@@ -1118,9 +1118,9 @@ def deploy_metric_filters_and_alarms(region: str, accounts: list, resource_prope
11181118 DRY_RUN_DATA [f"{ filter_name } _CloudWatch_Alarm" ] = "DRY_RUN: Deploy CloudWatch metric alarm"
11191119 else :
11201120 LOGGER .info (f"DRY_RUN: Filter deploy parameter is 'false'; Skip { filter_name } CloudWatch metric filter deployment" )
1121- DRY_RUN_DATA [f" { filter_name } _CloudWatch" ] = (
1122- "DRY_RUN: Filter deploy parameter is 'false'; Skip CloudWatch metric filter deployment "
1123- )
1121+ DRY_RUN_DATA [
1122+ f" { filter_name } _CloudWatch "
1123+ ] = "DRY_RUN: Filter deploy parameter is 'false'; Skip CloudWatch metric filter deployment"
11241124
11251125
11261126def deploy_central_cloudwatch_observability (event : dict ) -> None : # noqa: CCR001, CFQ001, C901
@@ -1216,9 +1216,9 @@ def deploy_central_cloudwatch_observability(event: dict) -> None: # noqa: CCR00
12161216 if DRY_RUN is False :
12171217 xacct_role = iam .create_role (cloudwatch .CROSS_ACCOUNT_ROLE_NAME , cloudwatch .CROSS_ACCOUNT_TRUST_POLICY , SOLUTION_NAME )
12181218 xacct_role_arn = xacct_role ["Role" ]["Arn" ]
1219- LIVE_RUN_DATA [f"OAMCrossAccountRoleCreate_ { bedrock_account } " ] = (
1220- f"Created { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } "
1221- )
1219+ LIVE_RUN_DATA [
1220+ f"OAMCrossAccountRoleCreate_ { bedrock_account } "
1221+ ] = f"Created { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } "
12221222 CFN_RESPONSE_DATA ["deployment_info" ]["action_count" ] += 1
12231223 CFN_RESPONSE_DATA ["deployment_info" ]["resources_deployed" ] += 1
12241224 LOGGER .info (f"Created { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } IAM role" )
@@ -1234,9 +1234,9 @@ def deploy_central_cloudwatch_observability(event: dict) -> None: # noqa: CCR00
12341234 cloudwatch .CROSS_ACCOUNT_ROLE_NAME ,
12351235 )
12361236 else :
1237- DRY_RUN_DATA [f"OAMCrossAccountRoleCreate_ { bedrock_account } " ] = (
1238- f"DRY_RUN: Create { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } "
1239- )
1237+ DRY_RUN_DATA [
1238+ f"OAMCrossAccountRoleCreate_ { bedrock_account } "
1239+ ] = f"DRY_RUN: Create { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } "
12401240 else :
12411241 LOGGER .info (
12421242 f"CloudWatch observability access manager { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } cross-account role found in { bedrock_account } "
@@ -1267,17 +1267,17 @@ def deploy_central_cloudwatch_observability(event: dict) -> None: # noqa: CCR00
12671267 LOGGER .info (f"Attaching { policy_arn } policy to { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } ..." )
12681268 if DRY_RUN is False :
12691269 iam .attach_policy (cloudwatch .CROSS_ACCOUNT_ROLE_NAME , policy_arn )
1270- LIVE_RUN_DATA [f"OamXacctRolePolicyAttach_ { policy_arn . split ( '/' )[ 1 ] } _ { bedrock_account } " ] = (
1271- f"Attached { policy_arn } policy to { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role "
1272- )
1270+ LIVE_RUN_DATA [
1271+ f"OamXacctRolePolicyAttach_ { policy_arn . split ( '/' )[ 1 ] } _ { bedrock_account } "
1272+ ] = f"Attached { policy_arn } policy to { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role"
12731273 CFN_RESPONSE_DATA ["deployment_info" ]["action_count" ] += 1
12741274
