to update these attributes: - private_zone (AWS API limitation). - comment (the appropriate call exists in the AWS API and in boto3, but has not, as of this writing, been added to boto2). - vpc_id (same story - we really need to rewrite this module with boto3) - vpc_name (really just a pointer to vpc_id anyway). - vpc_region (again, supported in boto3 but not boto2). name The name of the state definition. This will be used as the 'caller_ref' param if/when creating the hosted zone. domain_name The name of the domain. This should be a fully-specified domain, and should terminate with a period. This is the name you have registered with your DNS registrar. It is also the name you will delegate from your registrar to the Amazon Route 53 delegation servers returned in response to this request. Defaults to the value of name if not provided. comment Any comments you want to include about the hosted zone. private_zone Set True if creating a private hosted zone. vpc_id When creating a private hosted zone, either the VPC ID or VPC Name to associate with is required. Exclusive with vpe_name. Ignored if passed for a non-private zone. vpc_name When creating a private hosted zone, either the VPC ID or VPC Name to associate with is required. Exclusive with vpe_id. Ignored if passed for a non-private zone. vpc_region When creating a private hosted zone, the region of the associated VPC is required. If not provided, an effort will be made to determine it from vpc_id or vpc_name, if possible. If this fails, you'll need to provide an explicit value for this option. Ignored if passed for a non-private zone. ''' domain_name = domain_name if domain_name else name ret = {'name': name, 'result': True, 'comment': '', 'changes': {}} # First translaste vpc_name into a vpc_id if possible if private_zone: if not exactly_one((vpc_name, vpc_id)): raise SaltInvocationError('Either vpc_name or vpc_id is required ' 'when creating a private zone.') vpcs = __salt__['boto_vpc.describe_vpcs'](vpc_id=vpc_id, name=vpc_name, region=region, key=key, keyid=keyid, profile=profile).get( 'vpcs', []) if vpc_region and vpcs: vpcs = [v for v in vpcs if v['region'] == vpc_region] if not vpcs: msg = ('Private zone requested but a VPC matching given criteria ' 'not found.') log.error(msg) ret['result'] = False ret['comment'] = msg return ret if len(vpcs) > 1: msg = ('Private zone requested but multiple VPCs matching given ' 'criteria found: {0}.'.format([v['id'] for v in vpcs])) log.error(msg) return None vpc = vpcs[0] if vpc_name: vpc_id = vpc['id'] if not vpc_region: vpc_region = vpc['region'] # Next, see if it (or they) exist at all, anywhere? deets = __salt__['boto_route53.describe_hosted_zones']( domain_name=domain_name, region=region, key=key, keyid=keyid, profile=profile) create = False if not deets: create = True else: # Something exists - now does it match our criteria? if (json.loads(deets['HostedZone']['Config']['PrivateZone']) != private_zone): create = True else: if private_zone: for v, d in deets.get('VPCs', {}).items(): if (d['VPCId'] == vpc_id and d['VPCRegion'] == vpc_region): create = False break else: create = True if not create: ret['comment'] = 'Hostd Zone {0} already in desired state'.format( domain_name) else: # Until we get modifies in place with boto3, the best option is to # attempt creation and let route53 tell us if we're stepping on # toes. We can't just fail, because some scenarios (think split # horizon DNS) require zones with identical names but different # settings... log.info('A Hosted Zone with name {0} already exists, but with ' 'different settings. Will attempt to create the one ' 'requested on the assumption this is what is desired. ' 'This may fail...'.format(domain_name)) if create: if __opts__['test']: ret['comment'] = 'Route53 Hosted Zone {0} set to be added.'.format( domain_name) ret['result'] = None return ret res = __salt__['boto_route53.create_hosted_zone']( domain_name=domain_name, caller_ref=name, comment=comment, private_zone=private_zone, vpc_id=vpc_id, vpc_region=vpc_region, region=region, key=key, keyid=keyid, profile=profile) if res: msg = 'Hosted Zone {0} successfully created'.format(domain_name) log.info(msg) ret['comment'] = msg ret['changes']['old'] = None ret['changes']['new'] = res else: ret['comment'] = 'Creating Hosted Zone {0} failed'.format( domain_name) ret['result'] = False return ret
