
    VhF                        d dl Z 	 d dlZd dlmZ ddlmZ ddlmZ ddlmZ ddl	m
Z
 ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ  G d de      Z G d de
      Zej5                  d       ej6                         d               Zej5                  d       ej6                         d               Zej5                  d       ej6                         d               Z ej6                         d        Z ej6                         d        Z  ej6                         d        Z!ejE                  dg        ej6                         d               Z#ejE                  d g        ej6                         d!               Z$ejE                  d"g        ej6                         dnd#              Z%ejM                  d$       ej6                         d%               Z'e'Z(ejE                  d&g        ej6                         d'               Z)ejE                  d(g        ej6                         dnd)              Z*ejE                  d*g        ej6                         dnd+              Z+ejE                  d,       ej6                         d-               Z,ejE                  d.       ej6                         d/               Z-ejE                  d0g        ej6                         d1               Z.ejE                  d2       ej6                         dod3              Z/ejE                  d4       ej6                         d5               Z0d6 Z1d7 Z2ejM                  d8       ej6                         d9               Z3ejM                  d:       ej6                         d;               Z4ejM                  d<       ej6                         d=               Z5d> Z6d? Z7d@ Z8ejM                  dA       ej6                         dB               Z9ej5                  dC       ej6                         dD               Z:ejM                  dE       ej6                         dF               Z;ej5                  dG       ej6                         dH               Z<ejE                  dIg       dpdJ       Z=ejM                  dK       ej6                         dL               Z>ejM                  dM       ej6                         dN               Z?ejM                  dO       ej6                         dP               Z@ejM                  dQ       ej6                         dR               ZAdndSZBdndTZCdqdUZDdVedWefdXZEdYedWefdZZFd[edWefd\ZGd]edWefd^ZHd_edWefd`ZIdaedWefdbZJdcedWefddZKdeedWefdfZLdrdgedheMdWefdiZNdjedWefdkZOdledWefdmZPy# e$ r Y w xY w)s    N)	to_native   )parse_aws_arnvalidate_aws_arnis_boto3_error_code)AWSErrorHandler)AnsibleAWSError)AWSRetry)ansible_dict_to_boto3_tag_list)AnsibleAWSResource)AnsibleAWSResourceList)BotoResource)BotoResourceList#boto3_resource_list_to_ansible_dictboto3_resource_to_ansible_dictc                       e Zd Zy)AnsibleIAMErrorN)__name__
__module____qualname__     g/home/dcms/DCMS/lib/python3.12/site-packages/ansible_collections/amazon/aws/plugins/module_utils/iam.pyr   r      s    r   r   c                        e Zd ZeZed        Zy)IAMErrorHandlerc                     t        d      S )NNoSuchEntityr   )clss    r   _is_missingzIAMErrorHandler._is_missing%   s    ">22r   N)r   r   r   r   _CUSTOM_EXCEPTIONclassmethodr#   r   r   r   r   r   "   s    '3 3r   r   zdetach group policyc                 *    | j                  ||       y)N)	PolicyArn	GroupNameT)detach_group_policy)clientarngroups      r   detach_iam_group_policyr-   *   s     >r   zdetach role policyc                 *    | j                  ||       y)N)r'   RoleNameT)detach_role_policy)r*   r+   roles      r   detach_iam_role_policyr2   1        d;r   zdetach user policyc                 *    | j                  ||       y)N)r'   UserNameT)detach_user_policy)r*   r+   users      r   detach_iam_user_policyr8   8   r3   r   c                 ,     | j                   di |d   S )NInstanceProfiler   )get_instance_profile)r*   kwargss     r   _get_iam_instance_profilesr=   ?   s    &6&&001BCCr   c                 j    | j                  d      } |j                  di |j                         d   S )Nlist_instance_profilesInstanceProfilesr   get_paginatorpaginatebuild_full_resultr*   r<   	paginators      r   _list_iam_instance_profilesrG   D   s8    $$%=>I9''99;<NOOr   c                 j    | j                  d      } |j                  di |j                         d   S )Nlist_instance_profiles_for_roler@   r   rA   rE   s      r   $_list_iam_instance_profiles_for_rolerJ   J   s8    $$%FGI9''99;<NOOr   zlist policies for rolec                 j    | j                  d      }|j                  |      j                         d   S )Nlist_role_policiesr/   PolicyNamesrA   r*   	role_namerF   s      r   list_iam_role_policiesrQ   P   s7     $$%9:Iy1CCEmTTr   zlist policies attached to rolec                 j    | j                  d      }|j                  |      j                         d   S )Nlist_attached_role_policiesrM   AttachedPoliciesrA   rO   s      r   list_iam_role_attached_policiesrU   W   s8     $$%BCIy1CCEFXYYr   z
list usersc                 z    i }|d|i}| j                  d      } |j                  di |j                         d   S )N
PathPrefix
list_usersUsersr   rA   r*   pathargsrF   s       r   list_iam_usersr]   ^   sM     Dd#$$\2I9%%779'BBr   zlist all managed policiesc                 j    | j                  d      } |j                  di |j                         d   S )Nlist_policiesPoliciesr   rA   rE   s      r   list_iam_managed_policiesra   h   s8     $$_5I9''99;JGGr   zlist entities for policyc                 d    | j                  d      }|j                  |      j                         S )Nlist_entities_for_policyr'   rA   )r*   r+   rF   s      r   list_iam_entities_for_policyre   r   s2     $$%?@I,>>@@r   z
list rolesc                 |    i }|r||d<   | j                  d      } |j                  di |j                         d   S )NrW   
list_rolesRolesr   rA   rZ   s       r   list_iam_rolesri   y   sJ     D!\$$\2I9%%779'BBr   zlist mfa devicesc                 |    i }|r||d<   | j                  d      } |j                  di |j                         d   S )Nr5   list_mfa_devices
MFADevicesr   rA   )r*   r7   r\   rF   s       r   list_iam_mfa_devicesrm      sK     DZ$$%78I9%%779,GGr   zget rolec                 ,    | j                  |      d   S )NrM   Role)get_roler*   names     r   get_iam_rolers      s     ??D?)&11r   z	get groupc                 d    | j                  d      }|j                  |      j                         S )N	get_group)r(   rA   )r*   rr   rF   s      r   get_iam_grouprv      s1     $$[1I-??AAr   zget access keys for userc                 \    | j                  |      }t        |j                  dg             S )Nr5   AccessKeyMetadata)list_access_keysnormalize_iam_access_keysgetr*   r7   resultss      r   get_iam_access_keysr      s.     %%t%4G$W[[1Db%IJJr   zget userc                     | j                  |      }|rt        |j                  dg             S |j                  dg       S )Nrx   User)get_usernormalize_iam_userr|   )r*   r7   	normalizer~   s       r   get_iam_userr      s>     ooto,G!'++fb"9::;;vr""r   zget user tagsc                 J    | j                  |      }|j                  dg       S )Nrx   Tags)list_user_tagsr|   r}   s      r   list_iam_user_tagsr      s(     ##T#2G;;vr""r   c                 @    t        |       }|D ]  }|d   |k(  s|c S  y )N
PolicyName)ra   )r*   rr   policiespolicys       r   find_iam_managed_policy_by_namer      s2    (0H ,4'M r   c                 >    t        | |      }|y t        | |d         S )NArn)r   get_iam_managed_policy_by_arn)r*   rr   r   s      r   get_iam_managed_policy_by_namer      s'    ,VT:F~(??r   z
get policyc                 0    | j                  |      d   }|S )Nrd   Policy)
get_policy)r*   r+   r   s      r   r   r      s!     -h7FMr   zlist policy versionsc                 ,    | j                  |      d   S )Nrd   Versions)list_policy_versions)r*   r+   s     r    list_iam_managed_policy_versionsr      s     &&&5jAAr   zget policy versionc                 .    | j                  ||      d   S )N)r'   	VersionIdPolicyVersion)get_policy_version)r*   r+   versions      r   get_iam_managed_policy_versionr      s     $$sg$FWWr   c                    t        d |D              r|S i }t        |       }|D ]  }|d   ||d   <   |d   ||d   <    	 |D cg c]
  }|||    c}S c c}w # t        $ r}t        dt	        |      z   |      |d }~ww xY w)Nc              3   <   K   | ]  }|t        |d        y w)Niam)servicer   ).0r   s     r   	<genexpr>z7convert_managed_policy_names_to_arns.<locals>.<genexpr>   s!     
dvQWQcFE22
ds   r   r   zFailed to find policy by name:)message	exception)allra   KeyErrorr   str)r*   policy_namesallpoliciesr   r   es         r   $convert_managed_policy_names_to_arnsr      s    

d
ddK(0H 3,25MF<()%+E]F5M"3e2>U&BTF#UUU e&FQ&O[\]cddes0    A AAA A 	B$A>>Bc                     t        |       d   S )zAGiven an AnsibleAWSModule instance, get the active AWS account IDr   )get_aws_account_info)modules    r   get_aws_account_idr      s      '**r   c                 2   d}d}	 | j                  dt        j                               }|j                  d      }|j	                  d      }|j	                  d      j                  d      d	   }||| j#                  d       t        |      t        |      fS # t        j                  j                  t        j                  j                  f$ rA 	 | j                  d
t        j                               }|j                  d      d   d   j                  d      \  }}}}}}	n# t        d      $ r}
	 t        |
j                        }n# t        $ r t        |
      }Y nw xY wt        |      }||d   d
k7  r| j!                  |
d       |j	                  d      }|j	                  d      }Y d}
~
nZd}
~
wt        j                  j                  t        j                  j                  f$ r}
| j!                  |
d       Y d}
~
nd}
~
ww xY wY w xY w)a  Given an AnsibleAWSModule instance, return the account information
    (account id and partition) we are currently working on

    get_account_info tries too find out the account that we are working
    on.  It's not guaranteed that this will be easy so we try in
    several different ways.  Giving either IAM or STS privileges to
    the account should be enough to permit this.

