putpaws 0.0.8 → 0.1.0

data/lib/putpaws/provision/config_writer.rb

@@ -0,0 +1,88 @@
+require 'json'
+require 'fileutils'
+require 'pathname'
+require 'putpaws/provision/util'
+
+module Putpaws
+  module Provision
+    # Reflects provisioned resources into .putpaws/application.json and
+    # .putpaws/infra.json. Only the keys of the target service are touched.
+    # Shows a diff and asks for confirmation before writing.
+    class ConfigWriter
+      attr_reader :config, :state, :prompt, :io
+      def initialize(config:, state:, prompt:, io: $stdout)
+        @config = config
+        @state = state
+        @prompt = prompt
+        @io = io
+      end
+
+      def application_entry
+        {
+          region: config.region,
+          cluster: config.cluster_name,
+          service: config.service_name,
+          task_name_prefix: config.service_name,
+          log_group_prefix: config.log_group,
+          build_log_group_prefix: config.build_log_group,
+          build_project_name_prefix: config.build_project_name,
+          network: config.service_name,
+          target: config.service_name,
+        }
+      end
+
+      def network_entry
+        {
+          subnets: config.base[:subnets],
+          security_groups: state.resources[:security_group_ids] || [],
+          assign_public_ip: config.settings[:assign_public_ip] || 'DISABLED',
+        }
+      end
+
+      def target_entry
+        {
+          # Used by EventBridge Scheduler (scheduler:deploy).
+          scheduler_role: config.roles[:scheduler_role_arn],
+          cluster: state.resources[:cluster_arn],
+          # Revision-less on purpose: always run the latest ACTIVE revision.
+          task_definition: config.service_task_definition_family,
+          container_name: config.service_container_name,
+        }
+      end
+
+      def apply!
+        write_key(path('application.json'), [config.service_name.to_sym], application_entry)
+        write_key(path('infra.json'), [:network, config.service_name.to_sym], network_entry)
+        write_key(path('infra.json'), [:target, config.service_name.to_sym], target_entry)
+      end
+
+      private
+
+      def path(basename)
+        Pathname.new(config.path_prefix).join(basename)
+      end
+
+      def write_key(file, keys, entry)
+        data = file.exist? ? JSON.parse(File.read(file), symbolize_names: true) : {}
+        current = keys.reduce(data){|d, k| d.is_a?(Hash) ? d[k] : nil}
+        return if current == entry
+
+        io.puts "=== #{file} : #{keys.join('.')} ==="
+        io.puts "--- before"
+        io.puts current ? JSON.pretty_generate(current) : "(none)"
+        io.puts "+++ after"
+        io.puts JSON.pretty_generate(entry)
+        unless prompt.yes?("Update #{file}?")
+          io.puts "Skipped updating #{file}"
+          return
+        end
+
+        FileUtils.cp(file, "#{file}.bak") if file.exist?
+        parent = keys[0..-2].reduce(data){|d, k| d[k] ||= {}}
+        parent[keys.last] = entry
+        Util.write_json(file, data)
+        io.puts "Updated #{file}"
+      end
+    end
+  end
+end

data/lib/putpaws/provision/policy_generator.rb

@@ -0,0 +1,221 @@
+require 'fileutils'
+require 'putpaws/provision/util'
+
+module Putpaws
+  module Provision
+    # Generates drafts (たたき台) of IAM policies and roles.
+    # These are starting points to review and edit by hand before creating.
+    class PolicyGenerator
+      ECS_TASKS_TRUST = {
+        Version: '2012-10-17',
+        Statement: [{Effect: 'Allow', Principal: {Service: 'ecs-tasks.amazonaws.com'}, Action: 'sts:AssumeRole'}]
+      }
+      CODEBUILD_TRUST = {
+        Version: '2012-10-17',
+        Statement: [{Effect: 'Allow', Principal: {Service: 'codebuild.amazonaws.com'}, Action: 'sts:AssumeRole'}]
+      }
+
+      def scheduler_trust
+        {
+          Version: '2012-10-17',
+          Statement: [{
+            Effect: 'Allow',
+            Principal: {Service: 'scheduler.amazonaws.com'},
+            Action: 'sts:AssumeRole',
+            # confused deputy protection: only schedules in this account
+            Condition: {StringEquals: {'aws:SourceAccount' => account_id}},
+          }]
+        }
+      end
+
+      attr_reader :config
+      def initialize(config)
+        @config = config
+      end
+
+      def service_name; config.service_name; end
+      def region; config.region; end
+      def account_id; config.account_id; end
+
+      def write_step1_drafts!
+        dir = config.policies_dir
+        FileUtils.mkdir_p(dir)
+        Util.write_json(dir.join('role-task-execution.json'), task_execution_role_draft)
+        Util.write_json(dir.join('role-task.json'), task_role_draft)
+        Util.write_json(dir.join('role-codebuild.json'), codebuild_role_draft)
+        Util.write_json(dir.join('role-scheduler.json'), scheduler_role_draft)
+        %w[role-task-execution.json role-task.json role-codebuild.json role-scheduler.json]
+          .map{|f| dir.join(f).to_s}
+      end
+
+      def task_execution_role_draft
+        statements = [
+          {
+            Sid: 'EcrAuth',
+            Effect: 'Allow',
+            Action: %w[ecr:GetAuthorizationToken],
+            Resource: '*',
+          },
+          {
+            Sid: 'EcrPull',
+            Effect: 'Allow',
+            Action: %w[ecr:BatchCheckLayerAvailability ecr:GetDownloadUrlForLayer ecr:BatchGetImage],
+            Resource: config.base[:ecr_repository_arn],
+          },
+          {
+            Sid: 'WriteLogs',
+            Effect: 'Allow',
+            Action: %w[logs:CreateLogStream logs:PutLogEvents],
+            Resource: "arn:aws:logs:#{region}:#{account_id}:log-group:#{config.log_group}:*",
+          },
+        ]
+        unless config.resolved_secrets.empty?
+          statements << {
+            Sid: 'ReadSecrets',
+            Effect: 'Allow',
+            Action: %w[ssm:GetParameters],
+            Resource: "arn:aws:ssm:#{region}:#{account_id}:parameter#{config.ssm_parameter_prefix}/*",
+          }
+        end
+        {
+          SuggestedRoleName: "#{service_name}-task-execution",
+          SuggestedPolicyName: "#{service_name}-task-execution-policy",
+          AssumeRolePolicyDocument: ECS_TASKS_TRUST,
+          PolicyDocument: {Version: '2012-10-17', Statement: statements},
+        }
+      end
+
+      def task_role_draft
+        statements = [
+          {
+            Sid: 'EcsExec',
+            Effect: 'Allow',
+            Action: %w[
+              ssmmessages:CreateControlChannel ssmmessages:CreateDataChannel
+              ssmmessages:OpenControlChannel ssmmessages:OpenDataChannel
+            ],
+            Resource: '*',
+          },
+        ]
+        unless Util.blank?(config.base[:ses_identity_arn])
+          statements << {
+            Sid: 'SendMail',
+            Effect: 'Allow',
+            Action: %w[ses:SendEmail ses:SendRawEmail],
+            Resource: config.base[:ses_identity_arn],
+          }
+        end
+        unless Util.blank?(config.base[:s3_bucket_arn])
+          statements << {
+            Sid: 'UseBucket',
+            Effect: 'Allow',
+            Action: %w[s3:GetObject s3:PutObject s3:DeleteObject s3:ListBucket],
+            Resource: [config.base[:s3_bucket_arn], "#{config.base[:s3_bucket_arn]}/*"],
+          }
