ó
¡ôXc @ s€ d d l Z d d l Z d d l Z d d l Z d d l m Z m Z d d l m Z d d l m
Z
d e
f d „ ƒ YZ d S( iÿÿÿÿN( t Argt MutuallyExclusiveArgList( t
ArgumentError( t
STSRequestt
AssumeRolec B s| e Z d Z e d d d d d4 d d ƒe d d d d
d d d e d
d d d ƒe d d d d d d d ƒe e d d d d d4 d d d d ƒe d d d d d4 d d d d ƒƒ e e d d d d d d d ƒe d d d d d! d e d d" ƒƒ e d# d d$ d d% d d& ƒe d' d d( d d) d d* ƒe d+ d d, d d- d d. ƒg Z d/ „ Z d0 „ Z
d1 „ Z d2 „ Z d3 „ Z
RS(5 sˆ Assume an IAM role
The %(prog)s utility obtains credentials for an IAM role and
outputs them in the form of shellcode that sets environment
variables that allow euca2ools commands to use them. Use it
inside an eval command to make this process seamless:
$ eval `%(prog)s myrole`
To stop using the role, use euare-releaserole(1).t rolenamet metavart ROLEt route_tot helps the role to assumes -ds
--durationt destt DurationSecondst SECONDSt typet defaulti„ s_ number of seconds the
credentials should be valid for (900-3600) (default: 900)s --session-namet RoleSessionNamet PATHsc role session identifier to include in the
assumed role user ID (default: automatic)s -ct
csh_outputt actiont
store_truesf generate C-shell commands on
stdout (default if SHELL looks like a csh-style shells -st sh_outputs‡ generate Bourne shell
commands on stdout (default if SHELL does not look
like a csh-style shells --policy-contentt Policyt POLICY_CONTENTs´ an IAM policy
further restricting what the credentials will be
allowed to do. This cannot grant additional
permissions.s --policy-documentt FILEsÄ file containing
an IAM policy further restricting what the
credentials will be allowed to do. This cannot
grant additional permissions.s
--external-idt
ExternalIdt STRs/ external ID to use for comparison with policiess --mfa-serialt SerialNumbert MFAs MFA token serial numbers
--mfa-codet TokenCodet CODEs MFA token codec C s` | j | j j d ƒ ƒ | j d <| j j d ƒ s\ t j j ƒ j d ƒ } | | j d <n d S( NR t RoleArnR s euca2ools-%Y-%m-%dT%H-%M-%SZ( t _AssumeRole__build_role_arnt argst gett paramst datetimet utcnowt strftime( t selft session( ( sE /usr/lib/python2.7/site-packages/euca2ools/commands/sts/assumerole.pyt
preprocessS s c C s | j d ƒ d k r< d | k r< d j | j d ƒ Œ } n | j d ƒ d k rˆ | j d ƒ sm d | } n d j | j ƒ | ƒ } n | j d ƒ d k rª d | } n | j d ƒ d k rÌ d | } n | j d ƒ d
k rî d | } n | j d ƒ d k rd
| } n | S( sj
Build an ARN for a role from the fragment that was supplied at
the command line.
t :i t /s {0}:role/{1}i s role/s {0}:{1}i s iam:i s aws:i s arn:( t countt formatt splitt
startswitht _AssumeRole__get_account_id( R& t arn( ( sE /usr/lib/python2.7/site-packages/euca2ools/commands/sts/assumerole.pyt __build_role_arn[ s !
c C sC | j j d ƒ } | s* t j d ƒ } n | s? t d ƒ ‚ n | S( Ns
account-idt EC2_USER_IDsn failed to determine account ID; set account-id for the user in configuration or EC2_USER_ID in the environment( t configt get_user_optiont ost getenvR ( R& t
account_id( ( sE /usr/lib/python2.7/site-packages/euca2ools/commands/sts/assumerole.pyt __get_account_idx s c C s | d } | j d | d ƒ | j d | d ƒ | j d | d ƒ | j d | d ƒ | j d | d ƒ | j d | d ƒ | j d
| d ƒ | j d | d ƒ | j d
| d ƒ | j d | j d j d ƒ d ƒ | j d d ƒ Hd GHd j d j d „ t j Dƒ ƒ ƒ GHd S( Nt Credentialst AWS_ACCESS_KEY_IDt AccessKeyIdt AWS_ACCESS_KEYt EC2_ACCESS_KEYt AWS_SECRET_ACCESS_KEYt SecretAccessKeyt AWS_SECRET_KEYt EC2_SECRET_KEYt AWS_SESSION_TOKENt SessionTokent AWS_SECURITY_TOKENt AWS_CREDENTIAL_EXPIRATIONt
ExpirationR2 R R) i t AWS_CREDENTIAL_FILEs5 # If you can read this, rerun this program with eval:s # eval `{0}`t c s s | ] } t j | ƒ Vq d S( N( t pipest quote( t .0t arg( ( sE /usr/lib/python2.7/site-packages/euca2ools/commands/sts/assumerole.pys <genexpr>• s ( t _AssumeRole__print_varR" R- t NoneR, t joint syst argv( R& t resultt creds( ( sE /usr/lib/python2.7/site-packages/euca2ools/commands/sts/assumerole.pyt print_resultƒ s
$c C sˆ | j j d ƒ s@ | j j d ƒ rX t j d d ƒ j d ƒ rX | rO d } qm d } n | rg d } n d } | j d
| d | ƒ GHd S( NR R t SHELLt t cshs setenv {key} {val};s unsetenv {key};s {key}={val}; export {key};s unset {key};t keyt val( R R! R5 R6 t endswithR, ( R& RX RY t fmt( ( sE /usr/lib/python2.7/site-packages/euca2ools/commands/sts/assumerole.pyt __print_var— s N( t __name__t
__module__t DESCRIPTIONR RN t intR t opent ARGSR( R R/ RT RM ( ( ( sE /usr/lib/python2.7/site-packages/euca2ools/commands/sts/assumerole.pyR % sB ( R# R5 RI RP t requestbuilderR R t requestbuilder.exceptionsR t euca2ools.commands.stsR R ( ( ( sE /usr/lib/python2.7/site-packages/euca2ools/commands/sts/assumerole.pyt <module> s