Index: tools/telemetry/third_party/gsutil/third_party/boto/boto/iam/connection.py |
diff --git a/tools/telemetry/third_party/gsutil/third_party/boto/boto/iam/connection.py b/tools/telemetry/third_party/gsutil/third_party/boto/boto/iam/connection.py |
deleted file mode 100644 |
index 392d3f355cdf6d277ab89d909d15510a2a86f65e..0000000000000000000000000000000000000000 |
--- a/tools/telemetry/third_party/gsutil/third_party/boto/boto/iam/connection.py |
+++ /dev/null |
@@ -1,1642 +0,0 @@ |
-# Copyright (c) 2010-2011 Mitch Garnaat http://garnaat.org/ |
-# Copyright (c) 2010-2011, Eucalyptus Systems, Inc. |
-# |
-# Permission is hereby granted, free of charge, to any person obtaining a |
-# copy of this software and associated documentation files (the |
-# "Software"), to deal in the Software without restriction, including |
-# without limitation the rights to use, copy, modify, merge, publish, dis- |
-# tribute, sublicense, and/or sell copies of the Software, and to permit |
-# persons to whom the Software is furnished to do so, subject to the fol- |
-# lowing conditions: |
-# |
-# The above copyright notice and this permission notice shall be included |
-# in all copies or substantial portions of the Software. |
-# |
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS |
-# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABIL- |
-# ITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT |
-# SHALL THE AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, |
-# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS |
-# IN THE SOFTWARE. |
-import boto |
-import boto.jsonresponse |
-from boto.compat import json, six |
-from boto.resultset import ResultSet |
-from boto.iam.summarymap import SummaryMap |
-from boto.connection import AWSQueryConnection |
- |
-DEFAULT_POLICY_DOCUMENTS = { |
- 'default': { |
- 'Statement': [ |
- { |
- 'Principal': { |
- 'Service': ['ec2.amazonaws.com'] |
- }, |
- 'Effect': 'Allow', |
- 'Action': ['sts:AssumeRole'] |
- } |
- ] |
- }, |
- 'amazonaws.com.cn': { |
- 'Statement': [ |
- { |
- 'Principal': { |
- 'Service': ['ec2.amazonaws.com.cn'] |
- }, |
- 'Effect': 'Allow', |
- 'Action': ['sts:AssumeRole'] |
- } |
- ] |
- }, |
-} |
-# For backward-compatibility, we'll preserve this here. |
-ASSUME_ROLE_POLICY_DOCUMENT = json.dumps(DEFAULT_POLICY_DOCUMENTS['default']) |
- |
- |
-class IAMConnection(AWSQueryConnection): |
- |
- APIVersion = '2010-05-08' |
- |
- def __init__(self, aws_access_key_id=None, aws_secret_access_key=None, |
- is_secure=True, port=None, proxy=None, proxy_port=None, |
- proxy_user=None, proxy_pass=None, host='iam.amazonaws.com', |
- debug=0, https_connection_factory=None, path='/', |
- security_token=None, validate_certs=True, profile_name=None): |
- super(IAMConnection, self).__init__(aws_access_key_id, |
- aws_secret_access_key, |
- is_secure, port, proxy, |
- proxy_port, proxy_user, proxy_pass, |
- host, debug, https_connection_factory, |
- path, security_token, |
- validate_certs=validate_certs, |
- profile_name=profile_name) |
- |
- def _required_auth_capability(self): |
- return ['hmac-v4'] |
- |
- def get_response(self, action, params, path='/', parent=None, |
- verb='POST', list_marker='Set'): |
- """ |
- Utility method to handle calls to IAM and parsing of responses. |
- """ |
- if not parent: |
- parent = self |
- response = self.make_request(action, params, path, verb) |
- body = response.read() |
- boto.log.debug(body) |
- if response.status == 200: |
- if body: |
- e = boto.jsonresponse.Element(list_marker=list_marker, |
- pythonize_name=True) |
- h = boto.jsonresponse.XmlHandler(e, parent) |
- h.parse(body) |
- return e |
- else: |
- # Support empty responses, e.g. deleting a SAML provider |
- # according to the official documentation. |
- return {} |
- else: |
- boto.log.error('%s %s' % (response.status, response.reason)) |
- boto.log.error('%s' % body) |
- raise self.ResponseError(response.status, response.reason, body) |
- |
- # |
- # Group methods |
- # |
- |
- def get_all_groups(self, path_prefix='/', marker=None, max_items=None): |
- """ |
- List the groups that have the specified path prefix. |
- |
- :type path_prefix: string |
- :param path_prefix: If provided, only groups whose paths match |
- the provided prefix will be returned. |
- |
- :type marker: string |
- :param marker: Use this only when paginating results and only |
- in follow-up request after you've received a response |
- where the results are truncated. Set this to the value of |
- the Marker element in the response you just received. |
- |
- :type max_items: int |
- :param max_items: Use this only when paginating results to indicate |
- the maximum number of groups you want in the response. |
- """ |
- params = {} |
- if path_prefix: |
- params['PathPrefix'] = path_prefix |
- if marker: |
- params['Marker'] = marker |
- if max_items: |
- params['MaxItems'] = max_items |
- return self.get_response('ListGroups', params, |
- list_marker='Groups') |
- |
- def get_group(self, group_name, marker=None, max_items=None): |
- """ |
- Return a list of users that are in the specified group. |
- |
- :type group_name: string |
- :param group_name: The name of the group whose information should |
- be returned. |
- :type marker: string |
- :param marker: Use this only when paginating results and only |
- in follow-up request after you've received a response |
- where the results are truncated. Set this to the value of |
- the Marker element in the response you just received. |
- |
- :type max_items: int |
- :param max_items: Use this only when paginating results to indicate |
- the maximum number of groups you want in the response. |
- """ |
- params = {'GroupName': group_name} |
- if marker: |
- params['Marker'] = marker |
- if max_items: |
- params['MaxItems'] = max_items |
- return self.get_response('GetGroup', params, list_marker='Users') |
- |
- def create_group(self, group_name, path='/'): |
- """ |
- Create a group. |
- |
- :type group_name: string |
- :param group_name: The name of the new group |
- |
- :type path: string |
- :param path: The path to the group (Optional). Defaults to /. |
- |
- """ |
- params = {'GroupName': group_name, |
- 'Path': path} |
- return self.get_response('CreateGroup', params) |
- |
- def delete_group(self, group_name): |
- """ |
- Delete a group. The group must not contain any Users or |
- have any attached policies |
- |
- :type group_name: string |
- :param group_name: The name of the group to delete. |
- |
- """ |
- params = {'GroupName': group_name} |
- return self.get_response('DeleteGroup', params) |
- |
- def update_group(self, group_name, new_group_name=None, new_path=None): |
- """ |
- Updates name and/or path of the specified group. |
- |
- :type group_name: string |
- :param group_name: The name of the new group |
- |
- :type new_group_name: string |
- :param new_group_name: If provided, the name of the group will be |
- changed to this name. |
- |
- :type new_path: string |