12751275 CFN_RESPONSE_DATA ["deployment_info" ]["configuration_changes" ] += 1
12761276 LOGGER .info (f"Attached { policy_arn } policy to { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } " )
12771277 else :
1278- DRY_RUN_DATA [f"OAMCrossAccountRolePolicyAttach_ { policy_arn . split ( '/' )[ 1 ] } _ { bedrock_account } " ] = (
1279- f"DRY_RUN: Attach { policy_arn } policy to { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } "
1280- )
1278+ DRY_RUN_DATA [
1279+ f"OAMCrossAccountRolePolicyAttach_ { policy_arn . split ( '/' )[ 1 ] } _ { bedrock_account } "
1280+ ] = f"DRY_RUN: Attach { policy_arn } policy to { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } "
12811281
12821282 # 5e) OAM link in bedrock account
12831283 cloudwatch .CWOAM_CLIENT = sts .assume_role (bedrock_account , sts .CONFIGURATION_ROLE , "oam" , bedrock_region )
@@ -1286,9 +1286,9 @@ def deploy_central_cloudwatch_observability(event: dict) -> None: # noqa: CCR00
12861286 if DRY_RUN is False :
12871287 LOGGER .info ("CloudWatch observability access manager link not found, creating..." )
12881288 oam_link_arn = cloudwatch .create_oam_link (oam_sink_arn )
1289- LIVE_RUN_DATA [f"OAMLinkCreate_ { bedrock_account } _ { bedrock_region } " ] = (
1290- f"Created CloudWatch observability access manager link in { bedrock_account } in { bedrock_region } "
1291- )
1289+ LIVE_RUN_DATA [
1290+ f"OAMLinkCreate_ { bedrock_account } _ { bedrock_region } "
1291+ ] = f"Created CloudWatch observability access manager link in { bedrock_account } in { bedrock_region } "
12921292 CFN_RESPONSE_DATA ["deployment_info" ]["action_count" ] += 1
12931293
12941294 CFN_RESPONSE_DATA ["deployment_info" ]["resources_deployed" ] += 1
@@ -1297,9 +1297,9 @@ def deploy_central_cloudwatch_observability(event: dict) -> None: # noqa: CCR00
12971297 add_state_table_record ("oam" , "implemented" , "oam link" , "link" , oam_link_arn , bedrock_account , bedrock_region , "oam_link" )
12981298 else :
12991299 LOGGER .info ("DRY_RUN: CloudWatch observability access manager link not found, creating..." )
1300- DRY_RUN_DATA [f"OAMLinkCreate_ { bedrock_account } " ] = (
1301- f"DRY_RUN: Create CloudWatch observability access manager link in { bedrock_account } in { bedrock_region } "
1302- )
1300+ DRY_RUN_DATA [
1301+ f"OAMLinkCreate_ { bedrock_account } "
1302+ ] = f"DRY_RUN: Create CloudWatch observability access manager link in { bedrock_account } in { bedrock_region } "
13031303 # Set link arn to default value (for dry run)
13041304 oam_link_arn = f"arn:aws:cloudwatch::{ bedrock_account } :link/arn"
13051305 else :
@@ -1561,15 +1561,15 @@ def delete_custom_config_iam_role(rule_name: str, acct: str) -> None: # noqa: C
15611561 if DRY_RUN is False :
15621562 LOGGER .info (f"Detaching { policy ['PolicyName' ]} IAM policy from account { acct } in { region } " )
15631563 iam .detach_policy (rule_name , policy ["PolicyArn" ])
1564- LIVE_RUN_DATA [f" { rule_name } _ { acct } _ { region } _PolicyDetach" ] = (
1565- f"Detached { policy [ 'PolicyName' ] } IAM policy from account { acct } in { region } "
1566- )
1564+ LIVE_RUN_DATA [
1565+ f"{ rule_name } _ { acct } _ { region } _PolicyDetach "
1566+ ] = f"Detached { policy [ 'PolicyName' ] } IAM policy from account { acct } in { region } "
15671567 CFN_RESPONSE_DATA ["deployment_info" ]["action_count" ] += 1
