Cloud Manage Project

# Credential file format

Each section in `.elastic-credentials` starts with a header containing the **project name** and **project ID**. The
`load-credentials` command uses these headers to retrieve credentials for a specific project.

**Project section** (written automatically by `create-project` and `reset-credentials`):

```text
# Project: <project-name> | id=<project-id> | <timestamp>
ELASTICSEARCH_URL=https://...
KIBANA_URL=https://...
ELASTICSEARCH_USERNAME=admin
ELASTICSEARCH_PASSWORD=<password>
```

**API key section** (append when creating Elasticsearch API keys):

```text
# API Key: <key-name> | project=<project-name> | id=<project-id> | <details>
ELASTICSEARCH_API_KEY=<base64-encoded-key>
```

Sections for the same project are merged by `load-credentials`. Later entries overwrite earlier ones.
`ELASTICSEARCH_USERNAME` and `ELASTICSEARCH_PASSWORD` are saved to the file but **not exported** by `load-credentials`
unless `--include-admin` is passed. Use `--include-admin` only when creating an API key, then reload without it.


#!/usr/bin/env python3
"""Manage existing Elastic Cloud Serverless projects via the Serverless REST API.

Usage:
    python3 manage-project.py <command> [options]

Commands:
    list                List projects of a given type
    get                 Get project details
    update              Update project name, alias, tags, or search_lake settings
    reset-credentials   Reset project credentials
    delete              Delete a project
    resume              Resume a suspended project
    load-credentials    Load project credentials from .elastic-credentials

Commands that call the Cloud API require the EC_API_KEY environment variable.
"""

import argparse
import copy
import json
import os
import re
import shlex
import sys
import time
import urllib.error
import urllib.request
from datetime import datetime, timezone


def load_dotenv(path=".env"):
    """Load KEY=VALUE pairs from a .env file into os.environ (no overwrite)."""
    try:
        with open(path) as f:
            for line in f:
                line = line.strip()
                if not line or line.startswith("#") or "=" not in line:
                    continue
                key, _, value = line.partition("=")
                os.environ.setdefault(key.strip(), value.strip().strip("'\""))
    except FileNotFoundError:
        pass


load_dotenv()

BASE_URL = os.environ.get("EC_BASE_URL", "https://api.elastic-cloud.com")
API_PREFIX = "/api/v1/serverless"
VALID_TYPES = ("elasticsearch", "observability", "security")


def get_api_key():
    key = os.environ.get("EC_API_KEY")
    if not key:
        print("Error: EC_API_KEY environment variable is not set.", file=sys.stderr)
        print("Run the cloud-setup skill to configure authentication.", file=sys.stderr)
        sys.exit(1)
    return key


def api_request(method, path, body=None):
    url = f"{BASE_URL}{API_PREFIX}{path}"
    headers = {
        "Authorization": f"ApiKey {get_api_key()}",
        "Content-Type": "application/json",
        "User-Agent": "elastic-agentic",
    }
    data = json.dumps(body).encode() if body else None
    req = urllib.request.Request(url, data=data, headers=headers, method=method)
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            raw = resp.read().decode()
            return json.loads(raw) if raw else {}
    except urllib.error.HTTPError as e:
        error_body = e.read().decode()
        try:
            error_json = json.loads(error_body)
            print(json.dumps(error_json, indent=2), file=sys.stderr)
        except json.JSONDecodeError:
            print(error_body, file=sys.stderr)
        print(f"\nHTTP {e.code}: {e.reason}", file=sys.stderr)
        sys.exit(1)
    except urllib.error.URLError as e:
        print(f"Error: unable to reach {url}: {e.reason}", file=sys.stderr)
        sys.exit(1)


def cmd_list(args):
    result = api_request("GET", f"/projects/{args.type}")
    items = result.get("