private static async Task executeKMS(string[] args, Credentials credentials)
{
var nArgs = CLIHelper.GetNamedArguments(args);
var helper = new KMSHelper(credentials);
switch (args[1])
{
case "list-grants":
{
var result = await helper.GetGrantsByKeyNameAsync(
keyName : nArgs["key"],
grantName : nArgs["name"]);
Console.WriteLine($"{result.JsonSerialize(Newtonsoft.Json.Formatting.Indented)}");
}
; break;
case "create-grant":
{
var grants = nArgs["grants"].Split(',').Where(x => !x.IsNullOrWhitespace()).ToEnum <KMSHelper.GrantType>();
var grant = grants.Aggregate((a, b) => a | b);
var result = await helper.CreateRoleGrantByName(
keyName : nArgs["key"],
grantName : nArgs["name"],
roleName : nArgs["role"],
grant : grant);
Console.WriteLine($"SUCCESS, grant '{nArgs["name"]}' of key '{nArgs["key"]}' for role '{nArgs["role"]}' was created with privileges: '{grants.Select(x => x.ToString()).JsonSerialize()}'.");
}
; break;
case "remove-grant":
{
var result = await helper.RemoveGrantsByName(
keyName : nArgs["key"],
grantName : nArgs["name"]);
Console.WriteLine($"SUCCESS, {result?.Length ?? 0} grant/s with name '{nArgs["name"]}' of key '{nArgs["key"]}' were removed.");
}
; break;
case "help": HelpPrinter($"{args[0]}", "Amazon Identity and Access Management",
("list-grants", "Accepts params: key, name"),
("create-grant", "Accepts params: key, name, role, grants (',' separated: Encrypt, Decrypt)"),
("remove-grant", "Accepts params: key, name"));
break;
default:
{
Console.WriteLine($"Try '{args[0]} help' to find out list of available commands.");
throw new Exception($"Unknown IAM command: '{args[0]} {args[1]}'");
}
}
}
private static void executeFargate(string[] args, Credentials credentials)
{
var nArgs = CLIHelper.GetNamedArguments(args);
var elb = new ELBHelper();
var r53 = new Route53Helper();
var ecs = new ECSHelper();
var cw = new CloudWatchHelper();
var kms = new KMSHelper(credentials);
var iam = new IAMHelper(credentials);
var acm = new ACMHelper();
switch (args[1])
{
case "create-resources":
{
bool catchDisable = nArgs.GetValueOrDefault("catch-disable", "false").ToBool();
int resourceCreateTimeout = nArgs["resource-create-timeout"].ToInt32();
var resource = new FargateResourceV2(nArgs);
string prefix_new = "a-";
string prefix_old = "b-";
bool setRoutes = true;
Console.WriteLine("Determining Temporary Resource Naming Conventions...");
var record = r53.GetCNameRecordSet(resource.IsPublic ? resource.ZonePublic : resource.ZonePrivate, resource.DNSCName,
failover: "PRIMARY",
throwIfNotFound: false).Result;
if (record?.ResourceRecords.IsNullOrEmpty() == false)
{
var a_alb = elb.GetLoadBalancersByName(loadBalancerName: $"a-{resource.LoadBalancerName}", throwIfNotFound: false).Result.SingleOrDefault();
var b_alb = elb.GetLoadBalancersByName(loadBalancerName: $"b-{resource.LoadBalancerName}", throwIfNotFound: false).Result.SingleOrDefault();
if (a_alb != null && record.ResourceRecords.Any(r => r.Value == a_alb.DNSName))
{
prefix_new = "b-";
prefix_old = "a-";
setRoutes = false;
}
else if (b_alb != null && record.ResourceRecords.Any(r => r.Value == b_alb.DNSName))
{
prefix_new = "a-";
prefix_old = "b-";
setRoutes = false;
}
else
{
Console.WriteLine("WARNING!!! Record was present, but could NOT find any associated loadbalancers.");
}
}
var resourceNew = resource.DeepCopy();
resourceNew.SetName($"{prefix_new}{resource.Name}");
resourceNew.SetDNSCName($"{prefix_new}{resource.DNSCName}");
var resourceOld = resource.DeepCopy();
resourceOld.SetName($"{prefix_old}{resource.Name}");
resourceOld.SetDNSCName($"{prefix_old}{resource.DNSCName}");
Console.WriteLine("Destroying Temporary Resources...");
FargateResourceHelperV2.Destroy(resourceNew, elb, r53, ecs, cw, kms, iam, throwOnFailure: true, catchDisable: catchDisable).Await();
try
{
Console.WriteLine("Creating New Resources...");
FargateResourceHelperV2.Create(resourceNew, elb, r53, ecs, cw, kms, iam, acm);
Console.WriteLine($"Awaiting up to {resourceCreateTimeout} [s] for Tasks Desired Status...");
ecs.WaitForServiceToStart(resourceNew.ClusterName, resourceNew.ServiceName, resourceCreateTimeout).Await();
}
catch (Exception ex)
{
Console.WriteLine($"Failed New Resource Deployment with exception: {ex.JsonSerializeAsPrettyException(Formatting.Indented)}");
Console.WriteLine("Destroying New Resources...");
FargateResourceHelperV2.Destroy(resourceNew, elb, r53, ecs, cw, kms, iam, throwOnFailure: true, catchDisable: catchDisable).Await();
throw new Exception("New Resource Deployment Failure", ex);
}
if (setRoutes ||
record?.HealthCheckId == null ||
record.HealthCheckId != r53.GetHealthCheckAsync(resource.HealthCheckName, throwIfNotFound: false).Result?.Id)
{
Console.WriteLine("DNS Route Initialization...");
FargateResourceHelperV2.SetRoutes(resource, resourceNew, elb, r53, cw);
}
else
{
Console.WriteLine("DNS Route Swap...");
FargateResourceHelperV2.SwapRoutes(resource, resourceNew, elb, r53, cw);
}
Console.WriteLine("Destroying Old Resources...");
FargateResourceHelperV2.Destroy(resourceOld, elb, r53, ecs, cw, kms, iam, throwOnFailure: true, catchDisable: catchDisable).Await();
}
; break;
case "destroy-resources":
{
bool catchDisable = nArgs.GetValueOrDefault("catch-disable", "false").ToBool();
var resource = new FargateResourceV2(nArgs);
var resourceA = resource.DeepCopy();
resourceA.SetName($"a-{resource.Name}");
resourceA.SetDNSCName($"a-{resource.DNSCName}");
var resourceB = resource.DeepCopy();
resourceB.SetName($"b-{resource.Name}");
resourceB.SetDNSCName($"b-{resource.DNSCName}");
var t0 = FargateResourceHelperV2.Destroy(resource, elb, r53, ecs, cw, kms, iam, throwOnFailure: true, catchDisable: catchDisable);
var t1 = FargateResourceHelperV2.Destroy(resourceA, elb, r53, ecs, cw, kms, iam, throwOnFailure: true, catchDisable: catchDisable);
var t2 = FargateResourceHelperV2.Destroy(resourceB, elb, r53, ecs, cw, kms, iam, throwOnFailure: true, catchDisable: catchDisable);
var result = Task.WhenAll(t0, t1, t2).Result;
Console.WriteLine($"Destroying Health Check'{resource.ELBHealthyMetricAlarmName}'...");
r53.DeleteHealthCheckByNameAsync(resource.HealthCheckName, throwIfNotFound: false)
.CatchExceptionAsync(catchDisable: catchDisable).Result.PrintResult();
}
break;
case "help":
case "--help":
case "-help":
case "-h":
case "h":
HelpPrinter($"{args[0]}", "Amazon Fargate",
