├── ec2home
    ├── ansible.cfg
    ├── addons.yml
    ├── README.md
    ├── variables.tf
    └── main.tf
├── kriskross
    ├── static
    │   ├── aws-iam.png
    │   └── favicon.ico
    ├── templates
    │   └── targets.html
    ├── kriskross.py
    ├── README.md
    └── COPYING
├── platforms
    ├── roles
    │   ├── s3_fullaccess.json
    │   ├── ec2-trusted-policy.json
    │   ├── ec2_s3_readonly.json
    │   ├── ec2_s3_readonly_route53_write_rrs.json
    │   └── mkrole.py
    ├── stack
    │   ├── params
    │   └── asg.py
    ├── packer
    │   ├── basic.json
    │   └── essentials.yml
    ├── mkasg.sh
    └── scripts
    │   └── meta2dict.py
├── userdata
    └── gtfo-systemd.sh
├── README.md
├── troposphere_examples
    ├── ec2instance.py
    ├── README.md
    └── asg.py
├── mods
    ├── session.py
    └── awsprice.py
└── ec2.py


/ec2home/ansible.cfg:
--------------------------------------------------------------------------------
1 | [defaults]
2 | host_key_checking = False
3 | 


--------------------------------------------------------------------------------
/kriskross/static/aws-iam.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/iMilnb/awstools/HEAD/kriskross/static/aws-iam.png


--------------------------------------------------------------------------------
/kriskross/static/favicon.ico:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/iMilnb/awstools/HEAD/kriskross/static/favicon.ico


--------------------------------------------------------------------------------
/platforms/roles/s3_fullaccess.json:
--------------------------------------------------------------------------------
1 | {"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":"s3:*","Resource":"*"}}
2 | 


--------------------------------------------------------------------------------
/ec2home/addons.yml:
--------------------------------------------------------------------------------
 1 | ---
 2 | add_pkgs:
 3 |   - alpine
 4 |   - netcat
 5 | 
 6 | pip_pkgs:
 7 |   - ansible
 8 |   - awscli
 9 |   - boto3
10 | 
11 | copy_files:
12 |   ~/wrk/etc/pinerc: "{{homedir}}/.pinerc"
13 | 


--------------------------------------------------------------------------------
/platforms/roles/ec2-trusted-policy.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [
 4 |     {
 5 |       "Effect": "Allow",
 6 |       "Principal": {
 7 |         "Service": "ec2.amazonaws.com"
 8 |       },
 9 |       "Action": "sts:AssumeRole"
10 |     }
11 |   ]
12 | }
13 | 


--------------------------------------------------------------------------------
/userdata/gtfo-systemd.sh:
--------------------------------------------------------------------------------
 1 | # initial idea from
 2 | # http://without-systemd.org/wiki/index.php/How_to_remove_systemd_from_a_Debian_jessie/sid_installation
 3 | apt-get -y install sysvinit-core sysvinit sysvinit-utils
 4 | apt-get remove --purge --auto-remove systemd
 5 | cat >/etc/apt/preferences.d/systemd<<EOF
 6 | Package: systemd
 7 | Pin: origin ""
 8 | Pin-Priority: -1
 9 | 
10 | Package: *systemd*
11 | Pin: origin ""
12 | Pin-Priority: -1
13 | EOF
14 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # awstools
 2 | 
 3 | This repository contains tools I wrote to play with AWS
 4 | 
 5 | At `${DAYWORK}`, we use *Amazon Web Services* more and more, so I naturally
 6 | began writing tools to automate its manipulation.
 7 | 
 8 | I'll slowly free parts that are not bound to our own infrastructure in this
 9 | repository. The modules and scripts I wrote mainly use [boto3][1] and
10 | [troposphere][2], please check those two fabulous projects out!
11 | 
12 | [1]: http://boto3.readthedocs.org/en/latest/
13 | [2]: https://github.com/cloudtools/troposphere
14 | 


--------------------------------------------------------------------------------
/platforms/roles/ec2_s3_readonly.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [
 4 |     {
 5 |       "Effect": "Allow",
 6 |       "Action": [
 7 |         "s3:Get*",
 8 |         "s3:List*"
 9 |       ],
10 |       "Resource": "*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": "ec2:Describe*",
15 |       "Resource": "*"
16 |     },
17 |     {
18 |       "Effect": "Allow",
19 |       "Action": "elasticloadbalancing:Describe*",
20 |       "Resource": "*"
21 |     },
22 |     {
23 |       "Effect": "Allow",
24 |       "Action": [
25 |         "cloudwatch:ListMetrics",
26 |         "cloudwatch:GetMetricStatistics",
27 |         "cloudwatch:Describe*"
28 |       ],
29 |       "Resource": "*"
30 |     },
31 |     {
32 |       "Effect": "Allow",
33 |       "Action": "autoscaling:Describe*",
34 |       "Resource": "*"
35 |     }
36 |   ]
37 | }
38 | 


--------------------------------------------------------------------------------
/ec2home/README.md:
--------------------------------------------------------------------------------
 1 | ### Disposable and usable testing environment
 2 | 
 3 | The goal of this [Terraform][1] definition is to create an on-demand, disposable working environment within minutes in _AWS EC2_. I tried to make it as generic as possible so anyone could easily adapt it to its needs.
 4 | 
 5 | It setups a single instance whose parameters are recorded in the `variables.tf` file.
 6 | 
 7 | Once fired up, the instance is provisionned using [Ansible][2].  
 8 | I used my [own Ansible "essentials" playbook available here on GitHub][3] but you can obviously use yours simply by modifying the `playbook` and `extra_vars` variables in the `variables.tf` file.
 9 | 
10 | Inspired from:
11 | 
12 | * https://alex.dzyoba.com/blog/terraform-ansible/
13 | * https://github.com/dzeban/c10k/tree/master/infrastructure
14 | * https://github.com/terraform-community-modules/tf_aws_ec2_instance
15 | 
16 | [1]: https://terraform.io
17 | [2]: https://ansible.com
18 | [3]: https://github.com/iMilnb/playbooks/tree/master/single
19 | 


--------------------------------------------------------------------------------
/troposphere_examples/ec2instance.py:
--------------------------------------------------------------------------------
 1 | from troposphere import Base64, Join, Split
 2 | from troposphere import Parameter, Ref, Template, Tags
 3 | import troposphere.ec2 as ec2
 4 | import sys
 5 | 
 6 | params = {
 7 |     'AmiId': 'AMI Id',
 8 |     'InstanceName': 'Name tag of the instance',
 9 |     'SecurityGroup': 'Security Group' ,
10 |     'KeyName': 'SSH Key Name' ,
11 |     'InstanceType': 'Instance Type',
12 |     'SubnetA': 'Subnet A',
13 | }
14 | 
15 | t = Template()
16 | 
17 | for p in params.keys():
18 |     vars()[p] = t.add_parameter(Parameter(
19 |         p,
20 |         Type = "String",
21 |         Description = params[p]
22 |     ))
23 | 
24 | for n in range(int(sys.argv[1])):
25 |     if n == 0:
26 |         name = 'master'
27 |     else:
28 |         name = 'slave_{0}'.format(n)
29 |     t.add_resource(ec2.Instance(
30 |         "Ec2Instance{0}".format(n),
31 |         ImageId = Ref(AmiId),
32 |         InstanceType = Ref(InstanceType),
33 |         KeyName = Ref(KeyName),
34 |         SecurityGroupIds = Split(',', Ref(SecurityGroup)),
35 |         SubnetId = Ref(SubnetA),
36 |         Tags = Tags(Name = Join('', [Ref(InstanceName), name])),
37 |     ))
38 | 
39 | print(t.to_json())
40 | 


--------------------------------------------------------------------------------
/ec2home/variables.tf:
--------------------------------------------------------------------------------
 1 | variable "aws_region" {
 2 |   default = "eu-west-1"
 3 | }
 4 | 
 5 | variable "aws_profile" {
 6 | }
 7 | 
 8 | variable "instance_name" {
 9 |   default = "homesweethome"
10 | }
11 | 
12 | variable "ami_filter" {
13 |   default = "debian-stretch-hvm-x86_64-gp2-*"
14 | }
15 | 
16 | variable "ami_owner" {
17 |   default = "379101102735"
18 | }
19 | 
20 | variable "instance_type" {
21 |   default = "t2.nano"
22 | }
23 | 
24 | variable "ec2admin_user" {
25 |   default = "admin"
26 | }
27 | 
28 | variable "associate_public_ip" {
29 |   default = true
30 | }
31 | 
32 | variable "subnet_id" {
33 |   default = ""
34 | }
35 | 
36 | variable "keypair" {
37 |   default = "myownawskey_eu-west-1"
38 | }
39 | 
40 | variable "ssh_private_key" {
41 |   default = "~/aws/keys/myownawskey_eu-west-1.pem"
42 | }
43 | 
44 | variable "zone_id" {
45 |   default = "Y1KK3AR0KND02Z"
46 | }
47 | 
48 | variable "fqdn" {
49 |   default = "homesweethome.mydomain.com."
50 | }
51 | 
52 | variable "playbook" {
53 |   default = "playbooks/single/essentials.yml"
54 | }
55 | 
56 | variable "extra_vars" {
57 |   default = "'myuser=username myghuser=UberUserFoo' -e @playbooks/group_vars/debian -e @addons.yml -e new=yes"
58 | }
59 | 


--------------------------------------------------------------------------------
/troposphere_examples/README.md:
--------------------------------------------------------------------------------
 1 | * `ec2instance.py`: deploys `n` _EC2_ instances
 2 | * `asg.py`: a very simple _AutoScaling Group_ template
 3 | 
 4 | Usage:
 5 | 
 6 | * Generate `cf-foo.json`:
 7 | 
 8 | ```sh
 9 | $ python ec2instance.py 3 > cf-ec2instances.json
10 | ```
11 | 
12 | * Write the parameters file:
13 | 
14 | ```json
15 | [
16 | 	{
17 | 		"ParameterKey": "InstanceType",
18 | 		"ParameterValue": "t2.micro",
19 | 		"UsePreviousValue": false
20 | 	},
21 | 	{
22 | 		"ParameterKey": "AmiId",
23 | 		"ParameterValue": "ami-00000000",
24 | 		"UsePreviousValue": false
25 | 	},
26 | 	{
27 | 		"ParameterKey": "KeyName",
28 | 		"ParameterValue": "mykey-eu-central-1",
29 | 		"UsePreviousValue": false
30 | 	},
31 | 	{
32 | 		"ParameterKey": "SecurityGroup",
33 | 		"ParameterValue": "sg-00000000,sg-11111111",
34 | 		"UsePreviousValue": false
35 | 	},
36 | 	{
37 | 		"ParameterKey": "SubnetA",
38 | 		"ParameterValue": "subnet-00000000",
39 | 		"UsePreviousValue": false
40 | 	},
41 | 	{
42 | 		"ParameterKey": "InstanceName",
43 | 		"ParameterValue": "my_test_instance_",
44 | 		"UsePreviousValue": false
45 | 	}
46 | ]
47 | ```
48 | 
49 | Deploy the stack on `CloudFormation`
50 | 
51 | ```sh
52 | $ aws cloudformation create-stack --stack-name mystack --parameters file://cf-ec2instances.params --template-body file://cf-ec2instances.json
53 | ```
54 | 


--------------------------------------------------------------------------------
/troposphere_examples/asg.py:
--------------------------------------------------------------------------------
 1 | from troposphere import Template, Ref, Parameter, Tags
 2 | from troposphere.autoscaling import LaunchConfiguration, AutoScalingGroup, Tag
 3 | 
 4 | t = Template()
 5 | 
 6 | params = {
 7 |     'AmiId': 'Baked AMI Id',
 8 |     'InstanceName': 'Name tag of the instance',
 9 |     'SecurityGroup': 'Security Group' ,
10 |     'KeyName': 'SSH Key Name' ,
11 |     'InstanceType': 'Instance Type',
12 |     'EnvType': 'test',
13 |     'ScaleCapacity': 'Number of api servers to run',
14 |     'SubnetA': 'ASG Subnet A'
15 | }
16 | 
17 | for p in params.keys():
18 |     vars()[p] = t.add_parameter(Parameter(
19 |         p,
20 |         Type = "String",
21 |         Description = params[p]
22 |     ))
23 | 
24 | LaunchConfig = t.add_resource(LaunchConfiguration(
25 |     "LaunchConfiguration",
26 |     ImageId = Ref(AmiId),
27 |     SecurityGroups = [Ref(SecurityGroup)],
28 |     KeyName = Ref(KeyName),
29 |     InstanceType = Ref(InstanceType)
30 | ))
31 | 
32 | t.add_resource(AutoScalingGroup(
33 |     "AutoscalingGroup",
34 |     Tags=[
35 |         Tag("Environment", Ref(EnvType), True),
36 |         Tag("Name", Ref(InstanceName), True)
37 |     ],
38 |     DesiredCapacity = Ref(ScaleCapacity),
39 |     LaunchConfigurationName=Ref(LaunchConfig),
40 |     MinSize = Ref(ScaleCapacity),
41 |     MaxSize = Ref(ScaleCapacity),
42 |     VPCZoneIdentifier=[Ref(SubnetA)],
43 | ))
44 | 
45 | 
46 | print(t.to_json())
47 | 


--------------------------------------------------------------------------------
/platforms/stack/params:
--------------------------------------------------------------------------------
 1 | PARAMS="[
 2 |     {
 3 |         \"ParameterKey\": \"AmiId\",
 4 |         \"ParameterValue\": \"${AMIID##*:}\",
 5 |         \"UsePreviousValue\": false
 6 |     },
 7 |     {
 8 |         \"ParameterKey\": \"InstanceName\",
 9 |         \"ParameterValue\": \"${INSTANCENAME}\",
10 |         \"UsePreviousValue\": false
11 |     },
12 |     {
13 |         \"ParameterKey\": \"IamInstanceProfile\",
14 |         \"ParameterValue\": \"${INSTANCEPROFILE}\",
15 |         \"UsePreviousValue\": false
16 |     },
17 |     {
18 |         \"ParameterKey\": \"SecurityGroups\",
19 |         \"ParameterValue\": \"${SGSID}\",
20 |         \"UsePreviousValue\": false
21 |     },
22 |     {
23 |         \"ParameterKey\": \"KeyName\",
24 |         \"ParameterValue\": \"${KEYNAME}\",
25 |         \"UsePreviousValue\": false
26 |     },
27 |     {
28 |         \"ParameterKey\": \"InstanceType\",
29 |         \"ParameterValue\": \"${TYPE}\",
30 |         \"UsePreviousValue\": false
31 |     },
32 |     {
33 |         \"ParameterKey\": \"EnvType\",
34 |         \"ParameterValue\": \"${ENVTYPE}\",
35 |         \"UsePreviousValue\": false
36 |     },
37 |     {
38 |         \"ParameterKey\": \"ScaleCapacity\",
39 |         \"ParameterValue\": \"${CAPACITY}\",
40 |         \"UsePreviousValue\": false
41 |     },
42 |     {
43 |         \"ParameterKey\": \"Subnets\",
44 |         \"ParameterValue\": \"${SUBNETSID}\",
45 |         \"UsePreviousValue\": false
46 |     }
47 | ]"
48 | 


--------------------------------------------------------------------------------
/platforms/stack/asg.py:
--------------------------------------------------------------------------------
 1 | from troposphere import Template, Ref, Split, Parameter, Tags
 2 | from troposphere.autoscaling import LaunchConfiguration, AutoScalingGroup, Tag
 3 | 
 4 | t = Template()
 5 | 
 6 | params = {
 7 |     'AmiId': 'Baked AMI Id',
 8 |     'InstanceName': 'Name tag of the instance',
 9 |     'IamInstanceProfile': 'IAM Instance profile',
10 |     'SecurityGroups': 'Security Groups' ,
11 |     'KeyName': 'SSH Key Name' ,
12 |     'InstanceType': 'Instance Type',
13 |     'EnvType': 'test',
14 |     'ScaleCapacity': 'Number of api servers to run',
15 |     'Subnets': 'ASG Subnets'
16 | }
17 | 
18 | for p in params.keys():
19 |     vars()[p] = t.add_parameter(Parameter(
20 |         p,
21 |         Type = "String",
22 |         Description = params[p]
23 |     ))
24 | 
25 | LaunchConfig = t.add_resource(LaunchConfiguration(
26 |     "LaunchConfiguration",
27 |     ImageId = Ref(AmiId),
28 |     SecurityGroups = Split(',', Ref(SecurityGroups)),
29 |     KeyName = Ref(KeyName),
30 |     InstanceType = Ref(InstanceType)
31 | ))
32 | 
33 | t.add_resource(AutoScalingGroup(
34 |     "AutoscalingGroup",
35 |     Tags=[
36 |         Tag("Environment", Ref(EnvType), True),
37 |         Tag("Name", Ref(InstanceName), True)
38 |     ],
39 |     DesiredCapacity = Ref(ScaleCapacity),
40 |     LaunchConfigurationName=Ref(LaunchConfig),
41 |     MinSize = Ref(ScaleCapacity),
42 |     MaxSize = Ref(ScaleCapacity),
43 |     VPCZoneIdentifier=Split(',', Ref(Subnets)),
44 | ))
45 | 
46 | 
47 | print(t.to_json())
48 | 


--------------------------------------------------------------------------------
/platforms/roles/ec2_s3_readonly_route53_write_rrs.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [
 4 |     {
 5 |       "Effect": "Allow",
 6 |       "Action": [
 7 |         "s3:Get*",
 8 |         "s3:List*"
 9 |       ],
10 |       "Resource": "*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": "ec2:Describe*",
15 |       "Resource": "*"
16 |     },
17 |     {
18 |       "Effect": "Allow",
19 |       "Action": "elasticloadbalancing:Describe*",
20 |       "Resource": "*"
21 |     },
22 |     {
23 |       "Effect": "Allow",
24 |       "Action": [
25 |         "cloudwatch:ListMetrics",
26 |         "cloudwatch:GetMetricStatistics",
27 |         "cloudwatch:Describe*"
28 |       ],
29 |       "Resource": "*"
30 |     },
31 |     {
32 |       "Effect": "Allow",
33 |       "Action": "autoscaling:Describe*",
34 |       "Resource": "*"
35 |     },
36 |     {
37 |       "Effect": "Allow",
38 |       "Action": [
39 |          "route53:ListHostedZones"
40 |       ],
41 |       "Resource": "*"
42 |     },
43 |     {
44 |       "Effect": "Allow",
45 |       "Action": [
46 |          "route53:GetHostedZone"
47 |       ],
48 |       "Resource": "arn:aws:route53:::hostedzone/HOSTEDZONEID"
49 |     },
50 |     {
51 |       "Effect": "Allow",
52 |       "Action": [
53 |          "route53:ListResourceRecordSets"
54 |       ],
55 |       "Resource": "arn:aws:route53:::hostedzone/HOSTEDZONEID"
56 |     },
57 |     {
58 |       "Effect": "Allow",
59 |       "Action": [
60 |          "route53:ChangeResourceRecordSets"
61 |       ],
62 |       "Resource": "arn:aws:route53:::hostedzone/HOSTEDZONEID"
63 |     }
64 |   ]
65 | }
66 | 


--------------------------------------------------------------------------------
/kriskross/templates/targets.html:
--------------------------------------------------------------------------------
 1 | <!doctype html>
 2 | <html>
 3 |   <head>
 4 |     <!-- Required meta tags -->
 5 |     <meta charset="utf-8">
 6 |     <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
 7 | 
 8 |     <!-- Bootstrap CSS -->
 9 |     <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.6/css/bootstrap.min.css" integrity="sha384-rwoIResjU2yc3z8GV/NPeZWAv56rSmLldC3R/AZzGRnGxQQKnKkoFVhFQhNUwEyJ" crossorigin="anonymous">
10 |     <link rel="shortcut icon" href="{{ url_for('static', filename='favicon.ico') }}">
11 |   </head>
12 |   <body>
13 |     <div class="container">
14 |       {% if msg != None %}
15 |         <div class="alert alert-{{ msg }} text-center" role="alert" style="margin-top: 10px;">
16 |           {% if msg == 'success' %}
17 |             <strong>{{ target }}</strong> session successfully opened
18 |           {% else %}
19 |             Authentication error: {{ err }}
20 |           {% endif %}
21 |         </div>
22 |       {% endif %}
23 |       <div class="col-md-6 offset-md-3 text-center" style="margin-top: 15px;">
24 |         <img src="{{url_for('static', filename='aws-iam.png')}}" height="50px">
25 |       </div>
26 |       <div class="col-md-6 offset-md-3">
27 |         {% for t in prefs %}
28 |             <form action="{{url_for('web_service')}}" method="POST">
29 |             <div class="input-group" style="margin-top: 10px;">
30 |               <input type="password" name="mfa" value="" class="form-control" />
31 |               <span class="input-group-btn">
32 |                 <input type="submit" name="target" value="{{ t }}" class="btn btn-secondary" />
33 |               </span>
34 |             </div>
35 |           </form>
36 |         {% endfor %}
37 |       </div>
38 |     </div>
39 |   </body>
40 | </html>
41 | 


--------------------------------------------------------------------------------
/platforms/packer/basic.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "variables": {
 3 |     "aws_access_key": "",
 4 |     "aws_secret_key": "",
 5 |     "username": "{{user `username`}}",
 6 |     "githubname": "{{user `githubname`}}"
 7 |   },
 8 |   "builders": [{
 9 |     "type": "amazon-ebs",
10 |     "access_key": "{{user `aws_access_key`}}",
11 |     "secret_key": "{{user `aws_secret_key`}}",
12 |     "region": "eu-central-1",
13 |     "source_ami_filter": {
14 |       "filters": {
15 |         "virtualization-type": "hvm",
16 |         "name": "debian-jessie-*",
17 |         "architecture": "x86_64",
18 |         "root-device-type": "ebs"
19 |       },
20 |       "owners": [
21 |         "379101102735"
22 |       ],
23 |       "most_recent": true
24 |     },
25 |     "instance_type": "t2.micro",
26 |     "ssh_username": "admin",
27 |     "ami_name": "{{user `ami_basename`}}_{{timestamp}}",
28 |     "subnet_id": "{{user `subnetid`}}",
29 |     "security_group_id": "{{user `sgid`}}",
30 |     "associate_public_ip_address": false
31 |   }],
32 |   "provisioners": [{
33 |     "type": "shell",
34 |     "inline": [
35 |       "echo 'Acquire::ForceIPv4 \"true\";' | sudo tee /etc/apt/apt.conf.d/99force-ipv4",
36 |       "echo 'deb http://cloudfront.debian.net/debian jessie-backports main' |sudo tee /etc/apt/sources.list.d/backports.list",
37 |       "sudo apt-get update",
38 |       "sudo apt-get -t jessie-backports install -y ansible"
39 |     ]
40 |   }, {
41 |     "type": "ansible-local",
42 |     "playbook_file": "essentials.yml",
43 |     "command": "PYTHONUNBUFFERED=1 ansible-playbook",
44 |     "extra_arguments": ["--extra-vars \"myuser={{user `username`}} myghuser={{user `githubname`}}\""]
45 |   }],
46 |   "post-processors": [
47 |      [
48 |       {
49 |         "output": "manifest.json",
50 |         "strip_path": true,
51 |         "type": "manifest"
52 |       }
53 |      ]
54 |   ]
55 | }
56 | 


--------------------------------------------------------------------------------
/platforms/mkasg.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | usage()
 4 | {
 5 | 	echo "$0 -parc"
 6 | 	echo "	-p run packer"
 7 | 	echo "	-a execute all actions"
 8 | 	echo "	-a create IAM roles"
 9 | 	echo "	-a create CloudFormation stack"
10 | 	exit 2
11 | }
12 | 
13 | flags=''
14 | 
15 | while [ $# -gt 0 ]; do
16 | 	case "$1" in
17 | 	-p) flags="${flags}p" ;;
18 | 	-a) flags="${flags}a" ;;
19 | 	-r) flags="${flags}r" ;;
20 | 	-c) flags="${flags}c" ;;
21 | 	*) usage ;;
22 | 	esac
23 | 	shift
24 | done
25 | 
26 | . ./vars
27 | 
28 | case ${flags} in
29 | # packer IAM
30 | *a*|*p*)
31 | 	
32 | 	SGID=$(aws ec2 describe-security-groups --filters "Name=tag:Name, Values=${PKRSG}"| jq -r '.SecurityGroups[0].GroupId')
33 | 	SUBNETID=$(aws ec2 describe-subnets --filters "Name=tag:Name, Values=${PKRSUBNET}"|jq -r '.Subnets[0].SubnetId')
34 | 	
35 | 	cd packer && packer build \
36 | 		-var "username=${USER}" \
37 | 		-var "githubname=${GHUSER}" \
38 | 		-var "sgid=${SGID}" \
39 | 		-var "subnetid=${SUBNETID}" \
40 | 		-var "ami_basename=${AMI_BASENAME}" \
41 | 		basic.json
42 | 	;;
43 | # role creation
44 | *a*|*r*)
45 | 	cd roles
46 | 	# HOSTEDZONEID needs to be set in vars for RRset
47 | 	HOSTEDZONEID=$HOSTEDZONEID python mkrole.py \
48 | 		${ROLE} ${TRUST_POLICY} ${POLICY_DOCUMENT}
49 | 	;;
50 | # CloudFormation stack creation
51 | *a*|*c*)
52 | 	# get latest built AMI id
53 | 	AMIID=$(jq -r '.last_run_uuid as $uuid | .builds[] | select(.packer_run_uuid == $uuid) | .artifact_id' packer/manifest.json)
54 | 	INSTANCEPROFILE=$(aws iam list-instance-profiles-for-role --role-name "${ROLE}"|jq -r '.InstanceProfiles[].Arn')
55 | 
56 | 	cd stack
57 | 
58 | 	# generate JSON stack
59 | 	python asg.py > ${STACKNAME}.json
60 | 	# load stack parameters
61 | 	. ./params
62 | 	PARAMFILE="${STACKNAME}-parameters.json"
63 | 	echo "${PARAMS}" > "${PARAMFILE}"
64 | 
65 | 	aws cloudformation create-stack --stack-name ${STACKNAME} --template-body file://${STACKNAME}.json --parameters file://${PARAMFILE}
66 | 	;;
67 | *)
68 | 	usage
69 | 	;;
70 | esac
71 | 


--------------------------------------------------------------------------------
/platforms/roles/mkrole.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | """This piece of code aims at simplifying IAM Roles creation
 3 | """
 4 | 
 5 | import boto3
 6 | import sys
 7 | import os
 8 | 
 9 | def usage():
10 |     print(
11 |         '{0} <role name> <trust policy JSON file> <policy document JSON>'
12 |         .format(sys.argv[0])
13 |     )
14 |     sys.exit(2)
15 | 
16 | 
17 | if len(sys.argv) < 4:
18 |     usage()
19 | 
20 | name = sys.argv[1]
21 | trust_policy_json = sys.argv[2]
22 | policy_document_json = sys.argv[3]
23 | 
24 | # load the chosen trust policy and policy document
25 | for json_file in ['trust_policy_json', 'policy_document_json']:
26 |     with open(vars()[json_file], 'r') as f:
27 |         vars()[json_file[:-5]] = f.read()
28 | 
29 | HOSTEDZONEID = os.getenv('HOSTEDZONEID')
30 | 
31 | if 'HOSTEDZONEID' in policy_document and HOSTEDZONEID:
32 |     policy_document = policy_document.replace('HOSTEDZONEID', HOSTEDZONEID)
33 | 
34 | # connect to IAM
35 | c = boto3.client('iam')
36 | 
37 | # create the instance profile
38 | # both instance_profile and role have the same same so instance profile can be
39 | # deleted from the console. Source:
40 | # http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_delete.html
41 | instance_profile = '{0}_role'.format(name)
42 | r = c.create_instance_profile(
43 |     InstanceProfileName = instance_profile
44 | )
45 | 
46 | # create the role, associated with the chosen trust policy
47 | role = '{0}_role'.format(name)
48 | r = c.create_role(
49 |     RoleName = role,
50 |     AssumeRolePolicyDocument = trust_policy
51 | )
52 | 
53 | # associate role and instance profile
54 | r = c.add_role_to_instance_profile(
55 |     InstanceProfileName = instance_profile,
56 |     RoleName = role
57 | )
58 | 
59 | # attach policy to role
60 | r = c.put_role_policy(
61 |     RoleName = role,
62 |     PolicyName = '{0}_policy'.format(name),
63 |     PolicyDocument = policy_document
64 | )
65 | 
66 | print(
67 |     'Role {0} created with Instance Profile {1}'
68 |     .format(role, instance_profile)
69 | )
70 | 


