HEX

File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/boto_kms.cpython-310.pyc
o

�N�g-E�	@s�dZddlZddlZddlZddlmmZddlZe�	e
�ZzddlZddl
Ze�	d��ej�dZWn
eefyBdZYnwdd�Zdd	�Z	d8d
d�Z								d9dd
�Z							d:dd�Z						d;dd�Zd8dd�Zd8dd�Zd8dd�Zd8dd�Zd8dd�Zd8dd�Zd8dd�Z						d;d d!�Z 								d9d"d#�Z!								d9d$d%�Z"	d<d&d'�Z#	d8d(d)�Z$d8d*d+�Z%	d;d,d-�Z&	d;d.d/�Z'	d8d0d1�Z(							d:d2d3�Z)d8d4d5�Z*	d8d6d7�Z+dS)=ar
Connection module for Amazon KMS

.. versionadded:: 2015.8.0

:configuration: This module accepts explicit kms credentials but can also utilize
    IAM roles assigned to the instance through Instance Profiles. Dynamic
    credentials are then automatically obtained from AWS API and no further
    configuration is necessary. More Information available at::

       http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html

    If IAM roles are not used you need to specify them either in a pillar or
    in the minion's config file::

        kms.keyid: GKTADJGHEIQSXMKKRBJ08H
        kms.key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs

    A region may also be specified in the configuration::

        kms.region: us-east-1

    If a region is not specified, the default is us-east-1.

    It's also possible to specify key, keyid and region via a profile, either
    as a passed in dict, or as a string to pull from pillars or minion config:

        myprofile:
            keyid: GKTADJGHEIQSXMKKRBJ08H
            key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
            region: us-east-1

:depends: boto
�N�botoTFcCstjjjddd�S)z,
    Only load if boto libraries exist.
    z2.38.0F)Zboto_verZcheck_boto3)�salt�utilsZversionsZcheck_boto_reqs�rr�I/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/boto_kms.py�__virtual__=srcCstr
tdtdtd�dSdS)Nzboto.assign_funcs�kms)�pack)�HAS_BOTO�	__utils__�__name__Z__salt__)�optsrrr�__init__Ds�rc	
C�rt||||d�}i}z
|�||�d|d<W|Stjjy8}zd|d<td|�|d<WYd}~|Sd}~ww)z�
    Create a display name for a key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.create_alias 'alias/mykey' key_id
    ��region�key�keyid�profileT�resultF�boto.get_error�errorN)�	_get_conn�create_aliasr�	exception�BotoServerErrorr)	Z
alias_nameZ
target_key_idrrrr�conn�r�errrrI�
���rc


Cs�t||||	d�}
|�d�rt|�}i}z|
j||||||d�|d<W|Stjjy@}ztd|�|d<WYd}~|Sd}~ww)a
    Adds a grant to a key to specify who can access the key and under what
    conditions.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.create_grant 'alias/mykey' 'arn:aws:iam::1111111:/role/myrole' operations='["Encrypt","Decrypt"]'
    r�alias/)�retiring_principal�
operations�constraints�grant_tokens�grantrrN)r�
startswith�_get_key_id�create_grantrrrr)
�key_idZgrantee_principalr!r"r#r$rrrrrrrrrrr(as&
�
���r(c
Cs�t||||d�}i}tjj�|�}	z|j|	||d�}
|
d|d<W|Stjjy?}zt	d|�|d<WYd}~|Sd}~ww)z�
    Creates a master key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.create_key '{"Statement":...}' "My master key"
    r)�description�	key_usage�KeyMetadata�key_metadatarrN)
rr�serializers�json�	serialize�
create_keyrrrr)�policyr*r+rrrrrrZ_policyr-rrrrr1�s����r1c
Csrt||||d�}i}z|j|||d�}	|	d|d<W|Stjjy8}
ztd|
�|d<WYd}
~
|Sd}
~
ww)z�
    Decrypt ciphertext.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.decrypt encrypted_ciphertext
    r��encryption_contextr$�	Plaintext�	plaintextrrN)r�decryptrrrr)�ciphertext_blobr4r$rrrrrrr6rrrrr7�s����r7c
Cs�t||||d�}i}z|�|�}d|d<W|StjjyG}z#t|tjjj�r4d|d<|WYd}~St	d|�|d<WYd}~|Sd}~ww)z�
    Check for the existence of a key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.key_exists 'alias/mykey'
    rTrFNrr)
r�describe_keyrrr�
isinstancer�
exceptionsZNotFoundExceptionr�r)rrrrrrrrrr�
key_exists�s


���r=cCst|||||�d}|dS)z&
    From an alias, get a key_id.
    r-ZKeyId)r9)�aliasrrrrr-rrrr'�sr'c
Cslt||||d�}i}z|�|�}|d|d<W|Stjjy5}ztd|�|d<WYd}~|Sd}~ww)z�
    Get detailed information about a key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.describe_key 'alias/mykey'
    rr,r-rrN)rr9rrrrr<rrrr9�s

���r9c
C�pt||||d�}i}z|�|�}d|d<W|Stjjy7}zd|d<td|�|d<WYd}~|Sd}~ww)z�
    Mark key as disabled.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.disable_key 'alias/mykey'
    rTrFrrN)r�disable_keyrrrrr<rrrr@�


