mirror of
https://github.com/ansible-collections/community.general.git
synced 2025-07-02 14:40:19 -07:00
Aws ssm multiple fixes (#35569)
* aws ssm parameter lookup test case - fails demonstrating no exception when parameter missing * aws ssm parameter lookup - fail in case parameter doesn't exist * aws ssm parameter lookup test case - failing case for nice return from path lookup * aws ssm parameter lookup - convert incoming taglist to a key-value dictionary * aws ssm parameter lookup - pep8 / style clean up * aws_ssm lookup plugin rewrite for more standard interface * aws_ssm module and lookup - introduce integration test and fix: * aws_ssm module and lookup - error case integraton test and many PEP8 and other cleanups * aws ssm parameter lookup - Various fixes in response to review + recursive fix & test * aws ssm parameter lookup - more in response to review - shertel/abadger * aws ssm parameter lookup unit test - move to mocker according to abadger * aws ssm parameter lookup - integrate with new documentation fragment * aws ssm parameter lookup - accept either aws_profile or boto_profile * aws ssm parameter lookup - eliminate lookup document fragment until env vars are fixed later
This commit is contained in:
mikedlr
Sloane Hertel
parent
49eb0c49ea
commit
d31ded47fb
6 changed files with 451 additions and 154 deletions
|
|
@ -1,5 +1,6 @@
|
|||
# (c) 2016, Bill Wang <ozbillwang(at)gmail.com>
|
||||
# (c) 2017, Marat Bakeev <hawara(at)gmail.com>
|
||||
# (c) 2018, Michael De La Rue <siblemitcom.mddlr(at)spamgourmet.com>
|
||||
# (c) 2017 Ansible Project
|
||||
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
|
||||
|
|
@ -7,33 +8,42 @@ from __future__ import (absolute_import, division, print_function)
|
|||
__metaclass__ = type
|
||||
|
||||
DOCUMENTATION = '''
|
||||
lookup: aws_ssm
|
||||
author:
|
||||
- Bill Wang <ozbillwang(at)gmail.com>
|
||||
- Marat Bakeev <hawara(at)gmail.com>
|
||||
version_added: 2.5
|
||||
short_description: Get the value for a SSM parameter.
|
||||
description:
|
||||
- Get the value for an Amazon Simple Systems Manager parameter or a heirarchy of parameters. The first
|
||||
argument you pass the lookup can either be a parameter name or a hierarchy of parameters. Hierarchies start
|
||||
with a forward slash and end with the parameter name. Up to 5 layers may be specified.
|
||||
options:
|
||||
aws_profile:
|
||||
description: The boto profile to use. You may use environment variables or the default profile as an alternative.
|
||||
region:
|
||||
description: The region to use. You may use environment variables ar the default profile's region as an alternative.
|
||||
decrypt:
|
||||
description: A boolean to indicate whether to decrypt the parameter.
|
||||
default: false
|
||||
bypath:
|
||||
description: A boolean to indicate whether the parameter is provided as a hierarchy.
|
||||
default: false
|
||||
recursive:
|
||||
description: A boolean to indicate whether to retrieve all parameters within a hierarchy.
|
||||
default: false
|
||||
shortnames:
|
||||
description: Indicates whether to return the shortened name if using a parameter hierarchy.
|
||||
default: false
|
||||
lookup: aws_ssm
|
||||
author:
|
||||
- Bill Wang <ozbillwang(at)gmail.com>
|
||||
- Marat Bakeev <hawara(at)gmail.com>
|
||||
- Michael De La Rue <siblemitcom.mddlr@spamgourmet.com>
|
||||
version_added: 2.5
|
||||
requirements:
|
||||
- boto3
|
||||
- botocore
|
||||
short_description: Get the value for a SSM parameter or all parameters under a path.
|
||||
description:
|
||||
- Get the value for an Amazon Simple Systems Manager parameter or a heirarchy of parameters.
|
||||
The first argument you pass the lookup can either be a parameter name or a hierarchy of
|
||||
parameters. Hierarchies start with a forward slash and end with the parameter name. Up to
|
||||
5 layers may be specified.
|
||||
- When explicitly looking up a parameter by name the parameter being missing will be an error.
|
||||
- When looking up a path for parameters under it a dictionary will be returned for each path.
