449 lines
16 KiB
Python
449 lines
16 KiB
Python
|
# Copyright (c) 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved
|
||
|
|
#
|
||
|
|
# Permission is hereby granted, free of charge, to any person obtaining a
|
||
|
|
# copy of this software and associated documentation files (the
|
||
|
|
# "Software"), to deal in the Software without restriction, including
|
||
|
|
# without limitation the rights to use, copy, modify, merge, publish, dis-
|
||
|
|
# tribute, sublicense, and/or sell copies of the Software, and to permit
|
||
|
|
# persons to whom the Software is furnished to do so, subject to the fol-
|
||
|
|
# lowing conditions:
|
||
|
|
#
|
||
|
|
# The above copyright notice and this permission notice shall be included
|
||
|
|
# in all copies or substantial portions of the Software.
|
||
|
|
#
|
||
|
|
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
||
|
|
# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABIL-
|
||
|
|
# ITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
|
||
|
|
# SHALL THE AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
||
|
|
# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||
|
|
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
|
||
|
|
# IN THE SOFTWARE.
|
||
|
|
#
|
||
|
|
|
||
|
|
import boto
|
||
|
|
from boto.compat import json
|
||
|
|
from boto.connection import AWSQueryConnection
|
||
|
|
from boto.regioninfo import RegionInfo
|
||
|
|
from boto.exception import JSONResponseError
|
||
|
|
from boto.cloudhsm import exceptions
|
||
|
|
|
||
|
|
|
||
|
|
class CloudHSMConnection(AWSQueryConnection):
|
||
|
|
"""
|
||
|
|
AWS CloudHSM Service
|
||
|
|
"""
|
||
|
|
APIVersion = "2014-05-30"
|
||
|
|
DefaultRegionName = "us-east-1"
|
||
|
|
DefaultRegionEndpoint = "cloudhsm.us-east-1.amazonaws.com"
|
||
|
|
ServiceName = "CloudHSM"
|
||
|
|
TargetPrefix = "CloudHsmFrontendService"
|
||
|
|
ResponseError = JSONResponseError
|
||
|
|
|
||
|
|
_faults = {
|
||
|
|
"InvalidRequestException": exceptions.InvalidRequestException,
|
||
|
|
"CloudHsmServiceException": exceptions.CloudHsmServiceException,
|
||
|
|
"CloudHsmInternalException": exceptions.CloudHsmInternalException,
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
def __init__(self, **kwargs):
|
||
|
|
region = kwargs.pop('region', None)
|
||
|
|
if not region:
|
||
|
|
region = RegionInfo(self, self.DefaultRegionName,
|
||
|
|
self.DefaultRegionEndpoint)
|
||
|
|
|
||
|
|
if 'host' not in kwargs or kwargs['host'] is None:
|
||
|
|
kwargs['host'] = region.endpoint
|
||
|
|
|
||
|
|
super(CloudHSMConnection, self).__init__(**kwargs)
|
||
|
|
self.region = region
|
||
|
|
|
||
|
|
def _required_auth_capability(self):
|
||
|
|
return ['hmac-v4']
|
||
|
|
|
||
|
|
def create_hapg(self, label):
|
||
|
|
"""
|
||
|
|
Creates a high-availability partition group. A high-
|
||
|
|
availability partition group is a group of partitions that
|
||
|
|
spans multiple physical HSMs.
|
||
|
|
|
||
|
|
:type label: string
|
||
|
|
:param label: The label of the new high-availability partition group.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {'Label': label, }
|
||
|
|
return self.make_request(action='CreateHapg',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def create_hsm(self, subnet_id, ssh_key, iam_role_arn, subscription_type,
|
||
|
|
eni_ip=None, external_id=None, client_token=None,
|
||
|
|
syslog_ip=None):
|
||
|
|
"""
|
||
|
|
Creates an uninitialized HSM instance. Running this command
|
||
|
|
provisions an HSM appliance and will result in charges to your
|
||
|
|
AWS account for the HSM.
|
||
|
|
|
||
|
|
:type subnet_id: string
|
||
|
|
:param subnet_id: The identifier of the subnet in your VPC in which to
|
||
|
|
place the HSM.
|
||
|
|
|
||
|
|
:type ssh_key: string
|
||
|
|
:param ssh_key: The SSH public key to install on the HSM.
|
||
|
|
|
||
|
|
:type eni_ip: string
|
||
|
|
:param eni_ip: The IP address to assign to the HSM's ENI.
|
||
|
|
|
||
|
|
:type iam_role_arn: string
|
||
|
|
:param iam_role_arn: The ARN of an IAM role to enable the AWS CloudHSM
|
||
|
|
service to allocate an ENI on your behalf.
|
||
|
|
|
||
|
|
:type external_id: string
|
||
|
|
:param external_id: The external ID from **IamRoleArn**, if present.
|
||
|
|
|
||
|
|
:type subscription_type: string
|
||
|
|
:param subscription_type: The subscription type.
|
||
|
|
|
||
|
|
:type client_token: string
|
||
|
|
:param client_token: A user-defined token to ensure idempotence.
|
||
|
|
Subsequent calls to this action with the same token will be
|
||
|
|
ignored.
|
||
|
|
|
||
|
|
:type syslog_ip: string
|
||
|
|
:param syslog_ip: The IP address for the syslog monitoring server.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {
|
||
|
|
'SubnetId': subnet_id,
|
||
|
|
'SshKey': ssh_key,
|
||
|
|
'IamRoleArn': iam_role_arn,
|
||
|
|
'SubscriptionType': subscription_type,
|
||
|
|
}
|
||
|
|
if eni_ip is not None:
|
||
|
|
params['EniIp'] = eni_ip
|
||
|
|
if external_id is not None:
|
||
|
|
params['ExternalId'] = external_id
|
||
|
|
if client_token is not None:
|
||
|
|
params['ClientToken'] = client_token
|
||
|
|
if syslog_ip is not None:
|
||
|
|
params['SyslogIp'] = syslog_ip
|
||
|
|
return self.make_request(action='CreateHsm',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def create_luna_client(self, certificate, label=None):
|
||
|
|
"""
|
||
|
|
Creates an HSM client.
|
||
|
|
|
||
|
|
:type label: string
|
||
|
|
:param label: The label for the client.
|
||
|
|
|
||
|
|
:type certificate: string
|
||
|
|
:param certificate: The contents of a Base64-Encoded X.509 v3
|
||
|
|
certificate to be installed on the HSMs used by this client.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {'Certificate': certificate, }
|
||
|
|
if label is not None:
|
||
|
|
params['Label'] = label
|
||
|
|
return self.make_request(action='CreateLunaClient',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def delete_hapg(self, hapg_arn):
|
||
|
|
"""
|
||
|
|
Deletes a high-availability partition group.
|
||
|
|
|
||
|
|
:type hapg_arn: string
|
||
|
|
:param hapg_arn: The ARN of the high-availability partition group to
|
||
|
|
delete.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {'HapgArn': hapg_arn, }
|
||
|
|
return self.make_request(action='DeleteHapg',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def delete_hsm(self, hsm_arn):
|
||
|
|
"""
|
||
|
|
Deletes an HSM. Once complete, this operation cannot be undone
|
||
|
|
and your key material cannot be recovered.
|
||
|
|
|
||
|
|
:type hsm_arn: string
|
||
|
|
:param hsm_arn: The ARN of the HSM to delete.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {'HsmArn': hsm_arn, }
|
||
|
|
return self.make_request(action='DeleteHsm',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def delete_luna_client(self, client_arn):
|
||
|
|
"""
|
||
|
|
Deletes a client.
|
||
|
|
|
||
|
|
:type client_arn: string
|
||
|
|
:param client_arn: The ARN of the client to delete.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {'ClientArn': client_arn, }
|
||
|
|
return self.make_request(action='DeleteLunaClient',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def describe_hapg(self, hapg_arn):
|
||
|
|
"""
|
||
|
|
Retrieves information about a high-availability partition
|
||
|
|
group.
|
||
|
|
|
||
|
|
:type hapg_arn: string
|
||
|
|
:param hapg_arn: The ARN of the high-availability partition group to
|
||
|
|
describe.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {'HapgArn': hapg_arn, }
|
||
|
|
return self.make_request(action='DescribeHapg',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def describe_hsm(self, hsm_arn=None, hsm_serial_number=None):
|
||
|
|
"""
|
||
|
|
Retrieves information about an HSM. You can identify the HSM
|
||
|
|
by its ARN or its serial number.
|
||
|
|
|
||
|
|
:type hsm_arn: string
|
||
|
|
:param hsm_arn: The ARN of the HSM. Either the HsmArn or the
|
||
|
|
SerialNumber parameter must be specified.
|
||
|
|
|
||
|
|
:type hsm_serial_number: string
|
||
|
|
:param hsm_serial_number: The serial number of the HSM. Either the
|
||
|
|
HsmArn or the HsmSerialNumber parameter must be specified.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {}
|
||
|
|
if hsm_arn is not None:
|
||
|
|
params['HsmArn'] = hsm_arn
|
||
|
|
if hsm_serial_number is not None:
|
||
|
|
params['HsmSerialNumber'] = hsm_serial_number
|
||
|
|
return self.make_request(action='DescribeHsm',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def describe_luna_client(self, client_arn=None,
|
||
|
|
certificate_fingerprint=None):
|
||
|
|
"""
|
||
|
|
Retrieves information about an HSM client.
|
||
|
|
|
||
|
|
:type client_arn: string
|
||
|
|
:param client_arn: The ARN of the client.
|
||
|
|
|
||
|
|
:type certificate_fingerprint: string
|
||
|
|
:param certificate_fingerprint: The certificate fingerprint.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {}
|
||
|
|
if client_arn is not None:
|
||
|
|
params['ClientArn'] = client_arn
|
||
|
|
if certificate_fingerprint is not None:
|
||
|
|
params['CertificateFingerprint'] = certificate_fingerprint
|
||
|
|
return self.make_request(action='DescribeLunaClient',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def get_config(self, client_arn, client_version, hapg_list):
|
||
|
|
"""
|
||
|
|
Gets the configuration files necessary to connect to all high
|
||
|
|
availability partition groups the client is associated with.
|
||
|
|
|
||
|
|
:type client_arn: string
|
||
|
|
:param client_arn: The ARN of the client.
|
||
|
|
|
||
|
|
:type client_version: string
|
||
|
|
:param client_version: The client version.
|
||
|
|
|
||
|
|
:type hapg_list: list
|
||
|
|
:param hapg_list: A list of ARNs that identify the high-availability
|
||
|
|
partition groups that are associated with the client.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {
|
||
|
|
'ClientArn': client_arn,
|
||
|
|
'ClientVersion': client_version,
|
||
|
|
'HapgList': hapg_list,
|
||
|
|
}
|
||
|
|
return self.make_request(action='GetConfig',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def list_available_zones(self):
|
||
|
|
"""
|
||
|
|
Lists the Availability Zones that have available AWS CloudHSM
|
||
|
|
capacity.
|
||
|
|
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {}
|
||
|
|
return self.make_request(action='ListAvailableZones',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def list_hapgs(self, next_token=None):
|
||
|
|
"""
|
||
|
|
Lists the high-availability partition groups for the account.
|
||
|
|
|
||
|
|
This operation supports pagination with the use of the
|
||
|
|
NextToken member. If more results are available, the NextToken
|
||
|
|
member of the response contains a token that you pass in the
|
||
|
|
next call to ListHapgs to retrieve the next set of items.
|
||
|
|
|
||
|
|
:type next_token: string
|
||
|
|
:param next_token: The NextToken value from a previous call to
|
||
|
|
ListHapgs. Pass null if this is the first call.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {}
|
||
|
|
if next_token is not None:
|
||
|
|
params['NextToken'] = next_token
|
||
|
|
return self.make_request(action='ListHapgs',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def list_hsms(self, next_token=None):
|
||
|
|
"""
|
||
|
|
Retrieves the identifiers of all of the HSMs provisioned for
|
||
|
|
the current customer.
|
||
|
|
|
||
|
|
This operation supports pagination with the use of the
|
||
|
|
NextToken member. If more results are available, the NextToken
|
||
|
|
member of the response contains a token that you pass in the
|
||
|
|
next call to ListHsms to retrieve the next set of items.
|
||
|
|
|
||
|
|
:type next_token: string
|
||
|
|
:param next_token: The NextToken value from a previous call to
|
||
|
|
ListHsms. Pass null if this is the first call.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {}
|
||
|
|
if next_token is not None:
|
||
|
|
params['NextToken'] = next_token
|
||
|
|
return self.make_request(action='ListHsms',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def list_luna_clients(self, next_token=None):
|
||
|
|
"""
|
||
|
|
Lists all of the clients.
|
||
|
|
|
||
|
|
This operation supports pagination with the use of the
|
||
|
|
NextToken member. If more results are available, the NextToken
|
||
|
|
member of the response contains a token that you pass in the
|
||
|
|
next call to ListLunaClients to retrieve the next set of
|
||
|
|
items.
|
||
|
|
|
||
|
|
:type next_token: string
|
||
|
|
:param next_token: The NextToken value from a previous call to
|
||
|
|
ListLunaClients. Pass null if this is the first call.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {}
|
||
|
|
if next_token is not None:
|
||
|
|
params['NextToken'] = next_token
|
||
|
|
return self.make_request(action='ListLunaClients',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def modify_hapg(self, hapg_arn, label=None, partition_serial_list=None):
|
||
|
|
"""
|
||
|
|
Modifies an existing high-availability partition group.
|
||
|
|
|
||
|
|
:type hapg_arn: string
|
||
|
|
:param hapg_arn: The ARN of the high-availability partition group to
|
||
|
|
modify.
|
||
|
|
|
||
|
|
:type label: string
|
||
|
|
:param label: The new label for the high-availability partition group.
|
||
|
|
|
||
|
|
:type partition_serial_list: list
|
||
|
|
:param partition_serial_list: The list of partition serial numbers to
|
||
|
|
make members of the high-availability partition group.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {'HapgArn': hapg_arn, }
|
||
|
|
if label is not None:
|
||
|
|
params['Label'] = label
|
||
|
|
if partition_serial_list is not None:
|
||
|
|
params['PartitionSerialList'] = partition_serial_list
|
||
|
|
return self.make_request(action='ModifyHapg',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def modify_hsm(self, hsm_arn, subnet_id=None, eni_ip=None,
|
||
|
|
iam_role_arn=None, external_id=None, syslog_ip=None):
|
||
|
|
"""
|
||
|
|
Modifies an HSM.
|
||
|
|
|
||
|
|
:type hsm_arn: string
|
||
|
|
:param hsm_arn: The ARN of the HSM to modify.
|
||
|
|
|
||
|
|
:type subnet_id: string
|
||
|
|
:param subnet_id: The new identifier of the subnet that the HSM is in.
|
||
|
|
|
||
|
|
:type eni_ip: string
|
||
|
|
:param eni_ip: The new IP address for the elastic network interface
|
||
|
|
attached to the HSM.
|
||
|
|
|
||
|
|
:type iam_role_arn: string
|
||
|
|
:param iam_role_arn: The new IAM role ARN.
|
||
|
|
|
||
|
|
:type external_id: string
|
||
|
|
:param external_id: The new external ID.
|
||
|
|
|
||
|
|
:type syslog_ip: string
|
||
|
|
:param syslog_ip: The new IP address for the syslog monitoring server.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {'HsmArn': hsm_arn, }
|
||
|
|
if subnet_id is not None:
|
||
|
|
params['SubnetId'] = subnet_id
|
||
|
|
if eni_ip is not None:
|
||
|
|
params['EniIp'] = eni_ip
|
||
|
|
if iam_role_arn is not None:
|
||
|
|
params['IamRoleArn'] = iam_role_arn
|
||
|
|
if external_id is not None:
|
||
|
|
params['ExternalId'] = external_id
|
||
|
|
if syslog_ip is not None:
|
||
|
|
params['SyslogIp'] = syslog_ip
|
||
|
|
return self.make_request(action='ModifyHsm',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def modify_luna_client(self, client_arn, certificate):
|
||
|
|
"""
|
||
|
|
Modifies the certificate used by the client.
|
||
|
|
|
||
|
|
This action can potentially start a workflow to install the
|
||
|
|
new certificate on the client's HSMs.
|
||
|
|
|
||
|
|
:type client_arn: string
|
||
|
|
:param client_arn: The ARN of the client.
|
||
|
|
|
||
|
|
:type certificate: string
|
||
|
|
:param certificate: The new certificate for the client.
|
||
|
|
|
||
|
|
"""
|
||
|
|
params = {
|
||
|
|
'ClientArn': client_arn,
|
||
|
|
'Certificate': certificate,
|
||
|
|
}
|
||
|
|
return self.make_request(action='ModifyLunaClient',
|
||
|
|
body=json.dumps(params))
|
||
|
|
|
||
|
|
def make_request(self, action, body):
|
||
|
|
headers = {
|
||
|
|
'X-Amz-Target': '%s.%s' % (self.TargetPrefix, action),
|
||
|
|
'Host': self.region.endpoint,
|
||
|
|
'Content-Type': 'application/x-amz-json-1.1',
|
||
|
|
'Content-Length': str(len(body)),
|
||
|
|
}
|
||
|
|
http_request = self.build_base_http_request(
|
||
|
|
method='POST', path='/', auth_path='/', params={},
|
||
|
|
headers=headers, data=body)
|
||
|
|
response = self._mexe(http_request, sender=None,
|
||
|
|
override_num_retries=10)
|
||
|
|
response_body = response.read().decode('utf-8')
|
||
|
|
boto.log.debug(response_body)
|
||
|
|
if response.status == 200:
|
||
|
|
if response_body:
|
||
|
|
return json.loads(response_body)
|
||
|
|
else:
|
||
|
|
json_body = json.loads(response_body)
|
||
|
|
fault_name = json_body.get('__type', None)
|
||
|
|
exception_class = self._faults.get(fault_name, self.ResponseError)
|
||
|
|
raise exception_class(response.status, response.reason,
|
||
|
|
body=json_body)
|
||
|
|
|