Coverage for /pythoncovmergedfiles/medio/medio/usr/local/lib/python3.11/site-packages/c7n/resources/appelb.py: 46%

1# Copyright The Cloud Custodian Authors. 

2# SPDX-License-Identifier: Apache-2.0 

3""" 

4Application & Network Load Balancers 

5""" 

6import json 

7import logging 

8import re 

9 

10from botocore.exceptions import ClientError 

11from collections import defaultdict 

12from c7n.actions import ActionRegistry, BaseAction, ModifyVpcSecurityGroupsAction 

13from c7n.exceptions import PolicyValidationError 

14from c7n.filters import ( 

15 Filter, 

16 FilterRegistry, 

17 ListItemFilter, 

18 MetricsFilter, 

19 ValueFilter, 

20 WafV2FilterBase, 

21 WafClassicRegionalFilterBase 

22) 

23import c7n.filters.vpc as net_filters 

24from c7n import tags 

25from c7n.manager import resources 

26 

27from c7n.query import QueryResourceManager, DescribeSource, ConfigSource, TypeInfo 

28from c7n.utils import ( 

29 local_session, chunks, type_schema, get_retry, set_annotation) 

30 

31from c7n.resources.aws import Arn 

32from c7n.resources.shield import IsShieldProtected, SetShieldProtection 

33 

34log = logging.getLogger('custodian.app-elb') 

35 

36 

37class DescribeAppElb(DescribeSource): 

38 

39 def get_resources(self, ids, cache=True): 

40 """Support server side filtering on arns or names 

41 """ 

42 if ids[0].startswith('arn:'): 

43 params = {'LoadBalancerArns': ids} 

44 else: 

45 params = {'Names': ids} 

46 return self.query.filter(self.manager, **params) 

47 

48 def augment(self, albs): 

49 _describe_appelb_tags( 

50 albs, 

51 self.manager.session_factory, 

52 self.manager.executor_factory, 

53 self.manager.retry) 

54 

55 return albs 

56 

57 

58class ConfigAppElb(ConfigSource): 

59 

60 def load_resource(self, item): 

61 resource = super(ConfigAppElb, self).load_resource(item) 

62 item_attrs = item['supplementaryConfiguration'][ 

63 'LoadBalancerAttributes'] 

64 if isinstance(item_attrs, str): 

65 item_attrs = json.loads(item_attrs) 

66 # Matches annotation of AppELBAttributeFilterBase filter 

67 resource['Attributes'] = { 

68 attr['key']: parse_attribute_value(attr['value']) for 

69 attr in item_attrs} 

70 return resource 

71 

72 

73@resources.register('app-elb') 

74class AppELB(QueryResourceManager): 

75 """Resource manager for v2 ELBs (AKA ALBs and NLBs). 

76 """ 

77 

78 class resource_type(TypeInfo): 

79 service = 'elbv2' 

80 permission_prefix = 'elasticloadbalancing' 

81 enum_spec = ('describe_load_balancers', 'LoadBalancers', None) 

82 name = 'LoadBalancerName' 

83 id = 'LoadBalancerArn' 

84 filter_name = "Names" 

85 filter_type = "list" 

86 dimension = "LoadBalancer" 

87 date = 'CreatedTime' 

88 cfn_type = config_type = 'AWS::ElasticLoadBalancingV2::LoadBalancer' 

89 arn = "LoadBalancerArn" 

90 # The suffix varies by type of loadbalancer (app vs net) 

91 arn_type = 'loadbalancer/app' 

92 permissions_augment = ("elasticloadbalancing:DescribeTags",) 

93 

94 retry = staticmethod(get_retry(('Throttling',))) 

95 source_mapping = { 

96 'describe': DescribeAppElb, 

97 'config': ConfigAppElb 

98 } 

99 

100 @classmethod 

101 def get_permissions(cls): 

102 # override as the service is not the iam prefix 

103 return ("elasticloadbalancing:DescribeLoadBalancers", 

104 "elasticloadbalancing:DescribeLoadBalancerAttributes", 

105 "elasticloadbalancing:DescribeTags") 

