@@ -1118,9 +1118,9 @@ def deploy_metric_filters_and_alarms(region: str, accounts: list, resource_prope
1118
1118
DRY_RUN_DATA [f"{ filter_name } _CloudWatch_Alarm" ] = "DRY_RUN: Deploy CloudWatch metric alarm"
1119
1119
else :
1120
1120
LOGGER .info (f"DRY_RUN: Filter deploy parameter is 'false'; Skip { filter_name } CloudWatch metric filter deployment" )
1121
- DRY_RUN_DATA [f" { filter_name } _CloudWatch" ] = (
1122
- "DRY_RUN: Filter deploy parameter is 'false'; Skip CloudWatch metric filter deployment "
1123
- )
1121
+ DRY_RUN_DATA [
1122
+ f" { filter_name } _CloudWatch "
1123
+ ] = "DRY_RUN: Filter deploy parameter is 'false'; Skip CloudWatch metric filter deployment"
1124
1124
1125
1125
1126
1126
def deploy_central_cloudwatch_observability (event : dict ) -> None : # noqa: CCR001, CFQ001, C901
@@ -1216,9 +1216,9 @@ def deploy_central_cloudwatch_observability(event: dict) -> None: # noqa: CCR00
1216
1216
if DRY_RUN is False :
1217
1217
xacct_role = iam .create_role (cloudwatch .CROSS_ACCOUNT_ROLE_NAME , cloudwatch .CROSS_ACCOUNT_TRUST_POLICY , SOLUTION_NAME )
1218
1218
xacct_role_arn = xacct_role ["Role" ]["Arn" ]
1219
- LIVE_RUN_DATA [f"OAMCrossAccountRoleCreate_ { bedrock_account } " ] = (
1220
- f"Created { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } "
1221
- )
1219
+ LIVE_RUN_DATA [
1220
+ f"OAMCrossAccountRoleCreate_ { bedrock_account } "
1221
+ ] = f"Created { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } "
1222
1222
CFN_RESPONSE_DATA ["deployment_info" ]["action_count" ] += 1
1223
1223
CFN_RESPONSE_DATA ["deployment_info" ]["resources_deployed" ] += 1
1224
1224
LOGGER .info (f"Created { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } IAM role" )
@@ -1234,9 +1234,9 @@ def deploy_central_cloudwatch_observability(event: dict) -> None: # noqa: CCR00
1234
1234
cloudwatch .CROSS_ACCOUNT_ROLE_NAME ,
1235
1235
)
1236
1236
else :
1237
- DRY_RUN_DATA [f"OAMCrossAccountRoleCreate_ { bedrock_account } " ] = (
1238
- f"DRY_RUN: Create { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } "
1239
- )
1237
+ DRY_RUN_DATA [
1238
+ f"OAMCrossAccountRoleCreate_ { bedrock_account } "
1239
+ ] = f"DRY_RUN: Create { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } "
1240
1240
else :
1241
1241
LOGGER .info (
1242
1242
f"CloudWatch observability access manager { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } cross-account role found in { bedrock_account } "
@@ -1267,17 +1267,17 @@ def deploy_central_cloudwatch_observability(event: dict) -> None: # noqa: CCR00
1267
1267
LOGGER .info (f"Attaching { policy_arn } policy to { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } ..." )
1268
1268
if DRY_RUN is False :
1269
1269
iam .attach_policy (cloudwatch .CROSS_ACCOUNT_ROLE_NAME , policy_arn )
1270
- LIVE_RUN_DATA [f"OamXacctRolePolicyAttach_ { policy_arn . split ( '/' )[ 1 ] } _ { bedrock_account } " ] = (
1271
- f"Attached { policy_arn } policy to { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role "
1272
- )
1270
+ LIVE_RUN_DATA [
1271
+ f"OamXacctRolePolicyAttach_ { policy_arn . split ( '/' )[ 1 ] } _ { bedrock_account } "
1272
+ ] = f"Attached { policy_arn } policy to { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role"
1273
1273
CFN_RESPONSE_DATA ["deployment_info" ]["action_count" ] += 1
1274
1274
1275
1275
CFN_RESPONSE_DATA ["deployment_info" ]["configuration_changes" ] += 1
1276
1276
LOGGER .info (f"Attached { policy_arn } policy to { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } " )
1277
1277
else :
1278
- DRY_RUN_DATA [f"OAMCrossAccountRolePolicyAttach_ { policy_arn . split ( '/' )[ 1 ] } _ { bedrock_account } " ] = (
1279
- f"DRY_RUN: Attach { policy_arn } policy to { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } "
1280
- )
1278
+ DRY_RUN_DATA [
1279
+ f"OAMCrossAccountRolePolicyAttach_ { policy_arn . split ( '/' )[ 1 ] } _ { bedrock_account } "
1280
+ ] = f"DRY_RUN: Attach { policy_arn } policy to { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role in { bedrock_account } "
1281
1281
1282
1282
# 5e) OAM link in bedrock account
1283
1283
cloudwatch .CWOAM_CLIENT = sts .assume_role (bedrock_account , sts .CONFIGURATION_ROLE , "oam" , bedrock_region )
@@ -1286,9 +1286,9 @@ def deploy_central_cloudwatch_observability(event: dict) -> None: # noqa: CCR00
1286
1286
if DRY_RUN is False :
1287
1287
LOGGER .info ("CloudWatch observability access manager link not found, creating..." )
1288
1288
oam_link_arn = cloudwatch .create_oam_link (oam_sink_arn )
1289
- LIVE_RUN_DATA [f"OAMLinkCreate_ { bedrock_account } _ { bedrock_region } " ] = (
1290
- f"Created CloudWatch observability access manager link in { bedrock_account } in { bedrock_region } "
1291
- )
1289
+ LIVE_RUN_DATA [
1290
+ f"OAMLinkCreate_ { bedrock_account } _ { bedrock_region } "
1291
+ ] = f"Created CloudWatch observability access manager link in { bedrock_account } in { bedrock_region } "
1292
1292
CFN_RESPONSE_DATA ["deployment_info" ]["action_count" ] += 1
1293
1293
1294
1294
CFN_RESPONSE_DATA ["deployment_info" ]["resources_deployed" ] += 1
@@ -1297,9 +1297,9 @@ def deploy_central_cloudwatch_observability(event: dict) -> None: # noqa: CCR00
1297
1297
add_state_table_record ("oam" , "implemented" , "oam link" , "link" , oam_link_arn , bedrock_account , bedrock_region , "oam_link" )
1298
1298
else :
1299
1299
LOGGER .info ("DRY_RUN: CloudWatch observability access manager link not found, creating..." )
1300
- DRY_RUN_DATA [f"OAMLinkCreate_ { bedrock_account } " ] = (
1301
- f"DRY_RUN: Create CloudWatch observability access manager link in { bedrock_account } in { bedrock_region } "
1302
- )
1300
+ DRY_RUN_DATA [
1301
+ f"OAMLinkCreate_ { bedrock_account } "
1302
+ ] = f"DRY_RUN: Create CloudWatch observability access manager link in { bedrock_account } in { bedrock_region } "
1303
1303
# Set link arn to default value (for dry run)
1304
1304
oam_link_arn = f"arn:aws:cloudwatch::{ bedrock_account } :link/arn"
1305
1305
else :
@@ -1561,15 +1561,15 @@ def delete_custom_config_iam_role(rule_name: str, acct: str) -> None: # noqa: C
1561
1561
if DRY_RUN is False :
1562
1562
LOGGER .info (f"Detaching { policy ['PolicyName' ]} IAM policy from account { acct } in { region } " )
1563
1563
iam .detach_policy (rule_name , policy ["PolicyArn" ])
1564
- LIVE_RUN_DATA [f" { rule_name } _ { acct } _ { region } _PolicyDetach" ] = (
1565
- f"Detached { policy [ 'PolicyName' ] } IAM policy from account { acct } in { region } "
1566
- )
1564
+ LIVE_RUN_DATA [
1565
+ f"{ rule_name } _ { acct } _ { region } _PolicyDetach "
1566
+ ] = f"Detached { policy [ 'PolicyName' ] } IAM policy from account { acct } in { region } "
1567
1567
CFN_RESPONSE_DATA ["deployment_info" ]["action_count" ] += 1
1568
1568
else :
1569
1569
LOGGER .info (f"DRY_RUN: Detach { policy ['PolicyName' ]} IAM policy from account { acct } in { region } " )
1570
- DRY_RUN_DATA [f" { rule_name } _ { acct } _ { region } _Delete" ] = (
1571
- f"DRY_RUN: Detach { policy [ 'PolicyName' ] } IAM policy from account { acct } in { region } "
1572
- )
1570
+ DRY_RUN_DATA [
1571
+ f"{ rule_name } _ { acct } _ { region } _Delete "
1572
+ ] = f"DRY_RUN: Detach { policy [ 'PolicyName' ] } IAM policy from account { acct } in { region } "
1573
1573
else :
1574
1574
LOGGER .info (f"No IAM policies attached to { rule_name } for account { acct } in { region } " )
1575
1575
@@ -1587,9 +1587,9 @@ def delete_custom_config_iam_role(rule_name: str, acct: str) -> None: # noqa: C
1587
1587
remove_state_table_record (policy_arn )
1588
1588
else :
1589
1589
LOGGER .info (f"DRY_RUN: Delete { rule_name } -lamdba-basic-execution IAM policy for account { acct } in { region } " )
1590
- DRY_RUN_DATA [f" { rule_name } _ { acct } _ { region } _PolicyDelete" ] = (
1591
- f"DRY_RUN: Delete { rule_name } -lamdba-basic-execution IAM policy for account { acct } in { region } "
1592
- )
1590
+ DRY_RUN_DATA [
1591
+ f"{ rule_name } _ { acct } _ { region } _PolicyDelete "
1592
+ ] = f"DRY_RUN: Delete { rule_name } -lamdba-basic-execution IAM policy for account { acct } in { region } "
1593
1593
else :
1594
1594
LOGGER .info (f"{ rule_name } -lamdba-basic-execution IAM policy for account { acct } in { region } does not exist." )
1595
1595
@@ -1807,18 +1807,18 @@ def delete_event(event: dict, context: Any) -> None: # noqa: CFQ001, CCR001, C9
1807
1807
for policy in cross_account_policies :
1808
1808
LOGGER .info (f"Detaching { policy ['PolicyArn' ]} policy from { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } IAM role..." )
1809
1809
iam .detach_policy (cloudwatch .CROSS_ACCOUNT_ROLE_NAME , policy ["PolicyArn" ])
1810
- LIVE_RUN_DATA ["OAMCrossAccountRolePolicyDetach" ] = (
1811
- f"Detached { policy [ 'PolicyArn' ] } policy from { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role "
1812
- )
1810
+ LIVE_RUN_DATA [
1811
+ "OAMCrossAccountRolePolicyDetach "
1812
+ ] = f"Detached { policy [ 'PolicyArn' ] } policy from { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role"
1813
1813
CFN_RESPONSE_DATA ["deployment_info" ]["action_count" ] += 1
1814
1814
CFN_RESPONSE_DATA ["deployment_info" ]["configuration_changes" ] += 1
1815
1815
LOGGER .info (f"Detached { policy ['PolicyArn' ]} policy from { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } IAM role" )
1816
1816
else :
1817
1817
for policy in cross_account_policies :
1818
1818
LOGGER .info (f"DRY_RUN: Detaching { policy ['PolicyArn' ]} policy from { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } IAM role..." )
1819
- DRY_RUN_DATA ["OAMCrossAccountRolePolicyDetach" ] = (
1820
- f"DRY_RUN: Detach { policy [ 'PolicyArn' ] } policy from { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role "
1821
- )
1819
+ DRY_RUN_DATA [
1820
+ "OAMCrossAccountRolePolicyDetach "
1821
+ ] = f"DRY_RUN: Detach { policy [ 'PolicyArn' ] } policy from { cloudwatch . CROSS_ACCOUNT_ROLE_NAME } IAM role"
1822
1822
else :
1823
1823
LOGGER .info (f"No policies attached to { cloudwatch .CROSS_ACCOUNT_ROLE_NAME } IAM role" )
1824
1824
0 commit comments