@adobe/helix-deploy 9.3.21 → 9.4.0

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+# [9.4.0](https://github.com/adobe/helix-deploy/compare/v9.3.21...v9.4.0) (2023-12-07)
+
+
+### Features
+
+* **aws:** add layer, log format, tracing mode and extra permission AWS options ([141a995](https://github.com/adobe/helix-deploy/commit/141a995a0fa8834dd4e4df0281f1a1276961c3ef))
+
 ## [9.3.21](https://github.com/adobe/helix-deploy/compare/v9.3.20...v9.3.21) (2023-12-02)
 
 

package/README.md

@@ -130,6 +130,10 @@ AWS Deployment Options
       --aws-update-secrets        Uploads the function specific secrets with the params. defaults to /helix-deploy/{pkg}/{name}  [string]
       --aws-deploy-bucket         Name of the deploy S3 bucket to use (default is helix-deploy-bucket-{accountId})  [string] [default: ""]
       --aws-identity-source       Identity source to used when creating the authorizer  [array] [default: ["$request.header.Authorization"]]
+      --aws-log-format            The lambda log format. Can be either "JSON" or "Text". [string]
+      --aws-layers                List of layers ARNs to attach to the lambda function.  [array]
+      --aws-tracing-mode          The lambda tracing mode. Can be either "Active" or "PassThrough". [string]
+      --aws-extra-permissions     A list fo additional invoke permissions to add to the lambda function in the form <SourceARN>@<Principal>. [array]
 
 Google Deployment Options
       --google-project-id  the Google Cloud project to deploy to. Optional when the key file is a JSON file  [string] [default: ""]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-deploy",
-  "version": "9.3.21",
+  "version": "9.4.0",
   "description": "Library and Commandline Tools to build and deploy OpenWhisk Actions",
   "license": "Apache-2.0",
   "homepage": "https://github.com/adobe/helix-deploy#readme",

package/src/deploy/AWSConfig.js

@@ -29,6 +29,10 @@ export default class AWSConfig {
       identitySources: ['$request.header.Authorization'],
       deployBucket: '',
       updateSecrets: undefined,
+      logFormat: undefined,
+      layers: undefined,
+      tracingMode: undefined,
+      extraPermissions: undefined,
     });
   }
 
@@ -46,7 +50,11 @@ export default class AWSConfig {
       .withAWSCreateRoutes(argv.awsCreateRoutes)
       .withAWSParamsManager(argv.awsParameterManager)
       .withAWSDeployBucket(argv.awsDeployBucket)
-      .withAWSUpdateSecrets(argv.awsUpdateSecrets);
+      .withAWSUpdateSecrets(argv.awsUpdateSecrets)
+      .withAWSLogFormat(argv.awsLogFormat)
+      .withAWSLayers(argv.awsLayers)
+      .withAWSTracingMode(argv.awsTracingMode)
+      .withAWSExtraPermissions(argv.awsExtraPermissions);
   }
 
   withAWSRegion(value) {
@@ -117,12 +125,33 @@ export default class AWSConfig {
     return this;
   }
 
+  withAWSLogFormat(value) {
+    this.logFormat = value;
+    return this;
+  }
+
+  withAWSLayers(value) {
+    this.layers = value;
+    return this;
+  }
+
+  withAWSTracingMode(value) {
+    this.tracingMode = value;
+    return this;
+  }
+
+  withAWSExtraPermissions(value) {
+    this.extraPermissions = value;
+    return this;
+  }
+
   static yarg(yargs) {
     return yargs
       .group(['aws-region', 'aws-api', 'aws-role', 'aws-cleanup-buckets', 'aws-cleanup-integrations',
         'aws-create-routes', 'aws-create-authorizer', 'aws-attach-authorizer', 'aws-lambda-format',
         'aws-parameter-manager', 'aws-deploy-template', 'aws-arch', 'aws-update-secrets',
-        'aws-deploy-bucket', 'aws-identity-source'], 'AWS Deployment Options')
+        'aws-deploy-bucket', 'aws-identity-source', 'aws-log-format', 'aws-layers',
+        'aws-tracing-mode', 'aws-extra-permissions'], 'AWS Deployment Options')
       .option('aws-region', {
         description: 'the AWS region to deploy lambda functions to',
         type: 'string',
@@ -189,6 +218,24 @@ export default class AWSConfig {
         description: 'Name of the deploy S3 bucket to use (default is helix-deploy-bucket-{accountId})',
         type: 'string',
         default: '',
+      })
+      .option('aws-log-format', {
+        description: 'The lambda log format. Can be either "JSON" or "Text".',
+        type: 'string',
+      })
+      .option('aws-layers', {
+        description: 'List of layers ARNs to attach to the lambda function.',
+        type: 'string',
+        array: true,
+      })
+      .option('aws-tracing-mode', {
+        description: 'The lambda tracing mode. Can be either "Active" or "PassThrough".',
+        type: 'string',
+      })
+      .option('aws-extra-permissions', {
+        description: 'A list fo additional invoke permissions to add to the lambda function in the form <SourceARN>@<Principal>.',
+        type: 'string',
+        array: true,
       });
   }
 }

package/src/deploy/AWSDeployer.js

@@ -235,6 +235,9 @@ export default class AWSDeployer extends BaseDeployer {
       Architectures: [
         this._cfg.arch,
       ],
+      LoggingConfig: this._cfg.logFormat ? { Format: this._cfg.logFormat } : undefined,
+      Layers: this._cfg.layers,
+      TracingConfig: this._cfg.tracingMode ? { Mode: this._cfg.tracingMode } : undefined,
     };
 
     this.log.info(`--: using lambda role "${this._cfg.role}"`);
@@ -873,6 +876,28 @@ export default class AWSDeployer extends BaseDeployer {
     }
   }
 
+  async createExtraPermissions() {
+    const { functionName } = this;
+
+    if (this._cfg.extraPermissions) {
+      await Promise.allSettled(this._cfg.extraPermissions.map(async (extraPermission) => {
+        const [sourceArn, principal] = extraPermission.split('@', 2);
+        try {
+          await this._lambda.send(new AddPermissionCommand({
+            FunctionName: functionName,
+            Action: 'lambda:InvokeFunction',
+            SourceArn: sourceArn,
+            Principal: principal,
+            StatementId: crypto.createHash('sha256').update(functionName + sourceArn).digest('hex'),
+          }));
+          this.log.info(chalk`{green ok:} added invoke permissions for ${sourceArn}`);
+        } catch (e) {
+          // ignore, most likely the permission already exists
+        }
+      }));
+    }
+  }
+
   async deploy() {
     try {
       this.log.info(`--: using aws region "${this._cfg.region}"`);
@@ -881,6 +906,7 @@ export default class AWSDeployer extends BaseDeployer {
       await this.createLambda();
       await this.deleteZIP();
       await this.createAPI();
+      await this.createExtraPermissions();
       await this.checkFunctionReady();
     } catch (err) {
       this.log.error(`Unable to deploy Lambda function: ${err.message}`, err);