HEX

File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/states/__pycache__/boto_iam.cpython-310.pyc
o

�N�g��@sdZddlZddlZddlmmZddlZddl	m
mZddlZddl
Zddlm
mZddlZe�e�ZdZdd�Z							d;dd�Z						d<d
d�Z	d=dd
�Z	d=dd�Z									d>dd�Z	d?dd�Z	d?dd�Zd=dd�Zd=dd�Z	d=dd�Zd=dd�Z 										d@dd �Z!d!d"�Z"						dAd#d$�Z#						dAd%d&�Z$d=d'd(�Z%d=d)d*�Z&														dBd+d,�Z'd=d-d.�Z(						dCd/d0�Z)						dCd1d2�Z*d=d3d4�Z+	d=d5d6�Z,d=d7d8�Z-d9d:�Z.dS)Da&
Manage IAM objects
==================

.. versionadded:: 2015.8.0

This module uses ``boto``, which can be installed via package, or pip.

This module accepts explicit IAM credentials but can also utilize
IAM roles assigned to the instance through Instance Profiles. Dynamic
credentials are then automatically obtained from AWS API and no further
configuration is necessary. More information available `here
<http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html>`_.

It's also possible to specify ``key``, ``keyid`` and ``region`` via a profile, either
passed in as a dict, or as a string to pull from pillars or minion config:

.. code-block:: yaml

    delete-user:
      boto_iam.user_absent:
        - name: myuser
        - delete_keys: true


.. code-block:: yaml

    delete-keys:
      boto_iam.keys_absent:
        - access_keys:
          - 'AKIAJHTMIQ2ASDFLASDF'
          - 'PQIAJHTMIQ2ASRTLASFR'
        - user_name: myuser

.. code-block:: yaml

    create-user:
      boto_iam.user_present:
        - name: myuser
        - policies:
            mypolicy: |
                {
                    "Version": "2012-10-17",
                    "Statement": [{
                    "Effect": "Allow",
                    "Action": "*",
                    "Resource": "*"}]
                }
        - password: NewPassword$$1
        - region: eu-west-1
        - keyid: 'AKIAJHTMIQ2ASDFLASDF'
        - key: 'fdkjsafkljsASSADFalkfjasdf'

.. code-block:: yaml

    create-group:
      boto_iam.group_present:
        - name: mygroup
        - users:
          - myuser
          - myuser1
        - policies:
            mypolicy: |
                {
                    "Version": "2012-10-17",
                    "Statement": [{
                    "Effect": "Allow",
                    "Action": "*",
                    "Resource": "*"}]
                }
        - region: eu-west-1
        - keyid: 'AKIAJHTMIQ2ASDFLASDF'
        - key: 'safsdfsal;fdkjsafkljsASSADFalkfj'

.. code-block:: yaml

    change-policy:
      boto_iam.account_policy:
        - change_password: True
        - region: eu-west-1
        - keyid: 'AKIAJHTMIQ2ASDFLASDF'
        - key: 'safsdfsal;fdkjsafkljsASSADFalkfj'

.. code-block:: yaml

    create server certificate:
      boto_iam.server_cert_present:
        - name: mycert
        - public_key: salt://base/mycert.crt
        - private_key: salt://base/mycert.key
        - cert_chain: salt://base/mycert_chain.crt
        - region: eu-west-1
        - keyid: 'AKIAJHTMIQ2ASDFLASDF'
        - key: 'fdkjsafkljsASSADFalkfjasdf'

.. code-block:: yaml

    delete server certificate:
      boto_iam.server_cert_absent:
        - name: mycert

.. code-block:: yaml

    create keys for user:
      boto_iam.keys_present:
        - name: myusername
        - number: 2
        - save_dir: /root
        - region: eu-west-1
        - keyid: 'AKIAJHTMIQ2ASDFLASDF'
        - key: 'fdkjsafkljsASSADFalkfjasdf'

.. code-block:: yaml

    create policy:
      boto_iam.policy_present:
        - name: myname
        - policy_document: '{"MyPolicy": "Statement": [{"Action": ["sqs:*"], "Effect": "Allow", "Resource": ["arn:aws:sqs:*:*:*"], "Sid": "MyPolicySqs1"}]}'
        - region: eu-west-1
        - keyid: 'AKIAJHTMIQ2ASDFLASDF'
        - key: 'fdkjsafkljsASSADFalkfjasdf'

.. code-block:: yaml

    add-saml-provider:
      boto_iam.saml_provider_present:
        - name: my_saml_provider
        - saml_metadata_document: salt://base/files/provider.xml
        - keyid: 'AKIAJHTMIQ2ASDFLASDF'
        - key: 'safsdfsal;fdkjsafkljsASSADFalkfj'
�NZboto_iamcCsdtvrdSddt�d�fS)zF
    Only load if elementtree xml library and boto are available.
    �boto_iam.get_userTFzCannot load z# state: boto_iam module unavailable)�__salt__�__virtualname__�rr�H/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/boto_iam.py�__virtual__�s