    Tries:
    - sts:GetCallerIdentity
    - iam:GetUser
    - sts:DecodeAuthorizationMessage
    Nsts)retry_decoratorT)	aws_retryAccountr   :r   r   r   AccessDeniedr   zeFailed to get AWS account information, Try allowing sts:GetCallerIdentity or iam:GetUser permissions.)msg
account_id	partition)r*   r   jittered_backoffget_caller_identityr|   splitbotocore
exceptionsBotoCoreErrorClientErrorr   r	   r   r   AttributeErrorr   fail_json_aws	fail_json)r   r   r   
sts_client	caller_id
iam_client_arn_service_reg	_resourcer   
except_msgresults                r   r   r      s    JI]]5(:S:S:U]V
22T2B	]]9-
MM%(..s3A6	: Y.w 	 	
 j!9Y#788C --x/B/B/N/NO 	uh>W>W>YZJEOEXEXcgEXEhioEpFeCj CD)XtZ #>2 	0*&qyy1
! *&q\
*":.F~	!2e!;$$ %   L1J

;/I--++
 	   { !  		'sn   A+B 8HAD*)H*H9EF8E&#F8%E&&AF83H8:H2H
H
HHHzcreate instance profilec                 ^    t        |xs i       }|xs d}| j                  |||      }|d   S )N/)InstanceProfileNamePathr   r:   )r   create_instance_profile)r*   rr   r[   tags
boto3_tagsr   s         r   create_iam_instance_profiler   "  s?     0
;J;3D++4V`+aF#$$r   zdelete instance profilec                 (    | j                  |       y)Nr   T)delete_instance_profilerq   s     r   delete_iam_instance_profiler   +  s     ""t"<r   zadd role to instance profilec                 *    | j                  ||       yN)r   r/   T)add_role_to_instance_profiler*   profile_namerP   s      r    add_role_to_iam_instance_profiler   3  s     ''LS\']r   z!remove role from instance profilec                 *    | j                  ||       yr   )!remove_role_from_instance_profiler   s      r   %remove_role_from_iam_instance_profiler   :  s     ,,Xa,br   zlist instance profilesc                 t    |rt        | |      S |rt        | |      gS |rt        | |      S t        |       S )z
    Returns a list of IAM instance profiles in boto3 format.
    Profiles need to be converted to Ansible format using normalize_iam_instance_profile before being displayed.

    See also: normalize_iam_instance_profile
    rM   r   )rW   )rJ   r=   rG   )r*   rr   prefixr1   s       r   list_iam_instance_profilesr   B  sB     3FTJJ*6tLMM*6fEE&v..r   ztag instance profilec                 N    |sy t        |xs i       }| j                  ||       y )N)r   r   )r   tag_instance_profile)r*   rr   r   r   s       r   tag_iam_instance_profiler   T  s+     /
;J
DzJr   zuntag instance profilec                 0    |sy | j                  ||       y )N)r   TagKeys)untag_instance_profile)r*   rr   r   s      r   untag_iam_instance_profiler   ]  s     
!!dD!Ir   ztag managed policyc                 N    |sy t        |xs i       }| j                  ||       y )N)r'   r   )r   
tag_policy)r*   r+   r   r   s       r   tag_iam_policyr   e  s+     /
;J
*5r   zuntag managed policyc                 0    |sy | j                  ||       y )N)r'   r   )untag_policy)r*   r+   r   s      r   untag_iam_policyr   n  s     
#t4r   c                     |y ddd}d}|j                  | d      }t        |      |kD  rd|  d| S t        j                  ||      s|  d| S y )N@   )r1   r7   z[\w+=,.@-]+   
Length of z name may not exceed z name must match pattern )r|   lenre	fullmatch)resource_typerr   LENGTHSregex
max_lengths        r   _validate_iam_namer   v  sl    |2&GE]C0J
4y:M?*?
|LL<<t$ 9%AAr   c                     |y d}d}t        |      |kD  rd|  d| S |j                  d      r|j                  d      s|  dS t        j                  ||      s|  d| S y )Nz\/([\w+=,.@-]+\/)*i   r   z path may not exceed r   z path must begin and end with /z path must match pattern )r   endswith
startswithr   r   )r   r[   r   r   s       r   _validate_iam_pathr    s|    |!EJ
4y:M?*?
|LL==T__S%9 ?@@<<t$ 9%AAr   c                 D    t        | |      }|r|S t        | |      }|r|S y N)r   r  )r   rr   r[   name_problempath_problems        r   validate_iam_identifiersr	    s/    %mT:L%mT:Lr   devicereturnc                     t        |       S )zXConverts IAM MFA Device from the CamelCase boto3 format to the snake_case Ansible formatr   )r
  s    r   normalize_iam_mfa_devicer    s     *&11r   devicesc                     t        |       S )zcConverts a list of IAM MFA Devices from the CamelCase boto3 format to the snake_case Ansible formatr   )r  s    r   normalize_iam_mfa_devicesr    s     /w77r   r7   c                     t        |       S )zSConverts IAM users from the CamelCase boto3 format to the snake_case Ansible formatr   )r7   s    r   r   r     s    )$//r   r   c                     t        |       S )zVConverts IAM policies from the CamelCase boto3 format to the snake_case Ansible formatr   )r   s    r   normalize_iam_policyr    s    )&11r   r,   c                     t        | d      S )zTConverts IAM Groups from the CamelCase boto3 format to the snake_case Ansible formatF
force_tagsr   )r,   s    r   normalize_iam_groupr    s     *%EBBr   
access_keyc                     t        | d      S )zYConverts IAM access keys from the CamelCase boto3 format to the snake_case Ansible formatFr  r   )r  s    r   normalize_iam_access_keyr    s     **GGr   access_keysc                 @    | s| S t        | d      } t        | d       S )zcConverts a list of IAM access keys from the CamelCase boto3 format to the snake_case Ansible formatFr  c                 &    | j                  dd       S )Ncreate_date)r|   )ds    r   <lambda>z+normalize_iam_access_keys.<locals>.<lambda>  s    QUU=$-G r   )key)r   sorted)r  s    r   r{   r{     s'     5keTK+#GHHr   profilec                 0    dt         i}t        | |      }|S )zL
    Converts a boto3 format IAM instance profile into "Ansible" format
    rh   )nested_transforms)_normalize_iam_rolesr   )r#  
transformstransformed_profiles      r   normalize_iam_instance_profiler)    s#     /0J8T^_r   r1   
_v7_compatc                 n    dt         i}dg}t        | ||      }|r| j                  d      r| d   |d<   |S )z
    Converts a boto3 format IAM instance role into "Ansible" format

    _v7_compat is deprecated and will be removed in release after 2026-05-01 DO NOT USE.
    r@   AssumeRolePolicyDocument)r%  ignore_listassume_role_policy_document_raw) _normalize_iam_instance_profilesr   r|   )r1   r*  r'  r-  transformed_roles        r   normalize_iam_roler1    sN     %&FGJ-.K5djfqrdhh9:>BC]>^:;r   profilesc                 F    | s| S | D cg c]  }t        |       c}S c c}w r  )r)  )r2  ps     r   r/  r/    s$    7?@!*1-@@@   rolesc                 F    | s| S | D cg c]  }t        |       c}S c c}w r  )r1  )r6  rs     r   r&  r&    s$    +01aq!111r5  r  )T)NNN)NN)F)Qr   r   ImportErroransible.module_utils._textr   r+   r   r   r	   errorsr
   r   r   retriesr   taggingr   transformationr   r   r   r   r   r   r   r   deletion_error_handlerr   r-   r2   r8   r=   rG   rJ   list_error_handlerrQ   rU   r]   common_error_handlerra   list_managed_policiesre   ri   rm   rs   rv   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r	  r  r  r   r  r  r  r{   r)  boolr1  r/  r&  r   r   r   <module>rD     sp   
	 1  ! ) # '  3 . 2 ( , ? :	o 	3o 3 ''(=>  ?
 ''(<=  >
 ''(<=  >
 D D P P
 P P
 ##$<bAU  BU
 ##$DbIZ  JZ
 ##L"5C  6C %%&ABH  CH
 2  ##$>CA  DA
 ##L"5C  6C ##$6;H  <H ##J/2  02 ##K0B  1B
 ##$>CK  DK
 ##J/#  0# ##O4#  5#
@ %%l3  4
 %%&<=B  >B %%&:;X  <Xe+69r %%&?@%  A% ''(AB  C %%&DE  F
 ''(KL  M ##$<bA/ B/" %%&<=K  >K %%&>?J  @J %%&:;6  <6 %%&<=5  >5
2\ 26H 28'7 8<R 80\ 0.@ 0
2 22D 2
C| C0B CH H:L HI+; I@V IL =O \ t HZ A/? ADZ A2 0 25K 2u  		s   V4 4V=<V=