Class: Putpaws::Provision::Resources::IamRole

Inherits:
Base
  • Object
show all
Defined in:
lib/putpaws/provision/resources/iam_role.rb

Overview

Registers an IAM role from a reviewed draft file under policies/. This runs only after the user approved the drafts explicitly (roles.approve_drafts in provision.json). The draft content is applied as-is, including any edits the user made.

Instance Attribute Summary collapse

Attributes inherited from Base

#clients, #config, #state

Instance Method Summary collapse

Methods inherited from Base

#ensure!, #kind, #plan

Constructor Details

#initialize(roles_key:, draft_file:, **args) ⇒ IamRole

Returns a new instance of IamRole.



14
15
16
17
18
 
# File 'lib/putpaws/provision/resources/iam_role.rb', line 14

def initialize(roles_key:, draft_file:, **args)
  super(**args)
  @roles_key = roles_key
  @draft_file = draft_file
end

Instance Attribute Details

#draft_file ⇒ Object (readonly)

Returns the value of attribute draft_file.



13
14
15
 
# File 'lib/putpaws/provision/resources/iam_role.rb', line 13

def draft_file
  @draft_file
end

#roles_key ⇒ Object (readonly)

Returns the value of attribute roles_key.



13
14
15
 
# File 'lib/putpaws/provision/resources/iam_role.rb', line 13

def roles_key
  @roles_key
end

Instance Method Details

#changed?(_current) ⇒ Boolean

Re-applied only when the draft content changed since the last apply, so that manual changes on the AWS side are left alone otherwise.

Returns:



52
53
54
 
# File 'lib/putpaws/provision/resources/iam_role.rb', line 52

def changed?(_current)
  state.resources[digest_key] != digest
end

#create! ⇒ Object 



56
57
58
59
60
61
62
63
64
 
# File 'lib/putpaws/provision/resources/iam_role.rb', line 56

def create!
  res = clients.iam.create_role(
    role_name: name,
    assume_role_policy_document: JSON.generate(draft[:AssumeRolePolicyDocument]),
    tags: [MANAGED_TAG]
  )
  put_policy!
  {roles_key => res.role.arn, digest_key => digest}
end

#current ⇒ Object 



44
45
46
47
48
 
# File 'lib/putpaws/provision/resources/iam_role.rb', line 44

def current
  clients.iam.get_role(role_name: name).role
rescue Aws::IAM::Errors::NoSuchEntityException
  nil
end

#digest ⇒ Object 



36
37
38
 
# File 'lib/putpaws/provision/resources/iam_role.rb', line 36

def digest
  Digest::SHA256.hexdigest(JSON.generate(draft))
end

#digest_key ⇒ Object 



40
41
42
 
# File 'lib/putpaws/provision/resources/iam_role.rb', line 40

def digest_key
  :"iam_#{roles_key}_digest"
end

#draft ⇒ Object 



20
21
22
23
24
25
26
 
# File 'lib/putpaws/provision/resources/iam_role.rb', line 20

def draft
  @draft ||= begin
    path = config.policies_dir.join(draft_file)
    raise "Role draft not found: #{path}. Please run `putpaws ready` first." unless path.exist?
    JSON.parse(File.read(path), symbolize_names: true)
  end
end

#name ⇒ Object 



28
29
30
 
# File 'lib/putpaws/provision/resources/iam_role.rb', line 28

def name
  draft[:SuggestedRoleName]
end

#outputs(current) ⇒ Object 



75
76
77
 
# File 'lib/putpaws/provision/resources/iam_role.rb', line 75

def outputs(current)
  {roles_key => current.arn, digest_key => digest}
end

#policy_name ⇒ Object 



32
33
34
 
# File 'lib/putpaws/provision/resources/iam_role.rb', line 32

def policy_name
  draft[:SuggestedPolicyName]
end

#put_policy! ⇒ Object 



79
80
81
82
83
84
85
 
# File 'lib/putpaws/provision/resources/iam_role.rb', line 79

def put_policy!
  clients.iam.put_role_policy(
    role_name: name,
    policy_name: policy_name,
    policy_document: JSON.generate(draft[:PolicyDocument])
  )
end

#update!(current) ⇒ Object 



66
67
68
69
70
71
72
73
 
# File 'lib/putpaws/provision/resources/iam_role.rb', line 66

def update!(current)
  clients.iam.update_assume_role_policy(
    role_name: name,
    policy_document: JSON.generate(draft[:AssumeRolePolicyDocument])
  )
  put_policy!
  {roles_key => current.arn, digest_key => digest}
end