- :param new_path: If provided, the path of the group will be |
- changed to this path. |
- |
- """ |
- params = {'GroupName': group_name} |
- if new_group_name: |
- params['NewGroupName'] = new_group_name |
- if new_path: |
- params['NewPath'] = new_path |
- return self.get_response('UpdateGroup', params) |
- |
- def add_user_to_group(self, group_name, user_name): |
- """ |
- Add a user to a group |
- |
- :type group_name: string |
- :param group_name: The name of the group |
- |
- :type user_name: string |
- :param user_name: The to be added to the group. |
- |
- """ |
- params = {'GroupName': group_name, |
- 'UserName': user_name} |
- return self.get_response('AddUserToGroup', params) |
- |
- def remove_user_from_group(self, group_name, user_name): |
- """ |
- Remove a user from a group. |
- |
- :type group_name: string |
- :param group_name: The name of the group |
- |
- :type user_name: string |
- :param user_name: The user to remove from the group. |
- |
- """ |
- params = {'GroupName': group_name, |
- 'UserName': user_name} |
- return self.get_response('RemoveUserFromGroup', params) |
- |
- def put_group_policy(self, group_name, policy_name, policy_json): |
- """ |
- Adds or updates the specified policy document for the specified group. |
- |
- :type group_name: string |
- :param group_name: The name of the group the policy is associated with. |
- |
- :type policy_name: string |
- :param policy_name: The policy document to get. |
- |
- :type policy_json: string |
- :param policy_json: The policy document. |
- |
- """ |
- params = {'GroupName': group_name, |
- 'PolicyName': policy_name, |
- 'PolicyDocument': policy_json} |
- return self.get_response('PutGroupPolicy', params, verb='POST') |
- |
- def get_all_group_policies(self, group_name, marker=None, max_items=None): |
- """ |
- List the names of the policies associated with the specified group. |
- |
- :type group_name: string |
- :param group_name: The name of the group the policy is associated with. |
- |
- :type marker: string |
- :param marker: Use this only when paginating results and only |
- in follow-up request after you've received a response |
- where the results are truncated. Set this to the value of |
- the Marker element in the response you just received. |
- |
- :type max_items: int |
- :param max_items: Use this only when paginating results to indicate |
- the maximum number of groups you want in the response. |
- """ |
- params = {'GroupName': group_name} |
- if marker: |
- params['Marker'] = marker |
- if max_items: |
- params['MaxItems'] = max_items |
- return self.get_response('ListGroupPolicies', params, |
- list_marker='PolicyNames') |
- |
- def get_group_policy(self, group_name, policy_name): |
- """ |
- Retrieves the specified policy document for the specified group. |
- |
- :type group_name: string |
- :param group_name: The name of the group the policy is associated with. |
- |
- :type policy_name: string |
- :param policy_name: The policy document to get. |
- |
- """ |
- params = {'GroupName': group_name, |
- 'PolicyName': policy_name} |
- return self.get_response('GetGroupPolicy', params, verb='POST') |
- |
- def delete_group_policy(self, group_name, policy_name): |
- """ |
- Deletes the specified policy document for the specified group. |
- |
- :type group_name: string |
- :param group_name: The name of the group the policy is associated with. |
- |
- :type policy_name: string |
- :param policy_name: The policy document to delete. |
- |
- """ |
- params = {'GroupName': group_name, |
- 'PolicyName': policy_name} |
- return self.get_response('DeleteGroupPolicy', params, verb='POST') |
- |
- def get_all_users(self, path_prefix='/', marker=None, max_items=None): |
- """ |
- List the users that have the specified path prefix. |
- |
- :type path_prefix: string |
- :param path_prefix: If provided, only users whose paths match |
- the provided prefix will be returned. |
- |
- :type marker: string |
- :param marker: Use this only when paginating results and only |
- in follow-up request after you've received a response |
- where the results are truncated. Set this to the value of |
- the Marker element in the response you just received. |
- |
- :type max_items: int |
- :param max_items: Use this only when paginating results to indicate |
- the maximum number of groups you want in the response. |
- """ |
- params = {'PathPrefix': path_prefix} |
- if marker: |
- params['Marker'] = marker |
- if max_items: |
- params['MaxItems'] = max_items |
- return self.get_response('ListUsers', params, list_marker='Users') |
- |
- # |
- # User methods |
- # |
- |
- def create_user(self, user_name, path='/'): |
- """ |
- Create a user. |
- |
- :type user_name: string |
- :param user_name: The name of the new user |
- |
- :type path: string |
- :param path: The path in which the user will be created. |
- Defaults to /. |
- |
- """ |
- params = {'UserName': user_name, |
- 'Path': path} |
- return self.get_response('CreateUser', params) |
- |
- def delete_user(self, user_name): |
- """ |
- Delete a user including the user's path, GUID and ARN. |
- |
- If the user_name is not specified, the user_name is determined |
- implicitly based on the AWS Access Key ID used to sign the request. |
- |
- :type user_name: string |
- :param user_name: The name of the user to delete. |
- |
- """ |
- params = {'UserName': user_name} |
- return self.get_response('DeleteUser', params) |
- |
- def get_user(self, user_name=None): |
- """ |
- Retrieve information about the specified user. |
- |
- If the user_name is not specified, the user_name is determined |
- implicitly based on the AWS Access Key ID used to sign the request. |
- |
- :type user_name: string |
- :param user_name: The name of the user to retrieve. |
- If not specified, defaults to user making request. |
- """ |
- params = {} |
- if user_name: |
- params['UserName'] = user_name |
- return self.get_response('GetUser', params) |
- |
- def update_user(self, user_name, new_user_name=None, new_path=None): |
- """ |
- Updates name and/or path of the specified user. |
- |
- :type user_name: string |
- :param user_name: The name of the user |
- |
- :type new_user_name: string |
- :param new_user_name: If provided, the username of the user will be |
- changed to this username. |
- |
- :type new_path: string |
- :param new_path: If provided, the path of the user will be |
- changed to this path. |
- |
- """ |
- params = {'UserName': user_name} |
- if new_user_name: |
- params['NewUserName'] = new_user_name |
- if new_path: |
- params['NewPath'] = new_path |
- return self.get_response('UpdateUser', params) |
- |
- def get_all_user_policies(self, user_name, marker=None, max_items=None): |
- """ |
- List the names of the policies associated with the specified user. |
- |
- :type user_name: string |
- :param user_name: The name of the user the policy is associated with. |
- |
- :type marker: string |
- :param marker: Use this only when paginating results and only |
- in follow-up request after you've received a response |
- where the results are truncated. Set this to the value of |
- the Marker element in the response you just received. |
- |
- :type max_items: int |
- :param max_items: Use this only when paginating results to indicate |
- the maximum number of groups you want in the response. |
- """ |
- params = {'UserName': user_name} |
- if marker: |
- params['Marker'] = marker |
- if max_items: |
- params['MaxItems'] = max_items |
- return self.get_response('ListUserPolicies', params, |
- list_marker='PolicyNames') |
- |
- def put_user_policy(self, user_name, policy_name, policy_json): |
- """ |
- Adds or updates the specified policy document for the specified user. |
- |
- :type user_name: string |
- :param user_name: The name of the user the policy is associated with. |
- |
- :type policy_name: string |
- :param policy_name: The policy document to get. |
- |
- :type policy_json: string |
- :param policy_json: The policy document. |
- |
- """ |
- params = {'UserName': user_name, |
- 'PolicyName': policy_name, |
- 'PolicyDocument': policy_json} |
- return self.get_response('PutUserPolicy', params, verb='POST') |
- |
- def get_user_policy(self, user_name, policy_name): |
- """ |
- Retrieves the specified policy document for the specified user. |
- |
- :type user_name: string |
- :param user_name: The name of the user the policy is associated with. |
- |
- :type policy_name: string |
- :param policy_name: The policy document to get. |
- |
- """ |
- params = {'UserName': user_name, |
- 'PolicyName': policy_name} |
- return self.get_response('GetUserPolicy', params, verb='POST') |
- |
- def delete_user_policy(self, user_name, policy_name): |
- """ |
- Deletes the specified policy document for the specified user. |
- |
- :type user_name: string |
- :param user_name: The name of the user the policy is associated with. |
- |
- :type policy_name: string |
- :param policy_name: The policy document to delete. |
- |
- """ |
- params = {'UserName': user_name, |
- 'PolicyName': policy_name} |
- return self.get_response('DeleteUserPolicy', params, verb='POST') |
- |
- def get_groups_for_user(self, user_name, marker=None, max_items=None): |
- """ |
- List the groups that a specified user belongs to. |
- |
- :type user_name: string |
- :param user_name: The name of the user to list groups for. |
- |
- :type marker: string |
- :param marker: Use this only when paginating results and only |
- in follow-up request after you've received a response |
- where the results are truncated. Set this to the value of |
- the Marker element in the response you just received. |
- |
- :type max_items: int |
- :param max_items: Use this only when paginating results to indicate |
- the maximum number of groups you want in the response. |
- """ |
- params = {'UserName': user_name} |
- if marker: |
- params['Marker'] = marker |
- if max_items: |
- params['MaxItems'] = max_items |
- return self.get_response('ListGroupsForUser', params, |
- list_marker='Groups') |
- |
- # |
- # Access Keys |
- # |
- |
- def get_all_access_keys(self, user_name, marker=None, max_items=None): |
- """ |
- Get all access keys associated with an account. |
- |
- :type user_name: string |
- :param user_name: The username of the user |
- |
- :type marker: string |
- :param marker: Use this only when paginating results and only |
- in follow-up request after you've received a response |
- where the results are truncated. Set this to the value of |
- the Marker element in the response you just received. |
- |
- :type max_items: int |
- :param max_items: Use this only when paginating results to indicate |
- the maximum number of groups you want in the response. |
- """ |
- params = {'UserName': user_name} |
- if marker: |
- params['Marker'] = marker |
- if max_items: |
- params['MaxItems'] = max_items |
- return self.get_response('ListAccessKeys', params, |
- list_marker='AccessKeyMetadata') |
- |
- def create_access_key(self, user_name=None): |
- """ |
- Create a new AWS Secret Access Key and corresponding AWS Access Key ID |
- for the specified user. The default status for new keys is Active |
- |
- If the user_name is not specified, the user_name is determined |
- implicitly based on the AWS Access Key ID used to sign the request. |
- |
- :type user_name: string |
- :param user_name: The username of the user |
- |
- """ |
- params = {'UserName': user_name} |
- return self.get_response('CreateAccessKey', params) |
- |
- def update_access_key(self, access_key_id, status, user_name=None): |
- """ |
- Changes the status of the specified access key from Active to Inactive |
- or vice versa. This action can be used to disable a user's key as |
- part of a key rotation workflow. |
- |
- If the user_name is not specified, the user_name is determined |
- implicitly based on the AWS Access Key ID used to sign the request. |
- |
- :type access_key_id: string |
- :param access_key_id: The ID of the access key. |
- |
- :type status: string |
- :param status: Either Active or Inactive. |
- |
- :type user_name: string |
- :param user_name: The username of user (optional). |
- |
- """ |
- params = {'AccessKeyId': access_key_id, |
- 'Status': status} |
- if user_name: |
- params['UserName'] = user_name |
- return self.get_response('UpdateAccessKey', params) |
- |
- def delete_access_key(self, access_key_id, user_name=None): |
- """ |
- Delete an access key associated with a user. |
- |
- If the user_name is not specified, it is determined implicitly based |
- on the AWS Access Key ID used to sign the request. |
- |
- :type access_key_id: string |
- :param access_key_id: The ID of the access key to be deleted. |
- |
- :type user_name: string |
- :param user_name: The username of the user |
- |
- """ |
- params = {'AccessKeyId': access_key_id} |
- if user_name: |
- params['UserName'] = user_name |
- return self.get_response('DeleteAccessKey', params) |
- |
- # |
- # Signing Certificates |
- # |
- |
- def get_all_signing_certs(self, marker=None, max_items=None, |
- user_name=None): |
- """ |
- Get all signing certificates associated with an account. |
- |
- If the user_name is not specified, it is determined implicitly based |
- on the AWS Access Key ID used to sign the request. |
- |
- :type marker: string |
- :param marker: Use this only when paginating results and only |
- in follow-up request after you've received a response |
- where the results are truncated. Set this to the value of |
- the Marker element in the response you just received. |
- |
- :type max_items: int |
- :param max_items: Use this only when paginating results to indicate |
- the maximum number of groups you want in the response. |
- |
- :type user_name: string |
- :param user_name: The username of the user |
- |
- """ |
- params = {} |
- if marker: |
- params['Marker'] = marker |
- if max_items: |
- params['MaxItems'] = max_items |
- if user_name: |
- params['UserName'] = user_name |
- return self.get_response('ListSigningCertificates', |
- params, list_marker='Certificates') |
- |
- def update_signing_cert(self, cert_id, status, user_name=None): |
- """ |
- Change the status of the specified signing certificate from |
- Active to Inactive or vice versa. |
- |
- If the user_name is not specified, it is determined implicitly based |
- on the AWS Access Key ID used to sign the request. |
- |
- :type cert_id: string |
- :param cert_id: The ID of the signing certificate |
- |
- :type status: string |
- :param status: Either Active or Inactive. |
- |
- :type user_name: string |
- :param user_name: The username of the user |
- """ |
- params = {'CertificateId': cert_id, |
- 'Status': status} |
- if user_name: |
- params['UserName'] = user_name |
- return self.get_response('UpdateSigningCertificate', params) |
- |
- def upload_signing_cert(self, cert_body, user_name=None): |
- """ |
- Uploads an X.509 signing certificate and associates it with |
- the specified user. |
- |
- If the user_name is not specified, it is determined implicitly based |
- on the AWS Access Key ID used to sign the request. |
- |
- :type cert_body: string |
- :param cert_body: The body of the signing certificate. |
- |
- :type user_name: string |
- :param user_name: The username of the user |
- |
- """ |
- params = {'CertificateBody': cert_body} |
- if user_name: |
- params['UserName'] = user_name |
- return self.get_response('UploadSigningCertificate', params, |
- verb='POST') |
- |
- def delete_signing_cert(self, cert_id, user_name=None): |
- """ |
- Delete a signing certificate associated with a user. |
- |
- If the user_name is not specified, it is determined implicitly based |
- on the AWS Access Key ID used to sign the request. |
- |
- :type user_name: string |
- :param user_name: The username of the user |
- |
- :type cert_id: string |
- :param cert_id: The ID of the certificate. |
- |
- """ |
- params = {'CertificateId': cert_id} |
- if user_name: |
- params['UserName'] = user_name |
- return self.get_response('DeleteSigningCertificate', params) |
- |
- # |
- # Server Certificates |
- # |
- |
- def list_server_certs(self, path_prefix='/', |
- marker=None, max_items=None): |
- """ |
- Lists the server certificates that have the specified path prefix. |
- If none exist, the action returns an empty list. |
- |
- :type path_prefix: string |
- :param path_prefix: If provided, only certificates whose paths match |
- the provided prefix will be returned. |
- |
- :type marker: string |
- :param marker: Use this only when paginating results and only |
- in follow-up request after you've received a response |
- where the results are truncated. Set this to the value of |
- the Marker element in the response you just received. |
- |
- :type max_items: int |
- :param max_items: Use this only when paginating results to indicate |
- the maximum number of groups you want in the response. |
- |
- """ |
- params = {} |
- if path_prefix: |
- params['PathPrefix'] = path_prefix |
- if marker: |
- params['Marker'] = marker |
- if max_items: |
- params['MaxItems'] = max_items |
- return self.get_response('ListServerCertificates', |
- params, |
- list_marker='ServerCertificateMetadataList') |
- |
- # Preserves backwards compatibility. |
- # TODO: Look into deprecating this eventually? |
- get_all_server_certs = list_server_certs |
- |
- def update_server_cert(self, cert_name, new_cert_name=None, |
- new_path=None): |
- """ |
- Updates the name and/or the path of the specified server certificate. |
- |
- :type cert_name: string |
- :param cert_name: The name of the server certificate that you want |
- to update. |
- |
- :type new_cert_name: string |
- :param new_cert_name: The new name for the server certificate. |
- Include this only if you are updating the |
- server certificate's name. |
- |
- :type new_path: string |
- :param new_path: If provided, the path of the certificate will be |
- changed to this path. |
- """ |
- params = {'ServerCertificateName': cert_name} |
- if new_cert_name: |
- params['NewServerCertificateName'] = new_cert_name |
- if new_path: |
- params['NewPath'] = new_path |
- return self.get_response('UpdateServerCertificate', params) |
- |
- def upload_server_cert(self, cert_name, cert_body, private_key, |
- cert_chain=None, path=None): |
- """ |
- Uploads a server certificate entity for the AWS Account. |
- The server certificate entity includes a public key certificate, |
- a private key, and an optional certificate chain, which should |
- all be PEM-encoded. |
- |
- :type cert_name: string |
- :param cert_name: The name for the server certificate. Do not |
- include the path in this value. |
- |
- :type cert_body: string |
- :param cert_body: The contents of the public key certificate |
- in PEM-encoded format. |
- |
- :type private_key: string |
- :param private_key: The contents of the private key in |
- PEM-encoded format. |
- |
- :type cert_chain: string |
- :param cert_chain: The contents of the certificate chain. This |
- is typically a concatenation of the PEM-encoded |
- public key certificates of the chain. |
- |
- :type path: string |
- :param path: The path for the server certificate. |
- """ |
- params = {'ServerCertificateName': cert_name, |
- 'CertificateBody': cert_body, |
- 'PrivateKey': private_key} |
- if cert_chain: |
- params['CertificateChain'] = cert_chain |
- if path: |
- params['Path'] = path |
- return self.get_response('UploadServerCertificate', params, |
- verb='POST') |
- |
- def get_server_certificate(self, cert_name): |
- """ |
- Retrieves information about the specified server certificate. |
- |
- :type cert_name: string |
- :param cert_name: The name of the server certificate you want |
- to retrieve information about. |
- |
- """ |
- params = {'ServerCertificateName': cert_name} |
- return self.get_response('GetServerCertificate', params) |
- |
- def delete_server_cert(self, cert_name): |
- """ |
- Delete the specified server certificate. |
- |
- :type cert_name: string |
- :param cert_name: The name of the server certificate you want |
- to delete. |
- |
- """ |
- params = {'ServerCertificateName': cert_name} |
- return self.get_response('DeleteServerCertificate', params) |
- |
- # |
- # MFA Devices |
- # |
- |
- def get_all_mfa_devices(self, user_name, marker=None, max_items=None): |
- """ |
- Get all MFA devices associated with an account. |
- |
- :type user_name: string |
- :param user_name: The username of the user |
- |
- :type marker: string |
- :param marker: Use this only when paginating results and only |
- in follow-up request after you've received a response |
- where the results are truncated. Set this to the value of |
- the Marker element in the response you just received. |
- |
- :type max_items: int |
- :param max_items: Use this only when paginating results to indicate |
- the maximum number of groups you want in the response. |
- |
- """ |
- params = {'UserName': user_name} |
- if marker: |
- params['Marker'] = marker |
- if max_items: |
- params['MaxItems'] = max_items |
- return self.get_response('ListMFADevices', |
- params, list_marker='MFADevices') |
- |
- def enable_mfa_device(self, user_name, serial_number, |
- auth_code_1, auth_code_2): |
- """ |
- Enables the specified MFA device and associates it with the |
- specified user. |
- |
- :type user_name: string |
- :param user_name: The username of the user |
- |
- :type serial_number: string |
- :param serial_number: The serial number which uniquely identifies |
- the MFA device. |
- |
- :type auth_code_1: string |
- :param auth_code_1: An authentication code emitted by the device. |
- |
- :type auth_code_2: string |
- :param auth_code_2: A subsequent authentication code emitted |
- by the device. |
- |
- """ |
- params = {'UserName': user_name, |
- 'SerialNumber': serial_number, |
- 'AuthenticationCode1': auth_code_1, |
- 'AuthenticationCode2': auth_code_2} |
- return self.get_response('EnableMFADevice', params) |
- |
- def deactivate_mfa_device(self, user_name, serial_number): |
- """ |
- Deactivates the specified MFA device and removes it from |
- association with the user. |
- |
- :type user_name: string |
- :param user_name: The username of the user |
- |
- :type serial_number: string |
- :param serial_number: The serial number which uniquely identifies |
- the MFA device. |
- |
- """ |
- params = {'UserName': user_name, |
- 'SerialNumber': serial_number} |
- return self.get_response('DeactivateMFADevice', params) |
- |
- def resync_mfa_device(self, user_name, serial_number, |
- auth_code_1, auth_code_2): |
- """ |
- Syncronizes the specified MFA device with the AWS servers. |
- |
- :type user_name: string |
- :param user_name: The username of the user |
- |
- :type serial_number: string |
- :param serial_number: The serial number which uniquely identifies |
- the MFA device. |
- |
- :type auth_code_1: string |
- :param auth_code_1: An authentication code emitted by the device. |
- |
- :type auth_code_2: string |
- :param auth_code_2: A subsequent authentication code emitted |
- by the device. |
- |
- """ |
- params = {'UserName': user_name, |
- 'SerialNumber': serial_number, |
- 'AuthenticationCode1': auth_code_1, |
- 'AuthenticationCode2': auth_code_2} |
- return self.get_response('ResyncMFADevice', params) |
- |
- # |
- # Login Profiles |
- # |
- |
- def get_login_profiles(self, user_name): |
- """ |
- Retrieves the login profile for the specified user. |
- |
- :type user_name: string |
- :param user_name: The username of the user |
- |
- """ |
- params = {'UserName': user_name} |
- return self.get_response('GetLoginProfile', params) |
- |
- def create_login_profile(self, user_name, password): |
- """ |
- Creates a login profile for the specified user, give the user the |
- ability to access AWS services and the AWS Management Console. |
- |
- :type user_name: string |
- :param user_name: The name of the user |
- |
- :type password: string |
- :param password: The new password for the user |
- |
- """ |
- params = {'UserName': user_name, |
- 'Password': password} |
- return self.get_response('CreateLoginProfile', params) |
- |
- def delete_login_profile(self, user_name): |
- """ |
- Deletes the login profile associated with the specified user. |
- |
- :type user_name: string |
- :param user_name: The name of the user to delete. |
- |
- """ |
- params = {'UserName': user_name} |
- return self.get_response('DeleteLoginProfile', params) |
- |
- def update_login_profile(self, user_name, password): |
- """ |
- Resets the password associated with the user's login profile. |
- |
- :type user_name: string |
- :param user_name: The name of the user |
- |
- :type password: string |
- :param password: The new password for the user |
- |
- """ |
- params = {'UserName': user_name, |
- 'Password': password} |
- return self.get_response('UpdateLoginProfile', params) |
- |
- def create_account_alias(self, alias): |
- """ |
- Creates a new alias for the AWS account. |
- |
- For more information on account id aliases, please see |
- http://goo.gl/ToB7G |
- |
- :type alias: string |
- :param alias: The alias to attach to the account. |
- """ |
- params = {'AccountAlias': alias} |
- return self.get_response('CreateAccountAlias', params) |
- |
- def delete_account_alias(self, alias): |
- """ |
- Deletes an alias for the AWS account. |
- |
- For more information on account id aliases, please see |
- http://goo.gl/ToB7G |
- |
- :type alias: string |
- :param alias: The alias to remove from the account. |
- """ |
- params = {'AccountAlias': alias} |
- return self.get_response('DeleteAccountAlias', params) |
- |
- def get_account_alias(self): |
- """ |
- Get the alias for the current account. |
- |
- This is referred to in the docs as list_account_aliases, |
- but it seems you can only have one account alias currently. |
- |
- For more information on account id aliases, please see |
- http://goo.gl/ToB7G |
- """ |
- return self.get_response('ListAccountAliases', {}, |
- list_marker='AccountAliases') |
- |
- def get_signin_url(self, service='ec2'): |
- """ |
- Get the URL where IAM users can use their login profile to sign in |
- to this account's console. |
- |
- :type service: string |
- :param service: Default service to go to in the console. |
- """ |
- alias = self.get_account_alias() |
- |
- if not alias: |
- raise Exception('No alias associated with this account. Please use iam.create_account_alias() first.') |
- |
- resp = alias.get('list_account_aliases_response', {}) |
- result = resp.get('list_account_aliases_result', {}) |
- aliases = result.get('account_aliases', []) |
- |
- if not len(aliases): |
- raise Exception('No alias associated with this account. Please use iam.create_account_alias() first.') |
- |
- # We'll just use the first one we find. |
- alias = aliases[0] |
- |
- if self.host == 'iam.us-gov.amazonaws.com': |
- return "https://%s.signin.amazonaws-us-gov.com/console/%s" % ( |
- alias, |
- service |
- ) |
- elif self.host.endswith('amazonaws.com.cn'): |
- return "https://%s.signin.amazonaws.cn/console/%s" % ( |
- alias, |
- service |
- ) |
- else: |
- return "https://%s.signin.aws.amazon.com/console/%s" % ( |
- alias, |
- service |
- ) |
- |
- def get_account_summary(self): |
- """ |
- Get the alias for the current account. |
- |
- This is referred to in the docs as list_account_aliases, |
- but it seems you can only have one account alias currently. |
- |
- For more information on account id aliases, please see |
- http://goo.gl/ToB7G |
- """ |
- return self.get_object('GetAccountSummary', {}, SummaryMap) |
- |
- # |
- # IAM Roles |
- # |
- |
- def add_role_to_instance_profile(self, instance_profile_name, role_name): |
- """ |
- Adds the specified role to the specified instance profile. |
- |
- :type instance_profile_name: string |
- :param instance_profile_name: Name of the instance profile to update. |
- |
- :type role_name: string |
- :param role_name: Name of the role to add. |
- """ |
- return self.get_response('AddRoleToInstanceProfile', |
- {'InstanceProfileName': instance_profile_name, |
- 'RoleName': role_name}) |
- |
- def create_instance_profile(self, instance_profile_name, path=None): |
- """ |
- Creates a new instance profile. |
- |
- :type instance_profile_name: string |
- :param instance_profile_name: Name of the instance profile to create. |
- |
- :type path: string |
- :param path: The path to the instance profile. |
- """ |
- params = {'InstanceProfileName': instance_profile_name} |
- if path is not None: |
- params['Path'] = path |
- return self.get_response('CreateInstanceProfile', params) |
- |
- def _build_policy(self, assume_role_policy_document=None): |
- if assume_role_policy_document is not None: |
- if isinstance(assume_role_policy_document, six.string_types): |
- # Historically, they had to pass a string. If it's a string, |
- # assume the user has already handled it. |
- return assume_role_policy_document |
- else: |
- |
- for tld, policy in DEFAULT_POLICY_DOCUMENTS.items(): |
- if tld is 'default': |
- # Skip the default. We'll fall back to it if we don't find |
- # anything. |
- continue |
- |
- if self.host and self.host.endswith(tld): |
- assume_role_policy_document = policy |
- break |
- |
- if not assume_role_policy_document: |
- assume_role_policy_document = DEFAULT_POLICY_DOCUMENTS['default'] |
- |
- # Dump the policy (either user-supplied ``dict`` or one of the defaults) |
- return json.dumps(assume_role_policy_document) |
- |
- def create_role(self, role_name, assume_role_policy_document=None, path=None): |
- """ |
- Creates a new role for your AWS account. |
- |
- The policy grants permission to an EC2 instance to assume the role. |
- The policy is URL-encoded according to RFC 3986. Currently, only EC2 |
- instances can assume roles. |
- |
- :type role_name: string |
- :param role_name: Name of the role to create. |
- |
- :type assume_role_policy_document: ``string`` or ``dict`` |
- :param assume_role_policy_document: The policy that grants an entity |
- permission to assume the role. |
- |
- :type path: string |
- :param path: The path to the role. |
- """ |
- params = { |
- 'RoleName': role_name, |
- 'AssumeRolePolicyDocument': self._build_policy( |
- assume_role_policy_document |
- ), |
- } |
- if path is not None: |
- params['Path'] = path |
- return self.get_response('CreateRole', params) |
- |
- def delete_instance_profile(self, instance_profile_name): |
- """ |
- Deletes the specified instance profile. The instance profile must not |
- have an associated role. |
- |
- :type instance_profile_name: string |
- :param instance_profile_name: Name of the instance profile to delete. |
- """ |
- return self.get_response( |
- 'DeleteInstanceProfile', |
- {'InstanceProfileName': instance_profile_name}) |
- |
- def delete_role(self, role_name): |
- """ |
- Deletes the specified role. The role must not have any policies |
- attached. |
- |
- :type role_name: string |
- :param role_name: Name of the role to delete. |
- """ |
- return self.get_response('DeleteRole', {'RoleName': role_name}) |
- |
- def delete_role_policy(self, role_name, policy_name): |
- """ |
- Deletes the specified policy associated with the specified role. |
- |
- :type role_name: string |
- :param role_name: Name of the role associated with the policy. |
- |
- :type policy_name: string |
- :param policy_name: Name of the policy to delete. |
- """ |
- return self.get_response( |
- 'DeleteRolePolicy', |
- {'RoleName': role_name, 'PolicyName': policy_name}) |
- |
- def get_instance_profile(self, instance_profile_name): |
- """ |
- Retrieves information about the specified instance profile, including |
- the instance profile's path, GUID, ARN, and role. |
- |
- :type instance_profile_name: string |
- :param instance_profile_name: Name of the instance profile to get |
- information about. |
- """ |
- return self.get_response('GetInstanceProfile', |
- {'InstanceProfileName': instance_profile_name}) |
- |
- def get_role(self, role_name): |
- """ |
- Retrieves information about the specified role, including the role's |
- path, GUID, ARN, and the policy granting permission to EC2 to assume |
- the role. |
- |
- :type role_name: string |
- :param role_name: Name of the role associated with the policy. |
- """ |
- return self.get_response('GetRole', {'RoleName': role_name}) |
- |
- def get_role_policy(self, role_name, policy_name): |
- """ |
- Retrieves the specified policy document for the specified role. |
- |
- :type role_name: string |
- :param role_name: Name of the role associated with the policy. |
- |
- :type policy_name: string |
- :param policy_name: Name of the policy to get. |
- """ |
- return self.get_response('GetRolePolicy', |
- {'RoleName': role_name, |
- 'PolicyName': policy_name}) |
- |
- def list_instance_profiles(self, path_prefix=None, marker=None, |
- max_items=None): |
- """ |
- Lists the instance profiles that have the specified path prefix. If |
- there are none, the action returns an empty list. |
- |
- :type path_prefix: string |
- :param path_prefix: The path prefix for filtering the results. For |
- example: /application_abc/component_xyz/, which would get all |
- instance profiles whose path starts with |
- /application_abc/component_xyz/. |
- |
- :type marker: string |
- :param marker: Use this parameter only when paginating results, and |
- only in a subsequent request after you've received a response |
- where the results are truncated. Set it to the value of the |
- Marker element in the response you just received. |
- |
- :type max_items: int |
- :param max_items: Use this parameter only when paginating results to |
- indicate the maximum number of user names you want in the response. |
- """ |
- params = {} |
- if path_prefix is not None: |
- params['PathPrefix'] = path_prefix |
- if marker is not None: |
- params['Marker'] = marker |
- if max_items is not None: |
- params['MaxItems'] = max_items |
- |
- return self.get_response('ListInstanceProfiles', params, |
- list_marker='InstanceProfiles') |
- |
- def list_instance_profiles_for_role(self, role_name, marker=None, |
- max_items=None): |
- """ |
- Lists the instance profiles that have the specified associated role. If |
- there are none, the action returns an empty list. |
- |
- :type role_name: string |
- :param role_name: The name of the role to list instance profiles for. |
- |
- :type marker: string |
- :param marker: Use this parameter only when paginating results, and |
- only in a subsequent request after you've received a response |
- where the results are truncated. Set it to the value of the |
- Marker element in the response you just received. |
- |
- :type max_items: int |
- :param max_items: Use this parameter only when paginating results to |
- indicate the maximum number of user names you want in the response. |
- """ |
- params = {'RoleName': role_name} |
- if marker is not None: |
- params['Marker'] = marker |
- if max_items is not None: |
- params['MaxItems'] = max_items |
- return self.get_response('ListInstanceProfilesForRole', params, |
- list_marker='InstanceProfiles') |
- |
- def list_role_policies(self, role_name, marker=None, max_items=None): |
- """ |
- Lists the names of the policies associated with the specified role. If |
- there are none, the action returns an empty list. |
- |
- :type role_name: string |
- :param role_name: The name of the role to list policies for. |
- |
- :type marker: string |
- :param marker: Use this parameter only when paginating results, and |
- only in a subsequent request after you've received a response |
- where the results are truncated. Set it to the value of the |
- marker element in the response you just received. |
- |
- :type max_items: int |
- :param max_items: Use this parameter only when paginating results to |
- indicate the maximum number of user names you want in the response. |
- """ |
- params = {'RoleName': role_name} |
- if marker is not None: |
- params['Marker'] = marker |
- if max_items is not None: |
- params['MaxItems'] = max_items |
- return self.get_response('ListRolePolicies', params, |
- list_marker='PolicyNames') |
- |
- def list_roles(self, path_prefix=None, marker=None, max_items=None): |
- """ |
- Lists the roles that have the specified path prefix. If there are none, |
- the action returns an empty list. |
- |
- :type path_prefix: string |
- :param path_prefix: The path prefix for filtering the results. |
- |
- :type marker: string |
- :param marker: Use this parameter only when paginating results, and |
- only in a subsequent request after you've received a response |
- where the results are truncated. Set it to the value of the |
- marker element in the response you just received. |
- |
- :type max_items: int |
- :param max_items: Use this parameter only when paginating results to |
- indicate the maximum number of user names you want in the response. |
- """ |
- params = {} |
- if path_prefix is not None: |
- params['PathPrefix'] = path_prefix |
- if marker is not None: |
- params['Marker'] = marker |
- if max_items is not None: |
- params['MaxItems'] = max_items |
- return self.get_response('ListRoles', params, list_marker='Roles') |
- |
- def put_role_policy(self, role_name, policy_name, policy_document): |
- """ |
- Adds (or updates) a policy document associated with the specified role. |
- |
- :type role_name: string |
- :param role_name: Name of the role to associate the policy with. |
- |
- :type policy_name: string |
- :param policy_name: Name of the policy document. |
- |
- :type policy_document: string |
- :param policy_document: The policy document. |
- """ |
- return self.get_response('PutRolePolicy', |
- {'RoleName': role_name, |
- 'PolicyName': policy_name, |
- 'PolicyDocument': policy_document}) |
- |
- def remove_role_from_instance_profile(self, instance_profile_name, |
- role_name): |
- """ |
- Removes the specified role from the specified instance profile. |
- |
- :type instance_profile_name: string |
- :param instance_profile_name: Name of the instance profile to update. |
- |
- :type role_name: string |
- :param role_name: Name of the role to remove. |
- """ |
- return self.get_response('RemoveRoleFromInstanceProfile', |
- {'InstanceProfileName': instance_profile_name, |
- 'RoleName': role_name}) |
- |
- def update_assume_role_policy(self, role_name, policy_document): |
- """ |
- Updates the policy that grants an entity permission to assume a role. |
- Currently, only an Amazon EC2 instance can assume a role. |
- |
- :type role_name: string |
- :param role_name: Name of the role to update. |
- |
- :type policy_document: string |
- :param policy_document: The policy that grants an entity permission to |
- assume the role. |
- """ |
- return self.get_response('UpdateAssumeRolePolicy', |
- {'RoleName': role_name, |
- 'PolicyDocument': policy_document}) |
- |
- def create_saml_provider(self, saml_metadata_document, name): |
- """ |
- Creates an IAM entity to describe an identity provider (IdP) |
- that supports SAML 2.0. |
- |
- The SAML provider that you create with this operation can be |
- used as a principal in a role's trust policy to establish a |
- trust relationship between AWS and a SAML identity provider. |
- You can create an IAM role that supports Web-based single |
- sign-on (SSO) to the AWS Management Console or one that |
- supports API access to AWS. |
- |
- When you create the SAML provider, you upload an a SAML |
- metadata document that you get from your IdP and that includes |
- the issuer's name, expiration information, and keys that can |
- be used to validate the SAML authentication response |
- (assertions) that are received from the IdP. You must generate |
- the metadata document using the identity management software |
- that is used as your organization's IdP. |
- This operation requires `Signature Version 4`_. |
- For more information, see `Giving Console Access Using SAML`_ |
- and `Creating Temporary Security Credentials for SAML |
- Federation`_ in the Using Temporary Credentials guide. |
- |
- :type saml_metadata_document: string |
- :param saml_metadata_document: An XML document generated by an identity |
- provider (IdP) that supports SAML 2.0. The document includes the |
- issuer's name, expiration information, and keys that can be used to |
- validate the SAML authentication response (assertions) that are |
- received from the IdP. You must generate the metadata document |
- using the identity management software that is used as your |
- organization's IdP. |
- For more information, see `Creating Temporary Security Credentials for |
- SAML Federation`_ in the Using Temporary Security Credentials |
- guide. |
- |
- :type name: string |
- :param name: The name of the provider to create. |
- |
- """ |
- params = { |
- 'SAMLMetadataDocument': saml_metadata_document, |
- 'Name': name, |
- } |
- return self.get_response('CreateSAMLProvider', params) |
- |
- def list_saml_providers(self): |
- """ |
- Lists the SAML providers in the account. |
- This operation requires `Signature Version 4`_. |
- """ |
- return self.get_response('ListSAMLProviders', {}, list_marker='SAMLProviderList') |
- |
- def get_saml_provider(self, saml_provider_arn): |
- """ |
- Returns the SAML provider metadocument that was uploaded when |
- the provider was created or updated. |
- This operation requires `Signature Version 4`_. |
- |
- :type saml_provider_arn: string |
- :param saml_provider_arn: The Amazon Resource Name (ARN) of the SAML |
- provider to get information about. |
- |
- """ |
- params = {'SAMLProviderArn': saml_provider_arn} |
- return self.get_response('GetSAMLProvider', params) |
- |
- def update_saml_provider(self, saml_provider_arn, saml_metadata_document): |
- """ |
- Updates the metadata document for an existing SAML provider. |
- This operation requires `Signature Version 4`_. |
- |
- :type saml_provider_arn: string |
- :param saml_provider_arn: The Amazon Resource Name (ARN) of the SAML |
- provider to update. |
- |
- :type saml_metadata_document: string |
- :param saml_metadata_document: An XML document generated by an identity |
- provider (IdP) that supports SAML 2.0. The document includes the |
- issuer's name, expiration information, and keys that can be used to |
- validate the SAML authentication response (assertions) that are |
- received from the IdP. You must generate the metadata document |
- using the identity management software that is used as your |
- organization's IdP. |
- |
- """ |
- params = { |
- 'SAMLMetadataDocument': saml_metadata_document, |
- 'SAMLProviderArn': saml_provider_arn, |
- } |
- return self.get_response('UpdateSAMLProvider', params) |
- |
- def delete_saml_provider(self, saml_provider_arn): |
- """ |
- Deletes a SAML provider. |
- |
- Deleting the provider does not update any roles that reference |
- the SAML provider as a principal in their trust policies. Any |
- attempt to assume a role that references a SAML provider that |
- has been deleted will fail. |
- This operation requires `Signature Version 4`_. |
- |
- :type saml_provider_arn: string |
- :param saml_provider_arn: The Amazon Resource Name (ARN) of the SAML |
- provider to delete. |
- |
- """ |
- params = {'SAMLProviderArn': saml_provider_arn} |
- return self.get_response('DeleteSAMLProvider', params) |
- |
- # |
- # IAM Reports |
- # |
- |
- def generate_credential_report(self): |
- """ |
- Generates a credential report for an account |
- |
- A new credential report can only be generated every 4 hours. If one |
- hasn't been generated in the last 4 hours then get_credential_report |
- will error when called |
- """ |
- params = {} |
- return self.get_response('GenerateCredentialReport', params) |
- |
- def get_credential_report(self): |
- """ |
- Retrieves a credential report for an account |
- |
- A report must have been generated in the last 4 hours to succeed. |
- The report is returned as a base64 encoded blob within the response. |
- """ |
- params = {} |
- return self.get_response('GetCredentialReport', params) |
- |
- def create_virtual_mfa_device(self, path, device_name): |
- """ |
- Creates a new virtual MFA device for the AWS account. |
- |
- After creating the virtual MFA, use enable-mfa-device to |
- attach the MFA device to an IAM user. |
- |
- :type path: string |
- :param path: The path for the virtual MFA device. |
- |
- :type device_name: string |
- :param device_name: The name of the virtual MFA device. |
- Used with path to uniquely identify a virtual MFA device. |
- |
- """ |
- params = { |
- 'Path': path, |
- 'VirtualMFADeviceName': device_name |
- } |
- return self.get_response('CreateVirtualMFADevice', params) |
- |
- # |
- # IAM password policy |
- # |
- |
- def get_account_password_policy(self): |
- """ |
- Returns the password policy for the AWS account. |
- """ |
- params = {} |
- return self.get_response('GetAccountPasswordPolicy', params) |
- |
- def delete_account_password_policy(self): |
- """ |
- Delete the password policy currently set for the AWS account. |
- """ |
- params = {} |
- return self.get_response('DeleteAccountPasswordPolicy', params) |
- |
- def update_account_password_policy(self, allow_users_to_change_password=None, |
- hard_expiry=None, max_password_age=None , |
- minimum_password_length=None , |
- password_reuse_prevention=None, |
- require_lowercase_characters=None, |
- require_numbers=None, require_symbols=None , |
- require_uppercase_characters=None): |
- """ |
- Update the password policy for the AWS account. |
- |
- Notes: unset parameters will be reset to Amazon default settings! |
- Most of the password policy settings are enforced the next time your users |
- change their passwords. When you set minimum length and character type |
- requirements, they are enforced the next time your users change their |
- passwords - users are not forced to change their existing passwords, even |
- if the pre-existing passwords do not adhere to the updated password |
- policy. When you set a password expiration period, the expiration period |
- is enforced immediately. |
- |
- :type allow_users_to_change_password: bool |
- :param allow_users_to_change_password: Allows all IAM users in your account |
- to use the AWS Management Console to change their own passwords. |
- |
- :type hard_expiry: bool |
- :param hard_expiry: Prevents IAM users from setting a new password after |
- their password has expired. |
- |
- :type max_password_age: int |
- :param max_password_age: The number of days that an IAM user password is valid. |
- |
- :type minimum_password_length: int |
- :param minimum_password_length: The minimum number of characters allowed in |
- an IAM user password. |
- |
- :type password_reuse_prevention: int |
- :param password_reuse_prevention: Specifies the number of previous passwords |
- that IAM users are prevented from reusing. |
- |
- :type require_lowercase_characters: bool |
- :param require_lowercase_characters: Specifies whether IAM user passwords |
- must contain at least one lowercase character from the ISO basic Latin |
- alphabet (``a`` to ``z``). |
- |
- :type require_numbers: bool |
- :param require_numbers: Specifies whether IAM user passwords must contain at |
- least one numeric character (``0`` to ``9``). |
- |
- :type require_symbols: bool |
- :param require_symbols: Specifies whether IAM user passwords must contain at |
- least one of the following non-alphanumeric characters: |
- ``! @ # $ % ^ & * ( ) _ + - = [ ] { } | '`` |
- |
- :type require_uppercase_characters: bool |
- :param require_uppercase_characters: Specifies whether IAM user passwords |
- must contain at least one uppercase character from the ISO basic Latin |
- alphabet (``A`` to ``Z``). |
- """ |
- params = {} |
- if allow_users_to_change_password is not None and type(allow_users_to_change_password) is bool: |
- params['AllowUsersToChangePassword'] = str(allow_users_to_change_password).lower() |
- if hard_expiry is not None and type(allow_users_to_change_password) is bool: |
- params['HardExpiry'] = str(hard_expiry).lower() |
- if max_password_age is not None: |
- params['MaxPasswordAge'] = max_password_age |
- if minimum_password_length is not None: |
- params['MinimumPasswordLength'] = minimum_password_length |
- if password_reuse_prevention is not None: |
- params['PasswordReusePrevention'] = password_reuse_prevention |
- if require_lowercase_characters is not None and type(allow_users_to_change_password) is bool: |
- params['RequireLowercaseCharacters'] = str(require_lowercase_characters).lower() |
- if require_numbers is not None and type(allow_users_to_change_password) is bool: |
- params['RequireNumbers'] = str(require_numbers).lower() |
- if require_symbols is not None and type(allow_users_to_change_password) is bool: |
- params['RequireSymbols'] = str(require_symbols).lower() |
- if require_uppercase_characters is not None and type(allow_users_to_change_password) is bool: |
- params['RequireUppercaseCharacters'] = str(require_uppercase_characters).lower() |
- return self.get_response('UpdateAccountPasswordPolicy', params) |