Vh5dZdZdZddlZddlZ ddlZddlmZddl m Z ddl m Z dZ d Zd Zd Zd Zd ZdZdZdZdZdZdZedk(reyy#e$rYKwxYw)a --- module: lambda_policy version_added: 5.0.0 short_description: Creates, updates or deletes AWS Lambda policy statements. description: - This module allows the management of AWS Lambda policy statements. - It is idempotent and supports "Check" mode. - Use module M(amazon.aws.lambda) to manage the lambda function itself, M(amazon.aws.lambda_alias) to manage function aliases, M(amazon.aws.lambda_event) to manage event source mappings such as Kinesis streams, M(community.aws.execute_lambda) to execute a lambda function and M(amazon.aws.lambda_info) to gather information relating to one or more lambda functions. - This module was originally added to C(community.aws) in release 1.0.0. author: - Pierre Jodouin (@pjodouin) - Michael De La Rue (@mikedlr) options: function_name: description: - "Name of the Lambda function whose resource policy you are updating by adding a new permission." - "You can specify a function name (for example, Thumbnail ) or you can specify Amazon Resource Name (ARN) of the" - "function (for example, V(arn:aws:lambda:us-west-2:account-id:function:ThumbNail) ). AWS Lambda also allows you to" - "specify partial ARN (for example, V(account-id:Thumbnail) ). Note that the length constraint applies only to the" - "ARN. If you specify only the function name, it is limited to 64 character in length." required: true aliases: ['lambda_function_arn', 'function_arn'] type: str state: description: - Describes the desired state. default: "present" choices: ["present", "absent"] type: str alias: description: - Name of the function alias. Mutually exclusive with O(version). type: str version: description: - Version of the Lambda function. Mutually exclusive with O(alias). type: int statement_id: description: - A unique statement identifier. required: true aliases: ['sid'] type: str action: description: - "The AWS Lambda action you want to allow in this statement. Each Lambda action is a string starting with lambda: followed by the API name (see Operations ). For example, V(lambda:CreateFunction) . You can use wildcard (V(lambda:*)) to grant permission for all AWS Lambda actions." required: true type: str principal: description: - "The principal who is getting this permission. It can be Amazon S3 service Principal (s3.amazonaws.com ) if you want Amazon S3 to invoke the function, an AWS account ID if you are granting cross-account permission, or any valid AWS service principal such as sns.amazonaws.com. For example, you might want to allow a custom application in another AWS account to push events to AWS Lambda by invoking your function." required: true type: str source_arn: description: - This is optional; however, when granting Amazon S3 permission to invoke your function, you should specify this field with the bucket Amazon Resource Name (ARN) as its value. This ensures that only events generated from the specified bucket can invoke the function. type: str source_account: description: - The AWS account ID (without a hyphen) of the source owner. For example, if O(source_arn) identifies a bucket, then this is the bucket owner's account ID. You can use this additional condition to ensure the bucket you specify is owned by a specific account (it is possible the bucket owner deleted the bucket and some other AWS account created the bucket). You can also use this condition to specify all sources (that is, you don't specify the O(source_arn)) owned by a specific account. type: str event_source_token: description: - Token string representing source ARN or account. Mutually exclusive with O(source_arn) or O(source_account). type: str extends_documentation_fragment: - amazon.aws.common.modules - amazon.aws.region.modules - amazon.aws.boto3 a - name: Lambda S3 event notification amazon.aws.lambda_policy: state: present function_name: functionName alias: Dev statement_id: lambda-s3-myBucket-create-data-log action: lambda:InvokeFunction principal: s3.amazonaws.com source_arn: arn:aws:s3:eu-central-1:123456789012:bucketName source_account: 123456789012 register: lambda_policy_action - name: show results ansible.builtin.debug: var: lambda_policy_action z --- lambda_policy_action: description: Describes what action was taken. returned: success type: str sample: "added" N) to_native)is_boto3_error_code)AnsibleAWSModulecdj|jdDcgc]}|jc}Scc}w)z Changes python key into Pascal case equivalent. For example, 'this_function_name' becomes 'ThisFunctionName'. :param key: :return: _)joinsplit capitalize)keytokens l/home/dcms/DCMS/lib/python3.12/site-packages/ansible_collections/amazon/aws/plugins/modules/lambda_policy.pypcrs2 77CIIcNC5E$$&C DDCs=cpdD]1}|jj||j|k7s1yy)N)action principal source_arnsource_accountevent_source_tokenFT)paramsget)modulecurrent_statementparams r policy_equalrs<^ ==  U #'8'<'{5KN5[\o5p !12 9B;9OP^9_-: !56  76 -              sW A- A<B  BB)- A98A9< BB BB B&%B&) B76B7c|jd}t|d}t|}|r|j|d} |jd i|}tj|jdd }t||S#t d$ricYSt jjt jjf$r}|j|dYd}~d}~wwxYw) zChecks that policy exists and if so, that statement ID is present or absent. :param module: :param client: :return: statement_id)r$ QualifierNResourceNotFoundExceptionzretrieving function policyr%Policyz{})rr"r2update get_policyrbotocore exceptions ClientError BotoCoreError fail_json_awsjsonloadsrrB)rclientr?r qualifierpolicy_resultser>s rget_policy_statementrWs -- 'C (:;Jf%II.NB***8Z8ZZ**8T: ;F VS )) : ; '')) B Q$@AA BsBC&6C& C!!C&cTd}d}t||}t|}|r|j||js |jdi|d}|S#t j jt j jf$r}|j|dYd}~Sd}~wwxYw) ze Adds a permission statement to the policy. :param module: :param aws: :return: F)r$rDrrrrrrEzadding permission to policyr%NTrI) r"r2rJ check_modeadd_permissionrLrMrNrOrP)rrSchangedrr rTrVs radd_policy_permissionr\"sGF /Jf%II.    G !F ! ! /J / N ##//1D1D1R1RS G  (E F F GsA7B' B""B'cRd}t|d}t|}|r|j| |js|jdi|d}|S#t j jt j jf$r}|j|dYd}~|Sd}~wwxYw) zj Removed a permission statement from the policy. :param module: :param aws: :return: F)r$rDrETzremoving permission from policyr%NrI) r"r2rJrYremove_permissionrLrMrNrOrP)rrSr[r rTrVs rremove_policy_permissionr_FsG (IJJf%II.G  $F $ $ 2z 2G N    + +X-@-@-N-N OGQ$EFF NGs A7B&B!!B&c(d}d}|jd}d}t||}|rd}|dk(r?|dk(r&t||st||t ||}d}|dk(s"t ||}d}n|dk(rt||}d}t |t |  S) NFabsentstatenonepresentupdatedaddeddeleted)lambda_policy_action)r[ ansible_facts)rrWrr_r\r)r lambda_clientr[ current_staterb action_takencurrent_policy_statements r manage_staternasGM MM' "EL 4FMJ!   I %l6C[.\ $V] ;+FMBG$L )+FMBG"L ) #*6=A t/V WWrc&ttdddgtdddgtddgttd td td tttd  }t|dddgddgddggS)Nrdra)defaultchoicesTlambda_function_arn function_arn)requiredaliasesr?int)type)rtF)no_log) rbr$rDr1r0rrrrrr1r0rrr) argument_specsupports_check_modemutually_exclusive)rr)rys rsetup_module_objectr||s9y(.CDD3H.2YZ4%9f%   6vu-M" # i !< 0 !#3 4  rct}|jd}t|t||}|jdi|y)z< Main entry point. :return dict: ansible facts lambdaNrI)r|rSr.rn exit_json)rrSresultss rmainrsA! "F ]]8 $FF66*GFwr__main__) DOCUMENTATIONEXAMPLESRETURNrQr*rL ImportErroransible.module_utils._textrrsS j &   1\XE&`6  'T*@!H6X6:   zFU   sAA A