���r@c
Cr?)z�
    Disable key rotation for specified key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.disable_key_rotation 'alias/mykey'
    rTrFrrN)r�disable_key_rotationrrrrr<rrrrBrArBc
Cr?)z�
    Mark key as enabled.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.enable_key 'alias/mykey'
    rTrFrrN)r�
enable_keyrrrrr<rrrrC.rArCc
Cr?)z�
    Disable key rotation for specified key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.enable_key_rotation 'alias/mykey'
    rTrFrrN)r�enable_key_rotationrrrrr<rrrrDDrArDc
Cstt||||d�}i}	z|j||||d�}
|
d|	d<W|	Stjjy9}ztd|�|	d<WYd}~|	Sd}~ww)z�
    Encrypt plaintext into cipher text using specified key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.encrypt 'alias/mykey' 'myplaindata' '{"aws:username":"myuser"}'
    rr3ZCiphertextBlob�
ciphertextrrN)r�encryptrrrr)r)r6r4r$rrrrrrrErrrrrFZs ����rFc	

C�rt||||d�}	i}
z|	j|||||d�}||
d<W|
Stjjy8}ztd|�|
d<WYd}~|
Sd}~ww)z�
    Generate a secure data key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.generate_data_key 'alias/mykey' number_of_bytes=1024 key_spec=AES_128
    r�r4�number_of_bytes�key_specr$�data_keyrrN)r�generate_data_keyrrrr�
r)r4rIrJr$rrrrrrrKrrrrrL}�"�
���rLc	

CrG)z�
    Generate a secure data key without a plaintext copy of the key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.generate_data_key_without_plaintext 'alias/mykey' number_of_bytes=1024 key_spec=AES_128
    rrHrKrrN)r�#generate_data_key_without_plaintextrrrrrMrrrrO�rNrOc	
C�lt||||d�}i}z|�|�}|d|d<W|Stjjy5}ztd|�|d<WYd}~|Sd}~ww)z�
    Generate a random string.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.generate_random number_of_bytes=1024
    rr5�randomrrN)r�generate_randomrrrr)	rIrrrrrrrQrrrrrR�s
���rRc

Cs~t||||d�}i}z|�||�}tjjj|dtjd�|d<W|Stj	j
y>}	ztd|	�|d<WYd}	~	|Sd}	~	ww)z�
    Get the policy for the specified key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.get_key_policy 'alias/mykey' mypolicy
    r�Policy)�object_pairs_hook�
key_policyrrN)r�get_key_policyrr.r/Zdeserialize�odict�OrderedDictrrrr)
r)�policy_namerrrrrrrUrrrrrV�s
����rVc	
CrP)z�
    Get status of whether or not key rotation is enabled for a key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.get_key_rotation_status 'alias/mykey'
    rZKeyRotationEnabledrrrN)r�get_key_rotation_statusrrrr)	r)rrrrrrZkey_rotation_statusrrrrrZ�s

���rZc
Cs�t||||d�}|�d�rt|�}i}z+g}	d}
	|j|||
d�}|dD]}|	�|�q%d|vr6|d}
nnq|	|d<W|Stjjy[}
ztd	|
�|d
<WYd}
~
|Sd}
~
ww)z�
    List grants for the specified key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.list_grants 'alias/mykey'
    rr NT��limit�markerZGrantsZ
NextMarker�grantsrr)	rr&r'�list_grants�appendrrrr)r)r\r]rrrrrrZ_grantsZnext_markerr^r%rrrrr_s,

�
���r_c
Cs�t||||d�}|�d�rt|�}i}z|j|||d�}	|	d|d<W|StjjyA}
ztd|
�|d<WYd}
~
|Sd}
~
ww)	z�
    List key_policies for the specified key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.list_key_policies 'alias/mykey'
    rr r[ZPolicyNames�key_policiesrrN)rr&r'�list_key_policiesrrrr)r)r\r]rrrrrrrarrrrrb.s
���rbc

Cs~t||||d�}i}z|�||tjj�|��d|d<W|Stjjy>}	zd|d<t	d|	�|d<WYd}	~	|Sd}	~	ww)z�
    Attach a key policy to the specified key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.put_key_policy 'alias/mykey' default '{"Statement":...}'
    rTrFrrN)
r�put_key_policyrr.r/r0rrrr)
r)rYr2rrrrrrrrrrrcHs�
���rcc	

Cspt||||d�}	i}
z|	�|||||�}||
d<W|
Stjjy7}ztd|�|
d<WYd}~|
Sd}~ww)z�
    Reencrypt encrypted data with a new master key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.re_encrypt 'encrypted_data' 'alias/mynewkey' default '{"Statement":...}'
    rrErrN)r�
re_encryptrrrr)
r8Zdestination_key_idZsource_encryption_contextZdestination_encryption_contextr$rrrrrrrErrrrrdbs"�
���rdc	
Cs�t||||d�}|�d�rt|�}i}z
|�||�d|d<W|StjjyA}zd|d<td|�|d<WYd}~|Sd}~ww)	z�
    Revoke a grant from a key.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.revoke_grant 'alias/mykey' 8u89hf-j09j...
    rr TrFrrN)rr&r'�revoke_grantrrrr)	r)Zgrant_idrrrrrrrrrrre�s


���rec	
Cr)z�
    Update a key's description.

    CLI Example:

    .. code-block:: bash

        salt myminion boto_kms.update_key_description 'alias/mykey' 'My key'
    rTrFrrN)r�update_key_descriptionrrrr)	r)r*rrrrrrrrrrrf�rrf)NNNN)NNNNNNNN)NNNNNNN)NNNNNN)NNNNN),�__doc__�loggingZsalt.serializers.jsonrZsalt.utils.compatZsalt.utils.odictrrWZsalt.utils.versions�	getLoggerr�logrZboto.kms�setLevel�CRITICALr
�ImportError�AttributeErrorrrrr(r1r7r=r'r9r@rBrCrDrFrLrOrRrVrZr_rbrcrdrerfrrrr�<module>s�'
�
�
�*
�"
�
!






�%
�'
�&
�
�

�#
�
�
�
%