HEX
Server: Apache
System: Linux pdx1-shared-a1-38 6.6.104-grsec-jammy+ #3 SMP Tue Sep 16 00:28:11 UTC 2025 x86_64
User: mmickelson (3396398)
PHP: 8.1.31
Disabled: NONE
$ pwd: /lib/python3/dist-packages/awscli/customizations/cloudtrail/__pycache__/
Upload Files
File: //lib/python3/dist-packages/awscli/customizations/cloudtrail/__pycache__/validation.cpython-310.pyc
o

.&�aԜ�@s�ddlZddlZddlZddlZddlZddlZddlZddlZddlmZ	ddl
m
Z
mZddlm
Z
mZddlmZddlZddlmZmZddlmZddlmZdd	lmZe�e�Zd
ZdZdd
�Z dd�Z!dd�Z"dd�Z#dd�Z$dd�Z%			d,dd�Z&Gdd�de'�Z(Gdd�de)�Z*Gdd�de*�Z+Gd d!�d!e*�Z,Gd"d#�d#e'�Z-Gd$d%�d%e'�Z.Gd&d'�d'e'�Z/Gd(d)�d)e'�Z0Gd*d+�d+e�Z1dS)-�N)�error)�datetime�	timedelta)�tz�parser)�PyAsn1Error)�get_trail_by_arn�get_account_id_from_arn)�BasicCommand)�ClientError)�ParameterRequiredErrorz%Y%m%dT%H%M%SZz%Y-%m-%dT%H:%M:%SZcC�
|�t�S)z;Returns a formatted date string in a CloudTrail date format)�strftime�DATE_FORMAT��date�r�M/usr/lib/python3/dist-packages/awscli/customizations/cloudtrail/validation.py�format_date(�
rcCr
)z4Returns a formatted date string meant for CLI output)r�DISPLAY_DATE_FORMATrrrr�format_display_date-rrcCs|jt��d�S)z.Returns a normalized date using a UTC timezone)�tzinfo)�replacer�tzutcrrrr�normalize_date2srcCs|dd�S)z�Extract the timestamp portion of a manifest file.

    Manifest file names take the following form:
    AWSLogs/{account}/CloudTrail-Digest/{region}/{ymd}/{account}_CloudTrail     -Digest_{region}_{name}_region_{date}.json.gz
    i��i����r)�
digest_s3_keyrrr�extract_digest_key_date7srcCs(zt�|�WStytd|��w)NzUnable to parse date value: %s)r�parse�
ValueError)�date_stringrrr�
parse_dateAs
�r!cCs$t�d�}|�|�std|��dS)zlEnsures that the arn looks correct.

    ARNs look like: arn:aws:cloudtrail:us-east-1:123456789012:trail/fooz$arn:.+:cloudtrail:.+:\d{12}:trail/.+zInvalid trail ARN provided: %sN)�re�compile�matchr)�	trail_arn�patternrrr�assert_cloudtrail_arn_is_validHs

�r'c	Cs�t|�d}|dur4t||�}t�d|�|d}|�dd�}	|�d�}
|
r4|
s,td��|��dd}|�d	�d
}|�d�d}|
sHt|�}
t	|
|||||d
�}t
|||	|||t|�d�S)a�Creates a CloudTrail DigestTraverser and its object graph.

    :type cloudtrail_client: botocore.client.CloudTrail
    :param cloudtrail_client: Client used to connect to CloudTrail
    :type organization_client: botocore.client.organizations
    :param organization_client: Client used to connect to Organizations
    :type s3_client_provider: S3ClientProvider
    :param s3_client_provider: Used to create Amazon S3 client per/region.
    :param trail_arn: CloudTrail trail ARN
    :param trail_source_region: The scanned region of a trail.
    :param on_invalid: Callback that is invoked when validating a digest fails.
    :param on_gap: Callback that is invoked when a digest has no link to the
        previous digest, but there are more digests to validate. This can
        happen when a trail is disabled for a period of time.
    :param on_missing: Callback that is invoked when a digest file has been
        deleted from Amazon S3 but is supposed to be present.
    :param bucket: Amazon S3 bucket of the trail if it is different than the
        bucket that is currently associated with the trail.
    :param prefix: bucket: Key prefix prepended to each digest and log placed
        in the Amazon S3 bucket if it is different than the prefix that is
        currently associated with the trail.
    :param account_id: The account id for which the digest files are
        validated. For normal trails this is the caller account, for
        organization trails it is the member accout.

    ``on_gap``, ``on_invalid``, and ``on_missing`` callbacks are invoked with
    the following named arguments:

    - ``bucket`: The next S3 bucket.
    - ``next_key``: (optional) Next digest key that was found in the bucket.
    - ``next_end_date``: (optional) End date of the next found digest.
    - ``last_key``: The last digest key that was found.
    - ``last_start_date``: (optional) Start date of last found digest.
    - ``message``: (optional) Message string about the notification.
    NzLoaded trail info: %s�S3BucketName�S3KeyPrefix�IsOrganizationTrailzAMissing required parameter for organization trail: '--account-id'�Organization�Id�:��/���)�
account_id�
trail_name�s3_client_provider�trail_source_region�trail_home_region�organization_id)�digest_provider�starting_bucket�starting_prefix�
on_invalid�on_gap�
on_missing�public_key_provider)r'r�LOG�debug�getr�describe_organization�splitr	�DigestProvider�DigestTraverser�PublicKeyProvider)�cloudtrail_client�organization_clientr3r%r4r:r;r<�bucket�prefixr1r6�
trail_info�is_org_trail�trail_regionr2r7rrr�create_digest_traverserQsF(

�����rMc@s2eZdZdZddd�Zdd�Zdd�Zd	d
�ZdS)
�S3ClientProviderz�Creates Amazon S3 clients and determines the region name of a client.

    This class will cache the location constraints of previously requested
    buckets and cache previously created clients for the same region.
    �	us-east-1cCs||_||_i|_i|_dS�N)�_session�_get_bucket_location_region�
_client_cache�
_region_cache)�self�session�get_bucket_location_regionrrr�__init__�s
zS3ClientProvider.__init__cCs|�|�}|�|�S)z=Creates an S3 client that can work with the given bucket name)�_get_bucket_region�_create_client)rU�bucket_name�region_namerrr�
get_client�s

zS3ClientProvider.get_clientcCsB||jvr|�|j�}|j|d�}|dpd}||j|<|j|S)zReturns the region of a bucket)�Bucket�LocationConstraintrO)rTrZrR�get_bucket_location)rUr[�client�result�regionrrrrY�s


z#S3ClientProvider._get_bucket_regioncCs,||jvr|j�d|�}||j|<|j|S)z5Creates an Amazon S3 client for the given region name�s3)rSrQ�
create_client)rUr\rarrrrZ�s


zS3ClientProvider._create_clientN)rO)�__name__�
__module__�__qualname__�__doc__rXr]rYrZrrrrrN�s
	rNc@seZdZdZdS)�DigestErrorz0Exception raised when a digest fails to validateN)rfrgrhrirrrrrj�srjc� eZdZdZ�fdd�Z�ZS)�DigestSignatureErrorz3Exception raised when a digest signature is invalidc� d||f}tt|��|�dS)Nz=Digest file	s3://%s/%s	INVALID: signature verification failed)�superrlrX�rUrH�key�message��	__class__rrrX�s�zDigestSignatureError.__init__�rfrgrhrirX�
__classcell__rrrrrrl��rlcrk)�InvalidDigestFormatz4Exception raised when a digest has an invalid formatcrm)Nz.Digest file	s3://%s/%s	INVALID: invalid format)rnrwrXrorrrrrX�s�zInvalidDigestFormat.__init__rtrrrrrrw�rvrwc@� eZdZdZdd�Zdd�ZdS)rEz:Retrieves public keys from CloudTrail within a date range.cCs
||_dSrP)�_cloudtrail_client)rUrFrrrrX�s
zPublicKeyProvider.__init__cCs6|jj||d�}|d}t�d|�tdd�|D��S)a�Loads public keys in a date range into a returned dict.

        :type start_date: datetime
        :param start_date: Start date of a date range.
        :type end_date: datetime
        :param end_date: End date of a date range.
        :rtype: dict
        :return: Returns a dict where each key is the fingerprint of the
            public key, and each value is a dict of public key data.
        )�	StartTime�EndTime�
PublicKeyListzLoaded public keys in range: %scss�|]	}|d|fVqdS)�FingerprintNr)�.0rprrr�	<genexpr>�s�z4PublicKeyProvider.get_public_keys.<locals>.<genexpr>)ry�list_public_keysr>r?�dict)rU�
start_date�end_date�public_keys�public_keys_in_rangerrr�get_public_keys�s�z!PublicKeyProvider.get_public_keysN)rfrgrhrirXr�rrrrrE�srEc@s>eZdZdZ		d
dd�Zdd�Zdd�Zd	d
�Zdd�ZdS)rCa5
    Retrieves digest keys and digests from Amazon S3.

    This class is responsible for determining the full list of digest files
    in a bucket and loading digests from the bucket into a JSON decoded
    dict. This class is not responsible for validation or iterating from
    one digest to the next.
    NcCs,||_||_||_||_|p||_||_dSrP)�_client_providerr2r1r5r4r6)rUr3r1r2r5r4r6rrrrX�s

zDigestProvider.__init__cCs�g}|�||�}|j�|�}|�d�}|j||d�}	|	�d�}
tt|��}tt|tdd���}t	�
|�|��}
|
D]}|
�|�rUt
|�}||krL|S||krU|�|�q:|S)a�Returns a list of digest keys in the date range.

        This method uses a list_objects API call and provides a Marker
        parameter that is calculated based on the start_date provided.
        Amazon S3 then returns all keys in the bucket that start after
        the given key (non-inclusive). We then iterate over the keys
        until the date extracted from the yielded keys is greater than
        the given end_date.
        �list_objects)r^�MarkerzContents[*].Key�)�hours)�_create_digest_keyr�r]�
get_paginator�paginate�searchrrrr"r#�_create_digest_key_regexr$r�append)rUrHrIr�r��digests�markerra�	paginator�
page_iterator�
key_filter�target_start_date�target_end_date�digest_key_regexrp�extracted_daterrr�load_digest_keys_in_ranges*


�
�
�z(DigestProvider.load_digest_keys_in_rangec	Cs�|j�|�}|j||d�}zt�|d��tjdB�}t�|�	��}Wnt
tfy1t||��wd|dvs>d|dvrCt
||��|dd|d<|dd|d<||fS)	zlLoads a digest by key from S3.

        Returns the JSON decode data and GZIP inflated raw content.
        �r^�Key�Body��	signature�Metadatazsignature-algorithm�
_signature�_signature_algorithm)r�r]�
get_object�zlib�
decompress�read�	MAX_WBITS�json�loads�decoder�	ZLibErrorrwrl)rUrHrprarb�digest�digest_datarrr�fetch_digest#s"�
�

�zDigestProvider.fetch_digestcCsz|tdd�}d}|jt|�|�d�|j|j|jd�}|jr'|d7}|j|d<|d7}|jdi|��}|r;|d	|}|S)a~Computes an Amazon S3 key based on the provided data.

        The computed is what would have been placed in the S3 bucket if
        a log digest were created at a specific time. This computed key
        does not have to actually exist as it will only be used to as
        a Marker parameter in a list_objects call.

        :return: Returns a computed key as a string.
        r�)�minutes�AWSLogs/z%Y/%m/%d)r1r�ymd�
source_region�home_region�name�{organization_id}/r6z�{account_id}/CloudTrail-Digest/{source_region}/{ymd}/{account_id}_CloudTrail-Digest_{source_region}_{name}_{home_region}_{date}.json.gzr/Nr)	rr1rrr4r5r2r6�format)rUr��
key_prefixr�template�template_paramsrprrrr�:s&�
�z!DigestProvider._create_digest_keycCs�d}t�|j�t�|j�t�|j�t�|j�d�}|jr%|d7}|j|d<|d7}|jd
i|��}|r<t�|�d|}d|dS)z:Creates a regular expression used to match against S3 keysr�)r1r�r�r�r�r6z�{account_id}/CloudTrail\-Digest/{source_region}/\d+/\d+/\d+/{account_id}_CloudTrail\-Digest_{source_region}_{name}_{home_region}_.+\.json\.gzr/�^�$Nr)r"�escaper1r4r5r2r6r�)rUr�r�r�rprrrr�\s 



�
�z'DigestProvider._create_digest_key_regex�NN)	rfrgrhrirXr�r�r�r�rrrrrC�s	
�
""rCc@s^eZdZdZgd�Z		ddd�Zddd�Zdd	�Z	ddd�Zdd
d�Z	dd�Z
dd�ZdS)rDz4Retrieves and validates digests within a date range.)�digestPublicKeyFingerprint�digestS3Bucket�digestS3Object�previousDigestSignature�
digestEndTime�digestStartTimeNc		CsB||_||_||_||_||_||_||_|durt�}||_dS)a�
        :type digest_provider: DigestProvider
        :param digest_provider: DigestProvider object
        :param starting_bucket: S3 bucket where the digests are stored.
        :param starting_prefix: An optional prefix applied to each S3 key.
        :param public_key_provider: Provides public keys for a range.
        :param digest_validator: Validates digest using a validate method.
        :param on_invalid: Callback invoked when a digest is invalid.
        :param on_gap: Callback invoked when a digest has no parent, but
            there are still more digests to validate.
        :param on_missing: Callback invoked when a digest file is missing.
        N)	r8r9r7�_public_key_provider�_on_gap�_on_invalid�_on_missing�Sha256RSADigestValidator�_digest_validator)	rUr7r8r9r=�digest_validatorr:r;r<rrrrX{s
zDigestTraverser.__init__ccs��|dur	t��}t|�}t|�}|j}|j}|�||||�}|�||�}|�|�\}}|}|r�||kr�zA|�|||�\}	}tt	|	d��}|	�
dd�}
|	V|
durb|j|||||jdd�\}}n|	d}|
|krt|
}|�||||�}Wntt
y�}z!|jddd	kr�|�|j|||||jt|�d
�\}}WYd}~nLd}~wty�}z|j|||||jt|�d
�\}}WYd}~n+d}~wty�}z|j|||||jd||t|�fd
�\}}WYd}~nd}~ww|r�||ks4dSdSdSdS)aaCreates and returns a generator that yields validated digest data.

        Each yielded digest dictionary contains information about the digest
        and the log file associated with the digest. Digest files are validated
        before they are yielded. Whether or not the digest is successfully
        validated is stated in the "isValid" key value pair of the yielded
        dictionary.

        :type start_date: datetime
        :param start_date: Date to start validating from (inclusive).
        :type start_date: datetime
        :param end_date: Date to stop validating at (inclusive).
        Nr��previousDigestS3BucketT)r�rH�last_key�last_start_date�cb�is_cb_conditional�previousDigestS3Object�Error�Code�	NoSuchKey)r�rHr�r�r�rqz"Digest file	s3://%s/%s	INVALID: %s)r�utcnowrr8r9�
_load_digests�_load_public_keys�_get_last_digest�_load_and_validate_digestr!r@�_find_next_digestr�r�responser��strrjr��	Exception)rUr�r�rHrIr�r�rpr�r��previous_bucket�errr�traverse�sz��
�������������zDigestTraverser.traversecCs|jj||||d�S)N)rHrIr�r�)r7r�)rUrHrIr�r�rrrr��s�zDigestTraverser._load_digestsFc
Cs8|�||�\}}	|r|r|r|||||	||d�||	fS)z=Finds the next digest in the bucket and invokes any callback.)rH�next_keyr��
next_end_dater�rq)r�)
rUr�rHr�r�r�r�rqr�r�rrrr��s�z!DigestTraverser._find_next_digestcCs||sdS|dur|��}ttt|���}||fStt|��}|r<|��}ttt|���}||kr:t�d|�||fS|s dS)z�Finds the previous digest key (either the last or before before_key)

        If no key is provided, the last digest is used. If a digest is found,
        the end date of the provider is adjusted to match the found key's end
        date.
        r�NzNext found key: %s)�poprr!rr>r?)rUr��
before_keyr��
next_key_date�before_key_daterrrr��s&
�
��z DigestTraverser._get_last_digestc
Cs�|j�||�\}}|jD]}||vrt||��q|d|ks$|d|kr,td||f��|d}||vr@td|||jj|f��||d}|j�|||||�tt	|d��}	||	fS)z�Loads and validates a digest from S3.

        :param public_keys: Public key dictionary of fingerprint to dict.
        :return: Returns a tuple of the digest data as a dict and end_date
        :rtype: tuple
        r�r�zIDigest file	s3://%s/%s	INVALID: has been moved from its original locationr�zTDigest file	s3://%s/%s	INVALID: public key not found in region %s for fingerprint %s�Valuer�)
r7r��required_digest_keysrwrjr5r��validaterr!)
rUr�rHrpr�r��required_key�fingerprint�public_key_hexr�rrrr��s6

���
���
�z)DigestTraverser._load_and_validate_digestcCs.|j�||�}|stdt|�t|�f��|S)Nz&No public keys found between %s and %s)r�r��RuntimeErrorr)rUr�r�r�rrrr�s����z!DigestTraverser._load_public_keys)NNNNrP)NFN)rfrgrhrir�rXr�r�r�r�r�r�rrrrrDss
�
A
�

rDc@rx)r�z�
    Validates SHA256withRSA signed digests.

    The result of validating the digest is inserted into the digest_data
    dictionary using the isValid key value pair.
    c		Cs�z$t�|�}tjj|dd�}|�||�}t�|d�}t�|||�WdSt	y6t
d|||df��tjjyCt
||��w)a�Validates a digest file.

        Throws a DigestError when the digest is invalid.

        :param bucket: Bucket of the digest file
        :param key: Key of the digest file
        :param public_key: Public key bytes.
        :param digest_data: Dict of digest data returned when JSON
            decoding a manifest.
        :param inflated_digest: Inflated digest file contents as bytes.
        �DER)r�r�zNDigest file	s3://%s/%s	INVALID: Unable to load PKCS #1 key with fingerprint %sr�N)�base64�	b64decode�rsa�	PublicKey�
load_pkcs1�_create_string_to_sign�binascii�	unhexlify�verifyrrj�pkcs1�VerificationErrorrl)	rUrHrp�
public_keyr��inflated_digest�decoded_key�to_sign�signature_bytesrrrr�0s
��
�z!Sha256RSADigestValidator.validatecCsP|d}|dur
d}d|d|d|dt�|���|f}t�d|�|��S)Nr��nullz%s
%s/%s
%s
%sr�r�r�zDigest string to sign: %s)�hashlib�sha256�	hexdigestr>r?�encode)rUr�r��previous_signature�string_to_signrrrr�Ns�z/Sha256RSADigestValidator._create_string_to_signN)rfrgrhrir�r�rrrrr�(sr�cs�eZdZdZdZdZddddd�d	ddd
d�dddd
�dddd
�dddd
�dddd
�ddddd�gZ�fdd�Zdd�Zdd�Z	dd �Z
d!d"�Zd#d$�Zd%d&�Z
d<d(d)�Zd*d+�Zd,d-�Zd.d/�Zd0d1�Zd2d3�Zd4d5�Zd6d7�Zd8d9�Zd:d;�Z�ZS)=�CloudTrailValidateLogszN
    Validates log digests and log files, optionally saving them to disk.
    z
validate-logsa�
    Validates CloudTrail logs for a given period of time.

    This command uses the digest files delivered to your S3 bucket to perform
    the validation.

    The AWS CLI allows you to detect the following types of changes:

    - Modification or deletion of CloudTrail log files.
    - Modification or deletion of CloudTrail digest files.

    To validate log files with the AWS CLI, the following preconditions must
    be met:

    - You must have online connectivity to AWS.
    - You must have read access to the S3 bucket that contains the digest and
      log files.
    - The digest and log files must not have been moved from the original S3
      location where CloudTrail delivered them.
    - For organization trails you must have access to describe-organization to
      validate digest files

    When you disable Log File Validation, the chain of digest files is broken
    after one hour. CloudTrail will not digest log files that were delivered
    during a period in which the Log File Validation feature was disabled.
    For example, if you enable Log File Validation on January 1, disable it
    on January 2, and re-enable it on January 10, digest files will not be
    created for the log files delivered from January 3 to January 9. The same
    applies whenever you stop CloudTrail logging or delete a trail.

    .. note::

        Log files that have been downloaded to local disk cannot be validated
        with the AWS CLI. The CLI will download all log files each time this
        command is executed.

    .. note::

        This command requires that the role executing the command has
        permission to call ListObjects, GetObject, and GetBucketLocation for
        each bucket referenced by the trail.

    z	trail-arnT�stringz.Specifies the ARN of the trail to be validated)r��required�
cli_type_name�	help_textz
start-timez�Specifies that log files delivered on or after the specified UTC timestamp value will be validated. Example: "2015-01-08T05:21:42Z".zend-timez�Optionally specifies that log files delivered on or before the specified UTC timestamp value will be validated. The default value is the current time. Example: "2015-01-08T12:31:41Z".)r�r	r
z	s3-bucketz�Optionally specifies the S3 bucket where the digest files are stored. If a bucket name is not specified, the CLI will retrieve it by calling describe_trailsz	s3-prefixz�Optionally specifies the optional S3 prefix where the digest files are stored. If not specified, the CLI will determine the prefix automatically by calling describe_trails.z
account-idz�Optionally specifies the account for validating logs. This parameter is needed for organization trails for validating logs for specific account inside an organization�verbose�boolean�
store_truez*Display verbose log validation information)r�r	�actionr
csztt|��|�d|_d|_d|_d|_d|_d|_d|_	d|_
d|_d|_d|_
d|_d|_d|_d|_d|_d|_dS)NFrT)rnrrXr%�
is_verbose�
start_time�end_time�	s3_bucket�	s3_prefixr3rFr1�_source_region�_valid_digests�_invalid_digests�_valid_logs�
_invalid_logs�_is_last_status_double_space�_found_start_time�_found_end_time)rUrVrrrrrX�s$
zCloudTrailValidateLogs.__init__cCs8|�|�|�|�|��|jdks|jdkrdSdS)Nrr�)�handle_args�setup_services�_callrr)rU�args�parsed_globalsrrr�	_run_main�s

z CloudTrailValidateLogs._run_maincCs~|j|_|j|_|j|_|j|_|j|_tt|j��|_|j	r(tt|j	��|_	ntt
���|_	|j|j	kr9td��|j|_
dS)NzCInvalid time range specified: start-time must occur before end-time)r%rrrrr1rr!rrrr�rr)rUrrrrr�sz"CloudTrailValidateLogs.handle_argscCsj|j|_t|j|j�|_|j|jd�}|jj	di|��|_|jdur(|j|d<|jj	di|��|_	dS)N)r\r��
organizations�endpoint_url�
cloudtrail)r")r$)
rcrrNrQr3�
verify_sslrerGr#rF)rUr �client_argsrrrr�s&����

��z%CloudTrailValidateLogs.setup_servicesc
Cs�t|j|j|j|j|j|j|j|j|j	|j
|jd�}|��|�
|j|j�}|D],}|�|�|jd7_|�d|d|df�|dsHq(|dD]}|�|�qLq(|��dS)N)r%rFrGr4r3rHrIr<r:r;r1r�zDigest file	s3://%s/%s	validr�r��logFiles)rMr%rFrGrr3rr�_on_missing_digest�_on_invalid_digest�_on_digest_gapr1�_write_startup_textr�rr�_track_found_timesr�
_write_status�
_download_log�_write_summary_text)rU�	traverserr�r��logrrrr�s2�
���zCloudTrailValidateLogs._callcCsDt|d�}||jkr||_|js t|d�}t||j�|_dSdS)Nr�r�)r!rrr�minr)rUr��digest_start_time�digest_end_timerrrr,s
�z)CloudTrailValidateLogs._track_found_timesc

s4zi|j�|d�}|j|d|dd��t�tjdB�}t��}t�fdd�d�D]}|�	|�}|�
|�q)|��}|rA|�
|�|��}||dkrS|�
|�WdS|jd	7_|�d
|d|df�WdSty�}	z|	jddd
kr{�|�|�WYd}	~	dSd}	~	wty�|�|�YdSw)z9 Download a log, decompress, and compare SHA256 checksums�s3Bucket�s3Objectr�r�cs�d�d�S)Nr�i)r�r�r�rr�<lambda>sz6CloudTrailValidateLogs._download_log.<locals>.<lambda>��	hashValuer�zLog file	s3://%s/%s	validr�r�r�N)r3r]r�r��
decompressobjr�rr�iterr��update�flushr�_on_log_invalidrr-rr��_on_missing_logr��_on_invalid_log_format)
rUr1ra�
gzip_inflater�rolling_hash�chunk�data�remaining_data�
computed_hashr�rr7rr.s8�

���z$CloudTrailValidateLogs._download_logFcCsZ|r|jrtj�d|�ntj�d|�d|_dS|jr+d|_tj�d|�dSdS)Nz%s

z
%s

TFz%s
)r�sys�stderr�writer�stdout)rUrq�is_errorrrrr-/s
�z$CloudTrailValidateLogs._write_statuscCs(tj�d|jt|j�t|j�f�dS)Nz5Validating log files for trail %s between %s and %s

)rHrKrJr%rrr�rUrrrr+:s���z*CloudTrailValidateLogs._write_startup_textcCs�|js	tj�d�tj�dt|j�t|j�f�|js'|js'tj�d�dS|j	r-|j
s4tj�d�ntj�dt|j	�t|j
�f�|�|j|jd�|�|j|j
d�tj�d�dS)N�
zResults requested for %s to %s
zNo digests found
z No valid digests found in range
zResults found for %s to %s:
r�r1)rrHrKrJrrrrrrr�_write_ratiorrrMrrrr/@s(����z*CloudTrailValidateLogs._write_summary_textcCsP||}|dkr$tj�d|||f�|dkr&tj�d|||f�dSdSdS)Nrz
%d/%d %s files validz, %d/%d %s files INVALID)rHrKrJ)rU�valid�invalidr��totalrrrrOSs��z#CloudTrailValidateLogs._write_ratiocKs&|jd7_|�d||fd�dS)Nr�z)Digest file	s3://%s/%s	INVALID: not foundT�rr-)rUrHr��kwargsrrrr([s��z)CloudTrailValidateLogs._on_missing_digestcKs(|�dt|d�t|d�fd�dS)Nz;No log files were delivered by CloudTrail between %s and %sr�r�T)r-r)rUrTrrrr*`s

���z%CloudTrailValidateLogs._on_digest_gapcKs|jd7_|�|d�dS)Nr�TrS)rUrqrTrrrr)fsz)CloudTrailValidateLogs._on_invalid_digestcC�.|jd7_|�d|d|dfd�dS)Nr�z+Log file	s3://%s/%s	INVALID: invalid formatr5r6T�rr-�rU�log_datarrrrAj���z-CloudTrailValidateLogs._on_invalid_log_formatcCrU)Nr�z5Log file	s3://%s/%s	INVALID: hash value doesn't matchr5r6TrVrWrrrr?prYz&CloudTrailValidateLogs._on_log_invalidcCrU)Nr�z&Log file	s3://%s/%s	INVALID: not foundr5r6TrVrWrrrr@vrYz&CloudTrailValidateLogs._on_missing_log)F)rfrgrhri�NAME�DESCRIPTION�	ARG_TABLErXr!rrrr,r.r-r+r/rOr(r*r)rAr?r@rurrrrrr]sX-��������
r)NNNNNNN)2r�r�r�r�loggingr"rHr�rr�rr�dateutilrr�pyasn1.errorrr��&awscli.customizations.cloudtrail.utilsrr	�awscli.customizations.commandsr
�botocore.exceptionsr�
awscli.schemar�	getLoggerrfr>rrrrrrr!r'rM�objectrNrrjrlrwrErCrDr�rrrrr�<module>sR


�N#65
@ Telegram