�rTc	Cs*|ddid�}td|||||�sd|d<d|�d�|d<|S|r�td	|||||d
�}	t�d||	�t|	t�r�|	dd
d}	|	D]?}
tdr]d�|dd�|
d�g�|d<d|d<qBt||
d|||||�r�d�|dd�|
d�g�|d<d|d|
d<qB|�rtd|||||d
�}|�r|D]o}|d}
tdr�d�|dd�||
�g�|d<d|d<ntd||
||||d�}|r�d�|dd�||
�g�|d<tdr�d�|dd�|
�g�|d<d|d<q�td|
||||d�}|�rd�|dd |
�d!�g�|d<q�|�r=td�r!d�|dd"|�d#�g�|d<d|d<ntd$|||||�}|�r=d�|dd"|�d%�g�|d<td�rVd�|dd"|�d&�g�|d<d|d<n)t	|||||�}d�|d|dg�|d<|d�s|d|d<|dd'u�r|Std�r�d�|dd"|�d(�g�|d<d|d<n)t
|||||�}d�|d|dg�|d<|d�s�|d|d<|dd'u�r�|Std�r�d�|dd"|�d)�g�|d<d|d<|Std*|||||�}|du�rd�|dd"|�d!�g�|d<d|d<||dd<|Sd"|�d+|��|d<d'|d<|S),a�

    .. versionadded:: 2015.8.0

    Ensure the IAM user is absent. User cannot be deleted if it has keys.

    name (string)
        The name of the new user.

    delete_keys (bool)
        Delete all keys from user.

    delete_mfa_devices (bool)
        Delete all mfa devices from user.

        .. versionadded:: 2016.3.0

    delete_profile (bool)
        Delete profile from user.

        .. versionadded:: 2016.3.0

    region (string)
        Region to connect to.

    key (string)
        Secret key to be used.

    keyid (string)
        Access key to be used.

    profile (dict)
        A dict with region, key and keyid, or a pillar key (string)
        that contains a dict with region, key and keyid.
    T���name�result�comment�changesrr�	IAM User � does not exist.r�boto_iam.get_all_access_keys��	user_name�region�key�keyid�profilezKeys for user %s are %s.�list_access_keys_response�list_access_keys_result�access_key_metadata�test� zKey {} is set to be deleted.�
access_key_idNzKey {} has been deleted.�deletedr
zboto_iam.get_all_mfa_devicesZ
serial_numberz3IAM user {} MFA device {} is set to be deactivated.zboto_iam.deactivate_mfa_device)r�serialrrrrz)IAM user {} MFA device {} is deactivated.z+Virtual MFA device {} is set to be deleted.z"boto_iam.delete_virtual_mfa_device)rrrrrzVirtual MFA device � is deleted.�	IAM user z$ login profile is set to be deleted.zboto_iam.delete_login_profilez login profile is deleted.�) managed policies are set to be detached.F�' inline policies are set to be deleted.� is set to be deleted.zboto_iam.delete_user� could not be deleted.
 )r�log�debug�
isinstance�dict�__opts__�join�format�_delete_key�_user_policies_detached�_user_policies_deleted)r
Zdelete_keysZdelete_mfa_devicesZdelete_profilerrrr�ret�keys�kZdevices�drZmfa_deactivatedZmfa_deletedZprofile_deleted�_retrrrr�user_absent�s"-
�

���
����
����
�������
�
���

��

�
��

��



��


�
r4�{2}
{0}
{3}
{1}
c
Cs�|ddid�}td|||||�sd|d<d|�d�|d	<|St|t�s.d
|d	<d|d<|Stj�|�sBd|�d�|d	<d|d<|Std|||||d
�}	t|	t�rnt�d|	�t	|	�\}
}d|
�d|��|d	<d|d<|S|	ddd}	t�d|	�t
|	�|kr�d|��|d	<d|d<|Stdr�d|�d�|d	<d|d<|Si}t|t
|	��D]Y}
td|||||�}t|t�r�t	|�\}
}d|
�d|��|d	<d|d<|St�d|�d}d}i|t|
�<|||dd |t|
�d!<|||dd"|t|
�d#<q�z\t
jj�|�d$|��d%��0}|��D]#\}}|d!}|d#}|�t
jj�|�||d&|��d'|������qWd�n	1�sGwYd(|�d$|�d�|d	<d|d<||d)<|WSt�y|d*|�d$|�d�|d	<d|d<|YSw)+a�
    .. versionadded:: 2015.8.0

    Ensure the IAM access keys are present.

    name (string)
        The name of the new user.

    number (int)
        Number of keys that user should have.

    save_dir (string)
        The directory that the key/keys will be saved. Keys are saved to a file named according
        to the username privided.

    region (string)
        Region to connect to.

    key (string)
        Secret key to be used.

    keyid (string)
        Access key to be used.

    profile (dict)
        A dict with region, key and keyid, or a pillar key (string)
        that contains a dict with region, key and keyid.

    save_format (dict)
        Save format is repeated for each key. Default format is
        "{2}\n{0}\n{3}\n{1}\n", where {0} and {1} are placeholders for new
        key_id and key respectively, whereas {2} and {3} are "key_id-{number}"
        and 'key-{number}' strings kept for compatibility.
    Trr	rFrrrrz&The number of keys must be an integer.zThe directory rrzkeys are : false %szCould not get keys.
�
rrrzKeys are : %s.z"The number of keys exist for user rz$Access key is set to be created for �.Nzboto_iam.create_access_keyzCould not create keys.
zCreated is : %sZcreate_access_key_responseZcreate_access_key_resultZ
access_keyr�key_idZsecret_access_key�
secret_key�/�azkey_id-zkey-zKeys have been written to file r
zCould not write to file )rr'�int�os�path�isdir�strr%r&�
_get_error�lenr)�range�salt�utils�filesZfopen�items�writeZstringutilsZto_strr+�OSError)r
�numberZsave_dirrrrrZsave_formatr/r0�error�messageZnew_keys�i�created�responserZ_wrfZkey_numr8r9rrr�keys_presentts�,

�

�
�
��������rPc	Cs`|ddid�}td|||||�sd|d<d|�d�|d	<|S|D]}t|||||||�}q!|S)
a�

    .. versionadded:: 2015.8.0

    Ensure the IAM user access_key_id is absent.

    access_key_id (list)
        A list of access key ids

    user_name (string)
        The username of the user

    region (string)
        Region to connect to.

    key (string)
        Secret key to be used.

    keyid (string)
        Access key to be used.

    profile (dict)
        A dict with region, key and keyid, or a pillar key (string)
        that contains a dict with region, key and keyid.
    Trr	rFrrrr)rr,)Zaccess_keysrrrrrr/r1rrr�keys_absent�srQc
Cs\td|||||d�}t�d||�t|t�r.t�d|�d�|dd|�d�g�|d<|S|d	d
d}|D]s}t�d|d
|�t|d
�t|�kr�tdr`d�|�|d<d|d<|Std||||||�}	|	r�d�|dd|�d�g�|d<d|d|<|Sd�|dd|�d�g�|d<|Sd�|dd|�d�g�|d<|SdS)NrrzKeys for user %s are : %s.z+Keys %s are a string. Something went wrong.rrzKey z could not be deleted.rrrz#Key is: %s and is compared with: %srrz#Access key {} is set to be deleted.rzboto_iam.delete_access_keyz has been deleted.rr
r)rr%r&r'r@r*r)r+)
r/rrrrrrr0r1rrrrr,sP
�
�
�
������r,c
Cs|ddid�}
|si}|sg}|sg}i}|D]
}td|�}
|�|
�q|�|�td|||||	�}|s�tdrHd|�d�|
d	<d
|
d<|
Std||||||	�}|r�||
d
d<d�|
d	d|�d�g�|
d	<|rvt|
||||||	�}
t||||||	�}t�|
d
|d
�|
d
<d�|
d	|d	g�|
d	<n=d�|
d	d|�d�g�|
d	<|r�t|
||||||	�}
t||||||	�}t�|
d
|d
�|
d
<d�|
d	|d	g�|
d	<t||||||	�}t�|
d
|d
�|
d
<d�|
d	|d	g�|
d	<|d�s|d|
d<|
S|
S)a

    .. versionadded:: 2015.8.0

    Ensure the IAM user is present

    name (string)
        The name of the new user.

    policies (dict)
        A dict of IAM group policy documents.

    policies_from_pillars (list)
        A list of pillars that contain role policy dicts. Policies in the
        pillars will be merged in the order defined in the list and key
        conflicts will be handled by later defined keys overriding earlier
        defined keys. The policies defined here will be merged with the
        policies defined in the policies argument. If keys conflict, the keys
        in the policies argument will override the keys defined in
        policies_from_pillars.

    managed_policies (list)
        A list of managed policy names or ARNs that should be attached to this
        user.

    password (string)
        The password for the new user. Must comply with account policy.

    path (string)
        The path of the user. Default is '/'.

        .. versionadded:: 2015.8.2

    region (string)
        Region to connect to.

    key (string)
        Secret key to be used.

    keyid (string)
        Access key to be used.

    profile (dict)
        A dict with region, key and keyid, or a pillar key (string)
        that contains a dict with region, key and keyid.
    Trr	�
pillar.getrrr � is set to be created.rNrzboto_iam.create_userr
�userr�User � has been created.� is present.)r�updater)r*�_case_password�_user_policies_present�
dictupdate�_user_policies_attached)r
�policies�policies_from_pillars�managed_policies�passwordr>rrrrr/�	_policies�policy�_policy�existsrNr3rrr�user_presentAsZ:
���
rec	Cs$ddid�}i}g}|��D]0\}	}
t|
t�r"tjjj|
tjd�}n|
}t	d||	||||�}||kr>t
�d||�|
||	<qt	d|||||d�}
|
D]}	|	|vrW|�|	�qL|s]|�rt
|�}|�|�td	r{d
�d�|�|�|d<d|d
<|Sd|
i|dd<|��D]5\}	}
t	d||	|
||||�}|s�t	d|||||d�}
d|
i|dd<d|d
<d�|	|�|d<|Sq�|D]2}	t	d||	||||�}|s�t	d|||||d�}
d|
i|dd<d|d
<d�|	|�|d<|Sq�t	d|||||d�}
d|
i|dd<d�d�|
�|�|d<|S)NTr�rrr
��object_pairs_hookzboto_iam.get_user_policy�Policy mismatch:
%s
%s�boto_iam.get_all_user_policiesrr�&{} policies to be modified on user {}.�, rrr]r
�oldzboto_iam.put_user_policy�newFz#Failed to add policy {} for user {}�boto_iam.delete_user_policy�"Failed to add policy {} to user {}� {} policies modified on user {}.�rGr'r@rDrE�json�loads�odict�OrderedDictrr%r&�append�list�extendr)r+r*)r
r]rrrrr/�policies_to_create�policies_to_delete�policy_namerb�dict_policyrc�_list�
_to_modify�
policy_set�policy_unsetrrrrZ�s�
���
�
�


��
���
�
���

�
�rZc	Csrddid�}g}g}|p
gD]+}	td|	d||||d�}
d}|
�dg�D]
}||�d	�kr1d}nq$|s9|�|	�qtd
|||||d�}
dd
�|
D�}|
D]}|�d�|vrf|�d�|vrf|�|�d��qN|sl|�r7t|�}|�|�tdr�d�d�|�|�|d<d|d<|Sd|i|dd<|D]:}td||||||d�}|s�td
|||||d�}
dd
�|
D�}d|i|dd<d|d<d�||�|d<|Sq�|D];}td||||||d�}|�std
|||||d�}
dd
�|
D�}d|i|dd<d|d<d�||�|d<|Sq�td
|||||d�}
dd
�|
D�}t�	|�d|i|dd<d �d�|�|�|d<|S)!NTrrf�!boto_iam.list_entities_for_policyZUser�Z
entity_filterrrrrFZpolicy_usersr�$boto_iam.list_attached_user_policies�rrrrcS�g|]}|�d��qS��
policy_arn��get��.0�xrrr�
<listcomp>�z+_user_policies_attached.<locals>.<listcomp>r|r�rrkrlrrr_r
rmzboto_iam.attach_user_policycSr�r�r�r�rrrr�%r�rnrp�boto_iam.detach_user_policycSr�r�r�r�rrrr�4r�z'Failed to remove policy {} from user {}cSr�r�r�r�rrrr�>r�rq�
rr�rwrxryr)r+r*r%r&)r
r_rrrrr/�policies_to_attach�policies_to_detachrb�entities�foundZuserdictr~�oldpolicies�policy_datarr|r��newpoliciesr�rrrr\�s���
�
��


��
����
���
�

�r\c	CsNddid�}td|||||d�}dd�|D�}|s$d|�d	�|d
<|Stdr9d�d
�|�|�|d
<d|d<|Sd|i|dd<|D]<}td||||||d�}	|	std|||||d�}dd�|D�}
d|
i|dd<d|d<d|�d|��|d
<|SqCtd|||||d�}dd�|D�}
d|
i|dd<d�d
�|�|�|d
<|S)NTrrfr�rcSr�r�r�r�rrrr�Lr�z+_user_policies_detached.<locals>.<listcomp>zNo attached policies in user r7rrz({} policies to be detached from user {}.rlrr_r
rmr�r�cSr�r�r�r�rrrr�_r�rnFzFailed to detach z from user cSr�r�r�r�rrrr�gr�z"{} policies detached from user {}.�rr)r+r*�r
rrrrr/r~r�r�r�r�rrrr-GsL
�
��
��	
�
�r-c
	C� ddid�}td|||||d�}|sd|�d�|d<|Std	r2d
�d�|�|�|d<d|d<|Sd
|i|dd<|D]3}td||||||d�}|sotd|||||d�}	d
|	i|dd<d|d<d�||�|d<|Sq<td|||||d�}	d
|	i|dd<d�d�|�|�|d<|S)NTrrfrjrzNo inline policies in user r7rrz'{} policies to be deleted from user {}.rlr�inline_policiesr
rmror�rnFz Failed to detach {} from user {}z!{} policies deleted from user {}.r��
r
rrrrr/r�r|Zpolicy_deletedr�rrrr.o�J
�
��
���

�
�r.cCs�tdrd|�d�|d<d|d<|Std||||||�}t�d|�|rQd|vr:d	�|dd
|�d�g�|d<|Sd	�|dd|�d
�g�|d<d|dd<|Sd|d<d	�|dd�|�g�|d<|S)NrzLogin policy for z is set to be changed.rrzboto_iam.create_login_profilezLogin is : %s.�ConflictrzLogin profile for user � exists.z Password has been added to User r7ZREDACTEDr
r`FzIPassword for user {} could not be set.
Please check your password policy.)r)rr%r&r*r+)r/r
r`rrrrZloginrrrrY�s6����
���rYc		Csv|ddid�}td|||||�sd|d<d|�d�|d<|Std	r7d
�|dd|�d�g�|d<d
|d<n't|||||�}d
�|d|dg�|d<|ds^|d|d<|ddur^|Std	rvd
�|dd|�d�g�|d<d
|d<n't|||||�}d
�|d|dg�|d<|ds�|d|d<|ddur�|Sd
�|dd|�d�g�|d<td|||||d�}t|g||||||�}t�|d|d�|d<d
�|d|dg�|d<|ds�|d|d<|Std	�rd
�|dd|�d�g�|d<d
|d<|Std|||||�}|du�r+d
�|dd|�d�g�|d<d|d<||dd<|Sd|�d|��|d<d|d<|S)a�

    .. versionadded:: 2015.8.0

    Ensure the IAM group is absent.

    name (string)
        The name of the group.

    region (string)
        Region to connect to.

    key (string)
        Secret key to be used.

    keyid (string)
        Access key to be used.

    profile (dict)
        A dict with region, key and keyid, or a pillar key (string)
        that contains a dict with region, key and keyid.
    Trr	�boto_iam.get_grouprz
IAM Group rrrr�
IAM group r!NFr"z users are set to be removed.�boto_iam.get_group_members��
group_namerrrrr
r#zboto_iam.delete_grouprrr$)rr)r*�_group_policies_detached�_group_policies_deleted�_case_groupr[rX)	r
rrrrr/r3�existing_usersrrrr�group_absent�st
��

��
�
�
�
r�r:c	Cs|ddid�}|si}|sg}|sg}i}|D]
}
td|
�}|�|�q|�|�td|||||	d�}|s{tdrId|�d	�|d
<d|d<|Std
||||||	d�}|sed|�d�|d
<d|d<|S||dd<d�|d
d|�d�g�|d
<nd�|d
d|�d�g�|d
<t||||||	|
�}t�|d|d�|d<d�|d
|d
g�|d
<|ds�|d|d<|St||||||	|
�}t�|d|d�|d<d�|d
|d
g�|d
<|ds�|d|d<|S|du�r	t�d|�td|||||	d�}t	||||||||	�}|S)a

    .. versionadded:: 2015.8.0

    Ensure the IAM group is present

    name (string)
        The name of the new group.

    path (string)
        The path for the group, defaults to '/'

    policies (dict)
        A dict of IAM group policy documents.

    policies_from_pillars (list)
        A list of pillars that contain role policy dicts. Policies in the
        pillars will be merged in the order defined in the list and key
        conflicts will be handled by later defined keys overriding earlier
        defined keys. The policies defined here will be merged with the
        policies defined in the policies argument. If keys conflict, the keys
        in the policies argument will override the keys defined in
        policies_from_pillars.

    managed_policies (list)
        A list of policy names or ARNs that should be attached to this group.

    users (list)
        A list of users to be added to the group.

    region (string)
        Region to connect to.

    key (string)
        Secret key to be used.

    keyid (string)
        Access key to be used.

    profile (dict)
        A dict with region, key and keyid, or a pillar key (string) that
        contains a dict with region, key and keyid.

    delete_policies (boolean)
        Delete or detach existing policies that are not in the given list of policies.
        Default value is ``True``. If ``False`` is specified, existing policies
        will not be deleted or detached allowing manual modifications on the IAM group
        to be persistent.
    Trr	rRr�r�rr�rSrNrzboto_iam.create_group)r�r>rrrrzFailed to create IAM group r7Fr
�grouprzGroup rVrWzUsers are : %s.r�)
rrXr)r*�_group_policies_presentr[�_group_policies_attachedr%r&r�)r
r]r^r_�usersr>rrrr�delete_policiesr/rarbrcrdrNr3r�rrr�
group_presentst>

�� ��

�r�c
	Cszg}|D]	}	|�|	d�qt�d|�|D]^}	t�d|	�|	|vr:t�d�d�|dd|	�d|�d	�g�|d<qt�d
|	�tdrQd�|	|�|d<d|d
<qtd|	|||||�d�|dd|	�d|�d	�g�|d<||d|	<q|D]C}	|	|vr�tdr�d�|dd�|	|�g�|d<d|d
<qwtd||	||||d�d�|dd�|	|�g�|d<d|�d	�|d|	<qw|S)Nrzupstream users are %szusers are %szuser existsrrrUz is already a member of group r7zuser is set to be added %srz'User {} is set to be added to group {}.rzboto_iam.add_user_to_groupz has been added to group r
z+User {} is set to be removed from group {}.zboto_iam.remove_user_from_group)r�rrrrrz'User {} has been removed from group {}.zRemoved from group )rwr%r&r*r)r+r)
r/r�r�r�rrrrZ_usersrTrrrr��st
���
������
�����r�c	Cs ddid�}i}g}	|��D]0\}
}t|t�r"tjjj|tjd�}n|}t	d||
||||�}
|
|kr>t
�d|
|�|||
<qt	d|||||�}|D]
}
|rX|
|vrX|	�|
�qK|s^|	�rt
|	�}|�|�tdr|d	�d
�|�|�|d<d|d<|Sd
|i|dd<|��D]4\}
}t	d||
|||||�}|s�t	d|||||�}d
|i|dd<d|d<d�|
|�|d<|Sq�|	D]1}
t	d||
||||�}|s�t	d|||||�}d
|i|dd<d|d<d�|
|�|d<|Sq�t	d|||||�}d
|i|dd<d�d
�|�|�|d<|S)NTrrfrgzboto_iam.get_group_policyri�boto_iam.get_all_group_policiesr�'{} policies to be modified on group {}.rlrrr]r
rmzboto_iam.put_group_policyrnF�#Failed to add policy {} to group {}�boto_iam.delete_group_policy�!{} policies modified on group {}.rr)r
r]rrrrr�r/rzr{r|rbr}rcr~rr�r�rrrr��s�	
���
�
�


��
���
�
���

�
�r�c	Csvddid�}g}g}	|p
gD]+}
td|
d||||d�}d}|�dg�D]
}
||
�d	�kr1d}nq$|s9|�|
�qtd
|||||d�}dd
�|D�}|D]}|rh|�d�|vrh|�d�|vrh|	�|�d��qN|sn|	�r9t|	�}|�|�tdr�d�d�|�|�|d<d|d<|Sd|i|dd<|D]:}td||||||d�}|s�td
|||||d�}dd
�|D�}d|i|dd<d|d<d�||�|d<|Sq�|	D];}td||||||d�}|�std
|||||d�}dd
�|D�}d|i|dd<d|d<d�||�|d<|Sq�td
|||||d�}dd
�|D�}t�	|�d|i|dd<d �d�|�|�|d<|S)!NTrrfr�ZGroupr�FZ
policy_groupsr��%boto_iam.list_attached_group_policiesr�cSr�r�r�r�rrrr�<r�z,_group_policies_attached.<locals>.<listcomp>r|r�rr�rlrrr_r
rmzboto_iam.attach_group_policycSr�r�r�r�rrrr�Vr�rnr��boto_iam.detach_group_policycSr�r�r�r�rrrr�er�z(Failed to remove policy {} from group {}cSr�r�r�r�rrrr�or�r�r�)r
r_rrrrZdetach_policiesr/r�r�rbr�r��	groupdictr~r�r�rr|r�r�r�rrrr�s�	��
�
���


��
����
���
�

�r�c	CsJddid�}td|||||d�}dd�|D�}|s$d|�d	�|d
<|Stdr9d�d
�|�|�|d
<d|d<|Sd|i|dd<|D]:}td||||||d�}	|	s}td|||||d�}dd�|D�}
d|
i|dd<d|d<d�||�|d
<|SqCtd|||||d�}dd�|D�}
d|
i|dd<d�d
�|
�|�|d
<|S)NTrrfr�r�cSr�r�r�r�rrrr�}r�z,_group_policies_detached.<locals>.<listcomp>zNo attached policies in group r7rrz){} policies to be detached from group {}.rlrr_r
rmr�r�cSr�r�r�r�rrrr��r�rnF�!Failed to detach {} from group {}cSr�r�r�r�rrrr��r�z#{} policies detached from group {}.r�r�rrrr�xsP
�
��
���
�
�r�c
	Cr�)NTrrfr�r�zNo inline policies in group r7rrz({} policies to be deleted from group {}.rlrr�r
rmr�r�rnFr�z"{} policies deleted from group {}.r�r�rrrr��r�r�cCs*t�}dddid�}td|
|||
�}|sd|d<d|d	<|S|��D]7\}}|d
vr,q#|durZt||�t|���krZd�|dd
|�d||�d�g�|d<t|���|d|<q#|dsed|d<|Stdrsd|d<d|d	<|Std|||||||||	|
|||
�
r�|Sd|d<i|d<d|d	<|S)a�
    Change account policy.

    .. versionadded:: 2015.8.0

    name (string)
        The name of the account policy

    allow_users_to_change_password (bool)
        Allows all IAM users in your account to
        use the AWS Management Console to change their own passwords.

    hard_expiry (bool)
        Prevents IAM users from setting a new password after their
        password has expired.

    max_password_age (int)
        The number of days that an IAM user password is valid.

    minimum_password_length (int)
        The minimum number of characters allowed in an IAM user password.

    password_reuse_prevention (int)
        Specifies the number of previous passwords
        that IAM users are prevented from reusing.

    require_lowercase_characters (bool)
        Specifies whether IAM user passwords
        must contain at least one lowercase character from the ISO basic Latin alphabet (a to z).

    require_numbers (bool)
        Specifies whether IAM user passwords must contain at
        least one numeric character (0 to 9).

