@adobe/helix-deploy 7.2.1 → 7.3.0

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [7.3.0](https://github.com/adobe/helix-deploy/compare/v7.2.2...v7.3.0) (2022-11-17)
+
+
+### Features
+
+* use static deploy bucket ([#470](https://github.com/adobe/helix-deploy/issues/470)) ([dfe0a91](https://github.com/adobe/helix-deploy/commit/dfe0a91f3e8564213bfdc933a562433885c5625c)), closes [#469](https://github.com/adobe/helix-deploy/issues/469)
+
+## [7.2.2](https://github.com/adobe/helix-deploy/compare/v7.2.1...v7.2.2) (2022-11-12)
+
+
+### Bug Fixes
+
+* **deps:** update external fixes ([a54668d](https://github.com/adobe/helix-deploy/commit/a54668d351fc830ab1b669db1f8204c7c50ee5f7))
+
 ## [7.2.1](https://github.com/adobe/helix-deploy/compare/v7.2.0...v7.2.1) (2022-11-07)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-deploy",
-  "version": "7.2.1",
+  "version": "7.3.0",
   "description": "Library and Commandline Tools to build and deploy OpenWhisk Actions",
   "license": "Apache-2.0",
   "homepage": "https://github.com/adobe/helix-deploy#readme",
@@ -38,14 +38,15 @@
   "dependencies": {
     "@adobe/fastly-native-promises": "2.0.14",
     "@adobe/fetch": "3.3.0",
-    "@aws-sdk/client-apigatewayv2": "3.204.0",
-    "@aws-sdk/client-lambda": "3.204.0",
-    "@aws-sdk/client-s3": "3.204.0",
-    "@aws-sdk/client-secrets-manager": "3.204.0",
-    "@aws-sdk/client-ssm": "3.204.0",
+    "@aws-sdk/client-apigatewayv2": "3.209.0",
+    "@aws-sdk/client-lambda": "3.209.0",
+    "@aws-sdk/client-s3": "3.209.0",
+    "@aws-sdk/client-secrets-manager": "3.209.0",
+    "@aws-sdk/client-ssm": "3.209.0",
+    "@aws-sdk/client-sts": "3.211.0",
     "@fastly/js-compute": "0.5.4",
-    "@google-cloud/functions": "2.2.1",
-    "@google-cloud/secret-manager": "4.1.3",
+    "@google-cloud/functions": "2.2.3",
+    "@google-cloud/secret-manager": "4.1.4",
     "@google-cloud/storage": "6.7.0",
     "@rollup/plugin-alias": "4.0.2",
     "@rollup/plugin-commonjs": "23.0.2",
@@ -66,7 +67,7 @@
     "rollup-plugin-terser": "7.0.2",
     "semver": "7.3.8",
     "tar": "6.1.12",
-    "webpack": "5.74.0",
+    "webpack": "5.75.0",
     "yargs": "17.6.2"
   },
   "devDependencies": {
@@ -77,20 +78,20 @@
     "@semantic-release/changelog": "6.0.1",
     "@semantic-release/git": "10.0.1",
     "c8": "7.12.0",
-    "chai": "4.3.6",
+    "chai": "4.3.7",
     "chai-http": "4.3.0",
     "codecov": "3.8.3",
     "eslint": "8.27.0",
     "eslint-plugin-header": "3.1.1",
     "eslint-plugin-import": "2.26.0",
-    "husky": "8.0.1",
+    "husky": "8.0.2",
     "lint-staged": "13.0.3",
     "mocha": "10.1.0",
     "mocha-junit-reporter": "2.1.1",
     "mocha-multi-reporters": "1.5.1",
     "nock": "13.2.9",
     "semantic-release": "19.0.5",
-    "sinon": "14.0.1",
+    "sinon": "14.0.2",
     "yauzl": "2.10.0"
   },
   "engines": {

package/src/deploy/AWSConfig.js

@@ -19,7 +19,6 @@ export default class AWSConfig {
       region: '',
       role: '',
       apiId: '',
-      cleanUpBuckets: false,
       cleanUpIntegrations: false,
       createRoutes: false,
       lambdaFormat: DEFAULT_LAMBDA_FORMAT,
@@ -28,7 +27,7 @@ export default class AWSConfig {
       attachAuthorizer: '',
       arch: 'x86_64',
       identitySources: ['$request.header.Authorization'],
-      deployTemplate: 'helix-deploy-template',
+      deployBucket: '',
     });
   }
 
@@ -42,11 +41,10 @@ export default class AWSConfig {
       .withAWSCreateAuthorizer(argv.awsCreateAuthorizer)
       .withAWSAttachAuthorizer(argv.awsAttachAuthorizer)
       .withAWSIdentitySources(argv.awsIdentitySource)
-      .withAWSCleanUpBuckets(argv.awsCleanupBuckets)
       .withAWSCleanUpIntegrations(argv.awsCleanupIntegrations)
       .withAWSCreateRoutes(argv.awsCreateRoutes)
       .withAWSParamsManager(argv.awsParameterManager)
-      .withAWSDeployTemplate(argv.awsDeployTemplate);
+      .withAWSDeployBucket(argv.awsDeployBucket);
   }
 
   withAWSRegion(value) {
@@ -77,11 +75,6 @@ export default class AWSConfig {
     return this;
   }
 
-  withAWSCleanUpBuckets(value) {
-    this.cleanUpBuckets = value;
-    return this;
-  }
-
   withAWSCleanUpIntegrations(value) {
     this.cleanUpIntegrations = value;
     return this;
@@ -112,8 +105,8 @@ export default class AWSConfig {
     return this;
   }
 
-  withAWSDeployTemplate(value) {
-    this.deployTemplate = value;
+  withAWSDeployBucket(value) {
+    this.deployBucket = value;
     return this;
   }
 
@@ -175,20 +168,15 @@ export default class AWSConfig {
         description: 'Attach specified authorizer to routes during linking.',
         type: 'string',
       })
-      .option('aws-cleanup-buckets', {
-        description: 'Cleans up stray temporary S3 buckets',
-        type: 'boolean',
-        default: false,
-      })
       .option('aws-cleanup-integrations', {
         description: 'Cleans up unused integrations',
         type: 'boolean',
         default: false,
       })
-      .option('aws-deploy-template', {
-        description: 'Name of the deploy S3 bucket template to use',
+      .option('aws-deploy-bucket', {
+        description: 'Name of the deploy S3 bucket to use (default is helix-deploy-bucket-{accountId})',
         type: 'string',
-        default: 'helix-deploy-template',
+        default: '',
       });
   }
 }

package/src/deploy/AWSDeployer.js

@@ -12,13 +12,16 @@
 /* eslint-disable no-await-in-loop,no-restricted-syntax */
 import chalk from 'chalk-template';
 import {
-  CreateBucketCommand, DeleteBucketCommand, DeleteObjectCommand, DeleteObjectsCommand,
-  GetBucketTaggingCommand, ListBucketsCommand,
-  ListObjectsV2Command, PutObjectCommand,
-  PutPublicAccessBlockCommand, PutBucketTaggingCommand,
+  DeleteObjectCommand,
+  PutObjectCommand,
   S3Client,
 } from '@aws-sdk/client-s3';
 
+import {
+  GetCallerIdentityCommand,
+  STSClient,
+} from '@aws-sdk/client-sts';
+
 import {
   AddPermissionCommand,
   CreateAliasCommand,
@@ -52,12 +55,17 @@ import ActionBuilder from '../ActionBuilder.js';
 import AWSConfig from './AWSConfig.js';
 
 export default class AWSDeployer extends BaseDeployer {
+  /**
+   * @param {BaseConfig} baseConfig
+   * @param {AWSConfig} config
+   */
   constructor(baseConfig, config) {
     super(baseConfig);
 
     Object.assign(this, {
       id: 'aws',
       name: 'AmazonWebServices',
+      /** @type AWSConfig */
       _cfg: config,
       _functionARN: '',
       _aliasARN: '',
@@ -127,7 +135,6 @@ export default class AWSDeployer extends BaseDeployer {
   }
 
   async init() {
-    this._bucket = `poly-func-maker-temp-${crypto.randomBytes(16).toString('hex')}`;
     if (this._cfg.region) {
       this._s3 = new S3Client({
         region: this._cfg.region,
@@ -147,77 +154,39 @@ export default class AWSDeployer extends BaseDeployer {
     }
   }
 
-  async createS3Bucket() {
-    const data = await this._s3.send(new CreateBucketCommand({
-      Bucket: this._bucket,
-    }));
-    this.log.info(chalk`{green ok:} bucket ${data.Location} created`);
-
-    const { deployTemplate } = this._cfg;
-    if (!deployTemplate) {
-      return;
-    }
-
-    let tags;
-    try {
-      // Obtain tags from template bucket
-      const result = await this._s3.send(new GetBucketTaggingCommand({
-        Bucket: deployTemplate,
-      }));
-      tags = result.TagSet;
-    } catch (e) {
-      this.log.warn(`Unable to obtain default tags from template bucket: ${this.bucket}`, e);
-      return;
-    }
-
-    // Block public access
-    await this._s3.send(new PutPublicAccessBlockCommand({
-      Bucket: this._bucket,
-      PublicAccessBlockConfiguration: {
-        BlockPublicAcls: true,
-        IgnorePublicAcls: true,
-        BlockPublicPolicy: true,
-        RestrictPublicBuckets: true,
-      },
-    }));
-    this.log.info(chalk`{green ok:} bucket ${data.Location} hidden from public`);
-
-    // Put required tags
-    await this._s3.send(new PutBucketTaggingCommand({
-      Bucket: this._bucket,
-      Tagging: {
-        TagSet: tags,
-      },
-    }));
-    this.log.info(chalk`{green ok:} added tags to bucket ${data.Location}`);
+  async initAccountId() {
+    const sts = new STSClient({
+      region: this._cfg.region,
+    });
+    const ret = await sts.send(new GetCallerIdentityCommand());
+    this._accountId = ret.Account;
+    this.log.info(chalk`{green ok:} initialized AWS deployer for account {yellow ${ret.Account}}`);
   }
 
   async uploadZIP() {
     const { cfg } = this;
     const relZip = path.relative(process.cwd(), cfg.zipFile);
 
-    this.log.info(`--: uploading ${relZip} to S3 bucket ${this._bucket} ...`);
+    // ensure upload key is unique
+    this._bucket = this._cfg.deployBucket || `helix-deploy-bucket-${this._accountId}`;
+    this._key = `${path.basename(relZip)}-${crypto.randomBytes(16).toString('hex')}`;
     const uploadParams = {
       Bucket: this._bucket,
-      Key: relZip,
+      Key: this._key,
       Body: await fse.readFile(cfg.zipFile),
     };
 
+    this.log.info(`--: uploading ${relZip} to S3 bucket ${this._bucket} ...`);
     await this._s3.send(new PutObjectCommand(uploadParams));
-
-    this._key = relZip;
-    this.log.info(chalk`{green ok:} file uploaded`);
+    this.log.info(chalk`{green ok:} uploaded deploy package {blueBright s3://${this._bucket}/${this._key}}`);
   }
 
-  async deleteS3Bucket() {
+  async deleteZIP() {
     await this._s3.send(new DeleteObjectCommand({
       Bucket: this._bucket,
       Key: this._key,
     }));
-    await this._s3.send(new DeleteBucketCommand({
-      Bucket: this._bucket,
-    }));
-    this.log.info(chalk`{green ok:} bucket ${this._bucket} emptied and deleted`);
+    this.log.info(chalk`{green ok:} deleted deploy package {blueBright s3://${this._bucket}/${this._key}}.`);
   }
 
   async createLambda() {
@@ -255,7 +224,6 @@ export default class AWSDeployer extends BaseDeployer {
       ],
     };
 
-    console.log(functionConfig);
     this.log.info(`--: using lambda role "${this._cfg.role}"`);
 
     // check if function already exists
@@ -547,37 +515,6 @@ export default class AWSDeployer extends BaseDeployer {
     this.log.info(chalk`{green ok}: parameters updated.`);
   }
 
-  async cleanUpBuckets() {
-    this.log.info('--: cleaning up stray temporary S3 buckets ...');
-    let res = await this._s3.send(new ListBucketsCommand({}));
-    const helixBuckets = res.Buckets.filter((b) => b.Name.startsWith('poly-func-maker-temp-'));
-    if (helixBuckets.length === 0) {
-      this.log.info(chalk`{green ok}: no stray buckets found.`);
-    } else {
-      await Promise.all(helixBuckets.map(async (b) => {
-        // get all objects
-        res = await this._s3.send(new ListObjectsV2Command({
-          Bucket: b.Name,
-        }));
-        const keys = (res.Contents || []).map((c) => ({
-          Key: c.Key,
-        }));
-        if (keys.length) {
-          await this._s3.send(new DeleteObjectsCommand({
-            Bucket: b.Name,
-            Delete: {
-              Objects: keys,
-            },
-          }));
-        }
-        await this._s3.send(new DeleteBucketCommand({
-          Bucket: b.Name,
-        }));
-        this.log.info(chalk`{green ok}: deleted temporary bucket: ${b.Name}.`);
-      }));
-    }
-  }
-
   async cleanUpIntegrations(filter) {
     this.log.info('Clean up Integrations');
     const { ApiId } = await this.initApiId();
@@ -890,7 +827,7 @@ export default class AWSDeployer extends BaseDeployer {
   }
 
   async validateAdditionalTasks() {
-    if (this._cfg.cleanUpBuckets || this._cfg.cleanUpIntegrations) {
+    if (this._cfg.cleanUpIntegrations) {
       // disable auto build if no deploy
       if (!this.cfg.deploy) {
         this.cfg.build = false;
@@ -900,9 +837,6 @@ export default class AWSDeployer extends BaseDeployer {
   }
 
   async runAdditionalTasks() {
-    if (this._cfg.cleanUpBuckets) {
-      await this.cleanUpBuckets();
-    }
     if (this._cfg.cleanUpIntegrations) {
       await this.cleanUpIntegrations();
     }
@@ -911,11 +845,11 @@ export default class AWSDeployer extends BaseDeployer {
   async deploy() {
     try {
       this.log.info(`--: using aws region "${this._cfg.region}"`);
-      await this.createS3Bucket();
+      await this.initAccountId();
       await this.uploadZIP();
       await this.createLambda();
+      await this.deleteZIP();
       await this.createAPI();
-      await this.deleteS3Bucket();
       await this.checkFunctionReady();
     } catch (err) {
       this.log.error(`Unable to deploy Lambda function: ${err.message}`, err);