def run(self):
p = f'data/associations/{self.region}/{self.portfolio}/'
if not os.path.exists(p):
os.makedirs(p, exist_ok=True)
path = f'{p}/{self.account_id}.json'
with open(path, 'w') as f:
f.write("{}")
portfolio_id = aws.get_portfolio_for(self.portfolio, self.account_id,
self.region).get('Id')
logging.info(
f"{self.uid}: Creating the association for portfolio {portfolio_id}"
)
with betterboto_client.ClientContextManager(
'servicecatalog', region_name=self.region) as servicecatalog:
servicecatalog.associate_principal_with_portfolio(
PortfolioId=portfolio_id,
PrincipalARN=
f"arn:aws:iam::{self.account_id}:role/servicecatalog-puppet/PuppetRole",
PrincipalType='IAM')
self.write_output(self.param_kwargs)
def deploy_spoke_local_portfolios(manifest, launch_tasks):
section = constants.SPOKE_LOCAL_PORTFOLIOS
deployment_map = manifest_utils.build_deployment_map(manifest, section)
deployment_map = set_regions_for_deployment_map(deployment_map, section)
tasks_to_run = []
puppet_account_id = get_puppet_account_id()
for account_id, deployments_for_account in deployment_map.items():
for launch_name, launch_details in deployments_for_account.get(
section).items():
for region_name in launch_details.get('regions'):
depends_on = launch_details.get('depends_on')
dependencies = []
for dependency in depends_on:
for task_uid, task in launch_tasks.items():
if task.get('launch_name') == dependency:
dependencies.append(task)
hub_portfolio = aws.get_portfolio_for(
launch_details.get('portfolio'), puppet_account_id,
region_name)
create_spoke_local_portfolio_task_params = {
'account_id': account_id,
'region': region_name,
'portfolio': launch_details.get('portfolio'),
'provider_name': hub_portfolio.get('ProviderName'),
'description': hub_portfolio.get('Description'),
}
create_spoke_local_portfolio_task = luigi_tasks_and_targets.CreateSpokeLocalPortfolioTask(
**create_spoke_local_portfolio_task_params)
tasks_to_run.append(create_spoke_local_portfolio_task)
create_spoke_local_portfolio_task_as_dependency_params = {
'account_id': account_id,
'region': region_name,
'portfolio': launch_details.get('portfolio'),
}
create_associations_task_params = {
'associations': launch_details.get('associations'),
'puppet_account_id': puppet_account_id,
}
create_associations_for_portfolio_task = luigi_tasks_and_targets.CreateAssociationsForPortfolioTask(
**create_spoke_local_portfolio_task_as_dependency_params,
**create_associations_task_params,
dependencies=dependencies,
)
tasks_to_run.append(create_associations_for_portfolio_task)
import_into_spoke_local_portfolio_task_params = {
'hub_portfolio_id': hub_portfolio.get('Id')
}
import_into_spoke_local_portfolio_task = luigi_tasks_and_targets.ImportIntoSpokeLocalPortfolioTask(
**create_spoke_local_portfolio_task_as_dependency_params,
**import_into_spoke_local_portfolio_task_params,
)
tasks_to_run.append(import_into_spoke_local_portfolio_task)
launch_constraints = launch_details.get('constraints',
{}).get('launch', [])
if len(launch_constraints) > 0:
create_launch_role_constraints_for_portfolio_task_params = {
'launch_constraints': launch_constraints,
'puppet_account_id': puppet_account_id,
}
create_launch_role_constraints_for_portfolio = luigi_tasks_and_targets.CreateLaunchRoleConstraintsForPortfolio(
**
create_spoke_local_portfolio_task_as_dependency_params,
**import_into_spoke_local_portfolio_task_params,
**
create_launch_role_constraints_for_portfolio_task_params,
dependencies=dependencies,
)
tasks_to_run.append(
create_launch_role_constraints_for_portfolio)
return tasks_to_run
def run(self):
logger.info(f"{self.uid} starting ShareAndAcceptPortfolioTask")
portfolio_id = aws.get_portfolio_for(self.portfolio,
self.puppet_account_id,
self.region).get('Id')
p = f'data/shares/{self.region}/{self.portfolio}/'
if not os.path.exists(p):
os.makedirs(p, exist_ok=True)
path = f'{p}/{self.account_id}.json'
with open(path, 'w') as f:
f.write("{}")
logging.info(
f"{self.uid}: checking {portfolio_id} with {self.account_id}")
with betterboto_client.ClientContextManager(
'servicecatalog', region_name=self.region) as servicecatalog:
account_ids = servicecatalog.list_portfolio_access(
PortfolioId=portfolio_id).get('AccountIds')
if self.account_id in account_ids:
logging.info(
f"{self.uid}: not sharing {portfolio_id} with {self.account_id} as was previously shared"
)
else:
