@backstage/plugin-catalog-backend-module-aws 0.0.0-nightly-20220219022334

package/CHANGELOG.md

@@ -0,0 +1,40 @@
+# @backstage/plugin-catalog-backend-module-aws
+
+## 0.0.0-nightly-20220219022334
+### Minor Changes
+
+- 25e97e7242: Added this new catalog module, initially containing only the
+  `AwsOrganizationCloudAccountProcessor`.
+  
+  Note that this was moved over from the catalog backend itself, and therefore is
+  no longer part of its builtin set of processors. If you were using this
+  processor, through making use of the location type `aws-cloud-accounts` and/or
+  using the configuration key `catalog.processors.awsOrganization`, you will from
+  now on have to add the processor manually to your catalog.
+  
+  First, add the `@backstage/plugin-catalog-backend-module-aws` dependency to your
+  `packages/backend` package.
+  
+  Then, in `packages/backend/src/plugins/catalog.ts`:
+  
+  ```diff
+  +import { AwsOrganizationCloudAccountProcessor } from '@backstage/plugin-catalog-backend-module-aws';
+  
+   export default async function createPlugin(
+     env: PluginEnvironment,
+   ): Promise<Router> {
+     const builder = await CatalogBuilder.create(env);
+  +  builder.addProcessor(
+  +    AwsOrganizationCloudAccountProcessor.fromConfig(
+  +      env.config,
+  +      { logger: env.logger }
+  +    )
+  +  );
+     // ...
+  ```
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/plugin-catalog-backend@0.0.0-nightly-20220219022334
+  - @backstage/catalog-model@0.0.0-nightly-20220219022334

package/README.md

@@ -0,0 +1,10 @@
+# Catalog Backend Module for LDAP
+
+This is an extension module to the plugin-catalog-backend plugin, providing an
+`AwsOrganizationCloudAccountProcessor` that can be used to ingest cloud accounts
+as `Resource` kind entities.
+
+## Getting started
+
+See [Backstage documentation](https://backstage.io/docs/integrations/ldap/org) for details on how to install
+and configure the plugin.

package/config.d.ts

@@ -0,0 +1,36 @@
+/*
+ * Copyright 2020 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export interface Config {
+  catalog?: {
+    /**
+     * List of processor-specific options and attributes
+     */
+    processors?: {
+      /**
+       * AwsOrganizationCloudAccountProcessor configuration
+       */
+      awsOrganization?: {
+        provider: {
+          /**
+           * The role to be assumed by this processor
+           */
+          roleArn?: string;
+        };
+      };
+    };
+  };
+}

package/dist/index.cjs.js

@@ -0,0 +1,120 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var pluginCatalogBackend = require('@backstage/plugin-catalog-backend');
+var AWS = require('aws-sdk');
+
+function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
+
+var AWS__default = /*#__PURE__*/_interopDefaultLegacy(AWS);
+
+function readAwsOrganizationConfig(config) {
+  const providerConfig = config.getOptionalConfig("provider");
+  const roleArn = providerConfig == null ? void 0 : providerConfig.getOptionalString("roleArn");
+  return {
+    roleArn
+  };
+}
+
+const AWS_ORGANIZATION_REGION = "us-east-1";
+const LOCATION_TYPE = "aws-cloud-accounts";
+const ACCOUNTID_ANNOTATION = "amazonaws.com/account-id";
+const ARN_ANNOTATION = "amazonaws.com/arn";
+const ORGANIZATION_ANNOTATION = "amazonaws.com/organization-id";
+class AwsOrganizationCloudAccountProcessor {
+  static fromConfig(config, options) {
+    const c = config.getOptionalConfig("catalog.processors.awsOrganization");
+    return new AwsOrganizationCloudAccountProcessor({
+      ...options,
+      provider: c ? readAwsOrganizationConfig(c) : {}
+    });
+  }
+  static buildCredentials(config) {
+    const roleArn = config.roleArn;
+    if (!roleArn) {
+      return void 0;
+    }
+    return new AWS__default["default"].ChainableTemporaryCredentials({
+      params: {
+        RoleSessionName: "backstage-aws-organization-processor",
+        RoleArn: roleArn
+      }
+    });
+  }
+  constructor(options) {
+    this.provider = options.provider;
+    const credentials = AwsOrganizationCloudAccountProcessor.buildCredentials(this.provider);
+    this.organizations = new AWS__default["default"].Organizations({
+      credentials,
+      region: AWS_ORGANIZATION_REGION
+    });
+  }
+  getProcessorName() {
+    return "AwsOrganizationCloudAccountProcessor";
+  }
+  async readLocation(location, _optional, emit) {
+    if (location.type !== LOCATION_TYPE) {
+      return false;
+    }
+    (await this.getAwsAccounts()).map((account) => this.mapAccountToComponent(account)).filter((entity) => {
+      if (location.target !== "") {
+        if (entity.metadata.annotations) {
+          return entity.metadata.annotations[ORGANIZATION_ANNOTATION] === location.target;
+        }
+        return false;
+      }
+      return true;
+    }).forEach((entity) => {
+      emit(pluginCatalogBackend.results.entity(location, entity));
+    });
+    return true;
+  }
+  normalizeName(name) {
+    return name.trim().toLocaleLowerCase("en-US").replace(/[^a-zA-Z0-9\-]/g, "-");
+  }
+  extractInformationFromArn(arn) {
+    const parts = arn.split("/");
+    return {
+      accountId: parts[parts.length - 1],
+      organizationId: parts[parts.length - 2]
+    };
+  }
+  async getAwsAccounts() {
+    let awsAccounts = [];
+    let isInitialAttempt = true;
+    let nextToken = void 0;
+    while (isInitialAttempt || nextToken) {
+      isInitialAttempt = false;
+      const orgAccounts = await this.organizations.listAccounts({ NextToken: nextToken }).promise();
+      if (orgAccounts.Accounts) {
+        awsAccounts = awsAccounts.concat(orgAccounts.Accounts);
+      }
+      nextToken = orgAccounts.NextToken;
+    }
+    return awsAccounts;
+  }
+  mapAccountToComponent(account) {
+    const { accountId, organizationId } = this.extractInformationFromArn(account.Arn);
+    return {
+      apiVersion: "backstage.io/v1alpha1",
+      kind: "Resource",
+      metadata: {
+        annotations: {
+          [ACCOUNTID_ANNOTATION]: accountId,
+          [ARN_ANNOTATION]: account.Arn || "",
+          [ORGANIZATION_ANNOTATION]: organizationId
+        },
+        name: this.normalizeName(account.Name || ""),
+        namespace: "default"
+      },
+      spec: {
+        type: "cloud-account",
