returns boolean if a user has access to console login #2012

valkiriaaquatica · 2024-03-04T18:39:54Z

Summary
I've introduced a new feature that includes in the response a console_access parameter, which is a boolean indicating whether an iam user has the ability to log in through the AWS console. This addition is particularly useful for scenarios where administrative constraints require users to access AWS services exclusively via API keys or through controlled environments, such as landing zones, without using the AWS console login interface.

Issue Type

Feature Pull Request
Component Name: botocore
includes the botocore interaction, specifically regarding the console_access information retrievals

Additional Information
With this update, the module now provides visibility into whether an IAM user is permitted console access. This could be pivotal for enforcing stricter security protocols, ensuring users do not bypass VPN requirements, API keys, or other access control measures by logging in through the AWS console

Before the change a normal response:

{
    "arn": "arn:aws:iam::11111111:user/terraform",
    "create_date": "2018-04-18T14:12:44+00:00",
    "path": "/",
    "tags": {},
    "user_id": "12345abcd",
    "user_name": "terraform"
}

After the change:

{
    "arn": "arn:aws:iam::11111111:user/terraform",
    "console_access": false,
    "create_date": "2018-04-18T14:12:44+00:00",
    "path": "/",
    "tags": {},
    "user_id": "12345abcd",
    "user_name": "terraform"
}

softwarefactory-project-zuul · 2024-03-04T19:02:31Z

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/918c85f9bbc34b5593e793db86f19575

✔️ ansible-galaxy-importer SUCCESS in 3m 48s
✔️ build-ansible-collection SUCCESS in 15m 42s
✔️ ansible-test-splitter SUCCESS in 6m 31s
✔️ integration-amazon.aws-1 SUCCESS in 5m 10s
Skipped 43 jobs

softwarefactory-project-zuul · 2024-03-21T11:18:37Z

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/c52e741c13c34c5fb600cc9a4ab05c66

✔️ ansible-galaxy-importer SUCCESS in 5m 22s
✔️ build-ansible-collection SUCCESS in 17m 40s
✔️ ansible-test-splitter SUCCESS in 6m 33s
✔️ integration-amazon.aws-1 SUCCESS in 5m 12s
Skipped 43 jobs

abikouo · 2024-03-21T14:17:54Z

@valkiriaaquatica thanks for your contribution to this repository.
Your PR is incomplete, you will need to add a changelog fragment describing the change, here is an example https://github.com/ansible-collections/amazon.aws/blob/main/changelogs/fragments/20231211-rds_instance_cloudwatch.yml.
You will also need to update the module RETURN block adding the new parameters

abikouo

Just minor updates to return the full LoginProfile information in the output, as this should be necessary for other use cases

plugins/modules/iam_user_info.py

github-actions · 2024-03-21T14:43:27Z

Docs Build 📝

Thank you for contribution!✨

This PR has been merged and your docs changes will be incorporated when they are next published.

tremble

Apologies for the significant change requests, the IAM modules have recently been subject to some refactoring work including adding decorators for some of the common error handling code.

plugins/modules/iam_user_info.py

softwarefactory-project-zuul · 2024-03-21T15:38:00Z

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/85079ccea3744996b576b1722c34b5b9

✔️ ansible-galaxy-importer SUCCESS in 5m 13s
✔️ build-ansible-collection SUCCESS in 16m 02s
✔️ ansible-test-splitter SUCCESS in 6m 16s
✔️ integration-amazon.aws-1 SUCCESS in 9m 22s
Skipped 43 jobs

softwarefactory-project-zuul · 2024-03-21T17:31:27Z

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/ce93286bcbf44c2f8b1192263ae3c8c0

✔️ ansible-galaxy-importer SUCCESS in 5m 38s
✔️ build-ansible-collection SUCCESS in 15m 34s
✔️ ansible-test-splitter SUCCESS in 6m 00s
✔️ integration-amazon.aws-1 SUCCESS in 6m 38s
Skipped 43 jobs

softwarefactory-project-zuul · 2024-03-21T18:13:54Z

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/8adee2157aa4453987461294de3017b8

✔️ ansible-galaxy-importer SUCCESS in 5m 27s
✔️ build-ansible-collection SUCCESS in 14m 26s
✔️ ansible-test-splitter SUCCESS in 5m 26s
✔️ integration-amazon.aws-1 SUCCESS in 6m 52s
Skipped 43 jobs

valkiriaaquatica · 2024-03-21T18:17:02Z

thanks @abikouo and @tremble ! If there is anythiing i can help with the iam documentation (that I see is not as complete as others) I can help :)

abikouo

Just minor change in the changelog fragment

changelogs/fragments/20240321-iam-user-info.yml

I have added that now return in the return json the parameter console_access in boolean format to know if the user has or not access to login by console to the account. It can be used in cases where you only want users to access with keys or by landing zones...

Co-authored-by: Bikouo Aubin <[email protected]>

Co-authored-by: Mark Chappell <[email protected]>

instead of boolean it returns user info so if a user has console access info will be returned Co-authored-by: Mark Chappell <[email protected]>

Co-authored-by: Bikouo Aubin <[email protected]>

softwarefactory-project-zuul · 2024-03-22T08:47:28Z

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/1da04bdc3b0e49698ca94ee7b4c7c6dc

✔️ ansible-galaxy-importer SUCCESS in 5m 38s
✔️ build-ansible-collection SUCCESS in 15m 34s
✔️ ansible-test-splitter SUCCESS in 7m 04s
✔️ integration-amazon.aws-1 SUCCESS in 6m 20s
Skipped 43 jobs

tremble · 2024-03-22T08:52:02Z

@valkiriaaquatica thanks for the efforts you've put into this. Don't worry about the docs, it's my fault and I'll get them written. This isn't my day job so there's a certain amount of "getting around to it" involved (and everyone knows that writing code is more interesting than docs and tests :) ).

softwarefactory-project-zuul · 2024-03-22T09:10:56Z

Build succeeded (gate pipeline).
https://ansible.softwarefactory-project.io/zuul/buildset/9ab8baa329f64ad1897ba89e3782910d

✔️ ansible-galaxy-importer SUCCESS in 5m 01s
✔️ build-ansible-collection SUCCESS in 15m 03s
✔️ ansible-test-splitter SUCCESS in 5m 20s
✔️ integration-amazon.aws-1 SUCCESS in 7m 47s
Skipped 43 jobs

patchback · 2024-03-22T09:11:00Z

Backport to stable-7: 💚 backport PR created

✅ Backport PR branch: patchback/backports/stable-7/8b138e3947ede41de8264e9a4aabcfd7a2759891/pr-2012

Backported as #2023

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

returns boolean if a user has access to console login Summary I've introduced a new feature that includes in the response a console_access parameter, which is a boolean indicating whether an iam user has the ability to log in through the AWS console. This addition is particularly useful for scenarios where administrative constraints require users to access AWS services exclusively via API keys or through controlled environments, such as landing zones, without using the AWS console login interface. Issue Type Feature Pull Request Component Name: botocore includes the botocore interaction, specifically regarding the console_access information retrievals Additional Information With this update, the module now provides visibility into whether an IAM user is permitted console access. This could be pivotal for enforcing stricter security protocols, ensuring users do not bypass VPN requirements, API keys, or other access control measures by logging in through the AWS console Before the change a normal response: { "arn": "arn:aws:iam::11111111:user/terraform", "create_date": "2018-04-18T14:12:44+00:00", "path": "/", "tags": {}, "user_id": "12345abcd", "user_name": "terraform" } After the change: { "arn": "arn:aws:iam::11111111:user/terraform", "console_access": false, "create_date": "2018-04-18T14:12:44+00:00", "path": "/", "tags": {}, "user_id": "12345abcd", "user_name": "terraform" } Reviewed-by: Bikouo Aubin Reviewed-by: Mark Chappell (cherry picked from commit 8b138e3)

[PR #2012/8b138e39 backport][stable-7] returns boolean if a user has access to console login This is a backport of PR #2012 as merged into main (8b138e3). Summary I've introduced a new feature that includes in the response a console_access parameter, which is a boolean indicating whether an iam user has the ability to log in through the AWS console. This addition is particularly useful for scenarios where administrative constraints require users to access AWS services exclusively via API keys or through controlled environments, such as landing zones, without using the AWS console login interface. Issue Type Feature Pull Request Component Name: botocore includes the botocore interaction, specifically regarding the console_access information retrievals Additional Information With this update, the module now provides visibility into whether an IAM user is permitted console access. This could be pivotal for enforcing stricter security protocols, ensuring users do not bypass VPN requirements, API keys, or other access control measures by logging in through the AWS console Before the change a normal response: { "arn": "arn:aws:iam::11111111:user/terraform", "create_date": "2018-04-18T14:12:44+00:00", "path": "/", "tags": {}, "user_id": "12345abcd", "user_name": "terraform" } After the change: { "arn": "arn:aws:iam::11111111:user/terraform", "console_access": false, "create_date": "2018-04-18T14:12:44+00:00", "path": "/", "tags": {}, "user_id": "12345abcd", "user_name": "terraform" } Reviewed-by: Alina Buzachis Reviewed-by: Helen Bailey <[email protected]>

fix unsafe asserts SUMMARY Closes ansible-collections#2012 ISSUE TYPE Bugfix Pull Request COMPONENT NAME integrationtests Reviewed-by: Mark Chappell Reviewed-by: Alina Buzachis This commit was initially merged in https://github.com/ansible-collections/community.aws See: ansible-collections/community.aws@4bdcecd