|
||||
If there is no parameter under that path then the return will be successful but the
|
||||
dictionary will be empty.
|
||||
options:
|
||||
decrypt:
|
||||
description: A boolean to indicate whether to decrypt the parameter.
|
||||
default: false
|
||||
type: boolean
|
||||
bypath:
|
||||
description: A boolean to indicate whether the parameter is provided as a hierarchy.
|
||||
default: false
|
||||
type: boolean
|
||||
recursive:
|
||||
description: A boolean to indicate whether to retrieve all parameters within a hierarchy.
|
||||
default: false
|
||||
type: boolean
|
||||
shortnames:
|
||||
description: Indicates whether to return the name only without path if using a parameter hierarchy.
|
||||
default: false
|
||||
type: boolean
|
||||
'''
|
||||
|
||||
EXAMPLES = '''
|
||||
|
|
@ -45,130 +55,148 @@ EXAMPLES = '''
|
|||
debug: msg="{{ lookup('aws_ssm', 'NoKey') }}"
|
||||
|
||||
- name: lookup ssm parameter store in nominated region
|
||||
debug: msg="{{ lookup('aws_ssm', 'Hello', 'region=us-east-2' ) }}"
|
||||
debug: msg="{{ lookup('aws_ssm', 'Hello', region=us-east-2 ) }}"
|
||||
|
||||
- name: lookup ssm parameter store without decrypted
|
||||
debug: msg="{{ lookup('aws_ssm', 'Hello', 'decrypt=False' ) }}"
|
||||
debug: msg="{{ lookup('aws_ssm', 'Hello', decrypt=False ) }}"
|
||||
|
||||
- name: lookup ssm parameter store in nominated aws profile
|
||||
debug: msg="{{ lookup('aws_ssm', 'Hello', 'aws_profile=myprofile' ) }}"
|
||||
debug: msg="{{ lookup('aws_ssm', 'Hello', aws_profile=myprofile ) }}"
|
||||
|
||||
- name: lookup ssm parameter store with all options.
|
||||
debug: msg="{{ lookup('aws_ssm', 'Hello', 'decrypt=false', 'region=us-east-2', 'aws_profile=myprofile') }}"
|
||||
debug: msg="{{ lookup('aws_ssm', 'Hello', decrypt=false, region=us-east-2, aws_profile=myprofile') }}"
|
||||
|
||||
- name: return a dictionary of ssm parameters from a hierarchy path
|
||||
debug: msg="{{ lookup('aws_ssm', '/PATH/to/params', 'region=ap-southeast-2', 'bypath', 'recursive=true' ) }}"
|
||||
debug: msg="{{ lookup('aws_ssm', '/PATH/to/params', region=ap-southeast-2, bypath=true, recursive=true' ) }}"
|
||||
|
||||
- name: return a dictionary of ssm parameters from a hierarchy path with shortened names (param instead of /PATH/to/param)
|
||||
debug: msg="{{ lookup('aws_ssm', '/PATH/to/params', 'region=ap-southeast-2', 'shortnames', 'bypath', 'recursive=true' ) }}"
|
||||
debug: msg="{{ lookup('aws_ssm', '/PATH/to/params', region=ap-southeast-2, shortnames=true, bypath=true, recursive=true ) }}"
|
||||
|
||||
- name: Iterate over a parameter hierarchy
|
||||
debug: msg='key contains {{item.Name }} with value {{item.Value}} '
|
||||
with_aws_ssm:
|
||||
- '/TEST/test-list'
|
||||
- 'region=ap-southeast-2'
|
||||
- 'bypath'
|
||||
debug: msg='key contains {{item.Name}} with value {{item.Value}} '
|
||||
loop: '{{ query("aws_ssm", "/TEST/test-list", region="ap-southeast-2", bypath=true) }}'
|
||||
|
||||
'''
|
||||
|
||||
from ansible.module_utils.ec2 import HAS_BOTO3
|
||||
from ansible.module_utils._text import to_native
|
||||