+        end
+        {
+          SuggestedRoleName: "#{service_name}-task",
+          SuggestedPolicyName: "#{service_name}-task-policy",
+          AssumeRolePolicyDocument: ECS_TASKS_TRUST,
+          PolicyDocument: {Version: '2012-10-17', Statement: statements},
+        }
+      end
+
+      def codebuild_role_draft
+        {
+          SuggestedRoleName: "#{service_name}-codebuild",
+          SuggestedPolicyName: "#{service_name}-codebuild-policy",
+          AssumeRolePolicyDocument: CODEBUILD_TRUST,
+          PolicyDocument: {
+            Version: '2012-10-17',
+            Statement: [
+              {
+                Sid: 'WriteBuildLogs',
+                Effect: 'Allow',
+                Action: %w[logs:CreateLogStream logs:PutLogEvents],
+                Resource: "arn:aws:logs:#{region}:#{account_id}:log-group:#{config.build_log_group}:*",
+              },
+              {
+                Sid: 'EcrAuth',
+                Effect: 'Allow',
+                Action: %w[ecr:GetAuthorizationToken],
+                Resource: '*',
+              },
+              {
+                Sid: 'EcrPushPull',
+                Effect: 'Allow',
+                Action: %w[
+                  ecr:BatchCheckLayerAvailability ecr:GetDownloadUrlForLayer ecr:BatchGetImage
+                  ecr:InitiateLayerUpload ecr:UploadLayerPart ecr:CompleteLayerUpload ecr:PutImage
+                ],
+                Resource: config.base[:ecr_repository_arn],
+              },
+              # Deploy at the end of the build:
+              # aws ecs update-service --force-new-deployment (+ wait services-stable)
+              {
+                Sid: 'DeployService',
+                Effect: 'Allow',
+                Action: %w[ecs:UpdateService ecs:DescribeServices],
+                Resource: "arn:aws:ecs:#{region}:#{account_id}:service/#{config.cluster_name}/#{service_name}",
+              },
+              # Required because builds run inside the VPC (vpc_config).
+              {
+                Sid: 'ManageBuildEni',
+                Effect: 'Allow',
+                Action: %w[
+                  ec2:CreateNetworkInterface ec2:DescribeNetworkInterfaces ec2:DeleteNetworkInterface
+                  ec2:DescribeSubnets ec2:DescribeSecurityGroups ec2:DescribeDhcpOptions ec2:DescribeVpcs
+                ],
+                Resource: '*',
+              },
+              {
+                Sid: 'CreateBuildEniPermission',
+                Effect: 'Allow',
+                Action: %w[ec2:CreateNetworkInterfacePermission],
+                Resource: "arn:aws:ec2:#{region}:#{account_id}:network-interface/*",
+                Condition: {
+                  StringEquals: {
+                    'ec2:AuthorizedService' => 'codebuild.amazonaws.com',
+                    'ec2:Subnet' => (config.base[:subnets] || []).map{|s|
+                      "arn:aws:ec2:#{region}:#{account_id}:subnet/#{s}"
+                    },
+                  }
+                },
+              },
+            ]
+          },
+        }
+      end
+
+      # Assumed by EventBridge Scheduler to launch tasks (scheduler:deploy).
+      # Created for every service so that schedules can be added any time.
+      def scheduler_role_draft
+        {
+          SuggestedRoleName: "#{service_name}-scheduler",
+          SuggestedPolicyName: "#{service_name}-scheduler-policy",
+          AssumeRolePolicyDocument: scheduler_trust,
+          PolicyDocument: {
+            Version: '2012-10-17',
+            Statement: [
+              {
+                Sid: 'RunScheduledTask',
+                Effect: 'Allow',
+                Action: %w[ecs:RunTask],
+                Resource: [
+                  "arn:aws:ecs:#{region}:#{account_id}:task-definition/#{service_name}-*",
+                  "arn:aws:ecs:#{region}:#{account_id}:task-definition/#{service_name}-*:*",
+                ],
+              },
+              {
+                Sid: 'PassRolesToTasks',
+                Effect: 'Allow',
+                Action: %w[iam:PassRole],
+                Resource: "arn:aws:iam::#{account_id}:role/#{service_name}-*",
+              },
+            ]
+          },
+        }
+      end
+    end
+  end
+end

data/lib/putpaws/provision/preset.rb

@@ -0,0 +1,91 @@
+require 'json'
+require 'pathname'
+require 'fileutils'
+
+module Putpaws
+  module Provision
+    class Preset
+      BUILTIN_DIR = File.expand_path('presets', __dir__)
+
+      def self.local_dir(path_prefix: '.putpaws')
+        Pathname.new(path_prefix).join('provisioning', 'presets')
+      end
+
+      # Search order: project local -> user global (PUTPAWS_PRESETS_PATH dirs,
+      # then ~/.putpaws/presets) -> builtin (bundled in the gem).
+      def self.search_paths(path_prefix: '.putpaws')
+        paths = [[local_dir(path_prefix: path_prefix).to_s, 'local']]
+        ENV['PUTPAWS_PRESETS_PATH'].to_s.split(File::PATH_SEPARATOR).reject(&:empty?).each do |dir|
+          paths << [dir, 'global']
+        end
+        home = ENV['HOME'].to_s
+        paths << [File.join(home, '.putpaws', 'presets'), 'global'] unless home.empty?
+        paths << [BUILTIN_DIR, 'builtin']
+        paths
+      end
+
+      # [{name:, dir:, source:}] with name collisions resolved by search order.
+      def self.catalog(path_prefix: '.putpaws')
+        seen = {}
+        search_paths(path_prefix: path_prefix).each do |dir, source|
+          Dir.glob(File.join(dir, '*/preset.json')).sort.each do |p|
+            name = File.basename(File.dirname(p))
+            seen[name] ||= {name: name, dir: File.dirname(p), source: source}
+          end
+        end
+        seen.values.sort_by{|e| e[:name]}
+      end
+
+      def self.available(path_prefix: '.putpaws')
+        catalog(path_prefix: path_prefix).map{|e| e[:name]}
+      end
+
+      def self.find(name, path_prefix: '.putpaws')
+        entry = catalog(path_prefix: path_prefix).detect{|e| e[:name] == name}
+        entry && new(name: entry[:name], dir: entry[:dir])
+      end
+
+      # Copy a preset into .putpaws so that the project owns its snapshot and
+      # users can edit it. Does nothing when the local preset already exists.
+      def self.install(name, path_prefix: '.putpaws')
+        entry = catalog(path_prefix: path_prefix).detect{|e| e[:name] == name}
+        raise "Unknown preset: #{name}" unless entry
+        return new(name: entry[:name], dir: entry[:dir]) if entry[:source] == 'local'
+        local = local_dir(path_prefix: path_prefix).join(name)
+        FileUtils.mkdir_p(local.dirname)
+        FileUtils.cp_r(entry[:dir], local)
+        find(name, path_prefix: path_prefix)
+      end
+
+      attr_reader :name, :dir
+      def initialize(name:, dir:)
+        @name = name
+        @dir = dir
+      end
+
+      def data
+        @data ||= JSON.parse(File.read(File.join(dir, 'preset.json')), symbolize_names: true)
+      end
+
+      def defaults
+        data[:defaults] || {}
+      end
+
+      def task_definitions
+        data[:task_definitions] || []
+      end
+
+      def service_task_definition
+        data[:service_task_definition]
+      end
+
+      def devops_defaults
+        data[:devops_defaults] || {}
+      end
+
+      def template_path(file)
+        File.join(dir, 'templates', file)
+      end
+    end
+  end
+end

data/lib/putpaws/provision/presets/rails-nginx/preset.json

@@ -0,0 +1,32 @@
+{
+  "defaults": {
+    "cpu": "256",
+    "memory": "512",
+    "desired_count": 1,
+    "container_port": 3000,
+    "log_retention_days": 30,
+    "image_tag": "latest",
+    "nginx_image": "public.ecr.aws/nginx/nginx:stable",
+    "assign_public_ip": "DISABLED",
+    "env": {
+      "RAILS_ENV": "production",
+      "RACK_ENV": "production",
+      "RAILS_LOG_TO_STDOUT": "1"
+    },
+    "secrets": {
+      "RAILS_MASTER_KEY": "{ssm_parameter_prefix}/RAILS_MASTER_KEY"
+    }
+  },
+  "task_definitions": [
+    { "suffix": "app", "template": "taskdef-app.json.erb", "container_name": "app" },
+    { "suffix": "web", "template": "taskdef-web.json.erb", "container_name": "app" }
+  ],
+  "service_task_definition": "app",
+  "devops_defaults": {
+    "source_type": "GITHUB",
+    "environment_image": "aws/codebuild/standard:7.0",
+    "compute_type": "BUILD_GENERAL1_SMALL",
+    "privileged_mode": true,
+    "buildspec": "buildspec.yml"
+  }
+}

data/lib/putpaws/provision/presets/rails-nginx/templates/taskdef-app.json.erb

@@ -0,0 +1,29 @@
+{
+  "family": "<%= service_name %>-app",
+  "requiresCompatibilities": ["FARGATE"],
+  "networkMode": "awsvpc",
+  "cpu": "<%= cpu %>",
+  "memory": "<%= memory %>",
+  "executionRoleArn": "<%= execution_role_arn %>",
+  "taskRoleArn": "<%= task_role_arn %>",
+  "containerDefinitions": [
+    {
+      "name": "app",
+      "image": "<%= image %>",
+      "essential": true,
+      "portMappings": [
+        { "containerPort": <%= container_port %>, "protocol": "tcp" }
+      ],
+      "environment": <%= env_json %>,
+      "secrets": <%= secrets_json %>,
+      "logConfiguration": {
+        "logDriver": "awslogs",
+        "options": {
+          "awslogs-group": "<%= log_group %>",
+          "awslogs-region": "<%= region %>",
+          "awslogs-stream-prefix": "app"
+        }
+      }
+    }
+  ]
+}

data/lib/putpaws/provision/presets/rails-nginx/templates/taskdef-web.json.erb

@@ -0,0 +1,48 @@
+{
+  "family": "<%= service_name %>-web",
+  "requiresCompatibilities": ["FARGATE"],
+  "networkMode": "awsvpc",
+  "cpu": "<%= cpu %>",
+  "memory": "<%= memory %>",
+  "executionRoleArn": "<%= execution_role_arn %>",
+  "taskRoleArn": "<%= task_role_arn %>",
+  "containerDefinitions": [
+    {
+      "name": "app",
+      "image": "<%= image %>",
+      "essential": true,
+      "portMappings": [
+        { "containerPort": <%= container_port %>, "protocol": "tcp" }
+      ],
+      "environment": <%= env_json %>,
+      "secrets": <%= secrets_json %>,
+      "logConfiguration": {
+        "logDriver": "awslogs",
+        "options": {
+          "awslogs-group": "<%= log_group %>",
+          "awslogs-region": "<%= region %>",
+          "awslogs-stream-prefix": "app"
+        }
+      }
+    },
+    {
+      "name": "nginx",
+      "image": "<%= nginx_image %>",
+      "essential": true,
+      "portMappings": [
+        { "containerPort": 80, "protocol": "tcp" }
+      ],
+      "dependsOn": [
+        { "containerName": "app", "condition": "START" }
+      ],
+      "logConfiguration": {
+        "logDriver": "awslogs",
+        "options": {
+          "awslogs-group": "<%= log_group %>",
+          "awslogs-region": "<%= region %>",
+          "awslogs-stream-prefix": "nginx"
+        }
+      }
+    }
+  ]
+}

