HEX

File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/__pycache__/aws.cpython-310.pyc
o

�N�g>O�	@sddZddlZddlZddlZddlZddlZddlZddlZddlZddl	Z
ddlmm
ZddlmZddlZddlZddlZddlmmZe�e�ZdZdZgd�ZdZdZd	Z d
a!d
a"d
a#d
a$d
a%iZ&da'dd�Z(d&dd�Z)dd�Z*dd�Z+d'dd�Z,eddddd
dddf	dd�Z-dd�Z.dd�Z/											d(d d!�Z0d"d#�Z1d)d$d%�Z2dS)*z�
Connection library for AWS

.. versionadded:: 2015.5.0

This is a base library used by a number of AWS services.

:depends: requests
�N)�datetime�	us-east-1z
2016-11-15)ZRequestLimitExceededZInsufficientInstanceCapacityZ
InternalErrorZUnavailableZInsufficientAddressCapacityZ$InsufficientReservedInstanceCapacitygffffff@�zuse-instance-role-credentials�cCst�t�dd|��dS)az
    backoff an exponential amount of time to throttle requests
    during "API Rate Exceeded" failures as suggested by the AWS documentation here:
    https://docs.aws.amazon.com/AWSEC2/latest/APIReference/query-api-troubleshooting.html
    and also here:
    https://docs.aws.amazon.com/general/latest/gr/api-retries.html
    Failure to implement this approach results in a failure rate of >30% when using salt-cloud with
    "--parallel" when creating 50 or more instances with a fixed delay of 2 seconds.
    A failure rate of >10% is observed when using the salt-api with an asynchronous client
    specified (runner_async).
    ��N)�time�sleep�random�uniform)�attempts�r
�B/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/aws.py�sleep_exponential_backoff7srTcCszi}tdur
t|d<tjd|��ddi|td�}|jdkr7|r7tjdd	d
idditd�}|ja|jr7t|d�S|�	�|S)
an
    Get the instance metadata at the provided path
    The path argument will be prepended by http://169.254.169.254/latest/
    If using IMDSv2 with tokens required, the token will be fetched and used for subsequent requests
    (unless refresh_token_if_needed is False, in which case this will fail if tokens are required
    and no token was already cached)
    NzX-aws-ec2-metadata-tokenzhttp://169.254.169.254/latest/�httpr)�proxies�headers�timeouti�z'http://169.254.169.254/latest/api/tokenz$X-aws-ec2-metadata-token-ttl-secondsZ21600)rrrF)
�__IMDS_Token__�requests�get�AWS_METADATA_TIMEOUT�status_code�put�text�ok�get_metadata�raise_for_status)�pathZrefresh_token_if_neededr�resultZtoken_resultr
r
rrFs*
��
rc	CsLd}|dtks|dtkrwtrtt���d�krqz	td�}|j}Wntjj	tjj
fy:|d|ddfYSwz	td|���}Wntjj	tjj
fy\|d|ddfYSw|��}|da|da
|d	a|d
att
tf}n	|d|ddf}|�d�dur�|��}|�dd�t�d
|�d��t||�d�dd�}|S)aB
    Return the credentials for AWS signing.  This could be just the id and key
    specified in the provider configuration, or if the id or key is set to the
    literal string 'use-instance-role-credentials' creds will pull the instance
    role credentials from the meta data, cache them, and provide them instead.
    r
�id�key�%Y-%m-%dT%H:%M:%SZz#meta-data/iam/security-credentials/r�AccessKeyId�SecretAccessKey�Token�
Expiration�role_arnNzAssuming the role: %sr)r'�location)�
IROLE_CODE�__Expiration__r�utcnow�strftimerrr�
exceptions�	HTTPError�ConnectionError�json�__AccessKeyId__�__SecretAccessKey__�	__Token__r�copy�pop�log�info�
assumed_creds)�providerZret_credentialsrZrole�dataZprovider_shadowr
r
r�credsls>
�
���r;cCs�t��}|�d�}t|�\}}}	|��}
||
d<d|
d<d|
d<|�|
d<||
d<t|
���}ttt|
j	|���}t
j�tt
||���}
d	�|�d
�|�d
�|
�d
��}t�||tj�}t�|���}|��|
d<|	dkrq|	|
d
<|
S)z�
    Sign a query against AWS services using Signature Version 2 Signing
    Process. This is documented at:

    http://docs.aws.amazon.com/general/latest/gr/signature-version-2.html
    r"ZAWSAccessKeyId�2ZSignatureVersionZ
HmacSHA256ZSignatureMethodZ	Timestamp�Versionz
{}
{}
/
{}�utf-8Z	SignaturerZ
SecurityToken)rr+r,r;r4�sorted�keys�list�mapr�urllib�parse�	urlencode�zip�format�encode�hmac�new�hashlib�sha256�binascii�
b2a_base64�digest�strip)�method�endpoint�paramsr9�aws_api_version�timenow�	timestamp�
access_key_id�secret_access_key�token�params_with_headersr@�values�querystring�	canonicalZhashed�sigr
r
r�sig2�s.

