class MistAws::Iam

Attributes

credentials[R]
handle[R]
iam[R]
iam_client[R]
logger[R]
profile_name[R]

These are read-only accessor and are initializeds by initialize method

region[R]

Public Class Methods

new(opts={}) click to toggle source

Initializes all you need to access aws resources in a region You can create multiple instances to allow access to multiple regions in one program/recipe

@param opts [Hash] the key/value pairs for the initializer @option opts [String] :profile_name ('default' or ENV) profile name to use to get creds from ~/.aws/credentials. @option opts [String] :region (us-east-1 or ENV) AWS Region to use @option opts [Logger] :logger (STDERR) A logger instance to use for logging @return [MistAws::Iam]

# File lib/mist_aws/iam.rb, line 32
def initialize(opts={})
  # Ruby 1.9 backwards compatability
  opts = {profile_name: nil, region: nil, logger: ::Logger.new(STDERR)}.merge(opts)
  opts.each do |key, value|
    instance_variable_set "@#{key}", value
  end

  # Set by rspec tests that are testing methods called by initialize
  return if ENV['RSPEC_IGNORE_INITIALIZE']

  @region ||= ENV['AWS_REGION'] ? ENV['AWS_REGION'] : 'us-east-1'

  # Note get_creds also resolves and sets @profile_name as well as
  # fetching the appropriate credentials based on the value of
  # profile_name and various Environment Variables
  @credentials = get_creds(profile_name)

  @iam_client = ::Aws::IAM::Client.new(credentials: @credentials, region: @region)
  @iam = ::Aws::IAM::Resource.new(client: @iam_client)
end

Public Instance Methods

create_iam_role(role_name, policy_name, policy_document, instance_profile_name=nil) click to toggle source

Create an IAM role to be assigned to an ec2 instance Returns the Role object

@param role_name [String] Name of the role to create @param policy_name [String]

# File lib/mist_aws/iam.rb, line 152
def create_iam_role(role_name, policy_name, policy_document, instance_profile_name=nil)
  result = role_exists? role_name
  if result
    logger.warn "MistAws::Iam#create_iam_role: Role: #{role_name.inspect} already exists; Doing nothing"
    return nil 
  end
  
  assume_role_policy = {
    "Version" => "2012-10-17",
    "Statement" => [
      {"Effect" => "Allow",
        "Principal" => {
          "Service" => [
            "ec2.amazonaws.com"
          ]
        },
        "Action" => ["sts:AssumeRole"]
      }
    ]
  }.to_json

  # Create the role
  role = iam.create_role(role_name: role_name, assume_role_policy_document: assume_role_policy)

  # Create a policy object associated to the role and stuff the policy document into it
  policy = ::Aws::IAM::RolePolicy.new(role_name: role_name, name: policy_name, client: iam_client)
  policy.put(policy_document: policy_document)

  # Create an instance_profile
  instance_profile = iam.create_instance_profile(instance_profile_name: instance_profile_name) unless instance_profile_exists?(instance_profile_name)
  instance_profile.add_role(role_name: role_name)
  role
end
delete_iam_role(role_name, policy_name, instance_profile_name=nil) click to toggle source

Delete role, policy and instance_profile if they exist

# File lib/mist_aws/iam.rb, line 118
def delete_iam_role(role_name, policy_name, instance_profile_name=nil)
  unless role_exists? role_name
    logger.warn "MistAws::Iam#delete_iam_role: No role: #{role_name.inspect}; Doing nothing"
    return nil 
  end
  
  role = iam.role role_name

  # Removes the role from the instance_profiles
  # Deletes the instance_profile
  instance_profiles = role.instance_profiles
  instance_profiles.each do | instance_profile |
    instance_profile.remove_role role_name: role_name
    instance_profile.delete
  end

  # Delete the role_policies associated with the role
  role_policies = role.policies
  role_policies.each do | role_policy |
    role_policy.delete
  end

  # Delete the Role
  role.delete

  true
end
get_creds(profile_name=nil) click to toggle source

Returns the proper Aws credential object.

@param profile_name [String] (nil) Name of profile @return [::Aws::SharedCredentials | ::Aws::Credentials]

# File lib/mist_aws/iam.rb, line 59
def get_creds(profile_name=nil)
  unless profile_name
    if ENV['AWS_PROFILE']
      @profile_name = ENV['AWS_PROFILE']
    else
      if ENV['AWS_ACCESS_KEY_ID'] && ENV['AWS_SECRET_ACCESS_KEY']
        return ::Aws::Credentials.new(ENV['AWS_ACCESS_KEY_ID'], ENV['AWS_SECRET_ACCESS_KEY'])
      else
        @profile_name = 'default'
      end
    end
  else
    @profile_name = profile_name
  end

  begin
    ::Aws::SharedCredentials.new(profile_name: @profile_name)
  rescue StandardError => e
    @logger.error e.inspect
    raise e
  end
end
instance_profile_exists?(instance_profile_name) click to toggle source

Check if an instance profile exists

# File lib/mist_aws/iam.rb, line 93
def instance_profile_exists?(instance_profile_name)
  instance_profile = iam.instance_profile(instance_profile_name)
  case instance_profile.data_loaded?
  when true
    return instance_profile
  else
    return nil
  end
end
role_exists?(role_name) click to toggle source

Check if a role exists

# File lib/mist_aws/iam.rb, line 83
def role_exists?(role_name)
  begin
    iam_client.get_role role_name: role_name
  rescue ::Aws::IAM::Errors::NoSuchEntity
    return false
  end
  return true
end
role_policy_exists?(role_name, policy_name) click to toggle source

Check if there is a role_policy

# File lib/mist_aws/iam.rb, line 104
def role_policy_exists?(role_name, policy_name)
  begin
    iam_client.get_role_policy(role_name: role_name, policy_name: policy_name)
    exists = true
  rescue ::Aws::IAM::Errors::NoSuchEntityException
    logger.warn "No role_polcy: #{policy_name.inspect} for role: #{role_name.inspect}"
    exists = false
  end
  exists
end