data/lib/putpaws/provision/provision_config.rb

@@ -0,0 +1,156 @@
+require 'json'
+require 'pathname'
+require 'putpaws/provision/util'
+require 'putpaws/provision/preset'
+
+module Putpaws
+  module Provision
+    class ProvisionConfig
+      def self.dir_for(service_name, path_prefix: '.putpaws')
+        Pathname.new(path_prefix).join('provisioning', service_name)
+      end
+
+      def self.services(path_prefix: '.putpaws')
+        Dir.glob(Pathname.new(path_prefix).join('provisioning', '*', 'provision.json').to_s)
+          .map{|p| File.basename(File.dirname(p))}
+          .reject{|name| name == 'presets'}
+          .sort
+      end
+
+      def self.load(service_name, path_prefix: '.putpaws')
+        path = dir_for(service_name, path_prefix: path_prefix).join('provision.json')
+        raise "provision.json not found for #{service_name}. Please run `putpaws ready` first." unless path.exist?
+        data = JSON.parse(File.read(path), symbolize_names: true)
+        new(data, path_prefix: path_prefix)
+      end
+
+      attr_reader :data, :path_prefix
+      def initialize(data, path_prefix: '.putpaws')
+        @data = data
+        @path_prefix = path_prefix
+      end
+
+      def service_name
+        data[:service_name]
+      end
+
+      def region
+        data[:region]
+      end
+
+      def preset
+        @preset ||= begin
+          p = Preset.find(data[:preset], path_prefix: path_prefix)
+          raise "Preset not found: #{data[:preset]}" unless p
+          p
+        end
+      end
+
+      def base
+        data[:base] || {}
+      end
+
+      def roles
+        data[:roles] || {}
+      end
+
+      def overrides
+        data[:overrides] || {}
+      end
+
+      def devops
+        data[:devops] || {}
+      end
+
+      def dir
+        self.class.dir_for(service_name, path_prefix: path_prefix)
+      end
+
+      def policies_dir
+        dir.join('policies')
+      end
+
+      # preset defaults <- provision.json overrides (nil values ignored).
+      # env/secrets hashes are merged by key.
+      def settings
+        @settings ||= begin
+          merged = preset.defaults.dup
+          overrides.each do |k, v|
+            next if v.nil?
+            next if k == :cluster_name
+            if v.is_a?(Hash) && merged[k].is_a?(Hash)
+              merged[k] = merged[k].merge(v)
+            else
+              merged[k] = v
+            end
+          end
+          merged
+        end
+      end
+
+      def devops_settings
+        preset.devops_defaults.merge(devops.reject{|_, v| v.nil?})
+      end
+
+      def account_id
+        Util.arn_account_id(base[:ecr_repository_arn])
+      end
+
+      def ecr_image_uri(tag: nil)
+        "#{Util.ecr_repository_uri(base[:ecr_repository_arn])}:#{tag || settings[:image_tag] || 'latest'}"
+      end
+
+      def ssm_parameter_prefix
+        base[:ssm_parameter_prefix]
+      end
+
+      # {ssm_parameter_prefix} placeholders resolved, values as full parameter paths.
+      def resolved_secrets
+        (settings[:secrets] || {}).map{|name, path|
+          [name.to_s, path.to_s.gsub('{ssm_parameter_prefix}', ssm_parameter_prefix.to_s)]
+        }.to_h
+      end
+
+      def secret_parameter_arns
+        resolved_secrets.values.map{|path|
+          "arn:aws:ssm:#{region}:#{account_id}:parameter#{path}"
+        }
+      end
+
+      # ===== naming conventions (service_name prefix) =====
+
+      def sg_name
+        service_name
+      end
+
+      def cluster_name
+        Util.blank?(overrides[:cluster_name]) ? service_name : overrides[:cluster_name]
+      end
+
+      def log_group
+        "/ecs/#{service_name}"
+      end
+
+      def build_log_group
+        "/aws/codebuild/#{service_name}"
+      end
+
+      def build_project_name
+        service_name
+      end
+
+      def task_definition_family(suffix)
+        "#{service_name}-#{suffix}"
+      end
+
+      def service_task_definition_family
+        task_definition_family(preset.service_task_definition)
+      end
+
+      def service_container_name
+        entry = preset.task_definitions.detect{|t| t[:suffix] == preset.service_task_definition}
+        (entry && entry[:container_name]) || 'app'
+      end
+    end
+  end
+end

data/lib/putpaws/provision/provision_task.rb

@@ -0,0 +1 @@
+load File.expand_path("../tasks/provision.rake", __FILE__)