.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.29)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is turned on, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{
.    if \nF \{
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
.    \" fudge factors for nroff and troff
.if n \{\
.    ds #H 0
.    ds #V .8m
.    ds #F .3m
.    ds #[ \f1
.    ds #] \fP
.\}
.if t \{\
.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
.    ds #V .6m
.    ds #F 0
.    ds #[ \&
.    ds #] \&
.\}
.    \" simple accents for nroff and troff
.if n \{\
.    ds ' \&
.    ds ` \&
.    ds ^ \&
.    ds , \&
.    ds ~ ~
.    ds /
.\}
.if t \{\
.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
.    \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
.    \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
.    \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
.    ds : e
.    ds 8 ss
.    ds o a
.    ds d- d\h'-1'\(ga
.    ds D- D\h'-1'\(hy
.    ds th \o'bp'
.    ds Th \o'LP'
.    ds ae ae
.    ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "VM::EC2 3pm"
.TH VM::EC2 3pm "2016-06-04" "perl v5.22.2" "User Contributed Perl Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
VM::EC2 \- Perl interface to Amazon EC2, Virtual Private Cloud, Elastic Load Balancing, Autoscaling, and Relational Database services
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
\&\s-1NOTE:\s0 For information on \s-1AWS\s0's \s-1VPC,\s0 load balancing, autoscaling and relational
databases services, see \s-1VM::EC2::VPC\s0, \s-1VM::EC2::ELB\s0,
VM::EC2::REST::autoscaling, and
VM::EC2::REST::relational_database_service
.PP
.Vb 2
\& # set environment variables EC2_ACCESS_KEY, EC2_SECRET_KEY and/or EC2_URL
\& # to fill in arguments automatically
\&
\& ## IMAGE AND INSTANCE MANAGEMENT
\& # get new EC2 object
\& my $ec2 = VM::EC2\->new(\-access_key => \*(Aqaccess key id\*(Aq,
\&                        \-secret_key => \*(Aqaws_secret_key\*(Aq,
\&                        \-endpoint   => \*(Aqhttp://ec2.amazonaws.com\*(Aq);
\&
\& # fetch an image by its ID
\& my $image = $ec2\->describe_images(\*(Aqami\-12345\*(Aq);
\&
\& # get some information about the image
\& my $architecture = $image\->architecture;
\& my $description  = $image\->description;
\& my @devices      = $image\->blockDeviceMapping;
\& for my $d (@devices) {
\&    print $d\->deviceName,"\en";
\&    print $d\->snapshotId,"\en";
\&    print $d\->volumeSize,"\en";
\& }
\&
\& # run two instances
\& my @instances = $image\->run_instances(\-key_name      =>\*(AqMy_key\*(Aq,
\&                                       \-security_group=>\*(Aqdefault\*(Aq,
\&                                       \-min_count     =>2,
\&                                       \-instance_type => \*(Aqt1.micro\*(Aq)
\&           or die $ec2\->error_str;
\&
\& # wait for both instances to reach "running" or other terminal state
\& $ec2\->wait_for_instances(@instances);
\&
\& # print out both instance\*(Aqs current state and DNS name
\& for my $i (@instances) {
\&    my $status = $i\->current_status;
\&    my $dns    = $i\->dnsName;
\&    print "$i: [$status] $dns\en";
\& }
\&
\& # tag both instances with Role "server"
\& foreach (@instances) {$_\->add_tag(Role=>\*(Aqserver\*(Aq);
\&
\& # stop both instances
\& foreach (@instances) {$_\->stop}
\& 
\& # find instances tagged with Role=Server that are
\& # stopped, change the user data and restart.
\& @instances = $ec2\->describe_instances({\*(Aqtag:Role\*(Aq       => \*(AqServer\*(Aq,
\&                                        \*(Aqinstance\-state\-name\*(Aq => \*(Aqstopped\*(Aq});
\& for my $i (@instances) {
\&    $i\->userData(\*(AqSecure\-mode: off\*(Aq);
\&    $i\->start or warn "Couldn\*(Aqt start $i: ",$i\->error_str;
\& }
\&
\& # create an image from both instance, tag them, and make
\& # them public
\& for my $i (@instances) {
\&     my $img = $i\->create_image("Autoimage from $i","Test image");
\&     $img\->add_tags(Name  => "Autoimage from $i",
\&                    Role  => \*(AqServer\*(Aq,
\&                    Status=> \*(AqProduction\*(Aq);
\&     $img\->make_public(1);
\& }
\&
\& ## KEY MANAGEMENT
\&
\& # retrieve the name and fingerprint of the first instance\*(Aqs 
\& # key pair
\& my $kp = $instances[0]\->keyPair;
\& print $instances[0], ": keypair $kp=",$kp\->fingerprint,"\en";
\&
\& # create a new key pair
\& $kp = $ec2\->create_key_pair(\*(AqMy Key\*(Aq);
\& 
\& # get the private key from this key pair and write it to a disk file
\& # in ssh\-compatible format
\& my $private_key = $kp\->private_key;
\& open (my $f,\*(Aq>MyKeypair.rsa\*(Aq) or die $!;
\& print $f $private_key;
\& close $f;
\&
\& # Import a preexisting SSH key
\& my $public_key = \*(Aqssh\-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8o...\*(Aq;
\& $key = $ec2\->import_key_pair(\*(AqNewKey\*(Aq,$public_key);
\&
\& ## SECURITY GROUPS AND FIREWALL RULES
\& # Create a new security group
\& my $group = $ec2\->create_security_group(\-name        => \*(AqNewGroup\*(Aq,
\&                                         \-description => \*(Aqexample\*(Aq);
\&
\& # Add a firewall rule 
\& $group\->authorize_incoming(\-protocol  => \*(Aqtcp\*(Aq,
\&                            \-port      => 80,
\&                            \-source_ip => [\*(Aq192.168.2.0/24\*(Aq,\*(Aq192.168.2.1/24\*(Aq});
\&
\& # Write rules back to Amazon
\& $group\->update;
\&
\& # Print current firewall rules
\& print join ("\en",$group\->ipPermissions),"\en";
\&
\& ## VOLUME && SNAPSHOT MANAGEMENT
\&
\& # find existing volumes that are available
\& my @volumes = $ec2\->describe_volumes({status=>\*(Aqavailable\*(Aq});
\&
\& # back \*(Aqem all up to snapshots
\& foreach (@volumes) {$_\->snapshot(\*(AqBackup on \*(Aq.localtime)}
\&
\& # find a stopped instance in first volume\*(Aqs availability zone and 
\& # attach the volume to the instance using /dev/sdg
\& my $vol  = $volumes[0];
\& my $zone = $vol\->availabilityZone;
\& @instances = $ec2\->describe_instances({\*(Aqavailability\-zone\*(Aq=> $zone,
\&                                        \*(Aqrun\-state\-name\*(Aq   => $stopped);
\& $instances[0]\->attach_volume($vol=>\*(Aq/dev/sdg\*(Aq) if @instances;
\&
\& # create a new 20 gig volume
\& $vol = $ec2\->create_volume(\-availability_zone=> \*(Aqus\-east\-1a\*(Aq,
\&                            \-size             =>  20);
\& $ec2\->wait_for_volumes($vol);
\& print "Volume $vol is ready!\en" if $vol\->current_status eq \*(Aqavailable\*(Aq;
\&
\& # create a new elastic address and associate it with an instance
\& my $address = $ec2\->allocate_address();
\& $instances[0]\->associate_address($address);
.Ve
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
This is an interface to the 2014\-05\-01 version of the Amazon \s-1AWS API
\&\s0(http://aws.amazon.com/ec2). It was written provide access to the new
tag and metadata interface that is not currently supported by
Net::Amazon::EC2, as well as to provide developers with an extension
mechanism for the \s-1API.\s0 This library will also support the Open Stack
open source cloud (http://www.openstack.org/).
.PP
The main interface is the \s-1VM::EC2\s0 object, which provides methods for
interrogating the Amazon \s-1EC2,\s0 launching instances, and managing
instance lifecycle. These methods return the following major object
classes which act as specialized interfaces to \s-1AWS:\s0
.PP
.Vb 12
\& VM::EC2::BlockDevice               \-\- A block device
\& VM::EC2::BlockDevice::Attachment   \-\- Attachment of a block device to an EC2 instance
\& VM::EC2::BlockDevice::EBS          \-\- An elastic block device
\& VM::EC2::BlockDevice::Mapping      \-\- Mapping of a virtual storage device to a block device
\& VM::EC2::BlockDevice::Mapping::EBS \-\- Mapping of a virtual storage device to an EBS block device
\& VM::EC2::Group                     \-\- Security groups
\& VM::EC2::Image                     \-\- Amazon Machine Images (AMIs)
\& VM::EC2::Instance                  \-\- Virtual machine instances
\& VM::EC2::Instance::Metadata        \-\- Access to runtime metadata from running instances
\& VM::EC2::Region                    \-\- Availability regions
\& VM::EC2::Snapshot                  \-\- EBS snapshots
\& VM::EC2::Tag                       \-\- Metadata tags
.Ve
.PP
In addition, there is a high level interface for interacting with \s-1EC2\s0
servers and volumes, including file transfer and remote shell facilities:
.PP
.Vb 5
\&  VM::EC2::Staging::Manager         \-\- Manage a set of servers and volumes.
\&  VM::EC2::Staging::Server          \-\- A staging server, with remote shell and file transfer
\&                                        facilities.
\&  VM::EC2::Staging::Volume          \-\- A staging volume with the ability to copy itself between
\&                                        availability zones and regions.
.Ve
.PP
and a few specialty classes:
.PP
.Vb 6
\&  VM::EC2::Security::Token          \-\- Temporary security tokens for granting EC2 access to
\&                                        non\-AWS account holders.
\&  VM::EC2::Security::Credentials    \-\- Credentials for use by temporary account holders.
\&  VM::EC2::Security::Policy         \-\- Policies that restrict what temporary account holders
\&                                        can do with EC2 resources.
\&  VM::EC2::Security::FederatedUser  \-\- Account name information for temporary account holders.
.Ve
.PP
Lastly, there are several utility classes:
.PP
.Vb 6
\& VM::EC2::Generic                   \-\- Base class for all AWS objects
\& VM::EC2::Error                     \-\- Error messages
\& VM::EC2::Dispatch                  \-\- Maps AWS XML responses onto perl object classes
\& VM::EC2::ReservationSet            \-\- Hidden class used for describe_instances() request;
\&                                        The reservation Ids are copied into the Instance
\&                                         object.
.Ve
.PP
There is also a high-level \s-1API\s0 called \*(L"VM::EC2::Staging::Manager\*(R" for
managing groups of staging servers and volumes which greatly
simplifies the task of creating and updating instances that mount
multiple volumes. The \s-1API\s0 also provides a one-line command for
migrating EBS-backed AMIs from one zone to another. See
VM::EC2::Staging::Manager.
.PP
The interface provided by these modules is based on that described at
http://docs.amazonwebservices.com/AWSEC2/latest/APIReference/. The
following caveats apply:
.PP
.Vb 5
\& 1) Not all of the Amazon API is currently implemented. Specifically,
\&    a handful calls dealing with cluster management and VM importing
\&    are missing.  See L</MISSING METHODS> for a list of all the
\&    unimplemented API calls. Volunteers to fill in these gaps are
\&    most welcome!
\&
\& 2) For consistency with common Perl coding practices, method calls
\&    are lowercase and words in long method names are separated by
\&    underscores. The Amazon API prefers mixed case.  So in the Amazon
\&    API the call to fetch instance information is "DescribeInstances",
\&    while in VM::EC2, the method is "describe_instances". To avoid
\&    annoyance, if you use the mixed case form for a method name, the
\&    Perl autoloader will automatically translate it to underscores for
\&    you, and vice\-versa; this means you can call either
\&    $ec2\->describe_instances() or $ec2\->DescribeInstances().
\&
\& 3) Named arguments passed to methods are all lowercase, use
\&    underscores to separate words and start with hyphens.
\&    In other words, if the AWS API calls for an argument named
\&    "InstanceId" to be passed to the "DescribeInstances" call, then
\&    the corresponding Perl function will look like:
\&
\&         $instance = $ec2\->describe_instances(\-instance_id=>\*(Aqi\-12345\*(Aq)
\&
\&    In most cases automatic case translation will be performed for you
\&    on arguments. So in the previous example, you could use
\&    \-InstanceId as well as \-instance_id. The exception
\&    is when an absurdly long argument name was replaced with an 
\&    abbreviated one as described below. In this case, you must use
\&    the documented argument name.
\&
\&    In a small number of cases, when the parameter name was absurdly
\&    long, it has been abbreviated. For example, the
\&    "Placement.AvailabilityZone" parameter has been represented as
\&    \-placement_zone and not \-placement_availability_zone. See the
\&    documentation for these cases.
\&
\& 4) For each of the describe_foo() methods (where "foo" is a type of
\&    resource such as "instance"), you can fetch the resource by using
\&    their IDs either with the long form:
\&
\&          $ec2\->describe_foo(\-foo_id=>[\*(Aqa\*(Aq,\*(Aqb\*(Aq,\*(Aqc\*(Aq]),
\&
\&    or a shortcut form: 
\&
\&          $ec2\->describe_foo(\*(Aqa\*(Aq,\*(Aqb\*(Aq,\*(Aqc\*(Aq);
\&
\&    Both forms are listed in the headings in the documentation.
\&
\& 5) When the API calls for a list of arguments named Arg.1, Arg.2,
\&    then the Perl interface allows you to use an anonymous array for
\&    the consecutive values. For example to call describe_instances()
\&    with multiple instance IDs, use:
\&
\&       @i = $ec2\->describe_instances(\-instance_id=>[\*(Aqi\-12345\*(Aq,\*(Aqi\-87654\*(Aq])
\&
\& 6) All Filter arguments are represented as a \-filter argument whose value is
\&    an anonymous hash:
\&
\&       @i = $ec2\->describe_instances(\-filter=>{architecture=>\*(Aqi386\*(Aq,
\&                                               \*(Aqtag:Name\*(Aq  =>\*(AqWebServer\*(Aq})
\&
\&    If there are no other arguments you wish to pass, you can omit the
\&    \-filter argument and just pass a hashref:
\&
\&       @i = $ec2\->describe_instances({architecture=>\*(Aqi386\*(Aq,
\&                                      \*(Aqtag:Name\*(Aq  =>\*(AqWebServer\*(Aq})
\&
\&    For any filter, you may represent multiple OR arguments as an arrayref:
\&
\&      @i = $ec2\->describe\-instances({\*(Aqinstance\-state\-name\*(Aq=>[\*(Aqstopped\*(Aq,\*(Aqterminated\*(Aq]})
\&
\&    When adding or removing tags, the \-tag argument uses the same syntax.
\&
\& 7) The tagnames of each XML object returned from AWS are converted into methods
\&    with the same name and typography. So the <privateIpAddress> tag in a
\&    DescribeInstancesResponse, becomes:
\&
\&           $instance\->privateIpAddress
\&
\&    You can also use the more Perlish form \-\- this is equivalent:
\&
\&          $instance\->private_ip_address
\&
\&    Methods that correspond to complex objects in the XML hierarchy
\&    return the appropriate Perl object. For example, an instance\*(Aqs
\&    blockDeviceMapping() method returns an object of type
\&    VM::EC2::BlockDevice::Mapping.
\&
\&    All objects have a fields() method that will return the XML
\&    tagnames listed in the AWS specifications.
\&
\&      @fields = sort $instance\->fields;
\&      # \*(AqamiLaunchIndex\*(Aq, \*(Aqarchitecture\*(Aq, \*(AqblockDeviceMapping\*(Aq, ...
\&
\& 8) Whenever an object has a unique ID, string overloading is used so that 
\&    the object interpolates the ID into the string. For example, when you
\&    print a VM::EC2::Volume object, or use it in another string context,
\&    then it will appear as the string "vol\-123456". Nevertheless, it will
\&    continue to be usable for method calls.
\&
\&         ($v) = $ec2\->describe_volumes();
\&         print $v,"\en";                 # prints as "vol\-123456"
\&         $zone = $v\->availabilityZone;  # acts like an object
\&
\& 9) Many objects have convenience methods that invoke the AWS API on your
\&    behalf. For example, instance objects have a current_status() method that returns
\&    the run status of the object, as well as start(), stop() and terminate()
\&    methods that control the instance\*(Aqs lifecycle.
\&
\&         if ($instance\->current_status eq \*(Aqrunning\*(Aq) {
\&             $instance\->stop;
\&         }
\&
\& 10) Calls to AWS that have failed for one reason or another (invalid
\&    arguments, communications problems, service interruptions) will
\&    return undef and set the VM::EC2\->is_error() method to true. The
\&    error message and its code can then be recovered by calling
\&    VM::EC2\->error.
\&
\&      $i = $ec2\->describe_instance(\*(Aqi\-123456\*(Aq);
\&      unless ($i) {
\&          warn \*(AqGot no instance. Message was: \*(Aq,$ec2\->error;
\&      }
\&
\&    You may also elect to raise an exception when an error occurs.
\&    See the new() method for details.
.Ve
.SH "ASYNCHRONOUS CALLS"
.IX Header "ASYNCHRONOUS CALLS"
As of version 1.24, \s-1VM::EC2\s0 supports asynchronous calls to \s-1AWS\s0 using
AnyEvent::HTTP. This allows you to make multiple calls in parallel for
a significant improvement in performance.
.PP
In asynchronous mode, \s-1VM::EC2\s0 calls that ordinarily wait for \s-1AWS\s0 to
respond and then return objects corresponding to \s-1EC2\s0 instances,
volumes, images, and so forth, will instead immediately return an
AnyEvent condition variable. You can retrieve the result of the call
by calling the condition variable's \fIrecv()\fR method, or by setting a
callback to be executed when the call is complete.
.PP
To make an asynchronous call, you can set the global variable
\&\f(CW$VM::EC2::ASYNC\fR to a true value
.PP
Here is an example of a normal synchronous call:
.PP
.Vb 1
\& my @instances = $ec2\->describe_instances();
.Ve
.PP
Here is the asynchronous version initiated after setting
\&\f(CW$VM::EC2::ASYNC\fR (using a local block to limit its effects).
.PP
.Vb 5
\& {
\&    local $VM::EC2::ASYNC=1;
\&    my $cv = $ec2\->describe_instances();   # returns immediately
\&    my @instances = $cv\->recv;
\& }
.Ve
.PP
In case of an error \fIrecv()\fR will return undef and the error object can
be recovered using the condition variable's \fIerror()\fR method (this is an
enhancement over AnyEvent's standard condition variable class):
.PP
.Vb 2
\& my @instances = $cv\->recv 
\&    or die "No instances found! error = ",$cv\->error();
.Ve
.PP
You may attach a callback \s-1CODE\s0 reference to the condition variable using
its \fIcb()\fR method, in which case the callback will be invoked when the
APi call is complete. The callback will be invoked with a single
argument consisting of the condition variable. Ordinarily you will
call \fIrecv()\fR on the variable and then do something with the result:
.PP
.Vb 8
\& {
\&   local $VM::EC2::ASYNC=1;
\&   my $cv = $ec2\->describe_instances();
\&   $cv\->cb(sub {my $v = shift;
\&                my @i = $v\->recv;
\&                print "instances = @i\en"; 
\&                });
\&  }
.Ve
.PP
For callbacks to be invoked, someone must be run an event loop
using one of the event frameworks that AnyEvent supports (e.g. Coro,
Tk or Gtk). Alternately, you may simply run:
.PP
.Vb 1
\& AnyEvent\->condvar\->recv();
.Ve
.PP
If \f(CW$VM::EC2::ASYNC\fR is false, you can issue a single asynchronous call
by appending \*(L"_async\*(R" to the name of the method call. Similarly, if
\&\f(CW$VM::EC2::ASYNC\fR is true, you can make a single normal synchrous call
by appending \*(L"_sync\*(R" to the method name.
.PP
For example, this is equivalent to the above:
.PP
.Vb 2
\& my $cv = $ec2\->describe_instances_async();  # returns immediately
\& my @instances = $cv\->recv;
.Ve
.PP
You may stack multiple asynchronous calls on top of one another. When
you call \fIrecv()\fR on any of the returned condition variables, they will
all run in parallel. Hence the three calls will take no longer than
the longest individual one:
.PP
.Vb 4
\& my $cv1 = $ec2\->describe_instances_async({\*(Aqinstance\-state\-name\*(Aq=>\*(Aqrunning\*(Aq});
\& my $cv2 = $ec2\->describe_instances_async({\*(Aqinstance\-state\-name\*(Aq=>\*(Aqstopped\*(Aq});
\& my @running = $cv1\->recv;
\& my @stopped = $cv2\->recv;
.Ve
.PP
Same thing with callbacks:
.PP
.Vb 3
\& my (@running,@stopped);
\& my $cv1 = $ec2\->describe_instances_async({\*(Aqinstance\-state\-name\*(Aq=>\*(Aqrunning\*(Aq});
\& $cv1\->cb(sub {@running = shift\->recv});
\&
\& my $cv2 = $ec2\->describe_instances_async({\*(Aqinstance\-state\-name\*(Aq=>\*(Aqstopped\*(Aq});
\& $cv1\->cb(sub {@stopped = shift\->recv});
\&
\& AnyEvent\->condvar\->recv;
.Ve
.PP
And here it is using a group conditional variable to block until all
pending \fIdescribe_instances()\fR requests have completed:
.PP
.Vb 10
\& my %instances;
\& my $group = AnyEvent\->condvar;
\& $group\->begin;
\& for my $state (qw(pending running stopping stopped)) {
\&    $group\->begin;
\&    my $cv = $ec2\->describe_instances_async({\*(Aqinstance\-state\-name\*(Aq=>$state});
\&    $cv\->cb(sub {my @i = shift\->recv;
\&                 $instances{$state}=\e@i;
\&                 $group\->end});
\& }
\& $group\->recv;
\& # when we get here %instances will be populated by all instances,
\& # sorted by their state.
.Ve
.PP
If this looks mysterious, please consult AnyEvent for full
documentation and examples.
.PP
Lastly, be advised that some of the objects returned by calls to
\&\s-1VM::EC2,\s0 such as the VM::EC2::Instance object, will make their own
calls into \s-1VM::EC2\s0 for certain methods. Some of these methods will
block (be synchronous) of necessity, even if you have set
\&\f(CW$VM::EC2::ASYNC\fR. For example, the instance object's \fIcurrent_status()\fR
method must block in order to update the object and return the current
status. Other object methods may behave unpredictably in async
mode. Caveat emptor!
.SH "API GROUPS"
.IX Header "API GROUPS"
The extensive (and growing) Amazon \s-1API\s0 has many calls that you may
never need. To avoid the performance overhead of loading the
interfaces to all these calls, you may use Perl's import mechanism to
load only those modules you care about. By default, all methods are
loaded.
.PP
Loading is controlled by the \*(L"use\*(R" import list, and follows the
conventions described in the Exporter module:
.PP
.Vb 1
\& use VM::EC2;                     # load all methods!
\&
\& use VM::EC2 \*(Aqkey\*(Aq,\*(Aqelastic_ip\*(Aq;  # load Key Pair and Elastic IP
\&                                  # methods only
\&
\& use VM::EC2 \*(Aq:standard\*(Aq;         # load all the standard methods
\&
\& use VM::EC2 \*(Aq:standard\*(Aq,\*(Aq!key\*(Aq;  # load standard methods but not Key Pair
.Ve
.PP
Related \s-1API\s0 calls are grouped together using the scheme described at
http://docs.aws.amazon.com/AWSEC2/latest/APIReference/OperationList\-query.html. The
modules that define the \s-1API\s0 calls can be found in \s-1VM/EC2/REST/\s0; you
can read their documentation by running perldoc \s-1VM::EC2::REST::\s0\*(L"name
of module\*(R":
.PP
.Vb 1
\& perldoc VM::EC2::REST::elastic_ip
.Ve
.PP
The groups that you can import are as follows:
.PP
.Vb 2
\& :standard => ami, ebs, elastic_ip, instance, keys, general,
\&              monitoring, tag, security_group, security_token, zone
\&
\& :vpc      => customer_gateway, dhcp, elastic_network_interface, 
\&              private_ip, internet_gateway, network_acl, route_table,
\&              vpc, vpn, vpn_gateway
\&
\& :misc     => devpay, monitoring, reserved_instance,
\&              spot_instance, vm_export, vm_import, windows
\&
\& :scaling  => elastic_load_balancer,autoscaling
\&
\& :hpc      => placement_group
\&
\& :all      => :standard, :vpn, :misc
\&
\& :DEFAULT  => :all
.Ve
.PP
The individual modules are:
.PP
.Vb 10
\& ami               \-\- Control Amazon Machine Images
\& autoscaling       \-\- Control autoscaling
\& customer_gateway  \-\- VPC/VPN gateways
\& devpay            \-\- DevPay API
\& dhcp              \-\- VPC DHCP options
\& ebs               \-\- Elastic Block Store volumes & snapshots
\& elastic_ip        \-\- Elastic IP addresses
\& elastic_load_balancer \-\- The Elastic Load Balancer service
\& elastic_network_interface \-\- VPC Elastic Network Interfaces
\& general           \-\- Get console output and account attributes
\& instance          \-\- Control EC2 instances
\& internet_gateway  \-\- VPC connections to the internet
\& keys              \-\- Manage SSH keypairs
\& monitoring        \-\- Control instance monitoring
\& network_acl       \-\- Control VPC network access control lists
\& placement_group   \-\- Control the placement of HPC instances
\& private_ip        \-\- VPC private IP addresses
\& reserved_instance \-\- Reserve instances and view reservations
\& route_table       \-\- VPC network routing
\& security_group    \-\- Security groups for VPCs and normal instances
\& security_token    \-\- Temporary credentials for use with IAM roles
\& spot_instance     \-\- Request and manage spot instances
\& subnet            \-\- VPC subnets
\& tag               \-\- Create and interrogate resource tags.
\& vm_export         \-\- Export VMs
\& vm_import         \-\- Import VMs
\& vpc               \-\- Create and manipulate virtual private clouds
\& vpn_gateway       \-\- Create and manipulate VPN gateways within VPCs
\& vpn               \-\- Create and manipulate VPNs within VPCs
\& windows           \-\- Windows operating system\-specific API calls.
\& zone              \-\- Interrogate availability zones
.Ve
.SH "EXAMPLE SCRIPT"
.IX Header "EXAMPLE SCRIPT"
The script sync_to_snapshot.pl, distributed with this module,
illustrates a relatively complex set of steps on \s-1EC2\s0 that does
something useful. Given a list of directories or files on the local
filesystem it copies the files into an \s-1EBS\s0 snapshot with the desired
name by executing the following steps:
.PP
1. Provisions a new \s-1EBS\s0 volume on \s-1EC2\s0 large enough to hold the data.
.PP
2. Spins up a staging instance to manage the network transfer of data
from the local machine to the staging volume.
.PP
3. Creates a temporary ssh keypair and a security group that allows an
rsync-over-ssh.
.PP
4. Formats and mounts the volume if necessary.
.PP
5. Initiates an rsync-over-ssh for the designated files and
directories.
.PP
6. Unmounts and snapshots the volume.
.PP
7. Cleans up.
.PP
If a snapshot of the same name already exists, then it is used to
create the staging volume, enabling network-efficient synchronization
of the files. A snapshot tag named \*(L"Version\*(R" is incremented each time
you synchronize.
.SH "CORE METHODS"
.IX Header "CORE METHODS"
This section describes the \s-1VM::EC2\s0 constructor, accessor methods, and
methods relevant to error handling.
.ie n .SS "$ec2 = \s-1VM::EC2\-\s0>new(\-access_key=>$id,\-secret_key=>$key,\-endpoint=>$url)"
.el .SS "\f(CW$ec2\fP = \s-1VM::EC2\-\s0>new(\-access_key=>$id,\-secret_key=>$key,\-endpoint=>$url)"
.IX Subsection "$ec2 = VM::EC2->new(-access_key=>$id,-secret_key=>$key,-endpoint=>$url)"
Create a new Amazon access object. Required arguments are:
.PP
.Vb 1
\& \-access_key   Access ID for an authorized user
\&
\& \-secret_key   Secret key corresponding to the Access ID
\&
\& \-security_token Temporary security token obtained through a call to the
\&               AWS Security Token Service
\&
\& \-endpoint     The URL for making API requests
\&
\& \-region       The region to receive the API requests
\&
\& \-raise_error  If true, throw an exception.
\&
\& \-print_error  If true, print errors to STDERR.
.Ve
.PP
One or more of \-access_key or \-secret_key can be omitted if the
environment variables \s-1EC2_ACCESS_KEY\s0 and \s-1EC2_SECRET_KEY\s0 are
defined. If no endpoint is specified, then the environment variable
\&\s-1EC2_URL\s0 is consulted; otherwise the generic endpoint
http://ec2.amazonaws.com/ is used. You can also select the endpoint by
specifying one of the Amazon regions, such as \*(L"us\-west\-2\*(R", with the
\&\-region argument. The endpoint specified by \-region will override
\&\-endpoint.
.PP
\&\-security_token is used in conjunction with temporary security tokens
returned by \f(CW$ec2\fR\->\fIget_federation_token()\fR and \f(CW$ec2\fR\->\fIget_session_token()\fR
to grant restricted, time-limited access to some or all your \s-1EC2\s0
resources to users who do not have access to your account. If you pass
either a VM::EC2::Security::Token object, or the
VM::EC2::Security::Credentials object contained within the token
object, then \fInew()\fR does not need the \-access_key or \-secret_key
arguments. You may also pass a session token string scalar to
\&\-security_token, in which case you must also pass the access key \s-1ID\s0
and secret keys generated at the same time the session token was
created. See
http://docs.amazonwebservices.com/AWSEC2/latest/UserGuide/UsingIAM.html
and \*(L"\s-1AWS SECURITY TOKENS\*(R"\s0.
.PP
To use an Open Stack cloud, please provide the appropriate endpoint
\&\s-1URL.\s0
.PP
By default, when the Amazon \s-1API\s0 reports an error, such as attempting
to perform an invalid operation on an instance, the corresponding
method will return empty and the error message can be recovered from
\&\f(CW$ec2\fR\->\fIerror()\fR. However, if you pass \-raise_error=>1 to \fInew()\fR, the module
will instead raise a fatal error, which you can trap with eval{} and
report with $@:
.PP
.Vb 5
\&  eval {
\&     $ec2\->some_dangerous_operation();
\&     $ec2\->another_dangerous_operation();
\&  };
\&  print STDERR "something bad happened: $@" if $@;
.Ve
.PP
The error object can be retrieved with \f(CW$ec2\fR\->\fIerror()\fR as before.
.ie n .SS "$access_key = $ec2\->access_key([$new_access_key])"
.el .SS "\f(CW$access_key\fP = \f(CW$ec2\fP\->access_key([$new_access_key])"
.IX Subsection "$access_key = $ec2->access_key([$new_access_key])"
Get or set the \s-1ACCESS KEY.\s0 In this and all similar get/set methods,
call the method with no arguments to get the current value, and with a
single argument to change the value:
.PP
.Vb 2
\& $current_key = $ec2\->access_key;
\& $ec2\->access_key(\*(AqXYZZY\*(Aq);
.Ve
.PP
In the case of setting the value, these methods will return the old
value as their result:
.PP
.Vb 1
\& $old_key = $ec2\->access_key($new_key);
.Ve
.ie n .SS "$secret = $ec2\->secret([$new_secret])"
.el .SS "\f(CW$secret\fP = \f(CW$ec2\fP\->secret([$new_secret])"
.IX Subsection "$secret = $ec2->secret([$new_secret])"
Get or set the \s-1SECRET KEY\s0
.ie n .SS "$secret = $ec2\->security_token([$new_token])"
.el .SS "\f(CW$secret\fP = \f(CW$ec2\fP\->security_token([$new_token])"
.IX Subsection "$secret = $ec2->security_token([$new_token])"
Get or set the temporary security token. See \*(L"\s-1AWS SECURITY TOKENS\*(R"\s0.
.ie n .SS "$endpoint = $ec2\->endpoint([$new_endpoint])"
.el .SS "\f(CW$endpoint\fP = \f(CW$ec2\fP\->endpoint([$new_endpoint])"
.IX Subsection "$endpoint = $ec2->endpoint([$new_endpoint])"
Get or set the \s-1ENDPOINT URL.\s0
.ie n .SS "$region = $ec2\->region([$new_region])"
.el .SS "\f(CW$region\fP = \f(CW$ec2\fP\->region([$new_region])"
.IX Subsection "$region = $ec2->region([$new_region])"
Get or set the \s-1EC2\s0 region manipulated by this module. This has the side effect
of changing the endpoint.
.ie n .SS "$ec2\->raise_error($boolean)"
.el .SS "\f(CW$ec2\fP\->raise_error($boolean)"
.IX Subsection "$ec2->raise_error($boolean)"
Change the handling of error conditions. Pass a true value to cause
Amazon \s-1API\s0 errors to raise a fatal error. Pass false to make methods
return undef. In either case, you can detect the error condition
by calling \fIis_error()\fR and fetch the error message using \fIerror()\fR. This
method will also return the current state of the raise error flag.
.ie n .SS "$ec2\->print_error($boolean)"
.el .SS "\f(CW$ec2\fP\->print_error($boolean)"
.IX Subsection "$ec2->print_error($boolean)"
Change the handling of error conditions. Pass a true value to cause
Amazon \s-1API\s0 errors to print error messages to \s-1STDERR.\s0 Pass false to
cancel this behavior.
.ie n .SS "$boolean = $ec2\->is_error"
.el .SS "\f(CW$boolean\fP = \f(CW$ec2\fP\->is_error"
.IX Subsection "$boolean = $ec2->is_error"
If a method fails, it will return undef. However, some methods, such
as \fIdescribe_images()\fR, will also return undef if no resources matches
your search criteria. Call \fIis_error()\fR to distinguish the two
eventualities:
.PP
.Vb 5
\&  @images = $ec2\->describe_images(\-owner=>\*(Aq29731912785\*(Aq);
\&  unless (@images) {
\&      die "Error: ",$ec2\->error if $ec2\->is_error;
\&      print "No appropriate images found\en";
\&  }
.Ve
.ie n .SS "$err = $ec2\->error"
.el .SS "\f(CW$err\fP = \f(CW$ec2\fP\->error"
.IX Subsection "$err = $ec2->error"
If the most recently-executed method failed, \f(CW$ec2\fR\->\fIerror()\fR will return
the error code and other descriptive information. This method will
return undef if the most recently executed method was successful.
.PP
The returned object is actually an AWS::Error object, which
has two methods named \fIcode()\fR and \fImessage()\fR. If used in a string
context, its operator overloading returns the composite string
\&\*(L"$message [$code]\*(R".
.ie n .SS "$err = $ec2\->error_str"
.el .SS "\f(CW$err\fP = \f(CW$ec2\fP\->error_str"
.IX Subsection "$err = $ec2->error_str"
Same as \fIerror()\fR except it returns the string representation, not the
object. This works better in debuggers and exception handlers.
.ie n .SS "$account_id = $ec2\->account_id"
.el .SS "\f(CW$account_id\fP = \f(CW$ec2\fP\->account_id"
.IX Subsection "$account_id = $ec2->account_id"
Looks up the account \s-1ID\s0 corresponding to the credentials provided when
the \s-1VM::EC2\s0 instance was created. The way this is done is to fetch the
\&\*(L"default\*(R" security group, which is guaranteed to exist, and then
return its groupId field. The result is cached so that subsequent
accesses are fast.
.ie n .SS "$account_id = $ec2\->userId"
.el .SS "\f(CW$account_id\fP = \f(CW$ec2\fP\->userId"
.IX Subsection "$account_id = $ec2->userId"
Same as above, for convenience.
.ie n .SS "$new_ec2 = $ec2\->clone"
.el .SS "\f(CW$new_ec2\fP = \f(CW$ec2\fP\->clone"
.IX Subsection "$new_ec2 = $ec2->clone"
This method creates an identical copy of the \s-1EC2\s0 object. It is used
occasionally internally for creating an \s-1EC2\s0 object in a different \s-1AWS\s0
region:
.PP
.Vb 2
\& $singapore = $ec2\->clone;
\& $singapore\->region(\*(Aqap\-souteast\-1\*(Aq);
.Ve
.SH "INSTANCES"
.IX Header "INSTANCES"
Load the 'instances' module to bring in methods for interrogating,
launching and manipulating \s-1EC2\s0 instances. This module is part of
the ':standard' \s-1API\s0 group. The methods are described in detail in
VM::EC2::REST::instance. Briefly:
.PP
.Vb 11
\& @i = $ec2\->describe_instances(\-instance_id=>\e@ids,\-filter=>\e%filters)
\& @i = $ec2\->run_instances(\-image_id=>$id,%other_args)
\& @s = $ec2\->start_instances(\-instance_id=>\e@instance_ids)
\& @s = $ec2\->stop_instances(\-instance_id=>\e@instance_ids,\-force=>1)
\& @s = $ec2\->reboot_instances(\-instance_id=>\e@instance_ids)
\& $b = $ec2\->confirm_product_instance($instance_id,$product_code)
\& $m = $ec2\->instance_metadata
\& @d = $ec2\->describe_instance_attribute($instance_id,$attribute)
\& $b = $ec2\->modify_instance_attribute($instance_id,\-$attribute_name=>$value)
\& $b = $ec2\->reset_instance_attribute($instance_id,$attribute)
\& @s = $ec2\->describe_instance_status(\-instance_id=>\e@ids,\-filter=>\e%filters,%other_args);
.Ve
.SH "VOLUMES"
.IX Header "VOLUMES"
Load the 'ebs' module to bring in methods specific for elastic block
storage volumes and snapshots. This module is part of the ':standard'
\&\s-1API\s0 group. The methods are described in detail in
VM::EC2::REST::ebs. Briefly:
.PP
.Vb 10
\& @v = $ec2\->describe_volumes(\-volume_id=>\e@ids,\-filter=>\e%filters)
\& $v = $ec2\->create_volume(%args)
\& $b = $ec2\->delete_volume($volume_id)
\& $a = $ec2\->attach_volume($volume_id,$instance_id,$device)
\& $a = $ec2\->detach_volume($volume_id)
\& $ec2\->wait_for_attachments(@attachment)
\& @v = $ec2\->describe_volume_status(\-volume_id=>\e@ids,\-filter=>\e%filters)
\& $ec2\->wait_for_volumes(@volumes)
\& @d = $ec2\->describe_volume_attribute($volume_id,$attribute)
\& $b = $ec2\->enable_volume_io(\-volume_id=>$volume_id)
\& @s = $ec2\->describe_snapshots(\-snapshot_id=>\e@ids,%other_args)
\& @d = $ec2\->describe_snapshot_attribute($snapshot_id,$attribute)
\& $b = $ec2\->modify_snapshot_attribute($snapshot_id,\-$argument=>$value)
\& $b = $ec2\->reset_snapshot_attribute($snapshot_id,$attribute)
\& $s = $ec2\->create_snapshot(\-volume_id=>$vol,\-description=>$desc)
\& $b = $ec2\->delete_snapshot($snapshot_id) 
\& $s = $ec2\->copy_snapshot(\-source_region=>$region,\-source_snapshot_id=>$id,\-description=>$desc)
\& $ec2\->wait_for_snapshots(@snapshots)
.Ve
.SH "AMAZON MACHINE IMAGES"
.IX Header "AMAZON MACHINE IMAGES"
Load the 'ami' module to bring in methods for creating and
manipulating Amazon Machine Images. This module is part of the
\&':standard" group. Full details are in VM::EC2::REST::ami. Briefly:
.PP
.Vb 7
\& @i = $ec2\->describe_images(@image_ids)
\& $i = $ec2\->create_image(\-instance_id=>$id,\-name=>$name,%other_args)
\& $i = $ec2\->register_image(\-name=>$name,%other_args)
\& $r = $ec2\->deregister_image($image_id)
\& @d = $ec2\->describe_image_attribute($image_id,$attribute)
\& $b = $ec2\->modify_image_attribute($image_id,\-$attribute_name=>$value)
\& $b = $ec2\->reset_image_attribute($image_id,$attribute_name)
.Ve
.SH "KEYS"
.IX Header "KEYS"
Load the 'keys' module to bring in methods for creating and
manipulating \s-1SSH\s0 keypairs. This module is loaded with the ':standard'
group and documented in VM::EC2::REST::keys.
.PP
.Vb 4
\& @k = $ec2\->describe_key_pairs(@names);
\& $k = $ec2\->create_key_pair($name)
\& $k = $ec2\->import_key_pair($name,$public_key) 
\& $b = $ec2\->delete_key_pair($name)
.Ve
.SH "TAGS"
.IX Header "TAGS"
The methods in this module (loaded with ':standard') allow you to
create, delete and fetch resource tags. You may find that you rarely
need to use these methods directly because every object produced by
\&\s-1VM::EC2\s0 supports a simple tag interface:
.PP
.Vb 5
\&  $object = $ec2\->describe_volumes(\-volume_id=>\*(Aqvol\-12345\*(Aq); # e.g.
\&  $tags = $object\->tags();
\&  $name = $tags\->{Name};
\&  $object\->add_tags(Role => \*(AqWeb Server\*(Aq, Status=>\*(Aqdevelopment);
\&  $object\->delete_tags(Name=>undef);
.Ve
.PP
See VM::EC2::Generic for a full description of the uniform object
tagging interface, and VM::EC2::REST::tag for methods that allow
you to manipulate the tags on multiple objects simultaneously. The
methods defined by this module are:
.PP
.Vb 3
\& @t = $ec2\->describe_tags(\-filter=>\e%filters);
\& $b = $ec2\->create_tags(\-resource_id=>\e@ids,\-tag=>{key1=>value1...})
\& $b = $ec2\->delete_tags(\-resource_id=>$id1,\-tag=>{key1=>value1...})
.Ve
.SH "VIRTUAL PRIVATE CLOUDS"
.IX Header "VIRTUAL PRIVATE CLOUDS"
\&\s-1EC2\s0 virtual private clouds (VPCs) provide facilities for creating
tiered applications combining public and private subnetworks, and for
extending your home/corporate network into the cloud. VPC-related
methods are defined in the customer_gateway, dhcp,
elastic_network_interface, private_ip, internet_gateway, network_acl,
route_table, vpc, vpn, and vpn_gateway modules, and are loaded by
importing ':vpc'. See VM::EC2::REST::vpc for an introduction.
.PP
The \s-1VM::EC2::VPC\s0 and VM::EC2::VPC::Subnet modules define
convenience methods that simplify working with \s-1VPC\s0 objects. This
allows for steps that typically follow each other, such as creating a
route table and associating it with a subnet, happen
automatically. For example, this series of calls creates a \s-1VPC\s0 with a
single subnet, creates an Internet gateway attached to the \s-1VPC,\s0
associates a new route table with the subnet and then creates a
default route from the subnet to the Internet gateway:
.PP
.Vb 5
\& $vpc       = $ec2\->create_vpc(\*(Aq10.0.0.0/16\*(Aq)     or die $ec2\->error_str;
\& $subnet1   = $vpc\->create_subnet(\*(Aq10.0.0.0/24\*(Aq)  or die $vpc\->error_str;
\& $gateway   = $vpc\->create_internet_gateway       or die $vpc\->error_str;
\& $routeTbl  = $subnet\->create_route_table         or die $vpc\->error_str;
\& $routeTbl\->create_route(\*(Aq0.0.0.0/0\*(Aq => $gateway) or die $vpc\->error_str;
.Ve
.SH "ELASTIC LOAD BALANCERS (ELB) AND AUTOSCALING"
.IX Header "ELASTIC LOAD BALANCERS (ELB) AND AUTOSCALING"
The methods in the 'elastic_load_balancer' and 'autoscaling' modules
allow you to retrieve information about Elastic Load Balancers, create
new ELBs, and change the properties of the ELBs, as well as define
autoscaling groups and their launch configurations. These modules are
both imported by the ':scaling' import group. See
VM::EC2::REST::elastic_load_balancer and
VM::EC2::REST::autoscaling for descriptions of the facilities
enabled by this module.
.SH "AWS SECURITY POLICY"
.IX Header "AWS SECURITY POLICY"
The VM::EC2::Security::Policy module provides a simple Identity and
Access Management (\s-1IAM\s0) policy statement generator geared for use with
\&\s-1AWS\s0 security tokens (see next section). Its facilities are defined in
VM::EC2::Security::Token.
.SH "AWS SECURITY TOKENS"
.IX Header "AWS SECURITY TOKENS"
\&\s-1AWS\s0 security tokens provide a way to grant temporary access to
resources in your \s-1EC2\s0 space without giving them permanent
accounts. They also provide the foundation for mobile services and
multifactor authentication devices (\s-1MFA\s0). These methods are defined in
\&'security_token', which is part of the ':standard' group. See
VM::EC2::REST::security_token for details. Here is a quick example:
.PP
Here is an example:
.PP
.Vb 9
\& # on your side of the connection
\& $ec2 = VM::EC2\->new(...);  # as usual
\& my $policy = VM::EC2::Security::Policy\->new;
\& $policy\->allow(\*(AqDescribeImages\*(Aq,\*(AqRunInstances\*(Aq);
\& my $token = $ec2\->get_federation_token(\-name     => \*(AqTemporaryUser\*(Aq,
\&                                        \-duration => 60*60*3, # 3 hrs, as seconds
\&                                        \-policy   => $policy);
\& my $serialized = $token\->credentials\->serialize;
\& send_data_to_user_somehow($serialized);
\&
\& # on the temporary user\*(Aqs side of the connection
\& my $serialized = get_data_somehow();
\& my $token = VM::EC2::Security::Credentials\->new_from_serialized($serialized);
\& my $ec2   = VM::EC2\->new(\-security_token => $token);
\& print $ec2\->describe_images(\-owner=>\*(Aqself\*(Aq);
.Ve
.SH "SPOT AND RESERVED INSTANCES"
.IX Header "SPOT AND RESERVED INSTANCES"
The 'spot_instance' and 'reserved_instance' modules allow you to
create and manipulate spot and reserved instances. They are both part
of the ':misc' import group. See VM::EC2::REST::spot_instance and
VM::EC2::REST::reserved_instance. For example:
.PP
.Vb 7
\& @offerings = $ec2\->describe_reserved_instances_offerings(
\&          {\*(Aqavailability\-zone\*(Aq   => \*(Aqus\-east\-1a\*(Aq,
\&           \*(Aqinstance\-type\*(Aq       => \*(Aqc1.medium\*(Aq,
\&           \*(Aqproduct\-description\*(Aq =>\*(AqLinux/UNIX\*(Aq,
\&           \*(Aqduration\*(Aq            => 31536000,  # this is 1 year
\&           });
\& $offerings[0]\->purchase(5) and print "Five reserved instances purchased\en";
.Ve
.SH "WAITING FOR STATE CHANGES"
.IX Header "WAITING FOR STATE CHANGES"
\&\s-1VM::EC2\s0 provides a series of methods that allow your script to wait in
an efficient manner for desired state changes in instances, volumes
and other objects. They are described in detail the individual modules
to which they apply, but in each case the method will block until each
member of a list of objects transitions to a terminal state
(e.g. \*(L"completed\*(R" in the case of a snapshot). Briefly:
.PP
.Vb 4
\& $ec2\->wait_for_instances(@instances)
\& $ec2\->wait_for_snapshots(@snapshots) 
\& $ec2\->wait_for_volumes(@volumes) 
\& $ec2\->wait_for_attachments(@attachment)
.Ve
.PP
There is also a generic version of this defined in the \s-1VM::EC2\s0 core:
.ie n .SS "$ec2\->wait_for_terminal_state(\e@objects,['list','of','states'] [,$timeout])"
.el .SS "\f(CW$ec2\fP\->wait_for_terminal_state(\e@objects,['list','of','states'] [,$timeout])"
.IX Subsection "$ec2->wait_for_terminal_state(@objects,['list','of','states'] [,$timeout])"
Generic version of the last four methods. Wait for all members of the
provided list of Amazon objects instances to reach some terminal state
listed in the second argument, and then return a hash reference that
maps each object \s-1ID\s0 to its final state.
.PP
If a timeout is provided, in seconds, then the method will abort after
waiting the indicated time and return undef.
.ie n .SS "$timeout = $ec2\->wait_for_timeout([$new_timeout]);"
.el .SS "\f(CW$timeout\fP = \f(CW$ec2\fP\->wait_for_timeout([$new_timeout]);"
.IX Subsection "$timeout = $ec2->wait_for_timeout([$new_timeout]);"
Get or change the timeout for \fIwait_for_instances()\fR, \fIwait_for_attachments()\fR,
and \fIwait_for_volumes()\fR. The timeout is given in seconds, and defaults to
600 (10 minutes). You can set this to 0 to wait forever.
.SH "INTERNAL METHODS"
.IX Header "INTERNAL METHODS"
These methods are used internally and are listed here without
documentation (yet).
.ie n .SS "$underscore_name = $ec2\->canonicalize($mixedCaseName)"
.el .SS "\f(CW$underscore_name\fP = \f(CW$ec2\fP\->canonicalize($mixedCaseName)"
.IX Subsection "$underscore_name = $ec2->canonicalize($mixedCaseName)"
.ie n .SS "$instance_id = $ec2\->instance_parm(@args)"
.el .SS "\f(CW$instance_id\fP = \f(CW$ec2\fP\->instance_parm(@args)"
.IX Subsection "$instance_id = $ec2->instance_parm(@args)"
.ie n .SS "@arguments = $ec2\->value_parm(ParameterName => \e%args)"
.el .SS "\f(CW@arguments\fP = \f(CW$ec2\fP\->value_parm(ParameterName => \e%args)"
.IX Subsection "@arguments = $ec2->value_parm(ParameterName => %args)"
.ie n .SS "@arguments = $ec2\->single_parm(ParameterName => \e%args)"
.el .SS "\f(CW@arguments\fP = \f(CW$ec2\fP\->single_parm(ParameterName => \e%args)"
.IX Subsection "@arguments = $ec2->single_parm(ParameterName => %args)"
.ie n .SS "@parameters = $ec2\->prefix_parm($prefix, ParameterName => \e%args)"
.el .SS "\f(CW@parameters\fP = \f(CW$ec2\fP\->prefix_parm($prefix, ParameterName => \e%args)"
.IX Subsection "@parameters = $ec2->prefix_parm($prefix, ParameterName => %args)"
.ie n .SS "@arguments = $ec2\->member_hash_parms(ParameterName => \e%args)"
.el .SS "\f(CW@arguments\fP = \f(CW$ec2\fP\->member_hash_parms(ParameterName => \e%args)"
.IX Subsection "@arguments = $ec2->member_hash_parms(ParameterName => %args)"
Create a parameter list from a hashref or arrayref of hashes
.PP
Created specifically for the \s-1RDS\s0 ModifyDBParameterGroup parameter
\&'Parameters', but may be useful for other calls in the future.
.PP
ie:
.PP
The argument would be in the form:
.PP
.Vb 12
\&   [
\&           {
\&                   ParameterName=>\*(Aqmax_user_connections\*(Aq,
\&                   ParameterValue=>24,
\&                   ApplyMethod=>\*(Aqpending\-reboot\*(Aq
\&           },
\&           {
\&                   ParameterName=>\*(Aqmax_allowed_packet\*(Aq,
\&                   ParameterValue=>1024,
\&                   ApplyMethod=>\*(Aqimmediate\*(Aq
\&           },
\&   ];
.Ve
.PP
The resulting output would be if the argname is '\-parameters':
.PP
Parameters.member.1.ParameterName => max_user_connections
Parameters.member.1.ParameterValue => 24
Parameters.member.1.ApplyMethod => pending-reboot
Parameters.member.2.ParameterName => max_allowed_packet
Parameters.member.2.ParameterValue => 1024
Parameters.member.2.ApplyMethod => immediate
.ie n .SS "@arguments = $ec2\->list_parm(ParameterName => \e%args)"
.el .SS "\f(CW@arguments\fP = \f(CW$ec2\fP\->list_parm(ParameterName => \e%args)"
.IX Subsection "@arguments = $ec2->list_parm(ParameterName => %args)"
.ie n .SS "@parameters = $ec2\->member_list_parm(ParameterName => \e%args)"
.el .SS "\f(CW@parameters\fP = \f(CW$ec2\fP\->member_list_parm(ParameterName => \e%args)"
.IX Subsection "@parameters = $ec2->member_list_parm(ParameterName => %args)"
.ie n .SS "@arguments = $ec2\->filter_parm(\e%args)"
.el .SS "\f(CW@arguments\fP = \f(CW$ec2\fP\->filter_parm(\e%args)"
.IX Subsection "@arguments = $ec2->filter_parm(%args)"
.ie n .SS "@arguments = $ec2\->key_value_parameters($param_name,$keyname,$valuename,\e%args,$skip_undef_values)"
.el .SS "\f(CW@arguments\fP = \f(CW$ec2\fP\->key_value_parameters($param_name,$keyname,$valuename,\e%args,$skip_undef_values)"
.IX Subsection "@arguments = $ec2->key_value_parameters($param_name,$keyname,$valuename,%args,$skip_undef_values)"
.ie n .SS "@arguments = $ec2\->member_key_value_parameters($param_name,$keyname,$valuename,\e%args,$skip_undef_values)"
.el .SS "\f(CW@arguments\fP = \f(CW$ec2\fP\->member_key_value_parameters($param_name,$keyname,$valuename,\e%args,$skip_undef_values)"
.IX Subsection "@arguments = $ec2->member_key_value_parameters($param_name,$keyname,$valuename,%args,$skip_undef_values)"
.ie n .SS "@arguments = $ec2\->launch_perm_parm($prefix,$suffix,$value)"
.el .SS "\f(CW@arguments\fP = \f(CW$ec2\fP\->launch_perm_parm($prefix,$suffix,$value)"
.IX Subsection "@arguments = $ec2->launch_perm_parm($prefix,$suffix,$value)"
.ie n .SS "@arguments = $ec2\->iam_parm($args)"
.el .SS "\f(CW@arguments\fP = \f(CW$ec2\fP\->iam_parm($args)"
.IX Subsection "@arguments = $ec2->iam_parm($args)"
.ie n .SS "@arguments = $ec2\->block_device_parm($block_device_mapping_string)"
.el .SS "\f(CW@arguments\fP = \f(CW$ec2\fP\->block_device_parm($block_device_mapping_string)"
.IX Subsection "@arguments = $ec2->block_device_parm($block_device_mapping_string)"
.ie n .SS "$version = $ec2\->\fIversion()\fP"
.el .SS "\f(CW$version\fP = \f(CW$ec2\fP\->\fIversion()\fP"
.IX Subsection "$version = $ec2->version()"
Returns the \s-1API\s0 version to be sent to the endpoint. Calls
\&\fIguess_version_from_endpoint()\fR to determine this.
.ie n .SS "$version = $ec2\->\fIguess_version_from_endpoint()\fP"
.el .SS "\f(CW$version\fP = \f(CW$ec2\fP\->\fIguess_version_from_endpoint()\fP"
.IX Subsection "$version = $ec2->guess_version_from_endpoint()"
This method attempts to guess what version string to use when
communicating with various endpoints. When talking to endpoints that
contain the string \*(L"Eucalyptus\*(R" uses the old \s-1EC2 API
\&\*(L"2009\-04\-04\*(R".\s0 When talking to other endpoints, uses the latest \s-1EC2\s0
version string.
.ie n .SS "$ts = $ec2\->timestamp"
.el .SS "\f(CW$ts\fP = \f(CW$ec2\fP\->timestamp"
.IX Subsection "$ts = $ec2->timestamp"
.ie n .SS "@obj = $ec2\->call($action,@param);"
.el .SS "\f(CW@obj\fP = \f(CW$ec2\fP\->call($action,@param);"
.IX Subsection "@obj = $ec2->call($action,@param);"
Make a call to Amazon using \f(CW$action\fR and the passed arguments, and
return a list of objects.
.PP
if \f(CW$VM::EC2::ASYNC\fR is set to true, then will return a
AnyEvent::CondVar object instead of a list of objects. You may
retrieve the objects by calling \fIrecv()\fR or setting a callback:
.PP
.Vb 3
\&    $VM::EC2::ASYNC = 1;
\&    my $cv  = $ec2\->call(\*(AqDescribeInstances\*(Aq);
\&    my @obj = $cv\->recv;
.Ve
.PP
or
.PP
.Vb 5
\&    $VM::EC2::ASYNC = 1;
\&    my $cv  = $ec2\->call(\*(AqDescribeInstances\*(Aq);
\&    $cv\->cb(sub { my @objs = shift\->recv;
\&                  do_something(@objs);
\&                });
.Ve
.ie n .SS "$url = $ec2\->login_url(\-credentials => $credentials, \-issuer => $issuer_url, \-destination => $console_url);"
.el .SS "\f(CW$url\fP = \f(CW$ec2\fP\->login_url(\-credentials => \f(CW$credentials\fP, \-issuer => \f(CW$issuer_url\fP, \-destination => \f(CW$console_url\fP);"
.IX Subsection "$url = $ec2->login_url(-credentials => $credentials, -issuer => $issuer_url, -destination => $console_url);"
Returns an HTTP::Request object that points to the \s-1URL\s0 to login a user with \s-1STS\s0 credentials
.PP
.Vb 6
\&  \-credentials => $fed_token\->credentials \- Credentials from an $ec2\->get_federation_token call
\&  \-token => $token                        \- a SigninToken from $ec2\->get_signin_token call
\&  \-issuer => $issuer_url
\&  \-destination => $console_url            \- URL of the AWS console. Defaults to https://console.aws.amazon.com/console/home
\&  \-auto_scaling_group_names     List of auto scaling groups to describe
\&  \-names                        Alias of \-auto_scaling_group_names
.Ve
.PP
\&\-credentials or \-token are required for this method to work
.PP
Usage can be:
.PP
.Vb 3
\&  my $fed_token = $ec2\->get_federation_token(...);
\&  my $token = $ec2\->get_signin_token(\-credentials => $fed_token\->credentials);
\&  my $url = $ec2\->login_url(\-token => $token\->{SigninToken}, \-issuer => $issuer_url, \-destination => $console_url);
.Ve
.PP
Or:
.PP
.Vb 2
\&  my $fed_token = $ec2\->get_federation_token(...);
\&  my $url = $ec2\->login_url(\-credentials => $fed_token\->credentials, \-issuer => $issuer_url, \-destination => $console_url);
.Ve
.ie n .SS "$request = $ec2\->_sign(@args)"
.el .SS "\f(CW$request\fP = \f(CW$ec2\fP\->_sign(@args)"
.IX Subsection "$request = $ec2->_sign(@args)"
Create and sign an HTTP::Request.
.ie n .SS "@param = $ec2\->args(ParamName=>@_)"
.el .SS "\f(CW@param\fP = \f(CW$ec2\fP\->args(ParamName=>@_)"
.IX Subsection "@param = $ec2->args(ParamName=>@_)"
Set up calls that take either method(\-resource_id=>'foo') or method('foo').
.SH "OTHER INFORMATION"
.IX Header "OTHER INFORMATION"
This section contains technical information that may be of interest to developers.
.SS "Signing and authentication protocol"
.IX Subsection "Signing and authentication protocol"
This module uses Amazon \s-1AWS\s0 signing protocol version 2, as described at
http://docs.amazonwebservices.com/AWSEC2/latest/UserGuide/index.html?using\-query\-api.html.
It uses the HmacSHA256 signature method, which is the most secure
method currently available. For additional security, use \*(L"https\*(R" for
the communications endpoint:
.PP
.Vb 1
\&  $ec2 = VM::EC2\->new(\-endpoint=>\*(Aqhttps://ec2.amazonaws.com\*(Aq);
.Ve
.SS "Subclassing \s-1VM::EC2\s0 objects"
.IX Subsection "Subclassing VM::EC2 objects"
To subclass \s-1VM::EC2\s0 objects (or implement your own from scratch) you
will need to override the object dispatch mechanism. Fortunately this
is very easy. After \*(L"use \s-1VM::EC2\*(R"\s0 call
VM::EC2::Dispatch\->\fIregister()\fR one or more times:
.PP
.Vb 1
\& VM::EC2::Dispatch\->register($call_name => $dispatch).
.Ve
.PP
The first argument, \f(CW$call_name\fR, is name of the Amazon \s-1API\s0 call, such as \*(L"DescribeImages\*(R".
.PP
The second argument, \f(CW$dispatch\fR, instructs VM::EC2::Dispatch how to
create objects from the parsed \s-1XML.\s0 There are three possible syntaxes:
.PP
.Vb 1
\& 1) A CODE references, such as an anonymous subroutine.
\&
\&    In this case the code reference will be invoked to handle the 
\&    parsed XML returned from the request. The code will receive 
\&    two arguments consisting of the parsed
\&    content of the response, and the VM::EC2 object used to generate the
\&    request.
\&
\& 2) A VM::EC2::Dispatch method name, optionally followed by its arguments
\&    delimited by commas. Example:
\&
\&           "fetch_items,securityGroupInfo,VM::EC2::SecurityGroup"
\&
\&    This tells Dispatch to invoke its fetch_items() method with
\&    the following arguments:
\&
\&     $dispatch\->fetch_items($parsed_xml,$ec2,\*(AqsecurityGroupInfo\*(Aq,\*(AqVM::EC2::SecurityGroup\*(Aq)
\&
\&    The fetch_items() method is used for responses in which a
\&    list of objects is embedded within a series of <item> tags.
\&    See L<VM::EC2::Dispatch> for more information.
\&
\&    Other commonly\-used methods are "fetch_one", and "boolean".
\&
\& 3) A class name, such as \*(AqMyVolume\*(Aq
\&
\&    In this case, class MyVolume is loaded and then its new() method
\&    is called with the four arguments ($parsed_xml,$ec2,$xmlns,$requestid),
\&    where $parsed_xml is the parsed XML response, $ec2 is the VM::EC2
\&    object that generated the request, $xmlns is the XML namespace
\&    of the XML response, and $requestid is the AWS\-generated ID for the
\&    request. Only the first two arguments are really useful.
\&
\&    I suggest you inherit from VM::EC2::Generic and use the inherited new()
\&    method to store the parsed XML object and other arguments.
.Ve
.PP
Dispatch tries each of (1), (2) and (3), in order. This means that
class names cannot collide with method names.
.PP
The parsed content is the result of passing the raw \s-1XML\s0 through a
XML::Simple object created with:
.PP
.Vb 3
\& XML::Simple\->new(ForceArray    => [\*(Aqitem\*(Aq],
\&                  KeyAttr       => [\*(Aqkey\*(Aq],
\&                  SuppressEmpty => undef);
.Ve
.PP
In general, this will give you a hash of hashes. Any tag named 'item'
will be forced to point to an array reference, and any tag named \*(L"key\*(R"
will be flattened as described in the XML::Simple documentation.
.PP
A simple way to examine the raw parsed \s-1XML\s0 is to invoke any
VM::EC2::Generic's \fIas_string()\fR method:
.PP
.Vb 2
\& my ($i) = $ec2\->describe_instances;
\& print $i\->as_string;
.Ve
.PP
This will give you a Data::Dumper representation of the \s-1XML\s0 after it
has been parsed.
.PP
The suggested way to override the dispatch table is from within a
subclass of \s-1VM::EC2:\s0
.PP
.Vb 8
\& package \*(AqVM::EC2New\*(Aq;
\& use base \*(AqVM::EC2\*(Aq;
\&  sub new {
\&      my $self=shift;
\&      VM::EC2::Dispatch\->register(\*(Aqcall_name_1\*(Aq=>\e&subroutine1).
\&      VM::EC2::Dispatch\->register(\*(Aqcall_name_2\*(Aq=>\e&subroutine2).
\&      $self\->SUPER::new(@_);
\& }
.Ve
.PP
See VM::EC2::Dispatch for a working example of subclassing \s-1VM::EC2\s0
and one of its object classes.
.SH "DEVELOPING"
.IX Header "DEVELOPING"
The git source for this library can be found at https://github.com/lstein/LibVM\-EC2\-Perl,
To contribute to development, please obtain a github account and then either:
.PP
.Vb 2
\& 1) Fork a copy of the repository, make your changes against this repository, 
\&    and send a pull request to me to incorporate your changes.
\&
\& 2) Contact me by email and ask for push privileges on the repository.
.Ve
.PP
See http://help.github.com/ for help getting started.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
Net::Amazon::EC2
VM::EC2::Dispatch
VM::EC2::Generic
VM::EC2::BlockDevice
VM::EC2::BlockDevice::Attachment
VM::EC2::BlockDevice::EBS
VM::EC2::BlockDevice::Mapping
VM::EC2::BlockDevice::Mapping::EBS
VM::EC2::Error
VM::EC2::Generic
VM::EC2::Group
VM::EC2::Image
VM::EC2::Instance
VM::EC2::Instance::ConsoleOutput
VM::EC2::Instance::Metadata
VM::EC2::Instance::MonitoringState
VM::EC2::Instance::PasswordData
VM::EC2::Instance::Set
VM::EC2::Instance::State
VM::EC2::Instance::State::Change
VM::EC2::Instance::State::Reason
VM::EC2::KeyPair
VM::EC2::Region
VM::EC2::ReservationSet
VM::EC2::ReservedInstance
VM::EC2::ReservedInstance::Offering
VM::EC2::SecurityGroup
VM::EC2::Snapshot
VM::EC2::Staging::Manager
VM::EC2::Tag
VM::EC2::Volume
.SH "AUTHOR"
.IX Header "AUTHOR"
Lincoln Stein <lincoln.stein@gmail.com>.
.PP
Copyright (c) 2011 Ontario Institute for Cancer Research
.PP
This package and its accompanying libraries is free software; you can
redistribute it and/or modify it under the terms of the \s-1GPL \s0(either
version 1, or at your option, any later version) or the Artistic
License 2.0.  Refer to \s-1LICENSE\s0 for the full license text. In addition,
please see \s-1DISCLAIMER\s0.txt for disclaimers of warranty.