putpaws 0.0.9 → 0.1.3

data/lib/putpaws/provision/runner.rb

@@ -0,0 +1,218 @@
+require 'json'
+require 'fileutils'
+require 'putpaws/provision/util'
+require 'putpaws/provision/state'
+require 'putpaws/provision/aws_clients'
+require 'putpaws/provision/policy_generator'
+require 'putpaws/provision/config_writer'
+require 'putpaws/provision/resources/base'
+require 'putpaws/provision/resources/iam_role'
+require 'putpaws/provision/resources/security_group'
+require 'putpaws/provision/resources/cluster'
+require 'putpaws/provision/resources/log_group'
+require 'putpaws/provision/resources/task_definition'
+require 'putpaws/provision/resources/service'
+require 'putpaws/provision/resources/codebuild_project'
+
+module Putpaws
+  module Provision
+    # Orchestrates the provisioning commands:
+    #   ready  (provision:init)  ... interview + drafts
+    #   steady (provision:roles) ... create IAM roles from the reviewed drafts
+    #   ahead  (provision:plan)  ... dry-run
+    #   up     (provision:up)    ... build the rest, idempotent
+    #
+    # Running `steady` IS the user's explicit confirmation of the drafts:
+    # `up` never touches IAM and stops until the role ARNs are filled.
+    class Runner
+      ROLE_KEYS = [:task_execution_role_arn, :task_role_arn, :codebuild_role_arn, :scheduler_role_arn]
+      ROLE_DRAFTS = {
+        task_execution_role_arn: 'role-task-execution.json',
+        task_role_arn: 'role-task.json',
+        codebuild_role_arn: 'role-codebuild.json',
+        scheduler_role_arn: 'role-scheduler.json',
+      }
+
+      attr_reader :config, :state, :clients, :prompt, :io
+      def initialize(config:, state: nil, clients: nil, prompt: nil, io: $stdout)
+        @config = config
+        @state = state || State.load(config)
+        @clients = clients || AwsClients.new(region: config.region)
+        @prompt = prompt
+        @io = io
+      end
+
+      def blank_role_keys
+        ROLE_KEYS.select{|k| Util.blank?(config.roles[k])}
+      end
+
+      # A role is managed by `steady` when its ARN is blank (to be created) or
+      # when the filled ARN points at the draft's own role name (created by a
+      # previous `steady`; kept updatable). An ARN with a different role name
+      # is treated as external (org-managed) and never touched.
+      def steady_role_entries
+        args = {config: config, state: state, clients: clients}
+        ROLE_KEYS.map do |key|
+          resource = Resources::IamRole.new(roles_key: key, draft_file: ROLE_DRAFTS[key], **args)
+          arn = config.roles[key]
+          external = !Util.blank?(arn) && arn.split('/').last != resource.name
+          {key: key, resource: resource, external: external}
+        end
+      end
+
+      def service_resources
+        args = {config: config, state: state, clients: clients}
+        [
+          Resources::SecurityGroup.new(**args),
+          Resources::LogGroup.new(log_group_name: config.log_group, output_key: :log_group, **args),
+          Resources::Cluster.new(**args),
+          *config.preset.task_definitions.map{|entry| Resources::TaskDefinition.new(entry: entry, **args)},
+          Resources::Service.new(**args),
+        ]
+      end
+
+      def devops_resources
+        args = {config: config, state: state, clients: clients}
+        [
+          Resources::LogGroup.new(log_group_name: config.build_log_group, output_key: :build_log_group, **args),
+          Resources::CodebuildProject.new(**args),
+        ]
+      end
+
+      def missing_devops_requirements
+        missing = []
+        missing << 'devops.source_repository (provision.json)' if Util.blank?(config.devops_settings[:source_repository])
+        missing
+      end
+
+      # `putpaws steady`: show each draft inline, confirm one by one, then
+      # apply it as-is and fill the ARN into provision.json.
+      # Idempotent: re-run after editing drafts to update.
+      def steady!
+        io.puts "Applying IAM roles from drafts in #{config.policies_dir}/"
+        filled = {}
+        steady_role_entries.each do |entry|
+          if entry[:external]
+            print_action('SKIP', 'IamRole', "#{config.roles[entry[:key]]} (external)")
+            next
+          end
+          resource = entry[:resource]
+          action = resource.plan[:action]
+
+          if action == :skip
+            print_action('SKIP', 'IamRole', resource.name)
+          else
+            io.puts ""
+            io.puts "=== #{resource.draft_file} -> #{action.to_s.upcase} role: #{resource.name} ==="