def eni_present( name, subnet_id=None, subnet_name=None, private_ip_address=None, description=None, groups=None, source_dest_check=True, allocate_eip=False, arecords=None, region=None, key=None, keyid=None, profile=None): ''' Ensure the EC2 ENI exists. .. versionadded:: Boron name Name tag associated with the ENI. subnet_id The VPC subnet ID the ENI will exist within. subnet_name The VPC subnet name the ENI will exist within. private_ip_address The private ip address to use for this ENI. If this is not specified AWS will automatically assign a private IP address to the ENI. Must be specified at creation time; will be ignored afterward. description Description of the key. groups A list of security groups to apply to the ENI. source_dest_check Boolean specifying whether source/destination checking is enabled on the ENI. allocate_eip True/False - allocate and associate an EIP to the ENI .. versionadded:: Boron arecords A list of arecord dicts with attributes needed for the DNS add_record state. By default the boto_route53.add_record state will be used, which requires: name, zone, ttl, and identifier. See the boto_route53 state for information about these attributes. Other DNS modules can be called by specifying the provider keyword. By default, the private ENI IP address will be used, set 'public: True' in the arecord dict to use the ENI's public IP address .. versionadded:: Boron region Region to connect to. key Secret key to be used. keyid Access key to be used. profile A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid. ''' if not exactly_one((subnet_id, subnet_name)): raise SaltInvocationError('One (but not both) of subnet_id or ' 'subnet_name must be provided.') if not groups: raise SaltInvocationError('groups is a required argument.') if not isinstance(groups, list): raise SaltInvocationError('groups must be a list.') if not isinstance(source_dest_check, bool): raise SaltInvocationError('source_dest_check must be a bool.') ret = {'name': name, 'result': True, 'comment': '', 'changes': {}} r = __salt__['boto_ec2.get_network_interface']( name=name, region=region, key=key, keyid=keyid, profile=profile ) if 'error' in r: ret['result'] = False ret['comment'] = 'Error when attempting to find eni: {0}.'.format( r['error']['message'] ) return ret if not r['result']: if __opts__['test']: ret['comment'] = 'ENI is set to be created.' if allocate_eip: ret['comment'] = ' '.join([ret['comment'], 'An EIP is set to be allocated/assocaited to the ENI.']) if arecords: ret['comment'] = ' '.join([ret['comment'], 'A records are set to be created.']) ret['result'] = None return ret result_create = __salt__['boto_ec2.create_network_interface']( name, subnet_id=subnet_id, subnet_name=subnet_name, private_ip_address=private_ip_address, description=description, groups=groups, region=region, key=key, keyid=keyid, profile=profile ) if 'error' in result_create: ret['result'] = False ret['comment'] = 'Failed to create ENI: {0}'.format( result_create['error']['message'] ) return ret r['result'] = result_create['result'] ret['comment'] = 'Created ENI {0}'.format(name) ret['changes']['id'] = r['result']['id'] else: _ret = _eni_attribute( r['result'], 'description', description, region, key, keyid, profile ) ret['changes'] = dictupdate.update(ret['changes'], _ret['changes']) ret['comment'] = _ret['comment'] if not _ret['result']: ret['result'] = _ret['result'] if ret['result'] is False: return ret _ret = _eni_groups( r['result'], groups, region, key, keyid, profile ) ret['changes'] = dictupdate.update(ret['changes'], _ret['changes']) ret['comment'] = ' '.join([ret['comment'], _ret['comment']]) if not _ret['result']: ret['result'] = _ret['result'] if ret['result'] is False: return ret # Actions that need to occur whether creating or updating _ret = _eni_attribute( r['result'], 'source_dest_check', source_dest_check, region, key, keyid, profile ) ret['changes'] = dictupdate.update(ret['changes'], _ret['changes']) ret['comment'] = ' '.join([ret['comment'], _ret['comment']]) if