Support VPC Peering tests

aws/policy/networking.yaml

@@ -14,88 +14,93 @@ Statement:
   - Sid: AllowRegionalUnrestrictedResourceActionsWhichIncurNoFees
     Effect: Allow
     Action:
+      - ec2:AcceptVpcPeeringConnection
       - ec2:AllocateAddress
-      - ec2:DescribeAddresses
-      - ec2:ReleaseAddress
       - ec2:AssociateAddress
-      - ec2:DisassociateAddress
-      - ec2:CreateCustomerGateway
-      - ec2:DeleteCustomerGateway
-      - ec2:DescribeCustomerGateways
       - ec2:AssociateDhcpOptions
-      - ec2:CreateDhcpOptions
-      - ec2:DeleteDhcpOptions
-      - ec2:DescribeDhcpOptions
+      - ec2:AssociateRouteTable
+      - ec2:AssociateSubnetCidrBlock
+      - ec2:AssociateVpcCidrBlock
       - ec2:AttachInternetGateway
-      - ec2:DetachInternetGateway
-      - ec2:CreateInternetGateway
-      - ec2:DeleteInternetGateway
-      - ec2:DescribeInternetGateways
+      - ec2:AttachNetworkInterface
+      - ec2:AttachVpnGateway
+      - ec2:AuthorizeSecurityGroupEgress
+      - ec2:AuthorizeSecurityGroupIngress
+      - ec2:CreateCustomerGateway
+      - ec2:CreateDhcpOptions
       - ec2:CreateEgressOnlyInternetGateway
-      - ec2:DescribeEgressOnlyInternetGateways
-      - ec2:DeleteEgressOnlyInternetGateway
+      - ec2:CreateInternetGateway
       - ec2:CreateNatGateway
-      - ec2:DeleteNatGateway
-      - ec2:DescribeNatGateways
-      - ec2:DescribeNetworkAcls
+      - ec2:CreateNetworkAcl
+      - ec2:CreateNetworkAclEntry
       - ec2:CreateNetworkInterface
-      - ec2:AttachNetworkInterface
-      - ec2:DeleteNetworkInterface
-      - ec2:DescribeNetworkInterfaces
-      - ec2:DetachNetworkInterface
-      - ec2:ModifyNetworkInterfaceAttribute
       - ec2:CreateRoute
-      - ec2:DeleteRoute
-      - ec2:AssociateRouteTable
-      - ec2:DisassociateRouteTable
-      # - ec2:ReplaceRouteTableAssociation
       - ec2:CreateRouteTable
-      - ec2:DeleteRouteTable
-      - ec2:DescribeRouteTables
-      - ec2:ReplaceRoute
-      - ec2:AssociateSubnetCidrBlock
-      - ec2:DisassociateSubnetCidrBlock
-      - ec2:DescribeSubnets
+      - ec2:CreateSecurityGroup
       - ec2:CreateSubnet
-      - ec2:DeleteSubnet
-      - ec2:ModifySubnetAttribute
-      - ec2:AssociateVpcCidrBlock
-      - ec2:DisassociateVpcCidrBlock
-      - ec2:DescribeVpcs
       - ec2:CreateVpc
+      - ec2:CreateVpcEndpoint
+      - ec2:CreateVpcPeeringConnection
+      - ec2:CreateVpnConnection
+      - ec2:CreateVpnGateway
+      - ec2:DeleteCustomerGateway
+      - ec2:DeleteDhcpOptions
+      - ec2:DeleteEgressOnlyInternetGateway
+      - ec2:DeleteInternetGateway
+      - ec2:DeleteNatGateway
+      - ec2:DeleteNetworkAcl
+      - ec2:DeleteNetworkAclEntry
+      - ec2:DeleteNetworkInterface
+      - ec2:DeleteRoute
+      - ec2:DeleteRouteTable
+      - ec2:DeleteSecurityGroup
+      - ec2:DeleteSubnet
       - ec2:DeleteVpc
+      - ec2:DeleteVpcEndpoints
+      - ec2:DeleteVpcPeeringConnection
+      - ec2:DeleteVpnConnection
+      - ec2:DeleteVpnGateway
+      - ec2:DescribeAddresses
+      - ec2:DescribeCustomerGateways
+      - ec2:DescribeDhcpOptions
+      - ec2:DescribeEgressOnlyInternetGateways
+      - ec2:DescribeInternetGateways
+      - ec2:DescribeNatGateways
+      - ec2:DescribeNetworkAcls
+      - ec2:DescribeNetworkInterfaces
+      - ec2:DescribeRouteTables
+      - ec2:DescribeSecurityGroups
+      - ec2:DescribeSubnets
       - ec2:DescribeVpcAttribute
-      - ec2:ModifyVpcAttribute
       - ec2:DescribeVpcClassicLink
       - ec2:DescribeVpcClassicLinkDnsSupport
       - ec2:DescribeVpcEndpoints
       - ec2:DescribeVpcEndpointServices
-      - ec2:CreateVpcEndpoint
-      - ec2:DeleteVpcEndpoints
-      - ec2:ModifyVpcEndpoint
-      - ec2:CreateVpnConnection
-      - ec2:DeleteVpnConnection
+      - ec2:DescribeVpcPeeringConnections
+      - ec2:DescribeVpcs
       - ec2:DescribeVpnConnections
-      - ec2:AttachVpnGateway
-      - ec2:CreateVpnGateway
-      - ec2:DeleteVpnGateway
-      - ec2:DetachVpnGateway
       - ec2:DescribeVpnGateways
-      - ec2:AuthorizeSecurityGroupIngress
-      - ec2:AuthorizeSecurityGroupEgress
-      - ec2:RevokeSecurityGroupIngress
-      - ec2:RevokeSecurityGroupEgress
-      - ec2:UpdateSecurityGroupRuleDescriptionsIngress
-      - ec2:UpdateSecurityGroupRuleDescriptionsEgress
-      - ec2:DescribeSecurityGroups
-      - ec2:CreateSecurityGroup
-      - ec2:DeleteSecurityGroup
-      - ec2:CreateNetworkAcl
-      - ec2:CreateNetworkAclEntry
-      - ec2:DeleteNetworkAcl
-      - ec2:DeleteNetworkAclEntry
+      - ec2:DetachInternetGateway
+      - ec2:DetachNetworkInterface
+      - ec2:DetachVpnGateway
+      - ec2:DisassociateAddress
+      - ec2:DisassociateRouteTable
+      - ec2:DisassociateSubnetCidrBlock
+      - ec2:DisassociateVpcCidrBlock
+      - ec2:ModifyNetworkInterfaceAttribute
+      - ec2:ModifySubnetAttribute
+      - ec2:ModifyVpcAttribute
+      - ec2:ModifyVpcEndpoint
+      - ec2:RejectVpcPeeringConnection
+      - ec2:ReleaseAddress
       - ec2:ReplaceNetworkAclAssociation
       - ec2:ReplaceNetworkAclEntry
+      - ec2:ReplaceRoute
+      # - ec2:ReplaceRouteTableAssociation
+      - ec2:RevokeSecurityGroupEgress
+      - ec2:RevokeSecurityGroupIngress
+      - ec2:UpdateSecurityGroupRuleDescriptionsEgress
+      - ec2:UpdateSecurityGroupRuleDescriptionsIngress
     Resource:
       - "*"
     Condition:

aws/terminator/networking.py

@@ -347,6 +347,29 @@ def terminate(self):
         self.client.delete_vpn_gateway(VpnGatewayId=self.id)
 
 
+class Ec2VpcPeer(DbTerminator):
+    @staticmethod
+    def create(credentials):
+        return Terminator._create(credentials, Ec2VpcPeer, 'ec2', lambda client: client.describe_vpc_peering_connections()['VpcPeeringConnections'])
+
+    @property
+    def id(self):
+        return self.instance['VpcPeeringConnectionId']
+
+    @property
+    def name(self):
+        return get_tag_dict_from_tag_list(self.instance.get('Tags')).get('Name')
+
+    @property
+    def ignore(self):
+        if self.instance.get('Status', {}).get('Code') in ['rejected', 'deleted']:
+            return True
+        return False
+
+    def terminate(self):
+        self.client.delete_vpc_peering_connection(VpcPeeringConnectionId=self.id)
+
+
 class Ec2SecurityGroup(DbTerminator):
     @staticmethod
     def create(credentials):