Search in sources :

Example 1 with ListRolePoliciesRequest

use of com.amazonaws.services.identitymanagement.model.ListRolePoliciesRequest in project cloudbreak by hortonworks.

the class AwsSetup method validateInstanceProfileCreation.

private void validateInstanceProfileCreation(AwsCredentialView awsCredentialView) {
    GetRoleRequest roleRequest = new GetRoleRequest();
    String roleName = awsCredentialView.getRoleArn().split("/")[1];
    LOGGER.info("Start validate {} role for S3 access.", roleName);
    roleRequest.withRoleName(roleName);
    AmazonIdentityManagement client = awsClient.createAmazonIdentityManagement(awsCredentialView);
    try {
        ListRolePoliciesRequest listRolePoliciesRequest = new ListRolePoliciesRequest();
        listRolePoliciesRequest.setRoleName(roleName);
        ListRolePoliciesResult listRolePoliciesResult = client.listRolePolicies(listRolePoliciesRequest);
        for (String s : listRolePoliciesResult.getPolicyNames()) {
            if (checkIamOrS3Statement(roleName, client, s)) {
                LOGGER.info("Validation successful for s3 or iam access.");
                return;
            }
        }
        ListAttachedRolePoliciesRequest listAttachedRolePoliciesRequest = new ListAttachedRolePoliciesRequest();
        listAttachedRolePoliciesRequest.setRoleName(roleName);
        ListAttachedRolePoliciesResult listAttachedRolePoliciesResult = client.listAttachedRolePolicies(listAttachedRolePoliciesRequest);
        for (AttachedPolicy attachedPolicy : listAttachedRolePoliciesResult.getAttachedPolicies()) {
            if (checkIamOrS3Access(client, attachedPolicy)) {
                LOGGER.info("Validation successful for s3 or iam access.");
                return;
            }
        }
    } catch (AmazonServiceException ase) {
        if (ase.getStatusCode() == UNAUTHORIZED) {
            String policyMEssage = "Could not get policies on the role because the arn role do not have enough permission: %s";
            LOGGER.info(String.format(policyMEssage, ase.getErrorMessage()));
            throw new CloudConnectorException(String.format(policyMEssage, ase.getErrorMessage()));
        } else {
            LOGGER.info(ase.getMessage());
            throw new CloudConnectorException(ase.getErrorMessage());
        }
    } catch (Exception e) {
        LOGGER.info(e.getMessage());
        throw new CloudConnectorException(e.getMessage());
    }
    LOGGER.info("Could not get policies on the role because the arn role do not have enough permission.");
    throw new CloudConnectorException("Could not get policies on the role because the arn role do not have enough permission.");
}
Also used : ListAttachedRolePoliciesResult(com.amazonaws.services.identitymanagement.model.ListAttachedRolePoliciesResult) ListRolePoliciesResult(com.amazonaws.services.identitymanagement.model.ListRolePoliciesResult) AttachedPolicy(com.amazonaws.services.identitymanagement.model.AttachedPolicy) CloudConnectorException(com.sequenceiq.cloudbreak.cloud.exception.CloudConnectorException) AmazonServiceException(com.amazonaws.AmazonServiceException) GetRoleRequest(com.amazonaws.services.identitymanagement.model.GetRoleRequest) ListAttachedRolePoliciesRequest(com.amazonaws.services.identitymanagement.model.ListAttachedRolePoliciesRequest) ListRolePoliciesRequest(com.amazonaws.services.identitymanagement.model.ListRolePoliciesRequest) AmazonIdentityManagement(com.amazonaws.services.identitymanagement.AmazonIdentityManagement) AmazonServiceException(com.amazonaws.AmazonServiceException) AmazonClientException(com.amazonaws.AmazonClientException) CloudConnectorException(com.sequenceiq.cloudbreak.cloud.exception.CloudConnectorException)

Aggregations

AmazonClientException (com.amazonaws.AmazonClientException)1 AmazonServiceException (com.amazonaws.AmazonServiceException)1 AmazonIdentityManagement (com.amazonaws.services.identitymanagement.AmazonIdentityManagement)1 AttachedPolicy (com.amazonaws.services.identitymanagement.model.AttachedPolicy)1 GetRoleRequest (com.amazonaws.services.identitymanagement.model.GetRoleRequest)1 ListAttachedRolePoliciesRequest (com.amazonaws.services.identitymanagement.model.ListAttachedRolePoliciesRequest)1 ListAttachedRolePoliciesResult (com.amazonaws.services.identitymanagement.model.ListAttachedRolePoliciesResult)1 ListRolePoliciesRequest (com.amazonaws.services.identitymanagement.model.ListRolePoliciesRequest)1 ListRolePoliciesResult (com.amazonaws.services.identitymanagement.model.ListRolePoliciesResult)1 CloudConnectorException (com.sequenceiq.cloudbreak.cloud.exception.CloudConnectorException)1