Skip to content

Commit 9bca0e5

Browse files
kk1532kk1532
authored
aws - emr - security configuration filter (cloud-custodian#8268)
1 parent 23de69a commit 9bca0e5

8 files changed

+372
-1
lines changed

‎c7n/resources/emr.py

+40-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77

88
from c7n.actions import ActionRegistry, BaseAction
99
from c7n.exceptions import PolicyValidationError
10-
from c7n.filters import FilterRegistry, MetricsFilter
10+
from c7n.filters import FilterRegistry, MetricsFilter, ValueFilter
1111
from c7n.manager import resources
1212
from c7n.query import QueryResourceManager, TypeInfo, ConfigSource, DescribeSource
1313
from c7n.tags import universal_augment
@@ -307,6 +307,45 @@ def get_related_ids(self, resources):
307307
filters.register('network-location', net_filters.NetworkLocation)
308308

309309

310+
@filters.register('security-configuration')
311+
class EMRSecurityConfigurationFilter(ValueFilter):
312+
"""Filter for annotate security configuration and
313+
filter based on its attributes.
314+
315+
:example:
316+
317+
.. code-block:: yaml
318+
319+
policies:
320+
- name: emr-security-configuration
321+
resource: emr
322+
filters:
323+
- type: security-configuration
324+
key: EnableAtRestEncryption
325+
value: true
326+
327+
"""
328+
annotation_key = 'c7n:SecurityConfiguration'
329+
permissions = ("elasticmapreduce:ListSecurityConfigurations",
330+
"elasticmapreduce:DescribeSecurityConfiguration",)
331+
schema = type_schema('security-configuration', rinherit=ValueFilter.schema)
332+
schema_alias = False
333+
334+
def process(self, resources, event=None):
335+
results = []
336+
emr_sec_cfgs = {
337+
cfg['Name']: cfg for cfg in self.manager.get_resource_manager(
338+
'emr-security-configuration').resources()}
339+
for r in resources:
340+
if 'SecurityConfiguration' not in r:
341+
continue
342+
cfg = emr_sec_cfgs.get(r['SecurityConfiguration'], {}).get('SecurityConfiguration', {})
343+
if self.match(cfg):
344+
r[self.annotation_key] = cfg
345+
results.append(r)
346+
return results
347+
348+
310349
@resources.register('emr-security-configuration')
311350
class EMRSecurityConfiguration(QueryResourceManager):
312351
"""Resource manager for EMR Security Configuration

‎tests/data/placebo/test_emr_sc/elasticmapreduce.DescribeCluster_1.json

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"status_code": 200,
3+
"data": {
4+
"Cluster": {
5+
"Id": "j-1OBEPJWLJBMDO",
6+
"Name": "Test cluster1",
7+
"Status": {
8+
"State": "WAITING",
9+
"StateChangeReason": {
10+
"Message": "Cluster ready to run steps."
11+
},
12+
"Timeline": {
13+
"CreationDateTime": {
14+
"__class__": "datetime",
15+
"year": 2023,
16+
"month": 1,
17+
"day": 18,
18+
"hour": 21,
19+
"minute": 7,
20+
"second": 52,
21+
"microsecond": 540000
22+
},
23+
"ReadyDateTime": {
24+
"__class__": "datetime",
25+
"year": 2023,
26+
"month": 1,
27+
"day": 18,
28+
"hour": 21,
29+
"minute": 13,
30+
"second": 18,
31+
"microsecond": 256000
32+
}
33+
}
34+
},
35+
"Ec2InstanceAttributes": {
36+
"Ec2SubnetId": "subnet-0f3b0ee5d4a7da815",
37+
"RequestedEc2SubnetIds": [
38+
"subnet-0f3b0ee5d4a7da815"
39+
],
40+
"Ec2AvailabilityZone": "us-west-2a",
41+
"RequestedEc2AvailabilityZones": [],
42+
"IamInstanceProfile": "EMR_EC2_DefaultRole",
43+
"EmrManagedMasterSecurityGroup": "sg-05e325f9b09aa11fc",
44+
"EmrManagedSlaveSecurityGroup": "sg-03c8063bd682c0ebe",
45+
"ServiceAccessSecurityGroup": "sg-0b238edeeb3fe44eb",
46+
"AdditionalMasterSecurityGroups": [],
47+
"AdditionalSlaveSecurityGroups": []
48+
},
49+
"InstanceCollectionType": "INSTANCE_GROUP",
50+
"ReleaseLabel": "emr-6.9.0",
51+
"AutoTerminate": false,
52+
"TerminationProtected": true,
53+
"VisibleToAllUsers": true,
54+
"Applications": [
55+
{
56+
"Name": "Spark",
57+
"Version": "3.3.0"
58+
},
59+
{
60+
"Name": "Zeppelin",
61+
"Version": "0.10.1"
62+
}
63+
],
64+
"Tags": [],
65+
"ServiceRole": "EMR_DefaultRole",
66+
"NormalizedInstanceHours": 0,
67+
"MasterPublicDnsName": "ip-10-0-2-44.us-west-2.compute.internal",
68+
"Configurations": [],
69+
"SecurityConfiguration": "AtRestEnabled",
70+
"ScaleDownBehavior": "TERMINATE_AT_TASK_COMPLETION",
71+
"EbsRootVolumeSize": 10,
72+
"KerberosAttributes": {},
73+
"ClusterArn": "arn:aws:elasticmapreduce:us-west-2:644160558196:cluster/j-1OBEPJWLJBMDO",
74+
"StepConcurrencyLevel": 1,
75+
"PlacementGroups": [],
76+
"OSReleaseLabel": "2.0.20221210.1"
77+
},
78+
"ResponseMetadata": {}
79+
}
80+
}

‎tests/data/placebo/test_emr_sc/elasticmapreduce.DescribeCluster_2.json

+78
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
"status_code": 200,
3+
"data": {
4+
"Cluster": {
5+
"Id": "j-1QXCH9K3E0NMM",
6+
"Name": "Test cluster2",
7+
"Status": {
8+
"State": "WAITING",
9+
"StateChangeReason": {
10+
"Message": "Cluster ready to run steps."
11+
},
12+
"Timeline": {
13+
"CreationDateTime": {
14+
"__class__": "datetime",
15+
"year": 2023,
16+
"month": 1,
17+
"day": 13,
18+
"hour": 17,
19+
"minute": 13,
20+
"second": 1,
21+
"microsecond": 542000
22+
},
23+
"ReadyDateTime": {
24+
"__class__": "datetime",
25+
"year": 2023,
26+
"month": 1,
27+
"day": 13,
28+
"hour": 17,
29+
"minute": 18,
30+
"second": 31,
31+
"microsecond": 240000
32+
}
33+
}
34+
},
35+
"Ec2InstanceAttributes": {
36+
"Ec2SubnetId": "subnet-0f3b0ee5d4a7da815",
37+
"RequestedEc2SubnetIds": [
38+
"subnet-0f3b0ee5d4a7da815"
39+
],
40+
"Ec2AvailabilityZone": "us-west-2a",
41+
"RequestedEc2AvailabilityZones": [],
42+
"IamInstanceProfile": "EMR_EC2_DefaultRole",
43+
"EmrManagedMasterSecurityGroup": "sg-05e325f9b09aa11fc",
44+
"EmrManagedSlaveSecurityGroup": "sg-03c8063bd682c0ebe",
45+
"ServiceAccessSecurityGroup": "sg-0b238edeeb3fe44eb",
46+
"AdditionalMasterSecurityGroups": [],
47+
"AdditionalSlaveSecurityGroups": []
48+
},
49+
"InstanceCollectionType": "INSTANCE_GROUP",
50+
"ReleaseLabel": "emr-6.9.0",
51+
"AutoTerminate": false,
52+
"TerminationProtected": true,
53+
"VisibleToAllUsers": true,
54+
"Applications": [
55+
{
56+
"Name": "Spark",
57+
"Version": "3.3.0"
58+
},
59+
{
60+
"Name": "Zeppelin",
61+
"Version": "0.10.1"
62+
}
63+
],
64+
"Tags": [],
65+
"ServiceRole": "arn:aws:iam::644160558196:role/EMR_DefaultRole",
66+
"NormalizedInstanceHours": 5952,
67+
"MasterPublicDnsName": "ip-10-0-2-77.us-west-2.compute.internal",
68+
"Configurations": [],
69+
"ScaleDownBehavior": "TERMINATE_AT_TASK_COMPLETION",
70+
"KerberosAttributes": {},
71+
"ClusterArn": "arn:aws:elasticmapreduce:us-west-2:644160558196:cluster/j-1QXCH9K3E0NMM",
72+
"StepConcurrencyLevel": 1,
73+
"PlacementGroups": [],
74+
"OSReleaseLabel": "2.0.20221210.1"
75+
},
76+
"ResponseMetadata": {}
77+
}
78+
}

‎tests/data/placebo/test_emr_sc/elasticmapreduce.DescribeSecurityConfiguration_1.json

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"status_code": 200,
3+
"data": {
4+
"Name": "AtRestEnabled",
5+
"SecurityConfiguration": "{\"EncryptionConfiguration\":{\"AtRestEncryptionConfiguration\":{\"S3EncryptionConfiguration\":{\"EncryptionMode\":\"SSE-S3\"}},\"EnableInTransitEncryption\":false,\"EnableAtRestEncryption\":true}}",
6+
"CreationDateTime": {
7+
"__class__": "datetime",
8+
"year": 2023,
9+
"month": 1,
10+
"day": 18,
11+
"hour": 21,
12+
"minute": 5,
13+
"second": 46,
14+
"microsecond": 879000
15+
},
16+
"ResponseMetadata": {}
17+
}
18+
}

‎tests/data/placebo/test_emr_sc/elasticmapreduce.DescribeSecurityConfiguration_2.json

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"status_code": 200,
3+
"data": {
4+
"Name": "In-Transit",
5+
"SecurityConfiguration": "{\"EncryptionConfiguration\":{\"InTransitEncryptionConfiguration\":{\"TLSCertificateConfiguration\":{\"CertificateProviderType\":\"PEM\",\"S3Object\":\"s3://openssl-emr/my-certs.zip\"}},\"EnableInTransitEncryption\":true,\"EnableAtRestEncryption\":false}}",
6+
"CreationDateTime": {
7+
"__class__": "datetime",
8+
"year": 2023,
9+
"month": 1,
10+
"day": 11,
11+
"hour": 15,
12+
"minute": 55,
13+
"second": 16,
14+
"microsecond": 102000
15+
},
16+
"ResponseMetadata": {}
17+
}
18+
}

‎tests/data/placebo/test_emr_sc/elasticmapreduce.ListClusters_1.json

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"status_code": 200,
3+
"data": {
4+
"Clusters": [
5+
{
6+
"Id": "j-1OBEPJWLJBMDO",
7+
"Name": "Test cluster1",
8+
"Status": {
9+
"State": "WAITING",
10+
"StateChangeReason": {
11+
"Message": "Cluster ready to run steps."
12+
},
13+
"Timeline": {
14+
"CreationDateTime": {
15+
"__class__": "datetime",
16+
"year": 2023,
17+
"month": 1,
18+
"day": 18,
19+
"hour": 21,
20+
"minute": 7,
21+
"second": 52,
22+
"microsecond": 540000
23+
},
24+
"ReadyDateTime": {
25+
"__class__": "datetime",
26+
"year": 2023,
27+
"month": 1,
28+
"day": 18,
29+
"hour": 21,
30+
"minute": 13,
31+
"second": 18,
32+
"microsecond": 256000
33+
}
34+
}
35+
},
36+
"NormalizedInstanceHours": 0,
37+
"ClusterArn": "arn:aws:elasticmapreduce:us-west-2:644160558196:cluster/j-1OBEPJWLJBMDO"
38+
},
39+
{
40+
"Id": "j-1QXCH9K3E0NMM",
41+
"Name": "Test cluster2",
42+
"Status": {
43+
"State": "WAITING",
44+
"StateChangeReason": {
45+
"Message": "Cluster ready to run steps."
46+
},
47+
"Timeline": {
48+
"CreationDateTime": {
49+
"__class__": "datetime",
50+
"year": 2023,
51+
"month": 1,
52+
"day": 13,
53+
"hour": 17,
54+
"minute": 13,
55+
"second": 1,
56+
"microsecond": 542000
57+
},
58+
"ReadyDateTime": {
59+
"__class__": "datetime",
60+
"year": 2023,
61+
"month": 1,
62+
"day": 13,
63+
"hour": 17,
64+
"minute": 18,
65+
"second": 31,
66+
"microsecond": 240000
67+
}
68+
}
69+
},
70+
"NormalizedInstanceHours": 5952,
71+
"ClusterArn": "arn:aws:elasticmapreduce:us-west-2:644160558196:cluster/j-1QXCH9K3E0NMM"
72+
}
73+
],
74+
"ResponseMetadata": {}
75+
}
76+
}

‎tests/data/placebo/test_emr_sc/elasticmapreduce.ListSecurityConfigurations_1.json

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"status_code": 200,
3+
"data": {
4+
"SecurityConfigurations": [
5+
{
6+
"Name": "AtRestEnabled",
7+
"CreationDateTime": {
8+
"__class__": "datetime",
9+
"year": 2023,
10+
"month": 1,
11+
"day": 18,
12+
"hour": 21,
13+
"minute": 5,
14+
"second": 46,
15+
"microsecond": 879000
16+
}
17+
},
18+
{
19+
"Name": "In-Transit",
20+
"CreationDateTime": {
21+
"__class__": "datetime",
22+
"year": 2023,
23+
"month": 1,
24+
"day": 11,
25+
"hour": 15,
26+
"minute": 55,
27+
"second": 16,
28+
"microsecond": 102000
29+
}
30+
}
31+
],
32+
"ResponseMetadata": {}
33+
}
34+
}

0 commit comments

Comments
 (0)