class ZAWS::Services::EC2::SecurityGroup

Public Class Methods

new(shellout, aws, undofile) click to toggle source
# File lib/zaws/services/ec2/security_group.rb, line 10
def initialize(shellout, aws, undofile)
  @shellout=shellout
  @aws=aws
  @undofile=undofile
  @undofile ||= ZAWS::Helper::ZFile.new
end

Public Instance Methods

declare(region, vpcid, groupname, description, check, textout=nil, verbose=nil, ufile=nil) click to toggle source
# File lib/zaws/services/ec2/security_group.rb, line 60
def declare(region, vpcid, groupname, description, check, textout=nil, verbose=nil, ufile=nil)
  if ufile
    @undofile.prepend("zaws security_group delete #{groupname} --region #{region} --vpcid #{vpcid} $XTRA_OPTS", '#Delete security group', ufile)
  end
  sgroup_exists, sgroupid = exists(region, verbose, vpcid, groupname)
  return ZAWS::Helper::Output.binary_nagios_check(sgroup_exists, "OK: Security Group Exists.", "CRITICAL: Security Group Does Not Exist.", textout) if check
  if not sgroup_exists

    comline="aws --output json --region #{region} ec2 create-security-group --vpc-id #{vpcid} --group-name #{groupname} --description '#{description}'"

    sgroup=JSON.parse(@shellout.cli(comline, verbose))

