diff --git a/roles/aws/aws_admin_tools/defaults/main.yml b/roles/aws/aws_admin_tools/defaults/main.yml index 2ba6159df..ab8a82f0a 100644 --- a/roles/aws/aws_admin_tools/defaults/main.yml +++ b/roles/aws/aws_admin_tools/defaults/main.yml @@ -4,19 +4,40 @@ aws_admin_tools: allowed_ips: - 192.168.1.1/32 # Ip of server with access to API-s functions: - - name: "GetForecastedCosts" + - name: "get_forecasted_costs" type: GET inline_policies: name: "{{ _aws_profile }}Billing" resource: "*" - acton: + action: - "ce:*" policies: [] - - name: "ChangeASGScaling" + - name: "change_asg_scaling" type: POST policies: - arn:aws:iam::aws:policy/AmazonEC2FullAccess - - name: "GetListOfEC2" + - name: "get_list_of_ec2" type: GET - policies: - - arn:aws:iam::aws:policy/AmazonEC2FullAccess + policies: [] + inline_policies: + name: "list_ec2" + resource: "*" + action: + - "ec2:DescribeAddresses" + - "ec2:DescribeInstances" + - name: "get_ip_set" + type: GET + policies: [] + inline_policies: + name: "get_ip_set" + resource: "*" + action: + - "wafv2:GetIPSet" + - name: "update_ip_set" + type: POST + policies: [] + inline_policies: + name: "update_ip_set" + resource: "*" + action: + - "wafv2:UpdateIPSet" diff --git a/roles/aws/aws_admin_tools/tasks/create.yml b/roles/aws/aws_admin_tools/tasks/create.yml index 45b72a3ca..c34889767 100644 --- a/roles/aws/aws_admin_tools/tasks/create.yml +++ b/roles/aws/aws_admin_tools/tasks/create.yml @@ -65,7 +65,7 @@ - name: Update Lambda triggers. ansible.builtin.command: >- aws lambda add-permission - --function-name "API_{{ item.name }}" + --function-name "api_{{ item.name }}" --statement-id "{{ item.name }}_{{ _rand_str }}" --action "lambda:InvokeFunction" --principal apigateway.amazonaws.com diff --git a/roles/aws/aws_admin_tools/tasks/create_methods.yml b/roles/aws/aws_admin_tools/tasks/create_methods.yml index baf864a01..754c12a4b 100644 --- a/roles/aws/aws_admin_tools/tasks/create_methods.yml +++ b/roles/aws/aws_admin_tools/tasks/create_methods.yml @@ -54,7 +54,7 @@ --type AWS --content-handling CONVERT_TO_TEXT --integration-http-method POST - --uri "arn:aws:apigateway:{{ _aws_region }}:lambda:path/2015-03-31/functions/arn:aws:lambda:{{ _aws_region }}:{{ _acc_id }}:function:API_{{ item.name }}/invocations" + --uri "arn:aws:apigateway:{{ _aws_region }}:lambda:path/2015-03-31/functions/arn:aws:lambda:{{ _aws_region }}:{{ _acc_id }}:function:api_{{ item.name }}/invocations" --region {{ _aws_region }} - name: Add method response. diff --git a/roles/aws/aws_admin_tools/tasks/lambda_functions.yml b/roles/aws/aws_admin_tools/tasks/lambda_functions.yml index d107b82f5..448961888 100644 --- a/roles/aws/aws_admin_tools/tasks/lambda_functions.yml +++ b/roles/aws/aws_admin_tools/tasks/lambda_functions.yml @@ -12,30 +12,30 @@ - name: Write Lambda functions. ansible.builtin.template: - src: "API_{{ item.name }}.py.j2" - dest: "/tmp/API_{{ item.name }}.py" + src: "api_{{ item.name }}.py.j2" + dest: "/tmp/api_{{ item.name }}.py" - name: Create a zip archive of Lambda functions. community.general.archive: - path: "/tmp/API_{{ item.name }}.py" - dest: "/tmp/API_{{ item.name }}.zip" + path: "/tmp/api_{{ item.name }}.py" + dest: "/tmp/api_{{ item.name }}.zip" format: zip - name: Place Lambda functions in S3 bucket. amazon.aws.s3_object: bucket: "{{ _aws_profile }}-lambda-api-functions" object: "lambda-functions/API-{{ item.name }}.zip" - src: "/tmp/API_{{ item.name }}.zip" + src: "/tmp/api_{{ item.name }}.zip" mode: put - name: Get appropriate IAM role for Lambda. amazon.aws.iam_role_info: - name: "API_{{ item.name }}" + name: "api_{{ item.name }}" register: _iam_api_lambda - name: Create Lambda functions. amazon.aws.lambda: - name: "API_{{ item.name }}" + name: "api_{{ item.name }}" description: "Lambda function for {{ item.name }}" region: "{{ _aws_region }}" timeout: "{{ aws_admin_tools.timeout }}" @@ -44,6 +44,6 @@ state: present runtime: "{{ aws_admin_tools.runtime }}" role: "{{ _iam_api_lambda.iam_roles[0].arn }}" - handler: "API_{{ item.name }}.lambda_handler" + handler: "api_{{ item.name }}.lambda_handler" tags: - Name: "API_{{ item.name }}" + Name: "api_{{ item.name }}" diff --git a/roles/aws/aws_admin_tools/tasks/lambda_iam.yml b/roles/aws/aws_admin_tools/tasks/lambda_iam.yml index 5e5e5d400..a899e2e04 100644 --- a/roles/aws/aws_admin_tools/tasks/lambda_iam.yml +++ b/roles/aws/aws_admin_tools/tasks/lambda_iam.yml @@ -7,7 +7,8 @@ name: aws/aws_iam_role vars: aws_iam_role: - name: "API_{{ item.name }}" + name: "api_{{ item.name }}" aws_profile: "{{ _aws_profile }}" managed_policies: "{{ _policies }}" + inline_policies: "{{ item.inline_policies | default(omit) }}" policy_document: "{{ lookup('template', 'trusted_entitites.j2') }}" diff --git a/roles/aws/aws_admin_tools/templates/API_ChangeASGScaling.py.j2 b/roles/aws/aws_admin_tools/templates/api_change_asg_scaling.py.j2 similarity index 100% rename from roles/aws/aws_admin_tools/templates/API_ChangeASGScaling.py.j2 rename to roles/aws/aws_admin_tools/templates/api_change_asg_scaling.py.j2 diff --git a/roles/aws/aws_admin_tools/templates/API_GetForecastedCosts.py.j2 b/roles/aws/aws_admin_tools/templates/api_get_forecasted_costs.py.j2 similarity index 100% rename from roles/aws/aws_admin_tools/templates/API_GetForecastedCosts.py.j2 rename to roles/aws/aws_admin_tools/templates/api_get_forecasted_costs.py.j2 diff --git a/roles/aws/aws_admin_tools/templates/api_get_ip_set.py.j2 b/roles/aws/aws_admin_tools/templates/api_get_ip_set.py.j2 new file mode 100644 index 000000000..64a91c0c4 --- /dev/null +++ b/roles/aws/aws_admin_tools/templates/api_get_ip_set.py.j2 @@ -0,0 +1,21 @@ +import json +import boto3 + +waf_cli = boto3.client("wafv2") + +def lambda_handler(event, context): + + print("Gathering instance details.") + ip_set=waf_cli.get_ip_set( + Name=event['ip_set'], + Scope='REGIONAL', + Id=event['id'] + ) + + return { + 'statusCode': 200, + 'name': ip_set['IPSet']['Name'], + 'id': ip_set['IPSet']['Id'], + 'addresses': ip_set['IPSet']['Addresses'], + 'lock_token': ip_set['LockToken'], + } diff --git a/roles/aws/aws_admin_tools/templates/API_GetListOfEC2.py.j2 b/roles/aws/aws_admin_tools/templates/api_get_list_of_ec2.py.j2 similarity index 100% rename from roles/aws/aws_admin_tools/templates/API_GetListOfEC2.py.j2 rename to roles/aws/aws_admin_tools/templates/api_get_list_of_ec2.py.j2 diff --git a/roles/aws/aws_admin_tools/templates/API_tmp.j2 b/roles/aws/aws_admin_tools/templates/api_tmp.j2 similarity index 100% rename from roles/aws/aws_admin_tools/templates/API_tmp.j2 rename to roles/aws/aws_admin_tools/templates/api_tmp.j2 diff --git a/roles/aws/aws_admin_tools/templates/api_update_ip_set.py.j2 b/roles/aws/aws_admin_tools/templates/api_update_ip_set.py.j2 new file mode 100644 index 000000000..08781fb2b --- /dev/null +++ b/roles/aws/aws_admin_tools/templates/api_update_ip_set.py.j2 @@ -0,0 +1,19 @@ +import json +import boto3 + +waf_cli = boto3.client("wafv2") + +def lambda_handler(event, context): + + response = waf_cli.update_ip_set( + Name=event['name'], + Scope=event['scope'], + Id=event['id'], + Addresses=event['addresses'], + LockToken=event['lock_token'] +) + + return { + 'statusCode': 200, + 'body': response + }