Class: Putpaws::Iam::GrantCommand

Inherits:
Object
  • Object
show all
Defined in:
lib/putpaws/iam/grant_command.rb

Overview

Resolves operator managed policies idempotently. Policy names are derived from the profile name (service-operator-profile), so re-running converges to CREATE / UPDATE (new policy version) / SKIP instead of piling up policies. The group -> IAM action mapping lives here in code: when putpaws commands evolve, the next iam:grant surfaces the permission diff as an UPDATE.

Constant Summary collapse

GROUPS = 
%w[attach shell deploy logs codebuild scheduler]

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(app:, account_id: nil, iam_client: nil, sts_client: nil) ⇒ GrantCommand

Returns a new instance of GrantCommand.



17
18
19
20
21
22
 
# File 'lib/putpaws/iam/grant_command.rb', line 17

def initialize(app:, account_id: nil, iam_client: nil, sts_client: nil)
  @app = app
  @account_id = 
  @iam_client = iam_client
  @sts_client = sts_client
end

Instance Attribute Details

#app ⇒ Object (readonly)

Returns the value of attribute app.



16
17
18
 
# File 'lib/putpaws/iam/grant_command.rb', line 16

def app
  @app
end

Instance Method Details

#account_id ⇒ Object 



35
36
37
 
# File 'lib/putpaws/iam/grant_command.rb', line 35

def 
  @account_id ||= sts_client.get_caller_identity.
end

#apply!(profile) ⇒ Object 



79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
 
# File 'lib/putpaws/iam/grant_command.rb', line 79

def apply!(profile)
  doc = JSON.generate(build_policy_document(profile))
  if current_document(profile).nil?
    iam_client.create_policy(
      policy_name: policy_name(profile),
      policy_document: doc,
      description: "putpaws operator policy for #{app.name} (profile: #{profile.name})"
    )
  else
    prune_versions!(profile)
    iam_client.create_policy_version(
      policy_arn: policy_arn(profile),
      policy_document: doc,
      set_as_default: true
    )
  end
  policy_arn(profile)
end

#build_policy_document(profile) ⇒ Object 



55
56
57
58
59
 
# File 'lib/putpaws/iam/grant_command.rb', line 55

def build_policy_document(profile)
  statements = profile.groups.flat_map{|g| statements_for(g.to_s)}
  statements += (profile.extra_statements || [])
  {Version: '2012-10-17', Statement: statements}
end

#cluster_arn ⇒ Object 



43
44
45
 
# File 'lib/putpaws/iam/grant_command.rb', line 43

def cluster_arn
  "arn:aws:ecs:#{region}:#{}:cluster/#{app.cluster}"
end

#current_document(profile) ⇒ Object 



61
62
63
64
65
66
67
68
69
70
 
# File 'lib/putpaws/iam/grant_command.rb', line 61

def current_document(profile)
  policy = iam_client.get_policy(policy_arn: policy_arn(profile)).policy
  ver = iam_client.get_policy_version(
    policy_arn: policy_arn(profile),
    version_id: policy.default_version_id
  )
  JSON.parse(URI.decode_www_form_component(ver.policy_version.document))
rescue Aws::IAM::Errors::NoSuchEntityException
  nil
end

#iam_client ⇒ Object 



24
25
26
27
28
29
 
# File 'lib/putpaws/iam/grant_command.rb', line 24

def iam_client
  @iam_client ||= begin
    require 'aws-sdk-iam'
    Aws::IAM::Client.new(region: app.region)
  end
end

#plan(profile) ⇒ Object 



72
73
74
75
76
77
 
# File 'lib/putpaws/iam/grant_command.rb', line 72

def plan(profile)
  current = current_document(profile)
  return :create if current.nil?
  desired = JSON.parse(JSON.generate(build_policy_document(profile)))
  current == desired ? :skip : :update
end

#policy_arn(profile) ⇒ Object 



51
52
53
 
# File 'lib/putpaws/iam/grant_command.rb', line 51

def policy_arn(profile)
  "arn:aws:iam::#{}:policy/#{policy_name(profile)}"
end

#policy_name(profile) ⇒ Object 



47
48
49
 
# File 'lib/putpaws/iam/grant_command.rb', line 47

def policy_name(profile)
  "#{app.name}-operator-#{profile.name}"
end

#prune_versions!(profile) ⇒ Object

Managed policies keep at most 5 versions.



99
100
101
102
103
104
105
 
# File 'lib/putpaws/iam/grant_command.rb', line 99

def prune_versions!(profile)
  versions = iam_client.list_policy_versions(policy_arn: policy_arn(profile)).versions
  return if versions.size < 5
  oldest = versions.reject(&:is_default_version).min_by(&:create_date)
  return unless oldest
  iam_client.delete_policy_version(policy_arn: policy_arn(profile), version_id: oldest.version_id)
end

#region ⇒ Object 



39
40
41
 
# File 'lib/putpaws/iam/grant_command.rb', line 39

def region
  app.region
end

#statements_for(group) ⇒ Object 



107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
 
# File 'lib/putpaws/iam/grant_command.rb', line 107

def statements_for(group)
  case group
  when 'attach'
    [
      {Sid: 'AttachListTasks', Effect: 'Allow',
       Action: %w[ecs:ListTasks ecs:DescribeTasks],
       Resource: '*',
       Condition: {ArnEquals: {'ecs:cluster' => cluster_arn}}},
      {Sid: 'AttachExec', Effect: 'Allow',
       Action: %w[ecs:ExecuteCommand],
       Resource: "arn:aws:ecs:#{region}:#{}:task/#{app.cluster}/*"},
      {Sid: 'AttachPortForward', Effect: 'Allow',
       Action: %w[ssm:StartSession],
       Resource: [
         "arn:aws:ssm:#{region}::document/AWS-StartPortForwardingSessionToRemoteHost",
         "arn:aws:ecs:#{region}:#{}:task/#{app.cluster}/*",
       ]},
    ]
  when 'shell'
    prefix = app.task_name_prefix || app.name
    [
      {Sid: 'ShellRunTask', Effect: 'Allow',
       Action: %w[ecs:RunTask ecs:StopTask],
       Resource: [
         "arn:aws:ecs:#{region}:#{}:task-definition/#{prefix}*",
         "arn:aws:ecs:#{region}:#{}:task-definition/#{prefix}*:*",
         "arn:aws:ecs:#{region}:#{}:task/#{app.cluster}/*",
       ]},
      {Sid: 'ShellDescribeTasks', Effect: 'Allow',
       Action: %w[ecs:DescribeTasks],
       Resource: '*',
       Condition: {ArnEquals: {'ecs:cluster' => cluster_arn}}},
      {Sid: 'ShellExec', Effect: 'Allow',
       Action: %w[ecs:ExecuteCommand],
       Resource: "arn:aws:ecs:#{region}:#{}:task/#{app.cluster}/*"},
      {Sid: 'ShellPassRole', Effect: 'Allow',
       Action: %w[iam:PassRole],
       Resource: "arn:aws:iam::#{}:role/#{app.name}-*"},
    ]
  when 'deploy'
    [
      {Sid: 'DeployListServices', Effect: 'Allow',
       Action: %w[ecs:ListServices],
       Resource: '*',
       Condition: {ArnEquals: {'ecs:cluster' => cluster_arn}}},
      {Sid: 'DeployUpdateService', Effect: 'Allow',
       Action: %w[ecs:UpdateService ecs:DescribeServices],
       Resource: "arn:aws:ecs:#{region}:#{}:service/#{app.cluster}/#{app.service || '*'}"},
    ]
  when 'logs'
    r = app.log_region || region
    [
      {Sid: 'LogsDescribeGroups', Effect: 'Allow',
       Action: %w[logs:DescribeLogGroups],
       Resource: "arn:aws:logs:#{r}:#{}:log-group:*"},
      {Sid: 'LogsRead', Effect: 'Allow',
       Action: %w[logs:DescribeLogStreams logs:FilterLogEvents logs:GetLogEvents],
       Resource: [
         "arn:aws:logs:#{r}:#{}:log-group:#{app.log_group_prefix}*",
         "arn:aws:logs:#{r}:#{}:log-group:#{app.log_group_prefix}*:*",
       ]},
    ]
  when 'codebuild'
    r = app.build_region || region
    [
      {Sid: 'BuildList', Effect: 'Allow',
       Action: %w[codebuild:ListProjects],
       Resource: '*'},
      {Sid: 'BuildStart', Effect: 'Allow',
       Action: %w[codebuild:StartBuild codebuild:StopBuild codebuild:BatchGetBuilds codebuild:BatchGetProjects],
       Resource: "arn:aws:codebuild:#{r}:#{}:project/#{app.build_project_name_prefix}*"},
      {Sid: 'BuildLogsRead', Effect: 'Allow',
       Action: %w[logs:DescribeLogStreams logs:FilterLogEvents logs:GetLogEvents],
       Resource: [
         "arn:aws:logs:#{r}:#{}:log-group:#{app.build_log_group_prefix}*",
         "arn:aws:logs:#{r}:#{}:log-group:#{app.build_log_group_prefix}*:*",
       ]},
    ]
  when 'scheduler'
    scheduler_role = (app.target && app.target.scheduler_role) ||
      "arn:aws:iam::#{}:role/#{app.name}-*"
    [
      {Sid: 'ScheduleList', Effect: 'Allow',
       Action: %w[scheduler:ListSchedules],
       Resource: '*'},
      {Sid: 'ScheduleManage', Effect: 'Allow',
       Action: %w[scheduler:GetSchedule scheduler:CreateSchedule scheduler:UpdateSchedule],
       Resource: "arn:aws:scheduler:#{region}:#{}:schedule/default/*"},
      {Sid: 'SchedulePassRole', Effect: 'Allow',
       Action: %w[iam:PassRole],
       Resource: scheduler_role},
    ]
  else
    raise "Unknown group: #{group} (available: #{GROUPS.join(', ')})"
  end
end

#sts_client ⇒ Object 



31
32
33
 
# File 'lib/putpaws/iam/grant_command.rb', line 31

def sts_client
  @sts_client ||= Aws::STS::Client.new(region: app.region)
end