class MistAws::Iam
Attributes
These are read-only accessor and are initializeds by initialize method
Public Class Methods
Initializes all you need to access aws resources in a region You can create multiple instances to allow access to multiple regions in one program/recipe
@param opts [Hash] the key/value pairs for the initializer @option opts [String] :profile_name ('default' or ENV) profile name to use to get creds from ~/.aws/credentials. @option opts [String] :region (us-east-1 or ENV) AWS Region to use @option opts [Logger] :logger (STDERR) A logger instance to use for logging @return [MistAws::Iam]
# File lib/mist_aws/iam.rb, line 32 def initialize(opts={}) # Ruby 1.9 backwards compatability opts = {profile_name: nil, region: nil, logger: ::Logger.new(STDERR)}.merge(opts) opts.each do |key, value| instance_variable_set "@#{key}", value end # Set by rspec tests that are testing methods called by initialize return if ENV['RSPEC_IGNORE_INITIALIZE'] @region ||= ENV['AWS_REGION'] ? ENV['AWS_REGION'] : 'us-east-1' # Note get_creds also resolves and sets @profile_name as well as # fetching the appropriate credentials based on the value of # profile_name and various Environment Variables @credentials = get_creds(profile_name) @iam_client = ::Aws::IAM::Client.new(credentials: @credentials, region: @region) @iam = ::Aws::IAM::Resource.new(client: @iam_client) end
Public Instance Methods
Create an IAM role to be assigned to an ec2 instance Returns the Role object
@param role_name [String] Name of the role to create @param policy_name [String]
# File lib/mist_aws/iam.rb, line 152 def create_iam_role(role_name, policy_name, policy_document, instance_profile_name=nil) result = role_exists? role_name if result logger.warn "MistAws::Iam#create_iam_role: Role: #{role_name.inspect} already exists; Doing nothing" return nil end assume_role_policy = { "Version" => "2012-10-17", "Statement" => [ {"Effect" => "Allow", "Principal" => { "Service" => [ "ec2.amazonaws.com" ] }, "Action" => ["sts:AssumeRole"] } ] }.to_json # Create the role role = iam.create_role(role_name: role_name, assume_role_policy_document: assume_role_policy) # Create a policy object associated to the role and stuff the policy document into it policy = ::Aws::IAM::RolePolicy.new(role_name: role_name, name: policy_name, client: iam_client) policy.put(policy_document: policy_document) # Create an instance_profile instance_profile = iam.create_instance_profile(instance_profile_name: instance_profile_name) unless instance_profile_exists?(instance_profile_name) instance_profile.add_role(role_name: role_name) role end
Delete role, policy and instance_profile if they exist
# File lib/mist_aws/iam.rb, line 118 def delete_iam_role(role_name, policy_name, instance_profile_name=nil) unless role_exists? role_name logger.warn "MistAws::Iam#delete_iam_role: No role: #{role_name.inspect}; Doing nothing" return nil end role = iam.role role_name # Removes the role from the instance_profiles # Deletes the instance_profile instance_profiles = role.instance_profiles instance_profiles.each do | instance_profile | instance_profile.remove_role role_name: role_name instance_profile.delete end # Delete the role_policies associated with the role role_policies = role.policies role_policies.each do | role_policy | role_policy.delete end # Delete the Role role.delete true end
Returns the proper Aws credential object.
@param profile_name
[String] (nil) Name of profile @return [::Aws::SharedCredentials | ::Aws::Credentials]
# File lib/mist_aws/iam.rb, line 59 def get_creds(profile_name=nil) unless profile_name if ENV['AWS_PROFILE'] @profile_name = ENV['AWS_PROFILE'] else if ENV['AWS_ACCESS_KEY_ID'] && ENV['AWS_SECRET_ACCESS_KEY'] return ::Aws::Credentials.new(ENV['AWS_ACCESS_KEY_ID'], ENV['AWS_SECRET_ACCESS_KEY']) else @profile_name = 'default' end end else @profile_name = profile_name end begin ::Aws::SharedCredentials.new(profile_name: @profile_name) rescue StandardError => e @logger.error e.inspect raise e end end
Check if an instance profile exists
# File lib/mist_aws/iam.rb, line 93 def instance_profile_exists?(instance_profile_name) instance_profile = iam.instance_profile(instance_profile_name) case instance_profile.data_loaded? when true return instance_profile else return nil end end
Check if a role exists
# File lib/mist_aws/iam.rb, line 83 def role_exists?(role_name) begin iam_client.get_role role_name: role_name rescue ::Aws::IAM::Errors::NoSuchEntity return false end return true end
Check if there is a role_policy
# File lib/mist_aws/iam.rb, line 104 def role_policy_exists?(role_name, policy_name) begin iam_client.get_role_policy(role_name: role_name, policy_name: policy_name) exists = true rescue ::Aws::IAM::Errors::NoSuchEntityException logger.warn "No role_polcy: #{policy_name.inspect} for role: #{role_name.inspect}" exists = false end exists end