tvaultapi/src/main/java/com/tmobile/cso/vault/api/service/IAMServiceAccountsService.java
private void removeAWSRoleAssociationFromIAMSvcAccForOffboard(String iamSvcAccName, String token, String role) {
		String readPolicy = new StringBuilder()
				.append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY))
				.append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccName).toString();
		String writePolicy = new StringBuilder()
				.append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY))
				.append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccName).toString();
		String denyPolicy = new StringBuilder()
				.append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY))
				.append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccName).toString();
		String ownerPolicy = new StringBuilder()
				.append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.SUDO_POLICY))
				.append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccName).toString();

		log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
				put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
				put(LogMessage.ACTION, IAMServiceAccountConstants.DELETE_AWSROLE_ASSOCIATION).
				put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]", readPolicy, writePolicy, denyPolicy, ownerPolicy)).
				put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
				build()));

		Response roleResponse = reqProcessor.process("/auth/aws/roles","{\"role\":\""+role+"\"}",token);
		String responseJson="";
		String authType = TVaultConstants.EC2;
		List<String> policies = new ArrayList<>();
		List<String> currentpolicies = new ArrayList<>();

		if(HttpStatus.OK.equals(roleResponse.getHttpstatus())){
			responseJson = roleResponse.getResponse();
			ObjectMapper objMapper = new ObjectMapper();
			try {
				JsonNode policiesArry =objMapper.readTree(responseJson).get("policies");
				for(JsonNode policyNode : policiesArry){
					currentpolicies.add(policyNode.asText());
				}
				authType = objMapper.readTree(responseJson).get(TVaultConstants.AUTH_TYPE).asText();
			} catch (IOException e) {
		        log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
		                put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
		                put(LogMessage.ACTION, IAMServiceAccountConstants.DELETE_AWSROLE_ASSOCIATION).
		                put(LogMessage.MESSAGE, e.getMessage()).
		                put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
		                build()));
			}
			policies.addAll(currentpolicies);
			policies.remove(readPolicy);
			policies.remove(writePolicy);
			policies.remove(denyPolicy);

			String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ",");
			log.info(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
					put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
					put(LogMessage.ACTION, IAMServiceAccountConstants.DELETE_AWSROLE_ASSOCIATION).
					put(LogMessage.MESSAGE, "Remove AWS Role from IAM Service account -  policy :" + policiesString + " is being configured" ).
					put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
					build()));

			if (TVaultConstants.IAM.equals(authType)) {
				awsiamAuthService.configureAWSIAMRole(role,policiesString,token);
				log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
		                put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
		                put(LogMessage.ACTION, IAMServiceAccountConstants.DELETE_AWSROLE_ASSOCIATION).
		                put(LogMessage.MESSAGE, String.format ("%s, AWS IAM Role association is removed as part of offboarding IAM Service account [%s].", role, iamSvcAccName)).
		                put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
		                build()));
			}
			else {
				awsAuthService.configureAWSRole(role,policiesString,token);
				log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
		                put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
		                put(LogMessage.ACTION, IAMServiceAccountConstants.DELETE_AWSROLE_ASSOCIATION).
		                put(LogMessage.MESSAGE, String.format ("%s, AWS EC2 Role association is removed as part of offboarding IAM Service account [%s].", role, iamSvcAccName)).
		                put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
		                build()));
			}
		}
	}
/**
	 * Method to remove the AWS role association from IAM Service account for Off board.
	 * @param iamSvcAccName
	 * @param token
	 * @param role
	 */
Method to remove the AWS role association from IAM Service account for Off board.
Method to remove the AWS role association from IAM Service account for Off board .
private void removeAWSRoleAssociationFromIAMSvcAccForOffboard(String iamSvcAccName, String token, String role) {
		String readPolicy = new StringBuilder()
				.append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.READ_POLICY))
				.append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccName).toString();
		String writePolicy = new StringBuilder()
				.append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.WRITE_POLICY))
				.append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccName).toString();
		String denyPolicy = new StringBuilder()
				.append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.DENY_POLICY))
				.append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccName).toString();
		String ownerPolicy = new StringBuilder()
				.append(TVaultConstants.SVC_ACC_POLICIES_PREFIXES.getKey(TVaultConstants.SUDO_POLICY))
				.append(IAMServiceAccountConstants.IAMSVCACC_POLICY_PREFIX).append(iamSvcAccName).toString();
		log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
				put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
				put(LogMessage.ACTION, IAMServiceAccountConstants.DELETE_AWSROLE_ASSOCIATION).
				put(LogMessage.MESSAGE, String.format ("Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]", readPolicy, writePolicy, denyPolicy, ownerPolicy)).
				put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
				build()));
		Response roleResponse = reqProcessor.process("/auth/aws/roles","{\"role\":\""+role+"\"}",token);
		String responseJson="";
		String authType = TVaultConstants.EC2;
		List<String> policies = new ArrayList<>();
		List<String> currentpolicies = new ArrayList<>();
		if(HttpStatus.OK.equals(roleResponse.getHttpstatus())){
			responseJson = roleResponse.getResponse();
			ObjectMapper objMapper = new ObjectMapper();
			try {
				JsonNode policiesArry =objMapper.readTree(responseJson).get("policies");
				for(JsonNode policyNode : policiesArry){
					currentpolicies.add(policyNode.asText());
				}
				authType = objMapper.readTree(responseJson).get(TVaultConstants.AUTH_TYPE).asText();
			} catch (IOException e) {
		        log.error(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
		                put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
		                put(LogMessage.ACTION, IAMServiceAccountConstants.DELETE_AWSROLE_ASSOCIATION).
		                put(LogMessage.MESSAGE, e.getMessage()).
		                put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
		                build()));
			}
			policies.addAll(currentpolicies);
			policies.remove(readPolicy);
			policies.remove(writePolicy);
			policies.remove(denyPolicy);
			String policiesString = org.apache.commons.lang3.StringUtils.join(policies, ",");
			log.info(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
					put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
					put(LogMessage.ACTION, IAMServiceAccountConstants.DELETE_AWSROLE_ASSOCIATION).
					put(LogMessage.MESSAGE, "Remove AWS Role from IAM Service account -  policy :" + policiesString + " is being configured" ).
					put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
					build()));
			if (TVaultConstants.IAM.equals(authType)) {
				awsiamAuthService.configureAWSIAMRole(role,policiesString,token);
				log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
		                put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
		                put(LogMessage.ACTION, IAMServiceAccountConstants.DELETE_AWSROLE_ASSOCIATION).
		                put(LogMessage.MESSAGE, String.format ("%s, AWS IAM Role association is removed as part of offboarding IAM Service account [%s].", role, iamSvcAccName)).
		                put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
		                build()));
			}
			else {
				awsAuthService.configureAWSRole(role,policiesString,token);
				log.debug(JSONUtil.getJSON(ImmutableMap.<String, String>builder().
		                put(LogMessage.USER, ThreadLocalContext.getCurrentMap().get(LogMessage.USER)).
		                put(LogMessage.ACTION, IAMServiceAccountConstants.DELETE_AWSROLE_ASSOCIATION).
		                put(LogMessage.MESSAGE, String.format ("%s, AWS EC2 Role association is removed as part of offboarding IAM Service account [%s].", role, iamSvcAccName)).
		                put(LogMessage.APIURL, ThreadLocalContext.getCurrentMap().get(LogMessage.APIURL)).
		                build()));
			}
		}
	}
private void removeAWSRoleAssociationFromIAMSvcAccForOffboard ( String iamSvcAccName , String token , String role ) { String readPolicy = new StringBuilder ( ) . append ( TVaultConstants . SVC_ACC_POLICIES_PREFIXES . getKey ( TVaultConstants . READ_POLICY ) ) . append ( IAMServiceAccountConstants . IAMSVCACC_POLICY_PREFIX ) . append ( iamSvcAccName ) . toString ( ) ; String writePolicy = new StringBuilder ( ) . append ( TVaultConstants . SVC_ACC_POLICIES_PREFIXES . getKey ( TVaultConstants . WRITE_POLICY ) ) . append ( IAMServiceAccountConstants . IAMSVCACC_POLICY_PREFIX ) . append ( iamSvcAccName ) . toString ( ) ; String denyPolicy = new StringBuilder ( ) . append ( TVaultConstants . SVC_ACC_POLICIES_PREFIXES . getKey ( TVaultConstants . DENY_POLICY ) ) . append ( IAMServiceAccountConstants . IAMSVCACC_POLICY_PREFIX ) . append ( iamSvcAccName ) . toString ( ) ; String ownerPolicy = new StringBuilder ( ) . append ( TVaultConstants . SVC_ACC_POLICIES_PREFIXES . getKey ( TVaultConstants . SUDO_POLICY ) ) . append ( IAMServiceAccountConstants . IAMSVCACC_POLICY_PREFIX ) . append ( iamSvcAccName ) . toString ( ) ; log . debug ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . DELETE_AWSROLE_ASSOCIATION ) . put ( LogMessage . MESSAGE , String . format ( "Policies are, read - [%s], write - [%s], deny -[%s], owner - [%s]" , readPolicy , writePolicy , denyPolicy , ownerPolicy ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; Response roleResponse = reqProcessor . process ( "/auth/aws/roles" , "{\"role\":\"" + role + "\"}" , token ) ; String responseJson = "" ; String authType = TVaultConstants . EC2 ; List < String > policies = new ArrayList < > ( ) ; List < String > currentpolicies = new ArrayList < > ( ) ; if ( HttpStatus . OK . equals ( roleResponse . getHttpstatus ( ) ) ) { responseJson = roleResponse . getResponse ( ) ; ObjectMapper objMapper = new ObjectMapper ( ) ; try { JsonNode policiesArry = objMapper . readTree ( responseJson ) . get ( "policies" ) ; for ( JsonNode policyNode : policiesArry ) { currentpolicies . add ( policyNode . asText ( ) ) ; } authType = objMapper . readTree ( responseJson ) . get ( TVaultConstants . AUTH_TYPE ) . asText ( ) ; } catch ( IOException e ) { log . error ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . DELETE_AWSROLE_ASSOCIATION ) . put ( LogMessage . MESSAGE , e . getMessage ( ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; } policies . addAll ( currentpolicies ) ; policies . remove ( readPolicy ) ; policies . remove ( writePolicy ) ; policies . remove ( denyPolicy ) ; String policiesString = org . apache . commons . lang3 . StringUtils . join ( policies , "," ) ; log . info ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . DELETE_AWSROLE_ASSOCIATION ) . put ( LogMessage . MESSAGE , "Remove AWS Role from IAM Service account -  policy :" + policiesString + " is being configured" ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; if ( TVaultConstants . IAM . equals ( authType ) ) { awsiamAuthService . configureAWSIAMRole ( role , policiesString , token ) ; log . debug ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . DELETE_AWSROLE_ASSOCIATION ) . put ( LogMessage . MESSAGE , String . format ( "%s, AWS IAM Role association is removed as part of offboarding IAM Service account [%s]." , role , iamSvcAccName ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; } else { awsAuthService . configureAWSRole ( role , policiesString , token ) ; log . debug ( JSONUtil . getJSON ( ImmutableMap . < String , String > builder ( ) . put ( LogMessage . USER , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . USER ) ) . put ( LogMessage . ACTION , IAMServiceAccountConstants . DELETE_AWSROLE_ASSOCIATION ) . put ( LogMessage . MESSAGE , String . format ( "%s, AWS EC2 Role association is removed as part of offboarding IAM Service account [%s]." , role , iamSvcAccName ) ) . put ( LogMessage . APIURL , ThreadLocalContext . getCurrentMap ( ) . get ( LogMessage . APIURL ) ) . build ( ) ) ) ; } } }
Method to remove the AWS role association from IAM Service account for Off board.
Method to remove the AWS role association from IAM Service account for Off board .