stack_master 2.3.0 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6b2fd9ecb9882d2a0b00adee84d08975f5ae51b72297a449c5bd5218efbf8a17
-  data.tar.gz: c2eb23ba0ae38e6db17cc296a4a151aaaf7785bbff222d75ec671251ac398f1f
+  metadata.gz: 676259d50dc1b2634f669f98625e3203f57d39eb77d6e6bf55f0e3b13318174b
+  data.tar.gz: f759222c480eed85f359c9b6f713f865664f156078a065bd4ad16fcd2db47417
 SHA512:
-  metadata.gz: e5832578334d932b9750b9aa2914c6c0fc9d2b391606c3ab8fc60868b151c5b9fa996d2b89636d14515aff3b9892c8a913c1e0531ac57262a67072931a2a8f1c
-  data.tar.gz: 87dd2728b566b6d775a0b8cb7137acc856f1ee854436e35789578c1c129798594375bc9ad06018be2285605878918cf89d872c3df72fe20a3260380407e32b25
+  metadata.gz: 482ccf3ecd0511921404744dd8f081f6f1c17c954918bc8fef5e5d6b2bf4ddebafd74d942c22b858062abb9e38fa238031d0fb310c8a5dbd02482833b6119641
+  data.tar.gz: f9fdaf391a317ccaa1cad9e527b8bd4b529c7446b6bc13335a31fc8fde7504878f6f9183959742710e9a5b637ad3a783b302f2955f7ed6c2b67ba2876ef6fb62

data/README.md

@@ -625,7 +625,7 @@ stacks:
 
 ## Allowed accounts
 
-The AWS account the command is executing in can be restricted to a specific list of allowed accounts. This is useful in reducing the possibility of applying non-production changes in a production account. Each stack definition can specify the `allowed_accounts` property with an array of AWS account IDs the stack is allowed to work with.
+The AWS account the command is executing in can be restricted to a specific list of allowed accounts. This is useful in reducing the possibility of applying non-production changes in a production account. Each stack definition can specify the `allowed_accounts` property with an array of AWS account IDs or aliases the stack is allowed to work with.
 
 This is an opt-in feature which is enabled by specifying at least one account to allow.
 
@@ -644,7 +644,7 @@ stacks:
       template: myapp_db.rb
       allowed_accounts: # only allow these accounts (overrides the stack defaults)
         - '1234567890'
-        - '9876543210'
+        - my-account-alias
       tags:
         purpose: back-end
     myapp-web:
@@ -659,7 +659,7 @@ stacks:
         purpose: back-end
 ```
 
-In the cases where you want to bypass the account check, there is StackMaster flag `--skip-account-check` that can be used.
+In the cases where you want to bypass the account check, there is the StackMaster flag `--skip-account-check` that can be used.
 
 ## Commands
 

data/lib/stack_master.rb

@@ -7,6 +7,7 @@ require 'aws-sdk-ecr'
 require 'aws-sdk-s3'
 require 'aws-sdk-sns'
 require 'aws-sdk-ssm'
+require 'aws-sdk-iam'
 require 'colorize'
 require 'active_support/core_ext/hash/keys'
 require 'active_support/core_ext/object/blank'
@@ -45,6 +46,7 @@ module StackMaster
 
   autoload :StackDiffer, 'stack_master/stack_differ'
   autoload :Validator, 'stack_master/validator'
+  autoload :ParameterValidator, 'stack_master/parameter_validator'
 
   require 'stack_master/template_compilers/sparkle_formation'
   require 'stack_master/template_compilers/json'

data/lib/stack_master/cli.rb

@@ -262,13 +262,15 @@ module StackMaster
       if running_in_allowed_account?(allowed_accounts)
         block.call
       else
-        StackMaster.stdout.puts "Account '#{identity.account}' is not an allowed account. Allowed accounts are #{allowed_accounts}."
+        account_text = "'#{identity.account}'"
+        account_text << " (#{identity.account_aliases.join(', ')})" if identity.account_aliases.any?
+        StackMaster.stdout.puts "Account #{account_text} is not an allowed account. Allowed accounts are #{allowed_accounts}."
         false
       end
     end
 
     def running_in_allowed_account?(allowed_accounts)
-      StackMaster.skip_account_check? || identity.running_in_allowed_account?(allowed_accounts)
+      StackMaster.skip_account_check? || identity.running_in_account?(allowed_accounts)
     end
 
     def identity

data/lib/stack_master/commands/apply.rb

@@ -1,5 +1,3 @@
-require 'pathname'
-
 module StackMaster
   module Commands
     class Apply
@@ -205,18 +203,8 @@ module StackMaster
       end
 
       def ensure_valid_parameters!
-        if @proposed_stack.missing_parameters?
-          message = <<~MESSAGE
-            Empty/blank parameters detected, ensure values exist for those parameters.
-            Parameters will be read from the following locations:
-          MESSAGE
-          base_dir = Pathname.new(@stack_definition.base_dir)
-          @stack_definition.parameter_file_globs.each do |glob|
-            parameter_file = Pathname.new(glob).relative_path_from(base_dir)
-            message << " - #{parameter_file}\n"
-          end
-          failed!(message)
-        end
+        pv = ParameterValidator.new(stack: @proposed_stack, stack_definition: @stack_definition)
+        failed!(pv.error_message) if pv.missing_parameters?
       end
 
       def ensure_valid_template_body_size!

data/lib/stack_master/commands/status.rb

@@ -44,7 +44,7 @@ module StackMaster
       end
 
       def running_in_allowed_account?(allowed_accounts)
-        StackMaster.skip_account_check? || identity.running_in_allowed_account?(allowed_accounts)
+        StackMaster.skip_account_check? || identity.running_in_account?(allowed_accounts)
       end
 
       def identity

data/lib/stack_master/identity.rb

@@ -1,16 +1,25 @@
 module StackMaster
   class Identity
-    def running_in_allowed_account?(allowed_accounts)
-      allowed_accounts.nil? || allowed_accounts.empty? || allowed_accounts.include?(account)
+    MissingIamPermissionsError = Class.new(StandardError)
+
+    def running_in_account?(accounts)
+      accounts.nil? ||
+        accounts.empty? ||
+        contains_account_id?(accounts) ||
+        contains_account_alias?(accounts)
     end
 
     def account
       @account ||= sts.get_caller_identity.account
     end
 
-    private
+    def account_aliases
+      @aliases ||= iam.list_account_aliases.account_aliases
+    rescue Aws::IAM::Errors::AccessDenied
+      raise MissingIamPermissionsError, 'Failed to retrieve account aliases. Missing required IAM permission: iam:ListAccountAliases'
+    end
 
-    attr_reader :sts
+    private
 
     def region
       @region ||= ENV['AWS_REGION'] || Aws.config[:region] || Aws.shared_config.region || 'us-east-1'
@@ -19,5 +28,17 @@ module StackMaster
     def sts
       @sts ||= Aws::STS::Client.new(region: region)
     end
+
+    def iam
+      @iam ||= Aws::IAM::Client.new(region: region)
+    end
+
+    def contains_account_id?(ids)
+      ids.include?(account)
+    end
+
+    def contains_account_alias?(aliases)
+      account_aliases.any? { |account_alias| aliases.include?(account_alias) }
+    end
   end
 end

data/lib/stack_master/parameter_validator.rb

@@ -0,0 +1,36 @@
+require 'pathname'
+
+module StackMaster
+  class ParameterValidator
+    def initialize(stack:, stack_definition:)
+      @stack = stack
+      @stack_definition = stack_definition
+    end
+
+    def error_message
+      return nil unless missing_parameters?
+      message = "Empty/blank parameters detected. Please provide values for these parameters:"
+      missing_parameters.each do |parameter_name|
+        message << "\n - #{parameter_name}"
+      end
+      message << "\nParameters will be read from files matching the following globs:"
+      base_dir = Pathname.new(@stack_definition.base_dir)
+      @stack_definition.parameter_file_globs.each do |glob|
+        parameter_file = Pathname.new(glob).relative_path_from(base_dir)
+        message << "\n - #{parameter_file}"
+      end
+      message
+    end
+
+    def missing_parameters?
+      missing_parameters.any?
+    end
+
+    private
+
+    def missing_parameters
+      @missing_parameters ||=
+        @stack.parameters_with_defaults.select { |_key, value| value.nil? }.keys
+    end
+  end
+end

data/lib/stack_master/role_assumer.rb

@@ -45,6 +45,7 @@ module StackMaster
       credentials_key = "#{account}:#{role}"
       @credentials.fetch(credentials_key) do
         @credentials[credentials_key] = Aws::AssumeRoleCredentials.new(
+          region: StackMaster.cloud_formation_driver.region,
           role_arn: "arn:aws:iam::#{account}:role/#{role}",
           role_session_name: "stack-master-role-assumer"
         )

data/lib/stack_master/stack.rb

@@ -27,12 +27,6 @@ module StackMaster
       template_default_parameters.merge(parameters)
     end
 
-    def missing_parameters?
-      parameters_with_defaults.any? do |key, value|
-        value == nil
-      end
-    end
-
     def self.find(region, stack_name)
       cf = StackMaster.cloud_formation_driver
       cf_stack = cf.describe_stacks(stack_name: stack_name).stacks.first

data/lib/stack_master/validator.rb

@@ -10,12 +10,12 @@ module StackMaster
     end
 
     def perform
-      parameter_hash = ParameterLoader.load(@stack_definition.parameter_files)
-      compile_time_parameters = ParameterResolver.resolve(@config, @stack_definition, parameter_hash[:compile_time_parameters])
-
       StackMaster.stdout.print "#{@stack_definition.stack_name}: "
-      template_body = TemplateCompiler.compile(@config, @stack_definition.compiler, @stack_definition.template_dir, @stack_definition.template, compile_time_parameters, @stack_definition.compiler_options)
-      cf.validate_template(template_body: TemplateUtils.maybe_compressed_template_body(template_body))
+      if parameter_validator.missing_parameters?
+        StackMaster.stdout.puts "invalid\n#{parameter_validator.error_message}"
+        return false
+      end
+      cf.validate_template(template_body: TemplateUtils.maybe_compressed_template_body(stack.template_body))
       StackMaster.stdout.puts "valid"
       true
     rescue Aws::CloudFormation::Errors::ValidationError => e
@@ -28,5 +28,13 @@ module StackMaster
     def cf
       @cf ||= StackMaster.cloud_formation_driver
     end
+
+    def stack
+      @stack ||= Stack.generate(@stack_definition, @config)
+    end
+
+    def parameter_validator
+      @parameter_validator ||= ParameterValidator.new(stack: stack, stack_definition: @stack_definition)
+    end
   end
 end

data/lib/stack_master/version.rb

@@ -1,3 +1,3 @@
 module StackMaster
-  VERSION = "2.3.0"
+  VERSION = "2.4.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: stack_master
 version: !ruby/object:Gem::Version
-  version: 2.3.0
+  version: 2.4.0
 platform: ruby
 authors:
 - Steve Hodgkiss
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-03-18 00:00:00.000000000 Z
+date: 2020-04-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -255,6 +255,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1'
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-iam
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
 - !ruby/object:Gem::Dependency
   name: diffy
   requirement: !ruby/object:Gem::Requirement
@@ -472,6 +486,7 @@ files:
 - lib/stack_master/parameter_resolvers/security_group.rb
 - lib/stack_master/parameter_resolvers/sns_topic_name.rb
 - lib/stack_master/parameter_resolvers/stack_output.rb
+- lib/stack_master/parameter_validator.rb
 - lib/stack_master/prompter.rb
 - lib/stack_master/resolver_array.rb
 - lib/stack_master/role_assumer.rb
@@ -523,8 +538,8 @@ licenses:
 metadata:
   bug_tracker_uri: https://github.com/envato/stack_master/issues
   changelog_uri: https://github.com/envato/stack_master/blob/master/CHANGELOG.md
-  documentation_uri: https://www.rubydoc.info/gems/stack_master/2.3.0
-  source_code_uri: https://github.com/envato/stack_master/tree/v2.3.0
+  documentation_uri: https://www.rubydoc.info/gems/stack_master/2.4.0
+  source_code_uri: https://github.com/envato/stack_master/tree/v2.4.0
 post_install_message: 
 rdoc_options: []
 require_paths: