utils.aws

   1#!/usr/bin/env python3
   2"""
   3aws
   4
   5Common code useful for AWS functions.
   6
   7Example Usage:
   8    from utils import aws
   9    from utils.aws import ssm_get_parameter
  10"""
  11import contextlib
  12import boto3
  13import json
  14import os
  15import sys
  16import base64
  17import time
  18import typing
  19try:
  20    import loggy
  21except ImportError:
  22    from utils import loggy
  23try:
  24    import docker
  25except ImportError:
  26    from utils import docker
  27try:
  28    from .release import get_version, get_source_branch
  29except ImportError:
  30    from utils.release import get_version, get_source_branch
  31# try:
  32#     from .common import subprocess_long as _long_run, remove_empty_from_dict
  33# except ImportError:
  34#     from utils.common import subprocess_long as _long_run, remove_empty_from_dict
  35
  36from subprocess_tee import run as _run
  37
  38# init = False
  39# _sessions = None
  40# _sessions_task = None
  41# _sessions_build_com = None
  42# _sessions_build_gov = None
  43# _region = None
  44# _sessions = Sessions()
  45ECR_BASE_COM = {
  46    "registry_id": "575815261832",
  47    "region": "us-east-1"
  48    }
  49ECR_BASE_GOV = {
  50    "registry_id": "823420400518",
  51    "region": "us-gov-east-1"
  52    }
  53
  54
  55class AwsCreds():
  56    access_key = None
  57    secret_access_key = None
  58    region = None
  59
  60
  61class AwsSession():
  62    session = None
  63    creds = None
  64    name = None
  65
  66    def __init__(self, name):
  67        self.creds = AwsCreds()
  68        self.name = name
  69        self.session = None
  70
  71
  72class AwsSessions():
  73    __session = AwsSession("default")
  74    __session_task = AwsSession("task")
  75    __session_build_com = AwsSession("build_com")
  76    __session_build_gov = AwsSession("build_gov")
  77    __session_ecr_build_com = AwsSession("ecr_build_com")
  78    __session_ecr_build_gov = AwsSession("ecr_build_gov")
  79    __region = None
  80
  81    def __init__(self):
  82        self.__init_session()
  83        self.name = self.__session.name
  84        self.region = self.__session.creds.region
  85        self.session = self.__session
  86
  87    def get_session(self) -> boto3.Session:
  88        """
  89        get_session()
  90
  91        Get a reusable boto3.Session() to run your own boto3 commands into aws.
  92        """
  93        return self.__session.session
  94
  95    def get_creds(self) -> AwsCreds:
  96        """
  97        get_creds()
  98
  99        Get a reusable AwsCreds() to run your own CLI commands into aws.
 100        """
 101        return self.__session.creds
 102
 103    def __get_session_build_com(self) -> AwsSession:
 104        if self.__session_build_com.session is None:
 105            loggy.info("aws.__get_session_build_com(): session is None. Attempting to make one.")
 106            self.__init_internal_build_sessions()
 107        return self.__session_build_com
 108
 109    def __get_session_build_gov(self) -> AwsSession:
 110        if self.__session_build_gov.session is None:
 111            loggy.info("aws.__get_session_build_gov(): session is None. Attempting to make one.")
 112            self.__init_internal_build_sessions()
 113        return self.__session_build_gov
 114
 115    def __get_session_ecr_build_com(self) -> AwsSession:
 116        if self.__session_ecr_build_com.session is None:
 117            loggy.info("aws.__get_session_ecr_build_com(): session is None. Attempting to make one.")
 118            self.__init_internal_ecr_session()
 119        return self.__session_ecr_build_com
 120
 121    def __get_creds_ecr_build_com(self) -> AwsCreds:
 122        if self.__session_ecr_build_com.creds is None:
 123            loggy.info("aws.__get_session_ecr_build_com(): creds is None. Attempting to make one.")
 124            self.__init_internal_ecr_session()
 125        return self.__session_ecr_build_com.creds
 126
 127    def __get_session_ecr_build_gov(self) -> AwsSession:
 128        if self.__session_ecr_build_gov.session is None:
 129            loggy.info("aws.__get_session_ecr_build_gov(): session is None. Attempting to make one.")
 130            self.__init_internal_ecr_session()
 131        return self.__session_ecr_build_gov
 132
 133    def __get_creds_ecr_build_gov(self) -> AwsCreds:
 134        if self.__session_ecr_build_gov.creds is None:
 135            loggy.info("aws.__get_session_ecr_build_gov(): creds is None. Attempting to make one.")
 136            self.__init_internal_ecr_session()
 137        return self.__session_ecr_build_gov.creds
 138
 139    def __get_task_region(self) -> str:
 140        """
 141        __get_task_region()
 142
 143        Get the region of the task container from metadata
 144        """
 145        loggy.info("aws.AwsSessions().__get_task_region: Getting region from task metadata")
 146        _r = "us-east-1"
 147        if os.environ.get('ECS_CONTAINER_METADATA_URI'):
 148            output = _run("curl -s ${ECS_CONTAINER_METADATA_URI}/task", check=True, shell=True)
 149            task_arn = json.loads(output.stdout)
 150            _r = task_arn['TaskARN'].split(':')[3]
 151
 152        return _r
 153
 154    def __init_session(self) -> AwsSession:
 155        """
 156        __init_session()
 157
 158        This function initializes a boto3 AWS session for use in boto3 clients, using
 159        the pipeline environment credentials.
 160
 161        Returns a reusable AwsSession() object
 162        """
 163        if self.__session and self.__session.session:
 164            return self.__session
 165
 166        self.__session.creds.region = os.environ.get('AWS_DEFAULT_REGION', 'us-east-1')
 167
 168        if os.environ.get('AWS_ACCESS_KEY_ID') and os.environ.get('AWS_SECRET_ACCESS_KEY'):
 169            # loggy.info("aws.init_session(): Generating boto3 default session")
 170            self.__session.creds.access_key = os.environ.get('AWS_ACCESS_KEY_ID')
 171            self.__session.creds.secret_access_key = os.environ.get('AWS_SECRET_ACCESS_KEY')
 172            self.__session.creds.region = os.environ.get('AWS_DEFAULT_REGION', 'us-east-1')
 173
 174            self.__session.session = boto3.Session(
 175                aws_access_key_id=self.__session.creds.access_key,
 176                aws_secret_access_key=self.__session.creds.secret_access_key,
 177                region_name=self.__session.creds.region)
 178
 179        else:
 180            # loggy.info("aws.init_session(): boto3 default session set to None.")
 181            self.__session = AwsSession("default")
 182            return self.__session
 183
 184        _prime_the_session_pump = self.__session.session.client('sts').get_caller_identity()
 185
 186        # init = True
 187        _prime_the_session_pump = _prime_the_session_pump
 188        # self.__init_internal_sessions()
 189        # self.__init_internal_ecr_session()
 190        return self.__session
 191
 192    def __init_internal_ecr_session(self):
 193        """
 194        __init_internal_ecr_session()
 195
 196        This function creates reusable sessions for pushing to ecr based on the environment.
 197        This is meant to be an internal only function and does not return anything.
 198        """
 199
 200        if self.__session_ecr_build_com.session or self.__session_ecr_build_gov.session:
 201            return
 202
 203        secret_string = secrets_get_secret_string(name="/rekor/cloudops/cicd/svc_accounts/ecr-push", session=self.__get_session_build_com())
 204        # loggy.info("aws._init_internal_sessions(): Generating boto3 build com session")
 205        self.__session_ecr_build_com.creds.access_key = secret_string['access_key']
 206        self.__session_ecr_build_com.creds.secret_access_key = secret_string['secret_access_key']
 207        self.__session_ecr_build_com.creds.region = secret_string['region']
 208
 209        self.__session_ecr_build_com.session = boto3.Session(
 210            aws_access_key_id=self.__session_ecr_build_com.creds.access_key,
 211            aws_secret_access_key=self.__session_ecr_build_com.creds.secret_access_key,
 212            region_name=self.__session_ecr_build_com.creds.region
 213        )
 214        _prime_the_session_pump = self.__session_ecr_build_com.session.client('sts').get_caller_identity()
 215
 216        if 'gov' in os.environ.get('AWS_DEFAULT_REGION'):
 217            secret_string = secrets_get_secret_string(name="/rekor/cloudops/cicd/svc_accounts/ecr-push", session=self.__get_session_build_gov())
 218            # loggy.info("aws._init_internal_sessions(): Generating boto3 build com session")
 219            self.__session_ecr_build_gov.creds.access_key = secret_string['access_key']
 220            self.__session_ecr_build_gov.creds.secret_access_key = secret_string['secret_access_key']
 221            self.__session_ecr_build_gov.creds.region = secret_string['region']
 222
 223            self.__session_ecr_build_gov.session = boto3.Session(
 224                aws_access_key_id=self.__session_ecr_build_gov.creds.access_key,
 225                aws_secret_access_key=self.__session_ecr_build_gov.creds.secret_access_key,
 226                region_name=self.__session_ecr_build_gov.creds.region
 227            )
 228            _prime_the_session_pump = self.__session_ecr_build_gov.session.client('sts').get_caller_identity()
 229
 230        _prime_the_session_pump = _prime_the_session_pump
 231        return
 232
 233    def __init_internal_build_sessions(self):
 234        """
 235        __init_internal_build_sessions()
 236
 237        This function creates reusable sessions for _task, _build_com and/or _build_gov.
 238        This is meant to be an internal only function and does not return anything.
 239        """
 240        if self.__session_task.session or self.__session_build_com.session or self.__session_build_gov.session:
 241            return
 242
 243        with self.__unset_aws_envs():
 244            """
 245            Generate a session using the container task IAM role
 246            """
 247            loggy.info("aws.__init_internal_build_sessions(): Generating boto3 task session")
 248            self.__session_task.session = boto3.Session(region_name=self.__get_task_region())
 249            _prime_the_session_pump = self.__session_task.session.client('sts').get_caller_identity()
 250            # loggy.info("aws._init_internal_sessions(): boto3 task session: " + str(_prime_the_session_pump))
 251            self.__session_task.creds = None
 252            secret_string = secrets_get_secret_string(name="/rekor/cloudops/cicd/svc_accounts/gocd", session=self.__session_task)
 253
 254        # loggy.info("aws._init_internal_sessions(): Generating boto3 build com session")
 255
 256        self.__session_build_com.creds.access_key = secret_string['access_key']
 257        self.__session_build_com.creds.secret_access_key = secret_string['secret_access_key']
 258        self.__session_build_com.creds.region = secret_string['region']
 259
 260        """
 261        Generate a session for the build commercial account
 262        """
 263        self.__session_build_com.session = boto3.Session(
 264            aws_access_key_id=self.__session_build_com.creds.access_key,
 265            aws_secret_access_key=self.__session_build_com.creds.secret_access_key,
 266            region_name=self.__session_build_com.creds.region
 267        )
 268        _prime_the_session_pump = self.__session_build_com.session.client('sts').get_caller_identity()
 269
 270        if 'gov' in os.environ.get('AWS_DEFAULT_REGION', 'none'):
 271            # loggy.info("aws._init_internal_sessions(): Generating boto3 build gov session")
 272            secret_string = secrets_get_secret_string(name="/rekor/cloudops/cicd/svc_accounts/gocd_gov", session=self.__session_task)
 273
 274            self.__session_build_gov.creds.access_key = secret_string['access_key']
 275            self.__session_build_gov.creds.secret_access_key = secret_string['secret_access_key']
 276            self.__session_build_gov.creds.region = secret_string['region']
 277
 278            """
 279            Generate a session for the build gov account
 280            """
 281            self.__session_build_gov.session = boto3.Session(
 282                aws_access_key_id=self.__session_build_gov.creds.access_key,
 283                aws_secret_access_key=self.__session_build_gov.creds.secret_access_key,
 284                region_name=self.__session_build_gov.creds.region
 285            )
 286            _prime_the_session_pump = self.__session_build_gov.session.client('sts').get_caller_identity()
 287        else:
 288            # loggy.info("aws._init_internal_sessions(): boto3 build gov session set to None.")
 289            self.__session_build_gov.session = None
 290            self.__session_build_gov.creds = None
 291
 292        _prime_the_session_pump = _prime_the_session_pump
 293        # loggy.info("aws._init_internal_sessions(): Primed the session pumps: " + str(_prime_the_session_pump))
 294
 295        return
 296
 297    @contextlib.contextmanager
 298    def __unset_aws_envs(self, **environ):
 299        """
 300        __unset_aws_envs()
 301
 302        Temporarily unset aws environment variables.
 303
 304        >>> with _unset_aws_envs():
 305        ...   "AWS_ACCESS_KEY_ID" in os.environ
 306        False
 307        ...   "AWS_SECRET_ACCESS_KEY" in os.environ
 308        False
 309        ...   "AWS_DEFAULT_REGION" in os.environ
 310        False
 311
 312        >>> "AWS_ACCESS_KEY_ID" in os.environ
 313        AFXYZXYZXYZ
 314
 315        :type environ: dict[str, unicode]
 316        """
 317        old_environ = dict(os.environ)
 318        if os.environ.get("AWS_ACCESS_KEY_ID"):
 319            # loggy.info("aws._unset_aws_envs(): Temp Deleting AWS_ACCESS_KEY_ID from ENV")
 320            del os.environ["AWS_ACCESS_KEY_ID"]
 321        if os.environ.get("AWS_SECRET_ACCESS_KEY"):
 322            # loggy.info("aws._unset_aws_envs(): Temp Deleting AWS_SECRET_ACCESS_KEY from ENV")
 323            del os.environ["AWS_SECRET_ACCESS_KEY"]
 324        if os.environ.get("AWS_DEFAULT_REGION"):
 325            # loggy.info("aws._unset_aws_envs(): Temp Deleting AWS_SECRET_ACCESS_KEY from ENV")
 326            del os.environ["AWS_DEFAULT_REGION"]
 327
 328        try:
 329            # loggy.info("aws._unset_aws_envs(): Yielding back temp modified environment")
 330            yield
 331        finally:
 332            # loggy.info("aws._unset_aws_envs(): Clearing temp environ changes and returning original environ")
 333            os.environ.clear()
 334            os.environ.update(old_environ)
 335
 336    """
 337    Interal SSM functions
 338    """
 339
 340    def ssm_get_parameter(self, name: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None):
 341        """
 342        ssm_get_parameter()
 343
 344        Get an SSM Parameter Value from the build com or gov account
 345
 346        name: String containing param friendly name or arn. Will convert arn into friendly name before use.
 347        region: String defaults to AWS_DEFAULT_REGION or us-east-1
 348        session: aws.Sessions() will use a different session to build the client, default is _session
 349        """
 350
 351        _s = self.__get_session_build_com() if session is None else session
 352        _r = _s.region_name if region is None else region
 353        if 'gov' in _r:
 354            _s = self.__get_session_build_gov() if session is None else session
 355
 356        loggy.info(f"aws.AwsSessions().ssm_get_parameter(): BEGIN (using session named: {_s.name})")
 357
 358        return ssm_get_parameter(name=name, session=_s, region=_r)
 359
 360    """
 361    Internal ECR functions
 362    """
 363
 364    def ecr_generate_fqcn(self, container: str) -> [str, str]:
 365        """
 366        ecr_generate_fqcn()
 367
 368        Generate a fully qualified aws docker container string for the build account
 369        (i.e. 552324424.dkr.ecr.us-east-1.amazonaws.com/mirrored/timothy)
 370
 371        container: String representing container name:tag
 372
 373        Returns: String container and String tag (None if tag doesn't exist)
 374        """
 375        _s = self.__get_session_ecr_build_com()
 376        _r = ecr_get_region()
 377
 378        loggy.info(f"aws.AwsSessions().ecr_generate_fqcn(): BEGIN (using session named: {_s.name})")
 379        return ecr_generate_fqcn(container=container, session=_s, region=_r)
 380
 381    def ecr_tag_to_build(self, container: str, tag_list: list) -> bool:
 382        """
 383        ecr_tag_to_build()
 384
 385        Add a Tag to an existing remote ecr container.
 386        Example: ecr_tag(container="123456789.dkr.ecr.us-east-1.amazonaws.com/mirrored/timothy:1234", tag="latest")
 387
 388        container: String containing existing remote container with tag "container:tag"
 389        tag_list: String List containing new tags to add to the local container
 390        """
 391        _s = self.__get_session_ecr_build_com()
 392        _r = ecr_get_region()
 393
 394        loggy.info(f"aws.AwsSessions().ecr_tag_to_build(): BEGIN (using session named: {_s.name})")
 395        for tag in tag_list:
 396            if not ecr_tag(container=container, tag=tag, session=_s, region=_r):
 397                loggy.info(f"aws.AwsSessions().ecr_tag_to_build(): Failed to put tag {tag}")
 398                return False
 399
 400        return True
 401
 402    def ecr_promote_to_gov(self, container: str, tag: str, push_all_tags: typing.Optional[bool] = True) -> bool:
 403        """
 404        ecr_promote_to_gov()
 405
 406        Pull container from ECR Commercial and Push it into ECR GovCloud.
 407        NOTE: This will ONLY work from a gov pipeline!
 408
 409        container: String containing existing remote container with tag "container"
 410        tag: String containing existing tag for container
 411        push_all_tags: bool True/False defaults to True to push all tags for this container:tag pair
 412
 413        Returns: True/False
 414        """
 415        if 'gov' not in os.environ.get('AWS_DEFAULT_REGION'):
 416            loggy.info("aws.AwsSession().ecr_promote_to_gov(): THIS IS NOT A GOV PIPELINE! RETURNING FALSE.")
 417            return False
 418
 419        _s_from = self.__get_session_ecr_build_com()
 420        _r_from = ecr_get_region()
 421
 422        _s_to = self.__get_session_ecr_build_gov()
 423        _r_to = ecr_get_region(_s_to)
 424        _reg_id_to = ecr_get_registry_id(_s_to)
 425
 426        loggy.info(f"aws.AwsSessions().ecr_promote_to_gov(): BEGIN (using sessions named: {_s_from.name} and {_s_to.name})")
 427
 428        _c, _t = self.ecr_pull_from_build(container, tag)
 429
 430        # Grab all of the tags for this image
 431        # aws --profile build-com ecr describe-images --repository-name 'warp/api' --image-ids imageTag=prod_rc | jq .imageDetails[0].imageTags
 432        _details = ecr_describe_image(container=_c, tag=_t, session=_s_from, region=_r_from)
 433        _tag_list = _details['imageDetails'][0]['imageTags']
 434        if not ecr_login(registry_id=_reg_id_to, session=_s_to, region=_r_to):
 435            loggy.info("aws.AwsSessions().ecr_promote_to_gov(): Failed to log into the gov build ECR")
 436            return False
 437
 438        return self.ecr_push_and_scan(container=_c, tag=_t, tag_list=_tag_list, session=_s_to)
 439
 440    def ecr_pull_from_build(self, container: str, tag: str) -> [str, str]:
 441        """
 442        ecr_pull_from_build()
 443
 444        Pull an ECR container from the build account.
 445
 446        container: String containing existing remote container
 447        tag: String containing tag of remote container
 448
 449        Returns: Tuple [str, str] First str is full ECR name of container, second str is tag
 450        """
 451        _s = self.__get_session_ecr_build_com()
 452        _ri = ecr_get_registry_id()
 453        _r = ecr_get_region()
 454
 455        loggy.info(f"aws.AwsSessions().ecr_pull_from_build(): BEGIN (using session named: {_s.name})")
 456
 457        if not ecr_login(registry_id=_ri, session=_s, region=_r):
 458            return None, None
 459
 460        return ecr_pull(container=container, tag=tag, session=_s, region=_r)
 461
 462    def ecr_push_and_scan(self, container: str, tag: str, tag_list: typing.Optional[list] = None, session: typing.Optional[AwsSession] = None) -> bool:
 463        """
 464        ecr_push_and_scan()
 465
 466        Push a new container to build account ECR.
 467        This is only allowed from develop or hotfix branches.
 468
 469        container: String representing local container name
 470        tag: String with existing local tag for container name
 471        tag_list: Optional String List of additional tags to push with the container
 472        session: will use a different to build the client, default is build session
 473
 474        Returns: True/False
 475        """
 476        _b = get_source_branch()
 477
 478        if 'develop' not in _b and 'hotfix' not in _b and 'gov' not in os.environ.get('AWS_DEFAULT_REGION'):
 479            # check if image exists already. If it doesn't, we cannot make a new one. If it does we can promote it.
 480            loggy.info(f"aws.AwsSessions().ecr_push_and_scan(): Cannot push from branch ({_b}). Only develop and hotfix allowed.")
 481            sys.exit(f"aws.AwsSessions().ecr_push_and_scan(): Cannot push from branch ({_b}). Only develop and hotfix allowed.")
 482
 483        _s = self.__get_session_ecr_build_com() if session is None else session
 484        _ri = ecr_get_registry_id(session=_s)
 485        _r = ecr_get_region(session=_s)
 486
 487        loggy.info(f"aws.AwsSessions().ecr_push_and_scan(): BEGIN (using session named: {_s.name})")
 488        try:
 489            ecr_login(registry_id=_ri, session=_s, region=_r)
 490
 491            #
 492            # We only want to scan the first tag we push.
 493            #
 494            _container, _tag = ecr_generate_fqcn(container=f"{container}:{tag}", session=_s, region=_r)
 495
 496            loggy.info(f"aws.AwsSessions().ecr_push_and_scan(): Pushing local container ({container}:{tag}) to remote ({_container}:{_tag})")
 497
 498            _temp_tag = f"{get_version()}.SCAN"
 499
 500            loggy.info("aws.AwsSessions().ecr_push_and_scan(): TAG FOR SCAN")
 501            loggy.info(f"docker tag {container}:{_tag} {_container}:{_temp_tag}")
 502            if not docker.docker("tag", f"{container}:{_tag}", f"{_container}:{_temp_tag}"):
 503                return False
 504
 505            loggy.info("aws.AwsSessions().ecr_push_and_scan(): PUSH TAG FOR SCAN")
 506            if not docker.docker("push", f"{_container}:{_temp_tag}"):
 507                return False
 508
 509            #
 510            # ECR Scan
 511            #
 512            if ecr_scan(container=container, tag=_temp_tag, session=_s, region=_r):
 513                #
 514                # Push the original local tag into ECR
 515                #
 516                loggy.info(f"aws.AwsSessions().ecr_push_and_scan(): Post Scan - Pushing original tag ({tag}) using manifest")
 517                if not ecr_tag(container=f"{_container}:{_temp_tag}", tag=tag, session=_s, region=_r):
 518                    return False
 519                # if not docker.docker("tag", f"{_container}:{_temp_tag}", f"{_container}:{tag}"):
 520                #     return False
 521                # if not docker.docker("push", f"{_container}:{tag}"):
 522                #     return False
 523
 524                if tag_list:
 525                    for t in tag_list:
 526                        loggy.info(f"aws.AwsSessions().ecr_push_and_scan(): Post Scan - Pushing tag ({t}) using manifest")
 527                        if not ecr_tag(container=f"{_container}:{_temp_tag}", tag=t, session=_s, region=_r):
 528                            return False
 529                        # if not docker.docker("tag", f"{_container}:{_temp_tag}", f"{_container}:{t}"):
 530                        #     return False
 531                        # if not docker.docker("push", f"{_container}:{t}"):
 532                        #     return False
 533
 534                #
 535                # Push initial set of tags for this container so we have them ready when we
 536                # build out any of our standard named environments.
 537                #
 538                for t in ecr_check_tag_exists(container=_container, tag_list=['develop', 'qa', 'stage', 'hotfix', 'demo', 'prod'], session=_s, region=_r):
 539                    loggy.info(f"aws.AwsSessions().ecr_push_and_scan(): CDK tag for ENV {t} does not exist. Pushing tag so CDK can deploy/create successfully.")
 540                    _build_stub_container, _build_stub_tag = ecr_pull_from_build(container='gocd/stub', tag='stub')
 541                    if not ecr_login(registry_id=_ri, session=_s, region=_r):
 542                        return False
 543                    _stub_container, _stub_tag = ecr_generate_fqcn(container="gocd/stub:stub", session=_s, region=_r)
 544                    if not docker.docker("tag", f"{_build_stub_container}:{_build_stub_tag}", f"{_container}:{t}"):
 545                        return False
 546                    if not docker.docker("push", f"{_container}:{t}"):
 547                        return False
 548
 549                # else:
 550                #     loggy.info("aws.AwsSessions().ecr_push_and_scan(): No more tags to push")
 551            else:
 552                # Remove the original tag and add a FAILED tag to this container
 553                if not docker.docker("tag", f"{_container}:{_temp_tag}", f"{_container}:FAILED_SCAN"):
 554                    return False
 555                if not docker.docker("push", f"{_container}:FAILED_SCAN"):
 556                    return False
 557
 558                try:
 559                    client = _s.session.client('ecr', region_name=_r)
 560                    response = client.batch_delete_image(
 561                        repositoryName=ecr_strip_container_name(_container),
 562                        imageIds=[{
 563                            'imageTag': _temp_tag
 564                        }]
 565                    )
 566                except Exception as e:
 567                    loggy.info(f"aws.AwsSessions().ecr_push_and_scan(): Failed to delete the temp tag {_temp_tag} from container after scan failed. {str(e)}")
 568                    fail_code = response['failures'][0]['failureCode']
 569                    fail_reason = response['failures'][0]['failureReason']
 570                    loggy.info(f"Failure Code ({fail_code}). Failure Reason ({fail_reason})")
 571
 572                loggy.info("aws.AwsSessions().ecr_push_and_scan(): Container Scan failed. Check out pipeline results tab or ECR for Vulns.")
 573
 574        except Exception as e:
 575            loggy.error("aws.AwsSessions().ecr_push_and_scan(): Logging out of ECR repo.")
 576            ecr_logout(registry_id=_ri, session=_s, region=_r)
 577            sys.exit(f"aws.AwsSessions().ecr_push_and_scan(): Error: {str(e)}")
 578
 579        loggy.info("aws.AwsSessions().ecr_push_and_scan(): Logging out of ECR repo.")
 580        ecr_logout(registry_id=_ri, session=_s, region=_r)
 581
 582        return True
 583
 584
 585if os.environ.get('HOTFIX_HAMMER') and get_version() not in os.environ['HOTFIX_HAMMER']:
 586    loggy.error("aws.py: HOTFIX HAMMER HAS BEEN THROWN. Contact CloudOps to remove the hammer.")
 587    sys.exit("aws.py: HOTFIX HAMMER HAS BEEN THROWN. Contact CloudOps to remove the hammer.")
 588
 589_sessions = AwsSessions()
 590
 591
 592"""
 593Global Utils
 594"""
 595
 596
 597def get_aws_account_id(session: typing.Optional[AwsSession] = None) -> str:
 598    """
 599    get_aws_account_id()
 600
 601    Get the aws account ID using the local AWS_ACCESS_KEY_ID credentials.
 602
 603    session will use a different session to build the client, default is _sessions
 604    """
 605    global _sessions
 606    _s = _sessions.session if session is None else session
 607    loggy.info(f"aws.get_aws_account_id(): BEGIN (using session named: {_s.name})")
 608
 609    try:
 610        client = _s.session.client('sts')
 611        response = client.get_access_key_info(AccessKeyId=_s.creds.access_key)
 612        if 'Account' not in response:
 613            loggy.error("Error: Account ID not returned")
 614    except Exception as e:
 615        loggy.error("Error: " + str(e))
 616
 617    return response['Account']
 618
 619
 620def get_region(session: typing.Optional[AwsSession] = None) -> str:
 621    """
 622    get_region()
 623
 624    Get the aws region from the session.
 625
 626    session will use a different session to build the client, default is global _sessions
 627    """
 628    global _sessions
 629    _s = _sessions.session if session is None else session
 630    loggy.info(f"aws.get_region(): BEGIN (using session named: {_s.name})")
 631
 632    return _s.session.region_name
 633
 634
 635def get_session():
 636    """
 637    get_session()
 638
 639    Get the aws session that was instantiated on import. This will be tied to
 640    the local pipeline environment. Useful if you want to build out your own
 641    boto3 clients to run commands that aren't yet supported in this library.
 642
 643    returns: boto3.Session() object
 644    """
 645    global _sessions
 646    loggy.info(f"aws.get_session(): BEGIN (using session named: {_sessions.name})")
 647    return _sessions.session.session
 648
 649
 650"""
 651CloudFront Utils
 652"""
 653
 654
 655def cloudfront_create_invalidation(dist: str, items: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> str:
 656    """
 657    cloudfront_create_invalidation()
 658
 659    Create an invalidation on a CloudFront distribution.
 660
 661    dist: String Distribution ID
 662    items: String List of paths. (i.e. ["/*"])
 663    session: will use a different session to build the client, default is _sessions
 664    """
 665    global _sessions
 666
 667    _s = _sessions.session if session is None else session
 668    _r = _s.session.region_name if region is None else region
 669    loggy.info(f"aws.cloudfront_create_invalidation(): BEGIN (using session named: {_s.name})")
 670
 671    try:
 672        client = _s.session.client('cloudfront', region_name=_r)
 673        response = client.create_invalidation(
 674            DistributionId=dist,
 675            InvalidationBatch={
 676                'Paths': {
 677                    'Quantity': 1,
 678                    'Items': items
 679                },
 680                'CallerReference': str(time.time()).replace(".", "")
 681            }
 682        )
 683    except Exception as e:
 684        loggy.error("Error: " + str(e))
 685
 686    invalidation_id = response['Invalidation']['Id']
 687    return invalidation_id
 688
 689
 690"""
 691ECS Utils
 692"""
 693
 694
 695def ecs_deploy(clusterArn: str, serviceArn: str, tag: typing.Optional[str] = None, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> bool:
 696    """
 697    ecsDeploy.py
 698
 699    Deploy a new task definition to an existing ECS Cluster/Service
 700
 701    NOTE 1: This is NOT blue/green. Look at `ecsBlueGreenDeploy.py`
 702    NOTE 2: This will check if the clusterArn/serviceArn are NOT aws arns and instead
 703            use them as ssm parameter names to grab the values
 704
 705    clusterArn: String (Optional) Will use ECS_CLUSTER_ARN from os.environ as default
 706    serviceArn: String (Optional) Will use ECS_SERVICE_ARN from os.environ as default
 707    tag: String (Optional) - Will use `release.get_version()` as default
 708    session: AwsSession (Optional) will use a different session to build the client, default is _sessions
 709    region: String (Optional)
 710
 711    Returns: True/False
 712    """
 713    global _sessions
 714
 715    _s = _sessions.session if session is None else session
 716    _r = _s.session.region_name if region is None else region
 717    loggy.info(f"aws.ecsDeploy(): BEGIN (using session named: {_s.name})")
 718
 719    _TAG = tag if tag is not None else get_version()
 720    _CLUSTER_ARN = clusterArn
 721    _SERVICE_ARN = serviceArn
 722
 723    """
 724    If the _CLUSTER_ARN or _SERVICE_ARN are not in ARN format, consider them SSM Param names
 725    and use them to grab the ARNS out of SSM Params
 726    """
 727    _CLUSTER = _CLUSTER_ARN if ':' in _CLUSTER_ARN else ssm_get_parameter(name=_CLUSTER_ARN, session=_s, region=_r)
 728    _SERVICE = _SERVICE_ARN if ':' in _SERVICE_ARN else ssm_get_parameter(name=_SERVICE_ARN, session=_s, region=_r)
 729
 730    """
 731    go get the entire task definition for a service by name (might need the cluster too)
 732    """
 733    loggy.info("aws.ecsDeploy(): Looking up latest task definition for cluster/service")
 734    current_task_definition_arn = ecs_get_latest_task_definition_arn(cluster=_CLUSTER, service=_SERVICE, session=_s, region=_r)
 735    loggy.info("aws.ecsDeploy(): Storing the entire current task definition for rollback")
 736    current_task_definition = ecs_get_task_definition_from_arn(task_def_arn=current_task_definition_arn, session=_s, region=_r)
 737
 738    """
 739    This iterates through all current_task_definition.containers
 740    then for each container -> iterate through container.secrets
 741    for each secret -> find one where the key is "VERSION"
 742    if found, return the value which will be an ssm param arn
 743    """
 744    version_ssm_param_arn = ecs_get_version_param_name_from_task_def(task_def=current_task_definition)
 745
 746    """
 747    Get the currently deployed version number
 748    """
 749    old_version = ssm_get_parameter(name=version_ssm_param_arn, session=_s, region=_r)
 750
 751    """
 752    set the new version provided by the caller
 753    """
 754    new_version = _TAG
 755
 756    """
 757    This iterates over the containers again to set
 758    the new image in the container where
 759    we simply get the old image and replace the :{tag}
 760    before: docker.devops.rekor.io/blue/api:12345
 761    after: docker.devops.rekor.io/blue/api:$newVersion
 762    """
 763    new_task_definition = ecs_set_new_image_in_task_def(task_def=current_task_definition, version=new_version)
 764
 765    """
 766    Go register the next task def
 767    there should now be a new version of the task def
 768    """
 769    new_task_definition_arn = ecs_register_task_definition_revision(task_def=new_task_definition, session=_s, region=_r)
 770
 771    """
 772    update the ssm param with the new tag.
 773    This function should fail gracefully as not all appilcations use an SSM param
 774    to store its version. Scout uses the git commit hash for version awareness.
 775    """
 776    ssm_put_parameter(name=version_ssm_param_arn, value=_TAG, session=_s, region=_r)
 777
 778    """
 779    deploy new task def to the service
 780    """
 781    ecs_deploy_new_task_definition(cluster=_CLUSTER, service=_SERVICE, task_def_arn=new_task_definition_arn, session=_s, region=_r)
 782
 783    deploy_status = ecs_wait_services_stable(cluster=_CLUSTER, service=_SERVICE, session=_s, region=_r)
 784    if not deploy_status:
 785        loggy.info("ecsDeploy(): Deploy FAILED! Rolling back to original task def!")
 786        # Roll back procedures by rolling back the version param and setting the service back to the original task def
 787        ssm_put_parameter(name=version_ssm_param_arn, value=old_version, session=_s, region=_r)
 788        ecs_deploy_new_task_definition(cluster=_CLUSTER, service=_SERVICE, task_def_arn=current_task_definition_arn, session=_s, region=_r)
 789        deploy_status = ecs_wait_services_stable(cluster=_CLUSTER, service=_SERVICE, session=_s, region=_r)
 790        if not deploy_status:
 791            raise Exception("aws.ecsDeploy(): Rolling back to original task def failed!")
 792
 793        ecs_deregister_task_def(task_def=new_task_definition_arn, session=_s, region=_r)
 794        loggy.info("aws.ecsDeploy(): Deploy Failed! Rolled back to original task def.")
 795        return False
 796
 797    loggy.info("aws.ecsDeploy(): Deploy Successful")
 798    return True
 799
 800
 801def ecs_get_latest_task_definition_arn(cluster: str, service: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> str:
 802    """
 803    ecs_get_latest_task_definition_arn()
 804
 805    Get the latest task definition arn for a particular service in a particular cluster
 806
 807    cluster: String containing ECS Cluster ARN
 808    service: String containing ECS Service ARN
 809
 810    Returns: String containing task def arn
 811    """
 812    global _sessions
 813    _s = _sessions.session if session is None else session
 814    _r = _s.session.region_name if region is None else region
 815    loggy.info(f"aws.ecs_get_latest_task_definition_arn(): BEGIN (using session named: {_s.name})")
 816
 817    loggy.info(f"aws.ecs_get_latest_task_definition_arn(): Searching for latest task_definition_arn in cluster/service ({cluster} / {service})")
 818
 819    task_def_arn = None
 820    try:
 821        client = _s.session.client('ecs', region_name=_r)
 822        response = client.describe_services(
 823            cluster=cluster,
 824            services=[
 825                service
 826            ]
 827        )
 828        task_def_arn = response['services'][0]['taskDefinition']
 829    except Exception as e:
 830        loggy.error(f"aws.ecs_get_latest_task_definition_arn(): Error: {str(e)}")
 831        raise
 832
 833    return task_def_arn
 834
 835
 836def ecs_get_task_definition_from_arn(task_def_arn: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> dict:
 837    """
 838    ecs_get_task_definition_from_arn()
 839
 840    Get clonable task definition (json) from a task definition arn
 841
 842    task_def_arn: String containing task def arn
 843
 844    Returns: dict containing enough of the task def to clone it
 845    """
 846    global _sessions
 847    _s = _sessions.session if session is None else session
 848    _r = _s.session.region_name if region is None else region
 849    loggy.info(f"aws.ecs_get_task_definition_from_arn(): BEGIN (using session named: {_s.name})")
 850
 851    loggy.info(f"aws.ecs_get_task_definition_from_arn(): Reading in full task definition from: {task_def_arn}")
 852
 853    try:
 854        client = _s.session.client('ecs', region_name=_r)
 855        response = client.describe_task_definition(
 856            taskDefinition=task_def_arn
 857        )
 858
 859        task_def = response['taskDefinition']
 860    except Exception as e:
 861        loggy.error(f"aws.ecs_get_task_definition_from_arn(): Error: {str(e)}")
 862        raise
 863
 864    # remove_props_list = [
 865    #     "taskDefinitionArn",
 866    #     "revision",
 867    #     "status",
 868    #     "requiresAttributes",
 869    #     "compatibilities",
 870    #     "runtimePlatform",
 871    #     "inferenceAccelerators",
 872    #     "registeredAt",
 873    #     "deregisteredAt",
 874    #     "registeredBy",
 875    #     "ephemeralStorage"
 876    # ]
 877    # for prop in remove_props_list:
 878    #     if prop in task_def:
 879    #         del task_def[prop]
 880
 881    # now we remove any empty values or lists
 882    # task_def = remove_empty_from_dict(task_def)
 883
 884    return task_def
 885
 886
 887def __ecs_check_version_in_secrets(secrets: dict) -> str:
 888    """
 889    """
 890    param_name = None
 891    for secret in secrets:
 892        if secret.get('name') and 'VERSION' in secret['name']:
 893            param_name = secret.get('valueFrom')
 894            break
 895    return param_name
 896
 897
 898def ecs_get_version_param_name_from_task_def(task_def: dict) -> str:
 899    """
 900    ecs_get_version_param_name_from_task_def()
 901
 902    Get the `version` SSM param name from the task definition
 903
 904    task_def: dict
 905
 906    Return: String containing version SSM param name
 907    """
 908    loggy.info(f"aws.ecs_get_version_param_name_from_task_def(): Searching for VERSION ssm parameter arn in containers inside of {task_def}")
 909
 910    param_name = None
 911    if not task_def.get('containerDefinitions'):
 912        raise Exception("aws.ecs_get_version_param_name_from_task_def(): Could not locate containerDefinitions inside of the task_def dict")
 913        return param_name
 914
 915    for container in task_def['containerDefinitions']:
 916        if container.get('secrets'):
 917            param_name = __ecs_check_version_in_secrets(container['secrets'])
 918            if param_name:
 919                break
 920
 921    return param_name
 922
 923
 924# def ecs_save_task_def_to_json_file(current_task_definition, old_task_definition_file_name):
 925#     """
 926#     ecs_save_task_def_to_json_file()
 927#
 928#     Save our task definition to a json file.
 929#     """
 930
 931
 932def ecs_set_new_image_in_task_def(task_def: dict, version: str) -> dict:
 933    """
 934    ecs_set_new_image_in_task_def()
 935
 936    Set/replace the tag/version of the containers in a task def hashmap and returns a new hashmap
 937
 938    task_def: dict containing task definition
 939    version: String containiing new container tag/version
 940
 941    Returns: dict task_def
 942    """
 943    if not task_def.get('containerDefinitions'):
 944        raise Exception("aws.ecs_set_new_image_in_task_def(): containerDefinitions not found in task_def.")
 945
 946    for container in task_def['containerDefinitions']:
 947        if not container.get('image'):
 948            raise Exception("aws.ecs_set_new_image_in_task_def(): container image value not found in returned list.")
 949            return {}
 950
 951        _image, _original_image_version = container['image'].split(':')
 952        _image = f"{_image}:{version}"
 953        loggy.info(f"aws.ecs_set_new_image_in_task_def(): Changing image version ({_original_image_version}) to ({version}) for container named ({container['name']}): new image is ${_image}")
 954        container['image'] = _image
 955
 956    return task_def
 957
 958
 959def ecs_register_task_definition_revision(task_def: dict, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> dict:
 960    """
 961    ecs_register_new_task_definition()
 962
 963    Register a new task definition in ECS
 964
 965    task_def: dict of a task definition to register
 966
 967    Returns: dict of new task_def
 968    """
 969    global _sessions
 970    _s = _sessions.session if session is None else session
 971    _r = _s.session.region_name if region is None else region
 972    loggy.info(f"aws.ecs_register_new_task_definition(): BEGIN (using session named: {_s.name})")
 973
 974    loggy.info("aws.ecs_register_new_task_definition(): Registering new task definition.")
 975
 976    try:
 977        client = _s.session.client('ecs', region_name=_r)
 978        if 'secrets' in task_def['containerDefinitions'][0]:
 979            response = client.register_task_definition(
 980                family=task_def['family'],
 981                containerDefinitions=task_def['containerDefinitions'],
 982                volumes=task_def['volumes'],
 983                executionRoleArn=task_def['executionRoleArn'],
 984                requiresCompatibilities=task_def['requiresCompatibilities'],
 985                networkMode=task_def['networkMode'],
 986                cpu=task_def['cpu'],
 987                memory=task_def['memory']
 988            )
 989        else:
 990            response = client.register_task_definition(
 991                family=task_def['family'],
 992                containerDefinitions=task_def['containerDefinitions'],
 993                volumes=task_def['volumes'],
 994                requiresCompatibilities=task_def['requiresCompatibilities'],
 995                networkMode=task_def['networkMode'],
 996                cpu=task_def['cpu'],
 997                memory=task_def['memory']
 998            )
 999
1000        task_def = response['taskDefinition']['taskDefinitionArn']
1001    except Exception as e:
1002        loggy.error(f"aws.ecs_register_new_task_definition(): Error: {str(e)}")
1003        return {}
1004
1005    return task_def
1006
1007
1008def ecs_deploy_new_task_definition(cluster: str, service: str, task_def_arn: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> bool:
1009    """
1010    ecs_deploy_new_task_definition()
1011
1012    Deploy a task defition to a particular ECS Cluster/Service
1013
1014    cluster: String containing ECS Cluster Arn
1015    service: String containing ECS Service Arn
1016    task_def_arn: String containing task definition arn
1017
1018    Returns: True/False
1019    """
1020    global _sessions
1021    _s = _sessions.session if session is None else session
1022    _r = _s.session.region_name if region is None else region
1023    loggy.info(f"aws.ecs_deploy_new_task_definition(): BEGIN (using session named: {_s.name})")
1024
1025    loggy.info(f"aws.ecs_deploy_new_task_definition(): Deploying task defintion ({task_def_arn}) to cluster ({cluster} / service ({service}).")
1026
1027    try:
1028        client = _s.session.client('ecs', region_name=_r)
1029        client.update_service(
1030            cluster=cluster,
1031            service=service,
1032            taskDefinition=task_def_arn
1033        )
1034
1035    except Exception as e:
1036        loggy.error(f"aws.ecs_deploy_new_task_definition(): Error: {str(e)}")
1037        return False
1038
1039    return True
1040
1041
1042def ecs_wait_services_stable(cluster: str, service: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> bool:
1043    """
1044    ecs_wait_services_stable()
1045
1046    Wait up to 10 minutes for ECS services to become stable
1047
1048    cluster: String containing cluster arn
1049    service: String containing service arn
1050
1051    Returns: True/False
1052    """
1053    global _sessions
1054    _s = _sessions.session if session is None else session
1055    _r = _s.session.region_name if region is None else region
1056    loggy.info(f"aws.ecs_wait_services_stable(): BEGIN (using session named: {_s.name})")
1057
1058    loggy.info(f"aws.ecs_wait_services_stable(): Waiting for services to become stable on cluster ({cluster} / service ({service}).")
1059
1060    try:
1061        client = _s.session.client('ecs', region_name=_r)
1062        waiter = client.get_waiter('services_stable')
1063
1064        waiter.wait(
1065            cluster=cluster,
1066            services=[
1067                service
1068            ])
1069    except Exception as e:
1070        loggy.info(f"aws.ecs_wait_services_stable(): The services did not become stable: {str(e)}")
1071        raise
1072        return False
1073
1074    return True
1075
1076
1077def ecs_deregister_task_def(task_def_arn: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> bool:
1078    """
1079    ecs_deregister_task_def()
1080
1081    Deregister a task definition
1082
1083    task_def_arn: String containing task definition arn
1084
1085    Returns: True/False
1086    """
1087    global _sessions
1088    _s = _sessions.session if session is None else session
1089    _r = _s.session.region_name if region is None else region
1090    loggy.info(f"aws.ecs_deregister_task_def(): BEGIN (using session named: {_s.name})")
1091
1092    loggy.info(f"aws.ecs_deregister_task_def(): Deregistering task definition: {task_def_arn}")
1093
1094    try:
1095        client = _s.session.client('ecs', region_name=_r)
1096        response = client.deregister_task_definition(
1097            taskDefinition=task_def_arn
1098        )
1099        if not response.get('taskDefinition') or not response['taskDefinition'].get('deregisteredAt'):
1100            raise Exception
1101    except Exception as e:
1102        loggy.info(f"aws.ecs_deregister_task_def(): Failed to deregister task definition: {str(e)}")
1103        return False
1104
1105    return True
1106
1107
1108"""
1109ECR UTILS
1110"""
1111
1112
1113def ecr_get_manifest(container: str, tag: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> str:
1114    """
1115    ecr_get_manifest()
1116
1117    Get the image manifest for a remote container and tag
1118
1119    container: String representing container name
1120    tag: String tag to look up
1121    session: will use a different session to build the client, default is build session
1122    region: will use a different region to build the client, default is build region
1123
1124    Returns: String containing image manifest
1125    """
1126    global _sessions
1127    _s = _sessions.session if session is None else session
1128    _r = _s.session.region_name if region is None else region
1129    loggy.info(f"aws.ecr_get_manifest(): BEGIN (using session named: {_s.name})")
1130
1131    client = _s.session.client('ecr', region_name=_r)
1132
1133    manifest = None
1134    try:
1135        response = client.batch_get_image(
1136            repositoryName=ecr_strip_container_name(container),
1137            imageIds=[
1138                {
1139                    'imageTag': tag
1140                }
1141            ]
1142            # acceptedMediaTypes=['application/vnd.docker.distribution.manifest.v2+json'],
1143        )
1144        loggy.info(str(response))
1145        manifest = response['images'][0]['imageManifest']
1146        loggy.info(f"aws.ecr_get_manifest(): Found manifest {manifest}.")
1147    except Exception as e:
1148        loggy.info(f"aws.ecr_get_manifest(): Failed to retrieve manifest: {str(e)}")
1149        return manifest
1150
1151    return manifest
1152
1153
1154def ecr_put_image(container: str, tag: str, manifest: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> bool:
1155    """
1156    ecr_put_image()
1157
1158    Put an image manifest for a remote container and tag. Used for re-tagging an
1159    existing image
1160
1161    container: String representing container name
1162    tag: String new tag to add to image
1163    manifest: String manifest of image
1164    session: will use a different session to build the client, default is build session
1165    region: will use a different region to build the client, default is build region
1166
1167    Returns: True/False
1168    """
1169    global _sessions
1170    _s = _sessions.session if session is None else session
1171    _r = _s.session.region_name if region is None else region
1172    loggy.info(f"aws.ecr_put_image(): BEGIN (using session named: {_s.name})")
1173
1174    client = _s.session.client('ecr', region_name=_r)
1175
1176    try:
1177        client.put_image(
1178            repositoryName=ecr_strip_container_name(container),
1179            imageTag=tag,
1180            imageManifest=manifest
1181        )
1182        # loggy.info(str(response))
1183        loggy.info("aws.ecr_put_image(): Successfully put new image.")
1184    except Exception as e:
1185        if 'already exists' in str(e):
1186            loggy.info(f"aws.ecr_put_image(): Image already exists. Passing. {str(e)}")
1187            return True
1188        else:
1189            loggy.info(f"aws.ecr_put_image(): Failed to put image: {str(e)}")
1190            return False
1191
1192    return True
1193
1194
1195def ecr_tag_to_build(container: str, tag_list: list) -> bool:
1196    """
1197    ecr_tag_to_build()
1198
1199    Add a Tag to an existing remote ecr container.
1200    Example: ecr_tag(container="123456789.dkr.ecr.us-east-1.amazonaws.com/mirrored/timothy:1234", tag="latest")
1201
1202    This is the default and only path to get a container pushed into production.
1203
1204    NOTE 1: You will be logged out of any existing ECR repos. run `aws.ecr_login()` to establish a new connection
1205
1206    container: String containing existing remote container with tag "container:tag"
1207    tag_list: List containing new tags to add to the local container
1208
1209    Returns: True/False
1210    """
1211    global _sessions
1212    loggy.info(f"aws.ecr_tag_to_build(): BEGIN (using session named: {_sessions.name})")
1213    return _sessions.ecr_tag_to_build(container=container, tag_list=tag_list)
1214
1215
1216def ecr_tag(container: str, tag: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> bool:
1217    """
1218    ecr_tag()
1219
1220    Add a Tag to an existing remote ecr container.
1221    Example: ecr_tag(container="123456789.dkr.ecr.us-east-1.amazonaws.com/mirrored/timothy:1234", tag="latest")
1222
1223    container: String containing existing remote container with tag "container:tag"
1224    tag: String containing new tag to add to the local container
1225
1226    Returns: True/False
1227    """
1228    global _sessions
1229    _s = _sessions.session if session is None else session
1230    _r = ecr_get_region() if session is None else _s.session.region_name if region is None else region
1231    loggy.info(f"aws.ecr_tag(): BEGIN (using session named: {_s.name})")
1232
1233    loggy.info(f"aws.ecr_tag(): Tagging {container} with {tag}")
1234    if ':' not in container:
1235        raise Exception("aws.ecr_tag(): container must include tag")
1236
1237    _c, _t = ecr_generate_fqcn(container=container, session=_s, region=_r)
1238
1239    manifest = ecr_get_manifest(container=_c, tag=_t, session=_s, region=_r)
1240
1241    if ecr_put_image(container=_c, tag=tag, manifest=manifest, session=_s, region=_r):
1242        loggy.info("aws.ecr_tag(): Successfully added tag to image")
1243    else:
1244        loggy.info("aws.ecr_tag(): Failed to add new tag to image")
1245        return False
1246
1247    return True
1248
1249
1250def ecr_promote_to_gov(container: str, tag: str, push_all_tags: typing.Optional[bool] = True) -> bool:
1251    """
1252    ecr_promote_to_gov()
1253
1254    Pull container from ECR Commercial and Push it into ECR GovCloud.
1255    NOTE: This will ONLY work from a gov pipeline!
1256
1257    container: String containing existing remote container with tag "container"
1258    tag: String containing existing tag for container
1259    push_all_tags: bool True/False defaults to True to push all tags for this container:tag pair
1260
1261    Returns: True/False
1262    """
1263    global _sessions
1264    loggy.info(f"aws.ecr_promote_to_gov(): BEGIN (using session named: {_sessions.name})")
1265
1266    return _sessions.ecr_promote_to_gov(container, tag, push_all_tags)
1267
1268
1269def ecr_push_to_build(container: str, tag: str, tag_list: typing.Optional[list] = None) -> bool:
1270    """
1271    ecr_push_to_build()
1272
1273    Push a locally built container into our AWS build commercial account.
1274    This is the default and only path to get a container pushed into production.
1275
1276    NOTE 1: You must be running in either `develop` or `hotfix` branch.
1277    NOTE 2: You will be logged out of any existing ECR repos. run `aws.ecr_login()` to establish a new connection
1278
1279    container: String representing container name
1280    tag: String with existing local tag for container name
1281    tag_list: Optional String List of additional tags to push with the container
1282
1283    Returns: True/False
1284    """
1285    global _sessions
1286    loggy.info(f"aws.ecr_tag(): BEGIN (using session named: {_sessions.name})")
1287
1288    return _sessions.ecr_push_and_scan(container, tag, tag_list)
1289
1290
1291def ecr_get_registry_id(session: typing.Optional[AwsSession] = None) -> str:
1292    """
1293    ecr_get_registry_id()
1294
1295    Returns default registry_id (i.e. build account) unless a session is given.
1296
1297    session: AwsSession object to pull the registry_id from a session
1298    """
1299    if session:
1300        loggy.info(f"aws.ecr_get_registry_id(): BEGIN (using session named: {session.name})")
1301
1302    _registry_id = ECR_BASE_COM['registry_id'] if session is None else get_aws_account_id(session)
1303    return _registry_id
1304
1305
1306def ecr_get_region(session: typing.Optional[AwsSession] = None) -> str:
1307    """
1308    ecr_get_region()
1309
1310    Returns default registry region (i.e. build account) unless a session is given.
1311
1312    session: (Optional) String to pull the region from a session
1313    """
1314    if session:
1315        loggy.info(f"aws.ecr_get_region(): BEGIN (using session named: {session.name})")
1316
1317    _region = ECR_BASE_COM['region'] if session is None else get_region(session)
1318    return _region
1319
1320
1321def ecr_describe_image(container: str, tag: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> dict:
1322    """
1323    ecr_describe_image()
1324
1325    Returns a dict with the response from aws call to describe images
1326
1327    container: String of container
1328    tag: String of container tag
1329    session: will use this session to build the client, default is _sessions
1330    region: will use a specfic region to build the client, default is _sessions.region_name
1331    """
1332    global _sessions
1333    _s = _sessions.session if session is None else session
1334    _r = _s.session.region_name if region is None else region
1335    loggy.info(f"aws.ecr_describe_image(): BEGIN (using session named: {_s.name})")
1336
1337    client = _s.session.client('ecr', region_name=_r)
1338
1339    try:
1340        response = client.describe_images(
1341            repositoryName=ecr_strip_container_name(container),
1342            imageIds=[
1343                {
1344                    'imageTag': tag
1345                }
1346            ]
1347        )
1348        # loggy.info(str(response))
1349        loggy.info("aws.ecr_describe_image(): Successfully pulled image information.")
1350    except Exception as e:
1351        loggy.info(f"aws.ecr_describe_image(): Failed to pull image information: {str(e)}")
1352        return {}
1353
1354    if not response.get('imageDetails'):
1355        loggy.info(f"aws.ecr_describe_image(): Failed to pull image information. {str(response)}")
1356        return {}
1357
1358    return response
1359
1360
1361def ecr_logout(registry_id: typing.Optional[str] = None, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> None:
1362    """
1363    ecr_logout()
1364
1365    Logout from an ECR repo
1366
1367    registry_id: Authenticate to a different registry_id (aka AWS ECR)
1368    session: will use this session to build the client, default is _sessions
1369    region: will use a specfic region to build the client, default is _sessions.region_name
1370    """
1371    global _sessions
1372
1373    loggy.info("aws.ecr_logout(): BEGIN")
1374
1375    _s = _sessions.session if session is None else session
1376    _r = _s.session.region_name if region is None else region
1377    _reg = get_aws_account_id(_s) if registry_id is None else registry_id
1378    _repo = f"{_reg}.dkr.ecr.{_r}.amazonaws.com"
1379
1380    docker.logout(repo=_repo)
1381    return
1382
1383
1384def ecr_login(registry_id: typing.Optional[str] = None, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> bool:
1385    """
1386    ecr_login()
1387
1388    Authenticate Docker against an ECR repository.
1389
1390    Default: Authenticate using _sessions (current environment) to pull/push there.
1391
1392    registry_id: Authenticate to a different registry_id (aka AWS ECR)
1393    session: will use this session to build the client, default is _sessions
1394    region: will use a specfic region to build the client, default is _sessions.region_name
1395
1396    Returns: True/False
1397    """
1398    global _sessions
1399
1400    loggy.info("aws.ecr_login(): BEGIN")
1401
1402    _s = _sessions.session if session is None else session
1403    _r = _s.session.region_name if region is None else region
1404    _reg = get_aws_account_id(_s) if registry_id is None else registry_id
1405
1406    loggy.info(f"aws.ecr_login(): BEGIN (using session named: {_s.name})")
1407
1408    try:
1409        loggy.info(f"aws.ecr_login(): registry_id ({_reg}) region ({_r})")
1410        client = _s.session.client('ecr', region_name=_r)
1411        response = client.get_authorization_token(registryIds=[_reg])
1412    except Exception as e:
1413        loggy.error("Error: " + str(e))
1414        raise
1415
1416    try:
1417        auth = response["authorizationData"][0]
1418    except (IndexError, KeyError):
1419        raise RuntimeError("Unable to get authorization token from ECR!")
1420    except Exception as e:
1421        loggy.error("Error: " + str(e))
1422        raise
1423
1424    auth_token = base64.b64decode(auth["authorizationToken"]).decode()
1425    username, password = auth_token.split(":")
1426
1427    # cmd = [
1428    #     "login",
1429    #     "--username",
1430    #     username,
1431    #     "--password",
1432    #     password,
1433    #     auth["proxyEndpoint"],
1434    # ]
1435
1436    return docker.login(username=username, password=password, repo=auth["proxyEndpoint"])
1437
1438
1439def ecr_generate_build_fqcn(container: str) -> [str, str]:
1440    """
1441    ecr_generate_build_fqcn()
1442
1443    Generate a fully qualified aws docker container string for build account
1444    (i.e. 552324424.dkr.ecr.us-east-1.amazonaws.com/mirrored/timothy)
1445
1446    container: String representing container name:tag
1447
1448    Returns: String container and String tag (None if tag doesn't exist)
1449    """
1450    global _sessions
1451    loggy.info(f"aws.ecr_generate_build_fqcn(): BEGIN (using session named: {_sessions.name})")
1452    return _sessions.ecr_generate_fqcn(container=container)
1453
1454
1455def ecr_generate_fqcn(container: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> [str, str]:
1456    """
1457    ecr_generate_fqcn()
1458
1459    Generate a fully qualified aws docker container string based on current session Credentials
1460    (i.e. 552324424.dkr.ecr.us-east-1.amazonaws.com/mirrored/timothy)
1461
1462    container: String representing container name:tag
1463
1464    Returns: String container and String tag (None if tag doesn't exist)
1465    """
1466    global _sessions
1467
1468    if "dkr.ecr" in container:
1469        loggy.info(f"aws.ecr_generate_fqcn(): ECR URL already exists: {container}. Stripping container and creating a new ECR URL")
1470        container = ecr_strip_container_name(container=container)
1471        # return container.split(':')
1472
1473    _s = _sessions.session if session is None else session
1474    _r = ecr_get_region() if session is None else _s.session.region_name if region is None else region
1475    _reg = ecr_get_registry_id(_s)
1476
1477    loggy.info(f"aws.ecr_generate_fqcn(): BEGIN (using session named: {_s.name})")
1478
1479    loggy.info(f"aws.ecr_generate_fqcn(): Generated ECR URL: {_reg}.dkr.ecr.{_r}.amazonaws.com/{container}")
1480
1481    _ret = f"{_reg}.dkr.ecr.{_r}.amazonaws.com/{container}".split(':')
1482    if len(_ret) < 2:
1483        return _ret[0], None
1484
1485    return _ret[0], _ret[1]
1486
1487
1488def ecr_pull_from_build(container: str, tag: typing.Optional[str] = None) -> [str, str]:
1489    """
1490    ecr_pull_from_build()
1491
1492    Run a docker pull for a container:tag
1493
1494    container: String representing container name ("name:tag" is accepted)
1495    tag: String representing the tag of the container to pull (Optional)
1496
1497    NOTE: if tag is None and container does not include :tag in the String, we
1498    will append :latest to the container name
1499
1500    Returns: Tuple [str, str] First str is full ECR name of container, second str is tag
1501    """
1502    global _sessions
1503    loggy.info(f"aws.ecr_pull_from_build(): BEGIN (using session named: {_sessions.name})")
1504    return _sessions.ecr_pull_from_build(container=container, tag=tag)
1505
1506
1507def ecr_pull(container: str, tag: typing.Optional[str] = None, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> [str, str]:
1508    """
1509    ecr_pull()
1510
1511    Run a docker pull for a container:tag
1512    Ensure you run aws.ecr_login() first
1513
1514    container: String representing container name ("name:tag" is accepted)
1515    tag: String representing the tag of the container to pull (Optional)
1516
1517    NOTE: if tag is None and container does not include :tag in the String, we
1518    will append :latest to the container name
1519
1520    Returns: Tuple [str, str] First str is full ECR name of container, second str is tag
1521    """
1522    # global _sessions
1523    # _s = _sessions.session if session is None else session
1524    #
1525    # ecr_login(_s)
1526    # _container = container if ':' in container else f"{container}:latest" if tag is None else f"{container}:{tag}"
1527
1528    _c, _t = ecr_generate_fqcn(container=container, session=session, region=region)
1529    _t = tag if tag is not None else 'latest' if _t is None else _t
1530
1531    loggy.info(f"aws.ecr_pull(): Pulling container: {_c}:{_t}")
1532
1533    if not docker.docker("pull", f"{_c}:{_t}"):
1534        return None, None
1535
1536    return _c, _t
1537
1538
1539def ecr_check_tag_exists(container: str, tag_list: list, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> list:
1540    """
1541    ecr_check_tag_exists()
1542
1543    Check if tags exist for a container
1544
1545    container: String representing container name
1546    tag: String List of tags to check
1547    session: will use a different session to build the client, default is build session
1548    region: will use a different region to build the client, default is build region
1549
1550    Returns: String List of tags that are not found. Will return empty List on failure. (i.e. Fail Open)
1551    """
1552    global _sessions
1553    _s = _sessions.session if session is None else session
1554    _r = _s.session.region_name if region is None else region
1555
1556    loggy.info(f"aws.ecr_check_tag_exists(): BEGIN (using session named: {_s.name})")
1557
1558    client = _s.session.client('ecr', region_name=_r)
1559
1560    missing = tag_list
1561    try:
1562        response = client.describe_images(
1563            repositoryName=ecr_strip_container_name(container),
1564            filter={
1565                'tagStatus': 'TAGGED'
1566            }
1567        )
1568        loggy.info(str(response))
1569        for i in response['imageDetails']:
1570            for tag in tag_list:
1571                if tag in i['imageTags']:
1572                    loggy.info(f"aws.ecr_check_tag_exists(): Found tag {tag}. Removing from List.")
1573                    missing.remove(tag)
1574    except Exception as e:
1575        loggy.info(f"aws.ecr_check_tag_exists(): Failed to retrieve tags: {str(e)}")
1576        loggy.info("aws.ecr_check_tag_exists(): FAILING OPEN! Returning empty List.")
1577        return []
1578
1579    return missing
1580
1581
1582def ecr_push(container: str, tag: str, tag_list: typing.Optional[list] = None, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> bool:
1583    """
1584    ecr_push()
1585
1586    Push a new container to build account ECR
1587
1588    container: String representing container name
1589    tag: String with existing local tag for container name
1590    tag_list: Optional String List of additional tags to push with the container
1591    session: will use a different session to build the client, default is build session
1592
1593    Returns: True/False
1594    """
1595    global _sessions
1596    loggy.info(f"aws.ecr_push(): BEGIN (using session named: {_sessions.name})")
1597
1598    return _sessions.ecr_push(container, tag, tag_list, session, region)
1599
1600
1601def ecr_strip_container_name(container: str) -> str:
1602    """"
1603    ecr_strip_container_name()
1604
1605    Remove prefix of repo url from the repo name itself
1606
1607    container: String like "575815261832.dkr.ecr.******.amazonaws.com/mirrored/amazoncorretto"
1608
1609    Returns: String containing just container like "mirrored/amazoncorretto"
1610    """
1611    _new = container.split('/')
1612    del _new[0]
1613    return '/'.join(_new)
1614
1615
1616def ecr_scan(container: str, tag: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> bool:
1617    """
1618    ecr_scan()
1619
1620    Scan and wait for results of a container
1621
1622    container: String representing container name
1623    tag: String tags to scan
1624    session: will use a different to build the client, default is build session
1625
1626    Returns: True/False
1627    """
1628    global _sessions
1629    _s = _sessions.session if session is None else session
1630    _r = _s.session.region_name if region is None else region
1631
1632    loggy.info(f"aws.ecr_scan(): BEGIN (using session named: {_s.name})")
1633
1634    client = _s.session.client('ecr', region_name=_r)
1635    res = "IN_PROGRESS"
1636    _wait = 300
1637    try:
1638        while 'IN_PROGRESS' in res and _wait > 0:
1639            loggy.info(f"aws.ecr_scan(): Waiting up to 300 seconds for the ECR Scan of {container} with tag {tag} to complete.")
1640            response = client.describe_image_scan_findings(
1641                repositoryName=ecr_strip_container_name(container),
1642                imageId={
1643                    'imageTag': tag
1644                }
1645            )
1646            time.sleep(5)
1647            _wait -= 5
1648            res = response['imageScanStatus']['status']
1649
1650        loggy.info(f"aws.ecr_scan(): Scan completed with: {res}")
1651    except Exception as e:
1652        loggy.info(f"aws.ecr_scan(): Failed to get the scan status: {str(e)}")
1653        return False
1654
1655    """
1656    TODO: Check the scan for vulns
1657    """
1658
1659    return True
1660
1661
1662"""
1663SSM Utils
1664"""
1665
1666
1667def ssm_get_parameter_from_build(name: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> str:
1668    """
1669    ssm_get_parameter_from_build()
1670
1671    Get an SSM Parameter Value from the build account.
1672
1673    name: String containing param friendly name or arn. Will convert arn into friendly name before use.
1674    session: aws.Sessions() will use a different session to build the client, default is _sessions
1675    region: String defaults to AWS_DEFAULT_REGION or us-east-1
1676
1677    Returns String containing param value
1678    """
1679    global _sessions
1680    loggy.info(f"aws.ssm_get_parameter_from_build(): BEGIN (using session named: {_sessions.name})")
1681    return _sessions.ssm_get_parameter(name, session, region)
1682
1683
1684# def ssm_get_parameter(name, session=None, region=None, build=None):
1685def ssm_get_parameter(name: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> str:
1686    """
1687    ssm_get_parameter()
1688
1689    Get an SSM Parameter Value
1690
1691    name: String containing param friendly name or arn. Will convert arn into friendly name before use.
1692    region: String defaults to AWS_DEFAULT_REGION or us-east-1
1693    session: aws.Sessions() will use a different session to build the client, default is _sessions
1694
1695    Returns String containing param value
1696    """
1697    global _sessions
1698    _s = _sessions.session if session is None else session
1699    _r = _s.session.region_name if region is None else region
1700
1701    loggy.info(f"aws.ssm_get_parameter(): BEGIN (using session named: {_s.name})")
1702
1703    """
1704    This function only takes a name not an arn
1705    """
1706    name = name if ':parameter' not in name else name.split(':parameter')[1]
1707
1708    try:
1709        client = _s.session.client(service_name='ssm', region_name=_r)
1710        response = client.get_parameter(Name=name, WithDecryption=True)
1711
1712        return response['Parameter']['Value']
1713    except Exception as e:
1714        loggy.error("Error: " + str(e))
1715
1716    return None
1717
1718
1719def ssm_put_parameter(name: str,
1720                      value: str,
1721                      type: typing.Optional[str] = None,
1722                      session: typing.Optional[AwsSession] = None,
1723                      region: typing.Optional[str] = None,
1724                      KeyId: typing.Optional[str] = None) -> str:
1725    """
1726    ssm_put_parameter()
1727
1728    Create/Update an SSM Parameter
1729
1730    name and value are required
1731    type defaults to String
1732    region defaults to AWS_DEFAULT_REGION or us-east-1
1733    session will use a different session to build the client, default is _sessions
1734    KeyId is a string containing the KeyId for the encryption key to use if not default
1735
1736    Returns: String of new ssm param version
1737    """
1738    global _sessions
1739    _s = _sessions.session if session is None else session
1740    _r = _s.session.region_name if region is None else region
1741
1742    loggy.info(f"aws.ssm_put_parameter(): BEGIN (using session named: {_s.name})")
1743
1744    if not type:
1745        type = "String"
1746
1747    """
1748    This function only takes a name not an arn
1749    """
1750    name = name if ':parameter' not in name else name.split(':parameter')[1]
1751
1752    try:
1753        client = _s.session.client(service_name='ssm', region_name=_r)
1754        if KeyId:
1755            response = client.put_parameter(Name=name, Value=value, Type=type, Overwrite=True, KeyId=KeyId)
1756        else:
1757            response = client.put_parameter(Name=name, Value=value, Type=type, Overwrite=True)
1758
1759        return str(response['Version'])
1760    except Exception as e:
1761        loggy.error("Error: " + str(e))
1762
1763    return None
1764
1765
1766"""
1767SecretsManger Utils
1768"""
1769
1770
1771def secrets_get_secret_string(name: str, session: typing.Optional[AwsSession] = None, region: typing.Optional[str] = None) -> dict:
1772    """
1773    secrets_get_secret_string()
1774
1775    Retrieve sectret string value using ENV Variables as Credentials.
1776    This will retrieve the AWSCURRENT version.
1777
1778    name is required
1779    region defaults to AWS_DEFAULT_REGION or us-east-1
1780    session will use a different session to build the client, default is _sessions
1781
1782    Returns: dict containing secret string
1783    """
1784    global _sessions
1785    _s = _sessions.session if session is None else session
1786    _r = _s.session.region_name if region is None else region
1787
1788    loggy.info(f"aws.secrets_get_secret_string(): BEGIN (using session named: {_s.name})")
1789    loggy.info(f"aws.secrets_get_secret_string(): region name {_r}")
1790    try:
1791        client = _s.session.client(service_name='secretsmanager', region_name=_r)
1792
1793        response = client.get_secret_value(SecretId=name)
1794
1795        return json.loads(response['SecretString'])
1796    except Exception as e:
1797        loggy.error("Error: " + str(e))
1798        raise
1799
1800    return {}