o

�N�gR0�@stdZd
dl
m
mZ
d
dlmZ
dd�Z										ddd	�
Zd
d�Zdd
�Z	dd�Z
dd�Zdd�ZdS)a�
Manage KMS keys, key policies and grants.

.. versionadded:: 2015.8.0

Be aware that this interacts with Amazon's services, and so may incur charges.

This module uses ``boto``, which can be installed via package, or pip.

This module accepts explicit kms credentials but can also utilize
IAM roles assigned to the instance through Instance Profiles. Dynamic
credentials are then automatically obtained from AWS API and no further
configuration is necessary. More information available `here
<http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html>`_.

If IAM roles are not used you need to specify them either in a pillar file or
in the minion's config file:

.. code-block:: yaml

    elb.keyid: GKTADJGHEIQSXMKKRBJ08H
    elb.key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs

It's also possible to specify ``key``, ``keyid`` and ``region`` via a profile,
either passed in as a dict, or as a string to pull from pillars or minion
config:

.. code-block:: yaml

    myprofile:
        keyid: GKTADJGHEIQSXMKKRBJ08H
        key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
        region: us-east-1

.. code-block:: yaml

    Ensure mykey key exists:
      boto_kms.key_present:
        - name: mykey
        - region: us-east-1

    # Using a profile from pillars
    Ensure mykey key exists:
      boto_kms.key_present:
        - name: mykey
        - region: us-east-1
        - profile: myprofile

    # Passing in a profile
    Ensure mykey key exists:
      boto_key.key_present:
        - name: mykey
        - region: us-east-1
        - profile:
            keyid: GKTADJGHEIQSXMKKRBJ08H
            key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
�N)
�SaltInvocationErrorcCsd
tvrdSdS)z)
    Only load if boto is available.
    �boto_kms.describe_keyZboto_kms)Fz#boto_kms module could not be loaded)
�__salt__�rr�H/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/boto_kms.py�__virtual__?s

rFTcCs�|
std
�
�
|rt
|t�std�
�
t
|t�std�
�
t
|t�s#td�
�
t
|t�s,td�
�
|ddid�}t||
||||||	|
|�
}
t�|d	|
d	�|d	<d
�|d|
dg�
|d<|
dsk|
d|d<|dd
urk|S|S)a,
    Ensure the KMS key exists. KMS keys can not be deleted, so this function
    must be used to ensure the key is enabled or disabled.

    name
        Name of the key.

    policy
        Key usage policy.

    description
        Description of the key.

    key_usage
        Specifies the intended use of the key. Can only be set on creation,
        defaults to ENCRYPT_DECRYPT, which is also the only supported option.

    grants
        A list of grants to apply to the key. Not currently implemented.

    manage_grants
        Whether or not to manage grants. False by default, which will not
        manage any grants.

    key_rotation
        Whether or not key rotation is enabled for the key. False by default.

    enabled
        Whether or not the key is enabled. True by default.

    region
        Region to connect to.

    key
        Secret key to be used.

    keyid
        Access key to be used.

    profile
        A dict with region, key and keyid, or a pillar key (string)
        that contains a dict with region, key and keyid.
    zpolicy is a required argument.zmanage_grants must be a list.z$manage_grants must be true or false.z#key_rotation must be true or false.zenabled must be true or false.T�)�name�result�comment�changesr�
 rr
F)r�
isinstance�list�bool�_key_present�
dictupdate�update�join)r	�policy�description�	key_usageZgrantsZ
manage_grants�key_rotation�enabled�region�key�keyid�profile�ret�_retrrr�key_presentHs<9






















�




r c
Cs"d
did�}
d|��}td|||||	�}d|vr*d|
d<d	�
|dd
�
|
d<|
S|ds�tdr<d
|
d<d|
d<|
Std|
||||||	�}
d|
vr]d|
d<d�
|
dd
�
|
d<|
S|
d}|d}td||||||	�}d|vr�d|
d<d�
||dd
�|
d<|
Sddi
|
dd<d|i
|
dd<d|�d�|
d<n�td|||||	�}d|vr�d|
d<d�
|dd
�
|
d<|
S|d}t||||||	�}t�|
d|d�|
d<d�|
d|dg�
|
d<|ds�|d|
d<|
ddur�|
St||
||||	�}t�|
d|d�|
d<d�|
d|dg�
|
d<|d�
s,|d|
d<|
ddu�
r,|
St||||||	�}t�|
d|d�|
d<d�|
d|dg�
|
d<|d�
sb|d|
d<|
ddu�
rb|
St	||||||	�}t�|
d|d�|
d<d�|
d|dg�
|
d<|d�
s�|d|
d<|
S)NTr�r
rrzalias/zboto_kms.key_exists�errorFr
z&Error when attempting to find key: {}.�messager�testzKey is set to be created.zboto_kms.create_keyzFailed to create key: {}�key_metadata�KeyIdzboto_kms.create_aliaszoFailed to create key alias for key_id {}. This resource will be left dangling. Please clean manually. Error: {}rr�old�newzKey z	 created.rzFailed to update key: {}.r
)
r�format�__opts__�_key_descriptionrrr�_key_policy�_key_enabled�
_key_rotation)r	rrrrrrrrrr�alias�
r�rcr%�
kms_key_idZrnZrdrrrrr�s�







�






�






��




































rc
Cs�d
did�}|d}|d|
kr|Stdr d|d<d|d	<|S|
r/t
d
|||||�}d}	nt
d|||||�}d}	d
|vrPd|d	<d�|d
d�
|d<|S|	�d�|d<|S)NTrr!r&�Enabledr$z'Key set to have enabled status updated.rr
zboto_kms.enable_keyzboto_kms.disable_keyZDisabledr"Fz(Failed to update key enabled status: {}.r#z key.�r*rr))
r%rrrrrrr2�re�eventrrrr-�s*
















��
r-cCs�d
did�}|d|
kr|Stdrd|d<d|d<|St
d	|d
|
||||�}d|vr>d|d<d
�|dd�
|d<|Sd|d<|S)NTrr!ZDescriptionr$z$Key set to have description updated.rr
zboto_kms.update_key_descriptionr&r"Fz%Failed to update key description: {}.r#zUpdated key description.r4)r%rrrrrrZrdurrrr+
s$








�



��
r+cCs
d
did�}|d}td|||||�}|d|
kr|St
dr*d|d	<d|d<|S|d
s8d|d	<d|d<|S|
rEtd|||||�}	n
td|||||�}	d
|	vrxd|	d
dvrgd}
d|d<|
|d	<|Sd|d<d�|	d
d�
|d	<|Sd|
i
d|
i
d�|d<d|
�d�|d	<|S)NTrr!r&z boto_kms.get_key_rotation_statusr
r$z,Key set to have key rotation policy updated.rr3z2Key is disabled, not changing key rotation policy.zboto_kms.enable_key_rotationr"zis disabledr#FzFailed to set key rotation: {}.r)r'r(rzSet key rotation policy to �
.�rr*r))r%rrrrrrr2ZrkeZrk�msgrrrr.+
sL




�












�

�







�	�

�
r.c
Cs�d
did�}|d}td|d||||�}|d|
kr|St
dr0d	�|d
�
|d
<d|d<|Std|d|
||||�}	d
|	vrTd|d<d�|d
|	d
d�|d
<|Sd|d
<|S)NTrr!r&zboto_kms.get_key_policy�defaultZ
key_policyr$z&{} Key set to have key policy updated.rr
zboto_kms.put_key_policyr"Fz"{} Failed to update key policy: {}r#zUpdated key policy.r8)
r%rrrrrrr2ZrkpZrpkprrrr,Z
s,



�






�


��
r,)
NNNFFTNNNN)
�__doc__Zsalt.utils.dictupdate�utilsrZsalt.exceptionsrrr rr-r+r.r,rrrr�<module>
s(:










�\Y/