File: //lib/python3/dist-packages/awscli/customizations/cloudtrail/__pycache__/subscribe.cpython-310.pyc
o
.&�aa5 � @ s� d dl Z d dlZd dlZddlmZ d dlmZ d dlmZ d dl m
Z
e� e �Z
dZdZG d d
� d
e�ZG d d � d e�ZG d
d� de�ZdS )� N� )�get_account_id)� BasicCommand)�s3_bucket_exists)� ClientErrorz6policy/S3/AWSCloudTrail-S3BucketPolicy-2014-12-17.jsonz7policy/SNS/AWSCloudTrail-SnsTopicPolicy-2014-12-17.jsonc @ s e Zd ZdS )�CloudTrailErrorN)�__name__�
__module__� __qualname__� r r �L/usr/lib/python3/dist-packages/awscli/customizations/cloudtrail/subscribe.pyr s r c
@ s� e Zd ZdZdZdZdZdddd�d d
d �d d
d �ddd �ddd �ddd �ddd �ddd �gZdZdZ dd� Z
dd � Z d d � Z d d � Z
d,d"d#�Zd,d$d%�Zd&d'� Zd(d)� Zd*d+� Zd!S )-�CloudTrailSubscribez�
Subscribe/update a user account to CloudTrail, creating the required S3 bucket,
the optional SNS topic, and starting the CloudTrail monitoring and logging.
zcreate-subscriptionz�Creates and configures the AWS resources necessary to use CloudTrail, creates a trail using those resources, and turns on logging.znaws cloudtrail create-subscription (--s3-use-bucket|--s3-new-bucket) bucket-name [--sns-new-topic topic-name]
�nameTzCloudtrail name)r �required� help_textz
s3-new-bucketz%Create a new S3 bucket with this name)r r z
s3-use-bucketz(Use an existing S3 bucket with this namez s3-prefixzS3 object prefixz
sns-new-topicz%Create a new SNS topic with this namez include-global-service-eventsz(Whether to include global service eventszs3-custom-policyz Custom S3 policy template or URLzsns-custom-policyz!Custom SNS policy template or URLFc C s | � ||� | �||� dS )Nr )�setup_services�_call)�self�args�parsed_globalsr r r � _run_main@ s z CloudTrailSubscribe._run_mainc C s� d d d�}|j d ur|j |d< |jd ur|j|d< t�d� | jjd
i |��| _| jjd i |��| _| jjd i |��| _| jj j
| _
|j d urL|j |d< | jjd
i |��| _ d S )N)� region_name�verifyr r z&Initializing S3, SNS and CloudTrail...�sts�s3�sns� endpoint_url�
cloudtrail)r )r )r )r )
�region�
verify_ssl�LOG�debug�_session�
create_clientr r r �metar r r )r r r � client_argsr r r r G s �
z"CloudTrailSubscribe.setup_servicesc C s� |j }|r|�� dkrd}n
|�� dkrd}ntd��|j}|jrX|j}| jrN|jdu rN| jj|j gd�}|d d }d
|v rNt
� d � |d
�� |d
|_| �
||j|j� n |sa| jsatd ��|jr�z
| �|j|j�}W n ty� |jr�| jj|jd
� � w z| �|j ||j|j|�}W n ty� |jr�| jj|jd
� |jr�| jj|d d� � w tj�dj tj |dd�d�� | js�| � |j � tj�dj ||jp�dd�� dS dS )z�
Run the command. Calls various services based on input options and
outputs the final CloudTrail configuration.
�trueT�falseFzFYou must pass either true or false to --include-global-service-events.N)�
trailNameList� trailListr � S3KeyPrefixzSetting S3 prefix to {0}zBYou must pass either --s3-use-bucket or --s3-new-bucket to create.��Bucket�TopicArn�r- z#CloudTrail configuration:
{config}
� )�indent)�configz,Logs will be delivered to {bucket}:{prefix}
� )�bucket�prefix) � include_global_service_events�lower�
ValueError�
s3_use_bucket�
s3_new_bucket�UPDATE� s3_prefixr �describe_trailsr r r! �format�setup_new_bucket�s3_custom_policy�
sns_new_topic�setup_new_topic�sns_custom_policy� Exceptionr �
delete_bucket�upsert_cloudtrail_configr � delete_topic�sys�stdout�write�json�dumps�start_cloudtrail) r �optionsr �gser3 �res�
trail_info� topic_result�cloudtrail_configr r r r ^ sz � �
�
� �� �
�
���zCloudTrailSubscribe._callc
C sT z| j jd| j |d�}|d �� �d�W S ty) } ztd| j||��d }~ww )Nzawscloudtrail-policy-)r, �Key�Bodyzutf-8zCUnable to get regional policy template for region %s: %s. Error: %s)r �
get_objectr �read�decoderC r )r �key_name�data�er r r � _get_policy� s ����z CloudTrailSubscribe._get_policyNc
C s& t j�dj|d�� t| j�}|r|�d�s|d7 }|dur!|}n| �t�}|� d|�� d|�}d|v r=|� d|p:d�}n|� d |pCd�}t
� d
�|�� t | j
|�}|r]td j|d���d |i}| jd
krod| ji}||d< | j
jdi |��} z | j
j||d� W | S ty� | j
j|d� � w )zx
Creates a new S3 bucket with an appropriate policy to let CloudTrail
write to the prefix path.
z%Setting up new S3 bucket {bucket}...
