Iiz %SrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSK r SSK r SSK r SSK Jr SSKJr SSKJr SSKJrJrJrJrJrJrJrJrJr SSKrSSKrSSK J!r!J"r" SSK#J$r$ SS K%J&r&J'r'J(r( \RR"\*5r+"S S 5r,\"S S5q-S \"R\S \"R^S\"R`4Sjr1S\"R^S\"R^S\"Rd4Sjr3S\"R\S\"R\S\"Rd4Sjr4S\"R\S\"R\S\"Rd4Sjr5S\"R^S\"R^4Sjr6S\"R\S\"Rn4Sjr8"SS\Rr5r9\S\9\Rt4r;\\\9\S\Rt44r"S!S"\R~5r@S\"R^S\"R`4S#jrS\"R^S\"R`4S$jrAS\"R^S\"R`4S%jrBS&\"R^S\"R`4S'jrCS(\"R^S)\"R^S\"R`4S*jrDSS&\"R^S)\\"R^S\"R`4S+jjrES,\"R`S-\"R^S\"R`4S.jrFS,\"R\S-\"R^S\"R\4S/jrGS \"R\S \"R^S\"R`4S0jrHS1\"RS\"R`4S2jrJS3\"RS\"R`4S4jrKS1\"RS3\"RS\"R`4S5jrLS3\"RS\"R`4S6jrMSS1\"RS7\\\"R`S\"R`4S8jjrNS1\"RS\"R`4S9jrOS1\"RS\"R`4S:jrPS1\"RS\"R`4S;jrQS1\"RS\"R`4S<jrRS1\"RS\"R`4S=jrSS1\"RS\"R`4S>jrTS1\"RS\"R`4S?jrUS1\"RS\"R`4S@jrVSA\"RS\"R`4SBjrWSC\"R`S\"R`4SDjrXS1\"RS\"R`4SEjrYSF\"R`S\"R`4SGjrZSH\"R^S\"R^4SIjr[S1\"RS\"R`4SJjr\SF\"R`S\"R`4SKjr]SL\"R`S\"R`4SMjr^SN\"R`S\"R`4SOjr_S1\"RS\"R`4SPjr`S1\"RS\"R`4SQjraS1\"RS\"R`4SRjrbS1\"RS\"R`4SSjrcS1\"RS\"R`4STjrdS1\"RS\"R`4SUjreS1\"RS\"R`4SVjrfS1\"RS\"R`4SWjrgS1\"RS\"R`4SXjrhS1\"RS\"R`4SYjriSZ\"R^S[\"R^S\"R`4S\jrjS\"R`4S]jrkS\"R`4S^jrlS\"R`4S_jrmS\"R`4S`jrnS\"R`4SajroS\"R`4SbjrpS\"R`4ScjrqS1\"RS\"R`4SdjrrS1\"RS\"R`4SejrsS1\"RS\"R`4SfjrtS1\"RS\"R`4SgjruS1\"RS\"R`4Shjrv0Si\"R_Sj\"R_Sk\"R_Sl\"R_Sm\"R_Sn\"R_So\"R_Sp\"R_Sq\"R_Sr\"R_Ss\"R_St\"R_SH\"R_Su\"R_Sv\"R_Sw\"R_Sx\"R_0Sy\"R_Sz\"R_S{\"R_S|\"R_S}\"R_S~\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_E0S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_S\"R_E\"R\"R\"R\"R\"R\"R\"RS.Erx\\y\&4\zS'\S\"R`4r{/\3P\4P\5P\6P\=P\>P\8P\P\AP\BP\CP\EP\FP\GP\1P\HP\JP\LP\OP\WP\XP\YP\ZP\[P\\P\]P\^P\_P\`P\PP\QP\RP\SP\TP\UP\VP\aP\bP\cP\dP\eP\fP\gP\hP\iP\jP\kP\lP\mP\nP\oP\pP\qP\rP\sP\tP\uP\vP7Vs0sHoRT\"\{U5_M snr|\\y\{4\zS'"SS\!5r}gs snf)a$ Functions for C7N features when evaluating CEL expressions. These functions provide a mapping between C7N features and CEL. These functions are exposed by the global ``FUNCTIONS`` dictionary that is provided to the CEL evaluation run-time to provide necessary C7N features. The functions rely on implementation details in the ``CELFilter`` class. The API ======= C7N uses CEL and the :py:mod:`c7nlib` module as follows:: class CELFilter(c7n.filters.core.Filter): # See below for the long list of mixins. decls = { "resource": celpy.celtypes.MapType, "now": celpy.celtypes.TimestampType, "event": celpy.celtypes.MapType, } decls.update(celpy.c7nlib.DECLARATIONS) def __init__(self, expr: str) -> None: self.expr = expr def validate(self) -> None: cel_env = celpy.Environment( annotations=self.decls, runner_class=c7nlib.C7N_Interpreted_Runner) cel_ast = cel_env.compile(self.expr) self.pgm = cel_env.program(cel_ast, functions=celpy.c7nlib.FUNCTIONS) def process(self, resources: Iterable[celpy.celtypes.MapType]) -> Iterator[celpy.celtypes.MapType]: now = datetime.datetime.utcnow() for resource in resources: with C7NContext(filter=the_filter): cel_activation = { "resource": celpy.json_to_cel(resource), "now": celpy.celtypes.TimestampType(now), } if self.pgm.evaluate(cel_activation): yield resource This isn't the whole story, this is the starting point. This library of functions is bound into the program that's built from the AST. Several objects are required in activation for use by the CEL expression - ``resource``. The JSON document describing the cloud resource. - ``now.`` The current timestamp. - Optionally, ``event`` may have an AWS CloudWatch Event. The type: value Features ======================== The core value features of C7N require a number of CEL extensions. - :func:`glob(string, pattern)` uses Python fnmatch rules. This implements ``op: glob``. - :func:`difference(list, list)` creates intermediate sets and computes the difference as a boolean value. Any difference is True. This implements ``op: difference``. - :func:`intersect(list, list)` creats intermediate sets and computes the intersection as a boolean value. Any interection is True. This implements ``op: intersect``. - :func:`normalize(string)` supports normalized comparison between strings. In this case, it means lower cased and trimmed. This implements ``value_type: normalize``. - :func:`net.cidr_contains` checks to see if a given CIDR block contains a specific address. See https://www.openpolicyagent.org/docs/latest/policy-reference/#net. - :func:`net.cidr_size` extracts the prefix length of a parsed CIDR block. - :func:`version` uses ``disutils.version.LooseVersion`` to compare version strings. - :func:`resource_count` function. This is TBD. The type: value_from features ============================== This relies on ``value_from()`` and ``jmes_path_map()`` functions In context, it looks like this:: value_from("s3://c7n-resources/exemptions.json", "json") .jmes_path_map('exemptions.ec2.rehydration.["IamInstanceProfile.Arn"][].*[].*[]') .contains(resource["IamInstanceProfile"]["Arn"]) The ``value_from()`` function reads values from a given URI. - A full URI for an S3 bucket. - A full URI for a server that supports HTTPS GET requests. If a format is given, this is used, otherwise it's based on the suffix of the path. The ``jmes_path_map()`` function compiles and applies a JMESPath expression against each item in the collection to create a new collection. To an extent, this repeats functionality from the ``map()`` macro. Additional Functions ==================== A number of C7N subclasses of ``Filter`` provide additional features. There are at least 70-odd functions that are expressed or implied by these filters. Because the CEL expressions are always part of a ``CELFilter``, all of these additional C7N features need to be transformed into "mixins" that are implemented in two places. The function is part of the legacy subclass of ``Filter``, and the function is also part of ``CELFilter``. :: class InstanceImageMixin: # from :py:class:`InstanceImageBase` refactoring def get_instance_image(self): pass class RelatedResourceMixin: # from :py:class:`RelatedResourceFilter` mixin def get_related_ids(self): pass def get_related(self): pass class CredentialReportMixin: # from :py:class:`c7n.resources.iam.CredentialReport` filter. def get_credential_report(self): pass class ResourceKmsKeyAliasMixin: # from :py:class:`c7n.resources.kms.ResourceKmsKeyAlias` def get_matching_aliases(self, resource): pass class CrossAccountAccessMixin: # from :py:class:`c7n.filters.iamaccessfilter.CrossAccountAccessFilter` def get_accounts(self, resource): pass def get_vpcs(self, resource): pass def get_vpces(self, resource): pass def get_orgids(self, resource): pass # from :py:class:`c7n.resources.secretsmanager.CrossAccountAccessFilter` def get_resource_policy(self, resource): pass class SNSCrossAccountMixin: # from :py:class:`c7n.resources.sns.SNSCrossAccount` def get_endpoints(self, resource): pass def get_protocols(self, resource): pass class ImagesUnusedMixin: # from :py:class:`c7n.resources.ami.ImageUnusedFilter` def _pull_ec2_images(self, resource): pass def _pull_asg_images(self, resource): pass class SnapshotUnusedMixin: # from :py:class:`c7n.resources.ebs.SnapshotUnusedFilter` def _pull_asg_snapshots(self, resource): pass def _pull_ami_snapshots(self, resource): pass class IamRoleUsageMixin: # from :py:class:`c7n.resources.iam.IamRoleUsage` def service_role_usage(self, resource): pass def instance_profile_usage(self, resource): pass class SGUsageMixin: # from :py:class:`c7n.resources.vpc.SGUsage` def scan_groups(self, resource): pass class IsShieldProtectedMixin: # from :py:mod:`c7n.resources.shield` def get_type_protections(self, resource): pass class ShieldEnabledMixin: # from :py:class:`c7n.resources.account.ShieldEnabled` def account_shield_subscriptions(self, resource): pass class CELFilter( InstanceImageMixin, RelatedResourceMixin, CredentialReportMixin, ResourceKmsKeyAliasMixin, CrossAccountAccessMixin, SNSCrossAccountMixin, ImagesUnusedMixin, SnapshotUnusedMixin, IamRoleUsageMixin, SGUsageMixin, Filter, ): '''Container for functions used by c7nlib to expose data to CEL''' def __init__(self, data, manager) -> None: super().__init__(data, manager) assert data["type"].lower() == "cel" self.expr = data["expr"] self.parser = c7n.filters.offhours.ScheduleParser() def validate(self): pass # See above example def process(self, resources): pass # See above example This is not the complete list. See the ``tests/test_c7nlib.py`` for the ``celfilter_instance`` fixture which contains **all** of the functions required. C7N Context Object ================== A number of the functions require access to C7N features that are not simply part of the resource being filtered. There are two alternative ways to handle this dependency: - A global C7N context object that has the current ``CELFilter`` providing access to C7N internals. - A ``C7N`` argument to the functions that need C7N access. This would be provided in the activation context for CEL. To keep the library functions looking simple, the module global ``C7N`` is used. This avoids introducing a non-CEL parameter to the c7nlib functions. The ``C7N`` context object contains the following attributes: - ``filter``. The original C7N ``Filter`` object. This provides access to the resource manager. It can be used to manage supplemental queries using C7N caches and other resource management. This is set by the :py:class:`C7NContext` prior to CEL evaluation. Name Resolution =============== Note that names are **not** resolved via a lookup in the program object, an instance of the :py:class:`celpy.Runner` class. To keep these functions simple, the runner is not part of the run-time, and name resolution will appear to be "hard-wrired" among these functions. This is rarely an issue, since most of these functions are independent. The :func:`value_from` function relies on :func:`text_from` and :func:`parse_text`. Changing either of these functions with an override won't modify the behavior of :func:`value_from`. N)closing)version) TracebackType) AnyCallableDictIteratorListOptionalTypeUnioncast)InterpretedRunnerceltypes) json_to_cel) AnnotationContext Evaluatorct\rSrSrSrS\SS4SjrS\4SjrSSjr S \ \ \ S \ \ S \ \ SS4S jrS rg) C7NContexti-z Saves current C7N filter for use by functions in this module. This is essential for making C7N filter available to *some* of these functions. :: with C7NContext(filter): cel_prgm.evaluate(cel_activation) filterreturnNcXlgNr)selfrs 2/venv/lib/python3.13/site-packages/celpy/c7nlib.py__init__C7NContext.__init__9s cPURRSUR<S3$)Nz(filter=)) __class____name__rrs r__repr__C7NContext.__repr__<s$..))*(4;;/CCr cUqgr)C7Nr%s r __enter__C7NContext.