+        owner: "unknown"
+      }
+    };
+  }
+}
+
+exports.AwsOrganizationCloudAccountProcessor = AwsOrganizationCloudAccountProcessor;
+//# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs.js","sources":["../src/awsOrganization/config.ts","../src/processors/AwsOrganizationCloudAccountProcessor.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Config } from '@backstage/config';\n\n/**\n * The configuration parameters for a single AWS Organization Processor\n */\nexport type AwsOrganizationProviderConfig = {\n  /**\n   * The role to assume for the processor.\n   */\n  roleArn?: string;\n};\n\nexport function readAwsOrganizationConfig(\n  config: Config,\n): AwsOrganizationProviderConfig {\n  const providerConfig = config.getOptionalConfig('provider');\n\n  const roleArn = providerConfig?.getOptionalString('roleArn');\n  return {\n    roleArn,\n  };\n}\n","/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { LocationSpec, ResourceEntityV1alpha1 } from '@backstage/catalog-model';\nimport { Config } from '@backstage/config';\nimport {\n  CatalogProcessor,\n  CatalogProcessorEmit,\n  results,\n} from '@backstage/plugin-catalog-backend';\nimport AWS, { Credentials, Organizations } from 'aws-sdk';\nimport { Account, ListAccountsResponse } from 'aws-sdk/clients/organizations';\nimport { Logger } from 'winston';\nimport {\n  AwsOrganizationProviderConfig,\n  readAwsOrganizationConfig,\n} from '../awsOrganization/config';\n\nconst AWS_ORGANIZATION_REGION = 'us-east-1';\nconst LOCATION_TYPE = 'aws-cloud-accounts';\n\nconst ACCOUNTID_ANNOTATION = 'amazonaws.com/account-id';\nconst ARN_ANNOTATION = 'amazonaws.com/arn';\nconst ORGANIZATION_ANNOTATION = 'amazonaws.com/organization-id';\n\n/**\n * A processor for ingesting AWS Accounts from AWS Organizations.\n *\n * If custom authentication is needed, it can be achieved by configuring the\n * global AWS.credentials object.\n *\n * @public\n */\nexport class AwsOrganizationCloudAccountProcessor implements CatalogProcessor {\n  private readonly organizations: Organizations;\n  private readonly provider: AwsOrganizationProviderConfig;\n\n  static fromConfig(config: Config, options: { logger: Logger }) {\n    const c = config.getOptionalConfig('catalog.processors.awsOrganization');\n    return new AwsOrganizationCloudAccountProcessor({\n      ...options,\n      provider: c ? readAwsOrganizationConfig(c) : {},\n    });\n  }\n\n  private static buildCredentials(\n    config: AwsOrganizationProviderConfig,\n  ): Credentials | undefined {\n    const roleArn = config.roleArn;\n    if (!roleArn) {\n      return undefined;\n    }\n\n    return new AWS.ChainableTemporaryCredentials({\n      params: {\n        RoleSessionName: 'backstage-aws-organization-processor',\n        RoleArn: roleArn,\n      },\n    });\n  }\n\n  private constructor(options: { provider: AwsOrganizationProviderConfig }) {\n    this.provider = options.provider;\n    const credentials = AwsOrganizationCloudAccountProcessor.buildCredentials(\n      this.provider,\n    );\n    this.organizations = new AWS.Organizations({\n      credentials,\n      region: AWS_ORGANIZATION_REGION,\n    }); // Only available in us-east-1\n  }\n\n  getProcessorName(): string {\n    return 'AwsOrganizationCloudAccountProcessor';\n  }\n\n  async readLocation(\n    location: LocationSpec,\n    _optional: boolean,\n    emit: CatalogProcessorEmit,\n  ): Promise<boolean> {\n    if (location.type !== LOCATION_TYPE) {\n      return false;\n    }\n\n    (await this.getAwsAccounts())\n      .map(account => this.mapAccountToComponent(account))\n      .filter(entity => {\n        if (location.target !== '') {\n          if (entity.metadata.annotations) {\n            return (\n              entity.metadata.annotations[ORGANIZATION_ANNOTATION] ===\n              location.target\n            );\n          }\n          return false;\n        }\n        return true;\n      })\n      .forEach(entity => {\n        emit(results.entity(location, entity));\n      });\n\n    return true;\n  }\n\n  private normalizeName(name: string): string {\n    return name\n      .trim()\n      .toLocaleLowerCase('en-US')\n      .replace(/[^a-zA-Z0-9\\-]/g, '-');\n  }\n\n  private extractInformationFromArn(arn: string): {\n    accountId: string;\n    organizationId: string;\n  } {\n    const parts = arn.split('/');\n\n    return {\n      accountId: parts[parts.length - 1],\n      organizationId: parts[parts.length - 2],\n    };\n  }\n\n  private async getAwsAccounts(): Promise<Account[]> {\n    let awsAccounts: Account[] = [];\n    let isInitialAttempt = true;\n    let nextToken = undefined;\n    while (isInitialAttempt || nextToken) {\n      isInitialAttempt = false;\n      const orgAccounts: ListAccountsResponse = await this.organizations\n        .listAccounts({ NextToken: nextToken })\n        .promise();\n      if (orgAccounts.Accounts) {\n        awsAccounts = awsAccounts.concat(orgAccounts.Accounts);\n      }\n      nextToken = orgAccounts.NextToken;\n    }\n\n    return awsAccounts;\n  }\n\n  private mapAccountToComponent(account: Account): ResourceEntityV1alpha1 {\n    const { accountId, organizationId } = this.extractInformationFromArn(\n      account.Arn as string,\n    );\n    return {\n      apiVersion: 'backstage.io/v1alpha1',\n      kind: 'Resource',\n      metadata: {\n        annotations: {\n          [ACCOUNTID_ANNOTATION]: accountId,\n          [ARN_ANNOTATION]: account.Arn || '',\n          [ORGANIZATION_ANNOTATION]: organizationId,\n        },\n        name: this.normalizeName(account.Name || ''),\n        namespace: 'default',\n      },\n      spec: {\n        type: 'cloud-account',\n        owner: 'unknown',\n      },\n    };\n  }\n}\n"],"names":["AWS","results"],"mappings":";;;;;;;;;;;mCA6BE,QAC+B;AAC/B,QAAM,iBAAiB,OAAO,kBAAkB;AAEhD,QAAM,UAAU,iDAAgB,kBAAkB;AAClD,SAAO;AAAA,IACL;AAAA;AAAA;;ACJJ,MAAM,0BAA0B;AAChC,MAAM,gBAAgB;AAEtB,MAAM,uBAAuB;AAC7B,MAAM,iBAAiB;AACvB,MAAM,0BAA0B;2CAU8C;AAAA,SAIrE,WAAW,QAAgB,SAA6B;AAC7D,UAAM,IAAI,OAAO,kBAAkB;AACnC,WAAO,IAAI,qCAAqC;AAAA,SAC3C;AAAA,MACH,UAAU,IAAI,0BAA0B,KAAK;AAAA;AAAA;AAAA,SAIlC,iBACb,QACyB;AACzB,UAAM,UAAU,OAAO;AACvB,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA;AAGT,WAAO,IAAIA,wBAAI,8BAA8B;AAAA,MAC3C,QAAQ;AAAA,QACN,iBAAiB;AAAA,QACjB,SAAS;AAAA;AAAA;AAAA;AAAA,EAKP,YAAY,SAAsD;AACxE,SAAK,WAAW,QAAQ;AACxB,UAAM,cAAc,qCAAqC,iBACvD,KAAK;AAEP,SAAK,gBAAgB,IAAIA,wBAAI,cAAc;AAAA,MACzC;AAAA,MACA,QAAQ;AAAA;AAAA;AAAA,EAIZ,mBAA2B;AACzB,WAAO;AAAA;AAAA,QAGH,aACJ,UACA,WACA,MACkB;AAClB,QAAI,SAAS,SAAS,eAAe;AACnC,aAAO;AAAA;AAGT,IAAC,OAAM,KAAK,kBACT,IAAI,aAAW,KAAK,sBAAsB,UAC1C,OAAO,YAAU;AAChB,UAAI,SAAS,WAAW,IAAI;AAC1B,YAAI,OAAO,SAAS,aAAa;AAC/B,iBACE,OAAO,SAAS,YAAY,6BAC5B,SAAS;AAAA;AAGb,eAAO;AAAA;AAET,aAAO;AAAA,OAER,QAAQ,YAAU;AACjB,WAAKC,6BAAQ,OAAO,UAAU;AAAA;AAGlC,WAAO;AAAA;AAAA,EAGD,cAAc,MAAsB;AAC1C,WAAO,KACJ,OACA,kBAAkB,SAClB,QAAQ,mBAAmB;AAAA;AAAA,EAGxB,0BAA0B,KAGhC;AACA,UAAM,QAAQ,IAAI,MAAM;AAExB,WAAO;AAAA,MACL,WAAW,MAAM,MAAM,SAAS;AAAA,MAChC,gBAAgB,MAAM,MAAM,SAAS;AAAA;AAAA;AAAA,QAI3B,iBAAqC;AACjD,QAAI,cAAyB;AAC7B,QAAI,mBAAmB;AACvB,QAAI,YAAY;AAChB,WAAO,oBAAoB,WAAW;AACpC,yBAAmB;AACnB,YAAM,cAAoC,MAAM,KAAK,cAClD,aAAa,EAAE,WAAW,aAC1B;AACH,UAAI,YAAY,UAAU;AACxB,sBAAc,YAAY,OAAO,YAAY;AAAA;AAE/C,kBAAY,YAAY;AAAA;AAG1B,WAAO;AAAA;AAAA,EAGD,sBAAsB,SAA0C;AACtE,UAAM,EAAE,WAAW,mBAAmB,KAAK,0BACzC,QAAQ;AAEV,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,UAAU;AAAA,QACR,aAAa;AAAA,WACV,uBAAuB;AAAA,WACvB,iBAAiB,QAAQ,OAAO;AAAA,WAChC,0BAA0B;AAAA;AAAA,QAE7B,MAAM,KAAK,cAAc,QAAQ,QAAQ;AAAA,QACzC,WAAW;AAAA;AAAA,MAEb,MAAM;AAAA,QACJ,MAAM;AAAA,QACN,OAAO;AAAA;AAAA;AAAA;AAAA;;;;"}

package/dist/index.d.ts

@@ -0,0 +1,30 @@
+import { LocationSpec } from '@backstage/catalog-model';
+import { Config } from '@backstage/config';
+import { CatalogProcessor, CatalogProcessorEmit } from '@backstage/plugin-catalog-backend';
+import { Logger } from 'winston';
+
+/**
+ * A processor for ingesting AWS Accounts from AWS Organizations.
+ *
+ * If custom authentication is needed, it can be achieved by configuring the
+ * global AWS.credentials object.
+ *
+ * @public
+ */
+declare class AwsOrganizationCloudAccountProcessor implements CatalogProcessor {
+    private readonly organizations;
+    private readonly provider;
+    static fromConfig(config: Config, options: {
+        logger: Logger;
+    }): AwsOrganizationCloudAccountProcessor;
+    private static buildCredentials;
+    private constructor();
+    getProcessorName(): string;
+    readLocation(location: LocationSpec, _optional: boolean, emit: CatalogProcessorEmit): Promise<boolean>;
+    private normalizeName;
+    private extractInformationFromArn;
+    private getAwsAccounts;
+    private mapAccountToComponent;
+}
+
+export { AwsOrganizationCloudAccountProcessor };

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@backstage/plugin-catalog-backend-module-aws",
+  "description": "A Backstage catalog backend module that helps integrate towards AWS",
+  "version": "0.0.0-nightly-20220219022334",
+  "main": "dist/index.cjs.js",
+  "types": "dist/index.d.ts",
+  "license": "Apache-2.0",
+  "private": false,
+  "publishConfig": {
+    "access": "public",
+    "main": "dist/index.cjs.js",
+    "types": "dist/index.d.ts"
+  },
+  "backstage": {
+    "role": "backend-plugin-module"
+  },
+  "homepage": "https://backstage.io",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/backstage/backstage",
+    "directory": "plugins/catalog-backend-module-aws"
+  },
+  "keywords": [
+    "backstage"
+  ],
+  "scripts": {
+    "build": "backstage-cli package build",
+    "lint": "backstage-cli package lint",
+    "test": "backstage-cli package test",
+    "prepack": "backstage-cli package prepack",
+    "postpack": "backstage-cli package postpack",
+    "clean": "backstage-cli package clean",
+    "start": "backstage-cli package start"
+  },
+  "dependencies": {
+    "@backstage/catalog-model": "^0.0.0-nightly-20220219022334",
+    "@backstage/config": "^0.1.14",
+    "@backstage/errors": "^0.2.1",
+    "@backstage/plugin-catalog-backend": "^0.0.0-nightly-20220219022334",
+    "@backstage/types": "^0.1.2",
+    "aws-sdk": "^2.840.0",
+    "lodash": "^4.17.21",
+    "winston": "^3.2.1"
+  },
+  "devDependencies": {
+    "@backstage/cli": "^0.0.0-nightly-20220219022334",
+    "@types/lodash": "^4.14.151",
+    "aws-sdk-mock": "^5.2.1"
+  },
+  "files": [
+    "dist",
+    "config.d.ts"
+  ],
+  "configSchema": "config.d.ts"
+}