CURRENT PATH:
/
opt
/
gsutil
/
gslib
/
commands
/
__pycache__
/
[ ⬅ KEMBALI ]
|
[ HOME ]
Upload File:
Upload Ke Sini
Dir Baru
File Baru
Editing:
kms.cpython-39.pyc
a +(Wg�R � @ s� d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlZddlZddlm Z ddl m Z dd l m Z dd l mZ dd lmZ dd lmZ dd lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddl m Z ddl m Z ddl!m"Z" ddl#m$Z$ ddl%m&Z& ddl'm(Z( ddl)m*Z* ddl)m+Z+ dZ,dZ-d Z.e,e-�/d � e.�/d � d Z0d Z1d Z2d Z3d!e1e2 e3 Z4ee0e4�Z5ee,e1�Z6ee-e2�Z7ee.e3�Z8e+d"d#ge*d$�e*d%�d&�d'�Z9e+d"d#gd(e*d$�id'�Z:G d)d*� d*e�Z;dS )+z/This module provides the kms command to gsutil.� )�absolute_import)�print_function)�division)�unicode_literalsN)�metrics)�AccessDeniedException)�ServiceException)�Command)�CommandArgument)� ApiSelector)�CommandException)�NO_URLS_MATCHED_TARGET)�CreateHelpText)�KmsApi)�PopulateProjectId)�Binding)�storage_v1_messages)� text_util)�NO_MAX)� ValidateCMEK)�Retry)�GcloudStorageFlag)�GcloudStorageMapz4 gsutil kms authorize [-p <proj_id>] -k <kms_key> zJ gsutil kms encryption [(-d|[-k <kms_key>])] [-w] gs://<bucket_name>... z, gsutil kms serviceaccount [-p <proj_id>] � a� <B>AUTHORIZE</B> The authorize sub-command checks that the default (or supplied) project has a Cloud Storage service agent created for it, and if not, it creates one. It then adds appropriate encrypt/decrypt permissions to Cloud KMS resources such that the service agent can write and read Cloud KMS-encrypted objects in buckets associated with the service agent's project. <B>AUTHORIZE EXAMPLES</B> Authorize "my-project" to use a Cloud KMS key: gsutil kms authorize -p my-project \ -k projects/key-project/locations/us-east1/keyRings/key-ring/cryptoKeys/my-key <B>AUTHORIZE OPTIONS</B> -k <key> The path to the KMS key to use. The path has the following form: ``projects/[project-id]/locations/[location]/keyRings/[key-ring]/cryptoKeys/[my-key]`` -p <project> The ID or number of the project being authorized to use the Cloud KMS key. If this flag is not included, your default project is authorized. a� <B>ENCRYPTION</B> The encryption sub-command is used to set, display, or clear a bucket's default KMS key, which is used to encrypt newly-written objects if no other key is specified. <B>ENCRYPTION EXAMPLES</B> Set the default KMS key for my-bucket: gsutil kms encryption \ -k projects/key-project/locations/us-east1/keyRings/key-ring/cryptoKeys/my-key \ gs://my-bucket Show the default KMS key for my-bucket, if one is set: gsutil kms encryption gs://my-bucket Clear the default KMS key so newly-written objects are not encrypted using it: gsutil kms encryption -d gs://my-bucket Once you clear the default KMS key, newly-written objects are encrypted with Google-managed encryption keys by default. <B>ENCRYPTION OPTIONS</B> -k <key> Set the default KMS key for my-bucket using the full path to the key, which has the following form: ``projects/[project-id]/locations/[location]/keyRings/[key-ring]/cryptoKeys/[my-key]`` -w (used with -k key) Display a warning rather than failing if gsutil is unable to verify that the specified key contains the correct IAM bindings for encryption/decryption. This is useful for users that do not have getIamPolicy permission but know that the key has the correct IAM policy for encryption in the user's project. -d Clear the default KMS key. a" <B>SERVICEACCOUNT</B> The serviceaccount sub-command displays the Cloud Storage service agent that is used to perform Cloud KMS operations against your default project (or a supplied project). <B>SERVICEACCOUNT EXAMPLES</B> Show the service account for my-project: gsutil kms serviceaccount -p my-project <B>SERVICEACCOUNT OPTIONS</B> -p <project> The ID or number of the project whose Cloud Storage service agent is being requested. If this flag is not included, your default project is used. aS The kms command is used to configure Google Cloud Storage and Cloud KMS resources to support encryption of Cloud Storage objects with `Cloud KMS keys <https://cloud.google.com/storage/docs/encryption/customer-managed-keys>`_. The kms command has three sub-commands that deal with configuring Cloud Storage's integration with Cloud KMS: ``authorize``, ``encryption``, and ``serviceaccount``. Before using this command, read the `prerequisites <https://cloud.google.com/storage/docs/encryption/using-customer-managed-keys#prereqs>`_. for using Cloud KMS with Cloud Storage. �storagez service-agentz --projectz--authorize-cmek)�-p�-k��gcloud_command�flag_mapr c s� e Zd ZdZejdededdddej gej g e � d�gg d�d� Z ej dg dd eeeed�d �Zeeed �i d �Z� fd d�Zdd� Zeeddd�dd� �Zdd� Z dd� Z dd� Z dd � Z d d � Z d d � Z!d!d"� Z"d#d"� Z"� Z#S )$� KmsCommandz!Implements of gsutil kms command.�kms� zdk:p:wF�� authorize� encryption�serviceaccount) �usage_synopsis�min_args�max_args�supported_sub_args� file_url_ok�provider_url_ok�urls_start_arg�gs_api_support�gs_default_api�argparse_arguments� command_helpz Configure Cloud KMS encryption)� help_name�help_name_aliases� help_type�help_one_line_summary� help_text�subcommand_help_text)r$ r& r c s� | j d dkr�tdtddgtd�td�td�d�d �ii d �}d | j v sRd | j v rj|jd jd g7 _q�|jd jg d �7 _ntj}t� �|�S )Nr r% r �bucketsz --clear-default-encryption-keyz--default-encryption-key� )�-dr �-wr r: r �update)�describezi--format=value[separator=": "](name, encryption.defaultKmsKeyName.yesno(no="No default encryption key."))z--raw)�argsr r r r �gcloud_storage_map�super�get_gcloud_storage_args)�selfr? �� __class__� �!/opt/gsutil/gslib/commands/kms.pyrA � s( ��� � � z"KmsCommand.get_gcloud_storage_argsc C s� | � � d| _d | _d| _| jrx| jD ]P\}}|dkr>|| _q&|dkrX|| _t| j� q&|dkrhd| _q&|dkr&d| _q&| jr�| jdks�| js�td� t � d ����| js�t d �| _d S ) NFr r r: Tr; r% r zoThe "-w" option should only be specified for the "encryption" subcommand and must be used with the "-k" option.) �CheckArguments� clear_kms_key�kms_key� warn_on_key_authorize_failure�sub_opts� project_idr �subcommand_namer �join�textwrap�wrapr )rB rM �o�arE rE rF �_GatherSubOptions s6 ����z KmsCommand._GatherSubOptions� )�tries� timeout_secsc C s� | j j|dd�j}t| jd�}| j�d|� z^|�|�}| j�d|� d}tdd| gd �}||jvr�|j� |� |� ||� d }||fW S t y� | j r�t �d �t�d ��� |df Y S � Y n0 d S )a� Authorizes a project's service account to be used with a KMS key. Authorizes the Cloud Storage-owned service account for project_id to be used with kms_key. Args: project_id: (str) Project id string (not number). kms_key: (str) Fully qualified resource name for the KMS key. Returns: (str, bool) A 2-tuple consisting of: 1) The email address for the service account associated with the project, which is authorized to encrypt/decrypt with the specified key. 2) A bool value - True if we had to grant the service account permission to encrypt/decrypt with the given key; False if the required permission was already present. �gs��provider)�loggerzGetting IAM policy for %szCurrent policy is %sFz*roles/cloudkms.cryptoKeyEncrypterDecrypterzserviceAccount:%s)�role�membersTr a Warning: Check that your Cloud Platform project's service account has the "cloudkms.cryptoKeyEncrypterDecrypter" role for the specified key. Without this role, you may not be able to encrypt or decrypt objects using the key which will prevent you from uploading or downloading objects.N)� gsutil_api�GetProjectServiceAccount� email_addressr rZ �debugZGetKeyIamPolicyr �bindings�appendZSetKeyIamPolicyr rJ r � print_to_fdrN rO rP )rB rL rI �service_accountZkms_api�policyZadded_new_binding�bindingrE rE rF �_AuthorizeProject s4 � � �� z KmsCommand._AuthorizeProjectc C sj | � d� | js$td| j| jf ��| �| j| j�\}}|rRtd| j| jf � ntd| j| jf � dS )Nr$ z,%s %s requires a key to be specified with -kz9Authorized project %s to encrypt and decrypt with key: %szFProject %s was already authorized to encrypt and decrypt with key: %s.r )rS rI r � command_namerM rg rL �print)rB �_�newly_authorizedrE rE rF � _AuthorizeS s � � �zKmsCommand._Authorizec C s@ t j�� |_tdt|��d� � | jj|j |dg|j d� dS )z�Clears the defaultKmsKeyName on a Cloud Storage bucket. Args: bucket_metadata: (apitools_messages.Bucket) Metadata for the given bucket. bucket_url: (gslib.storage_url.StorageUrl) StorageUrl of the given bucket. z)Clearing default encryption key for %s...�/r% ��fieldsrY N) �apitools_messages�Bucket�EncryptionValuer% ri �str�rstripr] � PatchBucket� bucket_name�scheme)rB �bucket_metadata� bucket_urlrE rE rF �_EncryptionClearKeyb s � �z KmsCommand._EncryptionClearKeyc C s� |j }z|| d }}W n, tyD | �|| j�\}}|||< Y n0 |r^t�d|| jf � tjj| jd�|_ t dt |�� d� � | j j|j|dg|jd� dS ) aa Sets defaultKmsKeyName on a Cloud Storage bucket. Args: bucket_metadata: (apitools_messages.Bucket) Metadata for the given bucket. bucket_url: (gslib.storage_url.StorageUrl) StorageUrl of the given bucket. svc_acct_for_project_num: (Dict[int, str]) Mapping of project numbers to their corresponding service account. Fz,Authorized service account %s to use key: %s)�defaultKmsKeyNamez(Setting default KMS key for bucket %s...rm r% rn N)� projectNumber�KeyErrorrg rI r rc rp rq rr r% ri rs rt r] ru rv rw )rB rx ry �svc_acct_for_project_numZbucket_project_numberrd rk rE rE rF �_EncryptionSetKeyq s0 � ��� � �z KmsCommand._EncryptionSetKeyc st � � d� i �� �fdd�}d}� j}|s2� �� |D ]$}� �|�}|D ]}d}||� qHq6|spttt|� ��dS )Nr% c s� | j }|jdkr td� j ��� jj|jddg|jd�}� jrN� �||� dS � j rf� � ||�� dS t |�� d�}|j r�|j jr�td||j jf � n td | � dS ) z6Set, clear, or get the defaultKmsKeyName for a bucket.rW z7The %s command can only be used with gs:// bucket URLs.r% r| rn r rm z!Default encryption key for %s: %sz'Bucket %s has no default encryption key)� storage_urlrw r rh r] � GetBucketrv rH rz rI r rs rt r% r{ ri )�blrry rx �bucket_url_string�rB r~ rE rF �_EncryptionForBucket� s: ��� �� � z4KmsCommand._Encryption.<locals>._EncryptionForBucketFTr )rS r> �$RaiseWrongNumberOfArgumentsException�GetBucketUrlIterFromArgr r �list)rB r� � some_matched�url_args�url_str� bucket_iter�bucket_listing_refrE r� rF � _Encryption� s % zKmsCommand._Encryptionc C sz | � � | jsdg| _| jr:| jD ]\}}|dkr"|| _q"| jsJtd �| _| j�d| j� | jj| jdd�j }t |� dS )Nzgs://r z'Checking service account for project %srW rX r ) rG r> rK rL r rZ r` r] r^ r_ ri )rB rQ rR rd rE rE rF �_ServiceAccount� s" ��zKmsCommand._ServiceAccountc C sT z2t � | j| jj�\| _| _tj| jd� || �W S t jyN | �� Y n0 d S )N)rK ) �getoptr> � command_specr* rK r �LogCommandParams� GetoptError� RaiseInvalidArgumentException)rB �funcrE rE rF �_RunSubCommand� s � zKmsCommand._RunSubCommandc C s2 | j jdd�tjkr.td�t�d| j ����dS )�(Command entry point for the kms command.rW rX r z�The "%s" command can only be used with the GCS JSON API. If you have only supplied hmac credentials in your boto file, please instead supply a credential type that can be used with the JSON API.N) r] �GetApiSelectorr �JSONr rN rO rP rh )rB rE rE rF � RunCommand� s ���zKmsCommand.RunCommandc C s� | j jdd�tjkr.td�t�d| j ����t j t j t j d�}| j �d�| _| j|v rxtj| jgd� | �|| j �S td| j| jf ��d S ) r� rW rX r z�The "%s" command can only be used with the GCS JSON API, which cannot use HMAC credentials. Please supply a credential type that is compatible with the JSON API (e.g. OAuth2) in your boto config file.r# r )� subcommandsz+Invalid subcommand "%s" for the %s command.N)r] r� r r� r rN rO rP rh r rl r� r� r> �poprM r r� r� )rB Zmethod_for_subcommandrE rE rF r� � s& ���� �)$�__name__� __module__� __qualname__�__doc__r �CreateCommandSpec� _SYNOPSISr r r� r � MakeNCloudBucketURLsArgumentr� �HelpSpec�_DETAILED_HELP_TEXT�_authorize_help_text�_encryption_help_text�_serviceaccount_help_text� help_specr �_AUTHORIZE_COMMAND�_SERVICEACCOUNT_COMMANDr? rA rS r r rg rl rz r r� r� r� r� � __classcell__rE rE rC rF r � s\ ���� �� 4!; r )<r� � __future__r r r r r� rO �gslibr �gslib.cloud_apir r � gslib.commandr �gslib.command_argumentr �gslib.cs_api_mapr �gslib.exceptionr r �gslib.help_providerr Z gslib.kms_apir �gslib.project_idr Z3gslib.third_party.kms_apitools.cloudkms_v1_messagesr �"gslib.third_party.storage_apitoolsr rp Z gslib.utilsr �gslib.utils.constantsr � gslib.utils.encryption_helperr �gslib.utils.retry_utilr �gslib.utils.shim_utilr r Z_AUTHORIZE_SYNOPSISZ_ENCRYPTION_SYNOPSISZ_SERVICEACCOUNT_SYNOPSIS�lstripr� Z_AUTHORIZE_DESCRIPTIONZ_ENCRYPTION_DESCRIPTIONZ_SERVICEACCOUNT_DESCRIPTION� _DESCRIPTIONr� r� r� r� r� r� r rE rE rE rF �<module> s~ ��+ �� �������
SIMPAN
[ BATAL ]