@adobe/helix-deploy 6.2.28 → 6.2.31

package/CHANGELOG.md

@@ -1,3 +1,24 @@
+## [6.2.31](https://github.com/adobe/helix-deploy/compare/v6.2.30...v6.2.31) (2022-05-07)
+
+
+### Bug Fixes
+
+* **deps:** update external fixes ([88eb649](https://github.com/adobe/helix-deploy/commit/88eb64908850cd80e0a679f659d9a1a7644ef791))
+
+## [6.2.30](https://github.com/adobe/helix-deploy/compare/v6.2.29...v6.2.30) (2022-05-02)
+
+
+### Bug Fixes
+
+* **deps:** update external fixes ([15750cb](https://github.com/adobe/helix-deploy/commit/15750cb0ad2d4c29218f2ffe0a7292fed8bfd88f))
+
+## [6.2.29](https://github.com/adobe/helix-deploy/compare/v6.2.28...v6.2.29) (2022-04-27)
+
+
+### Bug Fixes
+
+* add tags to newly created polyfunc bucket ([#405](https://github.com/adobe/helix-deploy/issues/405)) ([db4286e](https://github.com/adobe/helix-deploy/commit/db4286ea579d91ee2ad8963b87f7fa6562f8947c))
+
 ## [6.2.28](https://github.com/adobe/helix-deploy/compare/v6.2.27...v6.2.28) (2022-04-25)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-deploy",
-  "version": "6.2.28",
+  "version": "6.2.31",
   "description": "Library and Commandline Tools to build and deploy OpenWhisk Actions",
   "license": "Apache-2.0",
   "homepage": "https://github.com/adobe/helix-deploy#readme",
@@ -39,31 +39,31 @@
   "dependencies": {
     "@adobe/fastly-native-promises": "2.0.7",
     "@adobe/helix-fetch": "3.0.9",
-    "@aws-sdk/client-apigatewayv2": "3.76.0",
-    "@aws-sdk/client-lambda": "3.76.0",
-    "@aws-sdk/client-s3": "3.76.0",
-    "@aws-sdk/client-secrets-manager": "3.76.0",
-    "@aws-sdk/client-ssm": "3.76.0",
+    "@aws-sdk/client-apigatewayv2": "3.85.0",
+    "@aws-sdk/client-lambda": "3.85.0",
+    "@aws-sdk/client-s3": "3.86.0",
+    "@aws-sdk/client-secrets-manager": "3.85.0",
+    "@aws-sdk/client-ssm": "3.85.0",
     "@fastly/js-compute": "0.2.4",
     "@google-cloud/functions": "1.3.0",
     "@google-cloud/secret-manager": "3.12.0",
-    "@google-cloud/storage": "5.19.3",
+    "@google-cloud/storage": "5.19.4",
     "@rollup/plugin-alias": "3.1.9",
-    "@rollup/plugin-commonjs": "21.1.0",
+    "@rollup/plugin-commonjs": "22.0.0",
     "@rollup/plugin-json": "4.1.0",
-    "@rollup/plugin-node-resolve": "13.2.1",
+    "@rollup/plugin-node-resolve": "13.3.0",
     "archiver": "5.3.1",
     "chalk-template": "0.4.0",
     "constants-browserify": "1.0.0",
     "dotenv": "16.0.0",
-    "express": "4.17.3",
+    "express": "4.18.1",
     "form-data": "4.0.0",
     "fs-extra": "10.1.0",
     "get-stream": "6.0.1",
     "isomorphic-git": "1.17.1",
     "openwhisk": "3.21.6",
     "proxyquire": "2.1.3",
-    "rollup": "2.70.2",
+    "rollup": "2.72.0",
     "rollup-plugin-terser": "7.0.2",
     "semver": "7.3.7",
     "tar": "6.1.11",
@@ -72,7 +72,7 @@
   },
   "devDependencies": {
     "@adobe/eslint-config-helix": "1.3.2",
-    "@adobe/helix-shared-wrap": "1.0.4",
+    "@adobe/helix-shared-wrap": "1.0.5",
     "@adobe/helix-status": "9.2.11",
     "@adobe/helix-universal-logger": "2.0.7",
     "@semantic-release/changelog": "6.0.1",
@@ -81,12 +81,12 @@
     "chai": "4.3.6",
     "chai-http": "4.3.0",
     "codecov": "3.8.3",
-    "eslint": "8.14.0",
+    "eslint": "8.15.0",
     "eslint-plugin-header": "3.1.1",
     "eslint-plugin-import": "2.26.0",
     "husky": "7.0.4",
-    "lint-staged": "12.4.0",
-    "mocha": "9.2.2",
+    "lint-staged": "12.4.1",
+    "mocha": "10.0.0",
     "mocha-junit-reporter": "2.0.2",
     "mocha-multi-reporters": "1.5.1",
     "nock": "13.2.4",

package/src/deploy/AWSConfig.js

@@ -27,6 +27,7 @@ export default class AWSConfig {
       createAuthorizer: '',
       attachAuthorizer: '',
       identitySources: ['$request.header.Authorization'],
+      deployTemplate: 'helix-deploy-template',
     });
   }
 
@@ -42,7 +43,8 @@ export default class AWSConfig {
       .withAWSCleanUpBuckets(argv.awsCleanupBuckets)
       .withAWSCleanUpIntegrations(argv.awsCleanupIntegrations)
       .withAWSCreateRoutes(argv.awsCreateRoutes)
-      .withAWSParamsManager(argv.awsParameterManager);
+      .withAWSParamsManager(argv.awsParameterManager)
+      .withAWSDeployTemplate(argv.awsDeployTemplate);
   }
 
   withAWSRegion(value) {
@@ -100,11 +102,16 @@ export default class AWSConfig {
     return this;
   }
 
+  withAWSDeployTemplate(value) {
+    this.deployTemplate = value;
+    return this;
+  }
+
   static yarg(yargs) {
     return yargs
       .group(['aws-region', 'aws-api', 'aws-role', 'aws-cleanup-buckets', 'aws-cleanup-integrations',
         'aws-create-routes', 'aws-create-authorizer', 'aws-attach-authorizer', 'aws-lambda-format',
-        'aws-parameter-manager'], 'AWS Deployment Options')
+        'aws-parameter-manager', 'aws-deploy-template'], 'AWS Deployment Options')
       .option('aws-region', {
         description: 'the AWS region to deploy lambda functions to',
         type: 'string',
@@ -162,6 +169,11 @@ export default class AWSConfig {
         description: 'Cleans up unused integrations',
         type: 'boolean',
         default: false,
+      })
+      .option('aws-deploy-template', {
+        description: 'Name of the deploy S3 bucket template to use',
+        type: 'string',
+        default: 'helix-deploy-template',
       });
   }
 }

package/src/deploy/AWSDeployer.js

@@ -13,8 +13,9 @@
 import chalk from 'chalk-template';
 import {
   CreateBucketCommand, DeleteBucketCommand, DeleteObjectCommand, DeleteObjectsCommand,
-  ListBucketsCommand,
+  GetBucketTaggingCommand, ListBucketsCommand,
   ListObjectsV2Command, PutObjectCommand,
+  PutPublicAccessBlockCommand, PutBucketTaggingCommand,
   S3Client,
 } from '@aws-sdk/client-s3';
 
@@ -151,6 +152,44 @@ export default class AWSDeployer extends BaseDeployer {
       Bucket: this._bucket,
     }));
     this.log.info(chalk`{green ok:} bucket ${data.Location} created`);
+
+    const { deployTemplate } = this._cfg;
+    if (!deployTemplate) {
+      return;
+    }
+
+    let tags;
+    try {
+      // Obtain tags from template bucket
+      const result = await this._s3.send(new GetBucketTaggingCommand({
+        Bucket: deployTemplate,
+      }));
+      tags = result.TagSet;
+    } catch (e) {
+      this.log.warn(`Unable to obtain default tags from template bucket: ${this.bucket}`, e);
+      return;
+    }
+
+    // Block public access
+    await this._s3.send(new PutPublicAccessBlockCommand({
+      Bucket: this._bucket,
+      PublicAccessBlockConfiguration: {
+        BlockPublicAcls: true,
+        IgnorePublicAcls: true,
+        BlockPublicPolicy: true,
+        RestrictPublicBuckets: true,
+      },
+    }));
+    this.log.info(chalk`{green ok:} bucket ${data.Location} hidden from public`);
+
+    // Put required tags
+    await this._s3.send(new PutBucketTaggingCommand({
+      Bucket: this._bucket,
+      Tagging: {
+        TagSet: tags,
+      },
+    }));
+    this.log.info(chalk`{green ok:} added tags to bucket ${data.Location}`);
   }
 
   async uploadZIP() {