�r_cCs:t�d�}t�t�����}t�t	��
�D]\}}|d|dkr$t	|=q|t	vr8t	|}|d|d|dfSd}|�dtj
�d	di�d
�d
d�}	tdd
|d|	|ddd�|dd|d|dd�
\}
}d|
d<tjd||
ddtd�}|jdkr~t�d|j�|��|��}
|
ddd}|t	|<|d|d|dfS)Nz[^a-z0-9A-Z+=,.@-]r&�xr#r$ZSessionTokenz
2011-06-15r�root_dirr�?�GETzsts.amazonaws.comZ
AssumeRolezd{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1", "Effect":"Allow","Action":"*","Resource":"*"}]}Z3600)r=�ActionZRoleSessionNameZRoleArn�PolicyZDurationSeconds�/�stszhttps://sts.amazonaws.com/)rSrTr:�uri�	prov_dict�productr(�
requesturlzapplication/jsonZAcceptT)rr:Zverifyri�zAssumeRole response: %sZAssumeRoleResponseZAssumeRoleResultZCredentials)�re�compiler�mktimerr+�	timetupler4�deepcopy�__AssumeCache__�items�sub�saltZconfigZget_id�sig4r�requestrrr6r7�contentrr0)rir'r(Zvalid_session_name_re�nowr!r;�c�versionZsession_namerrkrZrespr:r
r
rr8�sb
����
��
	r8�ec2rfc
%Cs
t��}
|durt|�\}}}n
t|||d�\}}}|dur!t�}|dur't}|��}|dvr3||d<t|���}t	t
|j|��}tj
�t	t||����dd�}|
�d�}|
�d�}i}t|
t�re|
��}|sntjj�|	�}||d	<||d
<||d<g}g}|dkr�||d
<t|��tjd�D]}|��}|�|�d||�����|�|�q�d�|�d}d�|�}d}d�||||||f�}d�|||df�} d�||| tjj�|�f�}!t||||�}"t�|"|!� d�t!j"��#�}#d�$||| ||#�}$|$|d<|�d|��}||fS)a_
    Sign a query against AWS services using Signature Version 4 Signing
    Process. This is documented at:

    http://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html
    http://docs.aws.amazon.com/general/latest/gr/sigv4-signed-request-examples.html
    http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
    N)r()Zs3Zssmr=�+z%20z%Y%m%dT%H%M%SZz%Y%m%dz
X-Amz-date�hostzx-amz-content-sha256rzX-Amz-security-token)r!�:�
�;zAWS4-HMAC-SHA256rf�aws4_requestr>z3{} Credential={}/{}, SignedHeaders={}, Signature={}Z
Authorization�?)%rr+r;r8�get_region_from_metadata�DEFAULT_LOCATIONr4r?r@rArBrrCrDrErF�replacer,�
isinstance�dictrt�utilsZ	hashutilsZ
sha256_digest�str�lower�appendrP�join�_sig_keyrIrJrHrKrL�	hexdigestrG)%rQrRrSrirTr(rjrhrkr:rr'Zpayload_hashrUrWrXrYrZr@r[r\ZamzdateZ	datestampZnew_headersZa_canonical_headersZa_signed_headers�headerZlower_headerZcanonical_headersZsigned_headers�	algorithmZcanonical_requestZcredential_scopeZstring_to_signZsigning_keyZ	signatureZauthorization_headerr
r
rrus��



���
���rucCst�||�d�tj���S)z�
    Key derivation functions. See:

    http://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html#signature-v4-examples-python
    r>)rIrJrHrKrLrO)r!�msgr
r
r�_signvsr�cCsFtd|�d�|�}|rt||�}t||�}nt||�}t|d�}|S)z�
    Get a signature key. See:

    http://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html#signature-v4-examples-python
    ZAWS4r>r�)r�rH)r!Z
date_stampZ
regionNameZserviceNameZkDateZkRegionZkServiceZkSigningr
r
rr�s


r�Fr<c 
Cs�|duri}|duri}|�dd|	f�}|�di�}|dur=|�|di��|	i�}
|
r<tt|
����d}|�||	�}n
|�|i��|	i�}
|
�dd�}|sTt||
�}|dur�|so|
�d|	�d	|�d	|���}d
|�d�}n#tj�|�j}|dkr�d
�|�}t	�
|�|dur�d|i|fSd|iSt	�d|�d}|
�d|
�|	�d�t��}|
�dd�s�|�|i��di��di�|
d<|�|i��di��di�|
d<|
dkr�t
||||
|||	|d�\}}i}n
t||||
|�}i}d}|tk�r�t	�d|�t	�d|�ztj|||td�}t	�d|j�t	�d|j�|��Wn�tjj�y�}zet�|jj�}t�|�}|�di��di��d d�}|tk�rg|�rg|tv�rg|d7}t	�
d!|jj|||�t|�WYd}~q�t	�
d"|jj||�|du�r�d|i|fWYd}~Sd|iWYd}~Sd}~wwt	�
d"|jj||�|du�r�d|i|fSd|iSt�|j�}|d}|du�r�|}|�r�t |�D]\}}|j!�"d#�}|d|k�r�||}�q�g}|D]}|�#t�|���q�|du�r�||fS|S)$a�
    Perform a query against AWS services using Signature Version 2 Signing
    Process. This is documented at:

    http://docs.aws.amazon.com/general/latest/gr/signature-version-2.html

    Regions and endpoints are documented at:

    http://docs.aws.amazon.com/general/latest/gr/rande.html

    Default ``product`` is ``ec2``. Valid ``product`` names are:

    .. code-block:: yaml

        - autoscaling (Auto Scaling)
        - cloudformation (CloudFormation)
        - ec2 (Elastic Compute Cloud)
        - elasticache (ElastiCache)
        - elasticbeanstalk (Elastic BeanStalk)
        - elasticloadbalancing (Elastic Load Balancing)
        - elasticmapreduce (Elastic MapReduce)
        - iam (Identity and Access Management)
        - importexport (Import/Export)
        - monitoring (CloudWatch)
        - rds (Relational Database Service)
        - simpledb (SimpleDB)
        - sns (Simple Notification Service)
        - sqs (Simple Queue Service)
    N�function�	providersrr�service_urlz
amazonaws.comrR�.zhttps://rfrzqCould not find a valid endpoint in the requesturl: {}. Looking for something like https://some.aws.endpoint/?argsT�errorzUsing AWS endpoint: %srcrTZ_api_versionr r{r!�4)rkzAWS Request: %szAWS Request Parameters: %s)rrSrzAWS Response Status Code: %szAWS Response Text: %sZErrors�ErrorZCodezFAWS Response Status Code and Error: [%s %s] %s; Attempts remaining: %sz.AWS Response Status Code and Error: [%s %s] %s�})$rrAr@�get_locationrCrD�urlparse�netlocrGr6r��debug�DEFAULT_AWS_API_VERSIONrur_�AWS_MAX_RETRIESZtracerrrrrr-r.�ETZ
fromstring�responserw�xmlZto_dict�AWS_RETRY_CODESr�	enumerate�tag�splitr�) rSZsetnamerkr(Z
return_urlZreturn_root�optsr9rRrjZsigverr�r�riZdriverr�Zendpoint_errrQrTrrZrr�exc�rootr:Zerr_coderr�idx�item�comps�retr
r
r�query�s�*�
�
�  
�

�
��
���

�
r�c	Cs�tdkrt�d�dStdkrtSztd�}Wntjjy,tjddd�daYdSwz|��d	}|atWSt	t
fyIt�d
�YdSw)zh
    Try to get region from instance identity document and cache it

    .. versionadded:: 2015.5.6
    zdo-not-get-from-metadatazDPreviously failed to get AWS region from metadata. Not trying again.Nrz"dynamic/instance-identity/documentz0Failed to get AWS region from instance metadata.T)�exc_info�regionz-Failed to decode JSON from instance metadata.)�__Location__r6r�rrr-ZRequestException�warningr0�
ValueError�KeyError)rr�r
r
rr�Is,��
�r�cCsN|duri}|�d�}|dur|dur|�d�}|durt�}|dur%t}|S)z�
    Return the region to use, in this order:
        opts['location']
        provider['location']
        get_region_from_metadata()
        DEFAULT_LOCATION
    Nr()rr�r�)r�r9r�r
r
rr�ns

r�)T)N)NNNNFFNNNr{r<)NN)3�__doc__rMr4rKrI�loggingr
rlr�urllib.parserCZxml.etree.ElementTreeZetreeZElementTreer�rrZsalt.configrtZsalt.utils.hashutilsZsalt.utils.xmlutilr�Zxmlutilr��	getLogger�__name__r6r�r�r�rr�r)r1r2r3r*r�rqrrrr;r_r8rur�r�r�r�r�r
r
r
r�<module>s|


&4
(B
�q	
�;%