ansible-collections/community.general
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2025-06-28 03:00:23 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Update iam_group to add check mode support (#27589)

Browse source
This commit is contained in:
Josh Souza 2018-01-22 12:29:22 -07:00 • committed by ansibot
parent b7f4504a36
commit 1ac715987b
1 changed files with 65 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

111
lib/ansible/modules/cloud/amazon/iam_group.py
View file

@ -192,7 +192,6 @@ def compare_group_members(current_group_members, new_group_members):
# If new_attached_policies is None it means we want to remove all policies # If new_attached_policies is None it means we want to remove all policies
if len(current_group_members) > 0 and new_group_members is None: if len(current_group_members) > 0 and new_group_members is None:
return False return False
if set(current_group_members) == set(new_group_members): if set(current_group_members) == set(new_group_members):
return True return True
else: else:
@ -200,6 +199,7 @@ def compare_group_members(current_group_members, new_group_members):
def convert_friendly_names_to_arns(connection, module, policy_names): def convert_friendly_names_to_arns(connection, module, policy_names):
if not any([not policy.startswith('arn:') for policy in policy_names if policy is not None]): if not any([not policy.startswith('arn:') for policy in policy_names if policy is not None]):
return policy_names return policy_names
allpolicies = {} allpolicies = {}
@ -220,12 +220,12 @@ def create_or_update_group(connection, module):
params = dict() params = dict()
params['GroupName'] = module.params.get('name') params['GroupName'] = module.params.get('name')
managed_policies = module.params.get('managed_policy') managed_policies = module.params.get('managed_policy')
if managed_policies:
managed_policies = convert_friendly_names_to_arns(connection, module, managed_policies)
users = module.params.get('users') users = module.params.get('users')
purge_users = module.params.get('purge_users') purge_users = module.params.get('purge_users')
purge_policy = module.params.get('purge_policy') purge_policy = module.params.get('purge_policy')
changed = False changed = False
if managed_policies:
managed_policies = convert_friendly_names_to_arns(connection, module, managed_policies)
# Get group # Get group
try: try:
@ -236,6 +236,10 @@ def create_or_update_group(connection, module):
# If group is None, create it # If group is None, create it
if group is None: if group is None:
# Check mode means we would create the group
if module.check_mode:
module.exit_json(changed=True)
try: try:
group = connection.create_group(**params) group = connection.create_group(**params)
changed = True changed = True
@ -248,34 +252,37 @@ def create_or_update_group(connection, module):
# Manage managed policies # Manage managed policies
current_attached_policies = get_attached_policy_list(connection, module, params['GroupName']) current_attached_policies = get_attached_policy_list(connection, module, params['GroupName'])
if not compare_attached_group_policies(current_attached_policies, managed_policies): if not compare_attached_group_policies(current_attached_policies, managed_policies):
current_attached_policies_arn_list = []
for policy in current_attached_policies:
current_attached_policies_arn_list.append(policy['PolicyArn'])
# If managed_policies has a single empty element we want to remove all attached policies # If managed_policies has a single empty element we want to remove all attached policies
if purge_policy: if purge_policy:
# Detach policies not present # Detach policies not present
current_attached_policies_arn_list = []
for policy in current_attached_policies:
current_attached_policies_arn_list.append(policy['PolicyArn'])
for policy_arn in list(set(current_attached_policies_arn_list) - set(managed_policies)): for policy_arn in list(set(current_attached_policies_arn_list) - set(managed_policies)):
try: changed = True
connection.detach_group_policy(GroupName=params['GroupName'], PolicyArn=policy_arn) if not module.check_mode:
except ClientError as e: try:
module.fail_json(msg=e.message, exception=traceback.format_exc(), connection.detach_group_policy(GroupName=params['GroupName'], PolicyArn=policy_arn)
**camel_dict_to_snake_dict(e.response)) except ClientError as e:
except ParamValidationError as e: module.fail_json(msg=e.message, exception=traceback.format_exc(),
module.fail_json(msg=e.message, exception=traceback.format_exc()) **camel_dict_to_snake_dict(e.response))
except ParamValidationError as e:
# If there are policies in managed_policies attach each policy module.fail_json(msg=e.message, exception=traceback.format_exc())
if managed_policies != [None]: # If there are policies to adjust that aren't in the current list, then things have changed
for policy_arn in managed_policies: # Otherwise the only changes were in purging above
try: if set(managed_policies) - set(current_attached_policies_arn_list):
connection.attach_group_policy(GroupName=params['GroupName'], PolicyArn=policy_arn) changed = True
except ClientError as e: # If there are policies in managed_policies attach each policy
module.fail_json(msg=e.message, exception=traceback.format_exc(), if managed_policies != [None] and not module.check_mode:
**camel_dict_to_snake_dict(e.response)) for policy_arn in managed_policies:
except ParamValidationError as e: try:
module.fail_json(msg=e.message, exception=traceback.format_exc()) connection.attach_group_policy(GroupName=params['GroupName'], PolicyArn=policy_arn)
except ClientError as e:
changed = True module.fail_json(msg=e.message, exception=traceback.format_exc(),
**camel_dict_to_snake_dict(e.response))
except ParamValidationError as e:
module.fail_json(msg=e.message, exception=traceback.format_exc())
# Manage group memberships # Manage group memberships
try: try:
@ -292,25 +299,33 @@ def create_or_update_group(connection, module):
if purge_users: if purge_users:
for user in list(set(current_group_members_list) - set(users)): for user in list(set(current_group_members_list) - set(users)):
try: # Ensure we mark things have changed if any user gets purged
connection.remove_user_from_group(GroupName=params['GroupName'], UserName=user) changed = True
except ClientError as e: # Skip actions for check mode
module.fail_json(msg=e.message, exception=traceback.format_exc(), if not module.check_mode:
**camel_dict_to_snake_dict(e.response)) try:
except ParamValidationError as e: connection.remove_user_from_group(GroupName=params['GroupName'], UserName=user)
module.fail_json(msg=e.message, exception=traceback.format_exc()) except ClientError as e:
module.fail_json(msg=e.message, exception=traceback.format_exc(),
if users != [None]: **camel_dict_to_snake_dict(e.response))
for user in users: except ParamValidationError as e:
try: module.fail_json(msg=e.message, exception=traceback.format_exc())
connection.add_user_to_group(GroupName=params['GroupName'], UserName=user) # If there are users to adjust that aren't in the current list, then things have changed
except ClientError as e: # Otherwise the only changes were in purging above
module.fail_json(msg=e.message, exception=traceback.format_exc(), if set(users) - set(current_group_members_list):
**camel_dict_to_snake_dict(e.response)) changed = True
except ParamValidationError as e: # Skip actions for check mode
module.fail_json(msg=e.message, exception=traceback.format_exc()) if users != [None] and not module.check_mode:
for user in users:
changed = True try:
connection.add_user_to_group(GroupName=params['GroupName'], UserName=user)
except ClientError as e:
module.fail_json(msg=e.message, exception=traceback.format_exc(),
**camel_dict_to_snake_dict(e.response))
except ParamValidationError as e:
module.fail_json(msg=e.message, exception=traceback.format_exc())
if module.check_mode:
module.exit_json(changed=changed)
# Get the group again # Get the group again
try: try:
@ -333,6 +348,9 @@ def destroy_group(connection, module):
module.fail_json(msg=e.message, exception=traceback.format_exc(), module.fail_json(msg=e.message, exception=traceback.format_exc(),
**camel_dict_to_snake_dict(e.response)) **camel_dict_to_snake_dict(e.response))
if group: if group:
# Check mode means we would remove this group
if module.check_mode:
module.exit_json(changed=True)
# Remove any attached policies otherwise deletion fails # Remove any attached policies otherwise deletion fails
try: try:
@ -417,6 +435,7 @@ def main():
module = AnsibleModule( module = AnsibleModule(
argument_spec=argument_spec, argument_spec=argument_spec,
supports_check_mode=True
) )
if not HAS_BOTO3: if not HAS_BOTO3: