Class: Chef::Knife::RdsSgFromDataBag

Inherits:
Chef::Knife show all
Includes:
RdsBase, RdsBaseDataBag
Defined in:
lib/chef/knife/rds_sg_from_data_bag.rb

Constant Summary

Constants included from RdsBase

Chef::Knife::RdsBase::APPLY_METHODS

Instance Method Summary collapse

Methods included from RdsBaseDataBag

#assert_data_bag_exists!, #assert_data_bag_item_exists!, #assert_data_bag_item_valid!, #assert_required_data_bag_options_present!, #data_bag_exists?, #data_bag_item, #defined_params, included, #required_data_bag_options

Methods included from RdsBase

#assert_name_args_at_least!, #assert_valid_apply_method!, #authenticate!, #connect!, included, #rds

Instance Method Details

#authorize_ec2_security_groups_to_db_security_group! ⇒ Object

assign ec2 security groups aws account id is REQUIRED. Currently, it must be exported as environment variable



107
108
109
110
111
112
113
114
115
116
117
118
119
120
 
# File 'lib/chef/knife/rds_sg_from_data_bag.rb', line 107

def authorize_ec2_security_groups_to_db_security_group!
  data_bag_item['ec2_security_groups'].each do |group|
    begin
      rds.client.authorize_db_security_group_ingress(
        db_security_group_name: db_security_group_name,
        ec2_security_group_owner_id: ,
        ec2_security_group_name: group
      )
      ui.info "#{group} applied"
    rescue AWS::RDS::Errors::AuthorizationAlreadyExists => e
      ui.info "#{group} already applied"
    end
  end
end

#authorize_ip_addresses_to_db_security_group! ⇒ Object

Assign ip addresses to security group



123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
 
# File 'lib/chef/knife/rds_sg_from_data_bag.rb', line 123

def authorize_ip_addresses_to_db_security_group!
  data_bag_item['ip_addresses'].each do |ip|
    begin
      rds.client.authorize_db_security_group_ingress(
        db_security_group_name: db_security_group_name,
        cidrip: ip
      )
    rescue AWS::RDS::Errors::InvalidParameterValue => e
      ui.info "Error applying ip #{ip}."
      ui.info e.message
    rescue AWS::RDS::Errors::AuthorizationAlreadyExists => e
      ui.info "#{ip} already applied."
    end

  end
end

#authorize_parameters_to_db_security_group! ⇒ Object

Assign all parameters from data bag to security group



56
57
58
59
 
# File 'lib/chef/knife/rds_sg_from_data_bag.rb', line 56

def authorize_parameters_to_db_security_group!
  authorize_ec2_security_groups_to_db_security_group!
  authorize_ip_addresses_to_db_security_group!
end

#aws_account_id ⇒ Object 



51
52
53
 
# File 'lib/chef/knife/rds_sg_from_data_bag.rb', line 51

def 
  ENV['AWS_ACCOUNT_ID']
end

#create_db_security_group! ⇒ Object

Create a new RDS Security group using the provideda data bag



141
142
143
144
145
146
 
# File 'lib/chef/knife/rds_sg_from_data_bag.rb', line 141

def create_db_security_group!
  rds.client.create_db_security_group(
    db_security_group_name: db_security_group_name,
    db_security_group_description: data_bag_item['description']
  )
end

#data_bag_item_name ⇒ Object

For use with base data bag module.



156
157
158
 
# File 'lib/chef/knife/rds_sg_from_data_bag.rb', line 156

def data_bag_item_name
  db_security_group_name
end

#db_security_group ⇒ Object

Load the DB Parameter Group resource from AWS using the API

Returns AWS::RDS::DBParameterGroup or nil



163
164
165
166
167
168
169
170
171
172
 
# File 'lib/chef/knife/rds_sg_from_data_bag.rb', line 163

def db_security_group
  unless @db_security_group
    begin
      @db_security_group = rds.client.describe_db_security_groups(db_security_group_name: db_security_group_name)
    rescue AWS::RDS::Errors::DBSecurityGroupNotFound => e
      @db_security_group = nil
    end
  end
  @db_security_group
end

#db_security_group_name ⇒ Object

The name of the database security group, extracted from name arguments

Returns string



151
152
153
 
# File 'lib/chef/knife/rds_sg_from_data_bag.rb', line 151

def db_security_group_name
  name_args.first
end

#revoke_ec2_security_groups_from_security_group! ⇒ Object

Revoke security groups that are not in the data bag



86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
 
# File 'lib/chef/knife/rds_sg_from_data_bag.rb', line 86

def revoke_ec2_security_groups_from_security_group!
  db_security_group[:db_security_groups].first[:ec2_security_groups].each do |eg|
    eg_name = eg[:ec2_security_group_name]
    unless data_bag_item['ec2_security_groups'].include?(eg_name)
      if eg[:status] == 'authorized'
        ui.info "Revoking access for #{eg_name}"
        rds.client.revoke_db_security_group_ingress(
          db_security_group_name: db_security_group_name,
          ec2_security_group_owner_id: ,
          ec2_security_group_name: eg_name
        )
      end
    else
      ui.info "Keeping #{eg_name}"
    end
  end
end

#revoke_ip_addresses_from_db_security_group! ⇒ Object

Revoke ip addresses belonging to group by NOT in data bag



68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
 
# File 'lib/chef/knife/rds_sg_from_data_bag.rb', line 68

def revoke_ip_addresses_from_db_security_group!
  db_security_group[:db_security_groups].first[:ip_ranges].each do |ip|
    cidr = ip[:cidrip]
    unless data_bag_item['ip_addresses'].include?(cidr)
      if ip[:status] == 'authorized'
        ui.info "Revoking access for #{cidr}"
        rds.client.revoke_db_security_group_ingress(
          db_security_group_name: db_security_group_name,
          cidrip: cidr
        )
      end
    else
      ui.info "Keeping #{cidr}"
    end
  end
end

#revoke_parameters_from_db_security_group! ⇒ Object

Remove all parameters NOT in data bag from security group



62
63
64
65
 
# File 'lib/chef/knife/rds_sg_from_data_bag.rb', line 62

def revoke_parameters_from_db_security_group!
  revoke_ec2_security_groups_from_security_group!
  revoke_ip_addresses_from_db_security_group!
end

#run ⇒ Object 



25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
 
# File 'lib/chef/knife/rds_sg_from_data_bag.rb', line 25

def run

  assert_name_args_at_least!(1, "Security group name is required!")

  assert_data_bag_item_valid!

  authenticate!

  if db_security_group.nil?
    ui.info("The security group #{db_security_group_name} does not exist.")
    confirm("Would you like to create it")
    create_db_security_group!
  else
    ui.info "The security group #{db_security_group_name} exists. Continuing..."
  end

  ui.info "Revoking parameters"
  revoke_parameters_from_db_security_group!
  ui.info "Authorizing parameters."
  authorize_parameters_to_db_security_group!

  ui.info("Assigned parameters to #{db_security_group_name}")
  exit 0

end