class Stalkedbybean::RoleSetup
Public Class Methods
parse_options(file_path, options)
click to toggle source
# File lib/stalkedbybean/role_setup.rb, line 6 def self.parse_options(file_path, options) @options = Stalkedbybean::Parser.parse_options(file_path, options) end
setup_IAM()
click to toggle source
# File lib/stalkedbybean/role_setup.rb, line 10 def self.setup_IAM @app_tag = "#{@options[:app_name]}-#{@options[:environment]}" @client = Aws::IAM::Client.new(region: "#{@options[:aws_region]}", profile: "#{@options[:aws_profile]}") @iam = Aws::IAM::Resource.new(client: @client) role_name = "#{@app_tag}-#{@options[:aws_region]}-beanstalk-EC2" begin role = self.create_role puts "Role created" rescue Aws::IAM::Errors::EntityAlreadyExists puts "Role already created" role = @client.get_role({ role_name: role_name }) end begin cred_stash_policy = self.create_cred_stash_policy puts "Credstash policy created" rescue Aws::IAM::Errors::EntityAlreadyExists puts "Credstash policy already created" policies = @client.list_policies({}) arn = policies.policies.find { |policy| policy.policy_name == "#{@app_tag}-credstash-access" }.arn cred_stash_policy = @client.get_policy({ policy_arn: arn }) end begin self.attach_policy_to_role(cred_stash_policy.arn, role) puts "Credstash policy attached" rescue Exception => ex puts "Credstash policy already attached" end begin self.attach_policy_to_role("arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier", role) rescue Exception => ex puts "AWSElasticBeanstalkWebTier policy already attached" end begin @client.create_instance_profile({ instance_profile_name: role_name }) puts "Instance profile created" rescue Exception => ex puts "Instance profile already created" end begin @client.add_role_to_instance_profile({ instance_profile_name: role_name, role_name: role_name }) puts "Role added to instance profile" rescue Exception => ex puts "Role has already been added to instance profile" end end
Private Class Methods
attach_policy_to_role(policy_arn, role)
click to toggle source
# File lib/stalkedbybean/role_setup.rb, line 130 def self.attach_policy_to_role(policy_arn, role) role.attach_policy({ policy_arn: policy_arn }) end
create_cred_stash_policy()
click to toggle source
# File lib/stalkedbybean/role_setup.rb, line 99 def self.create_cred_stash_policy role_policy_document = { "Version": "2012-10-17", "Statement": [ { "Action": [ "kms:Decrypt" ], "Effect": "Allow", "Resource": "#{@options[:kms_arn]}" }, { "Action": [ "dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan" ], "Effect": "Allow", "Resource": "arn:aws:dynamodb:#{@options[:aws_region]}:#{@options[:aws_account_id]}:table/#{@app_tag}" } ] }.to_json cred_stash_policy = @iam.create_policy({ policy_name: "#{@app_tag}-credstash-access", policy_document: role_policy_document }) cred_stash_policy end
create_role()
click to toggle source
# File lib/stalkedbybean/role_setup.rb, line 77 def self.create_role policy_doc = { Version:"2012-10-17", Statement:[ { Effect:"Allow", Principal:{ Service:"ec2.amazonaws.com" }, Action:"sts:AssumeRole" } ] } role = @iam.create_role({ role_name: "#{@app_tag}-#{@options[:aws_region]}-beanstalk-EC2", assume_role_policy_document: policy_doc.to_json }) return role end