106 

107 

108def _describe_appelb_tags(albs, session_factory, executor_factory, retry): 

109 client = local_session(session_factory).client('elbv2') 

110 

111 def _process_tags(alb_set): 

112 alb_map = {alb['LoadBalancerArn']: alb for alb in alb_set} 

113 

114 results = retry(client.describe_tags, ResourceArns=list(alb_map.keys())) 

115 for tag_desc in results['TagDescriptions']: 

116 if ('ResourceArn' in tag_desc and 

117 tag_desc['ResourceArn'] in alb_map): 

118 alb_map[tag_desc['ResourceArn']]['Tags'] = tag_desc['Tags'] 

119 

120 with executor_factory(max_workers=2) as w: 

121 list(w.map(_process_tags, chunks(albs, 20))) 

122 

123 

124AppELB.filter_registry.register('tag-count', tags.TagCountFilter) 

125AppELB.filter_registry.register('marked-for-op', tags.TagActionFilter) 

126AppELB.filter_registry.register('shield-enabled', IsShieldProtected) 

127AppELB.filter_registry.register('network-location', net_filters.NetworkLocation) 

128AppELB.action_registry.register('set-shield', SetShieldProtection) 

129 

130 

131@AppELB.filter_registry.register('metrics') 

132class AppElbMetrics(MetricsFilter): 

133 """Filter app/net load balancer by metric values. 

134 

135 Note application and network load balancers use different Cloud 

136 Watch metrics namespaces and metric names, the custodian app-elb 

137 resource returns both types of load balancer, so an additional 

138 filter should be used to ensure only targeting a particular 

139 type. ie. `- Type: application` or `- Type: network` 

140 

141 See available application load balancer metrics here 

142 https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-cloudwatch-metrics.html 

143 

144 See available network load balancer metrics here. 

145 https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-cloudwatch-metrics.html 

146 

147 

148 For network load balancer metrics, the metrics filter requires specifying 

149 the namespace parameter to the filter. 

150 

151 .. code-block:: yaml 

152 

153 policies: 

154 - name: net-lb-underutilized 

155 resource: app-elb 

156 filters: 

157 - Type: network 

158 - type: metrics 

159 name: ActiveFlowCount 

160 namespace: AWS/NetworkELB 

161 statistics: Sum 

162 days: 14 

163 value: 100 

164 op: less-than 

165 """ 

166 

167 def get_dimensions(self, resource): 

168 return [{ 

169 'Name': self.model.dimension, 

170 'Value': Arn.parse(resource['LoadBalancerArn']).resource}] 

171 

172 

173@AppELB.filter_registry.register('security-group') 

174class SecurityGroupFilter(net_filters.SecurityGroupFilter): 

175 

176 RelatedIdsExpression = "SecurityGroups[]" 

177 

178 

179@AppELB.filter_registry.register('subnet') 

180class SubnetFilter(net_filters.SubnetFilter): 

181 

182 RelatedIdsExpression = "AvailabilityZones[].SubnetId" 

183 

184 

185@AppELB.filter_registry.register('vpc') 

186class VpcFilter(net_filters.VpcFilter): 

187 

188 RelatedIdsExpression = "VpcId" 

189 

190 

191@AppELB.filter_registry.register('waf-enabled') 

192class WafEnabled(WafClassicRegionalFilterBase): 

193 """Filter Application LoadBalancer by waf-regional web-acl 

194 

195 :example: 

196 

197 .. code-block:: yaml 

198 

199 policies: 

200 - name: filter-elb-waf-regional 

201 resource: app-elb 

202 filters: 

203 - type: waf-enabled 

204 state: false 

205 web-acl: test 

206 """ 

207 

208 # application load balancers don't hold a reference to the associated web acl 

209 # so we have to look them up via the associations on the web acl directly 

210 def get_associated_web_acl(self, resource): 

211 return self.get_web_acl_from_associations( 

212 'APPLICATION_LOAD_BALANCER', 

213 resource['LoadBalancerArn'] 

214 ) 

215 

216 

217@AppELB.filter_registry.register('wafv2-enabled') 

218class WafV2Enabled(WafV2FilterBase): 

219 """Filter Application LoadBalancer by wafv2 web-acl 

220 

221 Supports regex expression for web-acl. 

222 Firewall Manager pushed WebACL's name varies by account and region. 

223 Regex expression can support both local and Firewall Managed WebACL. 

224 

225 :example: 

226 

227 .. code-block:: yaml 

228 

229 policies: 

230 - name: filter-wafv2-elb 

231 resource: app-elb 

232 filters: 

233 - type: wafv2-enabled 

234 state: false 

235 web-acl: testv2 

236 

237 - name: filter-wafv2-elb-regex 

238 resource: app-elb 

239 filters: 

240 - type: wafv2-enabled 

241 state: false 

242 web-acl: .*FMManagedWebACLV2-?FMS-.* 

243 """ 

244 

245 # application load balancers don't hold a reference to the associated web acl 

246 # so we have to look them up via the associations on the web acl directly 

247 def get_associated_web_acl(self, resource): 

248 return self.get_web_acl_from_associations( 

249 'APPLICATION_LOAD_BALANCER', 

250 resource['LoadBalancerArn'] 

251 ) 

252 

253 

254@AppELB.action_registry.register('set-waf') 

255class SetWaf(BaseAction): 

256 """Enable wafv2 protection on Application LoadBalancer. 

257 

258 :example: 

259 

260 .. code-block:: yaml 

261 

262 policies: 

263 - name: set-waf-for-elb 

264 resource: app-elb 

265 filters: 

266 - type: waf-enabled 

267 state: false 

268 web-acl: test 

269 actions: 

270 - type: set-waf 

271 state: true 

272 web-acl: test 

273 

274 - name: disassociate-wafv2-associate-waf-regional-elb 

275 resource: app-elb 

276 filters: 

277 - type: wafv2-enabled 

278 state: true 

279 actions: 

280 - type: set-waf 

281 state: true 

282 web-acl: test 

283 

284 """ 

285 permissions = ('waf-regional:AssociateWebACL', 'waf-regional:ListWebACLs') 

286 

287 schema = type_schema( 

288 'set-waf', required=['web-acl'], **{ 

289 'web-acl': {'type': 'string'}, 

290 # 'force': {'type': 'boolean'}, 

291 'state': {'type': 'boolean'}}) 

292 

293 def validate(self): 

294 found = False 

295 for f in self.manager.iter_filters(): 

296 if isinstance(f, WafEnabled) or isinstance(f, WafV2Enabled): 

297 found = True 

298 break 

299 if not found: 

300 # try to ensure idempotent usage 

301 raise PolicyValidationError( 

302 "set-waf should be used in conjunction with waf-enabled or wafv2-enabled \ 

303 filter on %s" % (self.manager.data,)) 

304 return self 

305 

306 def process(self, resources): 

307 wafs = self.manager.get_resource_manager('waf-regional').resources(augment=False) 

308 name_id_map = {w['Name']: w['WebACLId'] for w in wafs} 

309 target_acl = self.data.get('web-acl') 

310 target_acl_id = name_id_map.get(target_acl, target_acl) 

311 state = self.data.get('state', True) 

312 

313 if state and target_acl_id not in name_id_map.values(): 

314 raise ValueError("invalid web acl: %s" % (target_acl_id)) 

315 

316 client = local_session( 

317 self.manager.session_factory).client('waf-regional') 

318 

319 arn_key = self.manager.resource_type.id 

320 

321 # TODO implement force to reassociate. 

322 # TODO investigate limits on waf association. 

323 for r in resources: 

324 if state: 

325 client.associate_web_acl( 

326 WebACLId=target_acl_id, ResourceArn=r[arn_key]) 

327 else: 

328 client.disassociate_web_acl( 

329 WebACLId=target_acl_id, ResourceArn=r[arn_key]) 

330 

331 

332@AppELB.action_registry.register('set-wafv2') 

333class SetWafV2(BaseAction): 

334 """Enable wafv2 protection on Application LoadBalancer. 

