| Server IP : 198.38.94.13 / Your IP : 216.73.217.33 Web Server : Apache System : Linux d4744.dxb1.stableserver.net 5.14.0-611.49.1.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Apr 21 16:39:08 EDT 2026 x86_64 User : revivere ( 1140) PHP Version : 8.2.33 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/ |
Upload File : |
o
;j*E � @ s� d Z ddlZddlmZ ddlZddlZddlZe�e �Z
zddl Z ddl Z e�d��
ej� dZW n
eefy? dZY nw dd� Zd d
� Z d9d d �Z d:d
d�Z d;dd�Z d<dd�Zd9dd�Zd9dd�Zd9dd�Zd9dd�Zd9dd �Z d9d d �Z d9d d �Z d<d!d"�Z d:d#d$�Z d:d%d&�Z! d=d'd(�Z" d9d)d*�Z#d9d+d,�Z$ d<d-d.�Z% d<d/d0�Z& d9d1d2�Z' d;d3d4�Z(d9d5d6�Z) d9d7d8�Z*dS )>ar
Connection module for Amazon KMS
.. versionadded:: 2015.8.0
:configuration: This module accepts explicit kms credentials but can also utilize
IAM roles assigned to the instance through Instance Profiles. Dynamic
credentials are then automatically obtained from AWS API and no further
configuration is necessary. More Information available at::
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html
If IAM roles are not used you need to specify them either in a pillar or
in the minion's config file::
kms.keyid: GKTADJGHEIQSXMKKRBJ08H
kms.key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
A region may also be specified in the configuration::
kms.region: us-east-1
If a region is not specified, the default is us-east-1.
It's also possible to specify key, keyid and region via a profile, either
as a passed in dict, or as a string to pull from pillars or minion config:
myprofile:
keyid: GKTADJGHEIQSXMKKRBJ08H
key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
region: us-east-1
:depends: boto
� N)� OrderedDict�botoTFc C s t jjjddd�S )z,
Only load if boto libraries exist.
z2.38.0F)Zboto_verZ check_boto3)�salt�utilsZversionsZcheck_boto_reqs� r r �I/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/boto_kms.py� __virtual__= s r c C s t r
td tdtd� d S d S )Nzboto.assign_funcs�kms)�pack)�HAS_BOTO� __utils__�__name__Z__salt__)�optsr r r �__init__D s �r c
C �r t ||||d�}i }z
|�| |� d|d< W |S tjjy8 } zd|d< td |�|d< W Y d}~|S d}~ww )z�
Create a display name for a key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.create_alias 'alias/mykey' key_id
��region�key�keyid�profileT�resultF�boto.get_error�errorN)� _get_conn� create_aliasr � exception�BotoServerErrorr ) Z
alias_nameZ
target_key_idr r r r �conn�r�er r r r I �
���r c
C s� t |||| d�}
| �d�rt| �} i } z|
j| |||||d�| d< W | S tjjy@ } ztd | �| d< W Y d} ~ | S d} ~ ww )a
Adds a grant to a key to specify who can access the key and under what
conditions.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.create_grant 'alias/mykey' 'arn:aws:iam::1111111:/role/myrole' operations='["Encrypt","Decrypt"]'
r �alias/)�retiring_principal�
operations� constraints� grant_tokens�grantr r N)r �
startswith� _get_key_id� create_grantr r r r )
�key_idZgrantee_principalr" r# r$ r% r r r r r r r r r r r) a s&
�
���r) c
C s� t ||||d�}i }tjj�| �} z|j| ||d�}
|
d |d< W |S tjjy? } zt d | �|d< W Y d} ~ |S d} ~ ww )z�
Creates a master key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.create_key '{"Statement":...}' "My master key"
r )� description� key_usage� KeyMetadata� key_metadatar r N)
r r � serializers�json� serialize�
create_keyr r r r ) �policyr+ r, r r r r r r Z_policyr. r r r r r2 � s ����r2 c
C sr t ||||d�}i }z|j| ||d�} | d |d< W |S tjjy8 }
ztd |
�|d< W Y d}
~
|S d}
~
ww )z�
Decrypt ciphertext.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.decrypt encrypted_ciphertext
r ��encryption_contextr% � Plaintext� plaintextr r N)r �decryptr r r r ) �ciphertext_blobr5 r% r r r r r r r7 r r r r r8 � s ����r8 c
C s� t ||||d�}i }z |�| �}d|d< W |S tjjyG } z#t|tjjj�r4d|d< |W Y d}~S t d |�|d< W Y d}~|S d}~ww )z�
Check for the existence of a key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.key_exists 'alias/mykey'
r Tr FNr r )
r � describe_keyr r r �
isinstancer �
exceptionsZNotFoundExceptionr �r* r r r r r r r r r r �
key_exists� s
���r> c C s t | ||||�d }|d S )z&
From an alias, get a key_id.
