| # Copyright (c) 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved |
| # |
| # Permission is hereby granted, free of charge, to any person obtaining a |
| # copy of this software and associated documentation files (the |
| # "Software"), to deal in the Software without restriction, including |
| # without limitation the rights to use, copy, modify, merge, publish, dis- |
| # tribute, sublicense, and/or sell copies of the Software, and to permit |
| # persons to whom the Software is furnished to do so, subject to the fol- |
| # lowing conditions: |
| # |
| # The above copyright notice and this permission notice shall be included |
| # in all copies or substantial portions of the Software. |
| # |
| # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS |
| # OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABIL- |
| # ITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT |
| # SHALL THE AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, |
| # WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
| # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS |
| # IN THE SOFTWARE. |
| # |
| |
| import boto |
| from boto.compat import json |
| from boto.connection import AWSQueryConnection |
| from boto.regioninfo import RegionInfo |
| from boto.exception import JSONResponseError |
| from boto.cloudhsm import exceptions |
| |
| |
| class CloudHSMConnection(AWSQueryConnection): |
| """ |
| AWS CloudHSM Service |
| """ |
| APIVersion = "2014-05-30" |
| DefaultRegionName = "us-east-1" |
| DefaultRegionEndpoint = "cloudhsm.us-east-1.amazonaws.com" |
| ServiceName = "CloudHSM" |
| TargetPrefix = "CloudHsmFrontendService" |
| ResponseError = JSONResponseError |
| |
| _faults = { |
| "InvalidRequestException": exceptions.InvalidRequestException, |
| "CloudHsmServiceException": exceptions.CloudHsmServiceException, |
| "CloudHsmInternalException": exceptions.CloudHsmInternalException, |
| } |
| |
| |
| def __init__(self, **kwargs): |
| region = kwargs.pop('region', None) |
| if not region: |
| region = RegionInfo(self, self.DefaultRegionName, |
| self.DefaultRegionEndpoint) |
| |
| if 'host' not in kwargs or kwargs['host'] is None: |
| kwargs['host'] = region.endpoint |
| |
| super(CloudHSMConnection, self).__init__(**kwargs) |
| self.region = region |
| |
| def _required_auth_capability(self): |
| return ['hmac-v4'] |
| |
| def create_hapg(self, label): |
| """ |
| Creates a high-availability partition group. A high- |
| availability partition group is a group of partitions that |
| spans multiple physical HSMs. |
| |
| :type label: string |
| :param label: The label of the new high-availability partition group. |
| |
| """ |
| params = {'Label': label, } |
| return self.make_request(action='CreateHapg', |
| body=json.dumps(params)) |
| |
| def create_hsm(self, subnet_id, ssh_key, iam_role_arn, subscription_type, |
| eni_ip=None, external_id=None, client_token=None, |
| syslog_ip=None): |
| """ |
| Creates an uninitialized HSM instance. Running this command |
| provisions an HSM appliance and will result in charges to your |
| AWS account for the HSM. |
| |
| :type subnet_id: string |
| :param subnet_id: The identifier of the subnet in your VPC in which to |
| place the HSM. |
| |
| :type ssh_key: string |
| :param ssh_key: The SSH public key to install on the HSM. |
| |
| :type eni_ip: string |
| :param eni_ip: The IP address to assign to the HSM's ENI. |
| |
| :type iam_role_arn: string |
| :param iam_role_arn: The ARN of an IAM role to enable the AWS CloudHSM |
| service to allocate an ENI on your behalf. |
| |
| :type external_id: string |
| :param external_id: The external ID from **IamRoleArn**, if present. |
| |
| :type subscription_type: string |
| :param subscription_type: The subscription type. |
| |
| :type client_token: string |
| :param client_token: A user-defined token to ensure idempotence. |
| Subsequent calls to this action with the same token will be |
| ignored. |
| |
| :type syslog_ip: string |
| :param syslog_ip: The IP address for the syslog monitoring server. |
| |
| """ |
| params = { |
| 'SubnetId': subnet_id, |
| 'SshKey': ssh_key, |
| 'IamRoleArn': iam_role_arn, |
| 'SubscriptionType': subscription_type, |
| } |
| if eni_ip is not None: |
| params['EniIp'] = eni_ip |
| if external_id is not None: |
| params['ExternalId'] = external_id |
| if client_token is not None: |
| params['ClientToken'] = client_token |
| if syslog_ip is not None: |
| params['SyslogIp'] = syslog_ip |
| return self.make_request(action='CreateHsm', |
| body=json.dumps(params)) |
| |
| def create_luna_client(self, certificate, label=None): |
| """ |
| Creates an HSM client. |
| |
| :type label: string |
| :param label: The label for the client. |
| |
| :type certificate: string |
| :param certificate: The contents of a Base64-Encoded X.509 v3 |
| certificate to be installed on the HSMs used by this client. |
| |
| """ |
| params = {'Certificate': certificate, } |
| if label is not None: |
| params['Label'] = label |
| return self.make_request(action='CreateLunaClient', |
| body=json.dumps(params)) |
| |
| def delete_hapg(self, hapg_arn): |
| """ |
| Deletes a high-availability partition group. |
| |
| :type hapg_arn: string |
| :param hapg_arn: The ARN of the high-availability partition group to |
| delete. |
| |
| """ |
| params = {'HapgArn': hapg_arn, } |
| return self.make_request(action='DeleteHapg', |
| body=json.dumps(params)) |
| |
| def delete_hsm(self, hsm_arn): |
| """ |
| Deletes an HSM. Once complete, this operation cannot be undone |
| and your key material cannot be recovered. |
| |
| :type hsm_arn: string |
| :param hsm_arn: The ARN of the HSM to delete. |
| |
| """ |
| params = {'HsmArn': hsm_arn, } |
| return self.make_request(action='DeleteHsm', |
| body=json.dumps(params)) |
| |
| def delete_luna_client(self, client_arn): |
| """ |
| Deletes a client. |
| |
| :type client_arn: string |
| :param client_arn: The ARN of the client to delete. |
| |
| """ |
| params = {'ClientArn': client_arn, } |
| return self.make_request(action='DeleteLunaClient', |
| body=json.dumps(params)) |
| |
| def describe_hapg(self, hapg_arn): |
| """ |
| Retrieves information about a high-availability partition |
| group. |
| |
| :type hapg_arn: string |
| :param hapg_arn: The ARN of the high-availability partition group to |
| describe. |
| |
| """ |
| params = {'HapgArn': hapg_arn, } |
| return self.make_request(action='DescribeHapg', |
| body=json.dumps(params)) |
| |
| def describe_hsm(self, hsm_arn=None, hsm_serial_number=None): |
| """ |
| Retrieves information about an HSM. You can identify the HSM |
| by its ARN or its serial number. |
| |
| :type hsm_arn: string |
| :param hsm_arn: The ARN of the HSM. Either the HsmArn or the |
| SerialNumber parameter must be specified. |
| |
| :type hsm_serial_number: string |
| :param hsm_serial_number: The serial number of the HSM. Either the |
| HsmArn or the HsmSerialNumber parameter must be specified. |
| |
| """ |
| params = {} |
| if hsm_arn is not None: |
| params['HsmArn'] = hsm_arn |
| if hsm_serial_number is not None: |
| params['HsmSerialNumber'] = hsm_serial_number |
| return self.make_request(action='DescribeHsm', |
| body=json.dumps(params)) |
| |
| def describe_luna_client(self, client_arn=None, |
| certificate_fingerprint=None): |
| """ |
| Retrieves information about an HSM client. |
| |
| :type client_arn: string |
| :param client_arn: The ARN of the client. |
| |
| :type certificate_fingerprint: string |
| :param certificate_fingerprint: The certificate fingerprint. |
| |
| """ |
| params = {} |
| if client_arn is not None: |
| params['ClientArn'] = client_arn |
| if certificate_fingerprint is not None: |
| params['CertificateFingerprint'] = certificate_fingerprint |
| return self.make_request(action='DescribeLunaClient', |
| body=json.dumps(params)) |
| |
| def get_config(self, client_arn, client_version, hapg_list): |
| """ |
| Gets the configuration files necessary to connect to all high |
| availability partition groups the client is associated with. |
| |
| :type client_arn: string |
| :param client_arn: The ARN of the client. |
| |
| :type client_version: string |
| :param client_version: The client version. |
| |
| :type hapg_list: list |
| :param hapg_list: A list of ARNs that identify the high-availability |
| partition groups that are associated with the client. |
| |
| """ |
| params = { |
| 'ClientArn': client_arn, |
| 'ClientVersion': client_version, |
| 'HapgList': hapg_list, |
| } |
| return self.make_request(action='GetConfig', |
| body=json.dumps(params)) |
| |
| def list_available_zones(self): |
| """ |
| Lists the Availability Zones that have available AWS CloudHSM |
| capacity. |
| |
| |
| """ |
| params = {} |
| return self.make_request(action='ListAvailableZones', |
| body=json.dumps(params)) |
| |
| def list_hapgs(self, next_token=None): |
| """ |
| Lists the high-availability partition groups for the account. |
| |
| This operation supports pagination with the use of the |
| NextToken member. If more results are available, the NextToken |
| member of the response contains a token that you pass in the |
| next call to ListHapgs to retrieve the next set of items. |
| |
| :type next_token: string |
| :param next_token: The NextToken value from a previous call to |
| ListHapgs. Pass null if this is the first call. |
| |
| """ |
| params = {} |
| if next_token is not None: |
| params['NextToken'] = next_token |
| return self.make_request(action='ListHapgs', |
| body=json.dumps(params)) |
| |
| def list_hsms(self, next_token=None): |
| """ |
| Retrieves the identifiers of all of the HSMs provisioned for |
| the current customer. |
| |
| This operation supports pagination with the use of the |
| NextToken member. If more results are available, the NextToken |
| member of the response contains a token that you pass in the |
| next call to ListHsms to retrieve the next set of items. |
| |
| :type next_token: string |
| :param next_token: The NextToken value from a previous call to |
| ListHsms. Pass null if this is the first call. |
| |
| """ |
| params = {} |
| if next_token is not None: |
| params['NextToken'] = next_token |
| return self.make_request(action='ListHsms', |
| body=json.dumps(params)) |
| |
| def list_luna_clients(self, next_token=None): |
| """ |
| Lists all of the clients. |
| |
| This operation supports pagination with the use of the |
| NextToken member. If more results are available, the NextToken |
| member of the response contains a token that you pass in the |
| next call to ListLunaClients to retrieve the next set of |
| items. |
| |
| :type next_token: string |
| :param next_token: The NextToken value from a previous call to |
| ListLunaClients. Pass null if this is the first call. |
| |
| """ |
| params = {} |
| if next_token is not None: |
| params['NextToken'] = next_token |
| return self.make_request(action='ListLunaClients', |
| body=json.dumps(params)) |
| |
| def modify_hapg(self, hapg_arn, label=None, partition_serial_list=None): |
| """ |
| Modifies an existing high-availability partition group. |
| |
| :type hapg_arn: string |
| :param hapg_arn: The ARN of the high-availability partition group to |
| modify. |
| |
| :type label: string |
| :param label: The new label for the high-availability partition group. |
| |
| :type partition_serial_list: list |
| :param partition_serial_list: The list of partition serial numbers to |
| make members of the high-availability partition group. |
| |
| """ |
| params = {'HapgArn': hapg_arn, } |
| if label is not None: |
| params['Label'] = label |
| if partition_serial_list is not None: |
| params['PartitionSerialList'] = partition_serial_list |
| return self.make_request(action='ModifyHapg', |
| body=json.dumps(params)) |
| |
| def modify_hsm(self, hsm_arn, subnet_id=None, eni_ip=None, |
| iam_role_arn=None, external_id=None, syslog_ip=None): |
| """ |
| Modifies an HSM. |
| |
| :type hsm_arn: string |
| :param hsm_arn: The ARN of the HSM to modify. |
| |
| :type subnet_id: string |
| :param subnet_id: The new identifier of the subnet that the HSM is in. |
| |
| :type eni_ip: string |
| :param eni_ip: The new IP address for the elastic network interface |
| attached to the HSM. |
| |
| :type iam_role_arn: string |
| :param iam_role_arn: The new IAM role ARN. |
| |
| :type external_id: string |
| :param external_id: The new external ID. |
| |
| :type syslog_ip: string |
| :param syslog_ip: The new IP address for the syslog monitoring server. |
| |
| """ |
| params = {'HsmArn': hsm_arn, } |
| if subnet_id is not None: |
| params['SubnetId'] = subnet_id |
| if eni_ip is not None: |
| params['EniIp'] = eni_ip |
| if iam_role_arn is not None: |
| params['IamRoleArn'] = iam_role_arn |
| if external_id is not None: |
| params['ExternalId'] = external_id |
| if syslog_ip is not None: |
| params['SyslogIp'] = syslog_ip |
| return self.make_request(action='ModifyHsm', |
| body=json.dumps(params)) |
| |
| def modify_luna_client(self, client_arn, certificate): |
| """ |
| Modifies the certificate used by the client. |
| |
| This action can potentially start a workflow to install the |
| new certificate on the client's HSMs. |
| |
| :type client_arn: string |
| :param client_arn: The ARN of the client. |
| |
| :type certificate: string |
| :param certificate: The new certificate for the client. |
| |
| """ |
| params = { |
| 'ClientArn': client_arn, |
| 'Certificate': certificate, |
| } |
| return self.make_request(action='ModifyLunaClient', |
| body=json.dumps(params)) |
| |
| def make_request(self, action, body): |
| headers = { |
| 'X-Amz-Target': '%s.%s' % (self.TargetPrefix, action), |
| 'Host': self.region.endpoint, |
| 'Content-Type': 'application/x-amz-json-1.1', |
| 'Content-Length': str(len(body)), |
| } |
| http_request = self.build_base_http_request( |
| method='POST', path='/', auth_path='/', params={}, |
| headers=headers, data=body) |
| response = self._mexe(http_request, sender=None, |
| override_num_retries=10) |
| response_body = response.read().decode('utf-8') |
| boto.log.debug(response_body) |
| if response.status == 200: |
| if response_body: |
| return json.loads(response_body) |
| else: |
| json_body = json.loads(response_body) |
| fault_name = json_body.get('__type', None) |
| exception_class = self._faults.get(fault_name, self.ResponseError) |
| raise exception_class(response.status, response.reason, |
| body=json_body) |
| |