    ZAWS::Helper::Output.out_change(textout, "Security Group Created.") if sgroup["return"] == "true"
  else
    ZAWS::Helper::Output.out_no_op(textout, "Security Group Exists Already. Skipping Creation.")
  end
  return 0
end
declare_ingress_cidr(region, vpcid, target, cidr, protocol, port, nagios, textout=nil, verbose=nil, ufile=nil) click to toggle source
# File lib/zaws/services/ec2/security_group.rb, line 144
def declare_ingress_cidr(region, vpcid, target, cidr, protocol, port, nagios, textout=nil, verbose=nil, ufile=nil)
  if ufile
    @undofile.prepend("zaws security_group delete_ingress_cidr #{target} #{cidr} #{protocol} #{port} --region #{region} --vpcid #{vpcid} $XTRA_OPTS", '#Delete cidr ingress group rule', ufile)
  end
  ingress_exists, targetid = ingress_cidr_exists(region, vpcid, target, cidr, protocol, port, nil, verbose)
  return ZAWS::Helper::Output.binary_nagios_check(ingress_exists, "OK: Security group ingress cidr rule exists.", "CRITICAL: Security group ingress cidr rule does not exist.", textout) if nagios
  if not ingress_exists
    comline="aws --region #{region} ec2 authorize-security-group-ingress --group-id #{targetid} --cidr #{cidr} --protocol #{protocol} --port #{port}"
    # aws cli not returning json causes error.
    @shellout.cli(comline, verbose)
    ZAWS::Helper::Output.out_change(textout, "Ingress cidr rule created.")
  else
    ZAWS::Helper::Output.out_no_op(textout, "Ingress cidr rule not created. Exists already.")
  end
  return 0
end
declare_ingress_group(region, vpcid, target, source, protocol, port, nagios, textout=nil, verbose=nil, ufile=nil) click to toggle source
# File lib/zaws/services/ec2/security_group.rb, line 127
def declare_ingress_group(region, vpcid, target, source, protocol, port, nagios, textout=nil, verbose=nil, ufile=nil)
  if ufile
    @undofile.prepend("zaws security_group delete_ingress_group #{target} #{source} #{protocol} #{port} --region #{region} --vpcid #{vpcid} $XTRA_OPTS", '#Delete security group ingress group rule', ufile)
  end
  ingress_exists, targetid, sourceid = ingress_group_exists(region, vpcid, target, source, protocol, port, nil, verbose)
  return ZAWS::Helper::Output.binary_nagios_check(ingress_exists, "OK: Security group ingress group rule exists.", "CRITICAL: Security group ingress group rule does not exist.", textout) if nagios
  if not ingress_exists
    comline="aws --region #{region} ec2 authorize-security-group-ingress --group-id #{targetid} --source-group #{sourceid} --protocol #{protocol} --port #{port}"
    # aws cli not returning json causes error.
    @shellout.cli(comline, verbose)
    ZAWS::Helper::Output.out_change(textout, "Ingress group rule created.")
  else
    ZAWS::Helper::Output.out_no_op(textout, "Ingress group rule not created. Exists already.")
  end
  return 0
end
delete(region, verbose=nil, vpcid, groupname) click to toggle source
# File lib/zaws/services/ec2/security_group.rb, line 79
def delete(region, verbose=nil, vpcid, groupname)
  groupid=id_by_name(region, nil, nil, vpcid, groupname)
  return ZAWS::Helper::Output.return_no_op("Security Group does not exist. Skipping deletion.") if !groupid
  ds=@aws.awscli.command_ec2.deleteSecurityGroup
  ds.clear_settings
  ds.security_group_id(groupid)
  ds.aws.region(region)
  sgroup=JSON.parse(ds.execute(verbose))
  return ZAWS::Helper::Output.return_change("Security Group deleted.") if sgroup["return"] == "true"
end
delete_ingress_cidr(region, vpcid, target, cidr, protocol, port, textout=nil, verbose=nil) click to toggle source
# File lib/zaws/services/ec2/security_group.rb, line 172
def delete_ingress_cidr(region, vpcid, target, cidr, protocol, port, textout=nil, verbose=nil)
  ingress_exists, targetid = ingress_cidr_exists(region, vpcid, target, cidr, protocol, port, nil, verbose)
  if ingress_exists
    comline="aws --region #{region} ec2 revoke-security-group-ingress --group-id #{targetid} --cidr #{cidr} --protocol #{protocol} --port #{port}"
    val=JSON.parse(@shellout.cli(comline, verbose))
    ZAWS::Helper::Output.out_change(textout, "Security group ingress cidr rule deleted.") if val["return"] == "true"
  else
    ZAWS::Helper::Output.out_no_op(textout, "Security group ingress cidr rule does not exist. Skipping deletion.")
  end
end
delete_ingress_group(region, vpcid, target, source, protocol, port, textout=nil, verbose=nil) click to toggle source
# File lib/zaws/services/ec2/security_group.rb, line 161
def delete_ingress_group(region, vpcid, target, source, protocol, port, textout=nil, verbose=nil)
  ingress_exists, targetid, sourceid = ingress_group_exists(region, vpcid, target, source, protocol, port, nil, verbose)
  if ingress_exists
    comline="aws --region #{region} ec2 revoke-security-group-ingress --group-id #{targetid} --source-group #{sourceid} --protocol #{protocol} --port #{port}"
    val=JSON.parse(@shellout.cli(comline, verbose))
    ZAWS::Helper::Output.out_change(textout, "Security group ingress group rule deleted.") if val["return"] == "true"
  else
    ZAWS::Helper::Output.out_no_op(textout, "Security group ingress group rule does not exist. Skipping deletion.")
  end
end
exists(region, verbose=nil, vpcid, groupname) click to toggle source
# File lib/zaws/services/ec2/security_group.rb, line 35
def exists(region, verbose=nil, vpcid, groupname)
  view(region, 'json', verbose, vpcid, groupname)
  val, sgroupid = @aws.awscli.command_ec2.describeSecurityGroups.exists
  verbose.puts val.to_s if verbose
  return val, sgroupid
end
filter_groups_by_instances(security_groups, instances) click to toggle source
# File lib/zaws/services/ec2/security_group.rb, line 42
def filter_groups_by_instances(security_groups, instances)
  security_groups_hash=JSON.parse(security_groups)
  instances_hash=JSON.parse(instances)
  instances_hash['Reservations'].each do |w|
    w['Instances'].each do |x|
      x['SecurityGroups'].each do |y|
        security_groups_hash['SecurityGroups'] = security_groups_hash['SecurityGroups'].select { |j| not j['GroupName'] == (y['GroupName']) }
      end
      x['NetworkInterfaces'].each do |y|
        y['Groups'].each do |z|
          security_groups_hash['SecurityGroups'] = security_groups_hash['SecurityGroups'].select { |j| not j['GroupName'] == (z['GroupName']) }
        end
      end
    end
  end
  JSON.generate(security_groups_hash)
end
id_by_name(region, textout=nil, verbose=nil, vpcid, groupname) click to toggle source
# File lib/zaws/services/ec2/security_group.rb, line 90
def id_by_name(region, textout=nil, verbose=nil, vpcid, groupname)
  sgroups=JSON.parse(view(region, 'json', verbose, vpcid, groupname))
  group_id= sgroups["SecurityGroups"].count == 1 ? sgroups["SecurityGroups"][0]["GroupId"] : nil
  raise "More than one security group found when looking up id by name." if sgroups["SecurityGroups"].count > 1
  textout.puts group_id if textout
  return group_id
end
ingress_cidr_exists(region, vpcid, target, cidr, protocol, port, textout=nil, verbose=nil) click to toggle source
# File lib/zaws/services/ec2/security_group.rb, line 113
def ingress_cidr_exists(region, vpcid, target, cidr, protocol, port, textout=nil, verbose=nil)
  targetid=id_by_name(region, nil, nil, vpcid, target)
  if targetid
    sgroups=JSON.parse(view(region, 'json', verbose, vpcid, nil, targetid, nil, protocol, port, cidr))
    if (sgroups["SecurityGroups"].count > 0)
      # Additionally filter out the sgroups that do not have the cidr and port in the same ip permissions
      sgroups["SecurityGroups"]=sgroups["SecurityGroups"].select { |x| x['IpPermissions'].any? { |y| y['ToPort'] and y['FromPort'] and y['IpProtocol']==protocol and y['ToPort']==port.to_i and y['FromPort']==port.to_i and y['IpRanges'].any? { |z| z['CidrIp']=="#{cidr}" } } }
    end
    val = (sgroups["SecurityGroups"].count > 0)
    textout.puts val.to_s if textout
    return val, targetid
  end
end
ingress_group_exists(region, vpcid, target, source, protocol, port, textout=nil, verbose=nil) click to toggle source
# File lib/zaws/services/ec2/security_group.rb, line 98
def ingress_group_exists(region, vpcid, target, source, protocol, port, textout=nil, verbose=nil)
  targetid=id_by_name(region, nil, nil, vpcid, target)
  sourceid=id_by_name(region, nil, nil, vpcid, source)
  if targetid && sourceid
    sgroups=JSON.parse(view(region, 'json', verbose, vpcid, nil, targetid, sourceid, protocol, port))
    if (sgroups["SecurityGroups"].count > 0)
      # Additionally filter out the sgroups that do not have the source group  and port in the same ip permissions
      sgroups["SecurityGroups"]=sgroups["SecurityGroups"].select { |x| x['IpPermissions'].any? { |y| y['ToPort'] and y['FromPort'] and y['IpProtocol']==protocol and y['ToPort']==port.to_i and y['FromPort']==port.to_i and y['UserIdGroupPairs'].any? { |z| z['GroupId']=="#{sourceid}" } } }
    end
    val = (sgroups["SecurityGroups"].count > 0)
    textout.puts val.to_s if textout
    return val, targetid, sourceid
  end
end
view(region, viewtype, verbose=nil, vpcid=nil, groupname=nil, groupid=nil, perm_groupid=nil, perm_protocol=nil, perm_toport=nil, cidr=nil, unused=false) click to toggle source
# File lib/zaws/services/ec2/security_group.rb, line 17
def view(region, viewtype, verbose=nil, vpcid=nil, groupname=nil, groupid=nil, perm_groupid=nil, perm_protocol=nil, perm_toport=nil, cidr=nil, unused=false)
  ds=@aws.awscli.command_ec2.describeSecurityGroups
  ds.clear_settings
  ds.filter.vpc_id(vpcid).group_name(groupname).group_id(groupid)
  ds.filter.ip_permission_group_id(perm_groupid).ip_permission_cidr(cidr)
  ds.filter.ip_permission_protocol(perm_protocol).ip_permission_to_port(perm_toport)
  ds.aws.output(viewtype)
  ds.aws.region(region)
  sgroups=ds.view(viewtype, verbose)
  if unused #TODO: Improve to detect security groups associated to firewall.
    instances = @aws.ec2.compute.view(region, 'json', nil, verbose)
    sgroups = JSON.parse(filter_groups_by_instances(sgroups, instances))
    sgroups = sgroups['SecurityGroups'].map { |x| x['GroupName'] }.join("\n")
  end
  verbose.puts(sgroups) if verbose
  return sgroups
end