("create-service", "Accepts params:"));
break;
default:
{
Console.WriteLine($"Try '{args[0]} help' to find out list of available commands.");
throw new Exception($"Unknown Fargate command: '{args[0]} {args[1]}'");
}
}
}
public static void Create(
FargateResourceV2 resource,
ELBHelper elb, Route53Helper e53, ECSHelper ecs, CloudWatchHelper cw, KMSHelper kms, IAMHelper iam, ACMHelper acm)
{
var errList = new List <Exception>();
Console.WriteLine("Crating S3 Access Policy...");
var policyS3 = iam.CreatePolicyS3Async(
name: resource.PolicyNameAccessS3,
paths: resource.PathsS3,
permissions: resource.PermissionsS3,
description: $"S3 Access Policy '{resource.PolicyNameAccessS3}' to '{resource.PathsS3.JsonSerialize()}' auto generated by AWSHelper").Result.PrintResponse();
Console.WriteLine($"Crating Execution Role '{resource.RoleName}'...");
var roleEcs = iam.CreateRoleWithPoliciesAsync(
roleName: resource.RoleName,
policies: new string[] { resource.ExecutionPolicy, resource.PolicyNameAccessS3 },
roleDescription: $"Role '{resource.RoleName}' auto generated by AWSHelper").Result.PrintResponse();
Console.WriteLine($"Awaiting {resource.RoleCreateAwaitDelay / 1000} [s] to ensure that role was indexed...");
Thread.Sleep(resource.RoleCreateAwaitDelay);
Console.WriteLine($"Crating Default S3 Storage Grant '{resource.StorageGrantDefaultS3}' created for role '{resource.RoleName}'...");
var defaultGrantResult = kms.CreateRoleGrantByName(
keyName: resource.StorageKeyDefaultS3,
grantName: resource.StorageGrantDefaultS3,
roleName: resource.RoleName,
grant: KMSHelper.GrantType.EncryptDecrypt).Result.PrintResponse();
Console.WriteLine($"Crating Internal S3 Storage Grant '{resource.StorageGrantInternalS3}' created for role '{resource.RoleName}'...");
var internalGrantResult = kms.CreateRoleGrantByName(
keyName: resource.StorageKeyInternalS3,
grantName: resource.StorageGrantInternalS3,
roleName: resource.RoleName,
grant: KMSHelper.GrantType.EncryptDecrypt).Result.PrintResponse();
Console.WriteLine("Crating Application Load Balancer...");
var loadBalancer = elb.CreateApplicationLoadBalancerAsync(resource.LoadBalancerName, resource.Subnets, resource.SecurityGroups, !resource.IsPublic).Result.PrintResponse();
Console.WriteLine("Retriving Certificate...");
var cert = acm.DescribeCertificateByDomainName(resource.CertificateDomainName).Result.PrintResponse();
Console.WriteLine("Creating HTTP Target Group...");
var targetGroup_http = elb.CreateHttpTargetGroupAsync(resource.TargetGroupName, resource.Port, resource.VPC, resource.HealthCheckPath).Result.PrintResponse();
Console.WriteLine("Creating HTTPS Listener...");
var listener_https = elb.CreateHttpsListenerAsync(loadBalancer.LoadBalancerArn, targetGroup_http.TargetGroupArn, certificateArn: cert.CertificateArn).Result.PrintResponse();
Console.WriteLine("Creating HTTP Listener...");
var listener_http = elb.CreateHttpListenerAsync(loadBalancer.LoadBalancerArn, targetGroup_http.TargetGroupArn, resource.Port).Result.PrintResponse();
if (resource.IsPublic && !resource.ZonePublic.IsNullOrWhitespace())
{
Console.WriteLine("Creating Route53 DNS Record for the public zone...");
e53.UpsertCNameRecordAsync(
resource.ZonePublic,
name: resource.DNSCName,
value: loadBalancer.DNSName,
ttl: 60).Await();
}
if (!resource.ZonePrivate.IsNullOrWhitespace())
{
Console.WriteLine("Creating Route53 DNS Record for the private zone...");
e53.UpsertCNameRecordAsync(
resource.ZonePrivate,
name: resource.DNSCName,
value: loadBalancer.DNSName,
ttl: 60).Await();
}
Console.WriteLine("Initializeing Cluster...");
var createClusterResponse = ecs.CreateClusterAsync(resource.ClusterName).Result.PrintResponse();
Console.WriteLine("Creating Log Group...");
cw.CreateLogGroupAsync(resource.LogGroupName).Await();
Console.WriteLine("Creating Task Definitions...");
var taskDefinition = ecs.RegisterFargateTaskAsync(
executionRoleArn: resource.RoleName,
family: resource.TaskFamily,
cpu: resource.CPU,
memory: resource.Memory,
name: resource.TaskDefinitionName,
image: resource.Image,
envVariables: resource.Environment,
logGroup: resource.LogGroupName,
ports: resource.Ports).Result.PrintResponse();
Console.WriteLine("Creating Service...");
var service = ecs.CreateFargateServiceAsync(
name: resource.ServiceName,
taskDefinition: taskDefinition,
desiredCount: resource.DesiredCount,
cluster: resource.ClusterName,
targetGroup: targetGroup_http,
assignPublicIP: resource.IsPublic,
securityGroups: resource.SecurityGroups,
subnets: resource.Subnets
).Result.PrintResponse();
Console.WriteLine($"Creating Cloud Watch Metric '{resource.ELBHealthyMetricAlarmName}'...");
var metricAlarm = cw.UpsertAELBMetricAlarmAsync(elb,
name: resource.ELBHealthyMetricAlarmName,
loadBalancer: resource.LoadBalancerName, targetGroup: resource.TargetGroupName,
metric: CloudWatchHelper.ELBMetricName.HealthyHostCount,
comparisonOperator: Amazon.CloudWatch.ComparisonOperator.LessThanThreshold,
treshold: 1).Result.PrintResponse();
}
public static async Task <List <Exception> > Destroy(
FargateResourceV2 resource,
ELBHelper elb, Route53Helper e53, ECSHelper ecs, CloudWatchHelper cw, KMSHelper kms, IAMHelper iam,
bool throwOnFailure,
bool catchDisable)
{
var errList = new List <Exception>();
int maxRepeats = throwOnFailure ? 1 : 3;
int delay_ms = throwOnFailure ? 500 : 10000;
Console.WriteLine($"Destroying Role '{resource.RoleName}'...");
(await iam.DeleteRoleAsync(resource.RoleName, detachPolicies: true)
.TryCatchRetryAsync(maxRepeats: maxRepeats, delay: delay_ms).CatchExceptionAsync()).PrintResult();
Console.WriteLine($"Destroying Policy '{resource.PolicyNameAccessS3}'...");
errList.Add(iam.DeletePolicyByNameAsync(resource.PolicyNameAccessS3, throwIfNotFound: false)
.TryCatchRetryAsync(maxRepeats: maxRepeats, delay: delay_ms)
.CatchExceptionAsync(catchDisable: catchDisable).Result.PrintResult());
Console.WriteLine($"Destroying Default Grant '{resource.StorageGrantDefaultS3}' for key '{resource.StorageKeyDefaultS3}'...");
errList.Add(kms.RemoveGrantsByName(keyName: resource.StorageKeyDefaultS3, grantName: resource.StorageGrantDefaultS3, throwIfNotFound: false)
.TryCatchRetryAsync(maxRepeats: maxRepeats, delay: delay_ms)
.CatchExceptionAsync(catchDisable: catchDisable).Result.PrintResult());
Console.WriteLine($"Destroying Internal Grant '{resource.StorageGrantInternalS3}' for key '{resource.StorageKeyInternalS3}'...");
errList.Add(kms.RemoveGrantsByName(keyName: resource.StorageKeyInternalS3, grantName: resource.StorageGrantInternalS3, throwIfNotFound: false)
.TryCatchRetryAsync(maxRepeats: maxRepeats, delay: delay_ms)
.CatchExceptionAsync(catchDisable: catchDisable).Result.PrintResult());
Console.WriteLine($"Destroying Application Load Balancer '{resource.LoadBalancerName}'...");
errList.Add(elb.DestroyLoadBalancer(loadBalancerName: resource.LoadBalancerName, throwIfNotFound: false)
.TryCatchRetryAsync(maxRepeats: maxRepeats, delay: delay_ms)
.CatchExceptionAsync(catchDisable: catchDisable).Result.PrintResult());
if (resource.IsPublic && !resource.ZonePublic.IsNullOrWhitespace())
{
Console.WriteLine($"Destroying Route53 DNS Record: '{resource.DNSCName}' of '{resource.ZonePublic}' zone...");
errList.Add(e53.DestroyCNameRecord(resource.ZonePublic, resource.DNSCName, throwIfNotFound: false)
.TryCatchRetryAsync(maxRepeats: maxRepeats, delay: delay_ms)
.CatchExceptionAsync(catchDisable: catchDisable).Result.PrintResult());
}
if (!resource.ZonePrivate.IsNullOrWhitespace())
{
Console.WriteLine($"Destroying Route53 DNS Record: '{resource.DNSCName}' of '{resource.ZonePrivate}' zone...");
errList.Add(e53.DestroyCNameRecord(resource.ZonePrivate, resource.DNSCName, throwIfNotFound: false)
.TryCatchRetryAsync(maxRepeats: maxRepeats, delay: delay_ms)
.CatchExceptionAsync(catchDisable: catchDisable).Result.PrintResult());
}
Console.WriteLine($"Destroying Log Group '{resource.LogGroupName}'...");
errList.Add(cw.DeleteLogGroupAsync(resource.LogGroupName, throwIfNotFound: false)
.TryCatchRetryAsync(maxRepeats: maxRepeats, delay: delay_ms)
.CatchExceptionAsync(catchDisable: catchDisable).Result.PrintResult());
Console.WriteLine($"Destroying Task Definitions of Family'{resource.TaskFamily}'...");
errList.Add(ecs.DestroyTaskDefinitions(familyPrefix: resource.TaskFamily)
.TryCatchRetryAsync(maxRepeats: maxRepeats, delay: delay_ms)
.CatchExceptionAsync(catchDisable: catchDisable).Result.PrintResult());
Console.WriteLine($"Destroying Service '{resource.ServiceName}'...");
errList.Add(ecs.DestroyService(cluster: resource.ClusterName, serviceName: resource.ServiceName, throwIfNotFound: false)
.TryCatchRetryAsync(maxRepeats: maxRepeats, delay: delay_ms)
.CatchExceptionAsync(catchDisable: catchDisable).Result.PrintResult());
Console.WriteLine($"Destroying Cluster '{resource.ClusterName}'...");
errList.Add(ecs.DeleteClusterAsync(name: resource.ClusterName, throwIfNotFound: false)
.TryCatchRetryAsync(maxRepeats: maxRepeats, delay: delay_ms)
.CatchExceptionAsync(catchDisable: catchDisable).Result.PrintResult());
Console.WriteLine($"Destroying Metric Alarm '{resource.ELBHealthyMetricAlarmName}'...");
errList.Add(cw.DeleteMetricAlarmAsync(resource.ELBHealthyMetricAlarmName, throwIfNotFound: false)
.TryCatchRetryAsync(maxRepeats: maxRepeats, delay: delay_ms)
.CatchExceptionAsync(catchDisable: catchDisable).Result.PrintResult());
if (throwOnFailure && errList.Any(x => x != null))
{
throw new AggregateException("Failed Fargate Resource Destruction", errList.ToArray());
}
return(errList);
}