not _ret['result']: ret['result'] = _ret['result'] return ret if allocate_eip: if 'allocationId' not in r['result']: if __opts__['test']: ret['comment'] = ' '.join([ret['comment'], 'An EIP is set to be allocated and assocaited to the ENI.']) else: eip_alloc = __salt__['boto_ec2.allocate_eip_address'](domain=None, region=region, key=key, keyid=keyid, profile=profile) if eip_alloc: _ret = __salt__['boto_ec2.associate_eip_address'](instance_id=None, instance_name=None, public_ip=None, allocation_id=eip_alloc['allocation_id'], network_interface_id=r['result']['id'], private_ip_address=None, allow_reassociation=False, region=region, key=key, keyid=keyid, profile=profile) if not _ret: _ret = __salt__['boto_ec2.release_eip_address'](public_ip=None, allocation_id=eip_alloc['allocation_id'], region=region, key=key, keyid=keyid, profile=profile) ret['result'] = False msg = 'Failed to assocaite the allocated EIP address with the ENI. The EIP {0}'.format('was successfully released.' if _ret else 'was NOT RELEASED.') ret['comment'] = ' '.join([ret['comment'], msg]) return ret else: ret['result'] = False ret['comment'] = ' '.join([ret['comment'], 'Failed to allocate an EIP address']) return ret else: ret['comment'] = ' '.join([ret['comment'], 'An EIP is already allocated/assocaited to the ENI']) if arecords: for arecord in arecords: if 'name' not in arecord: msg = 'The arecord must contain a "name" property.' raise SaltInvocationError(msg) log.debug('processing arecord {0}'.format(arecord)) _ret = None dns_provider = 'boto_route53' arecord['record_type'] = 'A' public_ip_arecord = False if 'public' in arecord: public_ip_arecord = arecord.pop('public') if public_ip_arecord: if 'publicIp' in r['result']: arecord['value'] = r['result']['publicIp'] elif 'public_ip' in eip_alloc: arecord['value'] = eip_alloc['public_ip'] else: msg = 'Unable to add an A record for the public IP address, a public IP address does not seem to be allocated to this ENI.' raise CommandExecutionError(msg) else: arecord['value'] = r['result']['private_ip_address'] if 'provider' in arecord: dns_provider = arecord.pop('provider') if dns_provider == 'boto_route53': if 'profile' not in arecord: arecord['profile'] = profile if 'key' not in arecord: arecord['key'] = key if 'keyid' not in arecord: arecord['keyid'] = keyid if 'region' not in arecord: arecord['region'] = region _ret = __states__['.'.join([dns_provider, 'present'])](**arecord) log.debug('ret from dns_provider.present = {0}'.format(_ret)) ret['changes'] = dictupdate.update(ret['changes'], _ret['changes']) ret['comment'] = ' '.join([ret['comment'], _ret['comment']]) if not _ret['result']: ret['result'] = _ret['result'] if ret['result'] is False: return ret return ret
def subnet_group_present(name, description, subnet_ids=None, subnet_names=None, tags=None, region=None, key=None, keyid=None, profile=None): ''' Ensure DB subnet group exists. name The name for the DB subnet group. This value is stored as a lowercase string. subnet_ids A list of the EC2 Subnet IDs for the DB subnet group. Either subnet_ids or subnet_names must be provided. subnet_names A list of The EC2 Subnet names for the DB subnet group. Either subnet_ids or subnet_names must be provided. description Subnet group description. tags A list of tags. region Region to connect to. key Secret key to be used. keyid Access key to be used. profile A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid. ''' if not exactly_one((subnet_ids, subnet_names)): raise SaltInvocationError('One (but not both) of subnet_ids or ' 'subnet_names must be provided.') ret = {'name': name, 'result': True, 'comment': '', 'changes': {}} if not subnet_ids: subnet_ids = [] if subnet_names: for i in subnet_names: r = __salt__['boto_vpc.get_resource_id']('subnet', name=i, region=region, key=key, keyid=keyid, profile=profile) if 'error' in r: msg = 'Error looking up subnet ids: {0}'.format( r['error']['message']) ret['comment'] = msg ret['result'] = False return ret if r['id'] is None: msg = 'Subnet {0} does not exist.'.format(i) ret['comment'] = msg ret['result'] = False return ret subnet_ids.append(r['id']) exists = __salt__['boto_rds.subnet_group_exists'](name=name, tags=tags, region=region, key=key, keyid=keyid, profile=profile) if not exists: if __opts__['test']: ret['comment'] = 'Subnet group {0} is set to be created.'.format( name) ret['result'] = None return ret created = __salt__['boto_rds.create_subnet_group']( name=name, subnet_ids=subnet_ids, description=description, tags=tags, region=region, key=key, keyid=keyid, profile=profile) if not created: ret['result'] = False ret['comment'] = 'Failed to create {0} subnet group.'.format(name) return ret ret['changes']['old'] = None ret['changes']['new'] = name ret['comment'] = 'Subnet {0} created.'.format(name) return ret ret['comment'] = 'Subnet present.' return ret
def volume_absent(name, volume_name=None, volume_id=None, instance_name=None, instance_id=None, device=None, region=None, key=None, keyid=None, profile=None): ''' Ensure the EC2 volume is detached and absent. name State definition name. volume_name Name tag associated with the volume. For safety, if this matches more than one volume, the state will refuse to apply. volume_id Resource ID of the volume. instance_name Only remove volume if it is attached to instance with this Name tag. Exclusive with 'instance_id'. Requires 'device'. instance_id Only remove volume if it is attached to this instance. Exclusive with 'instance_name'. Requires 'device'. device Match by device rather than ID. Requires one of 'instance_name' or 'instance_id'. region Region to connect to. key Secret key to be used. keyid Access key to be used. profile A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid. .. versionadded:: Carbon ''' ret = {'name': name, 'result': True, 'comment': '', 'changes': {} } filters = {} running_states = ('pending', 'rebooting', 'running', 'stopping', 'stopped') if not exactly_one((volume_name, volume_id, instance_name, instance_id)): raise SaltInvocationError("Exactly one of 'volume_name', 'volume_id', " "'instance_name', or 'instance_id' must be provided.") if (instance_name or instance_id) and not device: raise SaltInvocationError("Parameter 'device' is required when either " "'instance_name' or 'instance_id' is specified.") if volume_id: filters.update({'volume-id': volume_id}) if volume_name: filters.update({'tag:Name': volume_name}) if instance_name: instance_id = __salt__['boto_ec2.get_id']( name=instance_name, region=region, key=key, keyid=keyid, profile=profile, in_states=running_states) if not instance_id: ret['comment'] = ('Instance with Name {0} not found. Assuming ' 'associated volumes gone.'.format(instance_name)) return ret if instance_id: filters.update({'attachment.instance-id': instance_id}) if device: filters.update({'attachment.device': device}) args = {'region': region, 'key': key, 'keyid': keyid, 'profile': profile} vols = __salt__['boto_ec2.get_all_volumes'](filters=filters, **args) if len(vols) < 1: ret['comment'] = 'Volume matching criteria not found, assuming already absent' return ret if len(vols) > 1: msg = "More than one volume matched criteria, can't continue in state {0}".format(name) log.error(msg) ret['comment'] = msg ret['result'] = False return ret vol = vols[0] log.info('Matched Volume ID {0}'.format(vol)) if __opts__['test']: ret['comment'] = 'The volume {0} is set to be deleted.'.format(vol) ret['result'] = None return ret if __salt__['boto_ec2.delete_volume'](volume_id=vol, force=True, **args): ret['comment'] = 'Volume {0} deleted.'.format(vol) ret['changes'] = {'old': {'volume_id': vol}, 'new': {'volume_id': None}} else: ret['comment'] = 'Error deleting volume {0}.'.format(vol) ret['result'] = False return ret
def hosted_zone_present(name, domain_name=None, private_zone=False, comment='', vpc_id=None, vpc_name=None, vpc_region=None, region=None, key=None, keyid=None, profile=None): ''' Ensure a hosted zone exists with the given attributes. Note that most things cannot be modified once a zone is created - it must be deleted and re-spun to update these attributes: - private_zone (AWS API limitation). - comment (the appropriate call exists in the AWS API and in boto3, but has not, as of this writing, been added to boto2). - vpc_id (same story - we really need to rewrite this module with boto3) - vpc_name (really just a pointer to vpc_id anyway). - vpc_region (again, supported in boto3 but not boto2). name The name of the state definition. This will be used as the 'caller_ref' param if/when creating the hosted zone. domain_name The name of the domain. This should be a fully-specified domain, and should terminate with a period. This is the name you have registered with your DNS registrar. It is also the name you will delegate from your registrar to the Amazon Route 53 delegation servers returned in response to this request. Defaults to the value of name if not provided. comment Any comments you want to include about the hosted zone. private_zone Set True if creating a private hosted zone. vpc_id When creating a private hosted zone, either the VPC ID or VPC Name to associate with is required. Exclusive with vpe_name. Ignored if passed for a non-private zone. vpc_name When creating a private hosted zone, either the VPC ID or VPC Name to associate with is required. Exclusive with vpe_id. Ignored if passed for a non-private zone. vpc_region When creating a private hosted zone, the region of the associated VPC is required. If not provided, an effort will be made to determine it from vpc_id or vpc_name, if possible. If this fails, you'll need to provide an explicit value for this option. Ignored if passed for a non-private zone. ''' domain_name = domain_name if domain_name else name ret = {'name': name, 'result': True, 'comment': '', 'changes': {}} # First translaste vpc_name into a vpc_id if possible if private_zone: if not exactly_one((vpc_name, vpc_id)): raise SaltInvocationError('Either vpc_name or vpc_id is required ' 'when creating a private zone.') vpcs = __salt__['boto_vpc.describe_vpcs']( vpc_id=vpc_id, name=vpc_name, region=region, key=key, keyid=keyid, profile=profile).get('vpcs', []) if vpc_region and vpcs: vpcs = [v for v in vpcs if v['region'] == vpc_region] if not vpcs: msg = ('Private zone requested but a VPC matching given criteria ' 'not found.') log.error(msg) ret['result'] = False ret['comment'] = msg return ret if len(vpcs) > 1: msg = ('Private zone requested but multiple VPCs matching given ' 'criteria found: {0}.'.format([v['id'] for v in vpcs])) log.error(msg) return None vpc = vpcs[0] if vpc_name: vpc_id = vpc['id'] if not vpc_region: vpc_region = vpc['region'] # Next, see if it (or they) exist at all, anywhere? deets = __salt__['boto_route53.describe_hosted_zones']( domain_name=domain_name, region=region, key=key, keyid=keyid, profile=profile) create = False if not deets: create = True else: # Something exists - now does it match our criteria? if (json.loads(deets['HostedZone']['Config']['PrivateZone']) != private_zone): create = True else: if private_zone: for v, d in deets.get('VPCs', {}).items(): if (d['VPCId'] == vpc_id and d['VPCRegion'] == vpc_region): create = False break else: create = True if not create: ret['comment'] = 'Hostd Zone {0} already in desired state'.format( domain_name) else: # Until we get modifies in place with boto3, the best option is to # attempt creation and let route53 tell us if we're stepping on # toes. We can't just fail, because some scenarios (think split # horizon DNS) require zones with identical names but different # settings... log.info('A Hosted Zone with name {0} already exists, but with ' 'different settings. Will attempt to create the one ' 'requested on the assumption this is what is desired. ' 'This may fail...'.format(domain_name)) if create: if __opts__['test']: ret['comment'] = 'Route53 Hosted Zone {0} set to be added.'.format( domain_name) ret['result'] = None return ret res = __salt__['boto_route53.create_hosted_zone'](domain_name=domain_name, caller_ref=name, comment=comment, private_zone=private_zone, vpc_id=vpc_id, vpc_region=vpc_region, region=region, key=key, keyid=keyid, profile=profile) if res: msg = 'Hosted Zone {0} successfully created'.format(domain_name) log.info(msg) ret['comment'] = msg ret['changes']['old'] = None ret['changes']['new'] = res else: ret['comment'] = 'Creating Hosted Zone {0} failed'.format( domain_name) ret['result'] = False return ret