aws.ec2 package¶

Submodules¶

aws.ec2.helpers module¶

aws.ec2.helpers.ip_permission_opens_all_ports(ipp)[source]¶

Returns True if an EC2 security group IP permission opens all ports and False otherwise.

>>> ip_permission_opens_all_ports({'FromPort': 1, 'ToPort': 65535})
True
>>> ip_permission_opens_all_ports({'FromPort': 1, 'ToPort': 965535})
True
>>> ip_permission_opens_all_ports({'FromPort': -1, 'ToPort': 20})
True
>>> ip_permission_opens_all_ports({'FromPort': 20, 'ToPort': -1})
True

>>> ip_permission_opens_all_ports({'ToPort': -1})
False

aws.ec2.helpers.ip_permission_cidr_allows_all_ips(ipp)[source]¶

Returns True if any IPv4 or IPv6 range for an EC2 security group IP permission opens allows access to or from all IPs and False otherwise.

>>> ip_permission_cidr_allows_all_ips({'IpRanges': [{'CidrIp': '0.0.0.0/0'}]})
True
>>> ip_permission_cidr_allows_all_ips({'Ipv6Ranges': [{'CidrIpv6': '::/0'}]})
True

>>> ip_permission_cidr_allows_all_ips({'IpRanges': [{'CidrIp': '192.0.1.1/8'}]})
False
>>> ip_permission_cidr_allows_all_ips({'Ipv6Ranges': [{'CidrIpv6': '192.0.1.1/8'}]})
False
>>> ip_permission_cidr_allows_all_ips({})
False

aws.ec2.helpers.ip_permission_grants_access_to_group_with_id(ipp, security_group_id)[source]¶

Returns True if an EC2 security group IP permission opens access to a security with the given ID and False otherwise.

>>> ip_permission_grants_access_to_group_with_id(
... {'UserIdGroupPairs': [{'GroupId': 'test-sgid'}]}, 'test-sgid')
True
>>> ip_permission_grants_access_to_group_with_id(
... {'UserIdGroupPairs': [{'GroupId': 'test-sgid'}]}, 'not-test-sgid')
False
>>> ip_permission_grants_access_to_group_with_id({}, 'test-sgid')
False

aws.ec2.helpers.ec2_security_group_opens_all_ports(ec2_security_group)[source]¶

Returns True if an ec2 security group includes a permission allowing inbound access on all ports and False otherwise or if protocol is ICMP.

>>> ec2_security_group_opens_all_ports(
... {'IpPermissions': [{}, {'FromPort': -1,'ToPort': 65536}]})
True

>>> ec2_security_group_opens_all_ports(
... {'IpPermissions': [{}, {'IpProtocol': 'icmp', 'FromPort': -1,'ToPort': -1}]})
False
>>> ec2_security_group_opens_all_ports({})
False

aws.ec2.helpers.ec2_security_group_opens_all_ports_to_self(ec2_security_group)[source]¶

Returns True if an ec2 security group includes a permission allowing all IPs inbound access on all ports and False otherwise or if protocol is ICMP.

>>> ec2_security_group_opens_all_ports_to_self({
... 'GroupId': 'test-sgid',
... 'IpPermissions': [
...     {'FromPort': 1, 'ToPort': 65535, 'UserIdGroupPairs': [{'GroupId': 'test-sgid'}]},
... ]})
True

>>> ec2_security_group_opens_all_ports_to_self({
... 'GroupId': 'test-sgid',
... 'IpPermissions': [
...     {'IpProtocol': "icmp", 'FromPort': -1, 'ToPort': -1, 'UserIdGroupPairs': [{'GroupId': 'test-sgid'}]},
... ]})
False
>>> ec2_security_group_opens_all_ports_to_self({
... 'GroupId': 'test-sgid',
... 'IpPermissions': [
...     {'UserIdGroupPairs': [{'GroupId': 'test-sgid'}]},
... ]})
False
>>> ec2_security_group_opens_all_ports_to_self({'GroupId': 'test-sgid'})
False
>>> ec2_security_group_opens_all_ports_to_self({
... 'GroupId': 'test-sgid',
... 'IpPermissions': [
...     {'UserIdGroupPairs': []},
... ]})
False
>>> ec2_security_group_opens_all_ports_to_self({})
False
>>> ec2_security_group_opens_all_ports_to_self([])
False

aws.ec2.helpers.ec2_security_group_opens_all_ports_to_all(ec2_security_group)[source]¶

Returns True if an ec2 security group includes a permission allowing all IPs inbound access on all ports and False otherwise or if protocol is ICMP.

>>> ec2_security_group_opens_all_ports_to_all({'IpPermissions': [
... {'FromPort': -1,'ToPort': 65535,'IpRanges': [{'CidrIp': '0.0.0.0/0'}]},
... ]})
True
>>> ec2_security_group_opens_all_ports_to_all({'IpPermissions': [
... {'FromPort': 1,'ToPort': 65535,'Ipv6Ranges': [{'CidrIpv6': '::/0'}]}
... ]})
True

>>> ec2_security_group_opens_all_ports_to_all({'IpPermissions': [
... {'IpProtocol': 'icmp','FromPort': -1,'ToPort': -1,'IpRanges': [{'CidrIp': '0.0.0.0/0'}]},
... ]})
False
>>> ec2_security_group_opens_all_ports_to_all({'IpPermissions': []})
False
>>> ec2_security_group_opens_all_ports_to_all({})
False
>>> ec2_security_group_opens_all_ports_to_all([])
False

aws.ec2.helpers.ec2_security_group_opens_specific_ports_to_all(ec2_security_group, allowed_ports=None)[source]¶

Returns True if an ec2 security group includes a permission allowing all IPs inbound access on specific unsafe ports and False otherwise or if protocol is ICMP.

>>> ec2_security_group_opens_specific_ports_to_all({'IpPermissions': [
... {'FromPort': 22,'ToPort': 22,'IpRanges': [{'CidrIp': '0.0.0.0/0'}]},
... ]})
True
>>> ec2_security_group_opens_specific_ports_to_all({'IpPermissions': [
... {'FromPort': 234,'ToPort': 432,'IpRanges': [{'CidrIp': '0.0.0.0/0'}]},
... ]})
True

>>> ec2_security_group_opens_specific_ports_to_all({'IpPermissions': [
... {'FromPort': 80,'ToPort': 80,'IpRanges': [{'CidrIp': '0.0.0.0/0'}]},
... ]})
False
>>> ec2_security_group_opens_specific_ports_to_all({'IpPermissions': []})
False
>>> ec2_security_group_opens_specific_ports_to_all({})
False
>>> ec2_security_group_opens_specific_ports_to_all([])
False

aws.ec2.helpers.ec2_instance_test_id(ec2_instance)[source]¶: A getter fn for test ids for EC2 instances

aws.ec2.helpers.ec2_security_group_test_id(ec2_security_group)[source]¶: A getter fn for test ids for EC2 security groups

aws.ec2.helpers.ec2_address_id(ec2_address)[source]¶: Format an Elastic IP address.

aws.ec2.helpers.is_ebs_volume_encrypted(ebs)[source]¶

Checks the EBS volume ‘Encrypted’ value.

>>> is_ebs_volume_encrypted({'Encrypted': True})
True
>>> is_ebs_volume_encrypted({'Encrypted': False})
False
>>> is_ebs_volume_encrypted({})
Traceback (most recent call last):
...
KeyError: 'Encrypted'
>>> is_ebs_volume_encrypted(0)
Traceback (most recent call last):
...
TypeError: 'int' object is not subscriptable
>>> is_ebs_volume_encrypted(None)
Traceback (most recent call last):
...
TypeError: 'NoneType' object is not subscriptable

aws.ec2.helpers.is_ebs_volume_piops(ebs)[source]¶

Checks if the EBS volume type is provisioned iops

>>> is_ebs_volume_piops({'VolumeType': 'io1'})
True
>>> is_ebs_volume_piops({'VolumeType': 'standard'})
False
>>> is_ebs_volume_piops({})
Traceback (most recent call last):
...
KeyError: 'VolumeType'
>>> is_ebs_volume_piops(0)
Traceback (most recent call last):
...
TypeError: 'int' object is not subscriptable
>>> is_ebs_volume_piops(None)
Traceback (most recent call last):
...
TypeError: 'NoneType' object is not subscriptable

aws.ec2.helpers.is_ebs_snapshot_public(ebs_snapshot)[source]¶

Checks if the EBS snapshot’s ‘CreateVolumePermissions’ attribute allows for public creation.

>>> is_ebs_snapshot_public({'CreateVolumePermissions':[{'Group': 'all'}]})
True
>>> is_ebs_snapshot_public({'CreateVolumePermissions':[{'Group': ''}]})
False
>>> is_ebs_snapshot_public({'CreateVolumePermissions':[{'foo': 'bar'}]})
False
>>> is_ebs_snapshot_public({'CreateVolumePermissions':[]})
False
>>> is_ebs_snapshot_public({})
False

aws.ec2.helpers.ec2_instance_missing_tag_names(ec2_instance, required_tag_names)[source]¶

Returns any tag names that are missing from an EC2 Instance.

>>> ec2_instance_missing_tag_names({'Tags': [{'Key': 'Name'}]}, frozenset(['Name']))
frozenset()
>>> ec2_instance_missing_tag_names({
... 'InstanceId': 'iid', 'Tags': [{'Key': 'Bar'}]}, frozenset(['Name']))
frozenset({'Name'})

aws.ec2.helpers.ebs_volume_attached_to_instance(ebs, volume_created_days_ago=90)[source]¶

Check an ebs volume is attached to an instance. The “volume_created_days_ago” parameter allows checking for volumes that were created that many days ago.

>>> from datetime import datetime
>>> from datetime import timezone

>>> ebs_volume_attached_to_instance({"CreateTime": datetime.fromisoformat("2020-09-11T19:45:22.116+00:00"), "State": "in-use"})
True
>>> ebs_volume_attached_to_instance({"CreateTime": datetime.fromisoformat("2000-09-11T19:45:22.116+00:00"), "State": "in-use"})
True
>>> ebs_volume_attached_to_instance({"CreateTime": datetime.now(timezone.utc), "State": "available"})
True
>>> ebs_volume_attached_to_instance({"CreateTime": datetime.fromisoformat("2000-09-11T19:45:22.116+00:00"), "State": "available"})
False

aws.ec2.helpers.ebs_snapshot_not_too_old(snapshot, snapshot_started_days_ago=365)[source]¶

Check an ebs snapshot is created less than “snapshot_started_days_ago”.

>>> from datetime import datetime
>>> from datetime import timezone
>>> from aws.ec2.helpers import ebs_snapshot_not_too_old
>>> ebs_snapshot_not_too_old({"StartTime": datetime.now(timezone.utc)})
True
>>> ebs_snapshot_not_too_old({"StartTime": datetime.fromisoformat("2019-09-11T19:45:22.116+00:00")})
False