abikouo requested changes Mar 21, 2024

View reviewed changes

plugins/modules/iam_user_info.py Outdated Show resolved Hide resolved

plugins/modules/iam_user_info.py Outdated Show resolved Hide resolved

plugins/modules/iam_user_info.py Outdated Show resolved Hide resolved

tremble requested changes Mar 21, 2024

View reviewed changes

plugins/modules/iam_user_info.py Outdated Show resolved Hide resolved

plugins/modules/iam_user_info.py Outdated Show resolved Hide resolved

plugins/modules/iam_user_info.py Show resolved Hide resolved

tremble reviewed Mar 21, 2024

View reviewed changes

plugins/modules/iam_user_info.py Outdated Show resolved Hide resolved

abikouo requested changes Mar 22, 2024

View reviewed changes

changelogs/fragments/20240321-iam-user-info.yml Outdated Show resolved Hide resolved

tremble approved these changes Mar 22, 2024

View reviewed changes

valkiriaaquatica and others added 14 commits March 22, 2024 08:37

Update plugins/modules/iam_user_info.py

6c1e8a8

Co-authored-by: Bikouo Aubin <[email protected]>

change ClientError to boto3 exception

97c771d

Co-authored-by: Bikouo Aubin <[email protected]>

Update plugins/modules/iam_user_info.py

6358d9d

Co-authored-by: Bikouo Aubin <[email protected]>

add console_access in RETURNS and delete import botocore

782716c

add changelog info for pr

233e5c3

remove whitespace and add is_boto3_error_code

f21d590

change comment

00780e8

Update plugins/modules/iam_user_info.py

fa407a1

Co-authored-by: Mark Chappell <[email protected]>

Update plugins/modules/iam_user_info.py

59e81f7

Co-authored-by: Mark Chappell <[email protected]>

Update plugins/modules/iam_user_info.py

c5e7da6

instead of boolean it returns user info so if a user has console access info will be returned Co-authored-by: Mark Chappell <[email protected]>

add login_profile to RETURN info

8e5c340

Update changelogs/fragments/20240321-iam-user-info.yml

1a33fb4

Co-authored-by: Bikouo Aubin <[email protected]>

fix whitespaces and lines issue

02234c0

abikouo force-pushed the patch-1 branch from 6a299f0 to 02234c0 Compare March 22, 2024 07:37

abikouo approved these changes Mar 22, 2024

View reviewed changes

abikouo added the mergeit Merge the PR (SoftwareFactory) label Mar 22, 2024

valkiriaaquatica added 2 commits March 22, 2024 09:06

apply black suggerations

07d9d29

tox changes

2dfd377

tremble added the backport-7 PR should be backported to the stable-7 branch label Mar 22, 2024

softwarefactory-project-zuul bot merged commit 8b138e3 into ansible-collections:main Mar 22, 2024
40 checks passed

patchback bot mentioned this pull request Mar 22, 2024

[PR #2012/8b138e39 backport][stable-7] returns boolean if a user has access to console login #2023

Merged

valkiriaaquatica deleted the patch-1 branch March 22, 2024 09:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

returns boolean if a user has access to console login #2012

returns boolean if a user has access to console login #2012

valkiriaaquatica commented Mar 4, 2024 •

edited

Loading

softwarefactory-project-zuul bot commented Mar 4, 2024

softwarefactory-project-zuul bot commented Mar 21, 2024

abikouo commented Mar 21, 2024

abikouo left a comment

github-actions bot commented Mar 21, 2024 •

edited

Loading

tremble left a comment

softwarefactory-project-zuul bot commented Mar 21, 2024

softwarefactory-project-zuul bot commented Mar 21, 2024

softwarefactory-project-zuul bot commented Mar 21, 2024

valkiriaaquatica commented Mar 21, 2024

abikouo left a comment

softwarefactory-project-zuul bot commented Mar 22, 2024

tremble commented Mar 22, 2024

softwarefactory-project-zuul bot commented Mar 22, 2024

patchback bot commented Mar 22, 2024 •

edited

Loading

returns boolean if a user has access to console login #2012

returns boolean if a user has access to console login #2012

Conversation

valkiriaaquatica commented Mar 4, 2024 • edited Loading

softwarefactory-project-zuul bot commented Mar 4, 2024

softwarefactory-project-zuul bot commented Mar 21, 2024

abikouo commented Mar 21, 2024

abikouo left a comment

Choose a reason for hiding this comment

github-actions bot commented Mar 21, 2024 • edited Loading

Docs Build 📝

tremble left a comment

Choose a reason for hiding this comment

softwarefactory-project-zuul bot commented Mar 21, 2024

softwarefactory-project-zuul bot commented Mar 21, 2024

softwarefactory-project-zuul bot commented Mar 21, 2024

valkiriaaquatica commented Mar 21, 2024

abikouo left a comment

Choose a reason for hiding this comment

softwarefactory-project-zuul bot commented Mar 22, 2024

tremble commented Mar 22, 2024

softwarefactory-project-zuul bot commented Mar 22, 2024

patchback bot commented Mar 22, 2024 • edited Loading

Backport to stable-7: 💚 backport PR created

valkiriaaquatica commented Mar 4, 2024 •

edited

Loading

github-actions bot commented Mar 21, 2024 •

edited

Loading

patchback bot commented Mar 22, 2024 •

edited

Loading