@continuous-excellence/ze-great-dashboard-aws 0.31.40 → 0.31.42

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/README.md +9 -10
  2. package/bootstrap/core-ecs-v1.yml +76 -24
  3. package/bootstrap/core-v1.yml +67 -28
  4. package/bootstrap/github-oidc-ecs-v1.yml +26 -10
  5. package/bootstrap/github-oidc-v1.yml +22 -12
  6. package/bootstrap/github-oidc-v2.yml +57 -27
  7. package/dist/bootstrap.d.ts +20 -0
  8. package/dist/cli.js +48 -35
  9. package/dist/index.d.ts +1 -1
  10. package/dist/index.js +41 -14
  11. package/dist/lambda.mjs +39 -16
  12. package/package.json +1 -1
  13. package/template-ecs.yml +77 -21
  14. package/template.yml +17 -14
package/README.md CHANGED
@@ -7,7 +7,6 @@ templates. The matching immutable browser client is published separately as
7
7
  another exact asset URL.
8
8
 
9
9
  This package is for teams that already operate AWS and can provide a protected entry path:
10
-
11
10
  - Lambda requires a consumer-owned API Gateway, ALB, or equivalent gateway with private invocation
12
11
  permission.
13
12
  - ECS requires consumer-owned subnets, security groups, and protected load balancing or routing for
@@ -82,7 +81,7 @@ sources, set `SecretReference` to the ARN of one consumer-owned Secrets Manager
82
81
  Parameter Store `SecureString`, for example:
83
82
 
84
83
  ```json
85
- {"GITHUB_TOKEN":"github_pat_…"}
84
+ { "GITHUB_TOKEN": "github_pat_…" }
86
85
  ```
87
86
 
88
87
  The board references `GITHUB_TOKEN` through `token_env`; the credential value never belongs in the
@@ -93,14 +92,14 @@ when a key is absent.
93
92
 
94
93
  ## Ownership boundaries
95
94
 
96
- | Package responsibility | Consumer responsibility |
97
- | --- | --- |
98
- | Board validation and release packaging | Board content and source permissions |
99
- | Server runtime and application templates | AWS account and network administration |
100
- | Restricted bootstrap templates | Reviewing and executing AWS changes |
101
- | Default immutable client asset selection | Approval of alternate asset hosts |
102
- | Read-only preflight, doctor, and consistency checks | Gateway, authentication, and health checks |
103
- | Exact secret-resource integration | Secret values, rotation, and credential-map ARN |
95
+ | Package responsibility | Consumer responsibility |
96
+ | --------------------------------------------------- | ----------------------------------------------- |
97
+ | Board validation and release packaging | Board content and source permissions |
98
+ | Server runtime and application templates | AWS account and network administration |
99
+ | Restricted bootstrap templates | Reviewing and executing AWS changes |
100
+ | Default immutable client asset selection | Approval of alternate asset hosts |
101
+ | Read-only preflight, doctor, and consistency checks | Gateway, authentication, and health checks |
102
+ | Exact secret-resource integration | Secret values, rotation, and credential-map ARN |
104
103
 
105
104
  Bootstrap commands do not perform mutating AWS operations. They emit plans, parameters, captures,
106
105
  and command arguments for an administrator to review and invoke. `bootstrap check` is the read-only
package/bootstrap/core-ecs-v1.yml CHANGED
@@ -1,16 +1,21 @@
1
- AWSTemplateFormatVersion: '2010-09-09'
1
+ AWSTemplateFormatVersion: "2010-09-09"
2
2
  Description: Ze Great Dashboard ECS bootstrap core v1. Administrator-managed; do not grant this authority to CI.
3
3
 