335 

336 Supports regex expression for web-acl 

337 

338 :example: 

339 

340 .. code-block:: yaml 

341 

342 policies: 

343 - name: set-wafv2-for-elb 

344 resource: app-elb 

345 filters: 

346 - type: wafv2-enabled 

347 state: false 

348 web-acl: testv2 

349 actions: 

350 - type: set-wafv2 

351 state: true 

352 web-acl: testv2 

353 

354 - name: disassociate-waf-regional-associate-wafv2-elb 

355 resource: app-elb 

356 filters: 

357 - type: waf-enabled 

358 state: true 

359 actions: 

360 - type: set-wafv2 

361 state: true 

362 

363 policies: 

364 - name: set-wafv2-for-elb-regex 

365 resource: app-elb 

366 filters: 

367 - type: wafv2-enabled 

368 state: false 

369 web-acl: .*FMManagedWebACLV2-?FMS-.* 

370 actions: 

371 - type: set-wafv2 

372 state: true 

373 web-acl: FMManagedWebACLV2-?FMS-TestWebACL 

374 

375 """ 

376 permissions = ('wafv2:AssociateWebACL', 

377 'wafv2:DisassociateWebACL', 

378 'wafv2:ListWebACLs') 

379 

380 schema = type_schema( 

381 'set-wafv2', **{ 

382 'web-acl': {'type': 'string'}, 

383 'state': {'type': 'boolean'}}) 

384 

385 retry = staticmethod(get_retry(( 

386 'ThrottlingException', 

387 'RequestLimitExceeded', 

388 'Throttled', 

389 'ThrottledException', 

390 'Throttling', 

391 'Client.RequestLimitExceeded'))) 

392 

393 def validate(self): 

394 found = False 

395 for f in self.manager.iter_filters(): 

396 if isinstance(f, WafV2Enabled) or isinstance(f, WafEnabled): 

397 found = True 

398 break 

399 if not found: 

400 # try to ensure idempotent usage 

401 raise PolicyValidationError( 

402 "set-wafv2 should be used in conjunction with wafv2-enabled or waf-enabled \ 

403 filter on %s" % (self.manager.data,)) 

404 return self 

405 

406 def process(self, resources): 

407 wafs = self.manager.get_resource_manager('wafv2').resources(augment=False) 

408 name_id_map = {w['Name']: w['ARN'] for w in wafs} 

409 state = self.data.get('state', True) 

410 

411 target_acl_id = '' 

412 if state: 

413 target_acl = self.data.get('web-acl', '') 

414 target_acl_ids = [v for k, v in name_id_map.items() if 

415 re.match(target_acl, k)] 

416 if len(target_acl_ids) != 1: 

417 raise ValueError(f'{target_acl} matching to none or ' 

418 f'multiple webacls') 

419 target_acl_id = target_acl_ids[0] 

420 

421 client = local_session( 

422 self.manager.session_factory).client('wafv2') 

423 

424 arn_key = self.manager.resource_type.id 

425 

426 # TODO implement force to reassociate. 

427 # TODO investigate limits on waf association. 

428 for r in resources: 

429 if state: 

430 self.retry(client.associate_web_acl, 

431 WebACLArn=target_acl_id, 

432 ResourceArn=r[arn_key]) 

433 else: 

434 self.retry(client.disassociate_web_acl, 

435 ResourceArn=r[arn_key]) 

436 

437 

438@AppELB.action_registry.register('set-s3-logging') 

439class SetS3Logging(BaseAction): 

440 """Action to enable/disable S3 logging for an application loadbalancer. 

441 

442 :example: 

443 

444 .. code-block:: yaml 

445 

446 policies: 

447 - name: elbv2-test 

448 resource: app-elb 

449 filters: 

450 - type: is-not-logging 

451 actions: 

452 - type: set-s3-logging 

453 bucket: elbv2logtest 

454 prefix: dahlogs 

455 state: enabled 

456 """ 

457 schema = type_schema( 

458 'set-s3-logging', 

459 state={'enum': ['enabled', 'disabled']}, 

460 bucket={'type': 'string'}, 

461 prefix={'type': 'string'}, 

462 required=('state',)) 

463 

464 permissions = ("elasticloadbalancing:ModifyLoadBalancerAttributes",) 

465 

466 def validate(self): 

467 if self.data.get('state') == 'enabled': 

468 if 'bucket' not in self.data or 'prefix' not in self.data: 

469 raise PolicyValidationError(( 

470 "alb logging enablement requires `bucket` " 

471 "and `prefix` specification on %s" % (self.manager.data,))) 

472 return self 

473 

474 def process(self, resources): 

475 client = local_session(self.manager.session_factory).client('elbv2') 

476 for elb in resources: 

477 elb_arn = elb['LoadBalancerArn'] 

478 attributes = [{ 

479 'Key': 'access_logs.s3.enabled', 

480 'Value': ( 

481 self.data.get('state') == 'enabled' and 'true' or 'value')}] 

482 

483 if self.data.get('state') == 'enabled': 

484 attributes.append({ 

485 'Key': 'access_logs.s3.bucket', 

486 'Value': self.data['bucket']}) 

487 

488 prefix_template = self.data['prefix'] 

489 info = {t['Key']: t['Value'] for t in elb.get('Tags', ())} 

490 info['DNSName'] = elb.get('DNSName', '') 

491 info['AccountId'] = elb['LoadBalancerArn'].split(':')[4] 

492 info['LoadBalancerName'] = elb['LoadBalancerName'] 

493 

494 attributes.append({ 

495 'Key': 'access_logs.s3.prefix', 

496 'Value': prefix_template.format(**info)}) 

497 

498 self.manager.retry( 

499 client.modify_load_balancer_attributes, 

500 LoadBalancerArn=elb_arn, Attributes=attributes) 

501 

502 

503@AppELB.action_registry.register('mark-for-op') 

504class AppELBMarkForOpAction(tags.TagDelayedAction): 

505 """Action to create a delayed action on an ELB to start at a later date 

506 

507 :example: 

508 

509 .. code-block:: yaml 

510 

511 policies: 

512 - name: appelb-failed-mark-for-op 

513 resource: app-elb 

514 filters: 

515 - "tag:custodian_elb_cleanup": absent 

516 - State: failed 

517 actions: 

518 - type: mark-for-op 

519 tag: custodian_elb_cleanup 

520 msg: "AppElb failed: {op}@{action_date}" 

521 op: delete 

522 days: 1 

523 """ 

524 

525 batch_size = 1 

526 

527 

528@AppELB.action_registry.register('tag') 

529class AppELBTagAction(tags.Tag): 

530 """Action to create tag/tags on an ELB 

531 

532 :example: 

533 

534 .. code-block:: yaml 

535 

536 policies: 

537 - name: appelb-create-required-tag 

538 resource: app-elb 

539 filters: 

540 - "tag:RequiredTag": absent 

541 actions: 

542 - type: tag 

543 key: RequiredTag 

544 value: RequiredValue 

545 """ 

546 

547 batch_size = 1 

548 permissions = ("elasticloadbalancing:AddTags",) 

549 

550 def process_resource_set(self, client, resource_set, ts): 

551 client.add_tags( 

552 ResourceArns=[alb['LoadBalancerArn'] for alb in resource_set], 

553 Tags=ts) 

554 

555 

556@AppELB.action_registry.register('remove-tag') 

557class AppELBRemoveTagAction(tags.RemoveTag): 

558 """Action to remove tag/tags from an ELB 

559 

560 :example: 

561 

562 .. code-block:: yaml 

563 

564 policies: 

565 - name: appelb-delete-expired-tag 

566 resource: app-elb 

567 filters: 

568 - "tag:ExpiredTag": present 

569 actions: 

570 - type: remove-tag 

571 tags: ["ExpiredTag"] 

572 """ 

573 

574 batch_size = 1 

575 permissions = ("elasticloadbalancing:RemoveTags",) 

576 

577 def process_resource_set(self, client, resource_set, tag_keys): 

578 client.remove_tags( 

579 ResourceArns=[alb['LoadBalancerArn'] for alb in resource_set], 

580 TagKeys=tag_keys) 

581 

582 

583@AppELB.action_registry.register('delete') 

584class AppELBDeleteAction(BaseAction): 

585 """Action to delete an ELB 

586 

587 To avoid unwanted deletions of ELB, it is recommended to apply a filter 

588 to the rule 

589 

590 :example: 

591 

592 .. code-block:: yaml 

593 

594 policies: 

595 - name: appelb-delete-failed-elb 

596 resource: app-elb 

597 filters: 

598 - State: failed 

599 actions: 

600 - delete 

601 """ 

602 

603 schema = type_schema('delete', force={'type': 'boolean'}) 

604 permissions = ( 

605 "elasticloadbalancing:DeleteLoadBalancer", 

606 "elasticloadbalancing:ModifyLoadBalancerAttributes",) 

607 

608 def process(self, load_balancers): 

609 client = local_session(self.manager.session_factory).client('elbv2') 

610 for lb in load_balancers: 

611 self.process_alb(client, lb) 

612 

613 def process_alb(self, client, alb): 

614 try: 

615 if self.data.get('force'): 

616 client.modify_load_balancer_attributes( 

617 LoadBalancerArn=alb['LoadBalancerArn'], 

618 Attributes=[{ 

619 'Key': 'deletion_protection.enabled', 

620 'Value': 'false', 

621 }]) 

622 self.manager.retry( 

623 client.delete_load_balancer, LoadBalancerArn=alb['LoadBalancerArn']) 

624 except client.exceptions.LoadBalancerNotFoundException: 

625 pass 

626 except ( 

627 client.exceptions.OperationNotPermittedException, 

628 client.exceptions.ResourceInUseException 

629 ) as e: 

630 self.log.warning( 

631 "Exception trying to delete load balancer: %s error: %s", 

632 alb['LoadBalancerArn'], e) 

633 

634 

635@AppELB.action_registry.register('modify-attributes') 

636class AppELBModifyAttributes(BaseAction): 

637 """Modify load balancer attributes. 

638 

639 :example: 

640 

641 .. code-block:: yaml 

642 

643 policies: 

644 - name: turn-on-elb-deletion-protection 

645 resource: app-elb 

646 filters: 

647 - type: attributes 

648 key: "deletion_protection.enabled" 

649 value: false 

650 actions: 

651 - type: modify-attributes 

652 attributes: 

653 "deletion_protection.enabled": "true" 

654 "idle_timeout.timeout_seconds": 120 

655 """ 

656 schema = { 

657 'type': 'object', 

658 'additionalProperties': False, 

659 'properties': { 

660 'type': { 

661 'enum': ['modify-attributes']}, 

662 'attributes': { 

663 'type': 'object', 

664 'additionalProperties': False, 

665 'properties': { 

666 'access_logs.s3.enabled': { 

667 'enum': ['true', 'false', True, False]}, 

668 'access_logs.s3.bucket': {'type': 'string'}, 

669 'access_logs.s3.prefix': {'type': 'string'}, 

670 'deletion_protection.enabled': { 

671 'enum': ['true', 'false', True, False]}, 

672 'idle_timeout.timeout_seconds': {'type': 'number'}, 

673 'routing.http.desync_mitigation_mode': { 

674 'enum': ['monitor', 'defensive', 'strictest']}, 

675 'routing.http.drop_invalid_header_fields.enabled': { 

676 'enum': ['true', 'false', True, False]}, 

677 'routing.http2.enabled': { 

678 'enum': ['true', 'false', True, False]}, 

679 'load_balancing.cross_zone.enabled': { 

680 'enum': ['true', 'false', True, False]}, 

681 }, 

682 }, 

683 }, 

684 } 

685 permissions = ("elasticloadbalancing:ModifyLoadBalancerAttributes",) 

686 

687 def process(self, resources): 

688 client = local_session(self.manager.session_factory).client('elbv2') 

689 for appelb in resources: 

690 self.manager.retry( 

691 client.modify_load_balancer_attributes, 

692 LoadBalancerArn=appelb['LoadBalancerArn'], 

693 Attributes=[ 

694 {'Key': key, 'Value': serialize_attribute_value(value)} 

695 for (key, value) in self.data['attributes'].items() 

696 ], 

697 ignore_err_codes=('LoadBalancerNotFoundException',), 

698 ) 

699 return resources 

700 

701 

702class AppELBListenerFilterBase: 

703 """ Mixin base class for filters that query LB listeners. 

704 """ 

705 permissions = ("elasticloadbalancing:DescribeListeners",) 

706 

707 def initialize(self, albs): 

708 client = local_session(self.manager.session_factory).client('elbv2') 

709 self.listener_map = defaultdict(list) 

710 for alb in albs: 

711 results = self.manager.retry(client.describe_listeners, 

712 LoadBalancerArn=alb['LoadBalancerArn'], 

713 ignore_err_codes=('LoadBalancerNotFoundException',)) 

714 self.listener_map[alb['LoadBalancerArn']] = results['Listeners'] 

715 

716 

717def parse_attribute_value(v): 

718 if v.isdigit(): 

719 v = int(v) 

720 elif v == 'true': 

721 v = True 

722 elif v == 'false': 

723 v = False 

724 return v 

725 

726 

727def serialize_attribute_value(v): 

728 if v is True: 

729 return 'true' 

730 elif v is False: 

731 return 'false' 

732 elif isinstance(v, int): 

733 return str(v) 

734 return v 

735 

736 

737class AppELBAttributeFilterBase: 

738 """ Mixin base class for filters that query LB attributes. 

739 """ 

740 

741 def initialize(self, albs): 

742 client = local_session(self.manager.session_factory).client('elbv2') 

743 

744 def _process_attributes(alb): 

745 if 'Attributes' not in alb: 

746 alb['Attributes'] = {} 

747 results = client.describe_load_balancer_attributes( 

748 LoadBalancerArn=alb['LoadBalancerArn']) 

749 # flatten out the list of dicts and cast 

750 for pair in results['Attributes']: 

751 k = pair['Key'] 

752 v = parse_attribute_value(pair['Value']) 

753 alb['Attributes'][k] = v 

754 

755 with self.manager.executor_factory(max_workers=2) as w: 

756 list(w.map(_process_attributes, albs)) 

757 

758 

759@AppELB.filter_registry.register('is-logging') 

760class IsLoggingFilter(Filter, AppELBAttributeFilterBase): 

761 """ Matches AppELBs that are logging to S3. 

762 bucket and prefix are optional 

763 

764 :example: 

765 

766 .. code-block:: yaml 

767 

768 policies: 

769 - name: alb-is-logging-test 

770 resource: app-elb 

771 filters: 

772 - type: is-logging 

773 

774 - name: alb-is-logging-bucket-and-prefix-test 

775 resource: app-elb 

776 filters: 

777 - type: is-logging 

778 bucket: prodlogs 

779 prefix: alblogs 

780 

781 """ 

782 permissions = ("elasticloadbalancing:DescribeLoadBalancerAttributes",) 

783 schema = type_schema('is-logging', 

784 bucket={'type': 'string'}, 

785 prefix={'type': 'string'} 

786 ) 

787 

788 def process(self, resources, event=None): 

789 self.initialize(resources) 

790 bucket_name = self.data.get('bucket', None) 

791 bucket_prefix = self.data.get('prefix', None) 

792 

793 return [alb for alb in resources 

794 if alb['Attributes']['access_logs.s3.enabled'] and 

795 (not bucket_name or bucket_name == alb['Attributes'].get( 

796 'access_logs.s3.bucket', None)) and 

797 (not bucket_prefix or bucket_prefix == alb['Attributes'].get( 

798 'access_logs.s3.prefix', None)) 

799 ] 

800 

801 

802@AppELB.filter_registry.register('is-not-logging') 

803class IsNotLoggingFilter(Filter, AppELBAttributeFilterBase): 

804 """ Matches AppELBs that are NOT logging to S3. 

805 or do not match the optional bucket and/or prefix. 

806 

807 :example: 

808 

809 .. code-block:: yaml 

810 

811 policies: 

812 - name: alb-is-not-logging-test 

813 resource: app-elb 

814 filters: 

815 - type: is-not-logging 

816 

817 - name: alb-is-not-logging-bucket-and-prefix-test 

818 resource: app-elb 

819 filters: 

820 - type: is-not-logging 

821 bucket: prodlogs 

822 prefix: alblogs 

823 

824 """ 

825 permissions = ("elasticloadbalancing:DescribeLoadBalancerAttributes",) 

826 schema = type_schema('is-not-logging', 

827 bucket={'type': 'string'}, 

828 prefix={'type': 'string'} 

829 ) 

830 

831 def process(self, resources, event=None): 

832 self.initialize(resources) 

833 bucket_name = self.data.get('bucket', None) 

834 bucket_prefix = self.data.get('prefix', None) 

835 

836 return [alb for alb in resources 

837 if not alb['Attributes']['access_logs.s3.enabled'] or 

838 (bucket_name and bucket_name != alb['Attributes'].get( 

839 'access_logs.s3.bucket', None)) or 

840 (bucket_prefix and bucket_prefix != alb['Attributes'].get( 

841 'access_logs.s3.prefix', None))] 

842 

843 

844@AppELB.filter_registry.register('attributes') 

845class CheckAttributes(ValueFilter, AppELBAttributeFilterBase): 

846 """ Value filter that allows filtering on ELBv2 attributes 

847 

848 :example: 

849 

850 .. code-block:: yaml 

851 

852 policies: 

853 - name: alb-http2-enabled 

854 resource: app-elb 

855 filters: 

856 - type: attributes 

857 key: routing.http2.enabled 

858 value: true 

859 op: eq 

860 """ 

861 annotate: False # no annotation from value Filter 

862 permissions = ("elasticloadbalancing:DescribeLoadBalancerAttributes",) 

863 schema = type_schema('attributes', rinherit=ValueFilter.schema) 

864 schema_alias = False 

865 

866 def process(self, resources, event=None): 

867 self.augment(resources) 

868 return super().process(resources, event) 

869 

870 def augment(self, resources): 

871 self.initialize(resources) 

872 

873 def __call__(self, r): 

874 return super().__call__(r['Attributes']) 

875 

876 

877class AppELBTargetGroupFilterBase: 

878 """ Mixin base class for filters that query LB target groups. 

879 """ 

880 

881 def initialize(self, albs): 

882 self.target_group_map = defaultdict(list) 

883 target_groups = self.manager.get_resource_manager( 

884 'app-elb-target-group').resources() 

885 for target_group in target_groups: 

886 for load_balancer_arn in target_group['LoadBalancerArns']: 

887 self.target_group_map[load_balancer_arn].append(target_group) 

888 

889 

890@AppELB.filter_registry.register('listener') 

891class AppELBListenerFilter(ValueFilter, AppELBListenerFilterBase): 

892 """Filter ALB based on matching listener attributes 

893 

894 Adding the `matched` flag will filter on previously matched listeners 

895 

896 :example: 

897 

898 .. code-block:: yaml 

899 

900 policies: 

901 - name: app-elb-invalid-ciphers 

902 resource: app-elb 

903 filters: 

904 - type: listener 

905 key: Protocol 

906 value: HTTPS 

907 - type: listener 

908 key: SslPolicy 

909 value: ['ELBSecurityPolicy-TLS-1-1-2017-01','ELBSecurityPolicy-TLS-1-2-2017-01'] 

910 op: ni 

911 matched: true 

912 actions: 

913 - type: modify-listener 

914 sslpolicy: "ELBSecurityPolicy-TLS-1-2-2017-01" 

915 """ 

916 

917 schema = type_schema( 

918 'listener', rinherit=ValueFilter.schema, matched={'type': 'boolean'}) 

919 schema_alias = False 

920 permissions = ("elasticloadbalancing:DescribeLoadBalancerAttributes",) 

921 

922 def validate(self): 

923 if not self.data.get('matched'): 

924 return 

925 listeners = list(self.manager.iter_filters()) 

926 found = False 

927 for f in listeners[:listeners.index(self)]: 

928 if not f.data.get('matched', False):