Split AWS Config modules (#40111)

* Adding module for AWS Config service

* adding integration tests

* Split resource types into their own modules

* Properly use resource_prefix and retry on IAM "eventual consistency"

* Add config aggregator module

* AWS config aggregator integration test fixes

* AWS config recorder module

* Config aggregation auth rule

* Use resource_prefix in IAM role name

* Disable config tests

lib/ansible/modules/cloud/amazon/aws_config_aggregator.py

@@ -0,0 +1,218 @@
+#!/usr/bin/python
+
+# Copyright: (c) 2018, Aaron Smith <ajsmith10381@gmail.com>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+ANSIBLE_METADATA = {'metadata_version': '1.1',
+                    'status': ['preview'],
+                    'supported_by': 'community'}
+
+
+DOCUMENTATION = r'''
+---
+module: aws_config_aggregator
+short_description: Manage AWS Config aggregations across multiple accounts
+description:
+    - Module manages AWS Config resources
+version_added: "2.6"
+requirements: [ 'botocore', 'boto3' ]
+author:
+    - "Aaron Smith (@slapula)"
+options:
+  name:
+    description:
+    - The name of the AWS Config resource.
+    required: true
+  state:
+    description:
+    - Whether the Config rule should be present or absent.
+    default: present
+    choices: ['present', 'absent']
+  account_sources:
+    description:
+    - Provides a list of source accounts and regions to be aggregated.
+    suboptions:
+      account_ids:
+        description:
+        - A list of 12-digit account IDs of accounts being aggregated.
+      aws_regions:
+        description:
+        - A list of source regions being aggregated.
+      all_aws_regions:
+        description:
+        - If true, aggreagate existing AWS Config regions and future regions.
+  organization_source:
+    description:
+    - The region authorized to collect aggregated data.
+    suboptions:
+      role_arn:
+        description:
+        - ARN of the IAM role used to retreive AWS Organization details associated with the aggregator account.
+      aws_regions:
+        description:
+        - The source regions being aggregated.
+      all_aws_regions:
+        description:
+        - If true, aggreagate existing AWS Config regions and future regions.
+extends_documentation_fragment:
+  - aws
+  - ec2
+'''
+
+EXAMPLES = r'''
+- name: Create cross-account aggregator
+  aws_config_aggregator:
+    name: test_config_rule
+    state: present
+    account_sources:
+      account_ids:
+      - 1234567890
+      - 0123456789
+      - 9012345678
+      all_aws_regions: yes
+'''
+
+RETURN = r'''#'''
+
+
+try:
+    import botocore
+    from botocore.exceptions import BotoCoreError, ClientError
+except ImportError:
+    pass  # handled by AnsibleAWSModule
+
+from ansible.module_utils.aws.core import AnsibleAWSModule
+from ansible.module_utils.ec2 import boto3_conn, get_aws_connection_info, AWSRetry
+from ansible.module_utils.ec2 import camel_dict_to_snake_dict, boto3_tag_list_to_ansible_dict
+
+
+def resource_exists(client, module, resource_type, params):
+    try:
+        aggregator = client.describe_configuration_aggregators(
+            ConfigurationAggregatorNames=[params['name']]
+        )
+        return aggregator['ConfigurationAggregators'][0]
+    except client.exceptions.from_code('NoSuchConfigurationAggregatorException'):
+        return
+    except (botocore.exceptions.ClientError, botocore.exceptions.BotoCoreError) as e:
+        module.fail_json_aws(e)
+
+
+def create_resource(client, module, params, result):
+    try:
+        response = client.put_configuration_aggregator(
+            ConfigurationAggregatorName=params['ConfigurationAggregatorName'],
+            AccountAggregationSources=params['AccountAggregationSources'],
+            OrganizationAggregationSource=params['OrganizationAggregationSource']
+        )
+        result['changed'] = True
+        result['aggregator'] = camel_dict_to_snake_dict(resource_exists(client, module, params))
+        return result
+    except (botocore.exceptions.ClientError, botocore.exceptions.BotoCoreError) as e:
+        module.fail_json_aws(e, msg="Couldn't create AWS Config configuration aggregator")
+
+
+def update_resource(client, module, resource_type, params, result):
+    current_params = client.describe_configuration_aggregators(
+        ConfigurationAggregatorNames=[params['name']]
+    )
+
+    del current_params['ConfigurationAggregatorArn']
+    del current_params['CreationTime']
+    del current_params['LastUpdatedTime']
+
+    if params != current_params['ConfigurationAggregators'][0]:
+        try:
+            client.put_configuration_aggregator(
+                ConfigurationAggregatorName=params['ConfigurationAggregatorName'],
+                AccountAggregationSources=params['AccountAggregationSources'],
+                OrganizationAggregationSource=params['OrganizationAggregationSource']
+            )
+            result['changed'] = True
+            result['aggregator'] = camel_dict_to_snake_dict(resource_exists(client, module, params))
+            return result
+        except (botocore.exceptions.ClientError, botocore.exceptions.BotoCoreError) as e:
+            module.fail_json_aws(e, msg="Couldn't create AWS Config configuration aggregator")
+
+
+def delete_resource(client, module, resource_type, params, result):
+    try:
+        client.delete_configuration_aggregator(
+            ConfigurationAggregatorName=params['ConfigurationAggregatorName']
+        )
+        result['changed'] = True
+        return result
+    except (botocore.exceptions.ClientError, botocore.exceptions.BotoCoreError) as e:
+        module.fail_json_aws(e, msg="Couldn't delete AWS Config configuration aggregator")
+
+
+def main():
+    module = AnsibleAWSModule(
+        argument_spec={
+            'name': dict(type='str', required=True),
+            'state': dict(type='str', choices=['present', 'absent'], default='present'),
+            'account_sources': dict(type='list', required=True),
+            'organization_source': dict(type='dict', required=True)
+        },
+        supports_check_mode=False,
+    )
+
+    result = {
+        'changed': False
+    }
+
+    name = module.params.get('name')
+    state = module.params.get('state')
+
+    params = {}
+    if name:
+        params['ConfigurationAggregatorName'] = name
+    if module.params.get('account_sources'):
+        params['AccountAggregationSources'] = []
+        for i in module.params.get('account_sources'):
+            tmp_dict = {}
+            if i.get('account_ids'):
+                tmp_dict['AccountIds'] = i.get('account_ids')
+            if i.get('aws_regions'):
+                tmp_dict['AwsRegions'] = i.get('aws_regions')
+            if i.get('all_aws_regions') is not None:
+                tmp_dict['AllAwsRegions'] = i.get('all_aws_regions')
+            params['AccountAggregationSources'].append(tmp_dict)
+    if module.params.get('organization_source'):
+        params['OrganizationAggregationSource'] = {}
+        if module.params.get('organization_source').get('role_arn'):
+            params['OrganizationAggregationSource'].update({
+                'RoleArn': module.params.get('organization_source').get('role_arn')
+            })
+        if module.params.get('organization_source').get('aws_regions'):
+            params['OrganizationAggregationSource'].update({
+                'AwsRegions': module.params.get('organization_source').get('aws_regions')
+            })
+        if module.params.get('organization_source').get('all_aws_regions') is not None:
+            params['OrganizationAggregationSourcep'].update({
+                'AllAwsRegions': module.params.get('organization_source').get('all_aws_regions')
+            })
+
+    client = module.client('config', retry_decorator=AWSRetry.jittered_backoff())
+
+    resource_status = resource_exists(client, module, params)
+
+    if state == 'present':
+        if not resource_status:
+            create_resource(client, module, params, result)
+        else:
+            update_resource(client, module, params, result)
+
+    if state == 'absent':
+        if resource_status:
+            delete_resource(client, module, params, result)
+
+    module.exit_json(changed=result['changed'])
+
+
+if __name__ == '__main__':
+    main()