|
| 1 | +#!/usr/bin/python |
| 2 | +# -*- coding: utf-8 -*- |
| 3 | + |
| 4 | +# Copyright: Contributors to the Ansible project |
| 5 | +# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) |
| 6 | + |
| 7 | +DOCUMENTATION = r""" |
| 8 | +--- |
| 9 | +module: s3_bucket |
| 10 | +version_added: 9.1.0 |
| 11 | +short_description: Manage SSM document |
| 12 | +description: |
| 13 | + - Create, update or delete a Amazon Web Services Systems Manager (SSM document). |
| 14 | +author: |
| 15 | + - Aubin Bikouo (@abikouo) |
| 16 | +options: |
| 17 | + name: |
| 18 | + description: |
| 19 | + - The name of the document. |
| 20 | + required: true |
| 21 | + type: str |
| 22 | + state: |
| 23 | + description: |
| 24 | + - Create or delete SSM document. |
| 25 | + required: false |
| 26 | + default: present |
| 27 | + choices: [ 'present', 'absent' ] |
| 28 | + type: str |
| 29 | + content: |
| 30 | + description: |
| 31 | + - The content for the new SSM document in JSON or YAML format. |
| 32 | + - Required if O(state=present). |
| 33 | + type: raw |
| 34 | + document_version: |
| 35 | + description: |
| 36 | + - The version of the document that you want to delete. |
| 37 | + - If not provided, all versions of the document are deleted. |
| 38 | + - Ignored if O(state=present). |
| 39 | + type: str |
| 40 | + force_delete: |
| 41 | + description: |
| 42 | + - Some SSM document types require that you specify a Force flag before you can delete the document. |
| 43 | + - Ignored if O(state=present). |
| 44 | + type: bool |
| 45 | + default: false |
| 46 | + document_version_name: |
| 47 | + description: |
| 48 | + - When O(state=absent), specify the version name of the document that you want to delete. |
| 49 | + - When O(state=present), specify the version of the artifact you are creating with the document. |
| 50 | + type: str |
| 51 | + aliases: ['version_name'] |
| 52 | + document_parameters: |
| 53 | + description: |
| 54 | + - Specify the parameters to use when creating the document. |
| 55 | + - Ignored if O(state=absent). |
| 56 | + type: dict |
| 57 | + suboptions: |
| 58 | + document_type: |
| 59 | + description: |
| 60 | + - The type of document to create. |
| 61 | + type: str |
| 62 | + document_format: |
| 63 | + description: |
| 64 | + - Specify the document format. The document format can be JSON, YAML, or TEXT. |
| 65 | + type: str |
| 66 | + default: 'JSON' |
| 67 | + choices: ['JSON', 'YAML', 'TEXT'] |
| 68 | + target_type: |
| 69 | + description: |
| 70 | + - Specify a target type to define the kinds of resources the document can run on. |
| 71 | + type: str |
| 72 | + display_name: |
| 73 | + description: |
| 74 | + - Specify a friendly name for the SSM document. This value can differ for each version of the document. |
| 75 | + type: str |
| 76 | + attachments: |
| 77 | + description: |
| 78 | + - A list of key-value pairs that describe attachments to a version of a document. |
| 79 | + type: list |
| 80 | + elements: dict |
| 81 | + suboptions: |
| 82 | + key: |
| 83 | + description: |
| 84 | + - The key of a key-value pair that identifies the location of an attachment to a document. |
| 85 | + type: str |
| 86 | + values: |
| 87 | + description: |
| 88 | + - The value of a key-value pair that identifies the location of an attachment to a document. |
| 89 | + type: list |
| 90 | + elements: str |
| 91 | + name: |
| 92 | + description: |
| 93 | + - The name of the document attachment file. |
| 94 | + type: str |
| 95 | + requires: |
| 96 | + description: |
| 97 | + - A list of SSM documents required by a document. |
| 98 | + type: list |
| 99 | + elements: dict |
| 100 | + suboptions: |
| 101 | + name: |
| 102 | + description: |
| 103 | + - The name of the required SSM document. The name can be an Amazon Resource Name (ARN). |
| 104 | + type: str |
| 105 | + required: true |
| 106 | + version: |
| 107 | + description: |
| 108 | + - The document version required by the current document. |
| 109 | + type: str |
| 110 | + require_type: |
| 111 | + description: |
| 112 | + - The document type of the required SSM document. |
| 113 | + type: str |
| 114 | + version_name: |
| 115 | + description: |
| 116 | + - The version of the artifact associated with the document. |
| 117 | + type: str |
| 118 | +extends_documentation_fragment: |
| 119 | + - amazon.aws.common.modules |
| 120 | + - amazon.aws.region.modules |
| 121 | + - amazon.aws.tags |
| 122 | + - amazon.aws.boto3 |
| 123 | +
|
| 124 | +""" |
| 125 | + |
| 126 | +EXAMPLES = r""" |
| 127 | +# Note: These examples do not set authentication details, see the AWS Guide for details. |
| 128 | +
|
| 129 | +""" |
| 130 | + |
| 131 | +RETURN = r""" |
| 132 | +document: |
| 133 | + description: Information about the SSM document created or updated. |
| 134 | + type: dict |
| 135 | + returned: when O(state=present) |
| 136 | + contains: |
| 137 | + sha1: |
| 138 | + description: The SHA1 hash of the document, which you can use for verification. |
| 139 | + returned: always. |
| 140 | + type: str |
| 141 | + hash: |
| 142 | + description: The Sha256 or Sha1 hash created by the system when the document was created.. |
| 143 | + returned: always. |
| 144 | + type: str |
| 145 | + hash_type: |
| 146 | + description: The hash type of the document. Valid values include Sha256 or Sha1. |
| 147 | + returned: always. |
| 148 | + type: str |
| 149 | + name: |
| 150 | + description: The name of the SSM document. |
| 151 | + returned: always. |
| 152 | + type: str |
| 153 | + display_name: |
| 154 | + description: The friendly name of the SSM document. |
| 155 | + returned: always. |
| 156 | + type: str |
| 157 | + version_name: |
| 158 | + description: The version of the artifact associated with the document. |
| 159 | + returned: always. |
| 160 | + type: str |
| 161 | + owner: |
| 162 | + description: The Amazon Web Services user that created the document. |
| 163 | + returned: always. |
| 164 | + type: str |
| 165 | + created_date: |
| 166 | + description: The date when the document was created. |
| 167 | + returned: always. |
| 168 | + type: str |
| 169 | + status: |
| 170 | + description: The status of the SSM document. |
| 171 | + returned: always. |
| 172 | + type: str |
| 173 | + status_information: |
| 174 | + description: A message returned by Amazon Web Services Systems Manager that explains the RV(document.status) value. |
| 175 | + returned: always. |
| 176 | + type: str |
| 177 | + document_version: |
| 178 | + description: The document version. |
| 179 | + returned: always. |
| 180 | + type: str |
| 181 | + description: |
| 182 | + description: A description of the document. |
| 183 | + returned: always. |
| 184 | + type: str |
| 185 | + parameters: |
| 186 | + description: A description of the parameters for a document. |
| 187 | + returned: always. |
| 188 | + type: dict |
| 189 | + contains: |
| 190 | + name: |
| 191 | + description: The name of the parameter. |
| 192 | + returned: always. |
| 193 | + type: str |
| 194 | + type: |
| 195 | + description: The type of parameter. |
| 196 | + returned: always. |
| 197 | + type: str |
| 198 | + description: |
| 199 | + description: A description of what the parameter does, how to use it, the default value, and whether or not the parameter is optional. |
| 200 | + returned: always. |
| 201 | + type: str |
| 202 | + default_value: |
| 203 | + description: The default values for the parameters. |
| 204 | + returned: If specified. |
| 205 | + type: str |
| 206 | + platform_types: |
| 207 | + description: The list of operating system (OS) platforms compatible with this SSM document. |
| 208 | + returned: always. |
| 209 | + type: str |
| 210 | + document_type: |
| 211 | + description: The type of document. |
| 212 | + returned: always. |
| 213 | + type: str |
| 214 | + schema_version: |
| 215 | + description: The schema version. |
| 216 | + returned: always. |
| 217 | + type: str |
| 218 | + latest_version: |
| 219 | + description: The latest version of the document. |
| 220 | + returned: always. |
| 221 | + type: str |
| 222 | + default_version: |
| 223 | + description: The default version. |
| 224 | + returned: always. |
| 225 | + type: str |
| 226 | + document_format: |
| 227 | + description: The document format, either JSON or YAML. |
| 228 | + returned: always. |
| 229 | + type: str |
| 230 | + target_type: |
| 231 | + description: The target type which defines the kinds of resources the document can run on. |
| 232 | + returned: always. |
| 233 | + type: str |
| 234 | + attachments_information: |
| 235 | + description: Details about the document attachments, including names, locations, sizes, and so on. |
| 236 | + returned: always. |
| 237 | + type: list |
| 238 | + elements: dict |
| 239 | + contains: |
| 240 | + name: |
| 241 | + description: The name of the attachment. |
| 242 | + returned: always. |
| 243 | + type: str |
| 244 | + requires: |
| 245 | + description: A list of SSM documents required by a document. |
| 246 | + returned: always. |
| 247 | + type: list |
| 248 | + elements: dict |
| 249 | + contains: |
| 250 | + name: |
| 251 | + description: The name of the required SSM document. |
| 252 | + returned: always. |
| 253 | + type: str |
| 254 | + version: |
| 255 | + description: The document version required by the current document. |
| 256 | + returned: always. |
| 257 | + type: str |
| 258 | + require_type: |
| 259 | + description: The document type of the required SSM document. |
| 260 | + returned: always. |
| 261 | + type: str |
| 262 | + version_name: |
| 263 | + description: An optional field specifying the version of the artifact associated with the document. |
| 264 | + returned: always. |
| 265 | + type: str |
| 266 | + author: |
| 267 | + description: The user in your organization who created the document. |
| 268 | + returned: always. |
| 269 | + type: str |
| 270 | + review_information: |
| 271 | + description: Details about the review of a document. |
| 272 | + returned: always. |
| 273 | + type: list |
| 274 | + elements: dict |
| 275 | + contains: |
| 276 | + reviewed_time: |
| 277 | + description: The time that the reviewer took action on the document review request. |
| 278 | + returned: always. |
| 279 | + type: str |
| 280 | + status: |
| 281 | + description: The current status of the document review request. |
| 282 | + returned: always. |
| 283 | + type: str |
| 284 | + reviewer: |
| 285 | + description: The reviewer assigned to take action on the document review request. |
| 286 | + returned: always. |
| 287 | + type: str |
| 288 | + approved_version: |
| 289 | + description: The version of the document currently approved for use in the organization. |
| 290 | + returned: always. |
| 291 | + type: str |
| 292 | + pending_review_version: |
| 293 | + description: The version of the document that is currently under review. |
| 294 | + returned: always. |
| 295 | + type: str |
| 296 | + review_status: |
| 297 | + description: The current status of the review. |
| 298 | + returned: always. |
| 299 | + type: str |
| 300 | + category: |
| 301 | + description: The classification of a document to help you identify and categorize its use. |
| 302 | + returned: always. |
| 303 | + type: list |
| 304 | + elements: str |
| 305 | + category_enum: |
| 306 | + description: The value that identifies a category. |
| 307 | + returned: always. |
| 308 | + type: list |
| 309 | + elements: str |
| 310 | + tags: |
| 311 | + description: Tags of the s3 object. |
| 312 | + returned: always |
| 313 | + type: dict |
| 314 | + sample: { |
| 315 | + "Owner": "dev001", |
| 316 | + "env": "test" |
| 317 | + } |
| 318 | +""" |
| 319 | + |
| 320 | +from typing import Any |
| 321 | +from typing import Dict |
| 322 | +from typing import Tuple |
| 323 | + |
| 324 | +try: |
| 325 | + import botocore |
| 326 | +except ImportError: |
| 327 | + pass # Handled by AnsibleAWSModule |
| 328 | + |
| 329 | + |
| 330 | +from ansible.module_utils.common.dict_transformations import camel_dict_to_snake_dict |
| 331 | +from ansible.module_utils.common.dict_transformations import snake_dict_to_camel_dict |
| 332 | + |
| 333 | +from ansible_collections.amazon.aws.plugins.module_utils.botocore import is_boto3_error_code |
| 334 | +from ansible_collections.amazon.aws.plugins.module_utils.modules import AnsibleAWSModule |
| 335 | +from ansible_collections.amazon.aws.plugins.module_utils.tagging import ansible_dict_to_boto3_tag_list |
| 336 | +from ansible_collections.amazon.aws.plugins.module_utils.tagging import boto3_tag_list_to_ansible_dict |
| 337 | + |
| 338 | + |
| 339 | +def get_document(module: AnsibleAWSModule, ssm_client: Any) -> Dict[str, Any]: |
| 340 | + params = {} |
| 341 | + name = module.params.get("name") |
| 342 | + document_version = module.params.get("document_version") |
| 343 | + version_name = module.params.get("version_name") |
| 344 | + if document_version: |
| 345 | + params.update({"DocumentVersion": document_version}) |
| 346 | + if version_name: |
| 347 | + params.update({"VersionName": version_name}) |
| 348 | + |
| 349 | + try: |
| 350 | + return ssm_client.describe_document(Name=name, **params)["Document"] |
| 351 | + except is_boto3_error_code("InvalidDocument"): |
| 352 | + return None |
| 353 | + except ( |
| 354 | + botocore.exceptions.ClientError, |
| 355 | + botocore.exceptions.BotoCoreError, |
| 356 | + ) as e: # pylint: disable=duplicate-except |
| 357 | + module.fail_json_aws(e, msg=f"Failed to describe SSM document {name}") |
| 358 | + |
| 359 | + |
| 360 | +def delete_document(module: AnsibleAWSModule, ssm_client: Any, existing_document: Dict[str, Any]) -> None: |
| 361 | + if not existing_document: |
| 362 | + module.exit_json(changed=False) |
| 363 | + if module.check_mode: |
| 364 | + module.exit_json(msg="Would have delete SSM document if not in check mode.", changed=True) |
| 365 | + |
| 366 | + params = {} |
| 367 | + name = module.params.get("name") |
| 368 | + document_version = module.params.get("document_version") |
| 369 | + version_name = module.params.get("version_name") |
| 370 | + force_delete = module.params.get("force_delete") |
| 371 | + if document_version: |
| 372 | + params.update({"DocumentVersion": document_version}) |
| 373 | + if version_name: |
| 374 | + params.update({"VersionName": version_name}) |
| 375 | + if force_delete: |
| 376 | + params.update({"Force": force_delete}) |
| 377 | + |
| 378 | + changed = False |
| 379 | + try: |
| 380 | + ssm_client.delete_document(Name=name, **params) |
| 381 | + except is_boto3_error_code("InvalidDocument"): |
| 382 | + changed = True |
| 383 | + except ( |
| 384 | + botocore.exceptions.ClientError, |
| 385 | + botocore.exceptions.BotoCoreError, |
| 386 | + ) as e: # pylint: disable=duplicate-except |
| 387 | + module.fail_json_aws(e, msg=f"Failed to delete SSM document {name}") |
| 388 | + |
| 389 | + module.exit_json(changed=changed) |
| 390 | + |
| 391 | + |
| 392 | +def create_document(module: AnsibleAWSModule, ssm_client: Any) -> Dict[str, Any]: |
| 393 | + name = module.params.get("name") |
| 394 | + content = module.params.get("content") |
| 395 | + version_name = module.params.get("version_name") |
| 396 | + document_parameters = module.params.get("document_parameters") |
| 397 | + tags = module.params.get("tags") |
| 398 | + |
| 399 | + params = {} |
| 400 | + if version_name: |
| 401 | + params["VersionName"] = version_name |
| 402 | + if document_parameters: |
| 403 | + params.update(snake_dict_to_camel_dict(document_parameters)) |
| 404 | + if tags: |
| 405 | + params["Tags"] = ansible_dict_to_boto3_tag_list(tags) |
| 406 | + |
| 407 | + try: |
| 408 | + return ssm_client.create_document( |
| 409 | + Name=name, |
| 410 | + Content=content, |
| 411 | + )["DocumentDescription"] |
| 412 | + except ( |
| 413 | + botocore.exceptions.ClientError, |
| 414 | + botocore.exceptions.BotoCoreError, |
| 415 | + ) as e: |
| 416 | + module.fail_json_aws(e, msg=f"Failed to create SSM document '{name}'") |
| 417 | + |
| 418 | + |
| 419 | +def update_document( |
| 420 | + module: AnsibleAWSModule, ssm_client: Any, existing_document: Dict[str, Any] |
| 421 | +) -> Tuple[Dict[str, Any], bool]: |
| 422 | + name = module.params.get("name") |
| 423 | + content = module.params.get("content") |
| 424 | + version_name = module.params.get("version_name") |
| 425 | + document_parameters = module.params.get("document_parameters") |
| 426 | + tags = module.params.get("tags") |
| 427 | + |
| 428 | + params = {} |
| 429 | + for aws_key, ansible_key in [ |
| 430 | + ("DisplayName", "display_name"), |
| 431 | + ("DocumentFormat", "document_format"), |
| 432 | + ("TargetType", "target_type"), |
| 433 | + ]: |
| 434 | + if document_parameters.get(ansible_key) is not None and document_parameters.get( |
| 435 | + ansible_key |
| 436 | + ) != existing_document.get(aws_key): |
| 437 | + params[aws_key] = document_parameters.get(ansible_key) |
| 438 | + |
| 439 | + if document_parameters.get("attachments"): |
| 440 | + ansible_attachments = sorted([x.get("name") for x in document_parameters.get("attachments")]) |
| 441 | + aws_attachments = sorted([x.get("Name") for x in existing_document.get("AttachmentsInformation")]) |
| 442 | + if aws_attachments != ansible_attachments: |
| 443 | + params["Attachments"] = document_parameters.get("attachments") |
| 444 | + |
| 445 | + changed = False |
| 446 | + ssm_document = None |
| 447 | + if params: |
| 448 | + if version_name: |
| 449 | + params["VersionName"] = version_name |
| 450 | + if document_parameters: |
| 451 | + params.update(snake_dict_to_camel_dict(document_parameters)) |
| 452 | + if tags: |
| 453 | + params["Tags"] = ansible_dict_to_boto3_tag_list(tags) |
| 454 | + |
| 455 | + changed = True |
| 456 | + if not module.check_mode: |
| 457 | + try: |
| 458 | + ssm_document = ssm_client.update_document( |
| 459 | + Name=name, |
| 460 | + Content=content, |
| 461 | + )["DocumentDescription"] |
| 462 | + changed = True |
| 463 | + except ( |
| 464 | + botocore.exceptions.ClientError, |
| 465 | + botocore.exceptions.BotoCoreError, |
| 466 | + ) as e: |
| 467 | + module.fail_json_aws(e, msg=f"Failed to update SSM document '{name}'") |
| 468 | + |
| 469 | + return ssm_document, changed |
| 470 | + |
| 471 | + |
| 472 | +def create_or_update_document(module: AnsibleAWSModule, ssm_client: Any, ssm_document: Dict[str, Any]) -> None: |
| 473 | + changed = False |
| 474 | + if ssm_document: |
| 475 | + document, changed = update_document(module, ssm_client, ssm_document) |
| 476 | + else: |
| 477 | + document = create_document(module, ssm_client) |
| 478 | + changed = True |
| 479 | + |
| 480 | + tags = boto3_tag_list_to_ansible_dict(document.pop("Tags")) |
| 481 | + document = camel_dict_to_snake_dict(document) |
| 482 | + document.update({"tags": tags}) |
| 483 | + module.exit_json(changed=changed, document=document) |
| 484 | + |
| 485 | + |
| 486 | +def main(): |
| 487 | + argument_spec = dict( |
| 488 | + name=dict(required=True), |
| 489 | + content=dict(type="raw"), |
| 490 | + state=dict(default="present", choices=["present", "absent"]), |
| 491 | + document_version=dict(), |
| 492 | + force_delete=dict(type="bool", default=False), |
| 493 | + document_version_name=dict(type="str", aliases=["version_name"]), |
| 494 | + document_parameters=dict( |
| 495 | + type="dict", |
| 496 | + options=dict( |
| 497 | + document_type=dict(), |
| 498 | + document_format=dict(type="str", default="JSON", choices=["JSON", "YAML", "TEXT"]), |
| 499 | + target_type=dict(), |
| 500 | + display_name=dict(), |
| 501 | + attachments=dict( |
| 502 | + type="list", |
| 503 | + elements="dict", |
| 504 | + options=dict( |
| 505 | + key=dict(), |
| 506 | + values=dict(type="list", elements="str"), |
| 507 | + name=dict(), |
| 508 | + ), |
| 509 | + ), |
| 510 | + requires=dict( |
| 511 | + type="list", |
| 512 | + elements="dict", |
| 513 | + options=dict( |
| 514 | + version_name=dict(), |
| 515 | + require_type=dict(), |
| 516 | + version=dict(), |
| 517 | + name=dict(required=True), |
| 518 | + ), |
| 519 | + ), |
| 520 | + ), |
| 521 | + ), |
| 522 | + ) |
| 523 | + |
| 524 | + module = AnsibleAWSModule( |
| 525 | + argument_spec=argument_spec, |
| 526 | + required_if=[ |
| 527 | + ["state", "present", ["content"]], |
| 528 | + ], |
| 529 | + supports_check_mode=True, |
| 530 | + ) |
| 531 | + |
| 532 | + ssm_client = module.client("ssm") |
| 533 | + state = module.params.get("state") |
| 534 | + ssm_document = get_document(module, ssm_client) |
| 535 | + module.exit_json(ssm_document=ssm_document) |
| 536 | + |
| 537 | + if state == "absent": |
| 538 | + delete_document(module, ssm_client, ssm_document) |
| 539 | + else: |
| 540 | + create_or_update_document(module, ssm_client, ssm_document) |
| 541 | + |
| 542 | + |
| 543 | +if __name__ == "__main__": |
| 544 | + main() |
0 commit comments