15681568 else :
15691569 LOGGER .info (f"DRY_RUN: Detach { policy ['PolicyName' ]} IAM policy from account { acct } in { region } " )
1570- DRY_RUN_DATA [f" { rule_name } _ { acct } _ { region } _Delete" ] = (
1571- f"DRY_RUN: Detach { policy [ 'PolicyName' ] } IAM policy from account { acct } in { region } "
1572- )
1570+ DRY_RUN_DATA [
1571+ f"{ rule_name } _ { acct } _ { region } _Delete "
1572+ ] = f"DRY_RUN: Detach { policy [ 'PolicyName' ] } IAM policy from account { acct } in { region } "
15731573 else :
15741574 LOGGER .info (f"No IAM policies attached to { rule_name } for account { acct } in { region } " )
15751575
@@ -1587,9 +1587,9 @@ def delete_custom_config_iam_role(rule_name: str, acct: str) -> None: # noqa: C
15871587 remove_state_table_record (policy_arn )
15881588 else :
15891589 LOGGER .info (f"DRY_RUN: Delete { rule_name } -lamdba-basic-execution IAM policy for account { acct } in { region } " )
1590- DRY_RUN_DATA [f" { rule_name } _ { acct } _ { region } _PolicyDelete" ] = (
1591- f"DRY_RUN: Delete { rule_name } -lamdba-basic-execution IAM policy for account { acct } in { region } "
1592- )
1590+ DRY_RUN_DATA [
1591+ f"{ rule_name } _ { acct } _ { region } _PolicyDelete "
1592+ ] = f"DRY_RUN: Delete { rule_name } -lamdba-basic-execution IAM policy for account { acct } in { region } "
15931593 else :
15941594 LOGGER .info (f"{ rule_name } -lamdba-basic-execution IAM policy for account { acct } in { region } does not exist." )
15951595
@@ -1807,18 +1807,18 @@ def delete_event(event: dict, context: Any) -> None: # noqa: CFQ001, CCR001, C9
18071807 for policy in cross_account_policies :
18081808 LOGGER .info (f"Detaching { policy ['PolicyArn' ]} policy from { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } IAM role..." )
18091809 iam .detach_policy (cloudwatch .CROSS_ACCOUNT_ROLE_NAME , policy ["PolicyArn" ])
1810- LIVE_RUN_DATA ["OAMCrossAccountRolePolicyDetach" ] = (
1811- f"Detached { policy [ 'PolicyArn' ] } policy from { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role "
1812- )
1810+ LIVE_RUN_DATA [
1811+ "OAMCrossAccountRolePolicyDetach "
1812+ ] = f"Detached { policy [ 'PolicyArn' ] } policy from { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role"
18131813 CFN_RESPONSE_DATA ["deployment_info" ]["action_count" ] += 1
18141814 CFN_RESPONSE_DATA ["deployment_info" ]["configuration_changes" ] += 1
18151815 LOGGER .info (f"Detached { policy ['PolicyArn' ]} policy from { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } IAM role" )
18161816 else :
18171817 for policy in cross_account_policies :
18181818 LOGGER .info (f"DRY_RUN: Detaching { policy ['PolicyArn' ]} policy from { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } IAM role..." )
1819- DRY_RUN_DATA ["OAMCrossAccountRolePolicyDetach" ] = (
1820- f"DRY_RUN: Detach { policy [ 'PolicyArn' ] } policy from { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role "
1821- )
1819+ DRY_RUN_DATA [
1820+ "OAMCrossAccountRolePolicyDetach "
1821+ ] = f"DRY_RUN: Detach { policy [ 'PolicyArn' ] } policy from { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role"
18221822 else :
18231823 LOGGER .info (f"No policies attached to { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } IAM role" )
18241824
0 commit comments