from ansible.module_utils.ec2 import HAS_BOTO3, boto3_tag_list_to_ansible_dict
|
||||
from ansible.errors import AnsibleError
|
||||
from ansible.plugins.lookup import LookupBase
|
||||
from ansible.module_utils.parsing.convert_bool import boolean
|
||||
|
||||
try:
|
||||
from __main__ import display
|
||||
except ImportError:
|
||||
from ansible.utils.display import Display
|
||||
display = Display()
|
||||
|
||||
try:
|
||||
from botocore.exceptions import ClientError
|
||||
import botocore
|
||||
import boto3
|
||||
except ImportError:
|
||||
pass # will be captured by imported HAS_BOTO3
|
||||
|
||||
|
||||
class LookupModule(LookupBase):
|
||||
def run(self, terms, variables, **kwargs):
|
||||
'''
|
||||
:param terms: a list of plugin options
|
||||
e.g. ['parameter_name', 'region=us-east-1', 'aws_profile=profile', 'decrypt=false']
|
||||
:param variables: config variables
|
||||
:return The value of the SSM parameter or None
|
||||
'''
|
||||
def _boto3_conn(region, credentials):
|
||||
if 'boto_profile' in credentials:
|
||||
boto_profile = credentials.pop('boto_profile')
|
||||
else:
|
||||
boto_profile = None
|
||||
|
||||
ret = {}
|
||||
response = {}
|
||||
session = {}
|
||||
ssm_dict = {}
|
||||
lparams = {}
|
||||
try:
|
||||
connection = boto3.session.Session(profile_name=boto_profile).client('ssm', region, **credentials)
|
||||
except (botocore.exceptions.ProfileNotFound, botocore.exceptions.PartialCredentialsError):
|
||||
if boto_profile:
|
||||
try:
|
||||
connection = boto3.session.Session(profile_name=boto_profile).client('ssm', region)
|
||||
# FIXME: we should probably do better passing on of the error information
|
||||
except (botocore.exceptions.ProfileNotFound, botocore.exceptions.PartialCredentialsError):
|
||||
raise AnsibleError("Insufficient credentials found.")
|
||||
else:
|
||||
raise AnsibleError("Insufficient credentials found.")
|
||||
return connection
|
||||
|
||||
|
||||
class LookupModule(LookupBase):
|
||||
def run(self, terms, variables=None, boto_profile=None, aws_profile=None,
|
||||
aws_secret_key=None, aws_access_key=None, aws_security_token=None, region=None,
|
||||
bypath=False, shortnames=False, recursive=False, decrypt=True):
|
||||
'''
|
||||
:arg terms: a list of lookups to run.
|
||||
e.g. ['parameter_name', 'parameter_name_too' ]
|
||||
:kwarg variables: ansible variables active at the time of the lookup
|
||||
:kwarg aws_secret_key: identity of the AWS key to use
|
||||
:kwarg aws_access_key: AWS seret key (matching identity)
|
||||
:kwarg aws_security_token: AWS session key if using STS
|
||||
:kwarg decrypt: Set to True to get decrypted parameters
|
||||
:kwarg region: AWS region in which to do the lookup
|
||||
:kwarg bypath: Set to True to do a lookup of variables under a path
|
||||
:kwarg recursive: Set to True to recurse below the path (requires bypath=True)
|
||||
:returns: A list of parameter values or a list of dictionaries if bypath=True.
|
||||
'''
|
||||
|
||||
if not HAS_BOTO3:
|
||||
raise AnsibleError('botocore and boto3 are required.')
|
||||
raise AnsibleError('botocore and boto3 are required for aws_ssm lookup.')
|
||||
|
||||
ssm_dict['WithDecryption'] = True
|
||||
ret = []
|
||||
response = {}
|
||||
ssm_dict = {}
|
||||
|
||||
# check if option 'bypath' is specified, while still allowing to have a parameter with the same name
|
||||
if 'bypath' in terms[1:]:
|
||||
ssm_dict['Path'] = terms[0]
|
||||
del terms[terms[1:].index('bypath') + 1]
|
||||
credentials = {}
|
||||
if aws_profile:
|
||||
credentials['boto_profile'] = aws_profile
|
||||
else:
|
||||
ssm_dict['Names'] = [terms[0]]
|
||||
credentials['boto_profile'] = boto_profile
|
||||
credentials['aws_secret_access_key'] = aws_secret_key
|
||||
credentials['aws_access_key_id'] = aws_access_key
|
||||
credentials['aws_session_token'] = aws_security_token
|
||||
|
||||
# Option to return short parameter names in by path lookups
|
||||
if 'shortnames' in terms[1:]:
|
||||
lparams['shortnames'] = True
|
||||
del terms[terms[1:].index('shortnames') + 1]
|
||||
client = _boto3_conn(region, credentials)
|
||||
|
||||
if len(terms) > 1:
|
||||
for param in terms[1:]:
|
||||
if "=" in param:
|
||||
key, value = param.split('=')
|
||||
else:
|
||||
raise AnsibleError("ssm parameter store plugin needs key=value pairs, but received %s" % param)
|
||||
ssm_dict['WithDecryption'] = decrypt
|
||||
|
||||
if key == "region" or key == "aws_profile":
|
||||
session[key] = value
|
||||
|
||||
# recurse or not
|
||||
if key == "recursive" and boolean(value):
|
||||
ssm_dict['Recursive'] = True
|
||||
|
||||
# decrypt the value or not
|
||||
if key == "decrypt" and boolean(value):
|
||||
ssm_dict['WithDecryption'] = False
|
||||
|
||||
if "aws_profile" in session:
|
||||
boto3.setup_default_session(profile_name=session['aws_profile'])
|
||||
|
||||
if "region" in session:
|
||||
client = boto3.client('ssm', region_name=session['region'])
|
||||
else:
|
||||
client = boto3.client('ssm')
|
||||
|
||||
try:
|
||||
# Lookup by path
|
||||
if 'Path' in ssm_dict:
|
||||
response = client.get_parameters_by_path(**ssm_dict)
|
||||
# Lookup by path
|
||||
if bypath:
|
||||
ssm_dict['Recursive'] = recursive
|
||||
for term in terms:
|
||||
ssm_dict["Path"] = term
|
||||
display.vvv("AWS_ssm path lookup term: %s in region: %s" % (term, region))
|
||||
try:
|
||||
response = client.get_parameters_by_path(**ssm_dict)
|
||||
except ClientError as e:
|
||||
raise AnsibleError("SSM lookup exception: {0}".format(to_native(e)))
|
||||
paramlist = list()
|
||||
paramlist.extend(response['Parameters'])
|
||||
|
||||
# Manual pagination, since boto doesnt support it yet for get_parameters_by_path
|
||||
# Manual pagination, since boto doesn't support it yet for get_parameters_by_path
|
||||
while 'NextToken' in response:
|
||||
response = client.get_parameters_by_path(NextToken=response['NextToken'], **ssm_dict)
|
||||
paramlist.extend(response['Parameters'])
|
||||
|
||||
# shorten parameter names. yes, this will return duplicate names with different values.
|
||||
if 'shortnames' in lparams:
|
||||
if shortnames:
|
||||
for x in paramlist:
|
||||
x['Name'] = x['Name'][x['Name'].rfind('/') + 1:]
|
||||
|
||||
display.vvvv("AWS_ssm path lookup returned: %s" % str(paramlist))
|
||||
if len(paramlist):
|
||||
return paramlist
|
||||
ret.append(boto3_tag_list_to_ansible_dict(paramlist,
|
||||
tag_name_key_name="Name",
|
||||
tag_value_key_name="Value"))
|
||||
else:
|
||||
return None
|
||||
# Lookup by parameter name
|
||||
else:
|
||||
ret.append({})
|
||||
# Lookup by parameter name - always returns a list with one or no entry.
|
||||
else:
|
||||
display.vvv("AWS_ssm name lookup term: %s" % terms)
|
||||
ssm_dict["Names"] = terms
|
||||
try:
|
||||
response = client.get_parameters(**ssm_dict)
|
||||
ret.update(response)
|
||||
if ret['Parameters']:
|
||||
return [ret['Parameters'][0]['Value']]
|
||||
else:
|
||||
return None
|
||||
except ClientError as e:
|
||||
raise AnsibleError("SSM lookup exception: {0}".format(to_native(e)))
|
||||
if len(response['Parameters']) == len(terms):
|
||||
ret = [p['Value'] for p in response['Parameters']]
|
||||
else:
|
||||
raise AnsibleError('Undefined AWS SSM parameter: %s ' % str(response['InvalidParameters']))
|
||||
|
||||
except ClientError as e:
|
||||
raise AnsibleError("SSM lookup exception: {0}".format(e))
|
||||
display.vvvv("AWS_ssm path lookup returning: %s " % str(ret))
|
||||
return ret
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue