File: //lib/python3.6/site-packages/awscli/customizations/cloudtrail/__pycache__/subscribe.cpython-36.pyc
3
�T_a5 � @ s� d dl Z d dlZd dlZddlmZ d dlmZ d dlmZ d dl m
Z
ej e �Z
dZdZG d d
� d
e�ZG d d � d e�ZG d
d� de�ZdS )� N� )�get_account_id)� BasicCommand)�s3_bucket_exists)� ClientErrorz6policy/S3/AWSCloudTrail-S3BucketPolicy-2014-12-17.jsonz7policy/SNS/AWSCloudTrail-SnsTopicPolicy-2014-12-17.jsonc @ s e Zd ZdS )�CloudTrailErrorN)�__name__�
__module__� __qualname__� r r � /usr/lib/python3.6/subscribe.pyr s r c
@ s� e Zd ZdZdZdZdZdddd�d d
d �d d
d �ddd �ddd �ddd �ddd �ddd �gZdZdZ dd� Z
dd � Z d d � Z d d � Z
d,d"d#�Zd-d$d%�Zd&d'� Zd(d)� Zd*d+� Zd!S ).�CloudTrailSubscribez�
Subscribe/update a user account to CloudTrail, creating the required S3 bucket,
the optional SNS topic, and starting the CloudTrail monitoring and logging.
zcreate-subscriptionz�Creates and configures the AWS resources necessary to use CloudTrail, creates a trail using those resources, and turns on logging.znaws cloudtrail create-subscription (--s3-use-bucket|--s3-new-bucket) bucket-name [--sns-new-topic topic-name]
�nameTzCloudtrail name)r Zrequired� help_textz
s3-new-bucketz%Create a new S3 bucket with this name)r r z
s3-use-bucketz(Use an existing S3 bucket with this namez s3-prefixzS3 object prefixz
sns-new-topicz%Create a new SNS topic with this namez include-global-service-eventsz(Whether to include global service eventszs3-custom-policyz Custom S3 policy template or URLzsns-custom-policyz!Custom SNS policy template or URLFc C s | j ||� | j||� dS )Nr )�setup_services�_call)�self�args�parsed_globalsr r r � _run_main@ s z CloudTrailSubscribe._run_mainc C s� d d d�}|j d k r |j |d< |jd k r2|j|d< tjd� | jjd
|�| _| jjd |�| _| jjd |�| _| jj j
| _
|j d k r�|j |d< | jjd
|�| _ d S )N)� region_name�verifyr r z&Initializing S3, SNS and CloudTrail...�sts�s3�sns� endpoint_url�
cloudtrail)r )r )r )r )
�regionZ
verify_ssl�LOG�debugZ_sessionZ
create_clientr r r �metar r r )r r r Z client_argsr r r r G s
z"CloudTrailSubscribe.setup_servicesc C s� |j }|r6|j� dkr d}n|j� dkr.d}ntd��|j}|jr�|j}| jr�|jdkr�| jj|j gd�}|d d }d
|kr�t
j d j |d
�� |d
|_| j
||j|j� n| r�| j r�td ��|j�ry| j|j|j�}W n0 tk
�r |j�r | jj|jd
� � Y nX y | j|j ||j|j|�}W nJ tk
�rz |j�rZ| jj|jd
� |j�rt| jj|d d� � Y nX tjjdj tj |dd�d�� | j�s�| j |j � tjjdj ||j�p�dd�� dS )z�
Run the command. Calls various services based on input options and
outputs the final CloudTrail configuration.
�trueTZfalseFzFYou must pass either true or false to --include-global-service-events.N)Z
trailNameListZ trailListr � S3KeyPrefixzSetting S3 prefix to {0}zBYou must pass either --s3-use-bucket or --s3-new-bucket to create.)�Bucket�TopicArn)r$ z#CloudTrail configuration:
{config}
� )�indent)�configz,Logs will be delivered to {bucket}:{prefix}
� )�bucket�prefix) Z include_global_service_events�lower�
ValueErrorZ
s3_use_bucketZ
s3_new_bucket�UPDATEZ s3_prefixr �describe_trailsr r r �format�setup_new_bucketZs3_custom_policyZ
sns_new_topic�setup_new_topicZsns_custom_policy� Exceptionr �
delete_bucket�upsert_cloudtrail_configr � delete_topic�sys�stdout�write�json�dumps�start_cloudtrail) r Zoptionsr �gser) �resZ
trail_info� topic_resultZcloudtrail_configr r r r ^ sd
zCloudTrailSubscribe._callc C s` y(| j jd| j |d�}|d j� jd�S tk
rZ } ztd| j||��W Y d d }~X nX d S )Nzawscloudtrail-policy-)r# ZKeyZBodyzutf-8zCUnable to get regional policy template for region %s: %s. Error: %s)r Z
get_objectr �read�decoder2 r )r Zkey_name�data�er r r � _get_policy� s z CloudTrailSubscribe._get_policyNc
C s. t jjdj|d�� t| j�}|r6|jd� r6|d7 }|dk rD|}n
| jt�}|j d|�j d|�}d|kr||j d|pvd�}n|j d |p�d�}t
j d
j|�� t | j
|�}|r�td j|d���d |i}| jd
kr�d| ji}||d< | j
jf |�} y| j
j||d� W n& tk
�r( | j
j|d� � Y nX | S )zx
Creates a new S3 bucket with an appropriate policy to let CloudTrail
write to the prefix path.
z%Setting up new S3 bucket {bucket}...
)r) �/Nz <BucketName>z<CustomerAccountID>z <Prefix>/r( z<Prefix>zBucket policy:
{0}z Bucket {bucket} already exists.r# z us-east-1ZLocationConstraintZCreateBucketConfiguration)r# �Policy)r# )r6 r7 r8 r/ r r �endswithrC �S3_POLICY_TEMPLATE�replacer r r r r2 r Z
create_bucketZput_bucket_policyr r3 )
r r) r* �
custom_policy�
account_id�policyZ
bucket_existsZparamsZ
bucket_configrA r r r r0 � s:
z$CloudTrailSubscribe.setup_new_bucketc sB t jjdj� d�� t| j�}y| jj� d }W n" tk
rR g }t j
d� Y nX � fdd�|D �rvtdj� d���| jj j }|dk r�|}n
| j
t�}|jd |�jd
|�jd � �}| jj� d �}yP| jj|d
d�}| j|d d |�}t jdj|�� | jj|d
d|d� W n* tk
�r< | jj|d
d� � Y nX |S )zz
Creates a new SNS topic with an appropriate policy to let CloudTrail
post messages to the topic.
z$Setting up new SNS topic {topic}...
)�topicZTopicsz$Unable to list topics, continuing...c s& g | ] }|d j d�d � kr|�qS )r$ �:r ���)�split)�.0�t)rL r r �
<listcomp>� s z7CloudTrailSubscribe.setup_new_topic.<locals>.<listcomp>z Topic {topic} already exists.Nz<Region>z<SNSTopicOwnerAccountId>z<SNSTopicName>)�Namer$ )r$ Z
AttributesrE zTopic policy:
{0})r$ Z
AttributeNameZAttributeValue)r6 r7 r8 r/ r r r Z list_topicsr2 r �warnr r rC �SNS_POLICY_TEMPLATErH Z create_topicZget_topic_attributes�merge_sns_policyr Zset_topic_attributesr5 ) r rL rI rJ Ztopicsr rK r> Z
topic_attrr )rL r r1 � s@
z#CloudTrailSubscribe.setup_new_topicc C s2 t j|�}t j|�}|d |d 7 < t j|�S )a�
Merge two SNS topic policy documents. The id information from
``left`` is used in the final document, and the statements
from ``right`` are merged into ``left``.
http://docs.aws.amazon.com/sns/latest/dg/BasicStructure.html
:type left: string
:param left: First policy JSON document
:type right: string
:param right: Second policy JSON document
:rtype: string
:return: Merged policy JSON
Z Statement)r9 �loadsr: )r �left�rightZ left_parsedZ right_parsedr r r rV % s
z$CloudTrailSubscribe.merge_sns_policyc C s� t jjd� d|i}|dk r$||d< |dk r4||d< |dk rD||d< |dk rT||d< | jsj| jjf |� n| jjf |� | jj� S )z�
Either create or update the CloudTrail configuration depending on
whether this command is a create or update command.
z.Creating/updating CloudTrail configuration...
rS NZ S3BucketNamer" Z SnsTopicNameZIncludeGlobalServiceEvents)r6 r7 r8 r- r Z create_trailZ update_trailr. )r r r) r* rL r< r' r r r r4 9 s z,CloudTrailSubscribe.upsert_cloudtrail_configc C s t jjd� | jj|d�S )zE
Start the CloudTrail service, which begins logging.
z Starting CloudTrail service...
)rS )r6 r7 r8 r Z
start_logging)r r r r r r; P s z$CloudTrailSubscribe.start_cloudtrail)N)N)r r r
�__doc__�NAME� DESCRIPTION�SYNOPSISZ ARG_TABLEr- Z
_UNDOCUMENTEDr r r rC r0 r1 rV r4 r; r r r r r
s:
M
4
;r
c @ s e Zd ZdZdZdZdZdZdS )�CloudTrailUpdatezF
Like subscribe above, but the update version of the command.
zupdate-subscriptionTzlUpdates any of the trail configuration settings, and creates and configures any new AWS resources specified.zpaws cloudtrail update-subscription [(--s3-use-bucket|--s3-new-bucket) bucket-name] [--sns-new-topic topic-name]
N)r r r
rZ r[ r- r\ r] r r r r r^ X s
r^ )r9 Zloggingr6 Zutilsr Z awscli.customizations.commandsr Zawscli.customizations.utilsr Zbotocore.exceptionsr Z getLoggerr r rG rU r2 r r
r^ r r r r �<module>
s
: