├── .yamllint
├── aws_tag_sched_ops_perform.py
├── aws_tag_sched_ops_perform.py.zip
├── aws_tag_sched_ops_perform.py.zip.md5.txt
├── cloudformation
    ├── aws_tag_sched_ops.yaml
    └── aws_tag_sched_ops_pre_install.yaml
├── pylintrc
├── readme.md
├── requirements.txt
├── setup.cfg
├── zlicense-code.txt
└── zlicense-doc.txt


/.yamllint:
--------------------------------------------------------------------------------
 1 | # https://github.com/sqlxpert/aws-tag-sched-ops/
 2 | #
 3 | # Copyright 2017, Paul Marcelin
 4 | #
 5 | # This file is part of TagSchedOps.
 6 | #
 7 | # TagSchedOps is free software: you can redistribute it and/or modify
 8 | # it under the terms of the GNU General Public License as published by
 9 | # the Free Software Foundation, either version 3 of the License, or
10 | # (at your option) any later version.
11 | #
12 | # TagSchedOps is distributed in the hope that it will be useful,
13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 | # GNU General Public License for more details.
16 | #
17 | # You should have received a copy of the GNU General Public License
18 | # along with TagSchedOps. If not, see http://www.gnu.org/licenses/
19 | 
20 | extends: default
21 | 
22 | rules:
23 |   line-length: disable
24 |   brackets:
25 |     min-spaces-inside: 0
26 |     max-spaces-inside: 1
27 |   braces:
28 |     min-spaces-inside: 0
29 |     max-spaces-inside: 1
30 |   new-line-at-end-of-file: disable
31 | 


--------------------------------------------------------------------------------
/aws_tag_sched_ops_perform.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python3
  2 | """Perform scheduled operations on AWS resources, based on tags
  3 | 
  4 | Intended as an AWS Lambda function. DIRECT EXECUTION NOT RECOMMENDED.
  5 | Developers: see instructions below license notice.
  6 | 
  7 | https://github.com/sqlxpert/aws-tag-sched-ops/
  8 | 
  9 | Copyright 2018, Paul Marcelin
 10 | 
 11 | This file is part of TagSchedOps.
 12 | 
 13 | TagSchedOps is free software: you can redistribute it and/or modify
 14 | it under the terms of the GNU General Public License as published by
 15 | the Free Software Foundation, either version 3 of the License, or
 16 | (at your option) any later version.
 17 | 
 18 | TagSchedOps is distributed in the hope that it will be useful,
 19 | but WITHOUT ANY WARRANTY; without even the implied warranty of
 20 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 21 | GNU General Public License for more details.
 22 | 
 23 | You should have received a copy of the GNU General Public License
 24 | along with TagSchedOps. If not, see http://www.gnu.org/licenses/
 25 | 
 26 | # pylint: disable=line-too-long
 27 | 
 28 | To execute directly, for development purposes ONLY:
 29 | 
 30 | 0. Have a separate AWS account number, with no production resources.
 31 |    If running on a local system, also have a dedicated IAM user with an AWS
 32 |    API key ("Programmatic access") but no password (no "AWS Management Console
 33 |    access") and no attached IAM policies (certainly not AdministratorAccess).
 34 | 
 35 | 1. Complete the Python 3 environment setup steps in requirements.txt
 36 | 
 37 | 2a. If running on an EC2 instance:
 38 |     http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html
 39 |     Add an IAM role to the instance. No AWS API key is needed.
 40 | -OR-
 41 | 2b. If running on a local system:
 42 |     http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-quick-configuration
 43 |     Follow the AWS command-line interface (CLI) configuration prompts to save
 44 |     the IAM user's AWS API Key ID and Secret Key locally, and set a region:
 45 |       aws configure  # Consider --profile (see Named Profiles in linked doc.)
 46 | 
 47 | 3. Attach the Ec2TagSchedOpsPerform and RdsTagSchedOpsPerform IAM policies
 48 |    to the IAM role (if running on an EC2 instance) or to the IAM user (if
 49 |    running on a local system). Attach no other policies to the role or user.
 50 | 
 51 | 4. At the start of each session, activate your Python 3 virtual environment.
 52 | 
 53 | 5. If running on an EC2 instance, also set a region each time:
 54 |      export AWS_DEFAULT_REGION='us-east-1'
 55 |    Optionally, EC2 users too can set this once and for all, using the AWS CLI:
 56 |      aws configure set region 'us-east-1'
 57 | 
 58 | 6. Run the code:
 59 |      python3 aws_tag_sched_ops_perform.py
 60 | 
 61 | 7. Check Python syntax and style (must use Python 3 PyLint and PyCodeStyle!):
 62 |      cd aws-tag-sched-ops  # Home of pylintrc and PyCodeStyle setup.cfg
 63 |      pylint      aws_tag_sched_ops_perform.py
 64 |      pycodestyle aws_tag_sched_ops_perform.py
 65 | 
 66 | 8. Package for upload to S3, for use with AWS Lambda:
 67 |      rm     aws_tag_sched_ops_perform.py.zip
 68 |      zip    aws_tag_sched_ops_perform.py.zip aws_tag_sched_ops_perform.py
 69 |      md5sum aws_tag_sched_ops_perform.py.zip > aws_tag_sched_ops_perform.py.zip.md5.txt
 70 | """
 71 | 
 72 | 
 73 | import os
 74 | import datetime
 75 | import re
 76 | import pprint
 77 | import random
 78 | import collections
 79 | import boto3
 80 | import botocore
 81 | 
 82 | 
 83 | DEBUG = ("DEBUG" in os.environ)  # Print params internal reference dict if set
 84 | 
 85 | 
 86 | # Rules for Schedule Tags
 87 | #
 88 | # Principle: Avoid an elaborate, custom data structure. Instead, because
 89 | # current date/time values will come from strftime, define the rules in
 90 | # an strftime format string, inserting some marker characters. Use these
 91 | # markers, which pass through strftime unchanged, to divide the strftime
 92 | # output into regular expressions, which can be matched against tag values.
 93 | #
 94 | #  &  And: delineates rules, ALL OF WHICH must be satisfied
 95 | #     (implemented as the split character; separates string
 96 | #      into three regexps, one each for day, hour and minute)
 97 | #
 98 | #  |  Or: delineates a rule's tag values, ANY ONE OF WHICH must be satisfied
 99 | #     (implemented as the alternation operator within a regexp;
100 | #      allows day, hour, or minute to be specified in various ways)
101 | #
102 | # \*  Wildcard: stands for any day of the month or any hour of the day
103 | #     (appears as a literal character in tag values, so it must be escaped)
104 | #
105 | #  ~  10-minute normalization marker: causes the preceding
106 | #     digit to be replaced with a 1-digit wildcard (for example,
107 | #     "M=%M~" --> "M=40~" --> r"M=4\d", which matches "M=40" through "M=49")
108 | #
109 | MINUTE_NORM_REGEXP = re.compile(r"0~")
110 | SCHED_TAG_STRFTIME_FMTS = {
111 |   "once": r"%Y-%m-%dT%H:%M~",
112 |   "periodic": r"dTH:M=%dT%H:%M~|uTH:M=%uT%H:%M~|d=%d|d=\*|u=%u&"
113 |               r"dTH:M=%dT%H:%M~|uTH:M=%uT%H:%M~|H:M=%H:%M~|H=%H|H=\*&"
114 |               r"dTH:M=%dT%H:%M~|uTH:M=%uT%H:%M~|H:M=%H:%M~|M=%M~",
115 | }
116 | # Delimiter between schedule parts (no commas allowed in RDS tag values!):
117 | SCHED_DELIMS = r"[, ]"
118 | # Child resources (images and snapshots) receive a date/time tracking
119 | # tag and the date/time string is also embedded in their names:
120 | TRACK_TAG_STRFTIME_FMT = "%Y-%m-%dT%H:%MZ"
121 | # Separators are desirable and safe within tag values, not resource names:
122 | DATE_CHARS_UNSAFE_REGEXP = re.compile(r"[-:]")
123 | 
124 | 
125 | def date_time_process(date_time):
126 |   """Take a datetime and return a dict of compiled regexps, plus a string.
127 | 
128 |   The dictionary maps frequency values to lists of compiled
129 |   regexps, to be matched against date/time schedule tags.
130 | 
131 |   The date/time string is normalized to the start of a 10-minute cycle,
132 |   because this code is designed to be executed every 10 minutes.
133 |   """
134 | 
135 |   sched_regexp_lists = {
136 |     freq: [
137 |       re.compile(fr"(^|{SCHED_DELIMS})({tag_val_part})({SCHED_DELIMS}|$)")
138 |       # Harmlessly permissive (mix/match/repeat delimiters)
139 |       for tag_val_part in MINUTE_NORM_REGEXP.sub(
140 |         r"\d",
141 |         date_time.strftime(strftime_fmt)
142 |       ).split("&")
143 |     ]
144 |     for (freq, strftime_fmt) in SCHED_TAG_STRFTIME_FMTS.items()
145 |   }
146 | 
147 |   date_time_norm_str = date_time.strftime(TRACK_TAG_STRFTIME_FMT)
148 | 
149 |   return (sched_regexp_lists, date_time_norm_str)
150 | 
151 | 
152 | def tag_key_join(*args, tag_prefix="managed", tag_delim="-"):
153 |   """Take any number of strings, apply a prefix, join, and return a tag key
154 |   """
155 | 
156 |   return tag_delim.join([tag_prefix] + list(args))
157 | 
158 | 
159 | def tag_encode(tag_key, tag_val):
160 |   """Return a tag dictionary, to be passed to a boto3 method
161 |   """
162 | 
163 |   return {"Key": tag_key, "Value": tag_val}
164 | 
165 | 
166 | def tag_decode(tag_pair):
167 |   """Convert a tag dictionary returned by a boto3 method to a tuple
168 |   """
169 | 
170 |   return (tag_pair["Key"], tag_pair["Value"])
171 | 
172 | 
173 | def singleton_list(item):
174 |   """Return a one-item list.
175 | 
176 |   Not equivalent to the built-in.
177 |   list("abc") produces ["a", "b", "c"] where this function produces ["abc"].
178 |   """
179 | 
180 |   return [item]
181 | 
182 | 
183 | def kwargs_one_rsrc(
184 |   rsrc_id_key,
185 |   rsrc_id_process=lambda rsrc_id: rsrc_id
186 | ):
187 |   """Take the resource ID parameter name (key) and return a kwargs lambda fn.
188 | 
189 |   The lambda function produces the keyword argument dictionary for boto3
190 |   methods that are called with either a single resource ID (default) or a
191 |   list of resource IDs (set rsrc_id_process=singleton_list). Even in the latter
192 |   case, it accepts one resource ID only, because one-at-a-time processing
193 |   prevents all-or-nothing failures and permits more specific error reporting.
194 |   """
195 | 
196 |   return lambda rsrc_id: {
197 |     rsrc_id_key: rsrc_id_process(rsrc_id),
198 |   }
199 | 
200 | 
201 | def kwargs_tags_set(
202 |   rsrc_id_key,
203 |   rsrc_id_process=lambda rsrc_id: rsrc_id,
204 |   tags_key="Tags"
205 | ):
206 |   """Take the resource ID parameter name (key) and return a kwargs lambda fn.
207 | 
208 |   The lambda function produces the keyword argument dictionary for boto3 tagging
209 |   methods, which are called with a list of tags and, generally, a list of
210 |   resource IDs (set rsrc_id_process=singleton_list). See also kwargs_one_rsrc.
211 |   """
212 | 
213 |   return lambda rsrc_id, tags: {
214 |     rsrc_id_key: rsrc_id_process(rsrc_id),
215 |     tags_key: tags,
216 |   }
217 | 
218 | 
219 | def kwargs_describe(filter_pairs):
220 |   """Take filter pairs and return kwargs for a boto3 describe_ method.
221 | 
222 |   Only supports Filters, so far the only describe_ parameter
223 |   that this code uses (and used only for EC2, at that).
224 |   """
225 | 
226 |   return (
227 |     {
228 |       "Filters": [
229 |         {
230 |           "Name": filter_name,
231 |           "Values": filter_vals
232 |         }
233 |         for (filter_name, filter_vals) in filter_pairs
234 |       ],
235 |     }
236 |     if filter_pairs else
237 |     {}
238 |   )
239 | 
240 | 
241 | def op_tags_filters(params_rsrc_type):
242 |   """Returns filter pairs for operation tags on a particular resource type.
243 | 
244 |   Only useful for EC2, because boto3 and the underlying
245 |   AWS REST API do not yet support tag-based filters for RDS.
246 |   """
247 | 
248 |   return [
249 |     ("tag-key", [tag_key_join(op) for op in params_rsrc_type["ops"]])
250 |   ]
251 | 
252 | 
253 | def child_id_get_rds_snapshot(resp, child_name):
254 |   """Take a boto3 rds.stop_db_instance response and return the snapshot ID.
255 | 
256 |   Use ONLY when rds.stop_db_instance was called with DBSnapshotIdentifier.
257 | 
258 |   Whereas calling rds.create_db_snapshot creates and tags a snapshot in one
259 |   step, calling rds.stop_db_instance with DBSnapshotIdentifier does not tag the
260 |   resulting snapshot. Construct the snapshot ID (actually an ARN) for step two,
261 |   rds.add_tags_to_resource.
262 |   """
263 | 
264 |   child_id = ""
265 |   if child_name:
266 |     parent_arn = resp.get("DBInstance", {}).get("DBInstanceArn", "")
267 |     if parent_arn:
268 |       arn_parts = parent_arn.split(":")
269 |       arn_parts[-2] = "snapshot"
270 |       arn_parts[-1] = child_name
271 |       child_id = ":".join(arn_parts)
272 |   return child_id
273 | 
274 | 
275 | # params defines, for each supported AWS service:
276 | #  - search conditions for parent resources (instances and volumes)
277 | #  - operations that can be performed on matching parent resources
278 | #  - rules for naming and tagging child resources (images and snapshots)
279 | #
280 | # Lambda functions cover up boto3 (and AWS REST API) inconsistencies:
281 | #  - how many levels from response to resource list
282 | #  - whether tags must be requested separately
283 | #  - whether child creation and tagging are separate
284 | #  - how equivalent call parameters (and response keys) are named
285 | #  - how resources are identified, in calls and in AWS at large
286 | 
287 | PARAMS_CHILD = {
288 |   "ec2": {
289 | 
290 |     "Image": {
291 |       "child_name_kwargs": lambda child_name: {
292 |         "Name": child_name,
293 |         "Description": child_name,
294 |         # Set both, because some AWS interfaces expose only one!
295 |       },
296 |       # http://boto3.readthedocs.io/en/latest/reference/services/ec2.html#EC2.Client.create_image
297 |       "name_chars_unsafe_regexp": (
298 |         re.compile(r"[^a-zA-Z0-9\(\)\[\] \./\-'@_]")
299 |       ),
300 |       "name_char_fill": "X",  # Replace unsafe characters with this
301 |       "name_len_max": 128,
302 |       "child_id_get": lambda resp, child_name: resp.get("ImageId", ""),
303 |       "child_tag_default": True,
304 |     },
305 | 
306 |     "Snapshot": {
307 |       "child_name_kwargs": lambda child_name: {
308 |         "Description": child_name,
309 |       },
310 |       # http://boto3.readthedocs.io/en/latest/reference/services/ec2.html#EC2.Client.create_snapshot
311 |       # No unsafe characters documented for snapshot description
312 |       "name_len_max": 255,
313 |       "child_id_get": lambda resp, child_name: resp.get("SnapshotId", ""),
314 |       "child_tag_default": True,
315 |     },
316 | 
317 |   },
318 |   "rds": {
319 | 
320 |     "DBSnapshot": {
321 |       "child_name_kwargs": lambda child_name: {
322 |         "DBSnapshotIdentifier": child_name,
323 |       },
324 |       # http://boto3.readthedocs.io/en/latest/reference/services/rds.html#RDS.Client.add_tags_to_resource
325 |       # http://boto3.readthedocs.io/en/latest/reference/services/rds.html#RDS.Client.create_db_snapshot
326 |       # Standard re module seems not to support Unicode character categories:
327 |       # "name_chars_unsafe_regexp": re.compile(r"[^\p{L}\p{Z}\p{N}_.:/=+\-]"),
328 |       # Simplification (may give unexpected results with Unicode characters):
329 |       "name_chars_unsafe_regexp": re.compile(r"[^\w.:/=+\-]"),
330 |       "name_char_fill": "X",
331 |       "name_len_max": 255,
332 |       "child_id_get": child_id_get_rds_snapshot,
333 |       "child_tag_default": False,
334 |     },
335 |   },
336 | 
337 | }
338 | 
339 | PARAMS = {
340 |   "ec2": {
341 |     "tags_set_method_name": "create_tags",
342 |     "tags_set_kwargs": kwargs_tags_set("Resources",
343 |                                        rsrc_id_process=singleton_list),
344 |     "rsrc_types": {
345 | 
346 |       "Instance": {
347 |         "pager_name": "describe_instances",
348 |         "filter_pairs": [
349 |           ("instance-state-name", ["running", "stopping", "stopped"]),
350 |         ],
351 |         "extra_filter_pairs": op_tags_filters,
352 |         "rsrcs_get_fn": lambda resp: (
353 |           instance
354 |           for reservation in resp["Reservations"]
355 |           for instance in reservation["Instances"]
356 |         ),
357 |         "id_key": "InstanceId",
358 |         "ops": {
359 |           "start": {
360 |             "op_method_name": "start_instances",
361 |             "op_kwargs": kwargs_one_rsrc("InstanceIds",
362 |                                          rsrc_id_process=singleton_list),
363 |           },
364 |           "reboot": {
365 |             "op_method_name": "reboot_instances",
366 |             "op_kwargs": kwargs_one_rsrc("InstanceIds",
367 |                                          rsrc_id_process=singleton_list),
368 |           },
369 |           "stop": {
370 |             "op_method_name": "stop_instances",
371 |             "op_kwargs": kwargs_one_rsrc("InstanceIds",
372 |                                          rsrc_id_process=singleton_list),
373 |           },
374 |           "image": {
375 |             "op_method_name": "create_image",
376 |             "op_kwargs": lambda rsrc_id: {
377 |               "InstanceId": rsrc_id,
378 |               "NoReboot": True,
379 |             },
380 |             "child_rsrc_type": "Image",
381 |             "params_child_rsrc_type": PARAMS_CHILD["ec2"]["Image"],
382 |           },
383 |           "reboot-image": {
384 |             "op_method_name": "create_image",
385 |             "op_kwargs": lambda rsrc_id: {
386 |               "InstanceId": rsrc_id,
387 |               "NoReboot": False,
388 |             },
389 |             "child_rsrc_type": "Image",
390 |             "params_child_rsrc_type": PARAMS_CHILD["ec2"]["Image"],
391 |           },
392 |         },
393 |         "op_set_to_op": {  # How to interpret combinations of operations
394 |           frozenset(["reboot", "image"]): "reboot-image",
395 |           frozenset(["reboot-image", "image"]): "reboot-image",
396 |           frozenset(["reboot-image", "reboot"]): "reboot-image",
397 |           frozenset(["reboot-image", "image", "reboot"]): "reboot-image",
398 |           frozenset(["reboot", "stop"]): "stop",  # Next start includes boot
399 |         },
400 |       },
401 |       "Volume": {
402 |         "pager_name": "describe_volumes",
403 |         "filter_pairs": [
404 |           ("status", ["available", "in-use"]),
405 |         ],
406 |         "extra_filter_pairs": op_tags_filters,
407 |         "rsrcs_get_fn": lambda resp: resp["Volumes"],
408 |         "id_key": "VolumeId",
409 |         "ops": {
410 |           "snapshot": {
411 |             "op_method_name": "create_snapshot",
412 |             "op_kwargs": kwargs_one_rsrc("VolumeId"),
413 |             "child_rsrc_type": "Snapshot",
414 |             "params_child_rsrc_type": PARAMS_CHILD["ec2"]["Snapshot"],
415 |           },
416 |         },
417 |       },
418 | 
419 |     },
420 |   },
421 |   "rds": {
422 |     "tags_get_method_name": "list_tags_for_resource",
423 |     "tags_get_rsrc_id_kwarg": "ResourceName",
424 |     "tags_key": "TagList",
425 | 
426 |     "tags_set_method_name": "add_tags_to_resource",
427 |     "tags_set_kwargs": kwargs_tags_set("ResourceName"),
428 | 
429 |     "rsrc_types": {
430 | 
431 |       "DBInstance": {
432 |         "pager_name": "describe_db_instances",
433 |         "filter_pairs": [],  # RDS supports very few Filters
434 |         "extra_filter_pairs": lambda params_rsrc_type: [],
435 |         "rsrcs_get_fn": lambda resp: resp["DBInstances"],
436 |         "id_key": "DBInstanceIdentifier",
437 |         "rsrc_tags_get_id_key": "DBInstanceArn",
438 |         "ops": {
439 |           "start": {
440 |             "op_method_name": "start_db_instance",
441 |             "op_kwargs": kwargs_one_rsrc("DBInstanceIdentifier"),
442 |           },
443 |           "reboot": {
444 |             "op_method_name": "reboot_db_instance",
445 |             "op_kwargs": lambda rsrc_id: {
446 |               "DBInstanceIdentifier": rsrc_id,
447 |               "ForceFailover": False,
448 |             },
449 |           },
450 |           "reboot-failover": {
451 |             "op_method_name": "reboot_db_instance",
452 |             "op_kwargs": lambda rsrc_id: {
453 |               "DBInstanceIdentifier": rsrc_id,
454 |               "ForceFailover": True,
455 |             },
456 |           },
457 |           "stop": {
458 |             "op_method_name": "stop_db_instance",
459 |             "op_kwargs": kwargs_one_rsrc("DBInstanceIdentifier"),
460 |           },
461 |           "snapshot": {
462 |             "op_method_name": "create_db_snapshot",
463 |             "op_kwargs": kwargs_one_rsrc("DBInstanceIdentifier"),
464 |             "child_rsrc_type": "DBSnapshot",
465 |             "params_child_rsrc_type": PARAMS_CHILD["rds"]["DBSnapshot"],
466 |           },
467 |           "snapshot-stop": {
468 |             "op_method_name": "stop_db_instance",
469 |             "op_kwargs": kwargs_one_rsrc("DBInstanceIdentifier"),
470 |             "child_rsrc_type": "DBSnapshot",
471 |             "params_child_rsrc_type": PARAMS_CHILD["rds"]["DBSnapshot"],
472 |             "child_tag_default_override": True,
473 |           },
474 |         },
475 |         "op_set_to_op": {
476 |           frozenset(["snapshot", "stop"]): "snapshot-stop",
477 |           frozenset(["snapshot-stop", "stop"]): "snapshot-stop",
478 |           frozenset(["snapshot-stop", "snapshot"]): "snapshot-stop",
479 |           frozenset(["snapshot-stop", "stop", "snapshot"]): "snapshot-stop",
480 |           frozenset(["reboot", "stop"]): "stop",  # Next start includes boot
481 |         },
482 |       },
483 | 
484 |     },
485 |   },
486 | }
487 | 
488 | 
489 | LOG_LINE_FMT = "\t".join([
490 |   "{initiated}",  # See boto3_success
491 |   "{rsrc_id}",
492 |   "{op}",
493 |   "{child_rsrc_type}",
494 |   "{child}",  # child_id (ID or ARN) if known, otherwise child_name
495 |   "{child_op}",
496 |   "{note}"
497 | ])
498 | 
499 | 
500 | # Never pass such tags to child resources:
501 | TAG_KEYS_UNSAFE_REGEXP = re.compile(r"^((aws|ec2|rds):|managed-delete)")
502 | TAG_VALS_UNSAFE_REGEXP = re.compile(r"^(aws|ec2|rds):")
503 | # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#tag-restrictions
504 | 
505 | 
506 | def unique_suffix(
507 |   length=5,
508 |   chars="acefgrtxy3478"  # Small but unambiguous; for a more varied charset:
509 |   # chars=string.ascii_lowercase + string.digits
510 |   # http://pwgen.cvs.sourceforge.net/viewvc/pwgen/src/pw_rand.c
511 |   # https://ux.stackexchange.com/questions/21076
512 | ):
513 |   """Return a string of randomly chosen characters
514 |   """
515 | 
516 |   return "".join(random.choice(chars) for dummy in range(length))
517 | 
518 | 
519 | def child_name_get(
520 |   parent_id,
521 |   parent_name_from_tag,
522 |   date_time_str,
523 |   params_child_rsrc_type,
524 |   # Prefix image and snapshot names, because some sections of the
525 |   # AWS Web Console don't expose tags ("z..." will sort after most
526 |   # manually-created resources, and "m" stands for "managed"):
527 |   child_name_prefix="zm",
528 |   child_name_delim="-",
529 | ):  # pylint: disable=too-many-arguments
530 |   """Return the best available name for an image or snapshot
531 |   """
532 | 
533 |   child_name_tentative = child_name_delim.join([
534 |     child_name_prefix,
535 |     parent_name_from_tag if parent_name_from_tag else parent_id,
536 |     date_time_str,
537 |     unique_suffix()
538 |   ])
539 |   name_chars_unsafe_regexp = params_child_rsrc_type.get(
540 |     "name_chars_unsafe_regexp",
541 |     None
542 |   )
543 |   if name_chars_unsafe_regexp:
544 |     child_name = name_chars_unsafe_regexp.sub(
545 |       params_child_rsrc_type["name_char_fill"],
546 |       child_name_tentative
547 |     )
548 |   else:
549 |     child_name = child_name_tentative
550 |   return child_name[:params_child_rsrc_type["name_len_max"]]
551 | 
552 | 
553 | def boto3_success(resp):
554 |   """Return True if a boto3 response reflects HTTP status code 200.
555 | 
556 |   Success, throughout this code, means that an AWS operation
557 |   has been initiated, not necessarily that it has completed.
558 | 
559 |   It may take hours for an image or snapshot to become available, and checking
560 |   for completion is an audit function, to be performed by other code or tools.
561 |   """
562 | 
563 |   return (
564 |     isinstance(resp, dict)
565 |     and (resp.get("ResponseMetadata", {}).get("HTTPStatusCode", 0) == 200)
566 |   )
567 | 
568 | 
569 | def rsrc_process(rsrc, params_tags, tags_get_fn):
570 |   """Process tags for one parent resource (instance or volume).
571 | 
572 |   Determines which operation to perform and which tags to
573 |   pass to a child resource (image or snapshot), if applicable.
574 |   """
575 | 
576 |   tags_match = set()
577 |   result = {
578 |     "ops_tentative": set(),
579 |     "name_from_tag": "",
580 |     "child_tags": [],
581 |   }
582 | 
583 |   for tag_pair in tags_get_fn(rsrc):
584 |     (tag_key, tag_val) = tag_decode(tag_pair)
585 |     if tag_key == "Name":
586 |       # Save (EC2) instance or volume name but do not pass to image or snapshot
587 |       result["name_from_tag"] = tag_val
588 |     else:
589 |       regexps = params_tags["tag_regexps"].get(tag_key, None)
590 |       if regexps is None:
591 |         if not (
592 |           TAG_KEYS_UNSAFE_REGEXP.match(tag_key)
593 |           or TAG_VALS_UNSAFE_REGEXP.match(tag_val)
594 |         ):
595 |           # Pass miscellaneous tag, but only if user-created
596 |           result["child_tags"].append(tag_pair)
597 |       else:
598 |         # Schedule tag: check whether value matches current date/time.
599 |         # Operation-enabling tag: ignore value. Empty list accomplishes
600 |         #   this by triggering else clause of for...else loop.
601 |         for regexp in regexps:
602 |           if not regexp.search(tag_val):
603 |             break
604 |         else:
605 |           tags_match.add(tag_key)
606 | 
607 |   for (tags_req, op) in params_tags["tag_set_to_op"].items():
608 |     if tags_req <= tags_match:
609 |       result["ops_tentative"].add(op)
610 |   result["op"] = params_tags["op_set_to_op"].get(
611 |     frozenset(result["ops_tentative"]),
612 |     None
613 |   )
614 | 
615 |   return result
616 | 
617 | 
618 | def rsrcs_get(
619 |   sched_regexp_lists,
620 |   params_rsrc_type,
621 |   pager,
622 |   tags_get_fn
623 | ):
624 |   """Return a hierarchical dict: operation --> resource ID --> details.
625 | 
626 |   Innermost dictionaries contain parent resource details,
627 |   including tags to pass to child resources.
628 | 
629 |   Error handling: Does not make sense to continue execution
630 |   if any error occurs while building the resource list.
631 |   """
632 | 
633 |   params_tags = {
634 |     "tag_regexps": {},
635 |     "tag_set_to_op": {},
636 |     "op_set_to_op": dict(params_rsrc_type.get("op_set_to_op", {})),  # Copy!
637 |   }
638 |   for op in params_rsrc_type["ops"]:
639 |     tag_op = tag_key_join(op)
640 |     # Operation-enabling tag: ignore value (see rsrc_process):
641 |     params_tags["tag_regexps"][tag_op] = []
642 |     # Schedule tag: regexp match on value:
643 |     for (freq, regexps) in sched_regexp_lists.items():
644 |       tag_op_freq = tag_key_join(op, freq)
645 |       params_tags["tag_regexps"][tag_op_freq] = regexps
646 |       # Require operation-enabling tag AND one schedule tag:
647 |       params_tags["tag_set_to_op"][frozenset([tag_op, tag_op_freq])] = op
648 |     # Single-operation identity:
649 |     params_tags["op_set_to_op"][frozenset([op])] = op
650 | 
651 |   if DEBUG:
652 |     print()
653 |     pprint.pprint(params_tags)
654 |     print()
655 | 
656 |   id_key = params_rsrc_type["id_key"]
657 |   rsrcs = collections.defaultdict(dict)
658 |   for resp in pager.paginate(**kwargs_describe(
659 |     params_rsrc_type["filter_pairs"]
660 |     + params_rsrc_type["extra_filter_pairs"](params_rsrc_type)
661 |   )):
662 |     for rsrc in params_rsrc_type["rsrcs_get_fn"](resp):
663 |       rsrc_processed = rsrc_process(rsrc, params_tags, tags_get_fn)
664 |       op = rsrc_processed.pop("op")
665 |       if op:
666 |         rsrcs[op][rsrc[id_key]] = rsrc_processed
667 |       elif rsrc_processed["ops_tentative"]:
668 |         print(LOG_LINE_FMT.format(
669 |           initiated=0,
670 |           rsrc_id=rsrc[id_key],
671 |           op=",".join(sorted(rsrc_processed["ops_tentative"])),
672 |           child_rsrc_type="",
673 |           child="",
674 |           child_op="",
675 |           note="OPS_UNSUPPORTED",
676 |         ))
677 | 
678 |   return rsrcs
679 | 
680 | 
681 | def ops_perform(
682 |   ops_rsrcs,
683 |   date_time_norm_str,
684 |   params_svc,
685 |   params_rsrc_type,
686 |   aws_client,
687 |   tags_set_method
688 | ):  # pylint: disable=too-many-arguments
689 |   """Perform operations on resources of a given type.
690 |   """
691 | 
692 |   date_time_norm_str_safe = DATE_CHARS_UNSAFE_REGEXP.sub(
693 |     "",
694 |     date_time_norm_str
695 |   )
696 | 
697 |   for (op, rsrcs) in ops_rsrcs.items():
698 | 
699 |     params_op = params_rsrc_type["ops"][op]
700 |     op_method = getattr(aws_client, params_op["op_method_name"])
701 |     two_step_tag = False
702 | 
703 |     child_rsrc_type = params_op.get("child_rsrc_type", "")
704 |     if child_rsrc_type:
705 |       params_child_rsrc_type = params_op["params_child_rsrc_type"]
706 |       two_step_tag = params_op.get(
707 |         "child_tag_default_override",
708 |         params_child_rsrc_type["child_tag_default"]
709 |       )
710 |       if two_step_tag:
711 |         child_tag_kwargs = params_svc["tags_set_kwargs"]
712 |         child_id_get = params_child_rsrc_type["child_id_get"]
713 | 
714 |     for (rsrc_id, rsrc) in rsrcs.items():
715 |       kwargs = params_op["op_kwargs"](rsrc_id)
716 |       if child_rsrc_type:
717 |         child_name = child_name_get(
718 |           rsrc_id,
719 |           rsrc["name_from_tag"],
720 |           date_time_norm_str_safe,
721 |           params_child_rsrc_type
722 |         )
723 |         kwargs.update(params_child_rsrc_type["child_name_kwargs"](child_name))
724 |         rsrc["child_tags"].extend([
725 |           tag_encode(tag_key_join("parent-name"), rsrc["name_from_tag"]),
726 |           tag_encode(tag_key_join("parent-id"), rsrc_id),
727 |           tag_encode(tag_key_join("origin"), op),
728 |           tag_encode(tag_key_join("date-time"), date_time_norm_str),
729 |           tag_encode("Name", child_name),
730 |         ])
731 |         if not two_step_tag:
732 |           kwargs["Tags"] = rsrc["child_tags"]
733 | 
734 |       # Either an exception or the absence of HTTP status code 200
735 |       # is a failure.
736 |       resp = {}
737 |       err_print = ""
738 |       try:
739 |         resp = op_method(**kwargs)
740 |       except botocore.exceptions.ClientError as err:
741 |         err_print = str(err)
742 |       success = boto3_success(resp)
743 |       print(LOG_LINE_FMT.format(
744 |         initiated=int(success),  # 0 is shorter than "False", etc.
745 |         rsrc_id=rsrc_id,
746 |         op=op,
747 |         child_rsrc_type=child_rsrc_type,
748 |         child=child_name if child_rsrc_type else "",
749 |         child_op="",
750 |         note="" if success else (resp if resp else err_print),
751 |       ))
752 | 
753 |       if two_step_tag and success:
754 |         child_id = child_id_get(resp, child_name)
755 |         resp = {}
756 |         err_print = ""
757 |         if child_id:
758 |           try:
759 |             resp = tags_set_method(
760 |               **child_tag_kwargs(child_id, rsrc["child_tags"])
761 |             )
762 |           except botocore.exceptions.ClientError as err:
763 |             err_print = str(err)
764 |         success = boto3_success(resp)
765 |         print(LOG_LINE_FMT.format(
766 |           initiated=int(success),
767 |           rsrc_id=rsrc_id,
768 |           op=op,
769 |           child_rsrc_type=child_rsrc_type,
770 |           child=child_id if child_id else "UNKNOWN",
771 |           child_op="tag",
772 |           note="" if success else (resp if resp else err_print),
773 |         ))
774 | 
775 | 
776 | def tags_get_two_step(
777 |   rsrc,
778 |   rsrc_tags_get_id_key,
779 |   tags_get_method,
780 |   tags_get_rsrc_id_kwarg,
781 |   tags_key
782 | ):
783 |   """
784 |   Take a resource description and a tag retrieval method, and return the tags.
785 | 
786 |   Error handling: Trap and log, noting that inability to obtain tags
787 |   means that reasources with scheduled operations might be missed.
788 |   """
789 | 
790 |   rsrc_id = rsrc[rsrc_tags_get_id_key]
791 |   resp = {}
792 |   err_print = ""
793 |   try:
794 |     resp = tags_get_method(**{
795 |       tags_get_rsrc_id_kwarg: rsrc_id,
796 |     })
797 |   except botocore.exceptions.ClientError as err:
798 |     err_print = str(err)
799 |   success = boto3_success(resp)
800 |   if err_print or not success:
801 |     print(LOG_LINE_FMT.format(
802 |       initiated=int(success),
803 |       rsrc_id=rsrc_id,
804 |       op="tags_get",
805 |       child_rsrc_type="",
806 |       child="",
807 |       child_op="",
808 |       note=resp if resp else err_print,
809 |     ))
810 | 
811 |   return resp.get(tags_key, [])
812 | 
813 | 
814 | def tags_get_get(params_svc, params_rsrc_type, aws_client):
815 |   """Returns a lambda function to get tags for a resouce.
816 |   """
817 | 
818 |   rsrc_tags_get_id_key = params_rsrc_type.get("rsrc_tags_get_id_key", "")
819 | 
820 |   return lambda rsrc: (
821 |     tags_get_two_step(
822 |       rsrc,
823 |       rsrc_tags_get_id_key,
824 |       getattr(aws_client, params_svc["tags_get_method_name"]),
825 |       params_svc["tags_get_rsrc_id_kwarg"],
826 |       params_svc["tags_key"]
827 |     )
828 | 
829 |     if rsrc_tags_get_id_key else
830 | 
831 |     rsrc["Tags"]
832 |   )
833 | 
834 | 
835 | def lambda_handler(event, context):  # pylint: disable=unused-argument
836 |   """Perform scheduled operations on AWS resources, based on tags
837 |   """
838 | 
839 |   if DEBUG:
840 |     pprint.pprint(PARAMS)
841 |     print()
842 | 
843 |   now = datetime.datetime.utcnow()
844 |   (sched_regexp_lists, date_time_norm_str) = date_time_process(now.replace(
845 |     minute=now.minute // 10 * 10,  # DOWN to :00, :10, :20, :30, :40 or :50
846 |     second=0,
847 |     microsecond=0,
848 |   ))
849 |   print(re.sub(r"[{}]", "", LOG_LINE_FMT))  # Simple log header
850 |   print(LOG_LINE_FMT.format(  # Log normalized time
851 |     initiated=9,  # Code, to distinguish this from failure (0) or success (1)
852 |     rsrc_id="",
853 |     op="",
854 |     child_rsrc_type="",
855 |     child="",
856 |     child_op="",
857 |     note=date_time_norm_str,
858 |   ))
859 | 
860 |   # Iterate over supported AWS services and resource types.
861 |   # Find resources based on tags.
862 |   # Perform each operation on the intended resources.
863 | 
864 |   for (svc, params_svc) in PARAMS.items():
865 |     aws_client = boto3.client(svc)
866 | 
867 |     # boto3 method references can only be resolved at run-time,
868 |     # against an instance of an AWS service's Client class.
869 |     # http://boto3.readthedocs.io/en/latest/guide/events.html#extensibility-guide
870 | 
871 |     tags_set_method = getattr(aws_client, params_svc["tags_set_method_name"])
872 | 
873 |     for params_rsrc_type in params_svc["rsrc_types"].values():
874 | 
875 |       tags_get_fn = tags_get_get(params_svc, params_rsrc_type, aws_client)
876 | 
877 |       ops_rsrcs = rsrcs_get(
878 |         sched_regexp_lists,
879 |         params_rsrc_type,
880 |         aws_client.get_paginator(params_rsrc_type["pager_name"]),
881 |         tags_get_fn
882 |       )
883 |       ops_perform(
884 |         ops_rsrcs,
885 |         date_time_norm_str,
886 |         params_svc,
887 |         params_rsrc_type,
888 |         aws_client,
889 |         tags_set_method
890 |       )
891 | 
892 | 
893 | if __name__ == "__main__":
894 |   lambda_handler(None, None)
895 | 


--------------------------------------------------------------------------------
/aws_tag_sched_ops_perform.py.zip:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/sqlxpert/aws-tag-sched-ops/46965cb344b92e6a6aa44c3576b2164ccf5a7970/aws_tag_sched_ops_perform.py.zip


--------------------------------------------------------------------------------
/aws_tag_sched_ops_perform.py.zip.md5.txt:
--------------------------------------------------------------------------------
1 | 5a7f5d7189299e215e7c37fb62f4420d  aws_tag_sched_ops_perform.py.zip
2 | 


--------------------------------------------------------------------------------
/cloudformation/aws_tag_sched_ops.yaml:
--------------------------------------------------------------------------------
   1 | ---
   2 | AWSTemplateFormatVersion: "2010-09-09"
   3 | 
   4 | Description: "Start, reboot, stop and back up AWS resources using tag-based schedules. Copyright 2017, Paul Marcelin. https://github.com/sqlxpert/aws-tag-sched-ops/"
   5 | 
   6 | 
   7 | # To check YAML syntax, first complete the setup steps
   8 | # in aws-tag-sched-ops/requirements.txt and then run:
   9 | #   yamllint -c aws-tag-sched-ops/.yamllint aws-tag-sched-ops/cloudformation/aws_tag_sched_ops.yaml
  10 | 
  11 | 
  12 | # https://github.com/sqlxpert/aws-tag-sched-ops/
  13 | #
  14 | # Copyright 2017, Paul Marcelin
  15 | #
  16 | # This file is part of TagSchedOps.
  17 | #
  18 | # TagSchedOps is free software: you can redistribute it and/or modify
  19 | # it under the terms of the GNU General Public License as published by
  20 | # the Free Software Foundation, either version 3 of the License, or
  21 | # (at your option) any later version.
  22 | #
  23 | # TagSchedOps is distributed in the hope that it will be useful,
  24 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26 | # GNU General Public License for more details.
  27 | #
  28 | # You should have received a copy of the GNU General Public License
  29 | # along with TagSchedOps. If not, see http://www.gnu.org/licenses/
  30 | 
  31 | 
  32 | Parameters:
  33 | 
  34 |   StackSetsOrMultiRegion:
  35 |     Type: String
  36 |     Description: "Whether you are creating this stack in multiple regions, and/or are using the StackSets feature of CloudFormation"
  37 |     AllowedValues:
  38 |       - "No"
  39 |       - "Yes"
  40 |     Default: "No"
  41 |   LambdaCodeS3Bucket:
  42 |     Type: String
  43 |     Description: "Name of the S3 bucket where AWS Lambda function source code is stored. (For multi-region or CloudFormation StackSets scenarios, an S3 bucket with this name PLUS a region suffix, e.g., my-bucket-us-east-1, must exist in EACH target region, and must contain the SAME source code file, readable by EVERY target AWS account.)"
  44 |   TagSchedOpsPerformCodeName:
  45 |     Type: String
  46 |     Description: "Name (without the .py.zip suffix) of the file (S3 object) containing compressed source code for the TagSchedOpsPerform AWS Lamba function. Accept the default unless directed otherwise."
  47 |     Default: "aws_tag_sched_ops_perform"
  48 |   TagSchedOpsPerformCodeS3VersionID:
  49 |     Type: String
  50 |     Description: "Version ID for the desired version of the TagSchedOpsPerform source code S3 object. Leave blank, unless object versioning has been turned on for the S3 bucket. (If using CloudFormation StackSets, always leave blank.)"
  51 |     Default: ""
  52 | 
  53 |   # Do not validate at CloudFormation level,
  54 |   # in case values accepted by underlying APIs change:
  55 | 
  56 |   MainRegion:
  57 |     Type: String  # No AWS-specific parameter type for this!
  58 |     Description: "The first region where the TagSchedOps stack was created, is being created, or will be created. (This is compared with the current region, to prevent the creation of multiple sets of identical IAM policies. For CloudFormation StackSets, include this region on the list of regions for EVERY target account.)"
  59 |     Default: "us-east-1"
  60 |   TagSchedOpsPerformLogRetainDays:
  61 |     Type: Number
  62 |     Description: "How many days to keep logs from the TagSchedOpsPerform AWS Lambda function. Typical values are 1, 7, 14, 30, 60, and 90 days, but for the full list, see http://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutRetentionPolicy.html"
  63 |     Default: 30
  64 |   TagSchedOpsPerformMemoryMB:
  65 |     Type: Number
  66 |     Description: "How many megabytes of memory to allocate to the TagSchedOpsPerform AWS Lambda function. Increase only in case of out-of-memory errors."
  67 |     Default: 128
  68 |   TagSchedOpsPerformTimeoutSecs:
  69 |     Type: Number
  70 |     Description: "How many seconds before execution of the TagSchedOpsPerform AWS Lambda function is canceled. Increase only in case of time-out errors."
  71 |     Default: 120
  72 | 
  73 | Conditions:
  74 |   TagSchedOpsPerformCodeNoS3ObjVersion:
  75 |     !Equals [ !Ref TagSchedOpsPerformCodeS3VersionID, "" ]
  76 |   RegionMulti:
  77 |     !Equals [ !Ref StackSetsOrMultiRegion, "Yes" ]
  78 |   UserIamPoliciesCreate:
  79 |     !Equals [ !Ref MainRegion, !Ref "AWS::Region" ]
  80 | 
  81 | Resources:
  82 | 
  83 | 
  84 |   # This file contains many repeated blocks that would be good
  85 |   # candidates for YAML anchors/aliases. Unforunately, submitting
  86 |   # a CloudFormation template with aliases produces the following
  87 |   # error: "YAML aliases are not allowed in CloudFormation templates"
  88 | 
  89 | 
  90 |   Ec2TagSchedOpsPerform:
  91 |     Type: "AWS::IAM::ManagedPolicy"
  92 |     DeletionPolicy: Delete
  93 |     Properties:
  94 |       Description: "All EC2 instances, EBS volumes: describe, get tags. Tagged EC2 instances: start, reboot, stop. All EC2 instances: create image (allows reboot!). All EC2 EBS volumes: create snapshot. All EC2 images and EBS snapshots: tag, but cannot tag for deletion, or delete."
  95 |       PolicyDocument:
  96 |         Version: "2012-10-17"
  97 |         Statement:
  98 | 
  99 |           - Effect: Allow
 100 |             Action: "ec2:DescribeInstances"
 101 |             Resource: "*"
 102 | 
 103 |           - Effect: Allow
 104 |             Action: "ec2:StartInstances"
 105 |             Resource: !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:instance/*"
 106 |             Condition:
 107 |               StringLike:
 108 |                 "ec2:ResourceTag/managed-start": "*"
 109 | 
 110 |           - Effect: Allow
 111 |             Action: "ec2:RebootInstances"
 112 |             Resource: !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:instance/*"
 113 |             Condition:
 114 |               StringLike:
 115 |                 "ec2:ResourceTag/managed-reboot": "*"
 116 | 
 117 |           - Effect: Allow
 118 |             Action: "ec2:StopInstances"
 119 |             Resource: !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:instance/*"
 120 |             Condition:
 121 |               StringLike:
 122 |                 "ec2:ResourceTag/managed-stop": "*"
 123 | 
 124 |           # WARNING: CreateImage without NoReboot reboots an EC2 instance,
 125 |           #          even if a policy denies RebootInstances!
 126 |           - Effect: Allow
 127 |             Action: "ec2:CreateImage"
 128 |             Resource: "*"
 129 |           # Resource-level permissions not supported, so
 130 |           # "ec2:ResourceTag/..." Condition key doesn't work.
 131 |           - Effect: Allow
 132 |             Action: "ec2:CreateTags"
 133 |             Resource: !Sub "arn:aws:ec2:${AWS::Region}::image/*"
 134 | 
 135 |           - Effect: Allow
 136 |             Action: "ec2:DescribeVolumes"
 137 |             Resource: "*"
 138 | 
 139 |           - Effect: Allow
 140 |             Action: "ec2:CreateSnapshot"
 141 |             Resource: "*"
 142 |             # Resource-level permissions not supported, so
 143 |             # "ec2:ResourceTag/..." Condition key doesn't work.
 144 |           - Effect: Allow
 145 |             Action: "ec2:CreateTags"
 146 |             Resource: !Sub "arn:aws:ec2:${AWS::Region}::snapshot/*"
 147 | 
 148 |           # Security: an entity that creates cannot delete
 149 | 
 150 |           - Effect: Deny
 151 |             Action: "ec2:DeregisterImage"
 152 |             Resource: "*"
 153 |           - Effect: Deny
 154 |             Action: "ec2:DeleteSnapshot"
 155 |             Resource: "*"
 156 | 
 157 |           # Security: An entity that creates cannot tag for deletion
 158 | 
 159 |           - Effect: Deny
 160 |             Action:
 161 |               - "ec2:CreateTags"
 162 |               - "ec2:DeleteTags"
 163 |             Resource:
 164 |               - !Sub "arn:aws:ec2:${AWS::Region}::image/*"
 165 |               - !Sub "arn:aws:ec2:${AWS::Region}::snapshot/*"
 166 |             Condition:
 167 |               "ForAnyValue:StringEquals":
 168 |                 "aws:TagKeys":
 169 |                   - "managed-delete"
 170 | 
 171 | 
 172 |   RdsTagSchedOpsPerform:
 173 |     Type: "AWS::IAM::ManagedPolicy"
 174 |     DeletionPolicy: Delete
 175 |     Properties:
 176 |       Description: "All RDS instances: describe, get tags. Tagged RDS instances: start, reboot (includes failover), stop (includes create snapshot), create snapshot. All RDS snapshots: tag, but cannot tag for deletion, or delete)."
 177 |       PolicyDocument:
 178 |         Version: "2012-10-17"
 179 |         Statement:
 180 | 
 181 |           - Effect: Allow
 182 |             Action: "rds:DescribeDBInstances"
 183 |             Resource: "*"
 184 |           - Effect: Allow
 185 |             Action: "rds:ListTagsForResource"
 186 |             Resource: !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:*"
 187 | 
 188 |           - Effect: Allow
 189 |             Action: "rds:StartDBInstance"
 190 |             Resource: !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:*"
 191 |             Condition:
 192 |               StringLike:
 193 |                 "rds:db-tag/managed-start": "*"
 194 | 
 195 |           - Effect: Allow
 196 |             Action: "rds:RebootDBInstance"
 197 |             Resource: !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:*"
 198 |             Condition:
 199 |               StringLike:
 200 |                 "rds:db-tag/managed-reboot": "*"
 201 | 
 202 |           - Effect: Allow
 203 |             Action: "rds:RebootDBInstance"
 204 |             Resource: !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:*"
 205 |             Condition:
 206 |               StringLike:
 207 |                 "rds:db-tag/managed-reboot-failover": "*"
 208 | 
 209 |           - Effect: Allow
 210 |             Action: "rds:StopDBInstance"
 211 |             Resource: !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:*"
 212 |             Condition:
 213 |               StringLike:
 214 |                 "rds:db-tag/managed-stop": "*"
 215 | 
 216 |           - Effect: Allow
 217 |             Action: "rds:StopDBInstance"  # With snapshot option
 218 |             Resource:
 219 |               - !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:*"
 220 |               - !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:snapshot:*"
 221 |             Condition:
 222 |               StringLike:
 223 |                 "rds:db-tag/managed-snapshot-stop": "*"
 224 |           - Effect: Allow
 225 |             Action: "rds:AddTagsToResource"
 226 |             Resource: !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:snapshot:*"
 227 | 
 228 |           - Effect: Allow
 229 |             Action: "rds:CreateDBSnapshot"
 230 |             Resource:
 231 |               - !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:*"
 232 |               - !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:snapshot:*"
 233 |             Condition:
 234 |               StringLike:
 235 |                 "rds:db-tag/managed-snapshot": "*"
 236 | 
 237 |           - Effect: Deny  # Security: an entity that creates cannot delete...
 238 |             Action: "rds:DeleteDBSnapshot"
 239 |             Resource: !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:snapshot:*"
 240 |           - Effect: Deny  # Security: ...and cannot tag for deletion.
 241 |             Action: "rds:AddTagsToResource"
 242 |             Resource: !Sub "arn:aws:rds:${AWS::Region}:${AWS::AccountId}:snapshot:*"
 243 |             Condition:
 244 |               StringLike:
 245 |                 "rds:snapshot-tag/managed-delete": "*"
 246 | 
 247 | 
 248 |   TagSchedOpsPerformLambdaRole:
 249 |     Type: "AWS::IAM::Role"
 250 |     DeletionPolicy: Delete
 251 |     Properties:
 252 |       AssumeRolePolicyDocument:
 253 |         Version: "2012-10-17"
 254 |         Statement:
 255 |           - Effect: Allow
 256 |             Principal: { Service: "lambda.amazonaws.com" }
 257 |             Action: "sts:AssumeRole"
 258 |       ManagedPolicyArns:
 259 |         - !Ref Ec2TagSchedOpsPerform
 260 |         - !Ref RdsTagSchedOpsPerform
 261 | 
 262 | 
 263 |   TagSchedOpsPerformLambdaFn:
 264 |     Type: "AWS::Lambda::Function"
 265 |     # Not a strict dependency, from CloudFormation's perspective.
 266 |     # This policy need not have been created and attached before the
 267 |     # AWS Lambda function is created, but rather, before it first runs:
 268 |     # DependsOn: TagSchedOpsPerformLog
 269 |     DeletionPolicy: Delete
 270 |     Properties:
 271 |       Code:
 272 |         S3Bucket: !If [ RegionMulti, !Sub "${LambdaCodeS3Bucket}-${AWS::Region}", !Ref LambdaCodeS3Bucket ]
 273 |         S3Key: !Join [ ".", [ !Ref TagSchedOpsPerformCodeName, "py", "zip" ] ]
 274 |         S3ObjectVersion: !If [ TagSchedOpsPerformCodeNoS3ObjVersion, !Ref "AWS::NoValue", !Ref TagSchedOpsPerformCodeS3VersionID ]
 275 |       Handler: !Join [ ".", [ !Ref TagSchedOpsPerformCodeName, "lambda_handler" ] ]
 276 |       MemorySize: !Ref TagSchedOpsPerformMemoryMB
 277 |       Role: !GetAtt TagSchedOpsPerformLambdaRole.Arn
 278 |       Runtime: "python3.6"
 279 |       Timeout: !Ref TagSchedOpsPerformTimeoutSecs
 280 | 
 281 | 
 282 |   TagSchedOpsPerformLogGrp:
 283 |     Type: "AWS::Logs::LogGroup"
 284 |     DeletionPolicy: Retain  # Might want to review after function is deleted
 285 |     Properties:
 286 |       # AWS Lambda functions log to streams named after them,
 287 |       # so a stream name assigned by CloudFormation would not work.
 288 |       # Disadvantage: Custom name prevents modification by CloudFormation.
 289 |       LogGroupName: !Join [ "/", [ "", "aws", "lambda", !Ref TagSchedOpsPerformLambdaFn ] ]
 290 |       RetentionInDays: !Ref TagSchedOpsPerformLogRetainDays
 291 | 
 292 | 
 293 |   TagSchedOpsPerformLog:
 294 |     Type: "AWS::IAM::ManagedPolicy"
 295 |     DeletionPolicy: Delete
 296 |     Properties:
 297 |       Description: "TagSchedOpsPerform log streams: create, and put events. Required when executing that AWS Lambda function."
 298 |       Roles:
 299 |         - !Ref TagSchedOpsPerformLambdaRole
 300 |       PolicyDocument:
 301 |         Version: "2012-10-17"
 302 |         Statement:
 303 |           - Effect: Allow
 304 |             Action:
 305 |               - "logs:CreateLogStream"
 306 |               - "logs:PutLogEvents"
 307 |             # Field 6 (counting from 0) of a CloudWatch log group
 308 |             # ARN is the log group's name, which in this case is
 309 |             # the final name of the AWS Lambda function, including
 310 |             # the random string appended by CloudFormation:
 311 |             Resource: !Join [ ":", [ !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group", !Select [ 6, !Split [ ":", !GetAtt TagSchedOpsPerformLogGrp.Arn ] ], "log-stream", "*" ] ]
 312 | 
 313 | 
 314 |   TagSchedOpsPerform10MinEventRule:
 315 |     Type: "AWS::Events::Rule"
 316 |     DeletionPolicy: Delete
 317 |     Properties:
 318 |       Description: "Every 10 minutes: run TagSchedOpsPerform AWS Lambda function"
 319 |       # Never change once-every-10-minutes scheduling, which
 320 |       # is part of the code's schedule tag matching semantics.
 321 |       #
 322 |       # +1 minute prevents the AWS Lambda function from running twice
 323 |       # in the same 10-minute interval, which could happen if the clock
 324 |       # of a CloudWatch Events server were slightly slower than the clock
 325 |       # of an AWS Lambda server: the Events server could trigger the AWS
 326 |       # Lambda function a fraction of a second before the start of the
 327 |       # intended interval on the AWS Lambda server's own clock.
 328 |       ScheduleExpression: "cron(01,11,21,31,41,51 * * * ? *)"
 329 |       State: ENABLED
 330 |       Targets:
 331 |         - Arn: !GetAtt TagSchedOpsPerformLambdaFn.Arn
 332 |           Id: !Ref TagSchedOpsPerformLambdaFn
 333 | 
 334 | 
 335 |   TagSchedOpsPerformInvokeLambdaPerm:
 336 |     Type: "AWS::Lambda::Permission"
 337 |     DeletionPolicy: Delete
 338 |     Properties:
 339 |       Action: "lambda:InvokeFunction"
 340 |       FunctionName: !Ref TagSchedOpsPerformLambdaFn
 341 |       Principal: "events.amazonaws.com"
 342 |       SourceArn: !GetAtt TagSchedOpsPerform10MinEventRule.Arn
 343 | 
 344 | 
 345 |   TagSchedOpsPerformDisableLambdaPerm:
 346 |     Type: "AWS::Lambda::Permission"
 347 |     DeletionPolicy: Delete
 348 |     Properties:
 349 |       Action: "lambda:DisableInvokeFunction"
 350 |       FunctionName: !Ref TagSchedOpsPerformLambdaFn
 351 |       Principal: "events.amazonaws.com"
 352 |       SourceArn: !GetAtt TagSchedOpsPerform10MinEventRule.Arn
 353 | 
 354 | 
 355 |   TagSchedOpsPerformLambdaFnProtect:  # Name in ARN on final line must match!
 356 |     Type: "AWS::IAM::ManagedPolicy"
 357 |     Condition: UserIamPoliciesCreate
 358 |     DeletionPolicy: Delete
 359 |     Properties:
 360 |       Description: "TagSchedOpsPerform Lambda function, CloudWatch log group, log stream, and CloudWatch event: cannot change or delete. TagSchedOpsPerform Lambda function: cannot invoke manually. This policy may not be exhaustive."
 361 |       PolicyDocument:
 362 |         Version: "2012-10-17"
 363 |         Statement:
 364 | 
 365 |           - Effect: Deny
 366 |             Action:
 367 |               - "lambda:DeleteFunction"
 368 |               - "lambda:UpdateFunctionCode"
 369 |               - "lambda:PublishVersion"
 370 |               - "lambda:UpdateFunctionConfiguration"
 371 |               - "lambda:AddPermission"
 372 |               - "lambda:RemovePermission"
 373 |               - "lambda:InvokeFunction"
 374 |             Resource: !GetAtt TagSchedOpsPerformLambdaFn.Arn
 375 | 
 376 |           - Effect: Deny
 377 |             Action: "lambda:CreateEventSourceMapping"
 378 |             Resource: "*"
 379 |             Condition:
 380 |               ArnEquals:
 381 |                 "lambda:FunctionArn": !GetAtt TagSchedOpsPerformLambdaFn.Arn
 382 | 
 383 |           - Effect: Deny
 384 |             Action:
 385 |               - "logs:DeleteLogGroup"
 386 |               - "logs:DeleteRetentionPolicy"
 387 |               - "logs:PutRetentionPolicy"
 388 |             Resource: !GetAtt TagSchedOpsPerformLogGrp.Arn
 389 | 
 390 |           - Effect: Deny
 391 |             Action: "logs:DeleteLogStream"
 392 |             # Field 6 (counting from 0) of a CloudWatch log group
 393 |             # ARN is the log group's name, which in this case is
 394 |             # the final name of the AWS Lambda function, including
 395 |             # the random string appended by CloudFormation:
 396 |             Resource: !Join [ ":", [ !Sub "arn:aws:logs:*:${AWS::AccountId}:log-group", !Select [ 6, !Split [ ":", !GetAtt TagSchedOpsPerformLogGrp.Arn ] ], "log-stream", "*" ] ]
 397 | 
 398 |           - Effect: Deny
 399 |             Action:
 400 |               - "events:DeleteRule"
 401 |               - "events:RemoveTargets"
 402 |               - "events:EnableRule"
 403 |               - "events:DisableRule"
 404 |               - "events:PutRule"
 405 |               - "events:PutTargets"
 406 |             Resource: !GetAtt TagSchedOpsPerform10MinEventRule.Arn
 407 | 
 408 |           - Effect: Deny
 409 |             Action:
 410 |               - "iam:DeleteRole"
 411 |               - "iam:AttachRolePolicy"
 412 |               - "iam:DetachRolePolicy"
 413 |               - "iam:PutRolePolicy"
 414 |               - "iam:DeleteRolePolicy"
 415 |               - "iam:UpdateAssumeRolePolicy"
 416 |               - "iam:PassRole"
 417 |             Resource: !GetAtt TagSchedOpsPerformLambdaRole.Arn
 418 | 
 419 |           - Effect: Deny
 420 |             Action:
 421 |               - "iam:DeletePolicy"
 422 |               - "iam:CreatePolicyVersion"
 423 |               - "iam:DeletePolicyVersion"
 424 |             Resource:
 425 |               - !Ref TagSchedOpsPerformLog
 426 |               - !Ref Ec2TagSchedOpsPerform
 427 |               - !Ref RdsTagSchedOpsPerform
 428 |               # !Ref TagSchedOpsPerformLambdaFnProtect
 429 |               # produces a "Circular dependency between resources" error.
 430 |               # Work-around:
 431 |               - !Sub "arn:aws:iam::${AWS::AccountId}:policy/${AWS::StackName}-TagSchedOpsPerformLambdaFnProtect*"
 432 | 
 433 | 
 434 |   Ec2TagSchedOpsAdminister:
 435 |     Type: "AWS::IAM::ManagedPolicy"
 436 |     Condition: UserIamPoliciesCreate
 437 |     DeletionPolicy: Delete
 438 |     Properties:
 439 |       Description: "All EC2 instances, EBS volumes: describe; view tags; add, delete tags for scheduled operations. All EC2 images, EBS snapshots: describe; view tags; cannot delete images or snapshots, or tag for deletion. All CloudWatch events: describe. Event for TagSchedOps: enable and disable."
 440 |       PolicyDocument:
 441 |         Version: "2012-10-17"
 442 |         Statement:
 443 | 
 444 |           - Effect: Allow
 445 |             Action:
 446 |               - "ec2:DescribeInstances"
 447 |               - "ec2:DescribeVolumes"
 448 |               - "ec2:DescribeImages"
 449 |               - "ec2:DescribeSnapshots"
 450 |               - "ec2:DescribeTags"
 451 |             Resource: "*"
 452 | 
 453 |           - Effect: Allow
 454 |             Action:
 455 |               - "ec2:CreateTags"
 456 |               - "ec2:DeleteTags"
 457 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
 458 |             Condition:
 459 |               "ForAllValues:StringEquals":
 460 |                 "aws:TagKeys":
 461 |                   # Operation-enabling tags:
 462 |                   - "managed-start"
 463 |                   - "managed-reboot"
 464 |                   - "managed-reboot-image"
 465 |                   - "managed-image"
 466 |                   - "managed-stop"
 467 |                   # Repetitive schedule tags:
 468 |                   - "managed-start-periodic"
 469 |                   - "managed-reboot-periodic"
 470 |                   - "managed-reboot-image-periodic"
 471 |                   - "managed-image-periodic"
 472 |                   - "managed-stop-periodic"
 473 |                   # One-time schedule tags:
 474 |                   - "managed-start-once"
 475 |                   - "managed-reboot-once"
 476 |                   - "managed-reboot-image-once"
 477 |                   - "managed-image-once"
 478 |                   - "managed-stop-once"
 479 | 
 480 |           - Effect: Allow
 481 |             Action:
 482 |               - "ec2:CreateTags"
 483 |               - "ec2:DeleteTags"
 484 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:volume/*"
 485 |             Condition:
 486 |               "ForAllValues:StringEquals":
 487 |                 "aws:TagKeys":
 488 |                   # Operation-enabling tags:
 489 |                   - "managed-snapshot"
 490 |                   # Repetitive schedule tags:
 491 |                   - "managed-snapshot-periodic"
 492 |                   # One-time schedule tags:
 493 |                   - "managed-snapshot-once"
 494 | 
 495 |           # Security: an entity that schedules backups cannot tag for deletion
 496 | 
 497 |           - Effect: Deny
 498 |             Action:
 499 |               - "ec2:CreateTags"
 500 |               - "ec2:DeleteTags"
 501 |             Resource:
 502 |               - !Sub "arn:aws:ec2:*::image/*"
 503 |               - !Sub "arn:aws:ec2:*::snapshot/*"
 504 |             Condition:
 505 |               "ForAnyValue:StringEquals":
 506 |                 "aws:TagKeys":
 507 |                   - "managed-delete"
 508 | 
 509 |           # Security: an entity that tags for deletion cannot delete
 510 | 
 511 |           - Effect: Deny
 512 |             Action: "ec2:DeregisterImage"
 513 |             Resource: "*"
 514 |           - Effect: Deny
 515 |             Action: "ec2:DeleteSnapshot"
 516 |             Resource: "*"
 517 | 
 518 |           # See effects of tags
 519 | 
 520 |           - Effect: Allow
 521 |             Action:
 522 |               - "logs:DescribeLogGroups"
 523 |               - "logs:DescribeLogStreams"
 524 |             Resource: "*"
 525 |           - Effect: Allow
 526 |             Action:
 527 |               - "logs:GetLogEvents"
 528 |               - "logs:FilterLogEvents"
 529 |             # Field 6 (counting from 0) of a CloudWatch log group
 530 |             # ARN is the log group's name, which in this case is
 531 |             # the final name of the AWS Lambda function, including
 532 |             # the random string appended by CloudFormation:
 533 |             Resource: !Join [ ":", [ !Sub "arn:aws:logs:*:${AWS::AccountId}:log-group", !Select [ 6, !Split [ ":", !GetAtt TagSchedOpsPerformLogGrp.Arn ] ], "log-stream", "*" ] ]
 534 | 
 535 |           # Diagnose permissions errors
 536 | 
 537 |           - Effect: Allow
 538 |             Action: "sts:DecodeAuthorizationMessage"
 539 |             Resource: "*"
 540 | 
 541 |           # Turn project on or off
 542 | 
 543 |           - Effect: Allow
 544 |             Action:
 545 |               - "events:ListRules"
 546 |               - "events:ListRuleNamesByTarget"
 547 |               - "events:ListTargetsByRule"
 548 |               - "events:DescribeRule"
 549 |               - "events:TestEventPattern"  # Necessary for CW Events Console
 550 |             Resource: "*"
 551 |           - Effect: Allow
 552 |             Action:
 553 |               - "events:EnableRule"
 554 |               - "events:DisableRule"
 555 |             Resource: !GetAtt TagSchedOpsPerform10MinEventRule.Arn
 556 | 
 557 | 
 558 |   RdsTagSchedOpsAdminister:
 559 |     Type: "AWS::IAM::ManagedPolicy"
 560 |     Condition: UserIamPoliciesCreate
 561 |     DeletionPolicy: Delete
 562 |     Properties:
 563 |       Description: "All RDS instances: describe; view tags; add, delete tags for scheduled operations. All RDS snapshots: describe; view tags; cannot delete snapshots, or tag for deletion.  All CloudWatch events: describe. Event for TagSchedOps: enable and disable. Due to an AWS limitation, ANY tag can be added with an intended tag. Withholding all RDS tagging privileges is safer than relying on this policy."
 564 |       PolicyDocument:
 565 |         Version: "2012-10-17"
 566 |         Statement:
 567 | 
 568 |           - Effect: Allow
 569 |             Action:
 570 |               - "rds:DescribeDBInstances"
 571 |               - "rds:DescribeDBSnapshots"
 572 |             Resource: "*"
 573 |           - Effect: Allow
 574 |             Action: "rds:ListTagsForResource"
 575 |             Resource:
 576 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 577 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
 578 | 
 579 |           # The "rds:req-tag/..." Condition key supported by RDS is equivalent
 580 |           # to the "aws:RequestTag/..." Condition key supported by EC2. These
 581 |           # can be used to require a certain tag (and optionally, a certain
 582 |           # value) in tag creation and tag deletion actions -- but ANY OTHER
 583 |           # TAGS ARE ALLOWED in the same action.
 584 |           #
 585 |           # RDS lacks an equivalent to EC2's "aws:TagKeys" Condition key.
 586 |           # With "ForAllValues:StringEquals", that Condition key can
 587 |           # be used to block tag creation and tag deletion actions that
 588 |           # include keys other than the ones listed.
 589 |           #
 590 |           # Useful references:
 591 |           #
 592 |           # EC2 (scroll to bottom):
 593 |           # http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-supported-iam-actions-resources.html
 594 |           #
 595 |           # RDS (comparison operators like "streq" have since been renamed):
 596 |           # https://aws.amazon.com/blogs/security/a-primer-on-rds-resource-level-permissions/
 597 | 
 598 |           - Effect: Allow
 599 |             Action:
 600 |               - "rds:AddTagsToResource"
 601 |               - "rds:RemoveTagsFromResource"
 602 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 603 |             Condition:
 604 |               StringLike:
 605 |                 "rds:req-tag/managed-start": "*"
 606 |           - Effect: Allow
 607 |             Action:
 608 |               - "rds:AddTagsToResource"
 609 |               - "rds:RemoveTagsFromResource"
 610 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 611 |             Condition:
 612 |               StringLike:
 613 |                 "rds:req-tag/managed-reboot": "*"
 614 |           - Effect: Allow
 615 |             Action:
 616 |               - "rds:AddTagsToResource"
 617 |               - "rds:RemoveTagsFromResource"
 618 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 619 |             Condition:
 620 |               StringLike:
 621 |                 "rds:req-tag/managed-reboot-failover": "*"
 622 |           - Effect: Allow
 623 |             Action:
 624 |               - "rds:AddTagsToResource"
 625 |               - "rds:RemoveTagsFromResource"
 626 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 627 |             Condition:
 628 |               StringLike:
 629 |                 "rds:req-tag/managed-stop": "*"
 630 |           - Effect: Allow
 631 |             Action:
 632 |               - "rds:AddTagsToResource"
 633 |               - "rds:RemoveTagsFromResource"
 634 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 635 |             Condition:
 636 |               StringLike:
 637 |                 "rds:req-tag/managed-snapshot": "*"
 638 |           - Effect: Allow
 639 |             Action:
 640 |               - "rds:AddTagsToResource"
 641 |               - "rds:RemoveTagsFromResource"
 642 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 643 |             Condition:
 644 |               StringLike:
 645 |                 "rds:req-tag/managed-snapshot-stop": "*"
 646 | 
 647 |           - Effect: Allow
 648 |             Action:
 649 |               - "rds:AddTagsToResource"
 650 |               - "rds:RemoveTagsFromResource"
 651 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 652 |             Condition:
 653 |               StringLike:
 654 |                 "rds:req-tag/managed-start-periodic": "*"
 655 |           - Effect: Allow
 656 |             Action:
 657 |               - "rds:AddTagsToResource"
 658 |               - "rds:RemoveTagsFromResource"
 659 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 660 |             Condition:
 661 |               StringLike:
 662 |                 "rds:req-tag/managed-reboot-periodic": "*"
 663 |           - Effect: Allow
 664 |             Action:
 665 |               - "rds:AddTagsToResource"
 666 |               - "rds:RemoveTagsFromResource"
 667 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 668 |             Condition:
 669 |               StringLike:
 670 |                 "rds:req-tag/managed-reboot-failover-periodic": "*"
 671 |           - Effect: Allow
 672 |             Action:
 673 |               - "rds:AddTagsToResource"
 674 |               - "rds:RemoveTagsFromResource"
 675 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 676 |             Condition:
 677 |               StringLike:
 678 |                 "rds:req-tag/managed-snapshot-periodic": "*"
 679 |           - Effect: Allow
 680 |             Action:
 681 |               - "rds:AddTagsToResource"
 682 |               - "rds:RemoveTagsFromResource"
 683 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 684 |             Condition:
 685 |               StringLike:
 686 |                 "rds:req-tag/managed-stop-periodic": "*"
 687 |           - Effect: Allow
 688 |             Action:
 689 |               - "rds:AddTagsToResource"
 690 |               - "rds:RemoveTagsFromResource"
 691 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 692 |             Condition:
 693 |               StringLike:
 694 |                 "rds:req-tag/managed-snapshot-stop-periodic": "*"
 695 | 
 696 |           - Effect: Allow
 697 |             Action:
 698 |               - "rds:AddTagsToResource"
 699 |               - "rds:RemoveTagsFromResource"
 700 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 701 |             Condition:
 702 |               StringLike:
 703 |                 "rds:req-tag/managed-start-once": "*"
 704 |           - Effect: Allow
 705 |             Action:
 706 |               - "rds:AddTagsToResource"
 707 |               - "rds:RemoveTagsFromResource"
 708 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 709 |             Condition:
 710 |               StringLike:
 711 |                 "rds:req-tag/managed-reboot-once": "*"
 712 |           - Effect: Allow
 713 |             Action:
 714 |               - "rds:AddTagsToResource"
 715 |               - "rds:RemoveTagsFromResource"
 716 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 717 |             Condition:
 718 |               StringLike:
 719 |                 "rds:req-tag/managed-reboot-failover-once": "*"
 720 |           - Effect: Allow
 721 |             Action:
 722 |               - "rds:AddTagsToResource"
 723 |               - "rds:RemoveTagsFromResource"
 724 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 725 |             Condition:
 726 |               StringLike:
 727 |                 "rds:req-tag/managed-snapshot-once": "*"
 728 |           - Effect: Allow
 729 |             Action:
 730 |               - "rds:AddTagsToResource"
 731 |               - "rds:RemoveTagsFromResource"
 732 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 733 |             Condition:
 734 |               StringLike:
 735 |                 "rds:req-tag/managed-stop-once": "*"
 736 |           - Effect: Allow
 737 |             Action:
 738 |               - "rds:AddTagsToResource"
 739 |               - "rds:RemoveTagsFromResource"
 740 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 741 |             Condition:
 742 |               StringLike:
 743 |                 "rds:req-tag/managed-snapshot-stop-once": "*"
 744 | 
 745 |           # Security: An entity that can schedule backups
 746 |           #           cannot delete them, or tag them for deletion.
 747 | 
 748 |           - Effect: Deny
 749 |             Action:
 750 |               - "rds:AddTagsToResource"
 751 |               - "rds:RemoveTagsFromResource"
 752 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
 753 |             Condition:
 754 |               StringLike:
 755 |                 "rds:req-tag/managed-delete": "*"
 756 |           - Effect: Deny
 757 |             Action: "rds:DeleteDBSnapshot"
 758 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
 759 | 
 760 |           # See effects of tags
 761 | 
 762 |           - Effect: Allow
 763 |             Action:
 764 |               - "logs:DescribeLogGroups"
 765 |               - "logs:DescribeLogStreams"
 766 |             Resource: "*"
 767 |           - Effect: Allow
 768 |             Action:
 769 |               - "logs:GetLogEvents"
 770 |               - "logs:FilterLogEvents"
 771 |             # Field 6 (counting from 0) of a CloudWatch log group
 772 |             # ARN is the log group's name, which in this case is
 773 |             # the final name of the AWS Lambda function, including
 774 |             # the random string appended by CloudFormation:
 775 |             Resource: !Join [ ":", [ !Sub "arn:aws:logs:*:${AWS::AccountId}:log-group", !Select [ 6, !Split [ ":", !GetAtt TagSchedOpsPerformLogGrp.Arn ] ], "log-stream", "*" ] ]
 776 | 
 777 |           # Diagnose permissions errors
 778 | 
 779 |           - Effect: Allow
 780 |             Action: "sts:DecodeAuthorizationMessage"
 781 |             Resource: "*"
 782 | 
 783 |           # Turn project on or off
 784 | 
 785 |           - Effect: Allow
 786 |             Action:
 787 |               - "events:ListRules"
 788 |               - "events:ListRuleNamesByTarget"
 789 |               - "events:ListTargetsByRule"
 790 |               - "events:DescribeRule"
 791 |               - "events:TestEventPattern"  # Necessary for CW Events Console
 792 |             Resource: "*"
 793 |           - Effect: Allow
 794 |             Action:
 795 |               - "events:EnableRule"
 796 |               - "events:DisableRule"
 797 |             Resource: !GetAtt TagSchedOpsPerform10MinEventRule.Arn
 798 | 
 799 | 
 800 |   Ec2TagSchedOpsScheduleOnce:
 801 |     Type: "AWS::IAM::ManagedPolicy"
 802 |     Condition: UserIamPoliciesCreate
 803 |     DeletionPolicy: Delete
 804 |     Properties:
 805 |       Description: "EC2 instances, EBS volumes tagged to enable a managed operation: add, delete one-time schedule tags for that operation. All EC2 instances, EBS volumes: describe; view tags; cannot add or delete operation-enabling or repetitive schedule tags. All EC2 images, EBS snapshots: describe; view tags; cannot delete, or tag for deletion."
 806 |       PolicyDocument:
 807 |         Version: "2012-10-17"
 808 |         Statement:
 809 | 
 810 |           - Effect: Allow
 811 |             Action:
 812 |               - "ec2:DescribeInstances"
 813 |               - "ec2:DescribeVolumes"
 814 |               - "ec2:DescribeImages"
 815 |               - "ec2:DescribeSnapshots"
 816 |               - "ec2:DescribeTags"
 817 |             Resource: "*"
 818 | 
 819 |           - Effect: Allow
 820 |             Action:
 821 |               - "ec2:CreateTags"
 822 |               - "ec2:DeleteTags"
 823 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
 824 |             Condition:
 825 |               StringLike:
 826 |                 "ec2:ResourceTag/managed-start": "*"
 827 |               "ForAllValues:StringLike":
 828 |                 "aws:TagKeys":
 829 |                   - "managed-start-once"
 830 |           - Effect: Allow
 831 |             Action:
 832 |               - "ec2:CreateTags"
 833 |               - "ec2:DeleteTags"
 834 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
 835 |             Condition:
 836 |               StringLike:
 837 |                 "ec2:ResourceTag/managed-reboot": "*"
 838 |               "ForAllValues:StringLike":
 839 |                 "aws:TagKeys":
 840 |                   - "managed-reboot-once"
 841 |           - Effect: Allow
 842 |             Action:
 843 |               - "ec2:CreateTags"
 844 |               - "ec2:DeleteTags"
 845 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
 846 |             Condition:
 847 |               StringLike:
 848 |                 "ec2:ResourceTag/managed-reboot-image": "*"
 849 |               "ForAllValues:StringLike":
 850 |                 "aws:TagKeys":
 851 |                   - "managed-reboot-image-once"
 852 |           - Effect: Allow
 853 |             Action:
 854 |               - "ec2:CreateTags"
 855 |               - "ec2:DeleteTags"
 856 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
 857 |             Condition:
 858 |               StringLike:
 859 |                 "ec2:ResourceTag/managed-image": "*"
 860 |               "ForAllValues:StringLike":
 861 |                 "aws:TagKeys":
 862 |                   - "managed-image-once"
 863 |           - Effect: Allow
 864 |             Action:
 865 |               - "ec2:CreateTags"
 866 |               - "ec2:DeleteTags"
 867 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
 868 |             Condition:
 869 |               StringLike:
 870 |                 "ec2:ResourceTag/managed-stop": "*"
 871 |               "ForAllValues:StringLike":
 872 |                 "aws:TagKeys":
 873 |                   - "managed-stop-once"
 874 | 
 875 |           - Effect: Allow
 876 |             Action:
 877 |               - "ec2:CreateTags"
 878 |               - "ec2:DeleteTags"
 879 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:volume/*"
 880 |             Condition:
 881 |               StringLike:
 882 |                 "ec2:ResourceTag/managed-snapshot": "*"
 883 |               "ForAllValues:StringLike":
 884 |                 "aws:TagKeys":
 885 |                   - "managed-snapshot-once"
 886 | 
 887 |           # Deny addition/modification/deletion of certain other tags
 888 | 
 889 |           - Effect: Deny
 890 |             Action:
 891 |               - "ec2:CreateTags"
 892 |               - "ec2:DeleteTags"
 893 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
 894 |             Condition:
 895 |               "ForAnyValue:StringEquals":
 896 |                 "aws:TagKeys":
 897 |                   # Operation-enabling tags:
 898 |                   - "managed-start"
 899 |                   - "managed-reboot"
 900 |                   - "managed-reboot-image"
 901 |                   - "managed-image"
 902 |                   - "managed-stop"
 903 |                   # Repetitive schedule tags:
 904 |                   - "managed-start-periodic"
 905 |                   - "managed-reboot-periodic"
 906 |                   - "managed-reboot-image-periodic"
 907 |                   - "managed-image-periodic"
 908 |                   - "managed-stop-periodic"
 909 |           - Effect: Deny
 910 |             Action:
 911 |               - "ec2:CreateTags"
 912 |               - "ec2:DeleteTags"
 913 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:volume/*"
 914 |             Condition:
 915 |               "ForAnyValue:StringEquals":
 916 |                 "aws:TagKeys":
 917 |                   # Operation-enabling tags:
 918 |                   - "managed-snapshot"
 919 |                   # Repetitive schedule tags:
 920 |                   - "managed-snapshot-periodic"
 921 | 
 922 |           # Security: an entity that schedules backups cannot delete
 923 | 
 924 |           - Effect: Deny
 925 |             Action: "ec2:DeregisterImage"
 926 |             Resource: "*"  # Resource-level permissions not supported
 927 |           - Effect: Deny
 928 |             Action: "ec2:DeleteSnapshot"
 929 |             Resource: "*"  # Resource-level permissions not supported
 930 | 
 931 |           # Security: an entity that schedules backups cannot tag for deletion
 932 | 
 933 |           - Effect: Deny
 934 |             Action:
 935 |               - "ec2:CreateTags"
 936 |               - "ec2:DeleteTags"
 937 |             Resource:
 938 |               - !Sub "arn:aws:ec2:*::image/*"
 939 |               - !Sub "arn:aws:ec2:*::snapshot/*"
 940 |             Condition:
 941 |               "ForAnyValue:StringEquals":
 942 |                 "aws:TagKeys":
 943 |                   - "managed-delete"
 944 | 
 945 |           # See effects of tags
 946 | 
 947 |           - Effect: Allow
 948 |             Action:
 949 |               - "logs:DescribeLogGroups"
 950 |               - "logs:DescribeLogStreams"
 951 |             Resource: "*"
 952 |           - Effect: Allow
 953 |             Action:
 954 |               - "logs:GetLogEvents"
 955 |               - "logs:FilterLogEvents"
 956 |             # Field 6 (counting from 0) of a CloudWatch log group
 957 |             # ARN is the log group's name, which in this case is
 958 |             # the final name of the AWS Lambda function, including
 959 |             # the random string appended by CloudFormation:
 960 |             Resource: !Join [ ":", [ !Sub "arn:aws:logs:*:${AWS::AccountId}:log-group", !Select [ 6, !Split [ ":", !GetAtt TagSchedOpsPerformLogGrp.Arn ] ], "log-stream", "*" ] ]
 961 | 
 962 |           # Diagnose permissions errors
 963 | 
 964 |           - Effect: Allow
 965 |             Action: "sts:DecodeAuthorizationMessage"
 966 |             Resource: "*"
 967 | 
 968 | 
 969 |   RdsTagSchedOpsScheduleOnce:
 970 |     Type: "AWS::IAM::ManagedPolicy"
 971 |     Condition: UserIamPoliciesCreate
 972 |     DeletionPolicy: Delete
 973 |     Properties:
 974 |       Description: "RDS instances tagged to enable a managed operation: add, delete one-time schedule tags for that operation. All RDS instances: describe; view tags; cannot add or delete operation-enabling or repetitive schedule tags. All RDS snapshots: describe; view tags; cannot delete, or tag for deletion. Due to an AWS limitation, ANY tag can be added with an intended tag. Withholding all RDS tagging privileges is safer than relying on this policy."
 975 |       PolicyDocument:
 976 |         Version: "2012-10-17"
 977 |         Statement:
 978 | 
 979 |           - Effect: Allow
 980 |             Action:
 981 |               - "rds:DescribeDBInstances"
 982 |               - "rds:DescribeDBSnapshots"
 983 |             Resource: "*"
 984 |           - Effect: Allow
 985 |             Action: "rds:ListTagsForResource"
 986 |             Resource:
 987 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 988 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
 989 | 
 990 |           - Effect: Allow
 991 |             Action:
 992 |               - "rds:AddTagsToResource"
 993 |               - "rds:RemoveTagsFromResource"
 994 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
 995 |             Condition:
 996 |               StringLike:
 997 |                 "rds:db-tag/managed-start": "*"
 998 |                 "rds:req-tag/managed-start-once": "*"
 999 |           - Effect: Allow
1000 |             Action:
1001 |               - "rds:AddTagsToResource"
1002 |               - "rds:RemoveTagsFromResource"
1003 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1004 |             Condition:
1005 |               StringLike:
1006 |                 "rds:db-tag/managed-reboot": "*"
1007 |                 "rds:req-tag/managed-reboot-once": "*"
1008 |           - Effect: Allow
1009 |             Action:
1010 |               - "rds:AddTagsToResource"
1011 |               - "rds:RemoveTagsFromResource"
1012 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1013 |             Condition:
1014 |               StringLike:
1015 |                 "rds:db-tag/managed-reboot-failover": "*"
1016 |                 "rds:req-tag/managed-reboot-failover-once": "*"
1017 |           - Effect: Allow
1018 |             Action:
1019 |               - "rds:AddTagsToResource"
1020 |               - "rds:RemoveTagsFromResource"
1021 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1022 |             Condition:
1023 |               StringLike:
1024 |                 "rds:db-tag/managed-stop": "*"
1025 |                 "rds:req-tag/managed-stop-once": "*"
1026 |           - Effect: Allow
1027 |             Action:
1028 |               - "rds:AddTagsToResource"
1029 |               - "rds:RemoveTagsFromResource"
1030 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1031 |             Condition:
1032 |               StringLike:
1033 |                 "rds:db-tag/managed-snapshot": "*"
1034 |                 "rds:req-tag/managed-snapshot-once": "*"
1035 |           - Effect: Allow
1036 |             Action:
1037 |               - "rds:AddTagsToResource"
1038 |               - "rds:RemoveTagsFromResource"
1039 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1040 |             Condition:
1041 |               StringLike:
1042 |                 "rds:db-tag/managed-snapshot-stop": "*"
1043 |                 "rds:req-tag/managed-snapshot-stop-once": "*"
1044 | 
1045 |           # Deny addition/modification/deletion of operation-enabling tags
1046 | 
1047 |           # DISABLED due to potential RDS IAM bug
1048 |           #
1049 |           # - Effect: Deny
1050 |           #   Action:
1051 |           #     - "rds:AddTagsToResource"
1052 |           #     - "rds:RemoveTagsFromResource"
1053 |           #   Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1054 |           #   Condition:
1055 |           #     StringLike:
1056 |           #       "rds:req-tag/managed-start": "*"
1057 |           # - Effect: Deny
1058 |           #   Action:
1059 |           #     - "rds:AddTagsToResource"
1060 |           #     - "rds:RemoveTagsFromResource"
1061 |           #   Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1062 |           #   Condition:
1063 |           #     StringLike:
1064 |           #       "rds:req-tag/managed-reboot": "*"
1065 |           # - Effect: Deny
1066 |           #   Action:
1067 |           #     - "rds:AddTagsToResource"
1068 |           #     - "rds:RemoveTagsFromResource"
1069 |           #   Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1070 |           #   Condition:
1071 |           #     StringLike:
1072 |           #       "rds:req-tag/managed-reboot-failover": "*"
1073 |           # - Effect: Deny
1074 |           #   Action:
1075 |           #     - "rds:AddTagsToResource"
1076 |           #     - "rds:RemoveTagsFromResource"
1077 |           #   Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1078 |           #   Condition:
1079 |           #     StringLike:
1080 |           #       "rds:req-tag/managed-stop": "*"
1081 |           # - Effect: Deny
1082 |           #   Action:
1083 |           #     - "rds:AddTagsToResource"
1084 |           #     - "rds:RemoveTagsFromResource"
1085 |           #   Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1086 |           #   Condition:
1087 |           #     StringLike:
1088 |           #       "rds:req-tag/managed-snapshot": "*"
1089 |           # - Effect: Deny
1090 |           #   Action:
1091 |           #     - "rds:AddTagsToResource"
1092 |           #     - "rds:RemoveTagsFromResource"
1093 |           #   Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1094 |           #   Condition:
1095 |           #     StringLike:
1096 |           #       "rds:req-tag/managed-snapshot-stop": "*"
1097 | 
1098 |           # Deny addition/modification/deletion of repetitive schedule tags
1099 | 
1100 |           - Effect: Deny
1101 |             Action:
1102 |               - "rds:AddTagsToResource"
1103 |               - "rds:RemoveTagsFromResource"
1104 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1105 |             Condition:
1106 |               StringLike:
1107 |                 "rds:req-tag/managed-start-periodic": "*"
1108 |           - Effect: Deny
1109 |             Action:
1110 |               - "rds:AddTagsToResource"
1111 |               - "rds:RemoveTagsFromResource"
1112 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1113 |             Condition:
1114 |               StringLike:
1115 |                 "rds:req-tag/managed-reboot-periodic": "*"
1116 |           - Effect: Deny
1117 |             Action:
1118 |               - "rds:AddTagsToResource"
1119 |               - "rds:RemoveTagsFromResource"
1120 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1121 |             Condition:
1122 |               StringLike:
1123 |                 "rds:req-tag/managed-reboot-failover-periodic": "*"
1124 |           - Effect: Deny
1125 |             Action:
1126 |               - "rds:AddTagsToResource"
1127 |               - "rds:RemoveTagsFromResource"
1128 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1129 |             Condition:
1130 |               StringLike:
1131 |                 "rds:req-tag/managed-stop-periodic": "*"
1132 |           - Effect: Deny
1133 |             Action:
1134 |               - "rds:AddTagsToResource"
1135 |               - "rds:RemoveTagsFromResource"
1136 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1137 |             Condition:
1138 |               StringLike:
1139 |                 "rds:req-tag/managed-snapshot-periodic": "*"
1140 |           - Effect: Deny
1141 |             Action:
1142 |               - "rds:AddTagsToResource"
1143 |               - "rds:RemoveTagsFromResource"
1144 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1145 |             Condition:
1146 |               StringLike:
1147 |                 "rds:req-tag/managed-snapshot-stop-periodic": "*"
1148 | 
1149 |           # Security: An entity that can schedule backups
1150 |           #           cannot delete them, or tag them for deletion.
1151 | 
1152 |           - Effect: Deny
1153 |             Action:
1154 |               - "rds:AddTagsToResource"
1155 |               - "rds:RemoveTagsFromResource"
1156 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1157 |             Condition:
1158 |               StringLike:
1159 |                 "rds:req-tag/managed-delete": "*"
1160 |           - Effect: Deny
1161 |             Action: "rds:DeleteDBSnapshot"
1162 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1163 | 
1164 |           # See effects of tags
1165 | 
1166 |           - Effect: Allow
1167 |             Action:
1168 |               - "logs:DescribeLogGroups"
1169 |               - "logs:DescribeLogStreams"
1170 |             Resource: "*"
1171 |           - Effect: Allow
1172 |             Action:
1173 |               - "logs:GetLogEvents"
1174 |               - "logs:FilterLogEvents"
1175 |             # Field 6 (counting from 0) of a CloudWatch log group
1176 |             # ARN is the log group's name, which in this case is
1177 |             # the final name of the AWS Lambda function, including
1178 |             # the random string appended by CloudFormation:
1179 |             Resource: !Join [ ":", [ !Sub "arn:aws:logs:*:${AWS::AccountId}:log-group", !Select [ 6, !Split [ ":", !GetAtt TagSchedOpsPerformLogGrp.Arn ] ], "log-stream", "*" ] ]
1180 | 
1181 |           # Diagnose permissions errors
1182 | 
1183 |           - Effect: Allow
1184 |             Action: "sts:DecodeAuthorizationMessage"
1185 |             Resource: "*"
1186 | 
1187 | 
1188 |   Ec2TagSchedOpsSchedulePeriodic:
1189 |     Type: "AWS::IAM::ManagedPolicy"
1190 |     Condition: UserIamPoliciesCreate
1191 |     DeletionPolicy: Delete
1192 |     Properties:
1193 |       Description: "EC2 instances, EBS volumes tagged to enable a managed operation: add, delete repetitive schedule tags for that operation. All EC2 instances, EBS volumes: describe; view tags; cannot add or delete operation-enabling tags. All EC2 images, EBS snapshots: describe; view tags; cannot delete, or tag for deletion."
1194 |       PolicyDocument:
1195 |         Version: "2012-10-17"
1196 |         Statement:
1197 | 
1198 |           - Effect: Allow
1199 |             Action:
1200 |               - "ec2:DescribeInstances"
1201 |               - "ec2:DescribeVolumes"
1202 |               - "ec2:DescribeImages"
1203 |               - "ec2:DescribeSnapshots"
1204 |               - "ec2:DescribeTags"
1205 |             Resource: "*"
1206 | 
1207 |           - Effect: Allow
1208 |             Action:
1209 |               - "ec2:CreateTags"
1210 |               - "ec2:DeleteTags"
1211 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
1212 |             Condition:
1213 |               StringLike:
1214 |                 "ec2:ResourceTag/managed-start": "*"
1215 |               "ForAllValues:StringLike":
1216 |                 "aws:TagKeys":
1217 |                   - "managed-start-periodic"
1218 |           - Effect: Allow
1219 |             Action:
1220 |               - "ec2:CreateTags"
1221 |               - "ec2:DeleteTags"
1222 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
1223 |             Condition:
1224 |               StringLike:
1225 |                 "ec2:ResourceTag/managed-reboot": "*"
1226 |               "ForAllValues:StringLike":
1227 |                 "aws:TagKeys":
1228 |                   - "managed-reboot-periodic"
1229 |           - Effect: Allow
1230 |             Action:
1231 |               - "ec2:CreateTags"
1232 |               - "ec2:DeleteTags"
1233 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
1234 |             Condition:
1235 |               StringLike:
1236 |                 "ec2:ResourceTag/managed-reboot-image": "*"
1237 |               "ForAllValues:StringLike":
1238 |                 "aws:TagKeys":
1239 |                   - "managed-reboot-image-periodic"
1240 |           - Effect: Allow
1241 |             Action:
1242 |               - "ec2:CreateTags"
1243 |               - "ec2:DeleteTags"
1244 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
1245 |             Condition:
1246 |               StringLike:
1247 |                 "ec2:ResourceTag/managed-image": "*"
1248 |               "ForAllValues:StringLike":
1249 |                 "aws:TagKeys":
1250 |                   - "managed-image-periodic"
1251 |           - Effect: Allow
1252 |             Action:
1253 |               - "ec2:CreateTags"
1254 |               - "ec2:DeleteTags"
1255 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
1256 |             Condition:
1257 |               StringLike:
1258 |                 "ec2:ResourceTag/managed-stop": "*"
1259 |               "ForAllValues:StringLike":
1260 |                 "aws:TagKeys":
1261 |                   - "managed-stop-periodic"
1262 |           - Effect: Allow
1263 |             Action:
1264 |               - "ec2:CreateTags"
1265 |               - "ec2:DeleteTags"
1266 | 
1267 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:volume/*"
1268 |             Condition:
1269 |               StringLike:
1270 |                 "ec2:ResourceTag/managed-snapshot": "*"
1271 |               "ForAllValues:StringLike":
1272 |                 "aws:TagKeys":
1273 |                   - "managed-snapshot-periodic"
1274 | 
1275 |           # Deny addition/modification/deletion of operation-enabling tags
1276 | 
1277 |           - Effect: Deny
1278 |             Action:
1279 |               - "ec2:CreateTags"
1280 |               - "ec2:DeleteTags"
1281 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
1282 |             Condition:
1283 |               "ForAnyValue:StringEquals":
1284 |                 "aws:TagKeys":
1285 |                   - "managed-start"
1286 |                   - "managed-reboot"
1287 |                   - "managed-reboot-image"
1288 |                   - "managed-image"
1289 |                   - "managed-stop"
1290 | 
1291 |           - Effect: Deny
1292 |             Action:
1293 |               - "ec2:CreateTags"
1294 |               - "ec2:DeleteTags"
1295 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:volume/*"
1296 |             Condition:
1297 |               "ForAnyValue:StringEquals":
1298 |                 "aws:TagKeys":
1299 |                   - "managed-snapshot"
1300 | 
1301 |           # Security: An entity that schedules backups cannot delete
1302 | 
1303 |           - Effect: Deny
1304 |             Action: "ec2:DeregisterImage"
1305 |             Resource: "*"
1306 |           - Effect: Deny
1307 |             Action: "ec2:DeleteSnapshot"
1308 |             Resource: "*"
1309 | 
1310 |           # Security: an entity that schedules backups cannot tag for deletion
1311 | 
1312 |           - Effect: Deny
1313 |             Action:
1314 |               - "ec2:CreateTags"
1315 |               - "ec2:DeleteTags"
1316 |             Resource:
1317 |               - !Sub "arn:aws:ec2:*::image/*"
1318 |               - !Sub "arn:aws:ec2:*::snapshot/*"
1319 |             Condition:
1320 |               "ForAnyValue:StringEquals":
1321 |                 "aws:TagKeys":
1322 |                   - "managed-delete"
1323 | 
1324 |           # See effects of tags
1325 | 
1326 |           - Effect: Allow
1327 |             Action:
1328 |               - "logs:DescribeLogGroups"
1329 |               - "logs:DescribeLogStreams"
1330 |             Resource: "*"
1331 |           - Effect: Allow
1332 |             Action:
1333 |               - "logs:GetLogEvents"
1334 |               - "logs:FilterLogEvents"
1335 |             # Field 6 (counting from 0) of a CloudWatch log group
1336 |             # ARN is the log group's name, which in this case is
1337 |             # the final name of the AWS Lambda function, including
1338 |             # the random string appended by CloudFormation:
1339 |             Resource: !Join [ ":", [ !Sub "arn:aws:logs:*:${AWS::AccountId}:log-group", !Select [ 6, !Split [ ":", !GetAtt TagSchedOpsPerformLogGrp.Arn ] ], "log-stream", "*" ] ]
1340 | 
1341 |           # Diagnose permissions errors
1342 | 
1343 |           - Effect: Allow
1344 |             Action: "sts:DecodeAuthorizationMessage"
1345 |             Resource: "*"
1346 | 
1347 | 
1348 |   RdsTagSchedOpsSchedulePeriodic:
1349 |     Type: "AWS::IAM::ManagedPolicy"
1350 |     Condition: UserIamPoliciesCreate
1351 |     DeletionPolicy: Delete
1352 |     Properties:
1353 |       Description: "RDS instances tagged to enable a managed operation: add, delete repetitive schedule tags for that operation. All RDS instances: describe; view tags; cannot add or delete operation-enabling tags. All RDS snapshots: describe; view tags; cannot delete, or tag for deletion. Due to an AWS limitation, ANY tag can be added with an intended tag. Withholding all RDS tagging privileges is safer than relying on this policy."
1354 |       PolicyDocument:
1355 |         Version: "2012-10-17"
1356 |         Statement:
1357 | 
1358 |           - Effect: Allow
1359 |             Action:
1360 |               - "rds:DescribeDBInstances"
1361 |               - "rds:DescribeDBSnapshots"
1362 |             Resource: "*"
1363 |           - Effect: Allow
1364 |             Action: "rds:ListTagsForResource"
1365 |             Resource:
1366 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1367 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1368 | 
1369 |           - Effect: Allow
1370 |             Action:
1371 |               - "rds:AddTagsToResource"
1372 |               - "rds:RemoveTagsFromResource"
1373 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1374 |             Condition:
1375 |               StringLike:
1376 |                 "rds:db-tag/managed-start": "*"
1377 |                 "rds:req-tag/managed-start-periodic": "*"
1378 |           - Effect: Allow
1379 |             Action:
1380 |               - "rds:AddTagsToResource"
1381 |               - "rds:RemoveTagsFromResource"
1382 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1383 |             Condition:
1384 |               StringLike:
1385 |                 "rds:db-tag/managed-reboot": "*"
1386 |                 "rds:req-tag/managed-reboot-periodic": "*"
1387 |           - Effect: Allow
1388 |             Action:
1389 |               - "rds:AddTagsToResource"
1390 |               - "rds:RemoveTagsFromResource"
1391 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1392 |             Condition:
1393 |               StringLike:
1394 |                 "rds:db-tag/managed-reboot-failover": "*"
1395 |                 "rds:req-tag/managed-reboot-failover-periodic": "*"
1396 |           - Effect: Allow
1397 |             Action:
1398 |               - "rds:AddTagsToResource"
1399 |               - "rds:RemoveTagsFromResource"
1400 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1401 |             Condition:
1402 |               StringLike:
1403 |                 "rds:db-tag/managed-stop": "*"
1404 |                 "rds:req-tag/managed-stop-periodic": "*"
1405 |           - Effect: Allow
1406 |             Action:
1407 |               - "rds:AddTagsToResource"
1408 |               - "rds:RemoveTagsFromResource"
1409 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1410 |             Condition:
1411 |               StringLike:
1412 |                 "rds:db-tag/managed-snapshot": "*"
1413 |                 "rds:req-tag/managed-snapshot-periodic": "*"
1414 |           - Effect: Allow
1415 |             Action:
1416 |               - "rds:AddTagsToResource"
1417 |               - "rds:RemoveTagsFromResource"
1418 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1419 |             Condition:
1420 |               StringLike:
1421 |                 "rds:db-tag/managed-snapshot-stop": "*"
1422 |                 "rds:req-tag/managed-snapshot-stop-periodic": "*"
1423 | 
1424 |           # Deny addition/modification/deletion of operation-enabling tags
1425 | 
1426 |           # DISABLED due to potential RDS IAM bug
1427 | 
1428 |           # - Effect: Deny
1429 |           #   Action:
1430 |           #     - "rds:AddTagsToResource"
1431 |           #     - "rds:RemoveTagsFromResource"
1432 |           #   Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1433 |           #   Condition:
1434 |           #     StringLike:
1435 |           #       "rds:req-tag/managed-start": "*"
1436 |           # - Effect: Deny
1437 |           #   Action:
1438 |           #     - "rds:AddTagsToResource"
1439 |           #     - "rds:RemoveTagsFromResource"
1440 |           #   Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1441 |           #   Condition:
1442 |           #     StringLike:
1443 |           #       "rds:req-tag/managed-reboot": "*"
1444 |           # - Effect: Deny
1445 |           #   Action:
1446 |           #     - "rds:AddTagsToResource"
1447 |           #     - "rds:RemoveTagsFromResource"
1448 |           #   Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1449 |           #   Condition:
1450 |           #     StringLike:
1451 |           #       "rds:req-tag/managed-reboot-failover": "*"
1452 |           # - Effect: Deny
1453 |           #   Action:
1454 |           #     - "rds:AddTagsToResource"
1455 |           #     - "rds:RemoveTagsFromResource"
1456 |           #   Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1457 |           #   Condition:
1458 |           #     StringLike:
1459 |           #       "rds:req-tag/managed-stop": "*"
1460 |           # - Effect: Deny
1461 |           #   Action:
1462 |           #     - "rds:AddTagsToResource"
1463 |           #     - "rds:RemoveTagsFromResource"
1464 |           #   Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1465 |           #   Condition:
1466 |           #     StringLike:
1467 |           #       "rds:req-tag/managed-snapshot": "*"
1468 |           # - Effect: Deny
1469 |           #   Action:
1470 |           #     - "rds:AddTagsToResource"
1471 |           #     - "rds:RemoveTagsFromResource"
1472 |           #   Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1473 |           #   Condition:
1474 |           #     StringLike:
1475 |           #       "rds:req-tag/managed-snapshot-stop": "*"
1476 | 
1477 |           # Security: An entity that can schedule backups
1478 |           #           cannot delete them, or tag them for deletion.
1479 | 
1480 |           - Effect: Deny
1481 |             Action:
1482 |               - "rds:AddTagsToResource"
1483 |               - "rds:RemoveTagsFromResource"
1484 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1485 |             Condition:
1486 |               StringLike:
1487 |                 "rds:req-tag/managed-delete": "*"
1488 |           - Effect: Deny
1489 |             Action: "rds:DeleteDBSnapshot"
1490 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1491 | 
1492 |           # See effects of tags
1493 | 
1494 |           - Effect: Allow
1495 |             Action:
1496 |               - "logs:DescribeLogGroups"
1497 |               - "logs:DescribeLogStreams"
1498 |             Resource: "*"
1499 |           - Effect: Allow
1500 |             Action:
1501 |               - "logs:GetLogEvents"
1502 |               - "logs:FilterLogEvents"
1503 |             # Field 6 (counting from 0) of a CloudWatch log group
1504 |             # ARN is the log group's name, which in this case is
1505 |             # the final name of the AWS Lambda function, including
1506 |             # the random string appended by CloudFormation:
1507 |             Resource: !Join [ ":", [ !Sub "arn:aws:logs:*:${AWS::AccountId}:log-group", !Select [ 6, !Split [ ":", !GetAtt TagSchedOpsPerformLogGrp.Arn ] ], "log-stream", "*" ] ]
1508 | 
1509 |           # Diagnose permissions errors
1510 | 
1511 |           - Effect: Allow
1512 |             Action: "sts:DecodeAuthorizationMessage"
1513 |             Resource: "*"
1514 | 
1515 | 
1516 |   Ec2TagSchedOpsTagForDeletion:
1517 |     Type: "AWS::IAM::ManagedPolicy"
1518 |     Condition: UserIamPoliciesCreate
1519 |     DeletionPolicy: Delete
1520 |     Properties:
1521 |       Description: "All EC2 images, EBS snapshots: describe; view tags; add, delete tags for deletion, but cannot delete images or snapshots. All EC2 instances, EBS volumes: describe; view tags; cannot add or delete operational-enabling, one-time schedule, or repetitive schedule tags."
1522 |       PolicyDocument:
1523 |         Version: "2012-10-17"
1524 |         Statement:
1525 | 
1526 |           - Effect: Allow
1527 |             Action:
1528 |               - "ec2:DescribeInstances"
1529 |               - "ec2:DescribeVolumes"
1530 |               - "ec2:DescribeImages"
1531 |               - "ec2:DescribeSnapshots"
1532 |               - "ec2:DescribeTags"
1533 |             Resource: "*"
1534 | 
1535 |           - Effect: Allow
1536 |             Action:
1537 |               - "ec2:CreateTags"
1538 |               - "ec2:DeleteTags"
1539 |             Resource:
1540 |               - !Sub "arn:aws:ec2:*::image/*"
1541 |               - !Sub "arn:aws:ec2:*::snapshot/*"
1542 |             Condition:
1543 |               "ForAllValues:StringEquals":
1544 |                 "aws:TagKeys":
1545 |                   - "managed-delete"
1546 | 
1547 |           # Security: an entity that tags for deletion cannot create
1548 | 
1549 |           - Effect: Deny
1550 |             Action: "ec2:CreateImage"
1551 |             Resource: "*"
1552 |           - Effect: Deny  # Security: ...cannot create...
1553 |             Action: "ec2:CreateSnapshot"
1554 |             Resource: "*"
1555 | 
1556 |           # Security: an entity that tags for deletion cannot delete
1557 | 
1558 |           - Effect: Deny
1559 |             Action: "ec2:DeregisterImage"
1560 |             Resource: "*"
1561 |           - Effect: Deny
1562 |             Action: "ec2:DeleteSnapshot"
1563 |             Resource: "*"
1564 | 
1565 |           # Deny addition/modification/deletion of certain other tags
1566 | 
1567 |           - Effect: Deny
1568 |             Action:
1569 |               - "ec2:CreateTags"
1570 |               - "ec2:DeleteTags"
1571 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
1572 |             Condition:
1573 |               "ForAnyValue:StringEquals":
1574 |                 "aws:TagKeys":
1575 |                   # Operation-enabling tags:
1576 |                   - "managed-start"
1577 |                   - "managed-reboot"
1578 |                   - "managed-reboot-image"
1579 |                   - "managed-image"
1580 |                   - "managed-stop"
1581 |                   # Repetitive schedule tags
1582 |                   - "managed-start-periodic"
1583 |                   - "managed-reboot-periodic"
1584 |                   - "managed-reboot-image-periodic"
1585 |                   - "managed-image-periodic"
1586 |                   - "managed-stop-periodic"
1587 |                   # One-time schedule tags:
1588 |                   - "managed-start-once"
1589 |                   - "managed-reboot-once"
1590 |                   - "managed-reboot-image-once"
1591 |                   - "managed-image-once"
1592 |                   - "managed-stop-once"
1593 | 
1594 |           - Effect: Deny
1595 |             Action:
1596 |               - "ec2:CreateTags"
1597 |               - "ec2:DeleteTags"
1598 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:volume/*"
1599 |             Condition:
1600 |               "ForAnyValue:StringEquals":
1601 |                 "aws:TagKeys":
1602 |                   # Operation-enabling tags:
1603 |                   - "managed-snapshot"
1604 |                   # Repetitive schedule tags:
1605 |                   - "managed-snapshot-periodic"
1606 |                   # One-time schedule tags:
1607 |                   - "managed-snapshot-once"
1608 | 
1609 |           # Diagnose permissions errors
1610 | 
1611 |           - Effect: Allow
1612 |             Action: "sts:DecodeAuthorizationMessage"
1613 |             Resource: "*"
1614 | 
1615 | 
1616 |   RdsTagSchedOpsTagForDeletion:
1617 |     Type: "AWS::IAM::ManagedPolicy"
1618 |     Condition: UserIamPoliciesCreate
1619 |     DeletionPolicy: Delete
1620 |     Properties:
1621 |       Description: "All RDS snapshots: describe; view tags; add, delete tags for deletion, but cannot delete snapshots. All RDS instances: describe; view tags; cannot add or delete operational-enabling, one-time schedule, or repetitive schedule tags. Due to an AWS limitation, ANY tag can be added with an intended tag. Withholding all RDS tagging privileges is safer than relying on this policy."
1622 |       PolicyDocument:
1623 |         Version: "2012-10-17"
1624 |         Statement:
1625 | 
1626 |           - Effect: Allow
1627 |             Action:
1628 |               - "rds:DescribeDBInstances"
1629 |               - "rds:DescribeDBSnapshots"
1630 |             Resource: "*"
1631 |           - Effect: Allow
1632 |             Action: "rds:ListTagsForResource"
1633 |             Resource:
1634 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1635 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1636 | 
1637 |           - Effect: Allow  # Security: an entity that tags for deletion...
1638 |             Action:
1639 |               - "rds:AddTagsToResource"
1640 |               - "rds:RemoveTagsFromResource"
1641 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1642 |             Condition:
1643 |               StringLike:
1644 |                 "rds:req-tag/managed-delete": "*"
1645 |           - Effect: Deny  # Security: ...cannot create...
1646 |             Action: "rds:CreateDBSnapshot"
1647 |             Resource:
1648 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1649 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1650 |           - Effect: Deny  # [another way to create RDS snapshots]
1651 |             Action: "rds:StopDBInstance"  # With snapshot option
1652 |             Resource:
1653 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1654 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1655 |           - Effect: Deny  # Security: ...and cannot delete.
1656 |             Action: "rds:DeleteDBSnapshot"
1657 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1658 | 
1659 |           # Deny addition/modification/deletion of operation-enabling tags
1660 | 
1661 |           - Effect: Deny
1662 |             Action:
1663 |               - "rds:AddTagsToResource"
1664 |               - "rds:RemoveTagsFromResource"
1665 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1666 |             Condition:
1667 |               StringLike:
1668 |                 "rds:req-tag/managed-start": "*"
1669 |           - Effect: Deny
1670 |             Action:
1671 |               - "rds:AddTagsToResource"
1672 |               - "rds:RemoveTagsFromResource"
1673 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1674 |             Condition:
1675 |               StringLike:
1676 |                 "rds:req-tag/managed-reboot": "*"
1677 |           - Effect: Deny
1678 |             Action:
1679 |               - "rds:AddTagsToResource"
1680 |               - "rds:RemoveTagsFromResource"
1681 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1682 |             Condition:
1683 |               StringLike:
1684 |                 "rds:req-tag/managed-reboot-failover": "*"
1685 |           - Effect: Deny
1686 |             Action:
1687 |               - "rds:AddTagsToResource"
1688 |               - "rds:RemoveTagsFromResource"
1689 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1690 |             Condition:
1691 |               StringLike:
1692 |                 "rds:req-tag/managed-stop": "*"
1693 |           - Effect: Deny
1694 |             Action:
1695 |               - "rds:AddTagsToResource"
1696 |               - "rds:RemoveTagsFromResource"
1697 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1698 |             Condition:
1699 |               StringLike:
1700 |                 "rds:req-tag/managed-snapshot": "*"
1701 |           - Effect: Deny
1702 |             Action:
1703 |               - "rds:AddTagsToResource"
1704 |               - "rds:RemoveTagsFromResource"
1705 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1706 |             Condition:
1707 |               StringLike:
1708 |                 "rds:req-tag/managed-snapshot-stop": "*"
1709 | 
1710 |           # Deny addition/modification/deletion of one-time schedule tags
1711 | 
1712 |           - Effect: Deny
1713 |             Action:
1714 |               - "rds:AddTagsToResource"
1715 |               - "rds:RemoveTagsFromResource"
1716 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1717 |             Condition:
1718 |               StringLike:
1719 |                 "rds:req-tag/managed-start-once": "*"
1720 |           - Effect: Deny
1721 |             Action:
1722 |               - "rds:AddTagsToResource"
1723 |               - "rds:RemoveTagsFromResource"
1724 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1725 |             Condition:
1726 |               StringLike:
1727 |                 "rds:req-tag/managed-reboot-once": "*"
1728 |           - Effect: Deny
1729 |             Action:
1730 |               - "rds:AddTagsToResource"
1731 |               - "rds:RemoveTagsFromResource"
1732 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1733 |             Condition:
1734 |               StringLike:
1735 |                 "rds:req-tag/managed-reboot-failover-once": "*"
1736 |           - Effect: Deny
1737 |             Action:
1738 |               - "rds:AddTagsToResource"
1739 |               - "rds:RemoveTagsFromResource"
1740 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1741 |             Condition:
1742 |               StringLike:
1743 |                 "rds:req-tag/managed-stop-once": "*"
1744 |           - Effect: Deny
1745 |             Action:
1746 |               - "rds:AddTagsToResource"
1747 |               - "rds:RemoveTagsFromResource"
1748 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1749 |             Condition:
1750 |               StringLike:
1751 |                 "rds:req-tag/managed-snapshot-once": "*"
1752 |           - Effect: Deny
1753 |             Action:
1754 |               - "rds:AddTagsToResource"
1755 |               - "rds:RemoveTagsFromResource"
1756 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1757 |             Condition:
1758 |               StringLike:
1759 |                 "rds:req-tag/managed-snapshot-stop-once": "*"
1760 | 
1761 |           # Deny addition/modification/deletion of repetitive schedule tags
1762 | 
1763 |           - Effect: Deny
1764 |             Action:
1765 |               - "rds:AddTagsToResource"
1766 |               - "rds:RemoveTagsFromResource"
1767 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1768 |             Condition:
1769 |               StringLike:
1770 |                 "rds:req-tag/managed-start-periodic": "*"
1771 |           - Effect: Deny
1772 |             Action:
1773 |               - "rds:AddTagsToResource"
1774 |               - "rds:RemoveTagsFromResource"
1775 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1776 |             Condition:
1777 |               StringLike:
1778 |                 "rds:req-tag/managed-reboot-periodic": "*"
1779 |           - Effect: Deny
1780 |             Action:
1781 |               - "rds:AddTagsToResource"
1782 |               - "rds:RemoveTagsFromResource"
1783 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1784 |             Condition:
1785 |               StringLike:
1786 |                 "rds:req-tag/managed-reboot-failover-periodic": "*"
1787 |           - Effect: Deny
1788 |             Action:
1789 |               - "rds:AddTagsToResource"
1790 |               - "rds:RemoveTagsFromResource"
1791 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1792 |             Condition:
1793 |               StringLike:
1794 |                 "rds:req-tag/managed-stop-periodic": "*"
1795 |           - Effect: Deny
1796 |             Action:
1797 |               - "rds:AddTagsToResource"
1798 |               - "rds:RemoveTagsFromResource"
1799 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1800 |             Condition:
1801 |               StringLike:
1802 |                 "rds:req-tag/managed-snapshot-periodic": "*"
1803 |           - Effect: Deny
1804 |             Action:
1805 |               - "rds:AddTagsToResource"
1806 |               - "rds:RemoveTagsFromResource"
1807 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1808 |             Condition:
1809 |               StringLike:
1810 |                 "rds:req-tag/managed-snapshot-stop-periodic": "*"
1811 | 
1812 |           # Diagnose permissions errors
1813 | 
1814 |           - Effect: Allow
1815 |             Action: "sts:DecodeAuthorizationMessage"
1816 |             Resource: "*"
1817 | 
1818 | 
1819 |   Ec2TagSchedOpsBackupDelete:
1820 |     Type: "AWS::IAM::ManagedPolicy"
1821 |     Condition: UserIamPoliciesCreate
1822 |     DeletionPolicy: Delete
1823 |     Properties:
1824 |       Description: "All EC2 images, EBS snapshots: delete, but cannot tag for deletion, or create. All EC2 instances, EBS volumes: cannot add or delete operational-enabling, one-time schedule, or repetitive schedule tags."
1825 |       PolicyDocument:
1826 |         Version: "2012-10-17"
1827 |         Statement:
1828 | 
1829 |           - Effect: Allow
1830 |             Action: "ec2:DescribeImages"
1831 |             Resource: "*"
1832 |           - Effect: Allow
1833 |             Action: "ec2:DescribeSnapshots"
1834 |             Resource: "*"
1835 |           - Effect: Allow
1836 |             Action: "ec2:DeregisterImage"
1837 |             Resource: "*"  # Resource-level permissions not supported
1838 |           - Effect: Allow
1839 |             Action: "ec2:DeleteSnapshot"
1840 |             Resource: "*"  # Resource-level permissions not supported
1841 | 
1842 |           # Security: an entity that deletes cannot create
1843 | 
1844 |           - Effect: Deny
1845 |             Action: "ec2:CreateImage"
1846 |             Resource: "*"
1847 |           - Effect: Deny
1848 |             Action: "ec2:CreateSnapshot"
1849 |             Resource: "*"
1850 | 
1851 |           # Security: an entity that deletes cannot tag for deletion
1852 | 
1853 |           - Effect: Deny
1854 |             Action:
1855 |               - "ec2:CreateTags"
1856 |               - "ec2:DeleteTags"
1857 |             Resource:
1858 |               - !Sub "arn:aws:ec2:*::image/*"
1859 |               - !Sub "arn:aws:ec2:*::snapshot/*"
1860 |             Condition:
1861 |               "ForAnyValue:StringEquals":
1862 |                 "aws:TagKeys":
1863 |                   - "managed-delete"
1864 | 
1865 |           - Effect: Deny
1866 |             Action:
1867 |               - "ec2:CreateTags"
1868 |               - "ec2:DeleteTags"
1869 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
1870 |             Condition:
1871 |               "ForAnyValue:StringEquals":
1872 |                 "aws:TagKeys":
1873 |                   # Operation-enabling tags:
1874 |                   - "managed-start"
1875 |                   - "managed-reboot"
1876 |                   - "managed-reboot-image"
1877 |                   - "managed-image"
1878 |                   - "managed-stop"
1879 |                   # Repetitive schedule tags:
1880 |                   - "managed-start-periodic"
1881 |                   - "managed-reboot-periodic"
1882 |                   - "managed-reboot-image-periodic"
1883 |                   - "managed-image-periodic"
1884 |                   - "managed-stop-periodic"
1885 |                   # One-time schedule tags:
1886 |                   - "managed-start-once"
1887 |                   - "managed-reboot-once"
1888 |                   - "managed-reboot-image-once"
1889 |                   - "managed-image-once"
1890 |                   - "managed-stop-once"
1891 | 
1892 |           - Effect: Deny
1893 |             Action:
1894 |               - "ec2:CreateTags"
1895 |               - "ec2:DeleteTags"
1896 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:volume/*"
1897 |             Condition:
1898 |               "ForAnyValue:StringEquals":
1899 |                 "aws:TagKeys":
1900 |                   # Operation-enabling tags:
1901 |                   - "managed-snapshot"
1902 |                   # Repetitive schedule tags:
1903 |                   - "managed-snapshot-periodic"
1904 |                   # One-time schedule tags:
1905 |                   - "managed-snapshot-once"
1906 | 
1907 | 
1908 |   RdsTagSchedOpsBackupDelete:
1909 |     Type: "AWS::IAM::ManagedPolicy"
1910 |     Condition: UserIamPoliciesCreate
1911 |     DeletionPolicy: Delete
1912 |     Properties:
1913 |       Description: "RDS snapshots tagged for deletion: delete. All RDS snapshots: cannot tag for deletion, or create. All RDS instances: cannot add or delete operational-enabling, one-time schedule, or repetitive schedule tags."
1914 |       PolicyDocument:
1915 |         Version: "2012-10-17"
1916 |         Statement:
1917 | 
1918 |           - Effect: Allow
1919 |             Action: "rds:DescribeDBSnapshots"
1920 |             Resource: "*"
1921 |           - Effect: Allow
1922 |             Action: "rds:ListTagsForResource"
1923 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1924 |           - Effect: Allow
1925 |             Action: "rds:DeleteDBSnapshot"
1926 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1927 |             Condition:
1928 |               StringLike:
1929 |                 "rds:snapshot-tag/managed-delete": "*"
1930 | 
1931 |           - Effect: Deny  # Security: an entity that deletes cannot create...
1932 |             Action: "rds:CreateDBSnapshot"
1933 |             Resource:
1934 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1935 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1936 |           - Effect: Deny  # [another way to create RDS snapshots]
1937 |             Action: "rds:StopDBInstance"  # With snapshot option
1938 |             Resource:
1939 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1940 |               - !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1941 |           - Effect: Deny  # ...and cannot tag for deletion
1942 |             Action:
1943 |               - "rds:AddTagsToResource"
1944 |               - "rds:RemoveTagsFromResource"
1945 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
1946 |             Condition:
1947 |               StringLike:
1948 |                 "rds:req-tag/managed-delete": "*"
1949 | 
1950 |           # Deny addition/modification/deletion of operation-enabling tags
1951 | 
1952 |           - Effect: Deny
1953 |             Action:
1954 |               - "rds:AddTagsToResource"
1955 |               - "rds:RemoveTagsFromResource"
1956 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1957 |             Condition:
1958 |               StringLike:
1959 |                 "rds:req-tag/managed-start": "*"
1960 |           - Effect: Deny
1961 |             Action:
1962 |               - "rds:AddTagsToResource"
1963 |               - "rds:RemoveTagsFromResource"
1964 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1965 |             Condition:
1966 |               StringLike:
1967 |                 "rds:req-tag/managed-reboot": "*"
1968 |           - Effect: Deny
1969 |             Action:
1970 |               - "rds:AddTagsToResource"
1971 |               - "rds:RemoveTagsFromResource"
1972 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1973 |             Condition:
1974 |               StringLike:
1975 |                 "rds:req-tag/managed-reboot-failover": "*"
1976 |           - Effect: Deny
1977 |             Action:
1978 |               - "rds:AddTagsToResource"
1979 |               - "rds:RemoveTagsFromResource"
1980 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1981 |             Condition:
1982 |               StringLike:
1983 |                 "rds:req-tag/managed-stop": "*"
1984 |           - Effect: Deny
1985 |             Action:
1986 |               - "rds:AddTagsToResource"
1987 |               - "rds:RemoveTagsFromResource"
1988 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1989 |             Condition:
1990 |               StringLike:
1991 |                 "rds:req-tag/managed-snapshot": "*"
1992 |           - Effect: Deny
1993 |             Action:
1994 |               - "rds:AddTagsToResource"
1995 |               - "rds:RemoveTagsFromResource"
1996 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
1997 |             Condition:
1998 |               StringLike:
1999 |                 "rds:req-tag/managed-snapshot-stop": "*"
2000 | 
2001 |           # Deny addition/modification/deletion of one-time schedule tags
2002 | 
2003 |           - Effect: Deny
2004 |             Action:
2005 |               - "rds:AddTagsToResource"
2006 |               - "rds:RemoveTagsFromResource"
2007 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2008 |             Condition:
2009 |               StringLike:
2010 |                 "rds:req-tag/managed-start-once": "*"
2011 |           - Effect: Deny
2012 |             Action:
2013 |               - "rds:AddTagsToResource"
2014 |               - "rds:RemoveTagsFromResource"
2015 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2016 |             Condition:
2017 |               StringLike:
2018 |                 "rds:req-tag/managed-reboot-once": "*"
2019 |           - Effect: Deny
2020 |             Action:
2021 |               - "rds:AddTagsToResource"
2022 |               - "rds:RemoveTagsFromResource"
2023 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2024 |             Condition:
2025 |               StringLike:
2026 |                 "rds:req-tag/managed-reboot-failover-once": "*"
2027 |           - Effect: Deny
2028 |             Action:
2029 |               - "rds:AddTagsToResource"
2030 |               - "rds:RemoveTagsFromResource"
2031 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2032 |             Condition:
2033 |               StringLike:
2034 |                 "rds:req-tag/managed-stop-once": "*"
2035 |           - Effect: Deny
2036 |             Action:
2037 |               - "rds:AddTagsToResource"
2038 |               - "rds:RemoveTagsFromResource"
2039 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2040 |             Condition:
2041 |               StringLike:
2042 |                 "rds:req-tag/managed-snapshot-once": "*"
2043 |           - Effect: Deny
2044 |             Action:
2045 |               - "rds:AddTagsToResource"
2046 |               - "rds:RemoveTagsFromResource"
2047 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2048 |             Condition:
2049 |               StringLike:
2050 |                 "rds:req-tag/managed-snapshot-stop-once": "*"
2051 | 
2052 |           # Deny addition/modification/deletion of repetitive schedule tags
2053 | 
2054 |           - Effect: Deny
2055 |             Action:
2056 |               - "rds:AddTagsToResource"
2057 |               - "rds:RemoveTagsFromResource"
2058 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2059 |             Condition:
2060 |               StringLike:
2061 |                 "rds:req-tag/managed-start-periodic": "*"
2062 |           - Effect: Deny
2063 |             Action:
2064 |               - "rds:AddTagsToResource"
2065 |               - "rds:RemoveTagsFromResource"
2066 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2067 |             Condition:
2068 |               StringLike:
2069 |                 "rds:req-tag/managed-reboot-periodic": "*"
2070 |           - Effect: Deny
2071 |             Action:
2072 |               - "rds:AddTagsToResource"
2073 |               - "rds:RemoveTagsFromResource"
2074 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2075 |             Condition:
2076 |               StringLike:
2077 |                 "rds:req-tag/managed-reboot-failover-periodic": "*"
2078 |           - Effect: Deny
2079 |             Action:
2080 |               - "rds:AddTagsToResource"
2081 |               - "rds:RemoveTagsFromResource"
2082 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2083 |             Condition:
2084 |               StringLike:
2085 |                 "rds:req-tag/managed-stop-periodic": "*"
2086 |           - Effect: Deny
2087 |             Action:
2088 |               - "rds:AddTagsToResource"
2089 |               - "rds:RemoveTagsFromResource"
2090 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2091 |             Condition:
2092 |               StringLike:
2093 |                 "rds:req-tag/managed-snapshot-periodic": "*"
2094 |           - Effect: Deny
2095 |             Action:
2096 |               - "rds:AddTagsToResource"
2097 |               - "rds:RemoveTagsFromResource"
2098 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2099 |             Condition:
2100 |               StringLike:
2101 |                 "rds:req-tag/managed-snapshot-stop-periodic": "*"
2102 | 
2103 | 
2104 |   Ec2TagSchedOpsNoTag:
2105 |     Type: "AWS::IAM::ManagedPolicy"
2106 |     Condition: UserIamPoliciesCreate
2107 |     DeletionPolicy: Delete
2108 |     Properties:
2109 |       Description: "All EC2 instances, EBS volumes: cannot add or delete operational-enabling, one-time schedule, or repetitive schedule tags. All EC2 images, EBS snapshots: cannot tag for deletion, and cannot delete."
2110 |       PolicyDocument:
2111 |         Version: "2012-10-17"
2112 |         Statement:
2113 | 
2114 |           - Effect: Deny
2115 |             Action:
2116 |               - "ec2:CreateTags"
2117 |               - "ec2:DeleteTags"
2118 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:instance/*"
2119 |             Condition:
2120 |               "ForAnyValue:StringEquals":
2121 |                 "aws:TagKeys":
2122 |                   # Operation-enabling tags:
2123 |                   - "managed-start"
2124 |                   - "managed-reboot"
2125 |                   - "managed-reboot-image"
2126 |                   - "managed-image"
2127 |                   - "managed-stop"
2128 |                   # Repetitive schedule tags:
2129 |                   - "managed-start-periodic"
2130 |                   - "managed-reboot-periodic"
2131 |                   - "managed-reboot-image-periodic"
2132 |                   - "managed-image-periodic"
2133 |                   - "managed-stop-periodic"
2134 |                   # One-time schedule tags:
2135 |                   - "managed-start-once"
2136 |                   - "managed-reboot-once"
2137 |                   - "managed-reboot-image-once"
2138 |                   - "managed-image-once"
2139 |                   - "managed-stop-once"
2140 | 
2141 |           - Effect: Deny
2142 |             Action:
2143 |               - "ec2:CreateTags"
2144 |               - "ec2:DeleteTags"
2145 |             Resource: !Sub "arn:aws:ec2:*:${AWS::AccountId}:volume/*"
2146 |             Condition:
2147 |               "ForAnyValue:StringEquals":
2148 |                 "aws:TagKeys":
2149 |                   # Operation-enabling tags:
2150 |                   - "managed-snapshot"
2151 |                   # Repetitive schedule tags:
2152 |                   - "managed-snapshot-periodic"
2153 |                   # One-time schedule tags:
2154 |                   - "managed-snapshot-once"
2155 | 
2156 |           # Deny addition/modification/deletion of deletion tags
2157 | 
2158 |           - Effect: Deny
2159 |             Action:
2160 |               - "ec2:CreateTags"
2161 |               - "ec2:DeleteTags"
2162 |             Resource:
2163 |               - !Sub "arn:aws:ec2:*::image/*"
2164 |               - !Sub "arn:aws:ec2:*::snapshot/*"
2165 |             Condition:
2166 |               "ForAnyValue:StringEquals":
2167 |                 "aws:TagKeys":
2168 |                   - "managed-delete"
2169 | 
2170 |           # Deny deletion
2171 | 
2172 |           - Effect: Deny
2173 |             Action: "ec2:DeregisterImage"
2174 |             Resource: "*"
2175 |           - Effect: Deny
2176 |             Action: "ec2:DeleteSnapshot"
2177 |             Resource: "*"
2178 | 
2179 | 
2180 |   RdsTagSchedOpsNoTag:
2181 |     Type: "AWS::IAM::ManagedPolicy"
2182 |     Condition: UserIamPoliciesCreate
2183 |     DeletionPolicy: Delete
2184 |     Properties:
2185 |       Description: "All RDS instances: cannot add or delete operational-enabling, one-time schedule, or repetitive schedule tags. All RDS snapshots: cannot tag for deletion, and cannot delete."
2186 |       PolicyDocument:
2187 |         Version: "2012-10-17"
2188 |         Statement:
2189 | 
2190 |           # Deny addition/modification/deletion of operation-enabling tags
2191 | 
2192 |           - Effect: Deny
2193 |             Action:
2194 |               - "rds:AddTagsToResource"
2195 |               - "rds:RemoveTagsFromResource"
2196 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2197 |             Condition:
2198 |               StringLike:
2199 |                 "rds:req-tag/managed-start": "*"
2200 |           - Effect: Deny
2201 |             Action:
2202 |               - "rds:AddTagsToResource"
2203 |               - "rds:RemoveTagsFromResource"
2204 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2205 |             Condition:
2206 |               StringLike:
2207 |                 "rds:req-tag/managed-reboot": "*"
2208 |           - Effect: Deny
2209 |             Action:
2210 |               - "rds:AddTagsToResource"
2211 |               - "rds:RemoveTagsFromResource"
2212 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2213 |             Condition:
2214 |               StringLike:
2215 |                 "rds:req-tag/managed-reboot-failover": "*"
2216 |           - Effect: Deny
2217 |             Action:
2218 |               - "rds:AddTagsToResource"
2219 |               - "rds:RemoveTagsFromResource"
2220 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2221 |             Condition:
2222 |               StringLike:
2223 |                 "rds:req-tag/managed-stop": "*"
2224 |           - Effect: Deny
2225 |             Action:
2226 |               - "rds:AddTagsToResource"
2227 |               - "rds:RemoveTagsFromResource"
2228 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2229 |             Condition:
2230 |               StringLike:
2231 |                 "rds:req-tag/managed-snapshot": "*"
2232 |           - Effect: Deny
2233 |             Action:
2234 |               - "rds:AddTagsToResource"
2235 |               - "rds:RemoveTagsFromResource"
2236 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2237 |             Condition:
2238 |               StringLike:
2239 |                 "rds:req-tag/managed-snapshot-stop": "*"
2240 | 
2241 |           # Deny addition/modification/deletion of one-time schedule tags
2242 | 
2243 |           - Effect: Deny
2244 |             Action:
2245 |               - "rds:AddTagsToResource"
2246 |               - "rds:RemoveTagsFromResource"
2247 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2248 |             Condition:
2249 |               StringLike:
2250 |                 "rds:req-tag/managed-start-once": "*"
2251 |           - Effect: Deny
2252 |             Action:
2253 |               - "rds:AddTagsToResource"
2254 |               - "rds:RemoveTagsFromResource"
2255 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2256 |             Condition:
2257 |               StringLike:
2258 |                 "rds:req-tag/managed-reboot-once": "*"
2259 |           - Effect: Deny
2260 |             Action:
2261 |               - "rds:AddTagsToResource"
2262 |               - "rds:RemoveTagsFromResource"
2263 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2264 |             Condition:
2265 |               StringLike:
2266 |                 "rds:req-tag/managed-reboot-failover-once": "*"
2267 |           - Effect: Deny
2268 |             Action:
2269 |               - "rds:AddTagsToResource"
2270 |               - "rds:RemoveTagsFromResource"
2271 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2272 |             Condition:
2273 |               StringLike:
2274 |                 "rds:req-tag/managed-stop-once": "*"
2275 |           - Effect: Deny
2276 |             Action:
2277 |               - "rds:AddTagsToResource"
2278 |               - "rds:RemoveTagsFromResource"
2279 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2280 |             Condition:
2281 |               StringLike:
2282 |                 "rds:req-tag/managed-snapshot-once": "*"
2283 |           - Effect: Deny
2284 |             Action:
2285 |               - "rds:AddTagsToResource"
2286 |               - "rds:RemoveTagsFromResource"
2287 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2288 |             Condition:
2289 |               StringLike:
2290 |                 "rds:req-tag/managed-snapshot-stop-once": "*"
2291 | 
2292 |           # Deny addition/modification/deletion of repetitive schedule tags
2293 | 
2294 |           - Effect: Deny
2295 |             Action:
2296 |               - "rds:AddTagsToResource"
2297 |               - "rds:RemoveTagsFromResource"
2298 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2299 |             Condition:
2300 |               StringLike:
2301 |                 "rds:req-tag/managed-start-periodic": "*"
2302 |           - Effect: Deny
2303 |             Action:
2304 |               - "rds:AddTagsToResource"
2305 |               - "rds:RemoveTagsFromResource"
2306 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2307 |             Condition:
2308 |               StringLike:
2309 |                 "rds:req-tag/managed-reboot-periodic": "*"
2310 |           - Effect: Deny
2311 |             Action:
2312 |               - "rds:AddTagsToResource"
2313 |               - "rds:RemoveTagsFromResource"
2314 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2315 |             Condition:
2316 |               StringLike:
2317 |                 "rds:req-tag/managed-stop-periodic": "*"
2318 |           - Effect: Deny
2319 |             Action:
2320 |               - "rds:AddTagsToResource"
2321 |               - "rds:RemoveTagsFromResource"
2322 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2323 |             Condition:
2324 |               StringLike:
2325 |                 "rds:req-tag/managed-snapshot-periodic": "*"
2326 |           - Effect: Deny
2327 |             Action:
2328 |               - "rds:AddTagsToResource"
2329 |               - "rds:RemoveTagsFromResource"
2330 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:db:*"
2331 |             Condition:
2332 |               StringLike:
2333 |                 "rds:req-tag/managed-snapshot-stop-periodic": "*"
2334 | 
2335 |           # Deny addition/modification/deletion of deletion tags
2336 | 
2337 |           - Effect: Deny
2338 |             Action:
2339 |               - "rds:AddTagsToResource"
2340 |               - "rds:RemoveTagsFromResource"
2341 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
2342 |             Condition:
2343 |               StringLike:
2344 |                 "rds:req-tag/managed-delete": "*"
2345 | 
2346 |           # Deny deletion
2347 | 
2348 |           - Effect: Deny
2349 |             Action: "rds:DeleteDBSnapshot"
2350 |             Resource: !Sub "arn:aws:rds:*:${AWS::AccountId}:snapshot:*"
2351 | 


--------------------------------------------------------------------------------
/cloudformation/aws_tag_sched_ops_pre_install.yaml:
--------------------------------------------------------------------------------
  1 | ---
  2 | AWSTemplateFormatVersion: "2010-09-09"
  3 | 
  4 | Description: "Prerequisite for installing TagSchedOps using CloudFormation with an assumed role, or CloudFormation StackSets. Copyright 2017, Paul Marcelin. https://github.com/sqlxpert/aws-tag-sched-ops/"
  5 | 
  6 | 
  7 | # To check YAML syntax, first complete the setup steps
  8 | # in aws-tag-sched-ops/requirements.txt and then run:
  9 | #   yamllint -c aws-tag-sched-ops/.yamllint aws-tag-sched-ops/cloudformation/aws_tag_sched_ops.yaml
 10 | 
 11 | 
 12 | # https://github.com/sqlxpert/aws-tag-sched-ops/
 13 | #
 14 | # Copyright 2017, Paul Marcelin
 15 | #
 16 | # This file is part of TagSchedOps.
 17 | #
 18 | # TagSchedOps is free software: you can redistribute it and/or modify
 19 | # it under the terms of the GNU General Public License as published by
 20 | # the Free Software Foundation, either version 3 of the License, or
 21 | # (at your option) any later version.
 22 | #
 23 | # TagSchedOps is distributed in the hope that it will be useful,
 24 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
 25 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 26 | # GNU General Public License for more details.
 27 | #
 28 | # You should have received a copy of the GNU General Public License
 29 | # along with TagSchedOps. If not, see http://www.gnu.org/licenses/
 30 | 
 31 | 
 32 | Parameters:
 33 |   AdministratorAccountId:
 34 |     Type: String
 35 |     Description: "AWS account number for StackSets administration account (where parent StackSets will be created). Leave blank if using ordinary CloudFormation instead of StackSets, or if AWSCloudFormationStackSetExecutionRole existed before this stack was created."
 36 |     MinLength: 0
 37 |     MaxLength: 12
 38 |   AWSCloudFormationStackSetExecutionRoleStatus:
 39 |     Type: String
 40 |     Description: "Status of the service role for CloudFormation StackSets, AWSCloudFormationStackSetExecutionRole, in current account (a StackSets target account, where child CloudFormation stacks will be created)"
 41 |     AllowedValues:
 42 |       - "Role does not exist"
 43 |       - "Role exists, AdministratorAccess policy attached"
 44 |       - "Role exists, CloudFormationFullAccess and StackSetExecutionMisc attached"
 45 |       - "Role exists, policies above not attached"
 46 |       - "Role irrelevant; using ordinary CloudFormation, not StackSets"
 47 |       # In the rare case where the CloudFormationFullAccess and
 48 |       # CloudFormationStackSetExecutionMisc IAM policies exist (from a prior
 49 |       # installation) but are no longer attached to the role, the user should
 50 |       # re-attach them, or simply delete them, before answering this question.
 51 |       # Custom-name-related limitations prevent using a CloudFormation
 52 |       # template to attach the pre-existing policies to the pre-existing role.
 53 |     Default: "Role irrelevant; using ordinary CloudFormation, not StackSets"
 54 |   LambdaCodeS3Bucket:
 55 |     Type: String
 56 |     Description: "Name of the S3 bucket where AWS Lambda function source code is stored. (For multi-region or CloudFormation StackSets scenarios, an S3 bucket with this name PLUS a region suffix, e.g., my-bucket-us-east-1, must exist in EACH target region, and must contain the SAME source code file, readable by EVERY target AWS account.)"
 57 |   TagSchedOpsCloudFormationStackNamePrefix:
 58 |     Type: String
 59 |     Description: "First part of the name of TagSchedOps CloudFormation stacks. (If you plan to create the TagSchedOps stack in one or more regions, using CloudFormation with an assumed role, and without StackSets, the name of each such stack must start with the prefix that you specify here.)"
 60 |     Default: "TagSchedOps"
 61 | 
 62 | Conditions:
 63 |   AWSCloudFormationStackSetExecutionRoleCreate:
 64 |     !Equals [ !Ref AWSCloudFormationStackSetExecutionRoleStatus, "Role does not exist" ]
 65 |   CloudFormationStackSetExecutionPoliciesCreateAttach:
 66 |     # Custom, least-privilege alternative to AdministratorAccess
 67 |     !Or
 68 |       - !Equals [ !Ref AWSCloudFormationStackSetExecutionRoleStatus, "Role does not exist" ]
 69 |       - !Equals [ !Ref AWSCloudFormationStackSetExecutionRoleStatus, "Role exists, policies above not attached" ]
 70 | 
 71 | Resources:
 72 | 
 73 | 
 74 |   AWSCloudFormationStackSetExecutionRole:
 75 |     # Replaces Step 2 in
 76 |     # http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs.html#stacksets-prereqs-accountsetup
 77 |     # Adapted from
 78 |     # https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/AWSCloudFormationStackSetExecutionRole.yml
 79 |     Type: AWS::IAM::Role
 80 |     Condition: AWSCloudFormationStackSetExecutionRoleCreate
 81 |     DeletionPolicy: Retain  # For any StackSets other than TagSchedOps
 82 |     Properties:
 83 |       Path: "/"
 84 |       RoleName: "AWSCloudFormationStackSetExecutionRole"
 85 |       AssumeRolePolicyDocument:
 86 |         Version: 2012-10-17
 87 |         Statement:
 88 |           - Effect: Allow
 89 |             Principal: { "AWS": !Ref AdministratorAccountId }
 90 |             Action: "sts:AssumeRole"
 91 | 
 92 | 
 93 |   TagSchedOpsCloudFormation:
 94 |     Type: AWS::IAM::Role
 95 |     DeletionPolicy: Delete
 96 |     Properties:
 97 |       AssumeRolePolicyDocument:
 98 |         Version: 2012-10-17
 99 |         Statement:
100 |           - Effect: Allow
101 |             Principal: { "Service": "cloudformation.amazonaws.com" }
102 |             Action: "sts:AssumeRole"
103 | 
104 | 
105 |   TagSchedOpsCloudFormationRolePass:
106 |     Type: "AWS::IAM::ManagedPolicy"
107 |     DeletionPolicy: Delete
108 |     Properties:
109 |       Description: "TagSchedOpsCloudFormation role: pass to CloudFormation. (If the IAM user who will install TagSchedOps manually (as an ordinary CloudFormation stack, not a StackSet) is not an administrator, attach this policy."
110 |       PolicyDocument:
111 |         Version: "2012-10-17"
112 |         Statement:
113 |           - Effect: Allow
114 |             Action: "iam:PassRole"
115 |             Resource: !GetAtt TagSchedOpsCloudFormation.Arn
116 | 
117 | 
118 |   CloudFormationFullAccess:
119 |     Type: "AWS::IAM::ManagedPolicy"
120 |     Condition: CloudFormationStackSetExecutionPoliciesCreateAttach
121 |     DeletionPolicy: Retain  # For any StackSets other than TagSchedOps
122 |     Properties:
123 |       ManagedPolicyName: "CloudFormationFullAccess"
124 |       Description: "CloudFormation: perform any action. (Needed for the CloudFormation StackSets service role in target accounts; not currently offered as an AWS-managed policy.)"
125 |       Roles:
126 |         # If role is being created by this template: CloudFormation dependency
127 |         # If role already exists: no dependency (prevents an error)
128 |         - !If [ AWSCloudFormationStackSetExecutionRoleCreate, !Ref AWSCloudFormationStackSetExecutionRole, "AWSCloudFormationStackSetExecutionRole" ]
129 |       PolicyDocument:
130 |         Version: "2012-10-17"
131 |         Statement:
132 |           - Effect: Allow
133 |             Action: "cloudformation:*"
134 |             Resource: "*"
135 | 
136 | 
137 |   CloudFormationStackSetExecutionMisc:
138 |     Type: "AWS::IAM::ManagedPolicy"
139 |     Condition: CloudFormationStackSetExecutionPoliciesCreateAttach
140 |     DeletionPolicy: Retain  # For any StackSets other than TagSchedOps
141 |     Properties:
142 |       ManagedPolicyName: "CloudFormationStackSetExecutionMisc"
143 |       Description: "S3: read from executor-templates-* buckets. SNS: publish to StackSet-* topics. (Needed for the CloudFormation StackSets service role in target accounts.)"
144 |       Roles:
145 |         # If role is being created by this template: CloudFormation dependency
146 |         # If role already exists: no dependency (prevents an error)
147 |         - !If [ AWSCloudFormationStackSetExecutionRoleCreate, !Ref AWSCloudFormationStackSetExecutionRole, "AWSCloudFormationStackSetExecutionRole" ]
148 |       PolicyDocument:
149 |         Version: "2012-10-17"
150 |         Statement:
151 |           - Effect: Allow
152 |             Action:
153 |               - "sns:Publish"
154 |             # Requirement discovered through StackSets Console error:
155 |             #   User: arn:aws:sts::ACCOUNT1:assumed-role/
156 |             #   AWSCloudFormationStackSetExecutionRole/UUID1 is
157 |             #   not authorized to perform: SNS:Publish on resource:
158 |             #   arn:aws:sns:REGION:ACCOUNT2:StackSet-UUID2
159 |             Resource: !Sub "arn:aws:sns:*:*:StackSet-*"
160 |           - Effect: Allow
161 |             Action:
162 |               - "s3:GetObject*"
163 |             # Requirement discovered through StackSets Console error:
164 |             #   TemplateURL must reference a valid
165 |             #   S3 object to which you have access.
166 |             # Bucket name discovered through CloudTrail trail:
167 |             #   Trail settings: Apply trail to all regions
168 |             #   Data events: Select all S3 buckets in your account, Read
169 |             Resource: "arn:aws:s3:::executor-templates-*/*"
170 | 
171 | 
172 |   TagSchedOpsInstall:
173 |     Type: "AWS::IAM::ManagedPolicy"
174 |     DeletionPolicy: Delete
175 |     Properties:
176 |       Description: "TagSchedOps: create, update, delete CloudFormation stack."
177 |       Roles:
178 |         - !Ref TagSchedOpsCloudFormation
179 | 
180 |         # If role is being created by this template: CloudFormation dependency
181 |         # If role already exists: no dependency (prevents an error)
182 |         - !If [ AWSCloudFormationStackSetExecutionRoleCreate, !Ref AWSCloudFormationStackSetExecutionRole, "AWSCloudFormationStackSetExecutionRole" ]
183 |       PolicyDocument:
184 |         Version: "2012-10-17"
185 |         Statement:
186 | 
187 |             # Sufficient only for a single AWS account. For multi-
188 |             # account, the user must also attach an S3 bucket policy
189 |             # allowing access by all StackSets taget accounts. Use of
190 |             # S3 ACLs, let alone public read access, is discouraged.
191 |           - Effect: Allow
192 |             Action:
193 |               - "s3:GetObject"
194 |               - "s3:GetObjectVersion"
195 |             Resource:
196 |               - !Sub "arn:aws:s3:::${LambdaCodeS3Bucket}/*"  # single-region
197 |               - !Sub "arn:aws:s3:::${LambdaCodeS3Bucket}-*/*"  # multi-region/StackSet
198 | 
199 |           - Effect: Allow
200 |             Action:
201 |               - "lambda:CreateFunction"
202 |               - "lambda:GetFunction"
203 |               - "lambda:DeleteFunction"
204 |               - "lambda:UpdateFunctionCode"
205 |               - "lambda:GetFunctionConfiguration"
206 |               - "lambda:UpdateFunctionConfiguration"
207 |               - "lambda:AddPermission"
208 |               - "lambda:RemovePermission"
209 |             Resource:
210 |               # CloudFormation StackSets installation:
211 |               - !Sub "arn:aws:lambda:*:${AWS::AccountId}:function:StackSet-*TagSchedOps*"
212 |               # CloudFormation installation (assumed role, no StackSets):
213 |               - !Sub "arn:aws:lambda:*:${AWS::AccountId}:function:${TagSchedOpsCloudFormationStackNamePrefix}*"
214 | 
215 |           - Effect: Allow
216 |             Action:
217 |               - "lambda:CreateEventSourceMapping"
218 |               - "lambda:UpdateEventSourceMapping"
219 |               - "lambda:DeleteEventSourceMapping"
220 |             Resource: "*"
221 |             Condition:
222 |               StringLike:
223 |                 "lambda:FunctionArn":
224 |                   # CloudFormation StackSets installation:
225 |                   - !Sub "arn:aws:lambda:*:${AWS::AccountId}:function:StackSet-*TagSchedOps*"
226 |                   # CloudFormation installation (assumed role, no StackSets):
227 |                   - !Sub "arn:aws:lambda:*:${AWS::AccountId}:function:${TagSchedOpsCloudFormationStackNamePrefix}*"
228 | 
229 |           - Effect: Allow
230 |             Action:
231 |               - "logs:CreateLogGroup"
232 |               - "logs:PutRetentionPolicy"
233 |               - "logs:DeleteRetentionPolicy"
234 |             Resource:
235 |               # CloudFormation StackSets installation:
236 |               - !Sub "arn:aws:logs:*:${AWS::AccountId}:log-group:/aws/lambda/StackSet-*TagSchedOps*"
237 |               # CloudFormation installation (assumed role, no StackSets):
238 |               - !Sub "arn:aws:logs:*:${AWS::AccountId}:log-group:/aws/lambda/${TagSchedOpsCloudFormationStackNamePrefix}*"
239 | 
240 |           - Effect: Allow
241 |             Action:
242 |               - "logs:DescribeLogGroups"
243 |             Resource: "*"
244 | 
245 |           - Effect: Allow
246 |             Action:
247 |               - "events:PutRule"
248 |               - "events:DescribeRule"
249 |               - "events:EnableRule"
250 |               - "events:DisableRule"
251 |               - "events:DeleteRule"
252 |               - "events:PutTargets"
253 |               - "events:ListTargetsByRule"
254 |               - "events:RemoveTargets"
255 |             Resource:
256 |               # CloudFormation StackSets installation:
257 |               - !Sub "arn:aws:events:*:${AWS::AccountId}:rule/StackSet-*TagSchedOps*"
258 |               # CloudFormation installation (assumed role, no StackSets):
259 |               - !Sub "arn:aws:events:*:${AWS::AccountId}:rule/${TagSchedOpsCloudFormationStackNamePrefix}*"
260 | 
261 |           - Effect: Allow
262 |             Action: "iam:PassRole"
263 |             Resource:
264 |               # ARNs below MUST agree with role's CloudFormation
265 |               # logical name in cloudformation/aws_tag_sched_ops.yaml
266 |               # (NB: StackSets seems to truncate role names)
267 | 
268 |               # CloudFormation StackSets installation:
269 |               - !Sub "arn:aws:iam::${AWS::AccountId}:role/StackSet-*TagSchedOps*"
270 |               # CloudFormation installation (assumed role, no StackSets):
271 |               - !Sub "arn:aws:iam::${AWS::AccountId}:role/${TagSchedOpsCloudFormationStackNamePrefix}*-TagSchedOpsPerformLambdaRole-*"
272 | 
273 |           - Effect: Allow
274 |             Action:
275 |               - "iam:CreatePolicy"
276 |               - "iam:GetPolicy"
277 |               - "iam:DeletePolicy"
278 |               - "iam:CreatePolicyVersion"
279 |               - "iam:ListPolicyVersions"
280 |               - "iam:GetPolicyVersion"
281 |               - "iam:DeletePolicyVersion"
282 |             Resource:
283 |               # CloudFormation StackSets installation:
284 |               - !Sub "arn:aws:iam::${AWS::AccountId}:policy/StackSet-*TagSchedOps*"
285 |               # CloudFormation installation (assumed role, no StackSets):
286 |               - !Sub "arn:aws:iam::${AWS::AccountId}:policy/${TagSchedOpsCloudFormationStackNamePrefix}*"
287 | 
288 |           - Effect: Allow
289 |             Action:
290 |               - "iam:CreateRole"
291 |               - "iam:GetRole"
292 |               - "iam:DeleteRole"
293 |               - "iam:UpdateAssumeRolePolicy"
294 |               - "iam:ListRolePolicies"
295 |               - "iam:GetRolePolicy"
296 |               - "iam:AttachRolePolicy"
297 |               - "iam:DetachRolePolicy"
298 |               - "iam:ListEntitiesForPolicy"
299 |               # - "iam:PutRolePolicy"
300 |               # - "iam:DeleteRolePolicy"
301 |             Resource:
302 |               # CloudFormation StackSets installation:
303 |               - !Sub "arn:aws:iam::${AWS::AccountId}:role/StackSet-*TagSchedOps*"
304 |               - !Sub "arn:aws:iam::${AWS::AccountId}:policy/StackSet-*TagSchedOps*"
305 |               # CloudFormation installation (assumed role, no StackSets):
306 |               - !Sub "arn:aws:iam::${AWS::AccountId}:role/${TagSchedOpsCloudFormationStackNamePrefix}*"
307 |               - !Sub "arn:aws:iam::${AWS::AccountId}:policy/${TagSchedOpsCloudFormationStackNamePrefix}*"
308 | 
309 |           - Effect: Allow
310 |             Action:
311 |               - "iam:ListAttachedRolePolicies"
312 |             Resource: "*"
313 | 


--------------------------------------------------------------------------------
/pylintrc:
--------------------------------------------------------------------------------
 1 | # https://github.com/sqlxpert/aws-tag-sched-ops/
 2 | #
 3 | # Copyright 2017, Paul Marcelin
 4 | #
 5 | # This file is part of TagSchedOps.
 6 | #
 7 | # TagSchedOps is free software: you can redistribute it and/or modify
 8 | # it under the terms of the GNU General Public License as published by
 9 | # the Free Software Foundation, either version 3 of the License, or
10 | # (at your option) any later version.
11 | #
12 | # TagSchedOps is distributed in the hope that it will be useful,
13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 | # GNU General Public License for more details.
16 | #
17 | # You should have received a copy of the GNU General Public License
18 | # along with TagSchedOps. If not, see http://www.gnu.org/licenses/
19 | 
20 | [MESSAGES CONTROL]
21 | 
22 | disable=bad-continuation,fixme,locally-disabled
23 | 
24 | [REPORTS]
25 | 
26 | reports=no
27 | 
28 | [VARIABLES]
29 | 
30 | max-locals=25
31 | 
32 | [BASIC]
33 | 
34 | argument-rgx=[a-z_][a-z0-9_]{1,30}$
35 | variable-rgx=[a-z_][a-z0-9_]{1,30}$
36 | 
37 | [FORMAT]
38 | 
39 | indent-string="  "
40 | indent-after-paren=2
41 | max-line-length=80
42 | 


--------------------------------------------------------------------------------
/readme.md:
--------------------------------------------------------------------------------
 1 | # Start, Reboot, Stop and Back Up AWS Resources with Tags
 2 | 
 3 | ## RETIREMENT NOTICE
 4 | 
 5 | Thank you for your interest and support since 2017! The TagSchedOps project was retired on
 6 | September 24, 2022.
 7 | 
 8 | Please enjoy the successor, Lights Off AWS,
 9 | [https://github.com/sqlxpert/lights-off-aws](https://github.com/sqlxpert/lights-off-aws)&nbsp;,
10 | which features:
11 | 
12 | * More scheduled operations to help you cut AWS costs:
13 |   * Hibernate EC2 instances
14 |   * Start, stop, reboot and back up RDS database _clusters_ (Aurora)
15 |   * Change a CloudFormation stack parameter, to create or delete expensive resources
16 |  
17 | * Parallelism and scalability, thanks to an SQS queue and a separate AWS Lambda function
18 |   to "do" scheduled operations
19 | 
20 | * Easier multi-region, multi-account deployment, with "service-managed" CloudFormation
21 |   StackSet permissions
22 | 
23 | * Shorter Python code, IAM policies, CloudFormation templates, and documentation
24 | 
25 | * An object-oriented Python 3 design
26 | 
27 | ## Licensing
28 | 
29 | The project's licenses remain in force.
30 | 
31 | |Scope|License|Copy Included|
32 | |--|--|--|
33 | |Source code files|[GNU General Public License (GPL) 3.0](http://www.gnu.org/licenses/gpl-3.0.html)|[zlicense-code.txt](https://github.com/sqlxpert/aws-tag-sched-ops/raw/master/zlicense-code.txt)|
34 | |Source code within documentation files|[GNU General Public License (GPL) 3.0](http://www.gnu.org/licenses/gpl-3.0.html)|[zlicense-code.txt](https://github.com/sqlxpert/aws-tag-sched-ops/raw/master/zlicense-code.txt)|
35 | |Documentation files (including this readme file)|[GNU Free Documentation License (FDL) 1.3](http://www.gnu.org/licenses/fdl-1.3.html)|[zlicense-doc.txt](https://github.com/sqlxpert/aws-tag-sched-ops/raw/master/zlicense-doc.txt)|
36 | 
37 | Copyright Paul Marcelin
38 | 
39 | Contact: `marcelin` at `cmu.edu` (replace at with `@`)
40 | 


--------------------------------------------------------------------------------
/requirements.txt:
--------------------------------------------------------------------------------
 1 | # Suggested setup steps:
 2 | #
 3 | #   python3 -m venv VIRTUALENV_PATH
 4 | #   source VIRTUALENV_PATH/bin/activate
 5 | #   pip3 install --upgrade --requirement requirements.txt
 6 | #
 7 | # where VIRTUALENV_PATH is the path to your new Python 3 virtual environment
 8 | 
 9 | 
10 | # https://github.com/sqlxpert/aws-tag-sched-ops/
11 | #
12 | # Copyright 2017, Paul Marcelin
13 | #
14 | # This file is part of TagSchedOps.
15 | #
16 | # TagSchedOps is free software: you can redistribute it and/or modify
17 | # it under the terms of the GNU General Public License as published by
18 | # the Free Software Foundation, either version 3 of the License, or
19 | # (at your option) any later version.
20 | #
21 | # TagSchedOps is distributed in the hope that it will be useful,
22 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
23 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 | # GNU General Public License for more details.
25 | #
26 | # You should have received a copy of the GNU General Public License
27 | # along with TagSchedOps. If not, see http://www.gnu.org/licenses/
28 | 
29 | 
30 | # Necessary for operation:
31 | boto3
32 | botocore
33 | 
34 | # Useful for AWS administration:
35 | awscli
36 | 
37 | # Necessary for development:
38 | pylint
39 | pycodestyle
40 | yamllint
41 | 


--------------------------------------------------------------------------------
/setup.cfg:
--------------------------------------------------------------------------------
 1 | # https://github.com/sqlxpert/aws-tag-sched-ops/
 2 | #
 3 | # Copyright 2017, Paul Marcelin
 4 | #
 5 | # This file is part of TagSchedOps.
 6 | #
 7 | # TagSchedOps is free software: you can redistribute it and/or modify
 8 | # it under the terms of the GNU General Public License as published by
 9 | # the Free Software Foundation, either version 3 of the License, or
10 | # (at your option) any later version.
11 | #
12 | # TagSchedOps is distributed in the hope that it will be useful,
13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 | # GNU General Public License for more details.
16 | #
17 | # You should have received a copy of the GNU General Public License
18 | # along with TagSchedOps. If not, see http://www.gnu.org/licenses/
19 | 
20 | [pycodestyle]
21 | ignore = E111, E121, E114, E501, W503
22 | # E501: Let pylint, which allows temporary, inline disabling, check line length
23 | # max-line-length = 80
24 | 


--------------------------------------------------------------------------------
/zlicense-code.txt:
--------------------------------------------------------------------------------
  1 | GNU GENERAL PUBLIC LICENSE
  2 | 
  3 | Version 3, 29 June 2007
  4 | 
  5 | Copyright © 2007 Free Software Foundation, Inc. <http://fsf.org/>
  6 | 
  7 | Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
  8 | 
  9 | Preamble
 10 | 
 11 | The GNU General Public License is a free, copyleft license for software and other kinds of works.
 12 | 
 13 | The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too.
 14 | 
 15 | When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
 16 | 
 17 | To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others.
 18 | 
 19 | For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.
 20 | 
 21 | Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it.
 22 | 
 23 | For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions.
 24 | 
 25 | Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users.
 26 | 
 27 | Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free.
 28 | 
 29 | The precise terms and conditions for copying, distribution and modification follow.
 30 | 
 31 | TERMS AND CONDITIONS
 32 | 
 33 | 0. Definitions.
 34 | 
 35 | “This License” refers to version 3 of the GNU General Public License.
 36 | 
 37 | “Copyright” also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
 38 | 
 39 | “The Program” refers to any copyrightable work licensed under this License. Each licensee is addressed as “you”. “Licensees” and “recipients” may be individuals or organizations.
 40 | 
 41 | To “modify” a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a “modified version” of the earlier work or a work “based on” the earlier work.
 42 | 
 43 | A “covered work” means either the unmodified Program or a work based on the Program.
 44 | 
 45 | To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
 46 | 
 47 | To “convey” a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
 48 | 
 49 | An interactive user interface displays “Appropriate Legal Notices” to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
 50 | 
 51 | 1. Source Code.
 52 | 
 53 | The “source code” for a work means the preferred form of the work for making modifications to it. “Object code” means any non-source form of a work.
 54 | 
 55 | A “Standard Interface” means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
 56 | 
 57 | The “System Libraries” of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A “Major Component”, in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
 58 | 
 59 | The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.
 60 | 
 61 | The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
 62 | 
 63 | The Corresponding Source for a work in source code form is that same work.
 64 | 
 65 | 2. Basic Permissions.
 66 | 
 67 | All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
 68 | 
 69 | You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
 70 | 
 71 | Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
 72 | 
 73 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
 74 | 
 75 | No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
 76 | 
 77 | When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
 78 | 
 79 | 4. Conveying Verbatim Copies.
 80 | 
 81 | You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
 82 | 
 83 | You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
 84 | 
 85 | 5. Conveying Modified Source Versions.
 86 | 
 87 | You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
 88 | 
 89 | a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
 90 | b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to “keep intact all notices”.
 91 | c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
 92 | d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
 93 | A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
 94 | 
 95 | 6. Conveying Non-Source Forms.
 96 | 
 97 | You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
 98 | 
 99 | a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
100 | b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
101 | c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
102 | d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
103 | e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
104 | A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
105 | 
106 | A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, “normally used” refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
107 | 
108 | “Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
109 | 
110 | If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
111 | 
112 | The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
113 | 
114 | Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
115 | 
116 | 7. Additional Terms.
117 | 
118 | “Additional permissions” are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
119 | 
120 | When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
121 | 
122 | Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
123 | 
124 | a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
125 | b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
126 | c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
127 | d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
128 | e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
129 | f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
130 | All other non-permissive additional terms are considered “further restrictions” within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
131 | 
132 | If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
133 | 
134 | Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
135 | 
136 | 8. Termination.
137 | 
138 | You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
139 | 
140 | However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
141 | 
142 | Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
143 | 
144 | Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
145 | 
146 | 9. Acceptance Not Required for Having Copies.
147 | 
148 | You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
149 | 
150 | 10. Automatic Licensing of Downstream Recipients.
151 | 
152 | Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
153 | 
154 | An “entity transaction” is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
155 | 
156 | You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
157 | 
158 | 11. Patents.
159 | 
160 | A “contributor” is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's “contributor version”.
161 | 
162 | A contributor's “essential patent claims” are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, “control” includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
163 | 
164 | Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
165 | 
166 | In the following three paragraphs, a “patent license” is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To “grant” such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
167 | 
168 | If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. “Knowingly relying” means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
169 | 
170 | If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
171 | 
172 | A patent license is “discriminatory” if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
173 | 
174 | Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
175 | 
176 | 12. No Surrender of Others' Freedom.
177 | 
178 | If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
179 | 
180 | 13. Use with the GNU Affero General Public License.
181 | 
182 | Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such.
183 | 
184 | 14. Revised Versions of this License.
185 | 
186 | The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
187 | 
188 | Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License “or any later version” applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation.
189 | 
190 | If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
191 | 
192 | Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
193 | 
194 | 15. Disclaimer of Warranty.
195 | 
196 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
197 | 
198 | 16. Limitation of Liability.
199 | 
200 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
201 | 
202 | 17. Interpretation of Sections 15 and 16.
203 | 
204 | If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
205 | 
206 | END OF TERMS AND CONDITIONS
207 | 


--------------------------------------------------------------------------------
/zlicense-doc.txt:
--------------------------------------------------------------------------------
  1 | GNU Free Documentation License
  2 | 
  3 | Version 1.3, 3 November 2008
  4 | 
  5 | Copyright © 2000, 2001, 2002, 2007, 2008 Free Software Foundation, Inc. <http://fsf.org/>
  6 | 
  7 | Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
  8 | 
  9 | 0. PREAMBLE
 10 | 
 11 | The purpose of this License is to make a manual, textbook, or other functional and useful document "free" in the sense of freedom: to assure everyone the effective freedom to copy and redistribute it, with or without modifying it, either commercially or noncommercially. Secondarily, this License preserves for the author and publisher a way to get credit for their work, while not being considered responsible for modifications made by others.
 12 | 
 13 | This License is a kind of "copyleft", which means that derivative works of the document must themselves be free in the same sense. It complements the GNU General Public License, which is a copyleft license designed for free software.
 14 | 
 15 | We have designed this License in order to use it for manuals for free software, because free software needs free documentation: a free program should come with manuals providing the same freedoms that the software does. But this License is not limited to software manuals; it can be used for any textual work, regardless of subject matter or whether it is published as a printed book. We recommend this License principally for works whose purpose is instruction or reference.
 16 | 
 17 | 1. APPLICABILITY AND DEFINITIONS
 18 | 
 19 | This License applies to any manual or other work, in any medium, that contains a notice placed by the copyright holder saying it can be distributed under the terms of this License. Such a notice grants a world-wide, royalty-free license, unlimited in duration, to use that work under the conditions stated herein. The "Document", below, refers to any such manual or work. Any member of the public is a licensee, and is addressed as "you". You accept the license if you copy, modify or distribute the work in a way requiring permission under copyright law.
 20 | 
 21 | A "Modified Version" of the Document means any work containing the Document or a portion of it, either copied verbatim, or with modifications and/or translated into another language.
 22 | 
 23 | A "Secondary Section" is a named appendix or a front-matter section of the Document that deals exclusively with the relationship of the publishers or authors of the Document to the Document's overall subject (or to related matters) and contains nothing that could fall directly within that overall subject. (Thus, if the Document is in part a textbook of mathematics, a Secondary Section may not explain any mathematics.) The relationship could be a matter of historical connection with the subject or with related matters, or of legal, commercial, philosophical, ethical or political position regarding them.
 24 | 
 25 | The "Invariant Sections" are certain Secondary Sections whose titles are designated, as being those of Invariant Sections, in the notice that says that the Document is released under this License. If a section does not fit the above definition of Secondary then it is not allowed to be designated as Invariant. The Document may contain zero Invariant Sections. If the Document does not identify any Invariant Sections then there are none.
 26 | 
 27 | The "Cover Texts" are certain short passages of text that are listed, as Front-Cover Texts or Back-Cover Texts, in the notice that says that the Document is released under this License. A Front-Cover Text may be at most 5 words, and a Back-Cover Text may be at most 25 words.
 28 | 
 29 | A "Transparent" copy of the Document means a machine-readable copy, represented in a format whose specification is available to the general public, that is suitable for revising the document straightforwardly with generic text editors or (for images composed of pixels) generic paint programs or (for drawings) some widely available drawing editor, and that is suitable for input to text formatters or for automatic translation to a variety of formats suitable for input to text formatters. A copy made in an otherwise Transparent file format whose markup, or absence of markup, has been arranged to thwart or discourage subsequent modification by readers is not Transparent. An image format is not Transparent if used for any substantial amount of text. A copy that is not "Transparent" is called "Opaque".
 30 | 
 31 | Examples of suitable formats for Transparent copies include plain ASCII without markup, Texinfo input format, LaTeX input format, SGML or XML using a publicly available DTD, and standard-conforming simple HTML, PostScript or PDF designed for human modification. Examples of transparent image formats include PNG, XCF and JPG. Opaque formats include proprietary formats that can be read and edited only by proprietary word processors, SGML or XML for which the DTD and/or processing tools are not generally available, and the machine-generated HTML, PostScript or PDF produced by some word processors for output purposes only.
 32 | 
 33 | The "Title Page" means, for a printed book, the title page itself, plus such following pages as are needed to hold, legibly, the material this License requires to appear in the title page. For works in formats which do not have any title page as such, "Title Page" means the text near the most prominent appearance of the work's title, preceding the beginning of the body of the text.
 34 | 
 35 | The "publisher" means any person or entity that distributes copies of the Document to the public.
 36 | 
 37 | A section "Entitled XYZ" means a named subunit of the Document whose title either is precisely XYZ or contains XYZ in parentheses following text that translates XYZ in another language. (Here XYZ stands for a specific section name mentioned below, such as "Acknowledgements", "Dedications", "Endorsements", or "History".) To "Preserve the Title" of such a section when you modify the Document means that it remains a section "Entitled XYZ" according to this definition.
 38 | 
 39 | The Document may include Warranty Disclaimers next to the notice which states that this License applies to the Document. These Warranty Disclaimers are considered to be included by reference in this License, but only as regards disclaiming warranties: any other implication that these Warranty Disclaimers may have is void and has no effect on the meaning of this License.
 40 | 
 41 | 2. VERBATIM COPYING
 42 | 
 43 | You may copy and distribute the Document in any medium, either commercially or noncommercially, provided that this License, the copyright notices, and the license notice saying this License applies to the Document are reproduced in all copies, and that you add no other conditions whatsoever to those of this License. You may not use technical measures to obstruct or control the reading or further copying of the copies you make or distribute. However, you may accept compensation in exchange for copies. If you distribute a large enough number of copies you must also follow the conditions in section 3.
 44 | 
 45 | You may also lend copies, under the same conditions stated above, and you may publicly display copies.
 46 | 
 47 | 3. COPYING IN QUANTITY
 48 | 
 49 | If you publish printed copies (or copies in media that commonly have printed covers) of the Document, numbering more than 100, and the Document's license notice requires Cover Texts, you must enclose the copies in covers that carry, clearly and legibly, all these Cover Texts: Front-Cover Texts on the front cover, and Back-Cover Texts on the back cover. Both covers must also clearly and legibly identify you as the publisher of these copies. The front cover must present the full title with all words of the title equally prominent and visible. You may add other material on the covers in addition. Copying with changes limited to the covers, as long as they preserve the title of the Document and satisfy these conditions, can be treated as verbatim copying in other respects.
 50 | 
 51 | If the required texts for either cover are too voluminous to fit legibly, you should put the first ones listed (as many as fit reasonably) on the actual cover, and continue the rest onto adjacent pages.
 52 | 
 53 | If you publish or distribute Opaque copies of the Document numbering more than 100, you must either include a machine-readable Transparent copy along with each Opaque copy, or state in or with each Opaque copy a computer-network location from which the general network-using public has access to download using public-standard network protocols a complete Transparent copy of the Document, free of added material. If you use the latter option, you must take reasonably prudent steps, when you begin distribution of Opaque copies in quantity, to ensure that this Transparent copy will remain thus accessible at the stated location until at least one year after the last time you distribute an Opaque copy (directly or through your agents or retailers) of that edition to the public.
 54 | 
 55 | It is requested, but not required, that you contact the authors of the Document well before redistributing any large number of copies, to give them a chance to provide you with an updated version of the Document.
 56 | 
 57 | 4. MODIFICATIONS
 58 | 
 59 | You may copy and distribute a Modified Version of the Document under the conditions of sections 2 and 3 above, provided that you release the Modified Version under precisely this License, with the Modified Version filling the role of the Document, thus licensing distribution and modification of the Modified Version to whoever possesses a copy of it. In addition, you must do these things in the Modified Version:
 60 | 
 61 | A. Use in the Title Page (and on the covers, if any) a title distinct from that of the Document, and from those of previous versions (which should, if there were any, be listed in the History section of the Document). You may use the same title as a previous version if the original publisher of that version gives permission.
 62 | B. List on the Title Page, as authors, one or more persons or entities responsible for authorship of the modifications in the Modified Version, together with at least five of the principal authors of the Document (all of its principal authors, if it has fewer than five), unless they release you from this requirement.
 63 | C. State on the Title page the name of the publisher of the Modified Version, as the publisher.
 64 | D. Preserve all the copyright notices of the Document.
 65 | E. Add an appropriate copyright notice for your modifications adjacent to the other copyright notices.
 66 | F. Include, immediately after the copyright notices, a license notice giving the public permission to use the Modified Version under the terms of this License, in the form shown in the Addendum below.
 67 | G. Preserve in that license notice the full lists of Invariant Sections and required Cover Texts given in the Document's license notice.
 68 | H. Include an unaltered copy of this License.
 69 | I. Preserve the section Entitled "History", Preserve its Title, and add to it an item stating at least the title, year, new authors, and publisher of the Modified Version as given on the Title Page. If there is no section Entitled "History" in the Document, create one stating the title, year, authors, and publisher of the Document as given on its Title Page, then add an item describing the Modified Version as stated in the previous sentence.
 70 | J. Preserve the network location, if any, given in the Document for public access to a Transparent copy of the Document, and likewise the network locations given in the Document for previous versions it was based on. These may be placed in the "History" section. You may omit a network location for a work that was published at least four years before the Document itself, or if the original publisher of the version it refers to gives permission.
 71 | K. For any section Entitled "Acknowledgements" or "Dedications", Preserve the Title of the section, and preserve in the section all the substance and tone of each of the contributor acknowledgements and/or dedications given therein.
 72 | L. Preserve all the Invariant Sections of the Document, unaltered in their text and in their titles. Section numbers or the equivalent are not considered part of the section titles.
 73 | M. Delete any section Entitled "Endorsements". Such a section may not be included in the Modified Version.
 74 | N. Do not retitle any existing section to be Entitled "Endorsements" or to conflict in title with any Invariant Section.
 75 | O. Preserve any Warranty Disclaimers.
 76 | If the Modified Version includes new front-matter sections or appendices that qualify as Secondary Sections and contain no material copied from the Document, you may at your option designate some or all of these sections as invariant. To do this, add their titles to the list of Invariant Sections in the Modified Version's license notice. These titles must be distinct from any other section titles.
 77 | 
 78 | You may add a section Entitled "Endorsements", provided it contains nothing but endorsements of your Modified Version by various parties—for example, statements of peer review or that the text has been approved by an organization as the authoritative definition of a standard.
 79 | 
 80 | You may add a passage of up to five words as a Front-Cover Text, and a passage of up to 25 words as a Back-Cover Text, to the end of the list of Cover Texts in the Modified Version. Only one passage of Front-Cover Text and one of Back-Cover Text may be added by (or through arrangements made by) any one entity. If the Document already includes a cover text for the same cover, previously added by you or by arrangement made by the same entity you are acting on behalf of, you may not add another; but you may replace the old one, on explicit permission from the previous publisher that added the old one.
 81 | 
 82 | The author(s) and publisher(s) of the Document do not by this License give permission to use their names for publicity for or to assert or imply endorsement of any Modified Version.
 83 | 
 84 | 5. COMBINING DOCUMENTS
 85 | 
 86 | You may combine the Document with other documents released under this License, under the terms defined in section 4 above for modified versions, provided that you include in the combination all of the Invariant Sections of all of the original documents, unmodified, and list them all as Invariant Sections of your combined work in its license notice, and that you preserve all their Warranty Disclaimers.
 87 | 
 88 | The combined work need only contain one copy of this License, and multiple identical Invariant Sections may be replaced with a single copy. If there are multiple Invariant Sections with the same name but different contents, make the title of each such section unique by adding at the end of it, in parentheses, the name of the original author or publisher of that section if known, or else a unique number. Make the same adjustment to the section titles in the list of Invariant Sections in the license notice of the combined work.
 89 | 
 90 | In the combination, you must combine any sections Entitled "History" in the various original documents, forming one section Entitled "History"; likewise combine any sections Entitled "Acknowledgements", and any sections Entitled "Dedications". You must delete all sections Entitled "Endorsements".
 91 | 
 92 | 6. COLLECTIONS OF DOCUMENTS
 93 | 
 94 | You may make a collection consisting of the Document and other documents released under this License, and replace the individual copies of this License in the various documents with a single copy that is included in the collection, provided that you follow the rules of this License for verbatim copying of each of the documents in all other respects.
 95 | 
 96 | You may extract a single document from such a collection, and distribute it individually under this License, provided you insert a copy of this License into the extracted document, and follow this License in all other respects regarding verbatim copying of that document.
 97 | 
 98 | 7. AGGREGATION WITH INDEPENDENT WORKS
 99 | 
100 | A compilation of the Document or its derivatives with other separate and independent documents or works, in or on a volume of a storage or distribution medium, is called an "aggregate" if the copyright resulting from the compilation is not used to limit the legal rights of the compilation's users beyond what the individual works permit. When the Document is included in an aggregate, this License does not apply to the other works in the aggregate which are not themselves derivative works of the Document.
101 | 
102 | If the Cover Text requirement of section 3 is applicable to these copies of the Document, then if the Document is less than one half of the entire aggregate, the Document's Cover Texts may be placed on covers that bracket the Document within the aggregate, or the electronic equivalent of covers if the Document is in electronic form. Otherwise they must appear on printed covers that bracket the whole aggregate.
103 | 
104 | 8. TRANSLATION
105 | 
106 | Translation is considered a kind of modification, so you may distribute translations of the Document under the terms of section 4. Replacing Invariant Sections with translations requires special permission from their copyright holders, but you may include translations of some or all Invariant Sections in addition to the original versions of these Invariant Sections. You may include a translation of this License, and all the license notices in the Document, and any Warranty Disclaimers, provided that you also include the original English version of this License and the original versions of those notices and disclaimers. In case of a disagreement between the translation and the original version of this License or a notice or disclaimer, the original version will prevail.
107 | 
108 | If a section in the Document is Entitled "Acknowledgements", "Dedications", or "History", the requirement (section 4) to Preserve its Title (section 1) will typically require changing the actual title.
109 | 
110 | 9. TERMINATION
111 | 
112 | You may not copy, modify, sublicense, or distribute the Document except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, or distribute it is void, and will automatically terminate your rights under this License.
113 | 
114 | However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
115 | 
116 | Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
117 | 
118 | Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, receipt of a copy of some or all of the same material does not give you any rights to use it.
119 | 
120 | 10. FUTURE REVISIONS OF THIS LICENSE
121 | 
122 | The Free Software Foundation may publish new, revised versions of the GNU Free Documentation License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. See http://www.gnu.org/copyleft/.
123 | 
124 | Each version of the License is given a distinguishing version number. If the Document specifies that a particular numbered version of this License "or any later version" applies to it, you have the option of following the terms and conditions either of that specified version or of any later version that has been published (not as a draft) by the Free Software Foundation. If the Document does not specify a version number of this License, you may choose any version ever published (not as a draft) by the Free Software Foundation. If the Document specifies that a proxy can decide which future versions of this License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Document.
125 | 
126 | 11. RELICENSING
127 | 
128 | "Massive Multiauthor Collaboration Site" (or "MMC Site") means any World Wide Web server that publishes copyrightable works and also provides prominent facilities for anybody to edit those works. A public wiki that anybody can edit is an example of such a server. A "Massive Multiauthor Collaboration" (or "MMC") contained in the site means any set of copyrightable works thus published on the MMC site.
129 | 
130 | "CC-BY-SA" means the Creative Commons Attribution-Share Alike 3.0 license published by Creative Commons Corporation, a not-for-profit corporation with a principal place of business in San Francisco, California, as well as future copyleft versions of that license published by that same organization.
131 | 
132 | "Incorporate" means to publish or republish a Document, in whole or in part, as part of another Document.
133 | 
134 | An MMC is "eligible for relicensing" if it is licensed under this License, and if all works that were first published under this License somewhere other than this MMC, and subsequently incorporated in whole or in part into the MMC, (1) had no cover texts or invariant sections, and (2) were thus incorporated prior to November 1, 2008.
135 | 
136 | The operator of an MMC Site may republish an MMC contained in the site under CC-BY-SA on the same site at any time before August 1, 2009, provided the MMC is eligible for relicensing.
137 | 
138 | ADDENDUM: How to use this License for your documents
139 | 
140 | To use this License in a document you have written, include a copy of the License in the document and put the following copyright and license notices just after the title page:
141 | 
142 |     Copyright (C)  YEAR  YOUR NAME.
143 |     Permission is granted to copy, distribute and/or modify this document
144 |     under the terms of the GNU Free Documentation License, Version 1.3
145 |     or any later version published by the Free Software Foundation;
146 |     with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
147 |     A copy of the license is included in the section entitled "GNU
148 |     Free Documentation License".
149 | If you have Invariant Sections, Front-Cover Texts and Back-Cover Texts, replace the "with … Texts." line with this:
150 | 
151 |     with the Invariant Sections being LIST THEIR TITLES, with the
152 |     Front-Cover Texts being LIST, and with the Back-Cover Texts being LIST.
153 | If you have Invariant Sections without Cover Texts, or some other combination of the three, merge those two alternatives to suit the situation.
154 | 
155 | If your document contains nontrivial examples of program code, we recommend releasing these examples in parallel under your choice of free software license, such as the GNU General Public License, to permit their use in free software.
156 | 


--------------------------------------------------------------------------------