logging.info(
f"{self.uid}: sharing {portfolio_id} with {self.account_id}"
)
with betterboto_client.CrossAccountClientContextManager(
'servicecatalog',
f"arn:aws:iam::{self.account_id}:role/servicecatalog-puppet/PuppetRole",
f"{self.account_id}-{self.region}-PuppetRole",
region_name=self.region,
) as cross_account_servicecatalog:
was_accepted = False
accepted_portfolio_shares = cross_account_servicecatalog.list_accepted_portfolio_shares_single_page(
).get('PortfolioDetails')
for accepted_portfolio_share in accepted_portfolio_shares:
if accepted_portfolio_share.get('Id') == portfolio_id:
was_accepted = True
break
if not was_accepted:
logging.info(f"{self.uid}: accepting {portfolio_id}")
cross_account_servicecatalog.accept_portfolio_share(
PortfolioId=portfolio_id, )
principals_for_portfolio = cross_account_servicecatalog.list_principals_for_portfolio_single_page(
PortfolioId=portfolio_id).get('Principals')
principal_was_associated = False
principal_to_associate = f"arn:aws:iam::{self.account_id}:role/servicecatalog-puppet/PuppetRole"
for principal_for_portfolio in principals_for_portfolio:
if principal_for_portfolio.get(
'PrincipalARN') == principal_to_associate:
principal_was_associated = True
if not principal_was_associated:
cross_account_servicecatalog.associate_principal_with_portfolio(
PortfolioId=portfolio_id,
PrincipalARN=principal_to_associate,
PrincipalType='IAM',
)
self.write_output(self.param_kwargs)
def convert_manifest_into_task_defs_for_spoke_local_portfolios_in(
account_id, expanded_from, organization, region, launch_details,
puppet_account_id, should_use_sns, launch_tasks, pre_actions, post_actions
):
dependencies = []
for depend in launch_details.get('depends_on', []):
for launch_task in launch_tasks:
if isinstance(launch_task, provisioning.ProvisionProductTask):
l_params = launch_task.to_str_params()
if l_params.get('launch_name') == depend:
dependencies.append(launch_task.param_kwargs)
hub_portfolio = aws.get_portfolio_for(
launch_details.get('portfolio'), puppet_account_id, region
)
tasks_to_run = []
create_spoke_local_portfolio_task_params = {
'account_id': account_id,
'region': region,
'portfolio': launch_details.get('portfolio'),
'provider_name': hub_portfolio.get('ProviderName'),
'description': hub_portfolio.get('Description'),
'pre_actions': pre_actions,
'organization': expanded_from
}
create_spoke_local_portfolio_task = portfoliomanagement.CreateSpokeLocalPortfolioTask(
**create_spoke_local_portfolio_task_params,
)
tasks_to_run.append(create_spoke_local_portfolio_task)
create_spoke_local_portfolio_task_as_dependency_params = {
'account_id': account_id,
'region': region,
'portfolio': launch_details.get('portfolio'),
'organization': organization,
}
if len(launch_details.get('associations', [])) > 0:
create_associations_for_portfolio_task = portfoliomanagement.CreateAssociationsForPortfolioTask(
**create_spoke_local_portfolio_task_as_dependency_params,
associations= launch_details.get('associations'),
puppet_account_id= puppet_account_id,
should_use_sns= should_use_sns,
dependencies=dependencies,
pre_actions=pre_actions,
)
tasks_to_run.append(create_associations_for_portfolio_task)
import_into_spoke_local_portfolio_task_params = {
'hub_portfolio_id': hub_portfolio.get('Id')
}
launch_constraints = launch_details.get('constraints', {}).get('launch', [])
import_into_spoke_local_portfolio_task = portfoliomanagement.ImportIntoSpokeLocalPortfolioTask(
**create_spoke_local_portfolio_task_as_dependency_params,
**import_into_spoke_local_portfolio_task_params,
pre_actions=pre_actions,
post_actions=post_actions if len(launch_constraints) == 0 else []
)
tasks_to_run.append(import_into_spoke_local_portfolio_task)
if len(launch_constraints) > 0:
create_launch_role_constraints_for_portfolio_task_params = {
'launch_constraints': launch_constraints,
'puppet_account_id': puppet_account_id,
'should_use_sns': should_use_sns,
}
create_launch_role_constraints_for_portfolio = portfoliomanagement.CreateLaunchRoleConstraintsForPortfolio(
**create_spoke_local_portfolio_task_as_dependency_params,
**import_into_spoke_local_portfolio_task_params,
**create_launch_role_constraints_for_portfolio_task_params,
dependencies=dependencies,
post_actions=post_actions,
pre_actions=pre_actions,
)
tasks_to_run.append(create_launch_role_constraints_for_portfolio)
return tasks_to_run