resources.py

#!/usr/bin/env python
"""
Script to generate a CloudFormation Template that brings up all of the AWS
resources needed to run lambda-chat

This requires Python 2.7. To get the required libraries:
 sudo pip install docopt boto troposphere awacs pyyaml --upgrade

Usage:
 resources.py cf
 resources.py launch --region=<region> --profile=<profile>
 resources.py update --region=<region> --profile=<profile>
 resources.py delete --region=<region> --profile=<profile>
 resources.py output --region=<region> --profile=<profile>

Options:
 -h --help Show this screen.
 --version Show version.
 --region=<region> The AWS region to use
 --profile=<profile> The AWS credential profile to use

License:
 Copyright 2015 CloudNative, Inc.
 https://cloudnative.io/

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at

 http://www.apache.org/licenses/LICENSE-2.0

 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.

"""

# Import all the goodness
import sys
from docopt import docopt
import yaml
from boto import cloudformation
from troposphere import Template, Parameter, Output
from troposphere import GetAtt, Ref, Join
import troposphere.iam as iam
import troposphere.sns as sns
import troposphere.s3 as s3
from awacs.aws import Action, Allow, Policy, Statement, Principal, Condition, StringEquals, AWSPrincipal


def default_config():
 """
 Returns a dict with the default configuration
 """
 return {
 'stack_name': 'Lambda-Chat',
 'tags': {
 'Name': 'Lambda Chat',
 'Creator': 'CloudNative'
 }
 }


def load_config():
 """
 Returns the default config merged with the what is in the config.yml file
 """
 try:
 # Attempt to load configuration file
 stream = file('config.yml', 'r')
 config = yaml.load(stream)
 config['loaded'] = True
 except IOError:
 config = {}
 config['loaded'] = False

 # Merge with default
 return dict(default_config().items() + config.items())


def assert_config_loaded():
 """
 Stops execution and displays an error message if the settings have not
 been loaded from config.yml
 """
 if not config['loaded']:
 print('ERROR: Could not load file: config.yml')
 sys.exit(1)


def cf_params():
 """
 Returns the parameters needed to create or update the CloudFormation
 stack
 """
 assert_config_loaded()
 return [
 ('GoogleOAuthClientID', config['google_oauth_client_id']),
 ('WebsiteS3BucketName', config['s3_bucket']),
 ]


def generate_cf_template():
 """
 Returns an entire CloudFormation stack by using troposphere to construct
 each piece
 """
 # Header of CloudFormation template
 t = Template()
 t.add_version("2010-09-09")
 t.add_description("Lambda Chat AWS Resources")
 # Paramters
 description = "should match [0-9]+-[a-z0-9]+.apps.googleusercontent.com"
 google_oauth_client_id = t.add_parameter(Parameter(
 "GoogleOAuthClientID",
 AllowedPattern="[0-9]+-[a-z0-9]+.apps.googleusercontent.com",
 Type="String",
 Description="The Client ID of your Google project",
 ConstraintDescription=description
 ))

 website_s3_bucket_name = t.add_parameter(Parameter(
 "WebsiteS3BucketName",
 AllowedPattern="[a-zA-Z0-9\-]*",
 Type="String",
 Description="Name of S3 bucket to store the website in",
 ConstraintDescription="can contain only alphanumeric characters and dashes.",
 ))

 # The SNS topic the website will publish chat messages to
 website_sns_topic = t.add_resource(sns.Topic(
 'WebsiteSnsTopic',
 TopicName='lambda-chat',
 DisplayName='Lambda Chat'
 ))
 t.add_output(Output(
 "WebsiteSnsTopic",
 Description="sns_topic_arn",
 Value=Ref(website_sns_topic),
 ))

 # The IAM Role and Policy the website will assume to publish to SNS
 website_role = t.add_resource(iam.Role(
 "WebsiteRole",
 Path="/",
 AssumeRolePolicyDocument=Policy(
 Statement=[
 Statement(
 Effect=Allow,
 Action=[Action("sts", "AssumeRoleWithWebIdentity")],
 Principal=Principal("Federated", "accounts.google.com"),
 Condition=Condition(
 StringEquals(
 "accounts.google.com:aud",
 Ref(google_oauth_client_id)
 )
 ),
 ),
 ],
 ),
 ))
 t.add_resource(iam.PolicyType(
 "WebsitePolicy",
 PolicyName="lambda-chat-website-policy",
 Roles=[Ref(website_role)],
 PolicyDocument=Policy(
 Version="2012-10-17",
 Statement=[
 Statement(
 Effect=Allow,
 Action=[Action("sns", "Publish")],
 Resource=[
 Ref(website_sns_topic)
 ],
 ),
 ],
 )
 ))
 t.add_output(Output(
 "WebsiteRole",
 Description="website_iam_role_arn",
 Value=GetAtt(website_role, "Arn"),
 ))

 website_bucket = t.add_resource(s3.Bucket(
 'WebsiteS3Bucket',
 BucketName=Ref(website_s3_bucket_name),
 WebsiteConfiguration=s3.WebsiteConfiguration(
 ErrorDocument="error.html",
 IndexDocument="index.html"
 )
 ))
 t.add_output(Output(
 "S3Bucket",
 Description="s3_bucket",
 Value=Ref(website_bucket),
 ))
 t.add_resource(s3.BucketPolicy(
 'WebsiteS3BucketPolicy',
 Bucket=Ref(website_bucket),
 PolicyDocument={
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "PublicAccess",
 "Effect": "Allow",
 "Principal": "*",
 "Action": ["s3:GetObject"],
 "Resource": [{
 "Fn::Join": [
 "",
 [
 "arn:aws:s3:::",
 {
 "Ref": "WebsiteS3Bucket",
 },
 "/*"
 ]
 ]
 }]
 }
 ]
 }
 ))

 return t


def launch(args, config, cf_conn, template):
 """
 Create new CloudFormation Stack from the template
 """
 print("Creating CloudFormation Stack %s..." % config['stack_name'])
 stack_id = cf_conn.create_stack(
 config['stack_name'],
 template_body=template.to_json(),
 parameters=cf_params(),
 tags=config['tags'],
 capabilities=['CAPABILITY_IAM']
 )
 print('Created ' + stack_id)


def update(args, config, cf_conn, template):
 """
 Update an existing CloudFormation Stack
 """
 print("Updating CloudFormation Stack %s..." % config['stack_name'])
 stack_id = cf_conn.update_stack(
 config['stack_name'],
 template_body=template.to_json(),
 parameters=cf_params(),
 tags=config['tags'],
 capabilities=['CAPABILITY_IAM']
 )
 print('Updated ' + stack_id)


def delete(args, config, cf_conn):
 """
 Deletes an existing CloudFormation Stack
 """
 # Delete an existing CloudFormation Stack with same name
 print("Deleting CloudFormation Stack %s..." % config['stack_name'])
 resp = cf_conn.delete_stack(
 config['stack_name'],
 )
 print(resp)


def output(args, config, cf_conn):
 """
 Describes a CloudFormation Stack and prints the outputs
 """
 print("Describing CloudFormation Stack %s..." % config['stack_name'])
 resp = conn.describe_stacks(
 config['stack_name']
 )
 print('---');
 print('region: %s' % args['--region'])
 for output in resp[0].outputs:
 print("%s: %s" % (output.description, output.value))


if __name__ == '__main__':
 args = docopt(__doc__, version='Lambda Chat AWS Resources 0.2')
 config = load_config()

 print_cf_template = args['cf'] or args['launch']

 try:
 if print_cf_template:
 template = generate_cf_template()
 print(template.to_json())
 if (args['cf']):
 sys.exit(1)

 # Get a connection to AWS CloudFormation in the given region
 conn = cloudformation.connect_to_region(
 args['--region'], profile_name=args['--profile'])

 if (args['launch']):
 launch(args, config, conn, template)

 elif (args['update']):
 update(args, config, conn, template)

 elif (args['delete']):
 delete(args, config, conn)

 elif (args['output']):
 output(args, config, conn)


 except Exception, e:
 print('ERROR')
 print(e)
 print(e.message)