Skip to content

Commit

Permalink
issues #592 and #506
Browse files Browse the repository at this point in the history
* issues #592 and #506
* making black
  • Loading branch information
eamonnfaherty committed Nov 18, 2022
1 parent 5cc99f8 commit 3f8d511
Show file tree
Hide file tree
Showing 4 changed files with 75 additions and 52 deletions.
2 changes: 1 addition & 1 deletion pyproject.toml
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@

[tool.poetry]
name = "aws-service-catalog-puppet"
version = "0.207.0"
version = "0.208.0"
description = "Making it easier to deploy ServiceCatalog products"
classifiers = ["Development Status :: 5 - Production/Stable", "Intended Audience :: Developers", "Programming Language :: Python :: 3", "License :: OSI Approved :: Apache Software License", "Operating System :: OS Independent", "Natural Language :: English"]
homepage = "https://service-catalog-tools-workshop.com/"
Expand Down
19 changes: 0 additions & 19 deletions servicecatalog_puppet/templates/associations.template.yaml.j2

This file was deleted.

Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@
from servicecatalog_puppet import config
from servicecatalog_puppet import utils
from servicecatalog_puppet.workflow.dependencies import tasks
import troposphere as t
from troposphere import s3, servicecatalog


class CreateAssociationsForSpokeLocalPortfolioTask(tasks.TaskWithReference):
Expand Down Expand Up @@ -35,51 +37,91 @@ def run(self):
)
portfolio_id = portfolio_details.get("Id")

used_wildcard = "*" in "".join(self.associations)
haystack = "".join(self.associations)
used_wildcard = "*" in haystack
used_roles = ":role/" in haystack
used_users = ":user/" in haystack
used_groups = ":group/" in haystack

if used_wildcard:
roles = list()
users = list()
groups = list()
with self.spoke_regional_client("iam") as iam:
paginator = iam.get_paginator("list_roles")
for page in paginator.paginate():
roles += page.get("Roles", [])
if used_roles:
paginator = iam.get_paginator("list_roles")
for page in paginator.paginate():
roles += page.get("Roles", [])
if used_users:
paginator = iam.get_paginator("list_users")
for page in paginator.paginate():
users += page.get("Users", [])
if used_groups:
paginator = iam.get_paginator("list_groups")
for page in paginator.paginate():
groups += page.get("Groups", [])

associations_to_use = list()
for association in self.associations:
if "*" in association:
association_as_a_regex = re.escape(
association.replace("${AWS::AccountId}", self.account_id)
).replace("\\*", "(.*)")
for role_object in roles:
role = role_object.get("Arn")
if re.match(association_as_a_regex, role):
associations_to_use.append(role)
if ":role/" in association:
for role_object in roles:
role = role_object.get("Arn")
if re.match(association_as_a_regex, role):
associations_to_use.append(role)
if ":user/" in association:
for user_object in users:
user = user_object.get("Arn")
if re.match(association_as_a_regex, user):
associations_to_use.append(user)
if ":group/" in association:
for group_object in groups:
group = group_object.get("Arn")
if re.match(association_as_a_regex, group):
associations_to_use.append(group)
else:
associations_to_use.append(association)
else:
associations_to_use = self.associations

with self.spoke_regional_client("cloudformation") as cloudformation:
template = config.env.get_template("associations.template.yaml.j2").render(
portfolio={
"DisplayName": self.portfolio,
"Associations": associations_to_use,
},
portfolio_id=portfolio_id,
)
stack_name = f"associations-for-{utils.slugify_for_cloudformation_stack_name(self.spoke_local_portfolio_name)}"
cloudformation.create_or_update(
StackName=stack_name,
TemplateBody=template,
NotificationARNs=[
f"arn:{config.get_partition()}:sns:{self.region}:{self.puppet_account_id}:servicecatalog-puppet-cloudformation-regional-events"
]
if self.should_use_sns
else [],
ShouldDeleteRollbackComplete=self.should_delete_rollback_complete_stacks,
Tags=self.initialiser_stack_tags,
)
result = cloudformation.describe_stacks(StackName=stack_name,).get(
"Stacks"
)[0]
self.write_empty_output()
v1_stack_name = f"associations-for-{utils.slugify_for_cloudformation_stack_name(self.spoke_local_portfolio_name)}"
cloudformation.ensure_deleted(StackName=v1_stack_name)

v2_stack_name = f"associations-v2-for-{utils.slugify_for_cloudformation_stack_name(self.spoke_local_portfolio_name)}"
if associations_to_use:
tpl = t.Template()
tpl.description = f"Associations for {self.portfolio}"
for association_to_use in associations_to_use:
logical_name = "".join(
filter(
str.isalnum,
f"{portfolio_id}{association_to_use.split(':')[-1]}",
)
)
tpl.add_resource(
servicecatalog.PortfolioPrincipalAssociation(
logical_name,
PortfolioId=portfolio_id,
PrincipalARN=association_to_use,
PrincipalType="IAM",
)
)
template = tpl.to_yaml()
cloudformation.create_or_update(
StackName=v2_stack_name,
TemplateBody=template,
NotificationARNs=[
f"arn:{config.get_partition()}:sns:{self.region}:{self.puppet_account_id}:servicecatalog-puppet-cloudformation-regional-events"
]
if self.should_use_sns
else [],
ShouldDeleteRollbackComplete=self.should_delete_rollback_complete_stacks,
Tags=self.initialiser_stack_tags,
)
else:
cloudformation.ensure_deleted(StackName=v2_stack_name)
self.write_empty_output()
2 changes: 1 addition & 1 deletion setup.py
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@

setup_kwargs = {
'name': 'aws-service-catalog-puppet',
'version': '0.207.0',
'version': '0.208.0',
'description': 'Making it easier to deploy ServiceCatalog products',
'long_description': '# aws-service-catalog-puppet\n\n![logo](./docs/logo.png) \n\n## Badges\n\n[![codecov](https://codecov.io/gh/awslabs/aws-service-catalog-puppet/branch/master/graph/badge.svg?token=e8M7mdsmy0)](https://codecov.io/gh/awslabs/aws-service-catalog-puppet)\n\n\n## What is it?\nThis is a python3 framework that makes it easier to share multi region AWS Service Catalog portfolios and makes it \npossible to provision products into accounts declaratively using a metadata based rules engine.\n\nWith this framework you define your accounts in a YAML file. You give each account a set of tags, a default region and \na set of enabled regions.\n\nOnce you have done this you can define portfolios should be shared with each set of accounts using the tags and you \ncan specify which regions the shares occur in.\n\nIn addition to this, you can also define products that should be provisioned into accounts using the same tag based \napproach. The framework will assume role into the target account and provision the product on your behalf.\n\n\n## Getting started\n\nYou can read the [installation how to](https://service-catalog-tools-workshop.com/30-how-tos/10-installation/30-service-catalog-puppet.html)\nor you can read through the [every day use](https://service-catalog-tools-workshop.com/30-how-tos/50-every-day-use.html)\nguides.\n\nYou can read the [documentation](https://aws-service-catalog-puppet.readthedocs.io/en/latest/) to understand the inner \nworkings. \n\n\n## Going further\n\nThe framework is one of a pair. The other is [aws-service-catalog-factory](https://github.com/awslabs/aws-service-catalog-factory).\nWith Service Catalog Factory you can create pipelines that deploy multi region portfolios very easily. \n\n## License\n\nThis library is licensed under the Apache 2.0 License. \n \n',
'author': 'Eamonn Faherty',
Expand Down

0 comments on commit 3f8d511

Please sign in to comment.