Merge pull request #88 from newrelic/mwhelan/unnest

Change newrelic-log-ingestion install mechanism

Author: Matt Whelan

README.md

@@ -96,6 +96,7 @@ newrelic-lambda integrations install \
 | `--memory-size` or `-m` | No | Memory size (in MiB) for the New Relic log ingestion function. Default to 128MB. |
 | `--nr-region` | No | The New Relic region to use for the integration. Can use the `NEW_RELIC_REGION` environment variable. Can be either `eu` or `us`. Defaults to `us`. |
 | `--timeout` or `-t` | No | Timeout (in seconds) for the New Relic log ingestion function. Defaults to 30 seconds. |
+| `--role-name` | No | Role name for the ingestion function. If you prefer to create and manage an IAM role for the function to assume out of band, do so and specify that role's name here. This avoids needing CAPABILITY_IAM. |
 | `--aws-profile` or `-p` | No | The AWS profile to use for this command. Can also use `AWS_PROFILE`. Will also check `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables if not using AWS CLI. |
 | `--aws-region` or `-r` | No | The AWS region for the integration. Can use `AWS_DEFAULT_REGION` environment variable. Defaults to AWS session region. |
 | `--aws-role-policy` | No | Specify an alternative IAM role policy ARN for this integration. |
@@ -115,23 +116,23 @@ newrelic-lambda integrations uninstall
 
 #### Update Integration
 
-Updates the New Relic log ingestion function to the latest version.
+Updates the New Relic log ingestion function to the latest version. Existing ingestion function parameters will 
+retain their values, unless you specify different values on the command line.
 
 ```bash
-newrelic-lambda integrations update \
-    --nr-account-id <account id> \
-    --nr-api-key <api key>
+newrelic-lambda integrations update 
 ```
 
 | Option | Required? | Description |
 |--------|-----------|-------------|
-| `--nr-account-id` or `-a` | Yes | The [New Relic Account ID](https://docs.newrelic.com/docs/accounts/install-new-relic/account-setup/account-id) for the integration. Only required if also uninstalling the New Relic AWS Lambda integration. Can also use the `NEW_RELIC_ACCOUNT_ID` environment variable. |
-| `--nr-api-key` or `-k` | Yes | Your [New Relic User API Key](https://docs.newrelic.com/docs/apis/get-started/intro-apis/types-new-relic-api-keys#user-api-key). Can also use the `NEW_RELIC_API_KEY` environment variable. |
-| `--disable-logs` or `-d` | No | Disables forwarding logs to New Relic Logging. This is disabled by default. Make sure you run `newrelic-lambda subscriptions install --function ...` afterwards. |
-| `--enable-logs` or `-e` | No | Enables forwarding logs to New Relic Logging. This is disabled by default. Make sure you run `newrelic-lambda subscriptions install --function ... --filter-pattern ""` afterwards. |
-| `--memory-size` or `-m` | No | Memory size (in MiB) for the New Relic log ingestion function. Default to 128MB. |
+| `--nr-account-id` or `-a` | No | The [New Relic Account ID](https://docs.newrelic.com/docs/accounts/install-new-relic/account-setup/account-id) for the integration. Only required if changing the account to which the logs are sent. Can also use the `NEW_RELIC_ACCOUNT_ID` environment variable. |
+| `--nr-api-key` or `-k` | No | Your [New Relic User API Key](https://docs.newrelic.com/docs/apis/get-started/intro-apis/types-new-relic-api-keys#user-api-key). Can also use the `NEW_RELIC_API_KEY` environment variable. Only required if changing the account to which the logs are sent. |
+| `--disable-logs` or `-d` | No | Disables forwarding logs to New Relic Logging. Make sure you run `newrelic-lambda subscriptions install --function ...` afterwards. |
+| `--enable-logs` or `-e` | No | Enables forwarding logs to New Relic Logging. Make sure you run `newrelic-lambda subscriptions install --function ... --filter-pattern ""` afterwards. |
+| `--memory-size` or `-m` | No | Memory size (in MiB) for the New Relic log ingestion function. |
 | `--nr-region` | No | The New Relic region to use for the integration. Can use the `NEW_RELIC_REGION` environment variable. Can be either `eu` or `us`. Defaults to `us`. |
-| `--timeout` or `-t` | No | Timeout (in seconds) for the New Relic log ingestion function. Defaults to 30 seconds. |
+| `--timeout` or `-t` | No | Timeout (in seconds) for the New Relic log ingestion function. |
+| `--role-name` | No | Role name for the ingestion function. If you prefer to create and manage an IAM role for the function to assume out of band, do so and specify that role's name here. This avoids needing CAPABILITY_IAM. |
 | `--aws-profile` or `-p` | No | The AWS profile to use for this command. Can also use `AWS_PROFILE`. Will also check `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables if not using AWS CLI. |
 | `--aws-region` or `-r` | No | The AWS region for the integration. Can use `AWS_DEFAULT_REGION` environment variable. Defaults to AWS session region. |
 

newrelic_lambda_cli/cli/integrations.py

@@ -58,6 +58,12 @@ def register(group):
     show_default=True,
     type=click.INT,
 )
+@click.option(
+    "--role-name",
+    help="The name of a pre-created execution role for the log ingest function",
+    metavar="<role_name>",
+    show_default=False,
+)
 def install(
     aws_profile,
     aws_region,
@@ -70,6 +76,7 @@ def install(
     nr_api_key,
     nr_region,
     timeout,
+    role_name,
 ):
     """Install New Relic AWS Lambda Integration"""
     session = boto3.Session(profile_name=aws_profile, region_name=aws_region)
@@ -106,7 +113,7 @@ def install(
 
     click.echo("Creating newrelic-log-ingestion Lambda function in AWS account")
     res = integrations.install_log_ingestion(
-        session, nr_license_key, enable_logs, memory_size, timeout
+        session, nr_license_key, enable_logs, memory_size, timeout, role_name
     )
     install_success = res and install_success
 
@@ -163,57 +170,48 @@ def uninstall(aws_profile, aws_region, aws_permissions_check, nr_account_id, for
 @add_options(AWS_OPTIONS)
 @click.option(
     "--enable-logs/--disable-logs",
-    default=False,
+    default=None,
     help="Determines if logs are forwarded to New Relic Logging",
-    show_default=True,
 )
 @click.option(
     "--memory-size",
     "-m",
-    default=128,
     help="Memory size (in MiB) for the log ingestion function",
     metavar="<size>",
-    show_default=True,
     type=click.INT,
 )
-@add_options(NR_OPTIONS)
 @click.option(
     "--timeout",
     "-t",
-    default=30,
     help="Timeout (in seconds) for the New Relic log ingestion function",
     metavar="<secs>",
-    show_default=True,
     type=click.INT,
 )
+@click.option(
+    "--role-name",
+    help="The name of a new pre-created execution role for the log ingest function",
+    metavar="<role_name>",
+)
 def update(
     aws_profile,
     aws_region,
     aws_permissions_check,
     enable_logs,
     memory_size,
-    nr_account_id,
-    nr_api_key,
-    nr_region,
     timeout,
+    role_name,
 ):
     """UpdateNew Relic AWS Lambda Integration"""
     session = boto3.Session(profile_name=aws_profile, region_name=aws_region)
 
     if aws_permissions_check:
         permissions.ensure_integration_install_permissions(session)
 
-    click.echo("Validating New Relic credentials")
-    gql_client = api.validate_gql_credentials(nr_account_id, nr_api_key, nr_region)
-
-    click.echo("Retrieving integration license key")
-    nr_license_key = api.retrieve_license_key(gql_client)
-
     update_success = True
 
     click.echo("Updating newrelic-log-ingestion Lambda function in AWS account")
     res = integrations.update_log_ingestion(
-        session, nr_license_key, enable_logs, memory_size, timeout
+        session, None, enable_logs, memory_size, timeout, role_name
     )
     update_success = res and update_success