r. ZKeyId)r: )�aliasr r r r r. r r r r( � s r( c
C sl t ||||d�}i }z|�| �}|d |d< W |S tjjy5 } ztd |�|d< W Y d}~|S d}~ww )z�
Get detailed information about a key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.describe_key 'alias/mykey'
r r- r. r r N)r r: r r r r r= r r r r: � s
���r: c
C �p t ||||d�}i }z |�| �}d|d< W |S tjjy7 } zd|d< td |�|d< W Y d}~|S d}~ww )z�
Mark key as disabled.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.disable_key 'alias/mykey'
r Tr Fr r N)r � disable_keyr r r r r= r r r rA �
���rA c
C r@ )z�
Disable key rotation for specified key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.disable_key_rotation 'alias/mykey'
r Tr Fr r N)r �disable_key_rotationr r r r r= r r r rC rB rC c
C r@ )z�
Mark key as enabled.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.enable_key 'alias/mykey'
r Tr Fr r N)r �
enable_keyr r r r r= r r r rD . rB rD c
C r@ )z�
Disable key rotation for specified key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.enable_key_rotation 'alias/mykey'
r Tr Fr r N)r �enable_key_rotationr r r r r= r r r rE D rB rE c
C st t ||||d�}i } z|j| |||d�}
|
d | d< W | S tjjy9 } ztd | �| d< W Y d} ~ | S d} ~ ww )z�
Encrypt plaintext into cipher text using specified key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.encrypt 'alias/mykey' 'myplaindata' '{"aws:username":"myuser"}'
r r4 ZCiphertextBlob�
ciphertextr r N)r �encryptr r r r ) r* r7 r5 r% r r r r r r rF r r r r rG Z s ����rG c
C �r t ||||d�} i }
z| j| ||||d�} | |
d< W |
S tjjy8 } ztd | �|
d< W Y d} ~ |
S d} ~ ww )z�
Generate a secure data key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.generate_data_key 'alias/mykey' number_of_bytes=1024 key_spec=AES_128
r �r5 �number_of_bytes�key_specr% �data_keyr r N)r �generate_data_keyr r r r �
r* r5 rJ rK r% r r r r r r rL r r r r rM } �" �
���rM c
C rH )z�
Generate a secure data key without a plaintext copy of the key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.generate_data_key_without_plaintext 'alias/mykey' number_of_bytes=1024 key_spec=AES_128
r rI rL r r N)r �#generate_data_key_without_plaintextr r r r rN r r r rP � rO rP c
C �l t ||||d�}i }z|�| �}|d |d< W |S tjjy5 } ztd |�|d< W Y d}~|S d}~ww )z�
Generate a random string.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.generate_random number_of_bytes=1024
r r6 �randomr r N)r �generate_randomr r r r ) rJ r r r r r r rR r r r r rS � s
���rS c
C s| t ||||d�}i }z|�| |�}tjjj|d td�|d< W |S tjj y= } zt
d | �|d< W Y d} ~ |S d} ~ ww )z�
Get the policy for the specified key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.get_key_policy 'alias/mykey' mypolicy
r �Policy)�object_pairs_hook�
key_policyr r N) r �get_key_policyr r/ r0 Z deserializer r r r r )
r* � policy_namer r r r r r rV r r r r rW � s ����rW c
C rQ )z�
Get status of whether or not key rotation is enabled for a key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.get_key_rotation_status 'alias/mykey'
r ZKeyRotationEnabledr r r N)r �get_key_rotation_statusr r r r ) r* r r r r r r Zkey_rotation_statusr r r r rY � s
���rY c
C s� t ||||d�}| �d�rt| �} i }z+g } d}
|j| ||
d�} | d D ]} | �| � q%d| v r6| d }
nnq| |d< W |S tjjy[ }
ztd |
�|d
< W Y d}
~
|S d}
~
ww ) z�
List grants for the specified key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.list_grants 'alias/mykey'
r r! NT��limit�markerZGrantsZ
NextMarker�grantsr r ) r r' r( � list_grants�appendr r r r )r* r[ r\ r r r r r r Z_grantsZ next_markerr] r& r r r r r^ s,
�
���r^ c
C s� t ||||d�}| �d�rt| �} i }z|j| ||d�} | d |d< W |S tjjyA }
ztd |
�|d< W Y d}
~
|S d}
~
ww ) z�
List key_policies for the specified key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.list_key_policies 'alias/mykey'
r r! rZ Z PolicyNames� key_policiesr r N)r r' r( �list_key_policiesr r r r ) r* r[ r\ r r r r r r r` r r r r ra . s
���ra c
C s~ t ||||d�}i }z|�| |tjj�|�� d|d< W |S tjjy> } zd|d< t d | �|d< W Y d} ~ |S d} ~ ww )z�
Attach a key policy to the specified key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.put_key_policy 'alias/mykey' default '{"Statement":...}'
r Tr Fr r N)
r �put_key_policyr r/ r0 r1 r r r r )
r* rX r3 r r r r r r r r r r rb H s �
���rb c
C sp t ||||d�} i }
z| �| ||||�} | |
d< W |
S tjjy7 } ztd | �|
d< W Y d} ~ |
S d} ~ ww )z�
Reencrypt encrypted data with a new master key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.re_encrypt 'encrypted_data' 'alias/mynewkey' default '{"Statement":...}'
r rF r r N)r �
re_encryptr r r r )
r9 Zdestination_key_idZsource_encryption_contextZ destination_encryption_contextr% r r r r r r rF r r r r rc b s" �
���rc c
C s� t ||||d�}| �d�rt| �} i }z
|�| |� d|d< W |S tjjyA } zd|d< td |�|d< W Y d}~|S d}~ww ) z�
Revoke a grant from a key.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.revoke_grant 'alias/mykey' 8u89hf-j09j...
r r! Tr Fr r N)r r' r( � revoke_grantr r r r ) r* Zgrant_idr r r r r r r r r r rd � s
���rd c
C r )z�
Update a key's description.
CLI Example:
.. code-block:: bash
salt myminion boto_kms.update_key_description 'alias/mykey' 'My key'
r Tr Fr r N)r �update_key_descriptionr r r r ) r* r+ r r r r r r r r r r re � r re )NNNN)NNNNNNNN)NNNNNNN)NNNNNN)NNNNN)+�__doc__�logging� collectionsr Zsalt.serializers.jsonr Zsalt.utils.compatZsalt.utils.versions� getLoggerr
�logr Zboto.kms�setLevel�CRITICALr � ImportError�AttributeErrorr r r r) r2 r8 r> r( r: rA rC rD rE rG rM rP rS rW rY r^ ra rb rc rd re r r r r �<module> s� '
�
�
�*
�"
�
!
�%
�'
�&
�
�
�#
�
�
�
%