)r3 �/Nz <BucketName>z<CustomerAccountID>z <Prefix>/r2 z<Prefix>zBucket policy:
{0}z Bucket {bucket} already exists.r, z us-east-1�LocationConstraint�CreateBucketConfiguration)r, �Policyr+ r )rG rH rI r= r r �endswithr[ �S3_POLICY_TEMPLATE�replacer r! r r rC r �
create_bucket�put_bucket_policyr rD )
r r3 r4 �
custom_policy�
account_id�policy�
bucket_exists�params�
bucket_configrY r r r r> � sB
�
� �
��z$CloudTrailSubscribe.setup_new_bucketc s6 t j�dj� d�� t| j�}z | j�� d }W n ty( g }t �
d� Y nw � fdd�|D �r:tdj� d���| jj j }|durF|}n| �
t�}|�d |��d
|��d � �}| jj� d �}z)| jj|d
d�}| �|d d |�}t �d�|�� | jj|d
d|d� W |S ty� | jj|d
d� � w )zz
Creates a new SNS topic with an appropriate policy to let CloudTrail
post messages to the topic.
z$Setting up new SNS topic {topic}...
��topic�Topicsz$Unable to list topics, continuing...c s& g | ]}|d � d�d � kr|�qS )r- �:���)�split)�.0�trk r r �
<listcomp>� s & z7CloudTrailSubscribe.setup_new_topic.<locals>.<listcomp>z Topic {topic} already exists.Nz<Region>z<SNSTopicOwnerAccountId>z<SNSTopicName>��Namer- r. �
Attributesr_ zTopic policy:
{0})r- �
AttributeName�AttributeValue)rG rH rI r= r r r � list_topicsrC r �warnr$ r r[ �SNS_POLICY_TEMPLATErb � create_topic�get_topic_attributes�merge_sns_policyr! �set_topic_attributesrF ) r rl re rf �topicsr rg rQ �
topic_attrr rk r rA � sP
�
��
��� � ��z#CloudTrailSubscribe.setup_new_topicc C s2 t �|�}t �|�}|d |d 7 < t �|�S )a�
Merge two SNS topic policy documents. The id information from
``left`` is used in the final document, and the statements
from ``right`` are merged into ``left``.
http://docs.aws.amazon.com/sns/latest/dg/BasicStructure.html
:type left: string
:param left: First policy JSON document
:type right: string
:param right: Second policy JSON document
:rtype: string
:return: Merged policy JSON
� Statement)rJ �loadsrK )r �left�right� left_parsed� right_parsedr r r r~ % s
z$CloudTrailSubscribe.merge_sns_policyc C s� t j�d� d|i}|dur||d< |dur||d< |dur"||d< |dur*||d< | js7| jjdi |�� n | jjdi |�� | j�� S ) z�
Either create or update the CloudTrail configuration depending on
whether this command is a create or update command.
z.Creating/updating CloudTrail configuration...
ru N� S3BucketNamer* � SnsTopicName�IncludeGlobalServiceEventsr )rG rH rI r: r � create_trail� update_trailr< )r r r3 r4 rl rN r1 r r r rE 9 s �
z,CloudTrailSubscribe.upsert_cloudtrail_configc C s t j�d� | jj|d�S )zE
Start the CloudTrail service, which begins logging.
z Starting CloudTrail service...
rt )rG rH rI r �
start_logging)r r r r r rL P s z$CloudTrailSubscribe.start_cloudtrail)N)r r r
�__doc__�NAME� DESCRIPTION�SYNOPSIS� ARG_TABLEr: �
_UNDOCUMENTEDr r r r[ r> rA r~ rE rL r r r r r
sJ
�������M
4; r
c @ s e Zd ZdZdZdZdZdZdS )�CloudTrailUpdatezF
Like subscribe above, but the update version of the command.
zupdate-subscriptionTzlUpdates any of the trail configuration settings, and creates and configures any new AWS resources specified.zpaws cloudtrail update-subscription [(--s3-use-bucket|--s3-new-bucket) bucket-name] [--sns-new-topic topic-name]
N)r r r
r� r� r: r� r� r r r r r� X s r� )rJ �loggingrG �utilsr � awscli.customizations.commandsr �awscli.customizations.utilsr �botocore.exceptionsr � getLoggerr r ra r{ rC r r
r� r r r r �<module> s
: