End-to-end renew of access keys for a specific profile in local awscli config
359008
def main(operation, profile, auto, debug, user_name=''):
    
    if user_name:
        logger.info('user_name parameter given (%s) as surrogate' % user_name)
    try:
        if operation in VALID_INSTALL:
            print(operation)
        elif operation == 'list':
            print(operation)
            return True
        elif not operation:
            msg_accent = (Colors.BOLD + 'list' + Colors.RESET + ' | ' + Colors.BOLD + 'up' + Colors.RESET)
            msg = """You must provide a valid OPERATION for --operation parameter:

                    --operation { """ + msg_accent + """ }
            """
            stdout_message(msg)
            logger.warning('%s: No valid operation provided. Exit' % (inspect.stack()[0][3]))
            sys.exit(exit_codes['E_MISC']['Code'])
        else:
            msg = 'Unknown operation. Exit'
            stdout_message(msg)
            logger.warning('%s: %s' % (msg, inspect.stack()[0][3]))
            sys.exit(exit_codes['E_MISC']['Code'])
    except KeyError as e:
        logger.critical(
            '%s: Cannot find Key %s' %
            (inspect.stack()[0][3], str(e)))
        return False
    except OSError as e:
        logger.critical(
            '%s: problem writing to file %s. Error %s' %
            (inspect.stack()[0][3], output_file, str(e)))
        return False
    except Exception as e:
        logger.critical(
            '%s: Unknown error. Error %s' %
            (inspect.stack()[0][3], str(e)))
        raise e
1262839
def SetCredentials(api_key,api_passwd):
	""""""
	global V1_API_KEY
	global V1_API_PASSWD
	global _V1_ENABLED
	_V1_ENABLED = True
	V1_API_KEY = api_key
	V1_API_PASSWD = api_passwd
618810
def save_existing_iam_env_vars(self):
        """"""
        for i in ['AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY',
                  'AWS_SESSION_TOKEN']:
            if i in self.env_vars:
                self.env_vars['OLD_' + i] = self.env_vars[i]
999945
def run_profile(self, profile, names, vm_overrides=None):
        '''
        
        '''
        if profile not in self.opts['profiles']:
            msg = 'Profile {0} is not defined'.format(profile)
            log.error(msg)
            return {'Error': msg}

        ret = {}
        if not vm_overrides:
            vm_overrides = {}

        try:
            with salt.utils.files.fopen(self.opts['conf_file'], 'r') as mcc:
                main_cloud_config = salt.utils.yaml.safe_load(mcc)
            if not main_cloud_config:
                main_cloud_config = {}
        except KeyError:
            main_cloud_config = {}
        except IOError:
            main_cloud_config = {}

        if main_cloud_config is None:
            main_cloud_config = {}

        mapped_providers = self.map_providers_parallel()
        profile_details = self.opts['profiles'][profile]
        vms = {}
        for prov, val in six.iteritems(mapped_providers):
            prov_name = next(iter(val))
            for node in mapped_providers[prov][prov_name]:
                vms[node] = mapped_providers[prov][prov_name][node]
                vms[node]['provider'] = prov
                vms[node]['driver'] = prov_name
        alias, driver = profile_details['provider'].split(':')

        provider_details = self.opts['providers'][alias][driver].copy()
        del provider_details['profiles']

        for name in names:
            if name in vms:
                prov = vms[name]['provider']
                driv = vms[name]['driver']
                msg = '{0} already exists under {1}:{2}'.format(
                    name, prov, driv
                )
                log.error(msg)
                ret[name] = {'Error': msg}
                continue

            vm_ = self.vm_config(
                name,
                main_cloud_config,
                provider_details,
                profile_details,
                vm_overrides,
            )
            if self.opts['parallel']:
                process = multiprocessing.Process(
                    target=self.create,
                    args=(vm_,)
                )
                process.start()
                ret[name] = {
                    'Provisioning': 'VM being provisioned in parallel. '
                                    'PID: {0}'.format(process.pid)
                }
                continue

            try:
                # No need to inject __active_provider_name__ into the context
                # here because self.create takes care of that
                ret[name] = self.create(vm_)
                if not ret[name]:
                    ret[name] = {'Error': 'Failed to deploy VM'}
                    if len(names) == 1:
                        raise SaltCloudSystemExit('Failed to deploy VM')
                    continue
                if self.opts.get('show_deploy_args', False) is False:
                    ret[name].pop('deploy_kwargs', None)
            except (SaltCloudSystemExit, SaltCloudConfigError) as exc:
                if len(names) == 1:
                    raise
                ret[name] = {'Error': str(exc)}

        return ret
355785
def _auth(profile=None, **kwargs):
    '''
    
    '''
    keystone_api_args = None
    if kwargs is not None:
        if kwargs.get('keystone_api_args') is not None:
            keystone_api_args = kwargs['keystone_api_args']

    if profile:
        credentials = __salt__['config.option'](profile)
        user = credentials['keystone.user']
        password = credentials['keystone.password']
        tenant = credentials['keystone.tenant']
        auth_url = credentials['keystone.auth_url']
        region_name = credentials.get('keystone.region_name', None)
        api_key = credentials.get('keystone.api_key', None)
        os_auth_system = credentials.get('keystone.os_auth_system', None)
        use_keystoneauth = credentials.get('keystone.use_keystoneauth', False)
    else:
        user = __salt__['config.option']('keystone.user')
        password = __salt__['config.option']('keystone.password')
        tenant = __salt__['config.option']('keystone.tenant')
        auth_url = __salt__['config.option']('keystone.auth_url')
        region_name = __salt__['config.option']('keystone.region_name')
        api_key = __salt__['config.option']('keystone.api_key')
        os_auth_system = __salt__['config.option']('keystone.os_auth_system')
        use_keystoneauth = __salt__['config.option']('keystone.use_keystoneauth')

    # Override pillar settings with settings provided by module argument
    if keystone_api_args:
        user = keystone_api_args.get('user', user)
        password = keystone_api_args.get('password', password)
        tenant = keystone_api_args.get('tenant', tenant)
        auth_url = keystone_api_args.get('auth_url', auth_url)
        region_name = keystone_api_args.get('region_name', region_name)
        api_key = keystone_api_args.get('api_key', api_key)
        os_auth_system = keystone_api_args.get('os_auth_system', os_auth_system)
        use_keystoneauth = keystone_api_args.get('use_keystoneauth', use_keystoneauth)

    if use_keystoneauth is True:
        if profile:
            credentials = __salt__['config.option'](profile)
            project_id = credentials.get('keystone.project_id', None)
            project_name = credentials.get('keystone.project_name', None)
            user_domain_name = credentials.get('keystone.user_domain_name', None)
            project_domain_name = credentials.get('keystone.project_domain_name', None)
            verify = credentials.get('keystone.verify', None)
        else:
            project_id = __salt__['config.option']('keystone.project_id')
            project_name = __salt__['config.option']('keystone.project_name')
            user_domain_name = __salt__['config.option']('keystone.user_domain_name')
            project_domain_name = __salt__['config.option']('keystone.project_domain_name')
            verify = __salt__['config.option']('keystone.verify')

        # Override pillar settings with settings provided by module argument
        if keystone_api_args:
            project_id = keystone_api_args.get('project_id', project_id)
            project_name = keystone_api_args.get('project_name', project_name)
            user_domain_name = keystone_api_args.get('user_domain_name', user_domain_name)
            project_domain_name = keystone_api_args.get('project_domain_name', project_domain_name)
            verify = keystone_api_args.get('verify', verify)

        send_kwargs = {
            'username': user,
            'password': password,
            'project_id': project_id,
            'auth_url': auth_url,
            'region_name': region_name,
            'use_keystoneauth': use_keystoneauth,
            'verify': verify,
            'project_name': project_name,
            'project_domain_name': project_domain_name,
            'user_domain_name': user_domain_name
        }
    else:
        send_kwargs = {
            'username': user,
            'password': password,
            'api_key': api_key,
            'project_id': tenant,
            'auth_url': auth_url,
            'region_name': region_name,
            'os_auth_plugin': os_auth_system
        }
    log.debug('SEND_KWARGS: %s', send_kwargs)
    return suon.SaltNova(**send_kwargs)
313566
def update(name, launch_config_name, availability_zones, min_size, max_size,
           desired_capacity=None, load_balancers=None, default_cooldown=None,
           health_check_type=None, health_check_period=None,
           placement_group=None, vpc_zone_identifier=None, tags=None,
           termination_policies=None, suspended_processes=None,
           scaling_policies=None, scheduled_actions=None,
           notification_arn=None, notification_types=None,
           region=None, key=None, keyid=None, profile=None):
    '''
    
    '''

    conn = _get_conn(region=region, key=key, keyid=keyid, profile=profile)
    conn3 = _get_conn_autoscaling_boto3(region=region, key=key, keyid=keyid,
                                        profile=profile)
    if not conn:
        return False, "failed to connect to AWS"
    if isinstance(availability_zones, six.string_types):
        availability_zones = salt.utils.json.loads(availability_zones)
    if isinstance(load_balancers, six.string_types):
        load_balancers = salt.utils.json.loads(load_balancers)
    if isinstance(vpc_zone_identifier, six.string_types):
        vpc_zone_identifier = salt.utils.json.loads(vpc_zone_identifier)
    if isinstance(tags, six.string_types):
        tags = salt.utils.json.loads(tags)
    if isinstance(termination_policies, six.string_types):
        termination_policies = salt.utils.json.loads(termination_policies)
    if isinstance(suspended_processes, six.string_types):
        suspended_processes = salt.utils.json.loads(suspended_processes)
    if isinstance(scheduled_actions, six.string_types):
        scheduled_actions = salt.utils.json.loads(scheduled_actions)

    # Massage our tagset into  add / remove lists
    # Use a boto3 call here b/c the boto2 call doeesn't implement filters
    current_tags = conn3.describe_tags(Filters=[{'Name': 'auto-scaling-group',
                                      'Values': [name]}]).get('Tags', [])
    current_tags = [{'key': t['Key'],
                     'value': t['Value'],
                     'resource_id': t['ResourceId'],
                     'propagate_at_launch': t.get('PropagateAtLaunch', False)}
                          for t in current_tags]
    add_tags = []
    desired_tags = []
    if tags:
        tags = __utils__['boto3.ordered'](tags)
        for tag in tags:
            try:
                key = tag.get('key')
            except KeyError:
                log.error('Tag missing key.')
                return False, "Tag {0} missing key".format(tag)
            try:
                value = tag.get('value')
            except KeyError:
                log.error('Tag missing value.')
                return False, "Tag {0} missing value".format(tag)
            propagate_at_launch = tag.get('propagate_at_launch', False)
            _tag = {'key': key,
                    'value': value,
                    'resource_id': name,
                    'propagate_at_launch': propagate_at_launch}
            if _tag not in current_tags:
                add_tags.append(_tag)
            desired_tags.append(_tag)
    delete_tags = [t for t in current_tags if t not in desired_tags]

    retries = 30
    while True:
        try:
            _asg = autoscale.AutoScalingGroup(
                connection=conn,
                name=name, launch_config=launch_config_name,
                availability_zones=availability_zones,
                min_size=min_size, max_size=max_size,
                desired_capacity=desired_capacity, load_balancers=load_balancers,
                default_cooldown=default_cooldown,
                health_check_type=health_check_type,
                health_check_period=health_check_period,
                placement_group=placement_group, tags=add_tags,
                vpc_zone_identifier=vpc_zone_identifier,
                termination_policies=termination_policies)
            if notification_arn and notification_types:
                conn.put_notification_configuration(_asg, notification_arn, notification_types)
            _asg.update()
            # Seems the update call doesn't handle tags, so we'll need to update
            # that separately.
            if add_tags:
                log.debug('Adding/updating tags from ASG: %s', add_tags)
                conn.create_or_update_tags([autoscale.Tag(**t) for t in add_tags])
            if delete_tags:
                log.debug('Deleting tags from ASG: %s', delete_tags)
                conn.delete_tags([autoscale.Tag(**t) for t in delete_tags])
            # update doesn't handle suspended_processes either
            # Resume all processes
            _asg.resume_processes()
            # suspend any that are specified.  Note that the boto default of empty
            # list suspends all; don't do that.
            if suspended_processes:
                _asg.suspend_processes(suspended_processes)
            log.info('Updated ASG %s', name)
            # ### scaling policies
            # delete all policies, then recreate them
            for policy in conn.get_all_policies(as_group=name):
                conn.delete_policy(policy.name, autoscale_group=name)
            _create_scaling_policies(conn, name, scaling_policies)
            # ### scheduled actions
            # delete all scheduled actions, then recreate them
            for scheduled_action in conn.get_all_scheduled_actions(as_group=name):
                conn.delete_scheduled_action(
                    scheduled_action.name, autoscale_group=name
                )
            _create_scheduled_actions(conn, name, scheduled_actions)
            return True, ''
        except boto.exception.BotoServerError as e:
            if retries and e.code == 'Throttling':
                log.debug('Throttled by AWS API, retrying in 5 seconds...')
                time.sleep(5)
                retries -= 1
                continue
            log.error(e)
            msg = 'Failed to update ASG {0}'.format(name)
            log.error(msg)
            return False, six.text_type(e)
266322
def load_credentials(self, boto_session=None, profile_name=None):
        
        # Automatically load credentials from config or environment
        if not boto_session:

            # If provided, use the supplied profile name.
            if profile_name:
                self.boto_session = boto3.Session(profile_name=profile_name, region_name=self.aws_region)
            elif os.environ.get('AWS_ACCESS_KEY_ID') and os.environ.get('AWS_SECRET_ACCESS_KEY'):
                region_name = os.environ.get('AWS_DEFAULT_REGION') or self.aws_region
                session_kw = {
                    "aws_access_key_id": os.environ.get('AWS_ACCESS_KEY_ID'),
                    "aws_secret_access_key": os.environ.get('AWS_SECRET_ACCESS_KEY'),
                    "region_name": region_name,
                }

                # If we're executing in a role, AWS_SESSION_TOKEN will be present, too.
                if os.environ.get("AWS_SESSION_TOKEN"):
                    session_kw["aws_session_token"] = os.environ.get("AWS_SESSION_TOKEN")

                self.boto_session = boto3.Session(**session_kw)
            else:
                self.boto_session = boto3.Session(region_name=self.aws_region)

            logger.debug("Loaded boto session from config: %s", boto_session)
        else:
            logger.debug("Using provided boto session: %s", boto_session)
            self.boto_session = boto_session

        # use provided session's region in case it differs
        self.aws_region = self.boto_session.region_name

        if self.boto_session.region_name not in LAMBDA_REGIONS:
            print("Warning! AWS Lambda may not be available in this AWS Region!")

        if self.boto_session.region_name not in API_GATEWAY_REGIONS:
            print("Warning! AWS API Gateway may not be available in this AWS Region!")
436199
def suspend(instance_id, profile=None, **kwargs):
    '''
    

    '''
    conn = _auth(profile, **kwargs)
    return conn.suspend(instance_id)
1019992
def modify_network_interface_attribute(
        name=None, network_interface_id=None, attr=None,
        value=None, region=None, key=None, keyid=None, profile=None):
    '''
    
    '''
    if not (name or network_interface_id):
        raise SaltInvocationError(
            'Either name or network_interface_id must be provided.'
        )
    if attr is None and value is None:
        raise SaltInvocationError(
            'attr and value must be provided.'
        )
    r = {}
    conn = _get_conn(region=region, key=key, keyid=keyid, profile=profile)
    result = _get_network_interface(conn, name, network_interface_id)
    if 'error' in result:
        return result
    eni = result['result']
    info = _describe_network_interface(eni)
    network_interface_id = info['id']
    # munge attr into what the API requires
    if attr == 'groups':
        _attr = 'groupSet'
    elif attr == 'source_dest_check':
        _attr = 'sourceDestCheck'
    elif attr == 'delete_on_termination':
        _attr = 'deleteOnTermination'
    else:
        _attr = attr
    _value = value
    if info.get('vpc_id') and _attr == 'groupSet':
        _value = __salt__['boto_secgroup.convert_to_group_ids'](
            value, vpc_id=info.get('vpc_id'), region=region, key=key,
            keyid=keyid, profile=profile
        )
        if not _value:
            r['error'] = {
                'message': ('Security groups do not map to valid security'
                            ' group ids')
            }
            return r
    _attachment_id = None
    if _attr == 'deleteOnTermination':
        try:
            _attachment_id = info['attachment']['id']
        except KeyError:
            r['error'] = {
                'message': ('No attachment id found for this ENI. The ENI must'
                            ' be attached before delete_on_termination can be'
                            ' modified')
            }
            return r
    try:
        r['result'] = conn.modify_network_interface_attribute(
            network_interface_id, _attr, _value, attachment_id=_attachment_id
        )
    except boto.exception.EC2ResponseError as e:
        r['error'] = __utils__['boto.get_error'](e)
    return r
76628
def rotate(args, credentials):
    """"""
    current_access_key_id = credentials.get(
        args.identity_profile, 'aws_access_key_id')

    # create new sessions using the MFA credentials
    session, session3, err = make_session(args.target_profile)
    if err:
        return err
    iam = session3.resource('iam')

    # find the AccessKey corresponding to the identity profile and delete it.
    current_access_key = next((key for key
                               in iam.CurrentUser().access_keys.all()
                               if key.access_key_id == current_access_key_id))
    current_access_key.delete()

    # create the new access key pair
    iam_service = session3.client('iam')
    new_access_key_pair = iam_service.create_access_key()["AccessKey"]

    print("Rotating from %s to %s." % (current_access_key.access_key_id,
                                       new_access_key_pair['AccessKeyId']),
          file=sys.stderr)
    update_credentials_file(args.aws_credentials,
                            args.identity_profile,
                            args.identity_profile,
                            credentials,
                            new_access_key_pair)
    print("%s profile updated." % args.identity_profile, file=sys.stderr)

    return OK
566464
def ls(ctx, name, list_formatted):
    """"""
    session = create_session(ctx.obj['AWS_PROFILE_NAME'])
    ec2 = session.resource('ec2')
    if name == '*':
        instances = ec2.instances.filter()
    else:
        condition = {'Name': 'tag:Name', 'Values': [name]}
        instances = ec2.instances.filter(Filters=[condition])
    out = format_output(instances, list_formatted)
    click.echo('\n'.join(out))
862587
def temporary_url(expires_at = Time.now + 3600)
      signature = Signature.generate_temporary_url_signature(:bucket => name,
                                                             :resource => key,
                                                             :expires_at => expires_at,
                                                             :secret_access_key => secret_access_key)

      "#{url}?AWSAccessKeyId=#{self.bucket.service.access_key_id}&Expires=#{expires_at.to_i.to_s}&Signature=#{signature}"
    end
548135
def _auth(profile=None, api_version=1, **connection_args):
    '''
    
    '''

    if profile:
        prefix = profile + ':keystone.'
    else:
        prefix = 'keystone.'

