chore: merge upstream cloud-custodian and restamp 0.9.53a1+bf0b50dbc

c7n/cli.py

@@ -9,6 +9,7 @@
 import importlib
 import logging
 import os
+import pathlib
 import pdb
 import sys
 import traceback
@@ -74,10 +75,9 @@ def _default_options(p, exclude=[]):
     output.add_argument("--debug", default=False, help=argparse.SUPPRESS,
                         action="store_true")
 
-    if 'vars' not in exclude:
-        # p.add_argument('--vars', default=None,
-        #               help='Vars file to substitute into policy')
-        p.set_defaults(vars=None)
+    if 'vars-file' not in exclude:
+        p.add_argument('--vars-file', default=None, type=_valid_path,
+                      help='Vars file to substitute into policy')
 
     if 'log-group' not in exclude:
         p.add_argument(
@@ -197,6 +197,17 @@ def _key_val_pair(value):
     return value
 
 
+def _valid_path(value):
+    """
+    Type checker to ensure that --vars-file is a path to a file
+    """
+    path = pathlib.Path(value)
+    if not path.is_file():
+        msg = 'vars-file must point to a file'
+        raise argparse.ArgumentTypeError(msg)
+    return value
+
+
 def setup_parser():
     c7n_desc = "Cloud Custodian - Cloud fleet management"
     parser = argparse.ArgumentParser(description=c7n_desc)

c7n/commands.py

@@ -1,6 +1,7 @@
 # Copyright The Cloud Custodian Authors.
 # SPDX-License-Identifier: Apache-2.0
 from collections import Counter, defaultdict
+from collections.abc import Mapping
 from datetime import timedelta, datetime
 from functools import wraps
 import json
@@ -50,7 +51,7 @@ def _load_policies(options):
         options.region = ""
         for fp in options.configs:
             try:
-                collection = policy_load(options, fp, validate=validate, vars=vars)
+                collection = policy_load(options, fp, validate=validate)
             except IOError:
                 log.error('policy file does not exist ({})'.format(fp))
                 errors += 1
@@ -123,7 +124,7 @@ def _load_policies(options):
 
         # Variable expansion and non schema validation (not optional)
         for p in policies:
-            p.expand_variables(p.get_variables())
+            p.expand_variables(p.get_variables(variables=dict(vars or {})))
             p.validate()
 
         return f(options, list(policies))
@@ -133,11 +134,13 @@ def _load_policies(options):
 
 def _load_vars(options):
     vars = None
-    if options.vars:
+    if options.vars_file:
         try:
-            vars = load_file(options.vars)
-        except IOError as e:
-            log.error('Problem loading vars file "{}": {}'.format(options.vars, e.strerror))
+            vars = load_file(options.vars_file)
+            if not isinstance(vars, Mapping):
+                raise ValueError("Invalid vars file type")
+        except (IOError, yaml.YAMLError, ValueError) as e:
+            log.error('Problem loading vars file "{}": {}'.format(options.vars_file, e))
             sys.exit(1)
 
     # TODO - provide builtin vars here (such as account)

c7n/config.py

@@ -32,6 +32,7 @@ def empty(cls, **kw):
             'region': os.environ.get('AWS_DEFAULT_REGION', 'us-east-1'),
             'regions': (),
             'cache': '',
+            'vars_file': None,
             'profile': None,
             'account_id': None,
             'assume_role': None,

c7n/element.py

@@ -2,11 +2,34 @@
 # Copyright The Cloud Custodian Authors.
 # SPDX-License-Identifier: Apache-2.0
 
+import typing
+
 from c7n import deprecated
 from c7n.executor import ThreadPoolExecutor
 from c7n.utils import jmespath_search
 
 
+class ElementJSONSchema(typing.TypedDict, total=False):
+    """The shape of a filter/action's ``schema`` class attribute.
+
+    This is a JSON Schema (draft-07) fragment, not a standalone
+    document: it gets embedded into the combined policy schema (see
+    ``c7n.schema.process_resource``) at
+    ``#/definitions/resources/<resource>/(actions|filters)/<name>``,
+    and is what validates a single filter/action block in policy
+    YAML, e.g. ``{'type': 'update', 'rotationPeriod': '...'}``.
+
+    Elements normally build this via the ``type_schema()`` helper
+    (``c7n.utils.type_schema``) rather than writing it by hand.
+    """
+
+    type: str
+    properties: dict[str, typing.Any]
+    required: list[str]
+    additionalProperties: bool
+    allOf: list[dict[str, typing.Any]]
+
+
 class Element:
     """Parent base class for filters and actions.
     """
@@ -16,7 +39,8 @@ class Element:
 
     executor_factory = ThreadPoolExecutor
 
-    schema = {'type': 'object'}
+    schema: ElementJSONSchema = {'type': 'object'}
+
     # schema aliases get hoisted into a jsonschema definition
     # location, and then referenced inline.
     schema_alias = None

c7n/resources/apigw.py

@@ -1382,3 +1382,46 @@ def process(self, resources):
                 ApiId=r['c7n:parent-id'],
                 StageName=r['StageName']
             )
+
+
+@resources.register("apigwv2-route")
+class ApiGatewayV2Route(query.ChildResourceManager):
+    """Resource manager for API Gateway V2 Routes.
+
+    API Gateway V2 routes define the routing logic for HTTP and WebSocket APIs.
+    This resource enables filtering routes by authorization type to identify
+    routes that may lack proper authorization controls.
+
+    :example:
+
+    Find routes with no authorization configured:
+
+    .. code-block:: yaml
+
+        policies:
+          - name: apigwv2-routes-without-authorization
+            resource: aws.apigwv2-route
+            filters:
+              - type: value
+                key: AuthorizationType
+                value: NONE
+    """
+
+    class resource_type(query.TypeInfo):
+        service = "apigatewayv2"
+        enum_spec = ('get_routes', 'Items', None)
+        parent_spec = ('aws.apigwv2', 'ApiId', True)
+        arn_type = "/apis"
+        id = "RouteId"
+        name = "RouteKey"
+        cfn_type = "AWS::ApiGatewayV2::Route"
+        permission_prefix = 'apigateway'
+        permissions_enum = ('apigateway:GET',)
+
+    def get_arns(self, resources):
+        partition = get_partition(self.config.region)
+        return [
+            "arn:{}:apigateway:{}::/apis/{}/routes/{}".format(
+                partition, self.config.region, r['c7n:parent-id'], r['RouteId']
+            )
+            for r in resources]

c7n/resources/bedrock.py

@@ -8,11 +8,12 @@
 from c7n.manager import resources
 from c7n.exceptions import PolicyValidationError
 from c7n.query import QueryResourceManager, TypeInfo, DescribeSource, DescribeWithResourceTags
+from c7n.query import RetryPageIterator
 from c7n.tags import RemoveTag, Tag, TagActionFilter, TagDelayedAction, universal_augment
 from c7n.utils import local_session, type_schema, QueryParser
 from c7n.actions import BaseAction
 from c7n.filters.kms import KmsRelatedFilter
-from c7n.filters import MetricsFilter, ValueFilter
+from c7n.filters import Filter, MetricsFilter, ValueFilter
 from c7n.resources.aws import shape_schema, shape_validate, Arn
 from c7n.resources.s3 import BucketAssembly, S3_AUGMENT_TABLE
 
@@ -225,6 +226,56 @@ class BedrockCustomModelKmsFilter(KmsRelatedFilter):
     RelatedIdsExpression = 'modelKmsKeyArn'
 
 
+@BedrockCustomModel.filter_registry.register('deployments')
+class ModelDeploymentsFilter(Filter):
+    """Filter custom models by their custom model deployments.
+
+    Queries ``ListCustomModelDeployments`` for deployments referencing the
+    model, optionally scoped server-side by ``status``. Matches
+    ``value: present`` if any matching deployment is found, or
+    ``value: absent`` if none is found.
+
+    :example:
+
+    Find custom models with no active deployment:
+
+    .. code-block:: yaml
+
+        policies:
+          - name: bedrock-custom-model-no-active-deployment
+            resource: aws.bedrock-custom-model
+            filters:
+              - type: deployments
+                status: Active
+                value: absent
+    """
+    schema = type_schema(
+        'deployments',
+        status={'enum': ['Creating', 'Active', 'Failed']},
+        value={'enum': ['present', 'absent']},
+        required=['value'])
+    permissions = ('bedrock:ListCustomModelDeployments',)
+    annotation_key = 'c7n:Deployments'
+
+    def process(self, resources, event=None):
+        client = local_session(self.manager.session_factory).client('bedrock')
+        params = {}
+        if 'status' in self.data:
+            params['statusEquals'] = self.data['status']
+        want_present = self.data['value'] == 'present'
+        results = []
+        paginator = client.get_paginator('list_custom_model_deployments')
+        paginator.PAGE_ITERATOR_CLS = RetryPageIterator
+        for r in resources:
+            deployments = paginator.paginate(
+                modelArnEquals=r['modelArn'], **params
+            ).build_full_result().get('modelDeploymentSummaries', [])
+            r[self.annotation_key] = deployments
+            if bool(deployments) == want_present:
+                results.append(r)
+        return results
+
+
 class DescribeBedrockCustomizationJob(DescribeSource):
 
     def augment(self, resources):

c7n/resources/cw.py

@@ -6,7 +6,9 @@
 from concurrent.futures import as_completed
 from datetime import datetime, timedelta
 
-from c7n.actions import BaseAction
+from botocore.exceptions import ClientError
+
+from c7n.actions import AutoTagUser, BaseAction
 from c7n.exceptions import PolicyValidationError
 from c7n.filters import Filter, MetricsFilter
 from c7n.filters.core import parse_date, ValueFilter
@@ -17,7 +19,8 @@
     QueryResourceManager,
     TypeInfo, DescribeSource, ConfigSource, DescribeWithResourceTags)
 from c7n.resolver import ValuesFrom
-from c7n.tags import universal_augment
+from c7n.tags import (
+    RemoveTag, Tag, TagActionFilter, TagDelayedAction, universal_augment)
 from c7n.utils import type_schema, local_session, chunks, get_retry, jmespath_search
 
 
@@ -688,6 +691,32 @@ def process(self, resources):
                 logGroupName=r['logGroupName'], **params)
 
 
+class DescribeDashboard(DescribeSource):
+
+    def augment(self, resources):
+        # Dashboards aren't supported by the resource groups tagging api,
+        # fetch their tags from cloudwatch directly.
+        resources = super().augment(resources)
+        client = local_session(self.manager.session_factory).client('cloudwatch')
+        results = []
+        for r, arn in zip(resources, self.manager.get_arns(resources)):
+            try:
+                tags = self.manager.retry(
+                    client.list_tags_for_resource, ResourceARN=arn).get('Tags', [])
+            except ClientError as e:
+                if e.response['Error']['Code'] not in (
+                        'ResourceNotFound', 'ResourceNotFoundException'):
+                    raise
+                # the dashboard was deleted between enumeration and augment
+                self.manager.log.warning(
+                    "Resource not found: list_tags_for_resource using %s" % {
+                        'ResourceARN': arn})
+                continue
+            r['Tags'] = tags
+            results.append(r)
+        return results
+
+
 @resources.register("cloudwatch-dashboard")
 class CloudWatchDashboard(QueryResourceManager):
     class resource_type(TypeInfo):
@@ -698,14 +727,71 @@ class resource_type(TypeInfo):
         id = "DashboardName"
         name = "DashboardName"
         cfn_type = "AWS::CloudWatch::Dashboard"
-        universal_taggable = object()
         global_resource = True
+        permissions_augment = ("cloudwatch:ListTagsForResource",)
 
     source_mapping = {
-       "describe": DescribeWithResourceTags,
+       "describe": DescribeDashboard,
     }
 
 
+@CloudWatchDashboard.action_registry.register('tag')
+class DashboardTag(Tag):
+    """Add tags to a cloudwatch dashboard
+
+    :example:
+
+    .. code-block:: yaml
+
+            policies:
+              - name: cloudwatch-dashboard-tag-owner
+                resource: aws.cloudwatch-dashboard
+                filters:
+                  - "tag:Owner": absent
+                actions:
+                  - type: tag
+                    key: Owner
+                    value: platform-team
+    """
+
+    permissions = ("cloudwatch:TagResource",)
+
+    def process_resource_set(self, client, resource_set, tags):
+        for arn in self.manager.get_arns(resource_set):
+            self.manager.retry(client.tag_resource, ResourceARN=arn, Tags=tags)
+
+
+@CloudWatchDashboard.action_registry.register('remove-tag')
+class DashboardRemoveTag(RemoveTag):
+    """Remove tags from a cloudwatch dashboard
+
+    :example:
+
+    .. code-block:: yaml
+
+            policies:
+              - name: cloudwatch-dashboard-remove-owner
+                resource: aws.cloudwatch-dashboard
+                filters:
+                  - "tag:Owner": present
+                actions:
+                  - type: remove-tag
+                    tags: [Owner]
+    """
+
+    permissions = ("cloudwatch:UntagResource",)
+
+    def process_resource_set(self, client, resource_set, tag_keys):
+        for arn in self.manager.get_arns(resource_set):
+            self.manager.retry(
+                client.untag_resource, ResourceARN=arn, TagKeys=tag_keys)
+
+
+CloudWatchDashboard.filter_registry.register('marked-for-op', TagActionFilter)
+CloudWatchDashboard.action_registry.register('mark-for-op', TagDelayedAction)
+CloudWatchDashboard.action_registry.register('auto-tag-user', AutoTagUser)
+
+
 @resources.register("destination")
 class Destination(QueryResourceManager):
     class resource_type(TypeInfo):