Class: Sfn::Callback::StackPolicy

Inherits:
Sfn::Callback show all
Defined in:
lib/sfn/callback/stack_policy.rb

Constant Summary collapse

DEFENSELESS_POLICY =

Policy to apply prior to stack deletion

{
  "Statement" => [{
    "Effect" => "Allow",
    "Action" => "Update:*",
    "Resource" => "*",
    "Principal" => "*",
  }],
}

Instance Attribute Summary collapse

Attributes inherited from Sfn::Callback

#api, #arguments, #config, #ui

Instance Method Summary collapse

Methods inherited from Sfn::Callback

#run_action

Constructor Details

#initialize(*args) ⇒ self

Overload to init policy cache



23
24
25
26
 
# File 'lib/sfn/callback/stack_policy.rb', line 23

def initialize(*args)
  super
  @policies = Smash.new
end

Instance Attribute Details

#policies ⇒ Smash (readonly)

Returns cached policies.

Returns:

  • (Smash) —

    cached policies



18
19
20
 
# File 'lib/sfn/callback/stack_policy.rb', line 18

def policies
  @policies
end

Instance Method Details

#before_update(args) ⇒ Object

Disable all existing policies prior to update

Parameters:

  • args (Hash) 


48
49
50
51
52
53
54
55
56
57
58
59
 
# File 'lib/sfn/callback/stack_policy.rb', line 48

def before_update(args)
  if config.get(:stack_policy, :update).to_s == "defenseless"
    ui.warn "Disabling all stack policies for update."
    stack = args[:api_stack]
    ([stack] + stack.nested_stacks).compact.each do |p_stack|
      @policies[p_stack.name] = DEFENSELESS_POLICY
      run_action "Disabling stack policy for #{ui.color(p_stack.name, :yellow)}" do
        save_stack_policy(p_stack)
      end
    end
  end
end

#save_stack_policy(p_stack) ⇒ NilClass

Save the cached policy for the given stack

Parameters:

  • p_stack (Miasma::Models::Orchestration::Stack)

Returns:

  • (NilClass) 


76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
 
# File 'lib/sfn/callback/stack_policy.rb', line 76

def save_stack_policy(p_stack)
  valid_logical_ids = p_stack.resources.reload.all.map(&:logical_id)
  stack_policy = @policies.fetch(p_stack.id,
                                 @policies.fetch(p_stack.data[:logical_id]),
                                 @policies[p_stack.name]).to_smash
  if stack_policy
    stack_policy[:Statement].delete_if do |policy_item|
      policy_match = policy_item[:Resource].to_s.match(
        %r{LogicalResourceId/(?<logical_id>.+)$}
      )
      if policy_match
        !valid_logical_ids.include?(policy_match["logical_id"])
      end
    end
  end
  result = p_stack.api.request(
    :path => "/",
    :method => :post,
    :form => Smash.new(
      "Action" => "SetStackPolicy",
      "StackName" => p_stack.id,
      "StackPolicyBody" => MultiJson.dump(stack_policy),
    ),
  )
end

#submit_policy(args) ⇒ Object Also known as: after_create, after_update

Submit all cached policies

Parameters:

  • args (Hash) 


31
32
33
34
35
36
37
38
39
40
 
# File 'lib/sfn/callback/stack_policy.rb', line 31

def submit_policy(args)
  ui.info "Submitting stack policy documents"
  stack = args[:api_stack]
  ([stack] + stack.nested_stacks).compact.each do |p_stack|
    run_action "Applying stack policy to #{ui.color(p_stack.name, :yellow)}" do
      save_stack_policy(p_stack)
    end
  end
  ui.info "Stack policy documents successfully submitted!"
end

#template(info) ⇒ Object

Generate stack policy for stack and cache for the after hook to handle

Parameters:

  • info (Hash) 


65
66
67
68
69
70
 
# File 'lib/sfn/callback/stack_policy.rb', line 65

def template(info)
  if info[:sparkle_stack]
    @policies.set(info.fetch(:stack_name, "unknown"),
                  info[:sparkle_stack].generate_policy)
  end
end