--------------------------------------------------------------------------------
/ec2home/main.tf:
--------------------------------------------------------------------------------
 1 | provider "aws" {
 2 |   region = "${var.aws_region}"
 3 |   profile = "${var.aws_profile}"
 4 | }
 5 | 
 6 | data "aws_ami" "ami_type" {
 7 |   most_recent = true
 8 | 
 9 |   filter {
10 |     name   = "name"
11 |     values = ["${var.ami_filter}"]
12 |   }
13 | 
14 |   filter {
15 |     name   = "virtualization-type"
16 |     values = ["hvm"]
17 |   }
18 | 
19 |   owners = ["${var.ami_owner}"]
20 | }
21 | 
22 | resource "aws_security_group" "ssh_sg" {
23 |   name = "inbound SSH"
24 | 
25 |   ingress {
26 |     from_port   = 22
27 |     to_port     = 22
28 |     protocol    = "tcp"
29 |     cidr_blocks = ["0.0.0.0/0"]
30 |   }
31 | 
32 |   egress {
33 |     from_port   = 0
34 |     to_port     = 0
35 |     protocol    = "-1"
36 |     cidr_blocks = ["0.0.0.0/0"]
37 |   }
38 | 
39 |   tags {
40 |     Name = "allow_ssh"
41 |   }
42 | }
43 | 
44 | resource "aws_instance" "ec2_instance" {
45 |   ami                         = "${data.aws_ami.ami_type.id}"
46 |   instance_type               = "${var.instance_type}"
47 |   subnet_id                   = "${var.subnet_id}"
48 |   vpc_security_group_ids      = ["${aws_security_group.ssh_sg.id}"]
49 |   key_name                    = "${var.keypair}"
50 |   associate_public_ip_address = "${var.associate_public_ip}"
51 |   count                       = 1
52 | 
53 |   tags {
54 |     created_by = "terraform"
55 |     Name = "${var.instance_name}"
56 |   }
57 | 
58 |   provisioner "remote-exec" {
59 |     inline = ["sudo apt-get -y install python"]
60 | 
61 |     connection {
62 |       type        = "ssh"
63 |       user        = "${var.ec2admin_user}"
64 |       private_key = "${file(var.ssh_private_key)}"
65 |     }
66 |   }
67 | 
68 |   provisioner "local-exec" {
69 |     command = "ansible-playbook -u ${var.ec2admin_user} -i '${self.public_ip},' --private-key ${var.ssh_private_key} -T 300 ${var.playbook} --extra-vars ${var.extra_vars}"
70 |   }
71 | }
72 | 
73 | resource "aws_route53_record" "instance" {
74 |   zone_id = "${var.zone_id}"
75 |   name    = "${var.fqdn}"
76 |   type    = "A"
77 |   ttl     = "300"
78 |   records = ["${aws_instance.ec2_instance.public_ip}"]
79 | }
80 | 


--------------------------------------------------------------------------------
/platforms/scripts/meta2dict.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | """Converts and return an AWS EC2 metadata in a dict format.
 3 | 
 4 | This module makes easier the task of finding and reading instances values
 5 | located in the http://169.254.169.254/ `virtual web server`_.
 6 | 
 7 | Its usage is trivial::
 8 | 
 9 |     import meta2dict
10 | 
11 |     ec2meta = meta2dict.load()
12 | 
13 | .. _virtual web server:
14 |    http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html
15 | 
16 | """
17 | 
18 | import json
19 | import requests
20 | 
21 | 
22 | def load(root='latest'):
23 |     """Returns instance metadata in a dict format.
24 | 
25 |     Args:
26 |         root (str): root directory.
27 | 
28 |     Return:
29 |         dict: instance metadata.
30 | 
31 |     """
32 |     metaurl = 'http://169.254.169.254/{0}'.format(root)
33 |     # those 3 top subdirectories are not exposed with a final '/'
34 |     metadict = {'dynamic': {}, 'meta-data': {}, 'user-data': {}}
35 | 
36 |     for subsect in metadict:
37 |         _datacrawl('{0}/{1}/'.format(metaurl, subsect), metadict[subsect])
38 | 
39 |     return metadict
40 | 
41 | 
42 | def _datacrawl(url, d):
43 |     """Recursively populates a dict with metadata.
44 | 
45 |     Args:
46 |         url (str): URL to parse
47 |         d (dict): dict to populate data with
48 | 
49 |     """
50 |     r = requests.get(url)
51 |     if r.status_code == 404:
52 |         return
53 | 
54 |     for l in r.text.split('\n'):
55 |         if not l: # handle "instance-identity/\n" case
56 |             continue
57 |         newurl = '{0}{1}'.format(url, l)
58 |         # a key is detected with a final '/'
59 |         if l.endswith('/'):
60 |             newkey = l.split('/')[-2]
61 |             d[newkey] = {}
62 |             _datacrawl(newurl, d[newkey])
63 | 
64 |         else:
65 |             r = requests.get(newurl)
66 |             if r.status_code != 404:
67 |                 try:
68 |                     d[l] = json.loads(r.text)
69 |                 except ValueError:
70 |                     d[l] = r.text
71 |             else:
72 |                 d[l] = None
73 | 
74 | 
75 | 
76 | if __name__ == '__main__':
77 |     # test the load function
78 |     print(json.dumps(load()))
79 | 


--------------------------------------------------------------------------------
/platforms/packer/essentials.yml:
--------------------------------------------------------------------------------
  1 | ---
  2 | # call me with --extra-vars "myuser=foo myghuser=foogh"
  3 | 
  4 | - hosts: all
  5 |   become: true
  6 | 
  7 |   vars:
  8 |     vimrc: |
  9 |       syntax on
 10 |       set ts=8
 11 |       set noai
 12 |       set ruler
 13 |       set tw=80
 14 |       set t_Co=256
 15 |       colorscheme molokai-transparent
 16 |       set laststatus=2
 17 | 
 18 |       au FileType python set ts=4 expandtab
 19 |       au FileType javascript set ts=4 expandtab
 20 |       au FileType html set ts=2 expandtab
 21 |       au FileType yaml,json set ts=2 expandtab
 22 | 
 23 |     tmuxconf: |
 24 |       set-option -g prefix2 C-q
 25 |       set-option -g default-terminal "screen-256color"
 26 | 
 27 |     profile: |
 28 |       PATH=${PATH}:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin:$HOME/bin
 29 |       # use vim for sudoedit and all $EDITOR
 30 |       EDITOR=vim
 31 |       VISUAL=$EDITOR
 32 |       export EDITOR VISUAL
 33 |       # allow ^Q for screen / tmux
 34 |       stty -ixon
 35 | 
 36 | 
 37 |   tasks:
 38 |     - name: installs essential tools
 39 |       apt: name={{item}} state=installed
 40 |       with_items:
 41 |         - vim-nox
 42 |         - sudo
 43 |         - tmux
 44 |         - build-essential
 45 |         - git
 46 |         - python
 47 |         - python-pip
 48 |         - zsh
 49 | 
 50 | ## sudo
 51 | 
 52 |     - name: make sudo group passwordless
 53 |       blockinfile:
 54 |         dest: /etc/sudoers
 55 |         block: |
 56 |           %sudo ALL=(ALL) NOPASSWD: ALL
 57 | 
 58 | ## create the user
 59 | 
 60 |     - name: user add
 61 |       user:
 62 |         name: "{{myuser}}"
 63 |         groups: sudo
 64 |         shell: /usr/bin/zsh
 65 | 
 66 | ## aws
 67 | 
 68 |     - name: install AWS CLI
 69 |       pip: name=awscli
 70 | 
 71 | ## shell
 72 | 
 73 |     - name: install powerline from pip
 74 |       pip: name=powerline-status
 75 | 
 76 |     - name: record powerline module path
 77 |       command: python -c "import powerline, os; print(os.path.dirname(powerline.__file__))"
 78 |       register: powerlinepath
 79 |       failed_when: powerlinepath is undefined
 80 | 
 81 |     - name: profile and powerline autoload
 82 |       copy:
 83 |         content: |
 84 |           {{profile}}
 85 | 
 86 |           powerline-daemon -q
 87 |           . {{powerlinepath.stdout_lines[0]}}/bindings/bash/powerline.sh
 88 |         dest: "/home/{{myuser}}/.zshrc"
 89 | 
 90 | ## vim
 91 | 
 92 |     - name: fetch vim themes
 93 |       git:
 94 |         repo: https://github.com/hugoroy/.vim
 95 |         dest: "/home/{{myuser}}/.vim"
 96 | 
 97 |     - name: create basic vimrc
 98 |       copy: content="{{vimrc}}\nset rtp+={{powerlinepath.stdout_lines[0]}}/bindings/vim\n" dest="/home/{{myuser}}/.vimrc"
 99 | 
100 | ## tmux
101 | 
102 |     - name: powerline support for tmux
103 |       copy: content="{{tmuxconf}}\nsource {{powerlinepath.stdout_lines[0]}}/bindings/tmux/powerline.conf\n" dest="/home/{{myuser}}/.tmux.conf"
104 | 
105 | ## chown user
106 | 
107 |     - name: create .ssh directory
108 |       file:
109 |         path: "/home/{{myuser}}/.ssh"
110 |         state: directory
111 |         mode: 0700
112 | 
113 |     - name: fetch SSH pubkeys
114 |       get_url:
115 |         url: "https://github.com/{{myghuser}}.keys"
116 |         dest: "/home/{{myuser}}/.ssh/authorized_keys"
117 |         mode: 0600
118 | 
119 |     - name: chown user
120 |       file:
121 |         path: "/home/{{myuser}}"
122 |         owner: "{{myuser}}"
123 |         recurse: yes
124 | 


--------------------------------------------------------------------------------
/kriskross/kriskross.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python
  2 | """
  3 | Starts an AWS console from the shell based on cross account roles.
  4 | 
  5 | See `README.md` for more details.
  6 | 
  7 | Usage:
  8 |   kriskross.py <target> [--awsaccounts=<file> --mfa=<token>]
  9 | 
 10 | """
 11 | 
 12 | import os
 13 | import sys
 14 | import json
 15 | import uuid
 16 | import boto3
 17 | import requests
 18 | import webbrowser
 19 | from docopt import docopt
 20 | from distutils.spawn import find_executable
 21 | from flask import Flask, request, render_template, url_for
 22 | 
 23 | app = Flask(__name__)
 24 | 
 25 | # add more!
 26 | browser_private_flag = {
 27 |     'chrome': '--incognito',
 28 |     'firefox': '--private-window'
 29 | }
 30 | 
 31 | def loadprefs():
 32 |     """load preferences file
 33 |     """
 34 |     if 'awsaccounts' not in locals() or awsaccounts == None:
 35 |         awsaccounts = '{0}/.awsaccounts'.format(os.path.expanduser('~'))
 36 | 
 37 |     return json.load(open(awsaccounts))
 38 | 
 39 | 
 40 | def do_auth(prefs, target, mfatoken):
 41 |     """Assume role, retrieve temporary token, authenticate and launch browser
 42 |     """
 43 |     signin_url = 'https://signin.aws.amazon.com/federation'
 44 |     console_url = 'https://console.aws.amazon.com/'
 45 | 
 46 |     # prepare assume role parameters
 47 |     params = {}
 48 |     params['RoleArn'] = 'arn:aws:iam::{0}:role/{1}'.format(
 49 |         prefs[target]['account'], prefs[target]['role']
 50 |     )
 51 |     # random hexadecimal
 52 |     params['RoleSessionName'] = uuid.uuid4().hex
 53 |     # ExternalId for 3rd party accounts
 54 |     if 'external-id' in prefs[target]:
 55 |         params['ExternalId'] = prefs[target]['external-id']
 56 |     # MFA token
 57 |     if mfatoken != None and 'mfa' in prefs[target]:
 58 |         params['SerialNumber'] = prefs[target]['mfa']
 59 |         params['TokenCode'] = mfatoken
 60 | 
 61 |     # Session duration
 62 |     if 'duration' in prefs[target]:
 63 |         params['DurationSeconds'] = prefs[target]['duration']
 64 | 
 65 |     p = {}
 66 |     if 'profile' in prefs[target]:
 67 |         p['profile_name'] = prefs[target]['profile']
 68 | 
 69 |     s = boto3.Session(**p)
 70 |     sts = s.client('sts')
 71 | 
 72 |     creds = sts.assume_role(**params)
 73 | 
 74 |     json_creds = json.dumps(
 75 |         {
 76 |             'sessionId': creds['Credentials']['AccessKeyId'],
 77 |             'sessionKey': creds['Credentials']['SecretAccessKey'],
 78 |             'sessionToken': creds['Credentials']['SessionToken']
 79 |         }
 80 |     )
 81 | 
 82 |     params = {'Action': 'getSigninToken', 'Session': json_creds}
 83 | 
 84 | 
 85 |     r = requests.get(signin_url, params = params)
 86 | 
 87 |     params = {
 88 |         'Action': 'login',
 89 |         'Issuer': '',
 90 |         'Destination': console_url,
 91 |         'SigninToken': json.loads(r.text)['SigninToken'],
 92 |     }
 93 | 
 94 |     if 'external-id' in prefs[target]:
 95 |         params['ExternalId'] = prefs[target]['external-id']
 96 | 
 97 |     uri = '{0}?{1}'.format(signin_url, requests.compat.urlencode(params))
 98 | 
 99 |     if 'private' in prefs[target] and prefs[target]['private'] == 'yes':
100 |         browserapp = os.environ.get('BROWSER')
101 | 
102 |         if browserapp:
103 |             browserpath = find_executable(browserapp)
104 |             private = ''
105 |             if browserpath:
106 |                 for k in browser_private_flag.keys():
107 |                     if k in browserapp:
108 |                         private = ' {0} %s'.format(browser_private_flag[k])
109 | 
110 |                 browser = webbrowser.get('{0}{1}'.format(browserpath, private))
111 |                 browser.open(uri)
112 |                 return
113 | 
114 |     webbrowser.open(uri)
115 | 
116 | 
117 | @app.route('/', methods=['GET', 'POST'])
118 | def web_service():
119 |     """Minimal web service to receive MFA
120 |     """
121 |     prefs = loadprefs()
122 |     msg = None
123 |     err = None
124 |     target = None
125 |     if request.method == 'POST':
126 |         try:
127 |             target = request.form['target']
128 |             do_auth(prefs, target, request.form['mfa'])
129 |             msg = 'success'
130 |         except Exception, e:
131 |             msg = 'danger'
132 |             err = str(e)
133 | 
134 |     return render_template(
135 |         'targets.html', prefs = prefs, msg = msg, err = err, target = target
136 |     )
137 | 
138 | 
139 | if __name__ == "__main__":
140 |     args = docopt(__doc__, version = 'kriskross 0.3')
141 | 
142 |     target = args.get('<target>')
143 |     awsaccounts = args.get('--awsaccounts')
144 |     mfatoken = args.get('--mfa')
145 | 
146 |     do_auth(loadprefs(), target, mfatoken)
147 | 
148 | 


--------------------------------------------------------------------------------
/kriskross/README.md:
--------------------------------------------------------------------------------
  1 | <p align="center">
  2 |   <img src="https://imil.net/stuff/kriskrosslogo2.png" alt="Jump! Jump!"/>
  3 | </p>
  4 | 
  5 | ### About
  6 | 
  7 | `kriskross` can start an _AWS_ console **on your own account**, sub-accounts or third party accounts using cross account roles from the **shell** or a basic **web service**: no more struggling with your _AWS console login / password_!. It can read `awscli` _profile_ and has [MFA][2] support. As a minimal web server`kriskross` makes _MFA_ copy & paste from your mobile device less prone to
  8 | errors.  
  9 | Learn about Cross-Account Access [in this very well written article][5].
 10 | 
 11 | _Hint: yes you **can** attach a cross account role to your own local account just by entering your own account id when creating the cross account role._
 12 | 
 13 | ### Configuration
 14 | 
 15 | It uses an `~/.awsaccounts` _JSON_ file with the format:
 16 | 
 17 | ```
 18 | {
 19 |     "target": {
 20 |         "account": "AWS account id",
 21 |         "role": "cross account access role name",
 22 |         "external-id": "optional external id for secure 3rd party access",
 23 |         "mfa": "optional MFA device serial number",
 24 |         "profile": "optional aws cli profile name for non-default direct access"
 25 |     },
 26 |     {
 27 |         ...
 28 |     }
 29 | }
 30 | ```
 31 | 
 32 | An example `awsaccount` file would be:
 33 | 
 34 | ```
 35 | {
 36 |     "myownaccount": {
 37 |         "account": "636487856791",
 38 |         "role": "MFAAdmin",
 39 |         "mfa": "arn:aws:iam::225011332614:mfa/MySelf"
 40 |     },
 41 |     "childaccount": {
 42 |         "account": "287487895991",
 43 |         "role": "ChildAdmin",
 44 |     },
 45 |     "thirdpartyaccount": {
 46 |         "account": "981036328202",
 47 |         "role": "ThirdParty",
 48 |         "external-id": "123456789"
 49 |     },
 50 |     "thirdpartyaccountwithMFA": {
 51 |         "account": "123036328892",
 52 |         "role": "ThirdParty",
 53 |         "external-id": "123456789"
 54 |         "mfa": "arn:aws:iam::225011332614:mfa/MySelf"
 55 |     },
 56 |     "myotheraccount": {
 57 |         "profile": "othercompany",
 58 |         "account": "123468236778",
 59 |         "role": "MFAAdmin",
 60 |         "mfa": "arn:aws:iam::678067632434:mfa/MySelf"
 61 |     }
 62 | }
 63 | ```
 64 | 
 65 | * The hash index is really a label, independent from your `~/.aws` configuration.
 66 | * `account` is the account number to build the role from.
 67 | * `role` is the role name.
 68 | * `mfa` is the _MFA_ "serial device", actually the _ARN_ as shown in the _IAM_ console.
 69 | * `external-id` is the arbitrary `id` you agreed to use with the third party.
 70 | * `profile` is an _AWS_ `profile_name` you would like to pivot from.
 71 | * `duration` is the role session duration, in seconds. Default duration is 3600, max session is 12 hours.
 72 | * `private` might be set to `yes` if you'd like to open the console on a browser private window (only _Firefox_ or _Chrome_ by now)
 73 |   * This feature relies on a `BROWSER` variable containing the executable name for your favorite web browser. Either add `BROWSER=firefox; export BROWSER` (or `google-chrome`) to your shell profile file, or prepend `kriskross` execution with the variable set.
 74 | 
 75 | A very simple, single account based file could be:
 76 | 
 77 | ```
 78 | {
 79 |   "simpleaccount": {
 80 |     "account": "636487856791"
 81 |     "role": "myrole"
 82 |   }
 83 | }
 84 | ```
 85 | 
 86 | Assuming you created a role called `myrole` in your current account, with the same account `id` as the source account, yes, this works. This configuration relies on a `~/.aws/{credentials,config}` with a default section and the corresponding `aws_access_key_id` / `aws_secret_access_key` pair.
 87 | 
 88 | There are many possible combinations:
 89 | 
 90 | * Direct, own account access, by creating a cross account role with the local account id
 91 | * Child account, by enabling cross account access
 92 | * Third party account using an external id
 93 | * Third party account using an external id and MFA
 94 | * Direct account access using [awscli][1] profiles
 95 | 
 96 | All with or without MFA (while enabling MFA is highly recommended).
 97 | 
 98 | You may give an alternative path and name for the account properties file using the
 99 | `--awsaccounts=` parameter.  
100 | If the role uses a MFA device, specify it with the `--mfa` parameter along with a `mfa` key associated with the target in the `awsaccounts` file which value is the MFA device serial number.
101 | 
102 | ### Usage
103 | 
104 | From the command line:
105 | 
106 | ```
107 | kriskross.py <target> [--awsaccounts=<file> --mfa=<token>]
108 | ```
109 | 
110 | Start as a foreground local web service ([Flask][3] default port is _5000_):
111 | 
112 | ```
113 | export FLASK_APP=kriskross.py
114 | python -m flask run --host=0.0.0.0
115 | ```
116 | 
117 | Or start it as a daemon with [gunicorn][4] (default port _8000_):
118 | 
119 | ```
120 | gunicorn -D -b 0.0.0.0 kriskross:app
121 | ```
122 | 
123 | ### History
124 | 
125 | This script is vaguely derived from _AWS_:
126 | https://aws.amazon.com/blogs/security/how-to-enable-cross-account-access-to-the-aws-management-console/
127 | and this `botocore` version:
128 | https://gist.githubusercontent.com/garnaat/10682964/raw/ef1caa152c006e33b54c0be8226f31ba35db331e/gistfile1.py  
129 | 
130 | [1]: https://github.com/aws/aws-cli
131 | [2]: https://aws.amazon.com/iam/details/mfa/
132 | [3]: http://flask.pocoo.org/
133 | [4]: http://gunicorn.org/
134 | [5]: https://aws.amazon.com/blogs/security/how-to-enable-cross-account-access-to-the-aws-management-console/
135 | 


--------------------------------------------------------------------------------
/mods/session.py:
--------------------------------------------------------------------------------
  1 | 
  2 | '''Helper functions in order to easily manipulate AWS objects with `boto3`_
  3 | 
  4 | .. module:: Aws
  5 |    :platform: UNIX
  6 |    :synopsis: Ease access to boto3 and wraps many useful functions
  7 | 
  8 | .. moduleauthor:: Emile 'iMil' Heitor <imil@NetBSD.org>
  9 | 
 10 | .. _boto3: http://boto3.readthedocs.org/en/latest/
 11 | '''
 12 | 
 13 | import boto3
 14 | import base64
 15 | import requests
 16 | 
 17 | class Aws:
 18 |     '''Aws class constructor
 19 | 
 20 |     :param str profile: Region profile, as defined in awscli configuration
 21 |     :param str t: Resource type, like ``ec2``, ``cloudformation``...
 22 | 
 23 |     :return: Access to resource, client and helpers
 24 |     '''
 25 |     def __init__(self, profile, t):
 26 |         '''Init method
 27 |         '''
 28 |         self.profile = profile
 29 |         if profile:
 30 |             self.session = boto3.Session(profile_name=profile)
 31 |             self.region = self.session._session.get_config_variable('region')
 32 |         if t:
 33 |             self.client = self.session.client(t)
 34 |             # some objects don't have resource (i.e. route53)
 35 |             try:
 36 |                 self.resource = self.session.resource(t)
 37 |             except:
 38 |                 pass
 39 | 
 40 |     def lsinstances(self, obj):
 41 |         '''Get all instances objects
 42 | 
 43 |         :param str obj: String form of resource type to get list from
 44 |         :return: All instances in object form
 45 |         '''
 46 |         return getattr(self.resource, obj).all()
 47 | 
 48 |     def mktags(self, taglst):
 49 |         '''Makes a Filter-friendly tag list
 50 | 
 51 |         :param dict taglst: A dict of key / value pairs
 52 | 
 53 |         :return: Filter-friendly tag list
 54 |         :rtype: dict
 55 |         '''
 56 |         tags = []
 57 |         for t in taglst:
 58 |             tags.append({'Key': t, 'Value': taglst[t]})
 59 |         return tags
 60 | 
 61 |     def tags2dict(self, tags):
 62 |         '''Converts a Filter tag list to a dict
 63 | 
 64 |         :param dict tags: A dict of Filter tag list
 65 | 
 66 |         :return: A simple key / value dict
 67 |         :rtype: dict
 68 |         '''
 69 |         ret = {}
 70 |         for t in tags:
 71 |             ret[t['Key']] = t['Value']
 72 |         return ret
 73 | 
 74 |     def get_id_from_nametag(self, res, tag):
 75 |         '''Returns a resource id matching a Name tag
 76 | 
 77 |         :param str obj: The resource to get the id from
 78 |         :param str tag: The Name tag
 79 | 
 80 |         :return: Resource id
 81 |         '''
 82 |         for o in getattr(self.resource, res).filter(
 83 |             Filters=[{'Name': 'tag:Name', 'Values': [tag]}]
 84 |         ):
 85 |             return o.id
 86 |     
 87 |         return None
 88 | 
 89 |     def mkuserdata(self, b64 = False, userdata = [], name = '', netblock = ''):
 90 |         '''Merge userdata files and possibly convert it to ``base64``
 91 | 
 92 |         :param boolean b64: Should we convert userdata to ``base64``
 93 |         :param list userdata: A list of userdata files
 94 |         :param str name: Name to be passed as an argument to userdata
 95 |         :param str netblock: Netblock (CIDR) argument for userdata
 96 | 
 97 |         :return: Merged userdata files, possibly in ``base64``
 98 |         :rtype: str
 99 |         '''
100 |         sh = ''
101 |         for u in userdata:
102 |             with open('userdata/{0}'.format(u), 'r') as f:
103 |                 sh = sh + f.read()
104 |         sh = sh.format(self.profile, name.lower(), netblock)
105 |         if b64 is False:
106 |             return sh
107 |         else:
108 |             return base64.b64encode(sh)
109 | 
110 |     def gettagval(self, res, tag):
111 |         '''Returns a tag value for a given resource
112 | 
113 |         :param str res: The resource to get the tag from
114 |         :param str tag: Tag's name
115 | 
116 |         :return: Tag value
117 |         :rtype: str
118 |         '''
119 |         for t in res.tags:
120 |             if t['Key'].lower() == tag.lower():
121 |                 return t['Value']
122 |         return 'none'
123 | 
124 |     def create_tag(self, rid, k, v):
125 |         '''Creates a tag entry for a given resource
126 | 
127 |         :param rid: Resource id
128 |         :k: Tag key, will be titled (upper case first letter)
129 |         :v: Tag value
130 |         '''
131 |         self.resource.create_tags(
132 |             Resources = [rid],
133 |             Tags = self.mktags({
134 |                 k.title(): v
135 |             })
136 |         )
137 | 
138 |     def lsinstnames(self):
139 |         '''Returns a dict of instances ids and Name tag
140 | 
141 |         :return: Dict of ``key`` = ``id`` / ``value`` = ``Name tag``
142 |         '''
143 |         instances = self.resource.instances.all()
144 |         instname = {}
145 |         for i in instances:
146 |             instname[i.id] = self.gettagval(i, 'Name')
147 | 
148 |         return instname
149 | 
150 |     def dmesg(self, name):
151 |         '''Returns console output for a given instance ``id`` or Name tag
152 | 
153 |         :param str name: Instance ``id`` or Name tag
154 | 
155 |         :return: Console output
156 |         :rtype: str
157 |         '''
158 |         instances = self.lsinstnames()
159 |         for i in instances:
160 |             if name in i or name in instances[i]:
161 |                 return self.client.get_console_output(InstanceId=i)['Output']
162 | 
163 |     def getamis(self, glob):
164 |         '''Returns all AMI ids and creation date ordered by the latter
165 | 
166 |         :param str glob: An AMI name ``glob``
167 | 
168 |         :return: Ordered list of AMI ids
169 |         :rtype: list
170 |         '''
171 |         imgs = {}
172 |         for i in self.resource.images.filter(
173 |             Filters = [{'Name': 'name', 'Values': [glob]}]
174 |         ):
175 |             imgs[i.id] = i.creation_date
176 |         return sorted(imgs, key = imgs.get)
177 | 
178 |     def get_debian_ami(self, glob):
179 |         '''Returns an AMI id matching with official debian wiki list
180 | 
181 |         :return: Latest AMI matching the ``glob``
182 |         :rtype: str
183 |         '''
184 |         for rel in ['Wheezy', 'Jessie']:
185 |             if rel.lower() in glob:
186 |                 break
187 | 
188 |         r = requests.get(
189 |             'https://wiki.debian.org/Cloud/AmazonEC2Image/{0}'.format(rel)
190 |         )
191 |         for ami in self.getamis(glob):
192 |             if ami in r.text:
193 |                 return ami
194 | 
195 |     def getami(self, glob):
196 |         '''Returns the latest AMI matching ``glob``
197 | 
198 |         :param str glob: An AMI name ``glob``
199 | 
200 |         :return: Latest AMI matching the ``glob``
201 |         :rtype: str
202 |         '''
203 |         return self.getamis(glob)[-1]
204 | 
205 |     def getinst(self, iid):
206 |         '''Returns an instance resource
207 | 
208 |         :param str iid: Instance id
209 | 
210 |         :return: Instance resource
211 |         '''
212 |         return self.resource.Instance(iid)
213 | 
214 |     def getall(self, res):
215 |         '''Return all occurences for a resource
216 | 
217 |         :param str res: Resource name
218 | 
219 |         :return: List of all resources
220 |         :rtype: list
221 |         '''
222 |         return [i for i in getattr(self.resource, res).all()]
223 | 
224 |     def change_nsrecord(self, action, dnsrecord):
225 |         '''Create, delete or modify a DNS record
226 | 
227 |         :param str action: One of ``CREATE``, ``DELETE`` or ``UPSERT``
228 |         :param dict dnsrecord: A dict describing the DNS record to change
229 | 
230 |         .. code-block:: python
231 | 
232 |            dnsrecord = {
233 |                'zone': 'foo.com',  # domain name
234 |                'rectype': 'A'|'NS'|'CNAME'|'MX'|'PTR'|'SRV'|'SPF'|'AAAA',
235 |                'name': 'myhost',  # host part only
236 |                'target': 'targetId'|'www.bar.com'|'10.0.0.1',
237 |                'ttl': 300,  # do not add TTL for an alias target
238 |                'healthcheck': True,  # optional, alias target only
239 |                'dnsname': 'foo-1.region.amazonaws.com'  # alias target only
240 |            }
241 | 
242 |         .. note::
243 | 
244 |            For a ``targetId`` record, ``dnsname`` is the external DNS name AWS
245 |            creates for the ELB, S3 bucket, CloudFront distribution or another
246 |            route 53 resource on the same hosted zone.
247 |            Also note that an ``AliasTarget`` must not have a ``TTL`` specified.
248 | 
249 |         Usage:
250 | 
251 |         .. code-block:: python
252 | 
253 |            obj.change_nsrecord('CREATE', dnsrecord)
254 | 
255 |         Documentation:
256 | 
257 |         * http://docs.aws.amazon.com/Route53/latest/APIReference/CreateAliasRRSAPI.html
258 |         * http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/quickref-route53.html
259 |         * http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-choosing-alias-non-alias.html
260 | 
261 |         '''
262 | 
263 |         hzones = self.client.list_hosted_zones_by_name(
264 |             DNSName = dnsrecord['zone']
265 |         )
266 |         zoneid = hzones['HostedZones'][0]['Id']
267 | 
268 |         dnsname = '{0}.{1}.'.format(dnsrecord['name'], dnsrecord['zone'])
269 | 
270 |         change = {
271 |             'Action': action,
272 |             'ResourceRecordSet': {
273 |                 'Name': dnsname,
274 |                 'Type': dnsrecord['rectype'],
275 |             }
276 |         }
277 | 
278 |         if 'dnsname' in dnsrecord:  # Alias target
279 |             if not 'healthcheck' in dnsrecord:
280 |                 hc = False
281 |             else:
282 |                 hc = dnsrecord['healthcheck']
283 |             change['ResourceRecordSet']['AliasTarget'] = {
284 |                 'HostedZoneId': dnsrecord['target'],
285 |                 'DNSName': dnsrecord['dnsname'],
286 |                 'EvaluateTargetHealth': hc
287 |             }
288 |             change['ResourceRecordSet']['SetIdentifier'] = '{0}_{1}_{2}'.format(
289 |                 self.region, dnsrecord['name'], dnsrecord['zone']
290 |             )
291 |             change['ResourceRecordSet']['Region'] = self.region
292 |         else:
293 |             change['ResourceRecordSet']['TTL'] = dnsrecord['ttl']
294 |             change['ResourceRecordSet']['ResourceRecords'] = [
295 |                 {'Value': dnsrecord['target']}
296 |             ]
297 | 
298 |         cb = {
299 |             'Comment': '{0} / {1} / {2}'.format(
300 |                 action, dnsrecord['name'], dnsrecord['zone']
301 |             ),
302 |             'Changes': [change]
303 |         }
304 | 
305 |         self.client.change_resource_record_sets(
306 |             HostedZoneId = zoneid,
307 |             ChangeBatch = cb
308 |         )
309 | 


--------------------------------------------------------------------------------
/mods/awsprice.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python
  2 | 
  3 | '''Price and attributes retrieval module for EC2 and RDS AWS resources
  4 | 
  5 | This module uses the HTML code within AWS website, which will most probably
  6 | change from time to time, dont blindly rely on this module before checking it
  7 | is still functionnal.
  8 | 
  9 | AWS website has ``<script>`` sections containing ``JavaScript`` which declares
 10 | a ``model`` variable. This variable points to an URL whose content is JS
 11 | readable ``JSON`` listing instances types, attributes and prices.
 12 | 
 13 | This module uses those ``JSON`` dicts to build ``python`` dicts.
 14 | 
 15 | .. note::
 16 | 
 17 |    As of 06/2015, the resources you might be interested in will probably be:
 18 | 
 19 |      - \*-od: on-demand attributes and on-demand price only
 20 |      - ri-v2/\*: prices by reserved instance options
 21 | 
 22 |    All resource types can be retrieved with the ``get_restype`` function
 23 | 
 24 | Typical usage:
 25 | 
 26 |    .. code-block:: python
 27 |    
 28 |       fulllist = ap.get_all_instances(
 29 |           'us-west-1', 'ec2', 'ri-v2/linux-unix-shared'
 30 |       )
 31 |       ap.instance_price(fulllist, 'm3.xlarge')
 32 | 
 33 | '''
 34 | 
 35 | import requests
 36 | import re
 37 | import sys
 38 | import json
 39 | from bs4 import BeautifulSoup
 40 | 
 41 | def get_awshtml(resource):
 42 |     '''Retrieve JS from AWS website for a given resource (``ec2`` or ``rds``)
 43 | 
 44 |     :param str resource: Resource to query, ``ec2`` or ``rds``
 45 | 
 46 |     :return text:
 47 |     :rtype: str
 48 |     '''
 49 |     return BeautifulSoup(requests.get(
 50 |         'http://aws.amazon.com/{0}/pricing/'.format(resource)
 51 |     ).text)
 52 | 
 53 | def get_models(resource):
 54 |     '''Retrieve available models
 55 | 
 56 |     :param str resource: Resource to query, ``ec2`` or ``rds``
 57 | 
 58 |     :return urllist: List of available models urls
 59 |     :rtype: list
 60 |     '''
 61 | 
 62 |     s = get_awshtml(resource)
 63 |     urllist = []
 64 |     for m in s.find_all('script'):
 65 |         r = re.search('model:[^\']*\'([^\']+)', m.text)
 66 |         if r and r.group(1):
 67 |             urllist.append('http:{0}'.format(r.group(1)))
 68 | 
 69 |     return urllist
 70 | 
 71 | def get_regions(resource, restype):
 72 |     '''Returns attributes or price list dict by regions
 73 | 
 74 |     :param str resource: Resource to query, ``ec2`` or ``rds``
 75 |     :param str restype: Resource type (``linux-od``, ``rhel-od`` ...)
 76 | 
 77 |     :return: Price list with region as key
 78 |     :rtype: dict
 79 |     '''
 80 | 
 81 |     models = get_models(resource)
 82 | 
 83 |     for url in models:
 84 |         if restype not in url:
 85 |             continue
 86 | 
 87 |         js = requests.get(url)
 88 | 
 89 |         # as of 31/05/2015, format is
 90 |         # od: callback({vers=0.01,config{:{...}});
 91 |         # reserved: callback({config{:{...}},vers:0.01});
 92 |         jregex = re.search('.+config:(\{(.+)\})(\}\);|,vers:0\.0.+)', js.text)
 93 |         if jregex:
 94 |             s = re.sub(r'([a-zA-Z0-9_-]+):', r'"\1":', jregex.group(1))
 95 |             pricelist = json.loads(s)
 96 |             return [r for r in pricelist['regions']]
 97 | 
 98 |     return {}
 99 | 
100 | def get_all_instances(region = None, resource = None, restype = None):
101 |     '''Returns an array of resource type on region
102 | 
103 |     :param str region: Region to lookup (``us-west-1`` ...)
104 |     :param str resource: Resource to query, ``ec2`` or ``rds``
105 |     :param str restype: Resource type (``linux-od``, ``rhel-od`` ...)
106 | 
107 |     :return prices: Dict containing instances properties and prices per hour
108 |     :rtype: dict
109 | 
110 |     .. note::
111 | 
112 |        as of 31/05/2015, format is
113 |        model: '//a0.awsstatic.com/pricing/1/ec2/linux-od.min.js'
114 |     '''
115 | 
116 |     pricelist = get_regions(resource, restype)
117 |     for reg in pricelist:
118 |         if reg['region'] == region:
119 |             return reg
120 | 
121 |     return None
122 | 
123 | def get_instance_attrs(fulllist, itype):
124 |     '''Returns instance price and caracteristics for a given region
125 | 
126 |     :param str fulllist: Full instance list from ``get_all_instances``
127 |     :param str itype: Instance type
128 | 
129 |     :return: Dict of instance caracteristics
130 |     :rtype: dict
131 |     '''
132 | 
133 |     for itypes in fulllist['instanceTypes']:
134 |         for i in itypes['sizes']:
135 |             if i['size'] == itype:
136 |                 return i
137 | 
138 | def get_instance_prices(fulllist, itype):
139 |     '''Returns prices corresponding to a reserve instance type, as of 26/06/15,
140 |     those are listed in the ``ri-v2/*`` rtypes.
141 | 
142 |     :param str fulllist: Full instance list from ``get_all_instances``
143 |     :param str itype: Instance type
144 | 
145 |     :return: Dict of given instance type price
146 |     :rtype: dict
147 |     '''
148 | 
149 |     inst_type = {}
150 |     for inst_type in fulllist['instanceTypes']:
151 |         if inst_type['type'] == itype:
152 |             return inst_type['terms']
153 | 
154 | def get_insttypes(fulllist):
155 | 
156 |     inst_types = []
157 |     for inst_type in fulllist['instanceTypes']:
158 |         inst_types.append(inst_type['type'])
159 | 
160 |     return inst_types
161 | 
162 | def get_restype(resource):
163 |     '''List resource types
164 | 
165 |     :param str resource: Resource to query, ``ec2`` or ``rds``
166 | 
167 |     :return: List of resource types
168 |     :rtype: list
169 |     '''
170 | 
171 |     models = get_models(resource)
172 | 
173 |     typelist = []
174 |     for url in models:
175 |         restype = re.search('.*/{0}/(.+)\.min\.js'.format(resource), url)
176 |         if restype and restype.group(1):
177 |             typelist.append(restype.group(1))
178 | 
179 |     return typelist
180 | 
181 | def instance_price(fulllist, itype):
182 |     '''An example function that gives prices for a given instance type
183 | 
184 |     :param str fulllist: Full instance list from ``get_all_instances``
185 |     :param str itype: Instance type (``t2.micro``, ``m3.large``...)
186 | 
187 |     :return: A simple hourly prices dict
188 |     :rtype: dict
189 |     '''
190 |     prices = fulllist['instanceTypes']
191 | 
192 |     pricelist = {
193 |         'ondemand': None,
194 |         'yrTerm1': {},
195 |         'yrTerm3': {}
196 |     }
197 |     for rtype in prices:  # resource type (t2.micro, m3.large...)
198 |         if rtype['type'] == itype:
199 |             pricelist['ondemand'] = \
200 |                 rtype['terms'][0]['onDemandHourly'][0]['prices']['USD']
201 |             for term in rtype['terms']:  # terms (yrTerm1, yrTerm3)
202 |                 for option in term['purchaseOptions']:
203 |                     for value in option['valueColumns']:
204 |                         if option['purchaseOption'] == 'partialUpfront':
205 |                             if value['name'] == 'effectiveHourly':
206 |                                 pricelist[term['term']]['partial'] = \
207 |                                     value['prices']['USD']
208 |                         if option['purchaseOption'] == 'allUpfront':
209 |                             if value['name'] == 'effectiveHourly':
210 |                                 pricelist[term['term']]['full'] = \
211 |                                     value['prices']['USD']
212 |                         if (term['term'] == 'yrTerm1' and
213 |                             option['purchaseOption'] == 'noUpfront' and
214 |                             value['name'] == 'effectiveHourly'):
215 |                                 pricelist['yrTerm1']['noup'] = \
216 |                                     value['prices']['USD']
217 |     return pricelist
218 | 
219 | def prices2csv(fulllist):
220 |     '''An example function that converts all instances prices to a CSV file
221 | 
222 |     :param str fulllist: Full instance by regions list from ``get_regions``
223 | 
224 |     .. note::
225 | 
226 |        If may want to modify the ``head`` and ``tmprow`` variables to suit your
227 |        needs.
228 |     '''
229 | 
230 |     typelist = []
231 |     for region in fulllist:
232 |         for itype in region['instanceTypes']:
233 |             if not itype['type'] in typelist:
234 |                 typelist.append(itype['type'])
235 | 
236 |     def getusd(term, option, duration):
237 |         # fulllist[x]['instanceTypes'][y]['terms'][z]['purchaseOptions']
238 |         for opt in term['purchaseOptions']:
239 |             if opt['purchaseOption'] == option:
240 |                 for vc in opt['valueColumns']:
241 |                     if vc['name'] == duration:
242 |                         return vc['prices']['USD']
243 | 
244 |     regions = []
245 |     csvarr = []
246 |     for itype in typelist:
247 |         row = {'type': itype}
248 |         # fulllist[x]
249 |         for region in fulllist:
250 |             curreg = region['region']
251 |             regions.append(curreg)
252 |             row[curreg] = {}
253 |             row[curreg]['avail'] = False
254 |             # fulllist[x]['instanceTypes']
255 |             for family in region['instanceTypes']:
256 |                 if family['type'] == itype:
257 |                     row[curreg]['avail'] = True
258 |                     # fulllist[x]['instanceTypes'][y]
259 |                     for term in family['terms']:
260 |                         row[curreg][term['term']] = {}
261 |                         for otype in [
262 |                             'noUpfront', 'partialUpfront', 'allUpfront'
263 |                         ]:
264 |                             row[curreg][term['term']][otype] = {}
265 |                             for d in [
266 |                                 'upfront', 'monthlyStar'
267 |                             ]:
268 |                                 row[curreg][term['term']][otype][d] = getusd(
269 |                                     term, otype, d
270 |                                 )
271 | 
272 |         csvarr.append(row)
273 | 
274 |     head = ''
275 |     for region in regions:
276 |         head = ','.join([
277 |             head, '{0},1y no up,1y part up,monthly,3y part up,monthly'
278 |         ]).format(region)
279 | 
280 |     f = open('allprices.csv', 'w')
281 | 
282 |     f.write('{0}\n'.format(head))
283 | 
284 |     # parse in instance order
285 |     for itype in typelist:
286 |         row = itype
287 |         # then parse in region order
288 |         for region in regions:
289 |             for inst in csvarr:
290 |                 if inst['type'] == itype:
291 |                     if inst[region]['avail'] is False:
292 |                         tmprow = 'N,,,,,'
293 |                     else:
294 |                         ireg = inst[region]
295 |                         tmprow = 'Y,{0},{1},{2},{3},{4}'.format(
296 |                             ireg['yrTerm1']['noUpfront']['monthlyStar'],
297 |                             ireg['yrTerm1']['partialUpfront']['upfront'],
298 |                             ireg['yrTerm1']['partialUpfront']['monthlyStar'],
299 |                             ireg['yrTerm3']['partialUpfront']['upfront'],
300 |                             ireg['yrTerm3']['partialUpfront']['monthlyStar']
301 | 
302 |                         )
303 |                     row = ','.join([row, tmprow])
304 |         f.write('{0}\n'.format(row))
305 | 
306 |     f.close()
307 | 
308 | 
309 | # Example usage
310 | 
311 | if __name__ == '__main__':
312 |     try:
313 |         all_instances = get_all_instances(sys.argv[1], sys.argv[2], sys.argv[3])
314 |         print(get_instance_attrs(all_instances, 't2.micro'))
315 |         print(instance_price(all_instances, 'm4.xlarge'))
316 |     except IndexError:
317 |         print('usage: {0} <region> <resource> <type>'.format(sys.argv[0]))
318 | 


--------------------------------------------------------------------------------
/kriskross/COPYING:
--------------------------------------------------------------------------------
  1 |                     GNU GENERAL PUBLIC LICENSE
  2 |                        Version 2, June 1991
  3 | 
  4 |  Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
  5 |  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  6 |  Everyone is permitted to copy and distribute verbatim copies
  7 |  of this license document, but changing it is not allowed.
  8 | 
  9 |                             Preamble
 10 | 
 11 |   The licenses for most software are designed to take away your
 12 | freedom to share and change it.  By contrast, the GNU General Public
 13 | License is intended to guarantee your freedom to share and change free
 14 | software--to make sure the software is free for all its users.  This
 15 | General Public License applies to most of the Free Software
 16 | Foundation's software and to any other program whose authors commit to
 17 | using it.  (Some other Free Software Foundation software is covered by
 18 | the GNU Lesser General Public License instead.)  You can apply it to
 19 | your programs, too.
 20 | 
 21 |   When we speak of free software, we are referring to freedom, not
 22 | price.  Our General Public Licenses are designed to make sure that you
 23 | have the freedom to distribute copies of free software (and charge for
 24 | this service if you wish), that you receive source code or can get it
 25 | if you want it, that you can change the software or use pieces of it
 26 | in new free programs; and that you know you can do these things.
 27 | 
 28 |   To protect your rights, we need to make restrictions that forbid
 29 | anyone to deny you these rights or to ask you to surrender the rights.
 30 | These restrictions translate to certain responsibilities for you if you
 31 | distribute copies of the software, or if you modify it.
 32 | 
 33 |   For example, if you distribute copies of such a program, whether
 34 | gratis or for a fee, you must give the recipients all the rights that
 35 | you have.  You must make sure that they, too, receive or can get the
 36 | source code.  And you must show them these terms so they know their
 37 | rights.
 38 | 
 39 |   We protect your rights with two steps: (1) copyright the software, and
 40 | (2) offer you this license which gives you legal permission to copy,
 41 | distribute and/or modify the software.
 42 | 
 43 |   Also, for each author's protection and ours, we want to make certain
 44 | that everyone understands that there is no warranty for this free
 45 | software.  If the software is modified by someone else and passed on, we
 46 | want its recipients to know that what they have is not the original, so
 47 | that any problems introduced by others will not reflect on the original
 48 | authors' reputations.
 49 | 
 50 |   Finally, any free program is threatened constantly by software
 51 | patents.  We wish to avoid the danger that redistributors of a free
 52 | program will individually obtain patent licenses, in effect making the
 53 | program proprietary.  To prevent this, we have made it clear that any
 54 | patent must be licensed for everyone's free use or not licensed at all.
 55 | 
 56 |   The precise terms and conditions for copying, distribution and
 57 | modification follow.
 58 | 
 59 |                     GNU GENERAL PUBLIC LICENSE
 60 |    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 61 | 
 62 |   0. This License applies to any program or other work which contains
 63 | a notice placed by the copyright holder saying it may be distributed
 64 | under the terms of this General Public License.  The "Program", below,
 65 | refers to any such program or work, and a "work based on the Program"
 66 | means either the Program or any derivative work under copyright law:
 67 | that is to say, a work containing the Program or a portion of it,
 68 | either verbatim or with modifications and/or translated into another
 69 | language.  (Hereinafter, translation is included without limitation in
 70 | the term "modification".)  Each licensee is addressed as "you".
 71 | 
 72 | Activities other than copying, distribution and modification are not
 73 | covered by this License; they are outside its scope.  The act of
 74 | running the Program is not restricted, and the output from the Program
 75 | is covered only if its contents constitute a work based on the
 76 | Program (independent of having been made by running the Program).
 77 | Whether that is true depends on what the Program does.
 78 | 
 79 |   1. You may copy and distribute verbatim copies of the Program's
 80 | source code as you receive it, in any medium, provided that you
 81 | conspicuously and appropriately publish on each copy an appropriate
 82 | copyright notice and disclaimer of warranty; keep intact all the
 83 | notices that refer to this License and to the absence of any warranty;
 84 | and give any other recipients of the Program a copy of this License
 85 | along with the Program.
 86 | 
 87 | You may charge a fee for the physical act of transferring a copy, and
 88 | you may at your option offer warranty protection in exchange for a fee.
 89 | 
 90 |   2. You may modify your copy or copies of the Program or any portion
 91 | of it, thus forming a work based on the Program, and copy and
 92 | distribute such modifications or work under the terms of Section 1
 93 | above, provided that you also meet all of these conditions:
 94 | 
 95 |     a) You must cause the modified files to carry prominent notices
 96 |     stating that you changed the files and the date of any change.
 97 | 
 98 |     b) You must cause any work that you distribute or publish, that in
 99 |     whole or in part contains or is derived from the Program or any
100 |     part thereof, to be licensed as a whole at no charge to all third
101 |     parties under the terms of this License.
102 | 
103 |     c) If the modified program normally reads commands interactively
104 |     when run, you must cause it, when started running for such
105 |     interactive use in the most ordinary way, to print or display an
106 |     announcement including an appropriate copyright notice and a
107 |     notice that there is no warranty (or else, saying that you provide
108 |     a warranty) and that users may redistribute the program under
109 |     these conditions, and telling the user how to view a copy of this
110 |     License.  (Exception: if the Program itself is interactive but
111 |     does not normally print such an announcement, your work based on
112 |     the Program is not required to print an announcement.)
113 | 
114 | These requirements apply to the modified work as a whole.  If
115 | identifiable sections of that work are not derived from the Program,
116 | and can be reasonably considered independent and separate works in
117 | themselves, then this License, and its terms, do not apply to those
118 | sections when you distribute them as separate works.  But when you
119 | distribute the same sections as part of a whole which is a work based
120 | on the Program, the distribution of the whole must be on the terms of
121 | this License, whose permissions for other licensees extend to the
122 | entire whole, and thus to each and every part regardless of who wrote it.
123 | 
124 | Thus, it is not the intent of this section to claim rights or contest
125 | your rights to work written entirely by you; rather, the intent is to
126 | exercise the right to control the distribution of derivative or
127 | collective works based on the Program.
128 | 
129 | In addition, mere aggregation of another work not based on the Program
130 | with the Program (or with a work based on the Program) on a volume of
131 | a storage or distribution medium does not bring the other work under
132 | the scope of this License.
133 | 
134 |   3. You may copy and distribute the Program (or a work based on it,
135 | under Section 2) in object code or executable form under the terms of
136 | Sections 1 and 2 above provided that you also do one of the following:
137 | 
138 |     a) Accompany it with the complete corresponding machine-readable
139 |     source code, which must be distributed under the terms of Sections
140 |     1 and 2 above on a medium customarily used for software interchange; or,
141 | 
142 |     b) Accompany it with a written offer, valid for at least three
143 |     years, to give any third party, for a charge no more than your
144 |     cost of physically performing source distribution, a complete
145 |     machine-readable copy of the corresponding source code, to be
146 |     distributed under the terms of Sections 1 and 2 above on a medium
147 |     customarily used for software interchange; or,
148 | 
149 |     c) Accompany it with the information you received as to the offer
150 |     to distribute corresponding source code.  (This alternative is
151 |     allowed only for noncommercial distribution and only if you
152 |     received the program in object code or executable form with such
153 |     an offer, in accord with Subsection b above.)
154 | 
155 | The source code for a work means the preferred form of the work for
156 | making modifications to it.  For an executable work, complete source
157 | code means all the source code for all modules it contains, plus any
158 | associated interface definition files, plus the scripts used to
159 | control compilation and installation of the executable.  However, as a
160 | special exception, the source code distributed need not include
161 | anything that is normally distributed (in either source or binary
162 | form) with the major components (compiler, kernel, and so on) of the
163 | operating system on which the executable runs, unless that component
164 | itself accompanies the executable.
165 | 
166 | If distribution of executable or object code is made by offering
167 | access to copy from a designated place, then offering equivalent
168 | access to copy the source code from the same place counts as
169 | distribution of the source code, even though third parties are not
170 | compelled to copy the source along with the object code.
171 | 
172 |   4. You may not copy, modify, sublicense, or distribute the Program
173 | except as expressly provided under this License.  Any attempt
174 | otherwise to copy, modify, sublicense or distribute the Program is
175 | void, and will automatically terminate your rights under this License.
176 | However, parties who have received copies, or rights, from you under
177 | this License will not have their licenses terminated so long as such
178 | parties remain in full compliance.
179 | 
180 |   5. You are not required to accept this License, since you have not
181 | signed it.  However, nothing else grants you permission to modify or
182 | distribute the Program or its derivative works.  These actions are
183 | prohibited by law if you do not accept this License.  Therefore, by
184 | modifying or distributing the Program (or any work based on the
185 | Program), you indicate your acceptance of this License to do so, and
186 | all its terms and conditions for copying, distributing or modifying
187 | the Program or works based on it.
188 | 
189 |   6. Each time you redistribute the Program (or any work based on the
190 | Program), the recipient automatically receives a license from the
191 | original licensor to copy, distribute or modify the Program subject to
192 | these terms and conditions.  You may not impose any further
193 | restrictions on the recipients' exercise of the rights granted herein.
194 | You are not responsible for enforcing compliance by third parties to
195 | this License.
196 | 
197 |   7. If, as a consequence of a court judgment or allegation of patent
198 | infringement or for any other reason (not limited to patent issues),
199 | conditions are imposed on you (whether by court order, agreement or
200 | otherwise) that contradict the conditions of this License, they do not
201 | excuse you from the conditions of this License.  If you cannot
202 | distribute so as to satisfy simultaneously your obligations under this
203 | License and any other pertinent obligations, then as a consequence you
204 | may not distribute the Program at all.  For example, if a patent
205 | license would not permit royalty-free redistribution of the Program by
206 | all those who receive copies directly or indirectly through you, then
207 | the only way you could satisfy both it and this License would be to
208 | refrain entirely from distribution of the Program.
209 | 
210 | If any portion of this section is held invalid or unenforceable under
211 | any particular circumstance, the balance of the section is intended to
212 | apply and the section as a whole is intended to apply in other
213 | circumstances.
214 | 
215 | It is not the purpose of this section to induce you to infringe any
216 | patents or other property right claims or to contest validity of any
217 | such claims; this section has the sole purpose of protecting the
218 | integrity of the free software distribution system, which is
219 | implemented by public license practices.  Many people have made
220 | generous contributions to the wide range of software distributed
221 | through that system in reliance on consistent application of that
222 | system; it is up to the author/donor to decide if he or she is willing
223 | to distribute software through any other system and a licensee cannot
224 | impose that choice.
225 | 
226 | This section is intended to make thoroughly clear what is believed to
227 | be a consequence of the rest of this License.
228 | 
229 |   8. If the distribution and/or use of the Program is restricted in
230 | certain countries either by patents or by copyrighted interfaces, the
231 | original copyright holder who places the Program under this License
232 | may add an explicit geographical distribution limitation excluding
233 | those countries, so that distribution is permitted only in or among
234 | countries not thus excluded.  In such case, this License incorporates
235 | the limitation as if written in the body of this License.
236 | 
237 |   9. The Free Software Foundation may publish revised and/or new versions
238 | of the General Public License from time to time.  Such new versions will
239 | be similar in spirit to the present version, but may differ in detail to
240 | address new problems or concerns.
241 | 
242 | Each version is given a distinguishing version number.  If the Program
243 | specifies a version number of this License which applies to it and "any
244 | later version", you have the option of following the terms and conditions
245 | either of that version or of any later version published by the Free
246 | Software Foundation.  If the Program does not specify a version number of
247 | this License, you may choose any version ever published by the Free Software
248 | Foundation.
249 | 
250 |   10. If you wish to incorporate parts of the Program into other free
251 | programs whose distribution conditions are different, write to the author
252 | to ask for permission.  For software which is copyrighted by the Free
253 | Software Foundation, write to the Free Software Foundation; we sometimes
254 | make exceptions for this.  Our decision will be guided by the two goals
255 | of preserving the free status of all derivatives of our free software and
256 | of promoting the sharing and reuse of software generally.
257 | 
258 |                             NO WARRANTY
259 | 
260 |   11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
261 | FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
262 | OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
263 | PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
264 | OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
265 | MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
266 | TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
267 | PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
268 | REPAIR OR CORRECTION.
269 | 
270 |   12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
271 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
272 | REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
273 | INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
274 | OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
275 | TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
276 | YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
277 | PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
278 | POSSIBILITY OF SUCH DAMAGES.
279 | 
280 |                      END OF TERMS AND CONDITIONS
281 | 
282 |             How to Apply These Terms to Your New Programs
283 | 
284 |   If you develop a new program, and you want it to be of the greatest
285 | possible use to the public, the best way to achieve this is to make it
286 | free software which everyone can redistribute and change under these terms.
287 | 
288 |   To do so, attach the following notices to the program.  It is safest
289 | to attach them to the start of each source file to most effectively
290 | convey the exclusion of warranty; and each file should have at least
291 | the "copyright" line and a pointer to where the full notice is found.
292 | 
293 |     <one line to give the program's name and a brief idea of what it does.>
294 |     Copyright (C) <year>  <name of author>
295 | 
296 |     This program is free software; you can redistribute it and/or modify
297 |     it under the terms of the GNU General Public License as published by
298 |     the Free Software Foundation; either version 2 of the License, or
299 |     (at your option) any later version.
300 | 
301 |     This program is distributed in the hope that it will be useful,
302 |     but WITHOUT ANY WARRANTY; without even the implied warranty of
303 |     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
304 |     GNU General Public License for more details.
305 | 
306 |     You should have received a copy of the GNU General Public License along
307 |     with this program; if not, write to the Free Software Foundation, Inc.,
308 |     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
309 | 
310 | Also add information on how to contact you by electronic and paper mail.
311 | 
312 | If the program is interactive, make it output a short notice like this
313 | when it starts in an interactive mode:
314 | 
315 |     Gnomovision version 69, Copyright (C) year name of author
316 |     Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
317 |     This is free software, and you are welcome to redistribute it
318 |     under certain conditions; type `show c' for details.
319 | 
320 | The hypothetical commands `show w' and `show c' should show the appropriate
321 | parts of the General Public License.  Of course, the commands you use may
322 | be called something other than `show w' and `show c'; they could even be
323 | mouse-clicks or menu items--whatever suits your program.
324 | 
325 | You should also get your employer (if you work as a programmer) or your
326 | school, if any, to sign a "copyright disclaimer" for the program, if
327 | necessary.  Here is a sample; alter the names:
328 | 
329 |   Yoyodyne, Inc., hereby disclaims all copyright interest in the program
330 |   `Gnomovision' (which makes passes at compilers) written by James Hacker.
331 | 
332 |   <signature of Ty Coon>, 1 April 1989
333 |   Ty Coon, President of Vice
334 | 
335 | This General Public License does not permit incorporating your program into
336 | proprietary programs.  If your program is a subroutine library, you may
337 | consider it more useful to permit linking proprietary applications with the
338 | library.  If this is what you want to do, use the GNU Lesser General
339 | Public License instead of this License.
340 | 


--------------------------------------------------------------------------------
/ec2.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python
  2 | #-*- coding: utf-8 -*-
  3 | 
  4 | 
  5 | '''Simple boto3 based EC2 and RDS manipulation tool
  6 | 
  7 | To create an EC2 instance, create a ``yaml`` file with the following format:
  8 | 
  9 |    .. code-block:: yaml
 10 | 
 11 |       frankfurt:
 12 |       - subnet-aza:
 13 |         - type: t2.micro
 14 |           customer: foo
 15 |           name: foo-www-1
 16 |           image: image-name-glob*
 17 |           key: mypemkey
 18 |           ipaddr: 10.1.1.2
 19 |           sg: [ssh-icmp-reply, http-https]
 20 |           userdata:
 21 |           - foo.sh
 22 |           - bar.sh
 23 |         - type ...
 24 |       - subnet-azb
 25 |         - type ...
 26 |       ireland:
 27 |       - subnet-aza ...
 28 | 
 29 | .. note::
 30 | 
 31 |     optional region parameter
 32 | 
 33 |     .. code-block:: yaml
 34 | 
 35 |        vpc: vpc-name-tag
 36 | 
 37 |     optional instance parameters
 38 | 
 39 |     .. code-block:: yaml
 40 | 
 41 |        data: 10 (default: none)
 42 |        srcdstchk: True|False (defaults to False)
 43 |        pubip: True|False (defaults to False)
 44 |        elb:
 45 |          scheme: internal|internet-facing
 46 |          elb_proto: tcp|udp
 47 |          elb_port: 123
 48 |          instance_proto: tcp|udp
 49 |          instance_port: 123
 50 |          sg: [ssh-hq]
 51 | 
 52 | .. note::
 53 | 
 54 |     * name should be of the form customer-service-number
 55 |     * AZ must exist and have the form: title-az[ab]
 56 |     * if no proto / ports are given to ``elb``, it will assume TCP/80
 57 | 
 58 | To create an RDS instance, create a ``yaml`` file with the following format:
 59 | 
 60 |    .. code-block:: yaml
 61 | 
 62 |       frankfurt:
 63 |       - foo-rds-subnetgroup:
 64 |         - type: db.t1.micro
 65 |           customer: foo
 66 |           name: foo-rds
 67 |           data: 8
 68 |           dbengine: MySQL
 69 |           dbversion: 5.6.22
 70 |           dbroot: root
 71 |           subnets: {aza: 10.1.2.0/24, azb: 10.1.3.0/24}
 72 |           sg: [mysql]
 73 |       - bar-rds-subnetgroup:
 74 |         - type ...
 75 |       ireland:
 76 |       - baz-rds-subnetgroup ...
 77 | 
 78 | .. note::
 79 | 
 80 |     if the Security Group does not exist yet, you can declare it this way:
 81 | 
 82 |     .. code-block:: yaml
 83 | 
 84 |        sg: 
 85 |        - name: MySQL_from_client_infra-test
 86 |          tag: mysql-from-infra-test
 87 |          cidr: [10.0.1.0/24, 192.168.1.0/24]
 88 |          port: 3306
 89 |          proto: tcp
 90 | 
 91 |     optional instance parameters
 92 | 
 93 |     .. code-block:: yaml
 94 | 
 95 |        multiaz: true | false
 96 |        maintenance: Tue:04:00-Tue:04:30
 97 |        retention: 7 (in days)
 98 |        backup: Tue:02:00-Tue:02:30
 99 |        autoupgrade: false (defaults to true)
100 |        iops: 2000
101 |        charset: utf8
102 |        storage: standard | gp2 | io1
103 | '''
104 | 
105 | import os
106 | import sys
107 | import yaml
108 | import time
109 | import string
110 | import random
111 | from subprocess import call
112 | from prettytable import from_csv
113 | 
114 | sys.path.append(os.getcwd())
115 | 
116 | import mods.awsprice as ap
117 | from mods.session import Aws
118 | # custom module you'd want to import
119 | try:
120 |     import mods.external as ext
121 |     ext_available = True
122 | except ImportError:
123 |     ext_available = False
124 | 
125 | if len(sys.argv) < 2:
126 |     print "usage: {0} <function> [arguments]".format(sys.argv[0])
127 |     sys.exit(1)
128 | 
129 | profile = os.environ.get('EC2REGION')
130 | 
131 | if profile is None:
132 |     print "Please add a profile or set the EC2REGION environment variable."
133 |     sys.exit(1)
134 | 
135 | ec2 = Aws(profile, 'ec2')
136 | 
137 | print "> working on profile: {0}".format(profile)
138 | 
139 | # by default, work on the 1st VPC
140 | vpc = [v for v in ec2.resource.vpcs.all()][0]
141 | 
142 | def ls():
143 |     '''List instances running in current region
144 |     '''
145 |     for i in ec2.getall('instances'):
146 |         if i.tags is None:
147 |             print("/!\ {0} has no tag name [{1}]".format(i.id, i.state['Name']))
148 |             continue
149 | 
150 |         t = ec2.tags2dict(i.tags)
151 |         tid = i.id
152 | 
153 |         if ext_available is True:
154 |             idtag = ext.custom_idtag
155 |             tid = i.id if not idtag in t else t[idtag]
156 | 
157 |         print "{0} {1} ({2}) - [{3}]".format(
158 |             tid, t['Name'], i.instance_type, i.state['Name']
159 |         )
160 | 
161 | def getyaml(fn, yf):
162 |     '''Read infrastructure ``yaml`` description
163 | 
164 |     :param str fn: Calling function name
165 |     :param str yf: Path to ``yaml`` file
166 |     '''
167 |     if len(sys.argv) < 3:
168 |         print("usage: {0} {1} <path/to/description.yaml>"
169 |             .format(sys.argv[0], fn))
170 |         sys.exit(1)
171 | 
172 |     try:
173 |         with open(yf, 'r') as f:
174 |             y = yaml.load(f.read())
175 |     except IOError:
176 |         print "{0} not found.".format(yf)
177 |         sys.exit(1)
178 | 
179 |     return y
180 | 
181 | def wait4tag(res, tag, val):
182 |     '''Waits for resource to be available before tagging its name
183 | 
184 |     :param str res: Resource name
185 |     :param str tag: Tag key to be given
186 |     :param str val: Tag value to be given
187 |     '''
188 |     rise = False
189 |     while rise is False:
190 |         try:
191 |             ec2.create_tag(res.id, tag, val)
192 |             rise = True
193 |         except:
194 |             e = sys.exc_info()[1]
195 |             print('waiting for resource to rise, {0}'.format(e))
196 |             time.sleep(1)
197 | 
198 | def subnet_check(ec2, subname, instance):
199 |     '''Checks subnet existence for a given instance IP address and create it
200 |     if not available
201 | 
202 |     :param ec2: EC2 resource
203 |     :param str subnet: subnet name
204 |     :param dict instance: Instance informations
205 |     '''
206 |     myaz = subname[-1]
207 | 
208 |     if ec2.get_obj_from_nametag('subnets', subname):
209 |         print('{0} already available, continuing'.format(subname))
210 |         return
211 | 
212 |     if ext_available is True:
213 |         niname = ext.natinstancename(instance)
214 |     else:
215 |         niname = 'nat-instance'  # warning, this is an example
216 | 
217 |     natinstance = [
218 |             i for i in ec2.resource.instances.filter(
219 |                 Filters = [{'Name': 'tag:Name', 'Values': [niname]}]
220 |             )
221 |     ]
222 | 
223 |     vpcid = vpc.id
224 | 
225 |     if not natinstance:
226 |         print('NO NAT instance for customer {0}'.format(instance['customer']))
227 |         reply = raw_input('attach this network to an Internet gw? [y/N] ')
228 |         if reply[0] != 'y':
229 |             sys.exit(1)
230 |         gwid = [i for i in vpc.internet_gateways.all()][0].id
231 |         nat = False
232 |     else:
233 |         gwid = natinstance[0].id
234 |         nat = True
235 | 
236 |     zone = None
237 | 
238 |     azs = ec2.client.describe_availability_zones()
239 |     for raz in azs['AvailabilityZones']:
240 |         # us-east-1[a] == az[a]
241 |         if raz['ZoneName'][-1] == myaz:
242 |             zone = raz['ZoneName']
243 |             break
244 | 
245 |     if zone is None:
246 |         print('{0} does not match any AZ, aborting'.format(myaz))
247 |         sys.exit(1)
248 | 
249 |     # EC2 instance
250 |     if 'ipaddr' in instance:
251 |         cidr = '{0}.0/24'.format('.'.join(instance['ipaddr'].split('.')[0:3]))
252 |     # RDS instance
253 |     else:
254 |         cidr = instance['subnets']['az{0}'.format(myaz)]
255 | 
256 |     # create the subnet
257 |     rs = ec2.resource.create_subnet(
258 |         DryRun = False,
259 |         VpcId = vpcid,
260 |         CidrBlock = cidr,
261 |         AvailabilityZone = zone
262 |     )
263 |     wait4tag(rs, 'Name', subname)
264 |     print('created subnet {0}'.format(rs.id))
265 | 
266 |     # create a route table
267 |     if instance['type'].startswith('db.'):
268 |         rtname = '{0}-rdsRT'.format(instance['customer'])
269 |     else:
270 |         rtname = '{0}-ec2RT'.format(instance['customer'])
271 | 
272 |     rt = ec2.get_obj_from_nametag('route_tables', rtname)
273 |     if rt:
274 |         rt_exists = True
275 |         print('{0} already exists, continuing'.format(rtname))
276 |     else:
277 |         rt_exists = False
278 | 
279 |     # create route table if non existent
280 |     if rt_exists is False:
281 |         rt = ec2.resource.create_route_table(
282 |             DryRun = False,
283 |             VpcId = vpcid
284 |         )
285 | 
286 |         wait4tag(rt, 'Name', rtname)
287 |         print('created route table {0}'.format(rt.id))
288 | 
289 |     # associate route table and subnet
290 |     rta = rt.associate_with_subnet(
291 |         DryRun = False,
292 |         SubnetId = rs.id
293 |     )
294 |     print('associated route table {0} with {1}'.format(rt.id, rta.id))
295 |     # create the default route
296 |     kwargs = {'DryRun': False, 'DestinationCidrBlock': '0.0.0.0/0',}
297 |     if nat is True:
298 |         kwargs['InstanceId'] = gwid
299 |     else:
300 |         # subnet has a default route to IGW, we must propagate routes from VGW
301 |         kwargs['GatewayId'] = gwid
302 |         vgw = ec2.client.describe_vpn_gateways()
303 |         for v in vgw['VpnGateways']:
304 |             if v['VpcAttachments']:
305 |                 vgwid = v['VpnGatewayId']
306 |                 break
307 |         print('attaching route table {0} to vgw {1}'.format(rt.id, vgwid))
308 |         ec2.client.enable_vgw_route_propagation(
309 |             RouteTableId = rt.id,
310 |             GatewayId = vgwid
311 |         )
312 | 
313 |     rc = rt.create_route(**kwargs)
314 | 
315 | def _mkdefval(data, kw, default):
316 |     return default if not kw in data else data[kw]
317 | 
318 | def elb_register(ec2, allaz, curaz, instance):
319 |     '''Register an instance to an ELB, creating the latter if it does not exist
320 | 
321 |     :param dict allaz: Every AZ present in the region, from the YAML file
322 |     :param str curaz: Current AZ, where the current instance is being created
323 |     :param dict instance: Instance being processed
324 |     '''
325 |     elb = Aws(ec2.profile, 'elb')
326 | 
327 |     elbs = elb.client.describe_load_balancers()
328 | 
329 |     lbname = 'elb-{0}'.format(instance['name'][:-2])
330 |     elb_exists = False
331 |     for lb in elbs['LoadBalancerDescriptions']:
332 |         if lb['LoadBalancerName'] == lbname:
333 |            elb_exists = True
334 | 
335 |     i = instance['elb']
336 | 
337 |     if elb_exists is False:
338 |         # first check for subnets existence
339 |         subnet_ids = []
340 |         curnet = curaz[:-4]  # current network name without az
341 |         for availz in allaz:
342 |             yaz = availz.keys()[0]
343 |             if curnet in yaz:
344 |                 # take 1st IP address from that subnet / AZ
345 |                 ipaddr = availz[yaz][0]['ipaddr']
346 |                 # and check for subnet existence
347 |                 subnet_check(ec2, yaz, instance)
348 |                 # and add it to subnet_ids
349 |                 subnet_ids.append(ec2.get_id_from_nametag('subnets', yaz))
350 | 
351 |         sgs = []
352 |         for sglist in instance['elb']['sg']:
353 |             sgs.append(ec2.get_id_from_nametag(
354 |                 'security_groups', sglist
355 |             ))
356 | 
357 |         print('creating ELB {0}'.format(lbname))
358 |         elb.client.create_load_balancer(
359 |             LoadBalancerName = lbname,
360 |             Listeners = [{
361 |                 'Protocol': _mkdefval(i, 'elb_proto', 'tcp'),
362 |                 'LoadBalancerPort': _mkdefval(i, 'elb_port', 80),
363 |                 'InstanceProtocol': _mkdefval(i, 'instance_proto', 'tcp'),
364 |                 'InstancePort': _mkdefval(i, 'instance_port', 80)
365 |             }],
366 |             Subnets = subnet_ids,
367 |             SecurityGroups = sgs,
368 |             Scheme = instance['elb']['scheme'],
369 |             Tags = ec2.mktags({'Name': lbname})
370 |         )
371 | 
372 |     print('registering {0} to ELB {1}'.format(instance['awsid'], lbname))
373 |     elb.client.register_instances_with_load_balancer(
374 |         LoadBalancerName = lbname,
375 |         Instances = [{
376 |             'InstanceId': instance['awsid']
377 |         }]
378 |     )
379 | 
380 | chars = ''.join([string.letters, string.digits])
381 | 
382 | def create_rds(ec2, subname, instance):
383 |     '''Create RDS instance described in the ``yaml`` file passed in parameter
384 |     '''
385 | 
386 |     rds = Aws(ec2.profile, 'rds')
387 | 
388 |     pwd = ''.join((random.choice(chars)) for x in range(20))
389 | 
390 |     groupname = ''.join(subname.split('-'))
391 |     subnames = []
392 |     for s in instance['subnets']:
393 |         azname = '{0}-{1}'.format(subname, s)
394 |         subnames.append(azname)
395 |         subnet_check(ec2, azname, instance)
396 | 
397 |     subnetids = [
398 |         ec2.get_id_from_nametag('subnets', s) for s in subnames
399 |     ]
400 | 
401 |     descsubgr = rds.client.describe_db_subnet_groups()
402 | 
403 |     subgr_exists = False
404 |     for subgr in descsubgr['DBSubnetGroups']:
405 |         if subgr['DBSubnetGroupName'] == groupname:
406 |             print("DBSubnetGroupName {0} exists, continuing".format(groupname))
407 |             subgr_exists = True
408 |             break
409 | 
410 |     if subgr_exists is False:
411 |         rds.client.create_db_subnet_group(
412 |             DBSubnetGroupName = groupname,
413 |             DBSubnetGroupDescription = '{0} subnet group for {1}'.format(
414 |                 subname, instance['customer']
415 |             ),
416 |             SubnetIds = subnetids,
417 |             Tags = ec2.mktags({'name': '{0}SubnetGroup'.format(subname)})
418 |         )
419 | 
420 |     sg = []
421 |     for rule in instance['sg']:
422 |         sg.append(ec2.mksg(vpc, rule).id)
423 | 
424 |     kwargs = {
425 |         'DBInstanceIdentifier': instance['name'],
426 |         'AllocatedStorage': instance['data'],
427 |         'DBInstanceClass': instance['type'],
428 |         'Engine': instance['dbengine'],
429 |         'MasterUsername': instance['dbroot'],
430 |         'MasterUserPassword': pwd,
431 |         'VpcSecurityGroupIds': sg,
432 |         'DBSubnetGroupName': groupname,
433 |         'EngineVersion': instance['dbversion']
434 |     }
435 |     opts = {
436 |         'maintenance': 'PreferredMaintenanceWindow',
437 |         'retention': 'BackupRetentionPeriod',
438 |         'backup': 'PreferredBackupWindow',
439 |         'multiaz': 'MultiAZ',
440 |         'autoupgrade': 'AutoMinorVersionUpgrade',
441 |         'iops': 'Iops',
442 |         'charset': 'CharacterSetName',
443 |         'storage': 'StorageType'
444 |     }
445 |     for k in opts:
446 |         if k in instance:
447 |             kwargs[opts[k]] = instance[k]
448 |     kwargs['Tags'] = ec2.mktags({'name': instance['name']})
449 | 
450 |     rc = rds.client.create_db_instance(**kwargs)
451 |     print('creating instance {0}'.format(instance['name']))
452 | 
453 | # Parse YAML and create EC2 instances
454 | 
455 | def create():
456 |     '''Create instance(s) described in the ``yaml`` file passed in parameter
457 |     '''
458 |     yf = sys.argv[2]
459 |     y = getyaml(create.__name__, yf)
460 | 
461 |     for reg in y: # loop through profiles
462 |         ec2 = Aws(reg, 'ec2')
463 |         ec2r = ec2.resource
464 |         for azlst in y[reg]: # loop through AZ list
465 |             if 'vpc' in azlst:
466 |                 vpc = ec2.get_obj_from_nametag('vpcs', azlst['vpc'])
467 |                 print('> selected {0}'.format(vpc.id))
468 |                 continue
469 |             for az in azlst: # loop through AZ
470 |                 for instance in azlst[az]:
471 |                     if 'awsid' in instance:
472 |                         reply = raw_input(
473 |                             '{0} exists as {1}, continue? [y/N] '.format(
474 |                                 instance['name'], instance['awsid']
475 |                             )
476 |                         )
477 |                         if reply[0] != 'y':
478 |                             continue
479 | 
480 |                     # check for RDS instance
481 |                     if instance['type'].startswith('db.'):
482 |                         create_rds(ec2, az, instance)
483 |                         continue
484 | 
485 |                     # check AZ / subnet existence, create it if absent
486 |                     subnet_check(ec2, az, instance)
487 | 
488 |                     if 'debian' in instance['image']:
489 |                         image = ec2.get_debian_ami(instance['image'])
490 |                     else:
491 |                         image = ec2.getami(instance['image'])
492 |                     sg = []
493 |                     for sglist in instance['sg']:
494 |                         sg.append(ec2.get_id_from_nametag(
495 |                             'security_groups', sglist
496 |                         ))
497 |                     subnet = ec2.get_id_from_nametag('subnets', az)
498 | 
499 |                     if 'data' in instance:
500 |                         blockdevmap = [
501 |                             {
502 |                                 'DeviceName': '/dev/xvdb',
503 |                                 'Ebs': {
504 |                                     'VolumeSize': instance['data'],
505 |                                     'DeleteOnTermination': True,
506 |                                 }
507 |                             }
508 |                         ]
509 |                     else:
510 |                         blockdevmap = []
511 | 
512 |                     netint = []
513 |                     if 'pubip' in instance and instance['pubip'] is True:
514 |                         pubip = True
515 |                     else:
516 |                         pubip = False
517 | 
518 |                     # Here, 'name' is the tag Name
519 | 
520 |                     # netblock for a NAT-type instance
521 |                     netblock = '{0}.0.0/16'.format(
522 |                         '.'.join(instance['ipaddr'].split('.')[:2])
523 |                     )
524 |                     print("creating instance {0}".format(instance['name']))
525 |                     rc = ec2r.create_instances(
526 |                         ImageId = image,
527 |                         MinCount = 1,
528 |                         MaxCount = 1,
529 |                         KeyName = instance['key'],
530 |                         InstanceType = instance['type'],
531 |                         BlockDeviceMappings = blockdevmap,
532 |                         NetworkInterfaces = [{
533 |                             'DeviceIndex': 0,
534 |                             'Groups': sg,
535 |                             'SubnetId': subnet,
536 |                             'PrivateIpAddress': instance['ipaddr'],
537 |                             'DeleteOnTermination': True,
538 |                             'AssociatePublicIpAddress': pubip
539 |                         }],
540 |                         UserData = ec2.mkuserdata(
541 |                             b64 = False,
542 |                             userdata = instance['userdata'],
543 |                             name = instance['name'],
544 |                             netblock = netblock
545 |                         )
546 |                     )
547 | 
548 |                     iid = rc[0].id
549 | 
550 |                     instance['awsid'] = iid
551 |                     tags = ['name', 'customer']
552 |                     # add custom fields
553 |                     if ext_available is True:
554 |                         newtags = ext.addfields(reg, instance)
555 |                         if newtags:
556 |                             tags.extend(newtags)
557 |                     # give the instance a tag name
558 |                     # we are supposed to be able to pass many tags to
559 |                     # create_tags but a traceback occurs as of boto3 0.0.21
560 |                     for tag in tags:
561 |                         print(
562 |                             "tagging instance id {0} {1} to {2}".format(
563 |                                 iid, tag, instance[tag]
564 |                             )
565 |                         )
566 |                         wait4tag(ec2r.Instance(iid), tag, instance[tag])
567 | 
568 |                     with open(sys.argv[2], 'w') as f:
569 |                         yaml.dump(y, f, default_flow_style=False)
570 | 
571 |                     # Mostly for NAT instances
572 |                     if 'srcdstchk' in instance:
573 |                         r = ec2r.Instance(iid).modify_attribute(
574 |                             SourceDestCheck  = {
575 |                                 'Value': instance['srcdstchk']
576 |                             }
577 |                         )
578 | 
579 |                     # optionally do something with instance informations
580 |                     # like inserting it to your own information system
581 |                     if ext_available is True:
582 |                         ext.instance_actions(ec2, reg, az, instance)
583 | 
584 |                     # create ELB if needed
585 |                     if 'elb' in instance:
586 |                         elb_register(ec2, y[reg], az, instance)
587 | 
588 |                     # create additionnal block devices if needed
589 |                     if not blockdevmap:
590 |                         continue
591 | 
592 |                     devlst = []
593 |                     print("waiting for block devices to rise")
594 |                     while not devlst:
595 |                         devlst = ec2r.Instance(iid).block_device_mappings
596 |                         time.sleep(1)
597 | 
598 |                     for dev in devlst:
599 |                         dname = dev['DeviceName'][5:]
600 |                         print(
601 |                             "tagging volume {0} to {1}_{2}".format(
602 |                                 dev['Ebs']['VolumeId'],
603 |                                 dname,
604 |                                 instance['name']
605 |                             )
606 |                         )
607 |                         tags = {
608 |                             'Name': '{0}_{1}'.format(
609 |                                 dname, instance['name']
610 |                             ),
611 |                             'Customer': instance['customer']
612 |                         }
613 |                         ec2.client.create_tags(
614 |                             Resources = [dev['Ebs']['VolumeId']],
615 |                             Tags = ec2.mktags(tags)
616 |                         )
617 | 
618 |     # final actions if needed
619 |     if ext_available is True:
620 |         ext.final_actions()
621 | 
622 | def rm():
623 |     '''Destroys an AWS instance
624 |     '''
625 |     if len(sys.argv) < 3:
626 |         print("usage: {0} rm <aws instance ids ...>")
627 |         sys.exit(1)
628 | 
629 |     reply = raw_input("REALLY DESTROY {0}? [y/N] ".format(
630 |                 ','.join(sys.argv[2:]))
631 |             )
632 |     if reply[0] != 'y':
633 |         print("aborting.")
634 |         sys.exit(0)
635 | 
636 |     # RDS instance
637 |     if not sys.argv[2].startswith('i-'):
638 |         dbid = sys.argv[2]
639 |         rds = Aws(ec2.profile, 'rds')
640 |         try:
641 |             rds.client.delete_db_instance(
642 |                 DBInstanceIdentifier = dbid, SkipFinalSnapshot = True
643 |             )
644 |             print('deleting {0}'.format(dbid))
645 |             sys.exit(0)
646 |         except:
647 |             e = sys.exc_info()[1]
648 |             print('error while deleting {0}: {1}'.format(dbid, e))
649 |             sys.exit(1)
650 | 
651 |     # pre-delete external actions
652 |     if ext_available is True:
653 |         ext.rm_actions(ec2, sys.argv[2:])
654 | 
655 |     try:
656 |         ec2.resource.instances.filter(InstanceIds=sys.argv[2:]).terminate()
657 |     except:
658 |         print('error while terminating {0}'.format(sys.argv[2:]))
659 |         sys.exit(1)
660 | 
661 | def _update_price(total, price):
662 |     return {
663 |         'ondemand': round(total['ondemand'] + float(price['ondemand']), 5),
664 |         'noup': round(total['noup'] + float(price['yrTerm1']['noup']), 5),
665 |         '1yearpartup': round(total['1yearpartup'] + \
666 |             float(price['yrTerm1']['partial']), 5),
667 |         '1yearfullup': round(total['1yearfullup'] + \
668 |             float(price['yrTerm1']['full']), 5),
669 |         '3yearpartup': round(total['3yearpartup'] + \
670 |             float(price['yrTerm3']['partial']), 5),
671 |         '3yearfullup': round(total['3yearfullup'] + \
672 |             float(price['yrTerm3']['full']), 5)
673 |     }
674 | 
675 | def _print_total_price(price):
676 |     titles = [
677 |         {'ondemand': 'on demand'},
678 |         {'noup': '1 y no up'},
679 |         {'1yearpartup': '1 y part up'},
680 |         {'1yearfullup': '1 y full up'},
681 |         {'3yearpartup': '3 y part up'},
682 |         {'3yearfullup': '3 y full up'}
683 |     ]
684 |     duration = {'hrly': 1, 'mthly': 24 * 30.5, 'yrly': 24 * 30.5 * 12}
685 | 
686 | 
687 |     prices = []
688 |     for t in titles:
689 |         prices.append(float(price[t.keys()[0]]))
690 | 
691 |     with open('prices.csv', 'w') as f:
692 |         f.write('durat,{0}\n'.format(
693 |             ','.join([x.values()[0] for x in titles]))
694 |         )
695 |         for d in sorted(duration, key=duration.get):
696 |             f.write('{0},{1}\n'.format(
697 |                 d, ','.join([str(p * duration[d]) for p in prices])
698 |             ))
699 | 
700 |     with open('prices.csv', 'r') as f:
701 |         print(from_csv(f))
702 | 
703 | 
704 | zero_price = {
705 |     'ondemand': 0.0,
706 |     'noup': 0.0,
707 |     '1yearpartup': 0.0,
708 |     '1yearfullup': 0.0,
709 |     '3yearpartup' : 0.0,
710 |     '3yearfullup': 0.0
711 | }
712 | 
713 | def lsyaml():
714 |     '''Lists instances types used in the descriptive ``yaml`` file
715 |     '''
716 |     t = {}
717 |     fulllist = ap.get_all_instances(
718 |         ec2.region, 'ec2', 'ri-v2/linux-unix-shared'
719 |     )
720 |     total_price = zero_price
721 |     for f in sys.argv[2:]:
722 |         y = getyaml(lsyaml.__name__, f)
723 | 
724 |         for reg in y: # loop through profiles
725 |             for azlst in y[reg]: # loop through AZ list
726 |                 for az in azlst: # loop through AZ
727 |                     for instance in azlst[az]:
728 |                         saz = az.split('-')[-1]
729 |                         if not saz in t:
730 |                             t[saz] = {instance['type']:  0}
731 |     
732 |                         if instance['type'] in t[saz]:
733 |                             t[saz][instance['type']] += 1
734 |                         else:
735 |                             t[saz][instance['type']] = 1
736 | 
737 |                         prices = ap.instance_price(fulllist, instance['type'])
738 |                         total_price = _update_price(total_price, prices)
739 | 
740 |     print(yaml.dump(t, default_flow_style=False))
741 | 
742 |     _print_total_price(total_price)
743 | 
744 | def lsec2():
745 |     '''List instances types used in EC2
746 |     '''
747 |     if len(sys.argv) < 3:
748 |         print(
749 |             'usage: {0} {1} \'name filter\''.format(
750 |                 sys.argv[0], lsec2.__name__
751 |             )
752 |         )
753 |         sys.exit(1)
754 | 
755 |     t = {}
756 |     total_price = zero_price
757 |     fulllist = ap.get_all_instances(
758 |         ec2.region, 'ec2', 'ri-v2/linux-unix-shared'
759 |     )
760 |     for i in ec2.resource.instances.filter(
761 |         Filters=[{'Name': 'tag:Name', 'Values': [sys.argv[2]]}]
762 |     ):
763 |         az = i.placement['AvailabilityZone'].split('-')[-1]
764 |         if not az in t:
765 |             t[az] = {i.instance_type: 0}
766 | 
767 |         if i.instance_type in t[az]:
768 |             t[az][i.instance_type] += 1
769 |         else:
770 |             t[az][i.instance_type] = 1
771 | 
772 |         prices = ap.instance_price(fulllist, i.instance_type)
773 |         total_price = _update_price(total_price, prices)
774 | 
775 |     print(yaml.dump(t, default_flow_style=False))
776 | 
777 |     _print_total_price(total_price)
778 | 
779 | 
780 | if __name__ == '__main__':
781 |     getattr(sys.modules[__name__], sys.argv[1])()
782 | 


--------------------------------------------------------------------------------