    require_symbols (bool)
        Specifies whether IAM user passwords must contain at
        least one of the following non-alphanumeric characters: ! @ # $ % ^ & * ( ) _ + - = [ ] { } | '

    require_uppercase_characters (bool)
        Specifies whether IAM user passwords must
        contain at least one uppercase character from the ISO basic Latin alphabet (A to Z).

    region (string)
        Region to connect to.

    key (string)
        Secret key to be used.

    keyid (string)
        Access key to be used.

    profile (dict)
        A dict with region, key and keyid, or a pillar key (string)
    zAccount PolicyTrr	zboto_iam.get_account_policyzAccount policy is not Enabled.rFr)rrrrr
Nrz
Policy value z has been set to r7r
zAccount policy is not changed.rz$Account policy is set to be changed.z'boto_iam.update_account_password_policy)�localsrrGr@�lowerr*r))r
Zallow_users_to_change_passwordZhard_expiryZmax_password_ageZminimum_password_lengthZpassword_reuse_preventionZrequire_lowercase_charactersZrequire_numbersZrequire_symbolsZrequire_uppercase_charactersrrrrZconfigr/�info�valuerrr�account_policy�sZF ����r�cCs�|ddid�}td|||||�}|sd|�d�|d<|Stdr/d	|�d
�|d<d|d<|Std
|||||�}|sId|d<d|�d�|d<|Sd|�d�|d<||d<|S)a�
    Deletes a server certificate.

    .. versionadded:: 2015.8.0

    name (string)
        The name for the server certificate. Do not include the path in this value.

    region (string)
        The name of the region to connect to.

    key (string)
        The key to be used in order to connect

    keyid (string)
        The keyid to be used in order to connect

    profile (string)
        The profile that contains a dict of region, key, keyid
    Trr	�boto_iam.get_server_certificate�Certificate rrr�Server certificate r#Nrzboto_iam.delete_server_certF� failed to be deleted.�
 was deleted.r
)rr))r
rrrrr/rdrrrr�server_cert_absent>s&
�r�c	

Cs�|ddid�}	td|||||�}
t�dt��|
r$d|�d�|	d<|	Sd	|vrVztd
|�}Wn%tyU}zt�|�d|�d�|	d<d
|	d<|	WYd}~Sd}~wwd	|vr�ztd
|�}Wn%ty�}zt�|�d|�d�|	d<d
|	d<|	WYd}~Sd}~ww|dur�d	|vr�ztd
|�}Wn%ty�}zt�|�d|�d�|	d<d
|	d<|	WYd}~Sd}~wwtdr�d|�d�|	d<d|	d<|	Std|||||||||�	}|d
ur�d|�d�|	d<||	d<|	Sd
|	d<d|�d�|	d<|	S)ao
    Crete server certificate.

    .. versionadded:: 2015.8.0

    name (string)
        The name for the server certificate. Do not include the path in this value.

    public_key (string)
        The contents of the public key certificate in PEM-encoded format.

    private_key (string)
        The contents of the private key in PEM-encoded format.

    cert_chain (string)
        The contents of the certificate chain. This is typically a
        concatenation of the PEM-encoded public key certificates of the chain.

    path (string)
        The path for the server certificate.

    region (string)
        The name of the region to connect to.

    key (string)
        The key to be used in order to connect

    keyid (string)
        The keyid to be used in order to connect

    profile (string)
        The profile that contains a dict of region, key, keyid
    Trr	r�zVariables are : %s.r�r�r�salt://�cp.get_file_strzFile z not found.FrNrr�rSzboto_iam.upload_server_cert�
 was created.r
� failed to be created.)rr%r&r�rIr))
r
Z
public_keyZprivate_keyZ
cert_chainr>rrrrr/rd�erNrrr�server_cert_presenthsh,
�
��
��
���r�c	Cs>|ddid�}td|||||�}	|	sYtdr%d|�d�|d<d	|d
<|Std||||||||�}
|
rK|
|dd
<d�|dd|�d�g�|d<|Sd|d
<d|d<i|d<|S|	�d
i�}	d�|dd|�d�g�|d<td||	�d�||||��di�}t|dt�r�tjj�	|d�}n|d}t|t�r�tjj�	|�}tjj
�||�}
t|
��rtdr�d|�d�|d<d	|d
<|Sd�|ddg�|d<tjj�
|�}td||d||||d�}
|
�d�s�d|d
<d�|
dd�|d<i|d<|Std ||	d||||d!�||d�d"i�d<|d|d�d#i�d<|S)$a|

    .. versionadded:: 2015.8.0

    Ensure the IAM managed policy is present

    name (string)
        The name of the new policy.

    policy_document (dict)
        The document of the new policy

    path (string)
        The path in which the policy will be created. Default is '/'.

    description (string)
        Description

    region (string)
        Region to connect to.

    key (string)
        Secret key to be used.

    keyid (string)
        Access key to be used.

    profile (dict)
        A dict with region, key and keyid, or a pillar key (string)
        that contains a dict with region, key and keyid.
    Trr	zboto_iam.get_policyrzIAM policy rSrNrzboto_iam.create_policyr
rbr�Policy rVFzFailed to update policy.rWzboto_iam.get_policy_versionZdefault_version_idZpolicy_versionZdocumentz set to be modified.zPolicy to be modifiedzboto_iam.create_policy_version)r|�policy_documentZset_as_defaultrrrrrNzFailed to update policy: {}.rKrL�boto_iam.delete_policy_version)r|�
version_idrrrrrnrm)rr)r*r�r'r@rDrErsrt�dataZ
compare_dicts�bool�dumpsr+�
setdefault)r
r�r>�descriptionrrrrr/rbrNZ	_describeZdescribeDict�rrrr�policy_present�s�)��=���

�
	
��	r�c		CsB|ddid�}td|||||d�}|sd|�d�|d<|Std	r0d|�d
�|d<d|d<|Std
|||||d�}|rl|D],}|�dd�dvrJq?td||�d�||||d�}|skd|d<d|�d�|d<|Sq?td|||||d�}|s�d|d<d|�d�|d<|Sd|i|dd<ddi|dd<d|�d�|d<|S)a�

    .. versionadded:: 2015.8.0

    Ensure the IAM managed policy with the specified name is absent

    name (string)
        The name of the new policy.

    region (string)
        Region to connect to.

    key (string)
        Secret key to be used.

    keyid (string)
        Access key to be used.

    profile (dict)
        A dict with region, key and keyid, or a pillar key (string)
        that contains a dict with region, key and keyid.
    Trr	zboto_iam.policy_existsr�r�rrr� is set to be removed.Nrzboto_iam.list_policy_versionsZis_default_versionF)�trueTr�r�)r�rrrrzFailed to delete policy r7zboto_iam.delete_policyrbr
rmrnz	 deleted.)rr)r�)	r
rrrrr/r�Zversions�versionrrr�
policy_absent9sT
�
���
�r�c

Cs2|ddid�}d|vr>z
td|�}t�|�Wn%ty=}zt�|�d|�d�|d<d	|d
<|WYd}~Sd}~wwtd||||d
�D]}||krZd|�d�|d<|SqHtdrmd|�d�|d<d|d
<|Std||||||d
�}	|	r�d|�d�|d<||dd<|Sd	|d
<d|�d�|d<|S)a
    .. versionadded:: 2016.11.0

    Ensure the SAML provider with the specified name is present.

    name (string)
        The name of the SAML provider.

    saml_metadata_document (string)
        The xml document of the SAML provider.

    region (string)
        Region to connect to.

    key (string)
        Secret key to be used.

    keyid (string)
        Access key to be used.

    profile (dict)
        A dict with region, key and keyid, or a pillar key (string)
        that contains a dict with region, key and keyid.
    Trr	r�r�zSAML document file z! not found or could not be loadedrFrN�boto_iam.list_saml_providersr��SAML provider rWrz is set to be create.zboto_iam.create_saml_providerr�r
rnr�)r�ET�
fromstringrIr%r&r))
r
Zsaml_metadata_documentrrrrr/r��providerrNrrr�saml_provider_present~sN

���
���r�cCs�|ddid�}td||||d�}t|�dkr!d|�d�|d	<|Std
r3d|�d�|d	<d|d
<|Std|||||d�}|durRd|�d�|d	<||dd<|Sd|d
<d|�d�|d	<|S)a
    .. versionadded:: 2016.11.0

    Ensure the SAML provider with the specified name is absent.

    name (string)
        The name of the SAML provider.

    saml_metadata_document (string)
        The xml document of the SAML provider.

    region (string)
        Region to connect to.

    key (string)
        Secret key to be used.

    keyid (string)
        Access key to be used.

    profile (dict)
        A dict with region, key and keyid, or a pillar key (string)
        that contains a dict with region, key and keyid.
    Trr	r�r�rr�z is absent.rrr�Nrzboto_iam.delete_saml_providerFr�r
rmr�)rrBr))r
rrrrr/r�rrrr�saml_provider_absent�s*�
�r�cCsFd�|�d�dd��}t�|�}|ddj}|ddj}||fS)Nr6�r�)r*�splitr�r��text)rK�coderLrrrrA�s

rA)TTTNNNN)NNNNr5)NNNN)	NNNNNNNNN)NNNNN)
NNNNr:NNNNT)NNNNNT)NNNNNNNNNNNNNN)NNNNNN)/�__doc__�loggingr=Zxml.etree.ElementTreeZetreeZElementTreer�Zsalt.utils.datarDZsalt.utils.dictupdaterEr[Zsalt.utils.filesZsalt.utils.jsonZsalt.utils.odictruZsalt.utils.stringutils�	getLogger�__name__r%rrr4rPrQr,rerZr\r-r.rYr�r�r�r�r�r�r�r�r�r�r�r�r�r�rArrrr�<module>s�

�W
�|
�'
�.
�j
�J
�
T
((
�
!Z
�|E
�Q
�
[
*(
�
u.
�_
�
uF
�
B0