salt.states.boto_iam¶

Manage IAM objects¶

2015.8.0 新版功能.

This module uses boto, which can be installed via package, or pip.

This module accepts explicit IAM credentials but can also utilize IAM roles assigned to the instance through Instance Profiles. Dynamic credentials are then automatically obtained from AWS API and no further configuration is necessary. More information available here.

It's also possible to specify key, keyid and region via a profile, either passed in as a dict, or as a string to pull from pillars or minion config:

delete-user:
  boto_iam.user_absent:
    - name: myuser
    - delete_keys: true

delete-keys:
  boto_iam.keys_absent:
    - access_keys:
      - 'AKIAJHTMIQ2ASDFLASDF'
      - 'PQIAJHTMIQ2ASRTLASFR'
    - user_name: myuser

create-user:
  boto_iam.user_present:
    - name: myuser
    - policies:
        mypolicy: |
            {
                "Version": "2012-10-17",
                "Statement": [{
                "Effect": "Allow",
                "Action": "*",
                "Resource": "*"}]
            }
    - password: NewPassword$$1
    - region: eu-west-1
    - keyid: 'AKIAJHTMIQ2ASDFLASDF'
    - key: 'fdkjsafkljsASSADFalkfjasdf'

create-group:
  boto_iam.group_present:
    - name: mygroup
    - users:
      - myuser
      - myuser1
    - policies:
        mypolicy: |
            {
                "Version": "2012-10-17",
                "Statement": [{
                "Effect": "Allow",
                "Action": "*",
                "Resource": "*"}]
            }
    - region: eu-west-1
    - keyid: 'AKIAJHTMIQ2ASDFLASDF'
    - key: 'safsdfsal;fdkjsafkljsASSADFalkfj'

change-policy:
  boto_iam.account_policy:
    - change_password: True
    - region: eu-west-1
    - keyid: 'AKIAJHTMIQ2ASDFLASDF'
    - key: 'safsdfsal;fdkjsafkljsASSADFalkfj'

create server certificate:
  boto_iam.server_cert_present:
    - name: mycert
    - public_key: salt://base/mycert.crt
    - private_key: salt://base/mycert.key
    - cert_chain: salt://base/mycert_chain.crt
    - region: eu-west-1
    - keyid: 'AKIAJHTMIQ2ASDFLASDF'
    - key: 'fdkjsafkljsASSADFalkfjasdf'

delete server certificate:
  boto_iam.server_cert_absent:
    - name: mycert

create keys for user:
  boto_iam.keys_present:
    - name: myusername
    - number: 2
    - save_dir: /root
    - region: eu-west-1
    - keyid: 'AKIAJHTMIQ2ASDFLASDF'
    - key: 'fdkjsafkljsASSADFalkfjasdf'

create policy:
  boto_iam.policy_present:
    - name: myname
    - policy_document: '{"MyPolicy": "Statement": [{"Action": ["sqs:*"], "Effect": "Allow", "Resource": ["arn:aws:sqs:*:*:*"], "Sid": "MyPolicySqs1"}]}'
    - region: eu-west-1
    - keyid: 'AKIAJHTMIQ2ASDFLASDF'
    - key: 'fdkjsafkljsASSADFalkfjasdf'

salt.states.boto_iam.account_policy(allow_users_to_change_password=None, hard_expiry=None, max_password_age=None, minimum_password_length=None, password_reuse_prevention=None, require_lowercase_characters=None, require_numbers=None, require_symbols=None, require_uppercase_characters=None, region=None, key=None, keyid=None, profile=None)¶

Change account policy.

2015.8.0 新版功能.

allow_users_to_change_password (bool): Allows all IAM users in your account to use the AWS Management Console to change their own passwords.
hard_expiry (bool): Prevents IAM users from setting a new password after their password has expired.
max_password_age (int): The number of days that an IAM user password is valid.
minimum_password_length (int): The minimum number of characters allowed in an IAM user password.
password_reuse_prevention (int): Specifies the number of previous passwords that IAM users are prevented from reusing.
require_lowercase_characters (bool): Specifies whether IAM user passwords must contain at least one lowercase character from the ISO basic Latin alphabet (a to z).
require_numbers (bool): Specifies whether IAM user passwords must contain at least one numeric character (0 to 9).
require_symbols (bool): Specifies whether IAM user passwords must contain at least one of the following non-alphanumeric characters: ! @ # $ % ^ & * ( ) _ + - = [ ] { } | '
require_uppercase_characters (bool): Specifies whether IAM user passwords must contain at least one uppercase character from the ISO basic Latin alphabet (A to Z).
region (string): Region to connect to.
key (string): Secret key to be used.
keyid (string): Access key to be used.
profile (dict): A dict with region, key and keyid, or a pillar key (string)

salt.states.boto_iam.group_absent(name, region=None, key=None, keyid=None, profile=None)¶

2015.8.0 新版功能.

Ensure the IAM group is absent.

name (string): The name of the group.
region (string): Region to connect to.
key (string): Secret key to be used.
keyid (string): Access key to be used.
profile (dict): A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid.

salt.states.boto_iam.group_present(name, policies=None, policies_from_pillars=None, managed_policies=None, users=None, path='/', region=None, key=None, keyid=None, profile=None)¶

2015.8.0 新版功能.

Ensure the IAM group is present

name (string): The name of the new group.
path (string): The path for the group, defaults to '/'
policies (dict): A dict of IAM group policy documents.
policies_from_pillars (list): A list of pillars that contain role policy dicts. Policies in the pillars will be merged in the order defined in the list and key conflicts will be handled by later defined keys overriding earlier defined keys. The policies defined here will be merged with the policies defined in the policies argument. If keys conflict, the keys in the policies argument will override the keys defined in policies_from_pillars.
manaaged_policies (list): A list of policy names or ARNs that should be attached to this group.
users (list): A list of users to be added to the group.
region (string): Region to connect to.
key (string): Secret key to be used.
keyid (string): Access key to be used.
profile (dict): A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid.

salt.states.boto_iam.keys_absent(access_keys, user_name, region=None, key=None, keyid=None, profile=None)¶

2015.8.0 新版功能.

Ensure the IAM user access_key_id is absent.

access_key_id (list): A list of access key ids
user_name (string): The username of the user
region (string): Region to connect to.
key (string): Secret key to be used.
keyid (string): Access key to be used.
profile (dict): A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid.

salt.states.boto_iam.keys_present(name, number, save_dir, region=None, key=None, keyid=None, profile=None)¶

2015.8.0 新版功能.

Ensure the IAM access keys are present.

name (string): The name of the new user.
number (int): Number of keys that user should have.
save_dir (string): The directory that the key/keys will be saved. Keys are saved to a file named according to the username privided.
region (string): Region to connect to.
key (string): Secret key to be used.
keyid (string): Access key to be used.
profile (dict): A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid.

salt.states.boto_iam.policy_absent(name, region=None, key=None, keyid=None, profile=None)¶

2015.8.0 新版功能.

Ensure the IAM managed policy with the specified name is absent

name (string): The name of the new policy.
region (string): Region to connect to.
key (string): Secret key to be used.
keyid (string): Access key to be used.
profile (dict): A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid.

salt.states.boto_iam.policy_present(name, policy_document, path=None, description=None, region=None, key=None, keyid=None, profile=None)¶

2015.8.0 新版功能.

Ensure the IAM managed policy is present

name (string): The name of the new policy.
policy_document (dict): The document of the new policy
path (string): The path in which the policy will be created. Default is '/'.
description (string): Description
region (string): Region to connect to.
key (string): Secret key to be used.
keyid (string): Access key to be used.
profile (dict): A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid.

salt.states.boto_iam.server_cert_absent(name, region=None, key=None, keyid=None, profile=None)¶

Deletes a server certificate.

2015.8.0 新版功能.

name (string): The name for the server certificate. Do not include the path in this value.
region (string): The name of the region to connect to.
key (string): The key to be used in order to connect
keyid (string): The keyid to be used in order to connect
profile (string): The profile that contains a dict of region, key, keyid

salt.states.boto_iam.server_cert_present(name, public_key, private_key, cert_chain=None, path=None, region=None, key=None, keyid=None, profile=None)¶

Crete server certificate.

2015.8.0 新版功能.

name (string): The name for the server certificate. Do not include the path in this value.
public_key (string): The contents of the public key certificate in PEM-encoded format.
private_key (string): The contents of the private key in PEM-encoded format.
cert_chain (string): The contents of the certificate chain. This is typically a concatenation of the PEM-encoded public key certificates of the chain.
path (string): The path for the server certificate.
region (string): The name of the region to connect to.
key (string): The key to be used in order to connect
keyid (string): The keyid to be used in order to connect
profile (string): The profile that contains a dict of region, key, keyid

salt.states.boto_iam.user_absent(name, delete_keys=True, delete_mfa_devices=True, delete_profile=True, region=None, key=None, keyid=None, profile=None)¶

2015.8.0 新版功能.

Ensure the IAM user is absent. User cannot be deleted if it has keys.

name (string): The name of the new user.
delete_keys (bool): Delete all keys from user.
delete_mfa_devices (bool): Delete all mfa devices from user.

2016.3.0 新版功能.
delete_profile (bool): Delete profile from user.

2016.3.0 新版功能.
region (string): Region to connect to.
key (string): Secret key to be used.
keyid (string): Access key to be used.
profile (dict): A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid.

salt.states.boto_iam.user_present(name, policies=None, policies_from_pillars=None, managed_policies=None, password=None, path=None, region=None, key=None, keyid=None, profile=None)¶

2015.8.0 新版功能.

Ensure the IAM user is present

name (string): The name of the new user.
policies (dict): A dict of IAM group policy documents.
policies_from_pillars (list): A list of pillars that contain role policy dicts. Policies in the pillars will be merged in the order defined in the list and key conflicts will be handled by later defined keys overriding earlier defined keys. The policies defined here will be merged with the policies defined in the policies argument. If keys conflict, the keys in the policies argument will override the keys defined in policies_from_pillars.
managed_policies (list): A list of managed policy names or ARNs that should be attached to this user.
password (string): The password for the new user. Must comply with account policy.
path (string): The path of the user. Default is '/'.

2015.8.2 新版功能.
region (string): Region to connect to.
key (string): Secret key to be used.
keyid (string): Access key to be used.
profile (dict): A dict with region, key and keyid, or a pillar key (string) that contains a dict with region, key and keyid.