+            io.puts JSON.pretty_generate(resource.draft)
+            unless prompt.yes?("Apply this content as role #{resource.name}?")
+              io.puts "Skipped #{resource.name}"
+              next
+            end
+            print_action(action.to_s.upcase, 'IamRole', resource.name)
+          end
+
+          outputs = resource.ensure!
+          state.merge_resources!(outputs)
+          filled[entry[:key]] = outputs[entry[:key]]
+        end
+        write_roles_to_provision_json!(filled)
+        io.puts "Next: check with `putpaws ahead`, then build with `putpaws up`."
+      end
+
+      def plan
+        io.puts "Service: #{config.service_name} (region: #{config.region}, account: #{config.account_id})"
+        io.puts ""
+        resources = steady_role_entries.reject{|e| e[:external]}.map{|e| e[:resource]}
+        resources += service_resources
+        resources += devops_resources if missing_devops_requirements.empty?
+        resources.each do |r|
+          p = r.plan
+          print_action(p[:action].to_s.upcase, p[:kind], p[:name])
+        end
+        if blank_role_keys.any?
+          io.puts "[stop point] IAM roles are not created yet. Review the drafts, then run `putpaws steady`."
+        end
+        if missing_devops_requirements.any?
+          io.puts "[stop point] Devops step is blocked. Fill in: #{missing_devops_requirements.join(', ')}"
+        end
+        check_ssm_parameters
+      end
+
+      def up!
+        if blank_role_keys.any?
+          io.puts "[stop point] IAM roles are not ready: #{blank_role_keys.join(', ')}"
+          io.puts "1. Review and edit the drafts in #{config.policies_dir}/"
+          io.puts "2. Run `putpaws steady` to create the roles and fill their ARNs."
+          io.puts "   (or fill in existing role ARNs in provision.json yourself)"
+          return
+        end
+
+        io.puts "Applying service step for #{config.service_name} (account: #{config.account_id}, region: #{config.region})"
+        apply_resources(service_resources)
+        state.mark_step!(:service, 'done')
+
+        ConfigWriter.new(config: config, state: state, prompt: prompt, io: io).apply!
+
+        if missing_devops_requirements.any?
+          io.puts "[stop point] Devops step is not ready. Fill in: #{missing_devops_requirements.join(', ')}"
+          io.puts "Then run `putpaws up` again."
+          return
+        end
+
+        io.puts "Applying devops step"
+        apply_resources(devops_resources)
+        state.mark_step!(:devops, 'done')
+        ConfigWriter.new(config: config, state: state, prompt: prompt, io: io).apply!
+
+        io.puts "All steps completed."
+        io.puts "Verify with: bundle exec putpaws #{config.service_name} ecs:run cmd='echo ok' wait=true"
+      end
+
+      private
+
+      def print_action(action, kind, name)
+        io.puts format("%-8s %-18s %s", action, kind, name)
+      end
+
+      def write_roles_to_provision_json!(filled)
+        return if filled.empty?
+        path = config.dir.join('provision.json')
+        data = JSON.parse(File.read(path), symbolize_names: true)
+        data[:roles] ||= {}
+        changed = filled.reject{|k, arn| data[:roles][k] == arn}
+        return if changed.empty?
+        FileUtils.cp(path, "#{path}.bak")
+        changed.each{|k, arn| data[:roles][k] = arn}
+        Util.write_json(path, data)
+        config.data[:roles] = data[:roles]
+        io.puts "Filled role ARNs into #{path}:"
+        changed.each{|k, arn| io.puts "  #{k}: #{arn}"}
+      end
+
+      def apply_resources(resources)
+        resources.each do |r|
+          print_action(r.plan[:action].to_s.upcase, r.kind, r.name)
+          outputs = r.ensure!
+          state.merge_resources!(outputs)
+        end
+      end
+
+      def check_ssm_parameters
+        paths = config.resolved_secrets.values
+        return if paths.empty?
+        res = clients.ssm.describe_parameters(
+          parameter_filters: [{key: 'Name', option: 'Equals', values: paths}]
+        )
+        existing = res.parameters.map(&:name)
+        missing = paths - existing
+        if missing.any?
+          io.puts "[warning] Missing SSM parameters (register them yourself, putpaws never touches values):"
+          missing.each{|p| io.puts "  aws ssm put-parameter --type SecureString --name #{p} --value '...'"}
+        end
+      rescue StandardError => e
+        io.puts "(ssm parameter check skipped: #{e.class})"
+      end
+    end
+  end
+end

data/lib/putpaws/provision/state.rb

@@ -0,0 +1,45 @@
+require 'json'
+require 'putpaws/provision/util'
+
+module Putpaws
+  module Provision
+    class State
+      def self.load(config)
+        path = config.dir.join('state.json')
+        data = path.exist? ? JSON.parse(File.read(path), symbolize_names: true) : {}
+        new(path: path.to_s, data: data)
+      end
+
+      attr_reader :path, :data
+      def initialize(path:, data:)
+        @path = path
+        @data = data
+        @data[:resources] ||= {}
+        @data[:steps] ||= {}
+      end
+
+      def resources
+        data[:resources]
+      end
+
+      def steps
+        data[:steps]
+      end
+
+      def merge_resources!(outputs)
+        resources.merge!(outputs.map{|k, v| [k.to_sym, v]}.to_h)
+        save!
+      end
+
+      def mark_step!(name, status)
+        steps[name.to_sym] = status
+        save!
+      end
+
+      def save!
+        data[:updated_at] = Time.now.to_s
+        Util.write_json(path, data)
+      end
+    end
+  end
+end

data/lib/putpaws/provision/tasks/provision.rake

@@ -0,0 +1,129 @@
+require "fileutils"
+require "putpaws/prompt"
+require "putpaws/provision/all"
+
+namespace :provision do
+  desc "Interview basic infra inputs and generate provision.json + IAM policy drafts. (alias: ready)"
+  task :init do
+    prompt = Putpaws::Prompt.safe
+    util = Putpaws::Provision::Util
+
+    service_name = ENV['service'] || prompt.ask("Application name (Ex: awesome-api-staging):") do |q|
+      q.required(true)
+      q.validate(/\A[a-z0-9][a-z0-9\-]*\z/, "lowercase letters, numbers and hyphens only")
+    end
+
+    dir = Putpaws::Provision::ProvisionConfig.dir_for(service_name)
+    if dir.join('provision.json').exist?
+      unless prompt.yes?("#{dir}/provision.json already exists. Overwrite?", default: false)
+        puts "Aborted."
+        next
+      end
+    end
+
+    region = prompt.ask("Region:", default: 'ap-northeast-1')
+    preset_choices = Putpaws::Provision::Preset.catalog.map{|e| ["#{e[:name]} (#{e[:source]})", e[:name]]}.to_h
+    preset_name = prompt.select("Preset:", preset_choices)
+
+    puts "--- Basic infra (existing resources; used to generate IAM policies) ---"
+    vpc_id = prompt.ask("VPC ID:"){|q| q.required(true)}
+    subnets = prompt.ask("Subnet IDs (comma separated):"){|q| q.required(true)}.split(',').map(&:strip)
+    sg_ids = prompt.ask("Security group IDs (existing, comma separated, empty to create a new one):")
+      .to_s.split(',').map(&:strip).reject(&:empty?)
+    ecr_arn = prompt.ask("ECR repository ARN:"){|q| q.required(true)}
+    ses_arn = prompt.ask("SES identity ARN (empty to skip):")
+    s3_arn = prompt.ask("S3 bucket ARN (empty to skip):")
+    ssm_prefix = prompt.ask("SSM parameter path prefix (existing; putpaws never writes values):", default: "/#{service_name}")
+    repo = prompt.ask("CodeBuild source repository URL (GitHub, empty to fill later):")
+
+    data = {
+      service_name: service_name,
+      region: region,
+      preset: preset_name,
+      base: {
+        vpc_id: vpc_id,
+        subnets: subnets,
+        security_group_ids: sg_ids,
+        ecr_repository_arn: ecr_arn,
+        ses_identity_arn: util.blank?(ses_arn) ? nil : ses_arn,
+        s3_bucket_arn: util.blank?(s3_arn) ? nil : s3_arn,
+        ssm_parameter_prefix: ssm_prefix,
+      },
+      roles: {
+        task_execution_role_arn: nil,
+        task_role_arn: nil,
+        codebuild_role_arn: nil,
+        scheduler_role_arn: nil,
+      },
+      overrides: {
+        cluster_name: nil,
+        cpu: nil,
+        memory: nil,
+        desired_count: nil,
+        env: {},
+        secrets: {},
+      },
+      devops: {
+        source_repository: util.blank?(repo) ? nil : repo,
+        buildspec: "buildspec.yml",
+      },
+    }
+
+    Putpaws::Provision::Preset.install(preset_name)
+    FileUtils.mkdir_p(dir)
+    util.write_json(dir.join('provision.json'), data)
+
+    config = Putpaws::Provision::ProvisionConfig.new(data)
+    files = Putpaws::Provision::PolicyGenerator.new(config).write_step1_drafts!
+
+    puts ""
+    puts "Generated:"
+    puts "  #{dir}/provision.json"
+    files.each{|f| puts "  #{f}"}
+    puts ""
+    puts "Next steps:"
+    puts "  1. Review and edit the role drafts in policies/."
+    puts "     When confirmed, run `putpaws steady` to create the IAM roles from the drafts as-is."
+    puts "     (or fill in existing role ARNs in provision.json instead)"
+    puts "  2. Register SSM parameters (Ex: #{ssm_prefix}/RAILS_MASTER_KEY) yourself."
+    puts "  3. Check with `putpaws ahead`, then build with `putpaws up`."
+  end
+
+  desc "Create IAM roles from the reviewed drafts and fill their ARNs into provision.json. Each role is shown and confirmed one by one. Idempotent. (alias: steady)"
+  task :roles do
+    config = Putpaws::Provision.resolve_config
+    prompt = Putpaws::Prompt.safe
+    puts "Service: #{config.service_name} / Account: #{config.account_id} / Region: #{config.region}"
+    Putpaws::Provision::Runner.new(config: config, prompt: prompt).steady!
+  end
+
+  desc "Show what `putpaws up` would do (dry-run). (alias: ahead)"
+  task :plan do
+    config = Putpaws::Provision.resolve_config
+    Putpaws::Provision::Runner.new(config: config, prompt: Putpaws::Prompt.safe).plan
+  end
+
+  desc "Build infra as far as possible, stopping where manual steps are required. Re-runnable. (alias: up)"
+  task :up do
+    config = Putpaws::Provision.resolve_config
+    prompt = Putpaws::Prompt.safe
+    puts "Service: #{config.service_name} / Account: #{config.account_id} / Region: #{config.region}"
+    unless prompt.yes?("Proceed?")
+      puts "Aborted."
+      next
+    end
+    Putpaws::Provision::Runner.new(config: config, prompt: prompt).up!
+  end
+end
+
+desc "Alias of provision:init"
+task ready: 'provision:init'
+
+desc "Alias of provision:roles"
+task steady: 'provision:roles'
+
+desc "Alias of provision:up"
+task up: 'provision:up'
+
+desc "Alias of provision:plan"
+task ahead: 'provision:plan'

data/lib/putpaws/provision/util.rb

@@ -0,0 +1,50 @@
+require 'json'
+
+module Putpaws
+  module Provision
+    module Util
+      module_function
+
+      def underscore(str)
+        str.to_s.gsub(/([a-z0-9])([A-Z])/, '\1_\2').downcase
+      end
+
+      # Task definition JSON is written in camelCase convention.
+      # Convert it into snake_case symbol keys for aws-sdk params.
+      def deep_underscore_keys(obj)
+        case obj
+        when Hash
+          obj.map{|k, v| [underscore(k).to_sym, deep_underscore_keys(v)]}.to_h
+        when Array
+          obj.map{|x| deep_underscore_keys(x)}
+        else
+          obj
+        end
+      end
+
+      def arn_account_id(arn)
+        arn.to_s.split(':')[4]
+      end
+
+      def arn_region(arn)
+        arn.to_s.split(':')[3]
+      end
+
+      def ecr_repository_name(arn)
+        arn.to_s.split(':', 6).last.to_s.sub(/\Arepository\//, '')
+      end
+
+      def ecr_repository_uri(arn)
+        "#{arn_account_id(arn)}.dkr.ecr.#{arn_region(arn)}.amazonaws.com/#{ecr_repository_name(arn)}"
+      end
+
+      def blank?(value)
+        value.nil? || value.to_s.strip.empty?
+      end
+
+      def write_json(path, data)
+        File.write(path, JSON.pretty_generate(data) + "\n")
+      end
+    end
+  end
+end

data/lib/putpaws/tasks/info.rake

@@ -0,0 +1,35 @@
+desc "Show resolved settings for the service. No AWS access."
+task :info do
+  app = fetch(:app)
+  row = ->(key, value){ puts format("%-26s %s", "#{key}:", value) unless value.nil? }
+
+  row.call('name', app.name)
+  row.call('region', app.region)
+  row.call('cluster', app.cluster)
+  row.call('service', app.service)
+  row.call('task_name_prefix', app.task_name_prefix)
+  row.call('ecs_region', app.ecs_region)
+  row.call('log_group_prefix', app.log_group_prefix)
+  row.call('log_region', app.log_region)
+  row.call('build_project_name_prefix', app.build_project_name_prefix)
+  row.call('build_log_group_prefix', app.build_log_group_prefix)
+  row.call('build_region', app.build_region)
+
+  if (network = app.network)
+    row.call('network', network.name)
+    row.call('  subnets', network.subnets && network.subnets.join(', '))
+    row.call('  security_groups', network.security_groups && network.security_groups.join(', '))
+    row.call('  assign_public_ip', network.assign_public_ip)
+  end
+
+  if (target = app.target)
+    row.call('target', target.name)
+    row.call('  cluster', target.cluster)
+    row.call('  task_definition', target.task_definition)
+    row.call('  container_name', target.container_name)
+    row.call('  scheduler_role', target.scheduler_role)
+  end
+
+  schedules = app.schedules
+  row.call('schedules', schedules.map(&:name).join(', ')) unless schedules.empty?
+end

data/lib/putpaws/version.rb

@@ -1,3 +1,3 @@
 module Putpaws
-  VERSION = "0.0.9"
+  VERSION = "0.1.3"
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: putpaws
 version: !ruby/object:Gem::Version
-  version: 0.0.9
+  version: 0.1.3
 platform: ruby
 authors:
 - metheglin
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-06-03 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -66,6 +65,34 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-ec2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-iam
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: aws-sdk-cloudwatchlogs
   requirement: !ruby/object:Gem::Requirement
@@ -119,6 +146,9 @@ files:
 - bin/putpaws
 - lib/Putpawsfile
 - lib/putpaws.rb
+- lib/putpaws/ai/ai_task.rb
+- lib/putpaws/ai/guide.rb
+- lib/putpaws/ai/tasks/ai_task.rake
 - lib/putpaws/all.rb
 - lib/putpaws/application.rb
 - lib/putpaws/application_config.rb
@@ -131,25 +161,53 @@ files:
 - lib/putpaws/code_build/tasks/build_task.rake
 - lib/putpaws/dsl.rb
 - lib/putpaws/ecs/ecs_task.rb
+- lib/putpaws/ecs/run_command.rb
 - lib/putpaws/ecs/task_command.rb
 - lib/putpaws/ecs/tasks/ecs_task.rake
 - lib/putpaws/env.rb
 - lib/putpaws/hello.rb
+- lib/putpaws/iam/grant_command.rb
+- lib/putpaws/iam/iam_task.rb
+- lib/putpaws/iam/operator_config.rb
+- lib/putpaws/iam/tasks/iam_task.rake
+- lib/putpaws/info.rb
 - lib/putpaws/infra_network_config.rb
 - lib/putpaws/infra_target_config.rb
 - lib/putpaws/prompt.rb
+- lib/putpaws/provision/all.rb
+- lib/putpaws/provision/aws_clients.rb
+- lib/putpaws/provision/config_writer.rb
+- lib/putpaws/provision/policy_generator.rb
+- lib/putpaws/provision/preset.rb
+- lib/putpaws/provision/presets/rails-nginx/preset.json
+- lib/putpaws/provision/presets/rails-nginx/templates/taskdef-app.json.erb
+- lib/putpaws/provision/presets/rails-nginx/templates/taskdef-web.json.erb
+- lib/putpaws/provision/provision_config.rb
+- lib/putpaws/provision/provision_task.rb
+- lib/putpaws/provision/resources/base.rb
+- lib/putpaws/provision/resources/cluster.rb
+- lib/putpaws/provision/resources/codebuild_project.rb
+- lib/putpaws/provision/resources/iam_role.rb
+- lib/putpaws/provision/resources/log_group.rb
+- lib/putpaws/provision/resources/security_group.rb
+- lib/putpaws/provision/resources/service.rb
+- lib/putpaws/provision/resources/task_definition.rb
+- lib/putpaws/provision/runner.rb
+- lib/putpaws/provision/state.rb
+- lib/putpaws/provision/tasks/provision.rake
+- lib/putpaws/provision/util.rb
 - lib/putpaws/schedule_config.rb
 - lib/putpaws/scheduler/schedule_command.rb
 - lib/putpaws/scheduler/scheduler_task.rb
 - lib/putpaws/scheduler/tasks/scheduler_task.rake
 - lib/putpaws/setup.rb
 - lib/putpaws/tasks/hello.rake
+- lib/putpaws/tasks/info.rake
 - lib/putpaws/version.rb
 homepage: https://rubygems.org/gems/putpaws
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -164,8 +222,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
-signing_key:
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Put your paws up!!
 test_files: []