parameters: (request_type, policy_name, permissions, role_mappings)
return_statement: return were_changes
docstring: Update roles to reflect the desired permissions.
  
      Args:
  
          request_type - 'Create', 'Update', or 'Delete'. Delete causes the named policy to be deleted.
          Create and Update causes the named policy to be set.
  
          policy_name - The name of the policy to delete or set.
  
          permissions - A description of the desired permissions:
  
            {
               '<resource-arn>': [
                  {
                     "AbstractRole": [ ["<resource-group-name>", "<abstract-role-name>"], ... ],
                     "Action": [ "<allowed-action>", ... ],
                     "ResourceSuffix": [ "<resource-suffix>", ... ],
                     "LogicalResourceId": "<logical-resource-id>"
                  },
                  ...
               ]
            }
  
          role_mappings - A abstract to physical role mappings that identify the roles to be updated:
  
            {
              "<role-physical-resource-id>": [
                {
                  "Effect": "<allow-or-deny>",
                  "AbstractRole": [ ["<resource-group-name>", "<abstract-role-name>"], ... ],
                },
                ...
              ]
            }
docstring_summary: Update roles to reflect the desired permissions.
docstring_tokens: Update roles to reflect the desired permissions .
function: def _update_roles(request_type, policy_name, permissions, role_mappings):
      """Update roles to reflect the desired permissions.
  
      Args:
  
          request_type - 'Create', 'Update', or 'Delete'. Delete causes the named policy to be deleted.
          Create and Update causes the named policy to be set.
  
          policy_name - The name of the policy to delete or set.
  
          permissions - A description of the desired permissions:
  
            {
               '<resource-arn>': [
                  {
                     "AbstractRole": [ ["<resource-group-name>", "<abstract-role-name>"], ... ],
                     "Action": [ "<allowed-action>", ... ],
                     "ResourceSuffix": [ "<resource-suffix>", ... ],
                     "LogicalResourceId": "<logical-resource-id>"
                  },
                  ...
               ]
            }
  
          role_mappings - A abstract to physical role mappings that identify the roles to be updated:
  
            {
              "<role-physical-resource-id>": [
                {
                  "Effect": "<allow-or-deny>",
                  "AbstractRole": [ ["<resource-group-name>", "<abstract-role-name>"], ... ],
                },
                ...
              ]
            }
  
      """
  
      were_changes = False
  
      print('Updating roles for {} request using permissions {} and role_mappings {}.'.format(request_type, permissions, role_mappings))
  
      if request_type == 'Delete':
  
          # Delete the target policy from all of roles. It is OK if the policy
          # doesn't exist.
  
          for role_physical_id in role_mappings:
              try:
                  print('Delete requested. Deleting role policy {} from role {}.'.format(policy_name, role_physical_id))
                  iam.delete_role_policy(RoleName=role_physical_id, PolicyName=policy_name)
                  were_changes = True
              except ClientError as e:
                  if e.response["Error"]["Code"] not in ["NoSuchEntity", "AccessDenied"]:
                      raise e
  
      else:
  
          for role_physical_id, role_mapping_list in six.iteritems(role_mappings):
  
              # Generate a policy for the role. If the policy has no statements,
              # we delete the policy instead of putting it. In this case, it is ok
              # if the policy doesn't exist.
  
              policy = _create_role_policy(permissions, role_mapping_list)
              if len(policy['Statement']) == 0:
                  try:
                      print('{} requested. Deleting role policy {} from role {} because there are no statements in the policy.'.format(request_type, policy_name,
                                                                                                                                       role_physical_id))
                      iam.delete_role_policy(RoleName=role_physical_id, PolicyName=policy_name)
                      were_changes = True
                  except ClientError as e:
                      if e.response["Error"]["Code"] not in ["NoSuchEntity", "AccessDenied"]:
                          raise e
              else:
                  policy_content = json.dumps(policy)
                  print('{} requested. Putting role policy {} on role {}: {}'.format(request_type, policy_name, role_physical_id, policy_content))
                  iam.put_role_policy(RoleName=role_physical_id, PolicyName=policy_name, PolicyDocument=policy_content)
                  were_changes = True
  
      return were_changes
function_tokens: def _update_roles ( request_type , policy_name , permissions , role_mappings ) : were_changes = False print ( 'Updating roles for {} request using permissions {} and role_mappings {}.' . format ( request_type , permissions , role_mappings ) ) if request_type == 'Delete' : # Delete the target policy from all of roles. It is OK if the policy # doesn't exist. for role_physical_id in role_mappings : try : print ( 'Delete requested. Deleting role policy {} from role {}.' . format ( policy_name , role_physical_id ) ) iam . delete_role_policy ( RoleName = role_physical_id , PolicyName = policy_name ) were_changes = True except ClientError as e : if e . response [ "Error" ] [ "Code" ] not in [ "NoSuchEntity" , "AccessDenied" ] : raise e else : for role_physical_id , role_mapping_list in six . iteritems ( role_mappings ) : # Generate a policy for the role. If the policy has no statements, # we delete the policy instead of putting it. In this case, it is ok # if the policy doesn't exist. policy = _create_role_policy ( permissions , role_mapping_list ) if len ( policy [ 'Statement' ] ) == 0 : try : print ( '{} requested. Deleting role policy {} from role {} because there are no statements in the policy.' . format ( request_type , policy_name , role_physical_id ) ) iam . delete_role_policy ( RoleName = role_physical_id , PolicyName = policy_name ) were_changes = True except ClientError as e : if e . response [ "Error" ] [ "Code" ] not in [ "NoSuchEntity" , "AccessDenied" ] : raise e else : policy_content = json . dumps ( policy ) print ( '{} requested. Putting role policy {} on role {}: {}' . format ( request_type , policy_name , role_physical_id , policy_content ) ) iam . put_role_policy ( RoleName = role_physical_id , PolicyName = policy_name , PolicyDocument = policy_content ) were_changes = True return were_changes