    def get(key, default=None):
        '''
        Checks connection_args, then salt-minion config,
        falls back to specified default value.
        '''
        return connection_args.get('connection_' + key,
                                   __salt__['config.get'](prefix + key, default))

    user = get('user', 'admin')
    password = get('password', None)
    tenant = get('tenant', 'admin')
    tenant_id = get('tenant_id')
    auth_url = get('auth_url', 'http://127.0.0.1:35357/v2.0')
    insecure = get('insecure', False)
    admin_token = get('token')
    region_name = get('region_name', None)

    if admin_token and api_version != 1 and not password:
        # If we had a password we could just
        # ignore the admin-token and move on...
        raise SaltInvocationError('Only can use keystone admin token ' +
                                  'with Heat API v1')
    elif password:
        # Can't use the admin-token anyway
        kwargs = {'username': user,
                  'password': password,
                  'tenant_id': tenant_id,
                  'auth_url': auth_url,
                  'region_name': region_name,
                  'tenant_name': tenant}
        # 'insecure' keyword not supported by all v2.0 keystone clients
        #   this ensures it's only passed in when defined
        if insecure:
            kwargs['insecure'] = True
    elif api_version == 1 and admin_token:
        kwargs = {'token': admin_token,
                  'auth_url': auth_url}
    else:
        raise SaltInvocationError('No credentials to authenticate with.')

    token = __salt__['keystone.token_get'](profile)
    kwargs['token'] = token['id']
    # This doesn't realy prevent the password to show up
    # in the minion log as keystoneclient.session is
    # logging it anyway when in debug-mode
    kwargs.pop('password')
    try:
        heat_endpoint = __salt__['keystone.endpoint_get']('heat', profile)['url']
    except KeyError:
        heat_endpoint = __salt__['keystone.endpoint_get']('heat', profile)['publicurl']
    heat_endpoint = heat_endpoint % token
    log.debug('Calling heatclient.client.Client(%s, %s, **%s)',
              api_version, heat_endpoint, kwargs)
    # may raise exc.HTTPUnauthorized, exc.HTTPNotFound
    # but we deal with those elsewhere
    return heatclient.client.Client(api_version, endpoint=heat_endpoint, **kwargs)
731865
def get_arn(name, region=None, key=None, keyid=None, profile=None):
    '''
    
    '''
    if name.startswith('arn:aws:sns:'):
        return name

    account_id = __salt__['boto_iam.get_account_id'](
        region=region, key=key, keyid=keyid, profile=profile
    )
    return 'arn:aws:sns:{0}:{1}:{2}'.format(_get_region(region, profile),
                                            account_id, name)
219036
def restore_existing_iam_env_vars(self):
        """"""
        for i in ['AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY',
                  'AWS_SESSION_TOKEN']:
            if 'OLD_' + i in self.env_vars:
                self.env_vars[i] = self.env_vars['OLD_' + i]
            elif i in self.env_vars:
                self.env_vars.pop(i)
314365
def boto_fix_security_token_in_profile(self, connect_args):
        '''  '''
        profile = 'profile ' + self.boto_profile
        if boto.config.has_option(profile, 'aws_security_token'):
            connect_args['security_token'] = boto.config.get(profile, 'aws_security_token')
        return connect_args
35188
def _auth(profile=None):
    '''
    
    '''
    if profile:
        credentials = __salt__['config.option'](profile)
        user = credentials['keystone.user']
        password = credentials.get('keystone.password', None)
        tenant = credentials['keystone.tenant']
        auth_url = credentials['keystone.auth_url']
        auth_version = credentials.get('keystone.auth_version', 2)
        region_name = credentials.get('keystone.region_name', None)
        api_key = credentials.get('keystone.api_key', None)
        os_auth_system = credentials.get('keystone.os_auth_system', None)
    else:
        user = __salt__['config.option']('keystone.user')
        password = __salt__['config.option']('keystone.password', None)
        tenant = __salt__['config.option']('keystone.tenant')
        auth_url = __salt__['config.option']('keystone.auth_url')
        auth_version = __salt__['config.option']('keystone.auth_version', 2)
        region_name = __salt__['config.option']('keystone.region_name')
        api_key = __salt__['config.option']('keystone.api_key')
        os_auth_system = __salt__['config.option']('keystone.os_auth_system')
    kwargs = {
        'user': user,
        'password': password,
        'key': api_key,
        'tenant_name': tenant,
        'auth_url': auth_url,
        'auth_version': auth_version,
        'region_name': region_name
    }

    return suos.SaltSwift(**kwargs)