??????????????
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 173
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 174
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 175
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 176
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 177
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 178
Udac @` s d d l m Z m Z m Z e Z i d d 6d g d 6d d 6Z d Z d Z d
Z d d l
Z
d d l Z y( d d l Z
d d l Z
d d l Z
Wn e k
r n Xd d l m Z d d
l m Z m Z m Z m Z m Z d Z d Z d Z d Z d Z d Z d Z d Z d Z! d d d Z# d d d d d Z$ d d d d Z% d d d d d d Z& d Z' d Z( d Z) e* d k re) n d S( i ( t absolute_importt divisiont print_functions 1.1t metadata_versiont stableinterfacet statust communityt supported_bys
---
module: iam
short_description: Manage IAM users, groups, roles and keys
description:
- Allows for the management of IAM users, user API keys, groups, roles.
version_added: "2.0"
options:
iam_type:
description:
- Type of IAM resource
choices: ["user", "group", "role"]
type: str
name:
description:
- Name of IAM resource to create or identify
required: true
type: str
new_name:
description:
- When state is update, will replace name with new_name on IAM resource
type: str
new_path:
description:
- When state is update, will replace the path with new_path on the IAM resource
type: str
state:
description:
- Whether to create, delete or update the IAM resource. Note, roles cannot be updated.
required: true
choices: [ "present", "absent", "update" ]
type: str
path:
description:
- When creating or updating, specify the desired path of the resource. If state is present,
it will replace the current path to match what is passed in when they do not match.
default: "/"
type: str
trust_policy:
description:
- The inline (JSON or YAML) trust policy document that grants an entity permission to assume the role. Mutually exclusive with C(trust_policy_filepath).
version_added: "2.2"
type: dict
trust_policy_filepath:
description:
- The path to the trust policy document that grants an entity permission to assume the role. Mutually exclusive with C(trust_policy).
version_added: "2.2"
type: str
access_key_state:
description:
- When type is user, it creates, removes, deactivates or activates a user's access key(s). Note that actions apply only to keys specified.
choices: [ "create", "remove", "active", "inactive", "Create", "Remove", "Active", "Inactive"]
type: str
key_count:
description:
- When access_key_state is create it will ensure this quantity of keys are present. Defaults to 1.
default: 1
type: int
access_key_ids:
description:
- A list of the keys that you want impacted by the access_key_state parameter.
type: list
groups:
description:
- A list of groups the user should belong to. When update, will gracefully remove groups not listed.
type: list
password:
description:
- When type is user and state is present, define the users login password. Also works with update. Note that always returns changed.
type: str
update_password:
default: always
choices: ['always', 'on_create']
description:
- C(always) will update passwords if they differ. C(on_create) will only set the password for newly created users.
type: str
notes:
- 'Currently boto does not support the removal of Managed Policies, the module will error out if your
user/group/role has managed policies when you try to do state=absent. They will need to be removed manually.'
author:
- "Jonathan I. Davila (@defionscode)"
- "Paul Seiffert (@seiffert)"
extends_documentation_fragment:
- aws
- ec2
s
# Basic user creation example
tasks:
- name: Create two new IAM users with API keys
iam:
iam_type: user
name: "{{ item }}"
state: present
password: "{{ temp_pass }}"
access_key_state: create
loop:
- jcleese
- mpython
# Advanced example, create two new groups and add the pre-existing user
# jdavila to both groups.
task:
- name: Create Two Groups, Mario and Luigi
iam:
iam_type: group
name: "{{ item }}"
state: present
loop:
- Mario
- Luigi
register: new_groups
- name:
iam:
iam_type: user
name: jdavila
state: update
groups: "{{ item.created_group.group_name }}"
loop: "{{ new_groups.results }}"
# Example of role with custom trust policy for Lambda service
- name: Create IAM role with custom trust relationship
iam:
iam_type: role
name: AAALambdaTestRole
state: present
trust_policy:
Version: '2012-10-17'
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service: lambda.amazonaws.com
s
role_result:
description: the IAM.role dict returned by Boto
type: str
returned: if iam_type=role and state=present
sample: {
"arn": "arn:aws:iam::A1B2C3D4E5F6:role/my-new-role",
"assume_role_policy_document": "...truncated...",
"create_date": "2017-09-02T14:32:23Z",
"path": "/",
"role_id": "AROAA1B2C3D4E5F6G7H8I",
"role_name": "my-new-role"
}
roles:
description: a list containing the name of the currently defined roles
type: list
returned: if iam_type=role and state=present
sample: [
"my-new-role",
"my-existing-role-1",
"my-existing-role-2",
"my-existing-role-3",
"my-existing-role-...",
]
N( t
AnsibleModule( t HAS_BOTOt boto_exceptiont connect_to_awst ec2_argument_spect get_aws_connection_infoc c` sm t d } } xY | sh | d | } x t | | D] } | Vq5 W| j d k } | s | j } q q Wd S( s
paginates the results from func by continuously passing in
the returned marker if the results were truncated. this returns
an iterator over the items in the returned response. `attr` is
the name of the attribute to iterate over in the response.
t markert falseN( t Falset Nonet getattrt is_truncatedR ( t funct attrt finishedR t rest item( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyt _paginate s
c C` s' g t | j d D] } | d ^ q S( Nt groupst
group_name( R t get_all_groups( t iamR ( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyt list_all_groups s c C` s' g t | j d D] } | d ^ q S( Nt userst user_name( R t
get_all_users( R R ( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyt list_all_users s c C` s' g t | j d D] } | d ^ q S( Nt rolest role_name( R t
list_roles( R R ( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyt list_all_roles s c C` s' g t | j d D] } | d ^ q S( Nt instance_profilest instance_profile_name( R t list_instance_profiles( R R ( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyt list_all_instance_profiles s c
C` s d } g } y | j | | j j j } t }
| d k rQ | j | | } n | d
k r | r x? | | k r | j | j d | j j
j | d 7} qf Wq n d } Wn5 t j
j k
r } | j d t d t | n& Xt d | d | d | } | |
f Sd S( Ni t createR i t changedt msgt created_usert passwordt access_keys( R+ ( t create_usert create_user_responset create_user_resultt usert TrueR t create_login_profilet appendt create_access_keyt create_access_key_responset create_access_key_resultt
access_keyt botot exceptiont BotoServerErrort fail_jsonR t strt dict(
t moduleR t namet pwdt patht key_statet key_countt key_qtyt keyst user_metaR, t errt user_info( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyR1 s&
c
C` s t } yW g | j | j j D] } | d ^ q } x | D] } | j | | q< Wt } Wn? t j j k
r } | j d | d d | d t
j n Xy) | j | j
} | j | t } Wnb t j j k
r,} t | } d | d | k r-| j d | d d | d t
j q-n Xy: x- | j | j j D] }
| j | |
qFWt } Wnt t j j k
r} t | } d | k r| j d | d d
| n | j d | d d | d t
j n Xyb | j | j d i j d
i j d g } x" | D] } | j | | d qWt } Wn? t j j k
r} | j d | d d | d t
j n X| S( Nt
access_key_idR, R- s Failed to delete keys: %sR= s Login Profile for User s cannot be found.s" Failed to delete login profile: %ss must detach all policies firsts All inline policies have been removed. Though it appearsthat %s has Managed Polices. This is not currently supported by boto. Please detach the policies through the console and try again.s Failed to delete policies: %st list_mfa_devices_responset list_mfa_devices_resultt mfa_devicest
serial_numbers/ Failed to deactivate associated MFA devices: %s( R t get_all_access_keyst list_access_keys_resultt access_key_metadatat delete_access_keyR5 R< R= R> R? t tracebackt
format_exct get_login_profilest get_login_profile_responset delete_login_profileR
t get_all_user_policiest list_user_policies_resultt policy_namest delete_user_policyt get_all_mfa_devicest gett deactivate_mfa_device(
RB R RC R, t ckt current_keyst keyRK t
login_profilet error_msgt policyRP t device( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyt delete_dependencies_first sF )
*
-
*3
*c C` s{ t | | | } y | j | WnE t j j k
rj } | j d | d d | | f d t j n Xt } | | f S( NR, R- s Failed to delete user %s: %sR= ( Ri t delete_userR< R= R> R? RV RW R5 ( RB R RC R, t ex( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyRj , s 0c
C` s t }
t } | r! | r! | } n yh g | j | j j D] } | d ^ q: }
g | j | j j D] } | d ^ qf } t |
} Wn t j j k
r?} t | } d | k r | r g | j | j j D] } | d ^ q }
g | j | j j D] } | d ^ q} | } q@| j d t d t
| n Xi } | sR| rP| j | j j
d } | | k s| | k rPt }
yn | s| j | d | d | j j } n | j | d | j j } t d | d
| d | d | | d R
R? R@ t get_usert get_user_resultR4 R5 t update_usert update_user_responset response_metadataRA t update_login_profileR6 R7 R8 R9 R: R; t zipt lowert update_access_keyt
capitalizeRU t update( RB R RC t new_nameRm RF RG RI RD t updatedR, t name_changeRb Rc R RH RK Rf t updated_key_listt c_pathR4 t new_keysR; t current_keyt current_key_statet
final_keyst final_key_statust fkt fks( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyRx 7 s )) )) #
)) ))
#
* &1 c C` s t } | r | } n y g | j | j j D] } | d ^ q. } g t | j | D] } | ^ qZ }
g t | j | D] } | ^ q } Wn5 t j j k
r }
| j d | d t
|
n Xt | d k r$x | D] } | j | | q Wx |
D] } | j
| | qWnz xw | D]o } y | j | | Wq+t j j k
r}
t |
} d | | k r| j d t d d | qq+Xq+Wt |
d k st | d k rt } n | | f S( s Sets groups for a user, will purge groups not explicitly passed, while
retaining pre-existing groups that also are in the new list.
R R, R- i s' The group with name %s cannot be found.s Group %s doesn't exist( R t get_groups_for_usert list_groups_for_user_resultR t frozensett
differenceR< R= R> R? R@ Ru t add_user_to_groupt remove_user_from_groupR
R5 ( RB R RC R R R R, t ogt orig_users_groupst rgt
remove_groupst ngt
new_groupsRK t newt rmt groupRf ( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyt set_users_groups s2 #(,
%$ c C` sk t } y | j | | j j j Wn5 t j j k
rZ } | j d | d t | n Xt
} | | f S( NR, R- ( R t create_groupt create_group_responset create_group_resultR R< R= R> R? R@ R5 ( RB R RC RE R, RK ( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyR s c C` s. t } y | j | Wnt j j k
r } t | } d | k r x- | j | j j D] } | j | | q] Wy | j | Wnj t j j k
r } t | } d | k r | j
d | d d | q | j
d | d t | qXt } q$| j
d | d t | n Xt } | | f S( Ns must delete policies firstR, R- s All inline policies have been removed. Though it appearsthat %s has Managed Polices. This is not currently supported by boto. Please detach the policies through the console and try again.(
R t delete_groupR< R= R> R
t get_all_group_policiest list_group_policies_resultR] t delete_group_policyR? R@ R5 ( RB R RC R, RK Rf Rg ( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyR s( c C` s t } y | j | j j j d } | rV | | k rV | j | d | t } qV n | r | | k r | j | d | d | t } | } q n Wn5 t j j k
r } | j
d | d t | n X| | | | f S( NRE Rm t new_group_nameR, R- ( R t get_groupt get_group_responset get_group_resultR t update_groupR5 R< R= R> R? R@ ( RB R RC R Rm R, t current_group_pathRK ( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyR s c C` s t } d } d } y | | k r t } | j | d | d | j j j } | | k r | j | d | j j j
} | j | | q n | j | j
j j
} Wn5 t j j k
r }
| j d | d t |
n% Xt | } | j | j j j } | | | | f S( Nt assume_role_policy_documentRE R, R- ( R R R5 t create_rolet create_role_responset create_role_resultt rolet create_instance_profilet create_instance_profile_responset create_instance_profile_resultt instance_profilet add_role_to_instance_profilet get_instance_profilet get_instance_profile_responset get_instance_profile_resultR< R= R> R? R@ R& t get_rolet get_role_responset get_role_result( RB R RC RE t role_listt prof_listt trust_policy_docR, t iam_role_resultt instance_profile_resultRK t updated_role_list( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyR " s$ c C` s t } d } d } y| | k rug | j | j j D] } | d ^ q7 } x | D] }
| j |
| qT Wy | j | Wn t j j k
rk} t
| } d | k r x0 | j | j j
D] }
| j | |
q Wn y | j | } Wnj t j j k
ra} t
| } d | k rB| j d | d d | qh| j d | d t | qrXt } quXt } n x, | D]$ } | | k r|| j | } q|q|WWn5 t j j k
r} | j d | d t | n
Xt | } | | | | f S( NR( s must detach all policies firstR, R- s All inline policies have been removed. Though it appearsthat %s has Managed Polices. This is not currently supported by boto. Please detach the policies through the console and try again.( R R t list_instance_profiles_for_rolet& list_instance_profiles_for_role_resultR' t! remove_role_from_instance_profilet delete_roleR< R= R> R
t list_role_policiest list_role_policies_resultR] t delete_role_policyR? R@ R5 t delete_instance_profileR& ( RB R RC R R R, R R t rpt cur_ins_proft profileRK Rf Rg t profR ( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyR ; sB )
c : $ C` s
t } | j t d t d t d d d d g d t d d d
d d t d t d t d d d
d g d t d
d d t d t d t d
d d t d d d g d t d
d d t d d d d d d d d d g d t d d d
d d t d t d d d
d d t d! t d
d d t d" t d
d d t d# t d d$ d
d d t d% t d
d d t d& t d
d' d t d( t d
d d t t d) | d* d# d" g g } t s| j d+ d, n | j j
d j } | j j
d j } | j j
d } | j j
d! } | j j
d% } | j j
d } | j j
d } | j j
d& } | j j
d( }
| j j
d } | j j
d } | j j
d# }
| j j
d" } | j j
d } | r8| j } t g d d g D] } | | k ^ q r8| r8| j d- t d+ d. q8n | d k rq| j j
d d k rq| j j
d } n= | d k r| j j
d d k r| j d+ d/ n d } | d k r| j j
d d k s| j j
d0 d k r| j d+ d1 n | d k r.| d k r.| j d- t d+ d2 n | ry4 t
| d3 } t j t j | } Wd QXWqt k
r} | j d+ t | d4 | qXnV |
ry t j |
} Wqt k
r} | j d+ t | d4 |
qXn d } t | \ } } } y7 | r+t t j | | } n t j j j | } Wn/ t j j k
rr} | j d+ t | n Xi } t } y4 t | } t | } t | } t | } Wn, t j j k
r} | j d+ | j n X| d k r
t } d }! t g | D] } | | | g k ^ q }" |" ri| j! | j" j# d& }# |
ri|# | k ri| }
|# } qin | d k r |" r | r t$ | | | | | | | \ }$ } | j% | j& j' }% | rt( | | | | | | \ }! } n | j) d5 |$ d |! d6 |% d- | q
| dQ k r
|" r
| d k r2d } n | | k rS| | k rSt } n t* | | | | |
| | | | |
\ }& }' }( }) |) ri t+ |) d7 6}* |* d7 j, g |' j- D]C \ }+ }, |+ g |) D] }- |- d0 ^ qk ri |+ d0 6|, d8 6^ q n: i g |' j- D] \ }+ }, i |+ d0 6|, d8 6^ qd7 6}* |& rX| rX| }. | } n t. | t+ rt( | | | | | | \ }! }/ |/ |( k r|/ } qt } n |( } | r|
r| j) d- | d |! d9 |. d: | d; | d( |
d6 |' d< |) d5 |* q
| rF |
rF | rF | j) d- | d |! d9 |. d: | d6 |' d< |) d5 |* q
| r |
r | r | j) d- | d |! d= | d6 |' d> | d< |) d5 |* q
| r |
r | j) d- | d |! d= | d; | d( |
d6 |' d< |) d5 |* q
| j) d- | d |! d= | d6 |' d< |) d5 |* q
| d k r5
|" r5
| j d+ d? | q
| d
k r
|" r
yE t( | | | d@ t/ | | | \ } } | j) dA | d- | Wq
t k
r
}0 | j d- | d+ t |0 q
Xq
| j) d- t d+ dB | q
n| d k r | | k }1 | d k rL |1 rL t0 dC | dD | d! | d& | \ }2 } | j) d- | dE |2 q
| dR k r\ |1 r\ t1 dC | dD | d! | d% | d( |
\ } }3 }4 }5 |
r | r | j) d- | dF | dG |3 d; |5 dH |4 n |
r | r | j) d- | dE | d; |5 dH |4 n |
r, | r, | j) d- | dF | dG |3 dI |5 n |
r | r | j) d- | dE | dI |5 q q
| d k r |1 r | j d- | d+ dJ | q
| d
k r
| | k r t2 dC | dD | d! | \ }6 } | j) d- | dK |6 q | j) d- | d+ dL q
n | d k r
g }7 | d k rE
t3 | | | | | | | \ } }7 }8 }9 nX | d
k rx
t4 | | | | | \ } }7 }8 }9 n% | d k r
| j d- t d+ dM n | j) d- | dN |7 dO |8 dP |9 n d S(S Nt iam_typet requiredt choicesR4 R R R t typet listt defaultt statet presentt absentR R/ t no_logt update_passwordt alwayst on_createt access_key_stateRr Rs R+ Rt t Activet Inactivet Createt Removet access_key_idsRG t inti RC t trust_policy_filepatht trust_policyRA R RE t /Rm t
argument_spect mutually_exclusiveR- s, This module requires boto, please install itR, sP At least one access key has to be defined in order to use 'active' or 'inactive'sM a password is being specified when the iam_type is not user. Check parametersRM sT the IAM type must be user, when IAM access keys are being modified. Check parameterssM iam_type: role, cannot currently be updated, please specify present or absentt rs : RJ RI R0 R t
old_user_nameRl Rp t created_keysR RF s+ The user %s does not exist. No update made.t t deleted_users1 User %s is already absent from your AWS IAM usersRB R R t old_group_nameR t new_group_patht
group_paths. Update Failed. Group %s doesn't seem to exist!R s Group already absents, Role update not currently supported by boto.R# t role_resultR ( R s update( R s update(5 R R RA R5 R R R R R? t paramsR` R} t anyt opent jsont dumpst loadt ExceptionR@ R
R R< R t
connectiont
IAMConnectionR= t NoAuthHandlerFoundR R" R& R* R> t messageRv Rw R4 R1 RR RS RT R t exit_jsonRx R t extendt itemst
isinstanceRj R R R R R (: R RB R R R RC R R/ t update_pwRE Rm RG RF R R t key_idst nRD t json_dataR t et regiont ec2_urlt aws_connect_kwargsR t resultR, t orig_group_listt orig_user_listt orig_role_listt orig_prof_listRK t been_updatedt user_groupst user_existst current_patht metaRI R t key_listt user_changedt new_keyRJ Rd t valuet itt orig_namet groups_changedRk t group_existst new_groupt updated_namet updated_patht cur_patht
removed_groupR R R ( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyt maini s ! 2 $$$"%% + !! 0
A7
# '
! * $ t __main__(+ t
__future__R R R R t
__metaclass__t ANSIBLE_METADATAt
DOCUMENTATIONt EXAMPLESt RETURNR RV t boto.exceptionR< t boto.iamt boto.iam.connectiont ImportErrort ansible.module_utils.basicR t ansible.module_utils.ec2R R
R R R
R R R" R& R* R1 Ri Rj Rx R R R R R R R R t __name__( ( ( sD /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/iam.pyt sH
X3
( 0 ' .