Skip to content

Commit a91d13e

Browse files
cyphronixcyphronix
committed
moved config rule delete operation to functions
1 parent 0145619 commit a91d13e

File tree

1 file changed

+3
-106
lines changed
  • aws_sra_examples/solutions/genai/bedrock_org/lambda/src

1 file changed

+3
-106
lines changed

‎aws_sra_examples/solutions/genai/bedrock_org/lambda/src/app.py‎

Lines changed: 3 additions & 106 deletions
Original file line numberDiff line numberDiff line change
@@ -1523,114 +1523,11 @@ def delete_event(event, context):
15231523

15241524
for acct in accounts:
15251525
for region in regions:
1526-
# 4a) Delete the config rule
1527-
config.CONFIG_CLIENT = sts.assume_role(acct, sts.CONFIGURATION_ROLE, "config", region)
1528-
config_rule_search = config.find_config_rule(rule_name)
1529-
if config_rule_search[0] is True:
1530-
if DRY_RUN is False:
1531-
LOGGER.info(f"Deleting {rule_name} config rule for account {acct} in {region}")
1532-
config.delete_config_rule(rule_name)
1533-
LIVE_RUN_DATA[f"{rule_name}_{acct}_{region}_Delete"] = f"Deleted {rule_name} custom config rule"
1534-
CFN_RESPONSE_DATA["deployment_info"]["action_count"] += 1
1535-
CFN_RESPONSE_DATA["deployment_info"]["resources_deployed"] -= 1
1536-
remove_state_table_record(config_rule_search[1]["ConfigRules"][0]["ConfigRuleArn"])
1537-
else:
1538-
LOGGER.info(f"DRY_RUN: Deleting {rule_name} config rule for account {acct} in {region}")
1539-
DRY_RUN_DATA[f"{rule_name}_{acct}_{region}_Delete"] = f"DRY_RUN: Delete {rule_name} custom config rule"
1540-
else:
1541-
LOGGER.info(f"{rule_name} config rule for account {acct} in {region} does not exist.")
1542-
1543-
# 4b) Delete lambda for custom config rule
1544-
lambdas.LAMBDA_CLIENT = sts.assume_role(acct, sts.CONFIGURATION_ROLE, "lambda", region)
1545-
lambda_search = lambdas.find_lambda_function(rule_name)
1546-
# TODO(liamschn): this will be a mypy error - need to have lambda_search return string, not None
1547-
if lambda_search is not None:
1548-
if DRY_RUN is False:
1549-
LOGGER.info(f"Deleting {rule_name} lambda function for account {acct} in {region}")
1550-
lambdas.delete_lambda_function(rule_name)
1551-
LIVE_RUN_DATA[f"{rule_name}_{acct}_{region}_Delete"] = f"Deleted {rule_name} lambda function"
1552-
CFN_RESPONSE_DATA["deployment_info"]["action_count"] += 1
1553-
CFN_RESPONSE_DATA["deployment_info"]["resources_deployed"] -= 1
1554-
remove_state_table_record(lambda_search["Configuration"]["FunctionArn"])
1555-
else:
1556-
LOGGER.info(f"DRY_RUN: Deleting {rule_name} lambda function for account {acct} in {region}")
1557-
DRY_RUN_DATA[f"{rule_name}_{acct}_{region}_Delete"] = f"DRY_RUN: Delete {rule_name} lambda function"
1558-
else:
1559-
LOGGER.info(f"{rule_name} lambda function for account {acct} in {region} does not exist.")
1560-
1561-
# 5) Detach IAM policies
1562-
# TODO(liamschn): handle case where policy is not found attached_policies = None
1563-
iam.IAM_CLIENT = sts.assume_role(acct, sts.CONFIGURATION_ROLE, "iam", REGION)
1564-
attached_policies = iam.list_attached_iam_policies(rule_name)
1565-
if attached_policies is not None:
1566-
if DRY_RUN is False:
1567-
for policy in attached_policies:
1568-
LOGGER.info(f"Detaching {policy['PolicyName']} IAM policy from account {acct} in {region}")
1569-
iam.detach_policy(rule_name, policy["PolicyArn"])
1570-
LIVE_RUN_DATA[
1571-
f"{rule_name}_{acct}_{region}_PolicyDetach"
1572-
] = f"Detached {policy['PolicyName']} IAM policy from account {acct} in {region}"
1573-
CFN_RESPONSE_DATA["deployment_info"]["action_count"] += 1
1574-
else:
1575-
LOGGER.info(f"DRY_RUN: Detach {policy['PolicyName']} IAM policy from account {acct} in {region}")
1576-
DRY_RUN_DATA[
1577-
f"{rule_name}_{acct}_{region}_Delete"
1578-
] = f"DRY_RUN: Detach {policy['PolicyName']} IAM policy from account {acct} in {region}"
1579-
1580-
# 6) Delete IAM policy
1581-
policy_arn = f"arn:{sts.PARTITION}:iam::{acct}:policy/{rule_name}-lamdba-basic-execution"
1582-
LOGGER.info(f"Policy ARN: {policy_arn}")
1583-
policy_search = iam.check_iam_policy_exists(policy_arn)
1584-
if policy_search is True:
1585-
if DRY_RUN is False:
1586-
LOGGER.info(f"Deleting {rule_name}-lamdba-basic-execution IAM policy for account {acct} in {region}")
1587-
iam.delete_policy(policy_arn)
1588-
LIVE_RUN_DATA[f"{rule_name}_{acct}_{region}_Delete"] = f"Deleted {rule_name} IAM policy"
1589-
CFN_RESPONSE_DATA["deployment_info"]["action_count"] += 1
1590-
CFN_RESPONSE_DATA["deployment_info"]["resources_deployed"] -= 1
1591-
remove_state_table_record(policy_arn)
1592-
else:
1593-
LOGGER.info(f"DRY_RUN: Delete {rule_name}-lamdba-basic-execution IAM policy for account {acct} in {region}")
1594-
DRY_RUN_DATA[
1595-
f"{rule_name}_{acct}_{region}_PolicyDelete"
1596-
] = f"DRY_RUN: Delete {rule_name}-lamdba-basic-execution IAM policy for account {acct} in {region}"
1597-
else:
1598-
LOGGER.info(f"{rule_name}-lamdba-basic-execution IAM policy for account {acct} in {region} does not exist.")
1526+
delete_custom_config_rule(rule_name, acct, region)
15991527

1600-
policy_arn2 = f"arn:{sts.PARTITION}:iam::{acct}:policy/{rule_name}"
1601-
LOGGER.info(f"Policy ARN: {policy_arn2}")
1602-
policy_search = iam.check_iam_policy_exists(policy_arn2)
1603-
if policy_search is True:
1604-
if DRY_RUN is False:
1605-
LOGGER.info(f"Deleting {rule_name} IAM policy for account {acct} in {region}")
1606-
iam.delete_policy(policy_arn2)
1607-
LIVE_RUN_DATA[f"{rule_name}_{acct}_{region}_Delete"] = f"Deleted {rule_name} IAM policy"
1608-
CFN_RESPONSE_DATA["deployment_info"]["action_count"] += 1
1609-
CFN_RESPONSE_DATA["deployment_info"]["resources_deployed"] -= 1
1610-
remove_state_table_record(policy_arn2)
1611-
else:
1612-
LOGGER.info(f"DRY_RUN: Delete {rule_name} IAM policy for account {acct} in {region}")
1613-
DRY_RUN_DATA[
1614-
f"{rule_name}_{acct}_{region}_PolicyDelete"
1615-
] = f"DRY_RUN: Delete {rule_name} IAM policy for account {acct} in {region}"
1616-
else:
1617-
LOGGER.info(f"{rule_name} IAM policy for account {acct} in {region} does not exist.")
1528+
# 5, 6, & 7) Detach IAM policies, delete IAM policy, delete IAM execution role for custom config rule lambda
1529+
delete_custom_config_iam_role(rule_name, acct)
16181530

1619-
# 7) Delete IAM execution role for custom config rule lambda
1620-
role_search = iam.check_iam_role_exists(rule_name)
1621-
if role_search[0] is True:
1622-
if DRY_RUN is False:
1623-
LOGGER.info(f"Deleting {rule_name} IAM role for account {acct} in {region}")
1624-
iam.delete_role(rule_name)
1625-
LIVE_RUN_DATA[f"{rule_name}_{acct}_{region}_Delete"] = f"Deleted {rule_name} IAM role"
1626-
CFN_RESPONSE_DATA["deployment_info"]["action_count"] += 1
1627-
CFN_RESPONSE_DATA["deployment_info"]["resources_deployed"] -= 1
1628-
remove_state_table_record(role_search[1])
1629-
else:
1630-
LOGGER.info(f"DRY_RUN: Delete {rule_name} IAM role for account {acct} in {region}")
1631-
DRY_RUN_DATA[f"{rule_name}_{acct}_{region}_RoleDelete"] = f"DRY_RUN: Delete {rule_name} IAM role for account {acct} in {region}"
1632-
else:
1633-
LOGGER.info(f"{rule_name} IAM role for account {acct} in {region} does not exist.")
16341531
# TODO(liamschn): Consider the 256 KB limit for any cloudwatch log message
16351532
if DRY_RUN is False:
16361533
LOGGER.info(json.dumps({"RUN STATS": CFN_RESPONSE_DATA, "RUN DATA": LIVE_RUN_DATA}))

0 commit comments

Comments
 (0)