__enter__?sr exc_type exc_value tracebackc[SS5qg)Nr)rr))rr,r-r.s r__exit__C7NContext.__exit__Cs<&r r)rN)r$ __module__ __qualname____firstlineno____doc__rrstrr&r*r r BaseExceptionrr0__static_attributes__r rrr-sl stD#D4 ./M*M*   r rsourcetargetrc^^[R"S5m[R"S5nUU4SjU5n[[R[ U55R U5$![ a gf=f)a^ The C7N shorthand ``tag:Name`` doesn't translate well to CEL. It extracts a single value from a sequence of objects with a ``{"Key": x, "Value": y}`` structure; specifically, the value for ``y`` when ``x == "Name"``. This function locate a particular "Key": target within a list of {"Key": x, "Value", y} items, returning the y value if one is found, null otherwise. In effect, the ``key()`` function:: resource["Tags"].key("Name")["Value"] is somewhat like:: resource["Tags"].filter(x, x["Key"] == "Name")[0] But the ``key()`` function doesn't raise an exception if the key is not found, instead it returns None. We might want to generalize this into a ``first()`` reduction macro. ``resource["Tags"].first(x, x["Key"] == "Name" ? x["Value"] : null, null)`` This macro returns the first non-null value or the default (which can be ``null``.) KeyValuec3># UHNn[[R[[RU5R T55T:XdMJUv MP g7fr)rr StringTypeMapTypeget).0itemkeyr;s r key..nsJ)D ##T(*:*:D%A%E%Ec%J K   s A A AN)rr@rrAnextrB StopIteration)r:r;valuematchesrEs ` @rrErETsm0   e $C    (E))G H$$d7m488?? s1A// A<;A<textpatterncV[R"[R"X55$)aACompare a string with a pattern. While ``"*.py".glob(some_string)`` seems logical because the pattern the more persistent object, this seems to cause confusion. We use ``some_string.glob("*.py")`` to express a regex-like rule. This parallels the CEL `.matches()` method. We also support ``glob(some_string, "*.py")``. )rBoolTypefnmatch)rLrMs rglobrQzs   W__T; <Ucg[U[R5(aURU5$[[ U]U5$NF) isinstance ipaddress _BaseNetwork supernet_ofsuperrh __contains__rotherr#s rrpIPv4Network.__contains__sA = eY33 4 4##E* *[$4U;;r c URUR:wa[USUS35eURUR:*=(a URUR:$![a [SUSU35ef=f)Nz and z are not of the same versionz*Unable to test subnet containment between )_version TypeErrornetwork_addressbroadcast_addressAttributeError)abs r _is_subnet_ofIPv4Network._is_subnet_ofs ::+#qcqc1M$NOO%%):)::C++q/B/BB" DQCuQCP s A#A&&Bc$URX5$)z3Return True if this network is a supernet of other.)r~)rrrs rrnIPv4Network.supernet_ofs%%e2 2r r9)r$r2r3r4rpsys version_infomajorminor staticmethodr~rnr8 __classcell__r#s@rrhrhsV< "s'7'7'='='B     3 3#(C"r rh.c[nSU;a[RnU"U5nU$![R[4a SnU$f=f)z Process cidr ranges. This is a union of types outside CEL. It appears to be Union[None, IPv4Network, ipaddress.IPv4Address] /N)rhrl ip_addressAddressValueError ValueError)rJklassvs r parse_cidrrsW$E %$$ %L H  ' ' 4  Hs(AArJch[U5nU(a [R"UR5$g)zCIDR prefixlen valueN)rrrd prefixlen)rJcidrs rsize_parse_cidrrs' e D //r c8^\rSrSrSrS\S\4U4SjjrSrU=r $)ComparableVersionizv The default LooseVersion will fail on comparing present strings, used in the value as shorthand for certain options. rrrcL>[[U] U5$![a gf=frj)ror__eq__rxrqs rrComparableVersion.__eq__s- *D8? ?  s  ##r9) r$r2r3r4r5objectrVrr8rrs@rrrs  Ftr rcH[[R[U55$r)rrr>rrJs rrrs  1% 8 99r cH[[R[U55$rrrr>rVrs rpresentrs U ,,r cR[[R[U5(+5$rrrs rabsentrs DK 00r urlc[RRUSS0S9n[[RR U55nUR 5R S5S:XaF[R"UR5[RS-5RS5nOUR5RS5nSSS5 [R"W5$!,(df  N$=f) zM Read raw text from a URL. This can be expanded to accept S3 or other URL's. zAccept-Encodinggzip)headerszContent-Encoding utf8zutf-8N)urllibrequestRequestrurlopeninforBzlib decompressread MAX_WBITSdecoderr@)rreqresponseraw_datas r text_fromrs .. /@&.I JC '', - ==?  1 2f <x}}8KLSSH }}--g6H .   x (( . -s B C00 C> source_textformatc tUS:Xa[[R"U55$US:XaW[R"UR 5Vs/sH'n[R "UR55PM) sn5$US;aR[R"UR 5Vs/sH"n[[R"U55PM$ sn5$US:XaX[R"[R"[R"U55Vs/sHn[U5PM sn5$US:XaX[R"[R"[R"U55Vs/sHn[U5PM sn5$[SU<35es snfs snfs snfs snf)z& Parse raw text using a given format. jsontxt)ldjsonndjsonjsonlcsvcsv2dictUnsupported format: )rrloadsrListType splitlinesr@rstriprreaderioStringIO DictReaderr)rrsrows r parse_textrsl 4::k233 5  6A6L6L6N O6NX  ,6N O   0 0  1<1G1G1I J1IA[A '1I J   5  ),BKK 4L)M N)M#[ )M N   :   ), K8P)Q R)Q#[ )Q R  /z:;; P K O Ss.F&+)F+F0;F5c SnU(d:[RRU5up4[R"USS5nX;a[ SU<35e[ [R[U55n[XQ5$)aN Read values from a URL. First, do :func:`text_from` to read the source. Then, do :func:`parse_text` to parse the source, if needed. This makes the format optional, and deduces it from the URL's path information. C7N will generally replace this with a function that leverages a more sophisticated :class:`c7n.resolver.ValuesFrom`. )rrrrrrrNr) ospathsplitextrr@rrrr)rrsupported_formats_suffixrs r value_fromr/szX GG$$S) $$VABZ0 &/z:;; H''38H h ''r source_data path_sourcecb[R"U5n[URU55$)z3 Apply JMESPath to an object read from from a URL. )jmespathcompilersearch)rr expressions r jmes_pathrOs* !!+.J z((5 66r c [R"U5n[R"UVs/sHn[ UR U55PM sn5$s snf)zc Apply JMESPath to a each object read from from a URL. This is for ndjson, nljson and jsonl files. )rrrrrr)rrrrs r jmes_path_maprYsL!!+.J   8CD Z&&s+ , D Ds$Ac [X5nUcg[[RU5R SS5up4UR 5R SS5upV[R"[R"S5[R"U5[R"S5[R"U5[R"S5[R"U505$![a gf=f)a1 Examines a list of {"Key": text, "Value": text} mappings looking for the given Key value. Parses a ``message:action@action_date`` value into a mapping {"message": message, "action": action, "action_date": action_date} If no Key or no Value or the Value isn't the right structure, the result is a null. N:r@messageaction action_date) rErrr@rsplitr`splitrrA TimestampType)r:r;rJmsgtgtraction_date_strs r marked_keyrfs  E }++U3::3B"%))+"3"3C";       *H,?,?,D    )8+>+>v+F    .0F0F0W   sAC33 D?Dresourcec[RRU5nU(a USnUSnOSnSn[[R R U5US.5$)av Reach into C7N to get the image details for this EC2 or ASG resource. Minimally, the creation date is transformed into a CEL timestamp. We may want to slightly generalize this to json_to_cell() the entire Image object. The following may be usable, but it seems too complex: :: C7N.filter.prefetch_instance_images(C7N.policy.resources) image = C7N.filter.get_instance_image(resource["ImageId"]) return json_to_cel(image) .. todo:: Refactor C7N Provide the :py:class:`InstanceImageBase` mixin in a :py:class:`CELFilter` class. We want to have the image details in the new :py:class:`CELFilter` instance. CreationDateNamez2000-01-01T01:01:01.000Z)rr)r)rget_instance_imagerdateutilparserisoparse)rimage creation_date image_names rrrs\0 JJ ) )( 3E n- 6] 2  !11-@*U r rc [RRR5R S5nUR USUSUSUSUSUSUSS 9S n[ U5$) a Reach into C7N and make a statistics request using the current C7N filter object. The ``request`` parameter is the request object that is passed through to AWS via the current C7N filter's manager. The request is a Mapping with the following keys and values: :: get_raw_metrics({ "Namespace": "AWS/EC2", "MetricName": "CPUUtilization", "Dimensions": {"Name": "InstanceId", "Value": resource.InstanceId}, "Statistics": ["Average"], "StartTime": now - duration("4d"), "EndTime": now, "Period": duration("86400s") }) The request is passed through to AWS more-or-less directly. The result is a CEL list of values for then requested statistic. A ``.map()`` macro can be used to compute additional details. An ``.exists()`` macro can filter the data to look for actionable values. We would prefer to refactor C7N and implement this with code something like this: :: C7N.filter.prepare_query(C7N.policy.resources) data = C7N.filter.get_resource_statistics(client, resource) return json_to_cel(data) .. todo:: Refactor C7N Provide a :py:class:`MetricsAccess` mixin in a :py:class:`CELFilter` class. We want to have the metrics processing in the new :py:class:`CELFilter` instance. cloudwatch Namespace MetricName Statistics StartTimeEndTimePeriod Dimensions)rrrrrrr Datapoints)r)rmanagersession_factoryclientget_metric_statisticsrrrdatas rget_raw_metricsrsLZZ   / / 1 8 8 FF  ' '+&<(<(+& "x <( (  D t r cL[RRR5Rn[RRR nX R U5S./n[[[R[UUSUUS/USUSUSS.555n[[[[RU5Vs/sH<n[[[[R4U5R US5PM> sn5$s snf)a Reach into C7N and make a statistics request using the current C7N filter. This builds a request object that is passed through to AWS via the :func:`get_raw_metrics` function. The ``request`` parameter is a Mapping with the following keys and values: :: resource.get_metrics({"MetricName": "CPUUtilization", "Statistic": "Average", "StartTime": now - duration("4d"), "EndTime": now, "Period": duration("86400s")} ).exists(m, m < 30) The namespace is derived from the ``C7N.policy``. The dimensions are derived from the ``C7N.fiter.model``. .. todo:: Refactor C7N Provide a :py:class:`MetricsAccess` mixin in a :py:class:`CELFilter` class. We want to have the metrics processing in the new :py:class:`CELFilter` instance. )rr>r Statisticrrr)rrrrrrr)r)rr get_model dimension resource_typerBrrrrArr r>rr6)rrr  namespace dimensions raw_metricsrDs r get_metricsrs4 "",,.88I ""00I$||I/FGHJ!$x'7'7"!,/$";/0 -y)h'  : # K T(..1;? ? c8>>)*D 1 5 5gk6J K?   sAD!c[RRR5R SSS9nUR US9Sn[ U5$)a Reach into C7N and make a health-events request using the current C7N filter. The ``request`` parameter is the filter object that is passed through to AWS via the current C7N filter's manager. The request is a List of AWS health events. :: get_raw_health_events({ "services": ["ELASTICFILESYSTEM"], "regions": ["us-east-1", "global"], "eventStatusCodes": ['open', 'upcoming'], }) health us-east-1 region_namerevents)r)rrrrdescribe_eventsrrs rget_raw_health_eventsrsTZZ   / / 1 8 8k9+F  ! ! ! 1( ;D t r statusesc U(d,[R"S5[R"S5/nSSSSSS.n[RRnUR UR SUR5RR55n[[[R[U/URRS /US .555nU$) z Reach into C7N and make a health-event request using the current C7N filter. This builds a request object that is passed through to AWS via the :func:`get_raw_health_events` function. .. todo:: Handle optional list of event types. openupcomingELASTICLOADBALANCINGEBSELASTICFILESYSTEMELASTICMAPREDUCE)zapp-elbebsefselbemrrglobal)servicesregionseventStatusCodes)rr@r)rrrBrr serviceupperrrrArconfigregion)rrphd_svc_name_mapmr* raw_eventss rget_health_eventsr1$s ''/1D1DZ1PQ)"%!  A""166*#5q{{}7L7L7R7R7TUG&tH,<,>xH ' ((r cV[RRU5n[U5$)zS Reach into C7N and make a get_related_vpc() request using the current C7N filter. )r)rget_related_vpcrrvpcs rrErE|s# ** $ $X .C s r cV[RRU5n[U5$)zX Reach into C7N and make a get_related_kms_keys() request using the current C7N filter. )r)rget_related_kms_keysrrFs rrIrIs# ** ) )( 3C s r security_group_idcX[RRU/5n[U5$)a Reach into C7N and make a get_related() request using the current C7N filter to get the security group. .. todo:: Refactor C7N Provide the :py:class:`RelatedResourceFilter` mixin in a :py:class:`CELFilter` class. We want to have the related id's details in the new :py:class:`CELFilter` instance. See :py:class:`VpcSecurityGroupFilter` subclass of :py:class:`RelatedResourceFilter`. r)r get_relatedr)rJr7s rsecurity_grouprNs'jj,,.?-@AO  ''r subnet_idcX[RRU/5n[U5$)a Reach into C7N and make a get_related() request using the current C7N filter to get the subnet. .. todo:: Refactor C7N Provide the :py:class:`RelatedResourceFilter` mixin in a :py:class:`CELFilter` class. We want to have the related id's details in the new :py:class:`CELFilter` instance. See :py:class:`VpcSubnetFilter` subclass of :py:class:`RelatedResourceFilter`. rL)rOr:s rsubnetrQs%jj$$i[1G w r c [RRR5R S5nUR 5R SS5n[RRR5n0nUH'nURUS/5RU5 M) UR UR5U;a7U[[UR UR55n[U5$[/5$)a! Reach into C7N and locate the flow logs using the current C7N filter. .. todo:: Refactor C7N Provide a separate function to get the flow logs, separate from the the filter processing. .. todo:: Refactor :func:`c7nlib.flow_logs` -- it exposes too much implementation detail. ec2FlowLogsr9 ResourceId)r)rrrrdescribe_flow_logsrBr  setdefaultappendidrr6r)rrlogsr/ resource_mapflflogss r flow_logsr^sZZ   / / 1 8 8 ?F  $ $ & * *:r :D $$&A46L< 0"5<+> ??r cR[[RRU55$)a Reach into C7N and make a get_related() request using the current C7N filter to get the IAM-role credential details. See :py:class:`c7n.resources.iam.CredentialReport` filter. The `get_credential_report()` function does what we need. .. todo:: Refactor C7N Refactor the :py:class:`c7n.resources.iam.CredentialReport` filter into a ``CredentialReportMixin`` mixin to the :py:class:`CELFilter` class. The ``get_credential_report()`` function does what we need. )rr)rget_credential_reportrs r credentialsrhs szz77A BBr cP[[RR55$)a Reach into C7N and make a get_matching_aliases() request using the current C7N filter to get the alias. See :py:class:`c7n.resources.kms.ResourceKmsKeyAlias`. The `get_matching_aliases()` function does what we need. .. todo:: Refactor C7N Refactor the :py:class:`c7n.resources.kms.ResourceKmsKeyAlias` filter into a ``ResourceKmsKeyAliasMixin`` mixin to the :py:class:`CELFilter` class. The ``get_matching_aliases()`` dfunction does what we need. )rr)rget_matching_aliases)r_s r kms_aliasrks szz668 99r key_idcX[RRU/5n[U5$)a+ Reach into C7N and make a ``get_related()`` request using the current C7N filter to get the key. We're looking for the c7n.resources.kms.Key resource manager to get the related key. .. todo:: Refactor C7N Provide the :py:class:`RelatedResourceFilter` mixin in a :py:class:`CELFilter` class. rL)rlrEs rkms_keyrn s% ** & *C s r tag_valuec ([RRRU5nUR SS5nUR 5VVVs0sH"up4UUVs/sHoUSUSUS.PM sn_M$ nnnn[ U5$s snfs snnnf)a Reach into C7N and use the the :py:class:`c7n.filters.offhours.ScheduleParser` class to examine the tag's value, the current time, and return a True/False. This parser is the `parser` value of the :py:class:`c7n.filters.offhours.Time` filter class. Using the filter's `parser.parse(value)` provides needed structure. The `filter.parser.parse(value)` will transform text of the Tag value into a dictionary. This is further transformed to something we can use in CEL. From this :: off=[(M-F,21),(U,18)];on=[(M-F,6),(U,10)];tz=pt C7N ScheduleParser produces this :: { off: [ { days: [1, 2, 3, 4, 5], hour: 21 }, { days: [0], hour: 18 } ], on: [ { days: [1, 2, 3, 4, 5], hour: 6 }, { days: [0], hour: 10 } ], tz: "pt" } For CEL, we need this :: { off: [ { days: [1, 2, 3, 4, 5], hour: 21, tz: "pt" }, { days: [0], hour: 18, tz: "pt" } ], on: [ { days: [1, 2, 3, 4, 5], hour: 6, tz: "pt" }, { days: [0], hour: 10, tz: "pt" } ], } This lets a CEL expression use :: key("maid_offhours").resource_schedule().off.exists(s, now.getDayOfWeek(s.tz) in s.days && now.getHour(s.tz) == s.hour) tzetdayshour)rsrtrq)r)rrparsepopitemsr)ro c7n_sched_docrqstate time_listtime cel_sched_docs rresource_scheduler}shJJ%%++I6M   4 &B !. 3 3 5 !6 E OX OXt&\4.parse_attribute_value`s/ 99;;q6M &[ '\r elbv2LoadBalancerArn)rc3D># UHnUST"US54v M g7f)r=r>Nr9)rCrDrs rrF$get_load_balancer..os+ -%[/W > ?-s  Attributes) r6r rrVr)rrrrrprintrr)rrrrs @rget_load_balancerrYssD#~)>ZZ   / / 1 8 8 AF66 !2375G 'N    -   r cB[RRR5R SSS9n[RR U[RRR 55nUVs/sHo3SPM nn[U5$s snf)z Depends on the :py:meth:`c7n.resources.shield.IsShieldProtected.process` method. This needs to be refactored and renamed to avoid collisions with other ``process()`` variants. Applies to most resource types. shieldrr ResourceArn)r)rrrrget_type_protectionsr r)rr protectionspprotected_resourcess rshield_protectionrvsZZ   / / 1 8 8{ 8 [F**11&#**:L:L:V:V:XYK5@A[]+[A * ++BsBcV[RRU5n[U5$)z Depends on :py:meth:`c7n.resources.account.ShieldEnabled.process` method. This needs to be refactored and renamed to avoid collisions with other ``process()`` variants. Applies to account resources only. )r)raccount_shield_subscriptionsr)r subscriptionss rshield_subscriptionrs#JJ;;HEM } %%r c[RRRS5R 5nUVs0sH o"SUS_M nn[ U5$s snf)z Depends on :py:meth:`c7n.resources.cloudfront.IsWafEnabled.process` method. This needs to be refactored and renamed to avoid collisions with other ``process()`` variants. wafrWebACLId)r)rrrrr)rwafswwaf_name_id_maps rweb_aclsrsV ::   2 25 9 C C ED9=>Ay!J-/O>  ''?sArQrYr\rarrrfrrrrrrrErrrr3rNrQr^rGrdrhrkrnr}rr6r9r<r?rBrErIrrrrrrrrrrrrrrr)rrrrrrr DECLARATIONS FUNCTIONScL\rSrSrSrS S\S\\S\R4Sjjr Sr g) C7N_Interpreted_RunneriaZ Extends the Evaluation to introduce the C7N CELFilter instance into the exvaluation. The variable is global to allow the functions to have the simple-looking argument values that CEL expects. This allows a function in this module to reach outside CEL for access to C7N's caches. .. todo: Refactor to be a mixin to the Runner class hierarchy. Ncontextrrc[URURU5URS9n[ US9 UR 5nSSS5 U$!,(df  W$=f)N)ast activation functionsr)rrnew_activationrrevaluate)rrrerJs rrC7N_Interpreted_Runner.evaluate$sU **73nn  v &JJLE' ' & s A A"r9r) r$r2r3r4r5rr rrr>rr8r9r rrrs.#(..r rr)~r5rrPrrlrloggingos.pathrrurllib.requestrr contextlibr distutilsr version_libtypesrtypingrrrr r r r r rrrcelpyrr celpy.adapterrcelpy.evaluationrrr getLoggerr$loggerrr)rr@r>rErOrQrYr\rardrfrh IPv4AddressCIDR CIDR_Classrr LooseVersionrrrrrrrrrrArrrrr1r3r6r9r<r?rBrErIrNrQr^rGrdrhrkrnr}rrrrrrrrrrrrrrrrrrrrrrr FunctionTyperr6__annotations__ ExtFunctionrr)fs0rrsT BF     ,-%;;   8 $H <#!!#8+>+>#8>>#L =x"" =X-@-@ =XEVEV =;X&&;x/@/@;XEVEV;;H%%;h.?.?;HDUDU;7h))7h.A.A72H--2(2B2B23)''3@ T; 5 5 56 4 $hsI4I4I/I&JJ K  &8..HX=M=M4N  00 :   : ^^: -8&&-HNN-1(%%18>>1 )8&& )HNN ) <$$<.6.A.A< ^^<:GK(   (&.x/B/B&C( ^^(@77.6.A.A7 ^^7 "" 191D1D      '/':': ^^<#H$$##L1X--1(..1h..)1)9)9. ^^.b8#3#3.48""4/0^^B $h.. $HNN $(h..(HNN( ("2"2  %x'7'7%X^^%x//X^^)8+;+;))h..HNN8#3#3(h&6&6(HNN("  hnn  (..  ((hnn2  HNN  @X((@h.A.A@*C(**Cx~~C":hnn:(..:" HNN  <&>><& ^^<&~ 28++ 2 2 .x'' .X^^ . /(( /hnn / 0)) 0x~~ 03H,,3(..33H,,3(..3 X-- 8>>  9("2"299H,<,<(.."h.>.>HNN$'8&&'x/B/B'x~~'< HNN  x~~  # #88>>8800?<'@ 5 5A<'B--C<'D#H$9$9E<'Fx,,G<'HH11I<'J%%K<'L&&M<'N(''O<'PX**Q<'RX**S<'Th++U<'V800W<'X$X%:%:Y<'Z&x'<'<[<'\&&]<'^(''_<'`X**a<'b%h&;&;c<'d..e<'fX22g<'h%11,,++!..!..#00%%u<' d3 ?#<|sHNN*+  ?%% 4[ !>B.C>%s)o