@adobe/helix-deploy 6.2.28 → 6.2.29

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [6.2.29](https://github.com/adobe/helix-deploy/compare/v6.2.28...v6.2.29) (2022-04-27)
+
+
+### Bug Fixes
+
+* add tags to newly created polyfunc bucket ([#405](https://github.com/adobe/helix-deploy/issues/405)) ([db4286e](https://github.com/adobe/helix-deploy/commit/db4286ea579d91ee2ad8963b87f7fa6562f8947c))
+
 ## [6.2.28](https://github.com/adobe/helix-deploy/compare/v6.2.27...v6.2.28) (2022-04-25)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-deploy",
-  "version": "6.2.28",
+  "version": "6.2.29",
   "description": "Library and Commandline Tools to build and deploy OpenWhisk Actions",
   "license": "Apache-2.0",
   "homepage": "https://github.com/adobe/helix-deploy#readme",

package/src/deploy/AWSConfig.js

@@ -27,6 +27,7 @@ export default class AWSConfig {
       createAuthorizer: '',
       attachAuthorizer: '',
       identitySources: ['$request.header.Authorization'],
+      deployTemplate: 'helix-deploy-template',
     });
   }
 
@@ -42,7 +43,8 @@ export default class AWSConfig {
       .withAWSCleanUpBuckets(argv.awsCleanupBuckets)
       .withAWSCleanUpIntegrations(argv.awsCleanupIntegrations)
       .withAWSCreateRoutes(argv.awsCreateRoutes)
-      .withAWSParamsManager(argv.awsParameterManager);
+      .withAWSParamsManager(argv.awsParameterManager)
+      .withAWSDeployTemplate(argv.awsDeployTemplate);
   }
 
   withAWSRegion(value) {
@@ -100,11 +102,16 @@ export default class AWSConfig {
     return this;
   }
 
+  withAWSDeployTemplate(value) {
+    this.deployTemplate = value;
+    return this;
+  }
+
   static yarg(yargs) {
     return yargs
       .group(['aws-region', 'aws-api', 'aws-role', 'aws-cleanup-buckets', 'aws-cleanup-integrations',
         'aws-create-routes', 'aws-create-authorizer', 'aws-attach-authorizer', 'aws-lambda-format',
-        'aws-parameter-manager'], 'AWS Deployment Options')
+        'aws-parameter-manager', 'aws-deploy-template'], 'AWS Deployment Options')
       .option('aws-region', {
         description: 'the AWS region to deploy lambda functions to',
         type: 'string',
@@ -162,6 +169,11 @@ export default class AWSConfig {
         description: 'Cleans up unused integrations',
         type: 'boolean',
         default: false,
+      })
+      .option('aws-deploy-template', {
+        description: 'Name of the deploy S3 bucket template to use',
+        type: 'string',
+        default: 'helix-deploy-template',
       });
   }
 }

package/src/deploy/AWSDeployer.js

@@ -13,8 +13,9 @@
 import chalk from 'chalk-template';
 import {
   CreateBucketCommand, DeleteBucketCommand, DeleteObjectCommand, DeleteObjectsCommand,
-  ListBucketsCommand,
+  GetBucketTaggingCommand, ListBucketsCommand,
   ListObjectsV2Command, PutObjectCommand,
+  PutPublicAccessBlockCommand, PutBucketTaggingCommand,
   S3Client,
 } from '@aws-sdk/client-s3';
 
@@ -151,6 +152,44 @@ export default class AWSDeployer extends BaseDeployer {
       Bucket: this._bucket,
     }));
     this.log.info(chalk`{green ok:} bucket ${data.Location} created`);
+
+    const { deployTemplate } = this._cfg;
+    if (!deployTemplate) {
+      return;
+    }
+
+    let tags;
+    try {
+      // Obtain tags from template bucket
+      const result = await this._s3.send(new GetBucketTaggingCommand({
+        Bucket: deployTemplate,
+      }));
+      tags = result.TagSet;
+    } catch (e) {
+      this.log.warn(`Unable to obtain default tags from template bucket: ${this.bucket}`, e);
+      return;
+    }
+
+    // Block public access
+    await this._s3.send(new PutPublicAccessBlockCommand({
+      Bucket: this._bucket,
+      PublicAccessBlockConfiguration: {
+        BlockPublicAcls: true,
+        IgnorePublicAcls: true,
+        BlockPublicPolicy: true,
+        RestrictPublicBuckets: true,
+      },
+    }));
+    this.log.info(chalk`{green ok:} bucket ${data.Location} hidden from public`);
+
+    // Put required tags
+    await this._s3.send(new PutBucketTaggingCommand({
+      Bucket: this._bucket,
+      Tagging: {
+        TagSet: tags,
+      },
+    }));
+    this.log.info(chalk`{green ok:} added tags to bucket ${data.Location}`);
   }
 
   async uploadZIP() {