4
4
  Parameters:
5
5
  ComputeMode: { Type: String, Default: ecs, AllowedValues: [ecs] }
6
- ArtifactBucketName: { Type: String, Description: Compatibility artifact bucket; ECS packages use the published image }
6
+ ArtifactBucketName:
7
+ {
8
+ Type: String,
9
+ Description: Compatibility artifact bucket; ECS packages use the published image,
10
+ }
7
11
  ApplicationStackName: { Type: String }
8
- DashboardFunctionName: { Type: String, Description: Compatibility name retained by the bootstrap manifest }
9
- RuntimeSecretArn: { Type: String, Default: '' }
10
- ArtifactKmsKeyArn: { Type: String, Default: '' }
12
+ DashboardFunctionName:
13
+ { Type: String, Description: Compatibility name retained by the bootstrap manifest }
14
+ RuntimeSecretArn: { Type: String, Default: "" }
15
+ ArtifactKmsKeyArn: { Type: String, Default: "" }
11
16
 
12
17
  Conditions:
13
- HasRuntimeSecret: !Not [!Equals [!Ref RuntimeSecretArn, '']]
18
+ HasRuntimeSecret: !Not [!Equals [!Ref RuntimeSecretArn, ""]]
14
19
 
15
20
  Resources:
16
21
  ArtifactBucket:
@@ -20,38 +25,85 @@ Resources:
20
25
  Properties:
21
26
  BucketName: !Ref ArtifactBucketName
22
27
  OwnershipControls: { Rules: [{ ObjectOwnership: BucketOwnerEnforced }] }
23
- PublicAccessBlockConfiguration: { BlockPublicAcls: true, BlockPublicPolicy: true, IgnorePublicAcls: true, RestrictPublicBuckets: true }
28
+ PublicAccessBlockConfiguration:
29
+ {
30
+ BlockPublicAcls: true,
31
+ BlockPublicPolicy: true,
32
+ IgnorePublicAcls: true,
33
+ RestrictPublicBuckets: true,
34
+ }
24
35
  CloudFormationExecutionRole:
25
36
  Type: AWS::IAM::Role
26
37
  DeletionPolicy: Retain
27
38
  UpdateReplacePolicy: Retain
28
39
  Properties:
29
- RoleName: !Sub '${ApplicationStackName}-execution'
40
+ RoleName: !Sub "${ApplicationStackName}-execution"
30
41
  AssumeRolePolicyDocument:
31
- Version: '2012-10-17'
32
- Statement: [{ Effect: Allow, Principal: { Service: cloudformation.amazonaws.com }, Action: sts:AssumeRole }]
42
+ Version: "2012-10-17"
43
+ Statement:
44
+ [
45
+ {
46
+ Effect: Allow,
47
+ Principal: { Service: cloudformation.amazonaws.com },
48
+ Action: sts:AssumeRole,
49
+ },
50
+ ]
33
51
  Policies:
34
52
  - PolicyName: DashboardEcsApplicationResources
35
53
  PolicyDocument:
36
- Version: '2012-10-17'
54
+ Version: "2012-10-17"
37
55
  Statement:
38
56
  - Sid: DashboardEcs
39
57
  Effect: Allow
40
- Action: [ecs:CreateCluster, ecs:DescribeClusters, ecs:UpdateCluster, ecs:DeleteCluster, ecs:CreateService, ecs:DescribeServices, ecs:UpdateService, ecs:DeleteService, ecs:RegisterTaskDefinition, ecs:DeregisterTaskDefinition, ecs:DescribeTaskDefinition, ecs:TagResource, ecs:UntagResource]
41
- Resource: '*'
58
+ Action:
59
+ [
60
+ ecs:CreateCluster,
61
+ ecs:DescribeClusters,
62
+ ecs:UpdateCluster,
63
+ ecs:DeleteCluster,
64
+ ecs:CreateService,
65
+ ecs:DescribeServices,
66
+ ecs:UpdateService,
67
+ ecs:DeleteService,
68
+ ecs:RegisterTaskDefinition,
69
+ ecs:DeregisterTaskDefinition,
70
+ ecs:DescribeTaskDefinition,
71
+ ecs:TagResource,
72
+ ecs:UntagResource,
73
+ ]
74
+ Resource: "*"
42
75
  - Sid: DashboardEcsLogs
43
76
  Effect: Allow
44
- Action: [logs:CreateLogGroup, logs:DeleteLogGroup, logs:DescribeLogGroups, logs:PutRetentionPolicy, logs:TagResource, logs:UntagResource]
45
- Resource: !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/ecs/${ApplicationStackName}:*'
77
+ Action:
78
+ [
79
+ logs:CreateLogGroup,
80
+ logs:DeleteLogGroup,
81
+ logs:DescribeLogGroups,
82
+ logs:PutRetentionPolicy,
83
+ logs:TagResource,
84
+ logs:UntagResource,
85
+ ]
86
+ Resource: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/ecs/${ApplicationStackName}:*"
46
87
  - Sid: ManageEcsRuntimeRoles
47
88
  Effect: Allow
48
- Action: [iam:CreateRole, iam:GetRole, iam:DeleteRole, iam:UpdateAssumeRolePolicy, iam:PutRolePolicy, iam:GetRolePolicy, iam:DeleteRolePolicy, iam:TagRole, iam:UntagRole]
49
- Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${ApplicationStackName}-*'
89
+ Action:
90
+ [
91
+ iam:CreateRole,
92
+ iam:GetRole,
93
+ iam:DeleteRole,
94
+ iam:UpdateAssumeRolePolicy,
95
+ iam:PutRolePolicy,
96
+ iam:GetRolePolicy,
97
+ iam:DeleteRolePolicy,
98
+ iam:TagRole,
99
+ iam:UntagRole,
100
+ ]
101
+ Resource: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${ApplicationStackName}-*"
50
102
  - Sid: PassRuntimeRolesToEcsOnly
51
103
  Effect: Allow
52
104
  Action: iam:PassRole
53
- Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${ApplicationStackName}-*'
54
- Condition: { StringEquals: { 'iam:PassedToService': ecs-tasks.amazonaws.com } }
105
+ Resource: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${ApplicationStackName}-*"
106
+ Condition: { StringEquals: { "iam:PassedToService": ecs-tasks.amazonaws.com } }
55
107
  - !If
56
108
  - HasRuntimeSecret
57
109
  - Sid: ReadConfiguredRuntimeCredentials
@@ -71,15 +123,15 @@ Resources:
71
123
  - Sid: DecryptConfiguredRuntimeParameter
72
124
  Effect: Allow
73
125
  Action: kms:Decrypt
74
- Resource: '*'
126
+ Resource: "*"
75
127
  Condition:
76
128
  StringEquals:
77
- 'kms:ViaService': !Sub 'ssm.${AWS::Region}.amazonaws.com'
78
- 'kms:EncryptionContext:PARAMETER_ARN': !Ref RuntimeSecretArn
129
+ "kms:ViaService": !Sub "ssm.${AWS::Region}.amazonaws.com"
130
+ "kms:EncryptionContext:PARAMETER_ARN": !Ref RuntimeSecretArn
79
131
  - !Ref AWS::NoValue
80
132
  Outputs:
81
- BootstrapContractVersion: { Value: '1' }
82
- BootstrapTemplateRevision: { Value: '1.0-ecs' }
133
+ BootstrapContractVersion: { Value: "1" }
134
+ BootstrapTemplateRevision: { Value: "1.0-ecs" }
83
135
  ArtifactBucketName: { Value: !Ref ArtifactBucket }
84
136
  ArtifactBucketArn: { Value: !GetAtt ArtifactBucket.Arn }
85
137
  CloudFormationExecutionRoleArn: { Value: !GetAtt CloudFormationExecutionRole.Arn }
package/bootstrap/core-v1.yml CHANGED
@@ -1,4 +1,4 @@
1
- AWSTemplateFormatVersion: '2010-09-09'
1
+ AWSTemplateFormatVersion: "2010-09-09"
2
2
  Description: Ze Great Dashboard bootstrap core v1. Administrator-managed; do not grant this authority to CI.
3
3
 
4
4
  Parameters:
@@ -18,16 +18,16 @@ Parameters:
18
18
  Description: Stable Lambda function name used by the application stack
19
19
  RuntimeSecretArn:
20
20
  Type: String
21
- Default: ''
21
+ Default: ""
22
22
  Description: Optional explicitly configured Secrets Manager secret or Parameter Store SecureString ARN
23
23
  ArtifactKmsKeyArn:
24
24
  Type: String
25
- Default: ''
25
+ Default: ""
26
26
  Description: Optional customer-managed KMS key ARN; SSE-S3 is used when blank
27
27
 
28
28
  Conditions:
29
- HasRuntimeSecret: !Not [!Equals [!Ref RuntimeSecretArn, '']]
30
- HasArtifactKmsKey: !Not [!Equals [!Ref ArtifactKmsKeyArn, '']]
29
+ HasRuntimeSecret: !Not [!Equals [!Ref RuntimeSecretArn, ""]]
30
+ HasArtifactKmsKey: !Not [!Equals [!Ref ArtifactKmsKeyArn, ""]]
31
31
 
32
32
  Resources:
33
33
  ArtifactBucket:
@@ -55,51 +55,90 @@ Resources:
55
55
  Properties:
56
56
  Bucket: !Ref ArtifactBucket
57
57
  PolicyDocument:
58
- Version: '2012-10-17'
58
+ Version: "2012-10-17"
59
59
  Statement:
60
60
  - Sid: DenyInsecureTransport
61
61
  Effect: Deny
62
- Principal: '*'
62
+ Principal: "*"
63
63
  Action: s3:*
64
- Resource: [!GetAtt ArtifactBucket.Arn, !Sub '${ArtifactBucket.Arn}/*']
65
- Condition: { Bool: { 'aws:SecureTransport': false } }
64
+ Resource: [!GetAtt ArtifactBucket.Arn, !Sub "${ArtifactBucket.Arn}/*"]
65
+ Condition: { Bool: { "aws:SecureTransport": false } }
66
66
 
67
67
  CloudFormationExecutionRole:
68
68
  Type: AWS::IAM::Role
69
69
  DeletionPolicy: Retain
70
70
  UpdateReplacePolicy: Retain
71
71
  Properties:
72
- RoleName: !Sub '${ApplicationStackName}-execution'
73
- Description: !Sub 'Restricted CloudFormation execution role for ${ApplicationStackName}'
72
+ RoleName: !Sub "${ApplicationStackName}-execution"
73
+ Description: !Sub "Restricted CloudFormation execution role for ${ApplicationStackName}"
74
74
  AssumeRolePolicyDocument:
75
- Version: '2012-10-17'
76
- Statement: [{ Effect: Allow, Principal: { Service: cloudformation.amazonaws.com }, Action: sts:AssumeRole }]
75
+ Version: "2012-10-17"
76
+ Statement:
77
+ [
78
+ {
79
+ Effect: Allow,
80
+ Principal: { Service: cloudformation.amazonaws.com },
81
+ Action: sts:AssumeRole,
82
+ },
83
+ ]
77
84
  Policies:
78
85
  - PolicyName: DashboardApplicationResources
79
86
  PolicyDocument:
80
- Version: '2012-10-17'
87
+ Version: "2012-10-17"
81
88
  Statement:
82
89
  - Sid: DashboardLambda
83
90
  Effect: Allow
84
- Action: [lambda:CreateFunction, lambda:GetFunction, lambda:UpdateFunctionCode, lambda:UpdateFunctionConfiguration, lambda:DeleteFunction, lambda:TagResource, lambda:UntagResource]
85
- Resource: !Sub 'arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${DashboardFunctionName}'
91
+ Action:
92
+ [
93
+ lambda:CreateFunction,
94
+ lambda:GetFunction,
95
+ lambda:UpdateFunctionCode,
96
+ lambda:UpdateFunctionConfiguration,
97
+ lambda:DeleteFunction,
98
+ lambda:TagResource,
99
+ lambda:UntagResource,
100
+ ]
101
+ Resource: !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${DashboardFunctionName}"
86
102
  - Sid: DashboardLogs
87
103
  Effect: Allow
88
- Action: [logs:CreateLogGroup, logs:DeleteLogGroup, logs:DescribeLogGroups, logs:PutRetentionPolicy, logs:TagResource, logs:UntagResource]
89
- Resource: !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${DashboardFunctionName}:*'
104
+ Action:
105
+ [
106
+ logs:CreateLogGroup,
107
+ logs:DeleteLogGroup,
108
+ logs:DescribeLogGroups,
109
+ logs:PutRetentionPolicy,
110
+ logs:TagResource,
111
+ logs:UntagResource,
112
+ ]
113
+ Resource: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${DashboardFunctionName}:*"
90
114
  - Sid: ReadLambdaArtifact
91
115
  Effect: Allow
92
116
  Action: s3:GetObject
93
- Resource: !Sub '${ArtifactBucket.Arn}/lambda/*'
117
+ Resource: !Sub "${ArtifactBucket.Arn}/lambda/*"
94
118
  - Sid: ManageRuntimeRole
95
119
  Effect: Allow
96
- Action: [iam:CreateRole, iam:GetRole, iam:DeleteRole, iam:UpdateAssumeRolePolicy, iam:PutRolePolicy, iam:GetRolePolicy, iam:DeleteRolePolicy, iam:AttachRolePolicy, iam:DetachRolePolicy, iam:ListRolePolicies, iam:ListAttachedRolePolicies, iam:TagRole, iam:UntagRole]
97
- Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${DashboardFunctionName}-server'
120
+ Action:
121
+ [
122
+ iam:CreateRole,
123
+ iam:GetRole,
124
+ iam:DeleteRole,
125
+ iam:UpdateAssumeRolePolicy,
126
+ iam:PutRolePolicy,
127
+ iam:GetRolePolicy,
128
+ iam:DeleteRolePolicy,
129
+ iam:AttachRolePolicy,
130
+ iam:DetachRolePolicy,
131
+ iam:ListRolePolicies,
132
+ iam:ListAttachedRolePolicies,
133
+ iam:TagRole,
134
+ iam:UntagRole,
135
+ ]
136
+ Resource: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${DashboardFunctionName}-server"
98
137
  - Sid: PassRuntimeRoleToLambdaOnly
99
138
  Effect: Allow
100
139
  Action: iam:PassRole
101
- Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${DashboardFunctionName}-server'
102
- Condition: { StringEquals: { 'iam:PassedToService': lambda.amazonaws.com } }
140
+ Resource: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${DashboardFunctionName}-server"
141
+ Condition: { StringEquals: { "iam:PassedToService": lambda.amazonaws.com } }
103
142
  - !If
104
143
  - HasRuntimeSecret
105
144
  - Sid: ReadConfiguredRuntimeCredentials
@@ -119,16 +158,16 @@ Resources:
119
158
  - Sid: DecryptConfiguredRuntimeParameter
120
159
  Effect: Allow
121
160
  Action: kms:Decrypt
122
- Resource: '*'
161
+ Resource: "*"
123
162
  Condition:
124
163
  StringEquals:
125
- 'kms:ViaService': !Sub 'ssm.${AWS::Region}.amazonaws.com'
126
- 'kms:EncryptionContext:PARAMETER_ARN': !Ref RuntimeSecretArn
164
+ "kms:ViaService": !Sub "ssm.${AWS::Region}.amazonaws.com"
165
+ "kms:EncryptionContext:PARAMETER_ARN": !Ref RuntimeSecretArn
127
166
  - !Ref AWS::NoValue
128
167
 
129
168
  Outputs:
130
- BootstrapContractVersion: { Value: '1' }
131
- BootstrapTemplateRevision: { Value: '1.3' }
169
+ BootstrapContractVersion: { Value: "1" }
170
+ BootstrapTemplateRevision: { Value: "1.3" }
132
171
  ArtifactBucketName: { Value: !Ref ArtifactBucket }
133
172
  ArtifactBucketArn: { Value: !GetAtt ArtifactBucket.Arn }
134
173
  CloudFormationExecutionRoleArn: { Value: !GetAtt CloudFormationExecutionRole.Arn }
package/bootstrap/github-oidc-ecs-v1.yml CHANGED
@@ -1,4 +1,4 @@
1
- AWSTemplateFormatVersion: '2010-09-09'
1
+ AWSTemplateFormatVersion: "2010-09-09"
2
2
  Description: Ze Great Dashboard GitHub OIDC adapter for ECS deployments.
3
3
  Parameters:
4
4
  ComputeMode: { Type: String, Default: ecs, AllowedValues: [ecs] }
@@ -15,25 +15,41 @@ Resources:
15
15
  GitHubDeployRole:
16
16
  Type: AWS::IAM::Role
17
17
  Properties:
18
- RoleName: !Sub '${ApplicationStackName}-github-deploy'
18
+ RoleName: !Sub "${ApplicationStackName}-github-deploy"
19
19
  AssumeRolePolicyDocument:
20
- Version: '2012-10-17'
21
- Statement: [{ Effect: Allow, Principal: { Federated: !Ref GitHubOidcProviderArn }, Action: sts:AssumeRoleWithWebIdentity }]
20
+ Version: "2012-10-17"
21
+ Statement:
22
+ [
23
+ {
24
+ Effect: Allow,
25
+ Principal: { Federated: !Ref GitHubOidcProviderArn },
26
+ Action: sts:AssumeRoleWithWebIdentity,
27
+ },
28
+ ]
22
29
  Policies:
23
30
  - PolicyName: DeployOneEcsApplication
24
31
  PolicyDocument:
25
- Version: '2012-10-17'
32
+ Version: "2012-10-17"
26
33
  Statement:
27
34
  - Sid: OperateOneApplicationStack
28
35
  Effect: Allow
29
- Action: [cloudformation:CreateChangeSet, cloudformation:DescribeChangeSet, cloudformation:ExecuteChangeSet, cloudformation:DeleteChangeSet, cloudformation:DescribeStacks, cloudformation:GetTemplate, cloudformation:GetTemplateSummary]
30
- Resource: !Sub 'arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${ApplicationStackName}/*'
36
+ Action:
37
+ [
38
+ cloudformation:CreateChangeSet,
39
+ cloudformation:DescribeChangeSet,
40
+ cloudformation:ExecuteChangeSet,
41
+ cloudformation:DeleteChangeSet,
42
+ cloudformation:DescribeStacks,
43
+ cloudformation:GetTemplate,
44
+ cloudformation:GetTemplateSummary,
45
+ ]
46
+ Resource: !Sub "arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${ApplicationStackName}/*"
31
47
  - Sid: PassCoreExecutionRole
32
48
  Effect: Allow
33
49
  Action: iam:PassRole
34
50
  Resource: !Ref CloudFormationExecutionRoleArn
35
- Condition: { StringEquals: { 'iam:PassedToService': cloudformation.amazonaws.com } }
51
+ Condition: { StringEquals: { "iam:PassedToService": cloudformation.amazonaws.com } }
36
52
  Outputs:
37
- BootstrapContractVersion: { Value: '1' }
38
- BootstrapTemplateRevision: { Value: '1.0-ecs' }
53
+ BootstrapContractVersion: { Value: "1" }
54
+ BootstrapTemplateRevision: { Value: "1.0-ecs" }
39
55
  GitHubDeployRoleArn: { Value: !GetAtt GitHubDeployRole.Arn }
package/bootstrap/github-oidc-v1.yml CHANGED
@@ -1,4 +1,4 @@
1
- AWSTemplateFormatVersion: '2010-09-09'
1
+ AWSTemplateFormatVersion: "2010-09-09"
2
2
  Description: Ze Great Dashboard GitHub OIDC adapter v1. Superseded by github-oidc-v2.yml; retained for explicit migration review.
3
3
 
4
4
  Parameters:
@@ -15,41 +15,51 @@ Resources:
15
15
  DeletionPolicy: Retain
16
16
  UpdateReplacePolicy: Retain
17
17
  Properties:
18
- RoleName: !Sub '${ApplicationStackName}-github-deploy'
18
+ RoleName: !Sub "${ApplicationStackName}-github-deploy"
19
19
  MaxSessionDuration: 3600
20
20
  AssumeRolePolicyDocument:
21
- Version: '2012-10-17'
21
+ Version: "2012-10-17"
22
22
  Statement:
23
23
  - Effect: Allow
24
24
  Principal: { Federated: !Ref GitHubOidcProviderArn }
25
25
  Action: sts:AssumeRoleWithWebIdentity
26
26
  Condition:
27
27
  StringEquals:
28
- 'token.actions.githubusercontent.com:aud': sts.amazonaws.com
29
- 'token.actions.githubusercontent.com:sub': !Sub 'repo:${GitHubRepository}:environment:${GitHubEnvironment}'
28
+ "token.actions.githubusercontent.com:aud": sts.amazonaws.com
29
+ "token.actions.githubusercontent.com:sub": !Sub "repo:${GitHubRepository}:environment:${GitHubEnvironment}"
30
30
  Policies:
31
31
  - PolicyName: DeployOneDashboard
32
32
  PolicyDocument:
33
- Version: '2012-10-17'
33
+ Version: "2012-10-17"
34
34
  Statement:
35
35
  - Sid: UploadLambdaArtifacts
36
36
  Effect: Allow
37
37
  Action: [s3:PutObject, s3:GetObject]
38
- Resource: !Sub 'arn:${AWS::Partition}:s3:::${ArtifactBucketName}/lambda/*'
38
+ Resource: !Sub "arn:${AWS::Partition}:s3:::${ArtifactBucketName}/lambda/*"
39
39
  - Sid: InspectArtifactBucket
40
40
  Effect: Allow
41
41
  Action: [s3:GetBucketLocation, s3:ListBucket]
42
- Resource: !Sub 'arn:${AWS::Partition}:s3:::${ArtifactBucketName}'
42
+ Resource: !Sub "arn:${AWS::Partition}:s3:::${ArtifactBucketName}"
43
43
  - Sid: OperateOneApplicationStack
44
44
  Effect: Allow
45
- Action: [cloudformation:CreateChangeSet, cloudformation:DescribeChangeSet, cloudformation:ExecuteChangeSet, cloudformation:DeleteChangeSet, cloudformation:DescribeStacks, cloudformation:DescribeStackEvents, cloudformation:GetTemplate, cloudformation:GetTemplateSummary]
46
- Resource: !Sub 'arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${ApplicationStackName}/*'
45
+ Action:
46
+ [
47
+ cloudformation:CreateChangeSet,
48
+ cloudformation:DescribeChangeSet,
49
+ cloudformation:ExecuteChangeSet,
50
+ cloudformation:DeleteChangeSet,
51
+ cloudformation:DescribeStacks,
52
+ cloudformation:DescribeStackEvents,
53
+ cloudformation:GetTemplate,
54
+ cloudformation:GetTemplateSummary,
55
+ ]
56
+ Resource: !Sub "arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${ApplicationStackName}/*"
47
57
  - Sid: PassCoreExecutionRole
48
58
  Effect: Allow
49
59
  Action: iam:PassRole
50
60
  Resource: !Ref CloudFormationExecutionRoleArn
51
- Condition: { StringEquals: { 'iam:PassedToService': cloudformation.amazonaws.com } }
61
+ Condition: { StringEquals: { "iam:PassedToService": cloudformation.amazonaws.com } }
52
62
 
53
63
  Outputs:
54
- BootstrapContractVersion: { Value: '1' }
64
+ BootstrapContractVersion: { Value: "1" }
55
65
  GitHubDeployRoleArn: { Value: !GetAtt GitHubDeployRole.Arn }
package/bootstrap/github-oidc-v2.yml CHANGED
@@ -1,4 +1,4 @@
1
- AWSTemplateFormatVersion: '2010-09-09'
1
+ AWSTemplateFormatVersion: "2010-09-09"
2
2
  Description: Ze Great Dashboard GitHub OIDC adapter v2. Administrator-managed; requires a central OIDC provider.
3
3
 
4
4
  Parameters:
@@ -16,13 +16,13 @@ Parameters:
16
16
  ApplicationStackName: { Type: String }
17
17
  ConsumerGatewayStackName:
18
18
  Type: String
19
- Default: ''
19
+ Default: ""
20
20
  Description: Optional consumer-owned gateway stack whose outputs the deploy role may read
21
21
  ArtifactBucketName: { Type: String }
22
22
  CloudFormationExecutionRoleArn: { Type: String }
23
23
 
24
24
  Conditions:
25
- HasConsumerGatewayStack: !Not [!Equals [!Ref ConsumerGatewayStackName, '']]
25
+ HasConsumerGatewayStack: !Not [!Equals [!Ref ConsumerGatewayStackName, ""]]
26
26
 
27
27
  Resources:
28
28
  GitHubDeployRole:
@@ -30,77 +30,107 @@ Resources:
30
30
  DeletionPolicy: Retain
31
31
  UpdateReplacePolicy: Retain
32
32
  Properties:
33
- RoleName: !Sub '${ApplicationStackName}-github-deploy'
33
+ RoleName: !Sub "${ApplicationStackName}-github-deploy"
34
34
  MaxSessionDuration: 3600
35
35
  AssumeRolePolicyDocument:
36
- Version: '2012-10-17'
36
+ Version: "2012-10-17"
37
37
  Statement:
38
38
  - Effect: Allow
39
39
  Principal: { Federated: !Ref GitHubOidcProviderArn }
40
40
  Action: sts:AssumeRoleWithWebIdentity
41
41
  Condition:
42
42
  StringEquals:
43
- 'token.actions.githubusercontent.com:aud': sts.amazonaws.com
44
- 'token.actions.githubusercontent.com:sub': !Sub
45
- - 'repo:${Owner}@${GitHubOwnerId}/${Repository}@${GitHubRepositoryId}:environment:${GitHubEnvironment}'
46
- - Owner: !Select [0, !Split ['/', !Ref GitHubRepository]]
47
- Repository: !Select [1, !Split ['/', !Ref GitHubRepository]]
43
+ "token.actions.githubusercontent.com:aud": sts.amazonaws.com
44
+ "token.actions.githubusercontent.com:sub": !Sub
45
+ - "repo:${Owner}@${GitHubOwnerId}/${Repository}@${GitHubRepositoryId}:environment:${GitHubEnvironment}"
46
+ - Owner: !Select [0, !Split ["/", !Ref GitHubRepository]]
47
+ Repository: !Select [1, !Split ["/", !Ref GitHubRepository]]
48
48
  Policies:
49
49
  - PolicyName: DeployOneDashboard
50
50
  PolicyDocument:
51
- Version: '2012-10-17'
51
+ Version: "2012-10-17"
52
52
  Statement:
53
53
  - Sid: UploadLambdaArtifacts
54
54
  Effect: Allow
55
55
  Action: [s3:PutObject, s3:GetObject]
56
- Resource: !Sub 'arn:${AWS::Partition}:s3:::${ArtifactBucketName}/lambda/*'
56
+ Resource: !Sub "arn:${AWS::Partition}:s3:::${ArtifactBucketName}/lambda/*"
57
57
  - Sid: InspectArtifactBucket
58
58
  Effect: Allow
59
59
  Action: [s3:GetBucketLocation, s3:ListBucket]
60
- Resource: !Sub 'arn:${AWS::Partition}:s3:::${ArtifactBucketName}'
60
+ Resource: !Sub "arn:${AWS::Partition}:s3:::${ArtifactBucketName}"
61
61
  - Sid: OperateOneApplicationStack
62
62
  Effect: Allow
63
- Action: [cloudformation:CreateChangeSet, cloudformation:DescribeChangeSet, cloudformation:ExecuteChangeSet, cloudformation:DeleteChangeSet, cloudformation:DescribeStacks, cloudformation:DescribeStackEvents, cloudformation:GetTemplate, cloudformation:GetTemplateSummary]
64
- Resource: !Sub 'arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${ApplicationStackName}/*'
63
+ Action:
64
+ [
65
+ cloudformation:CreateChangeSet,
66
+ cloudformation:DescribeChangeSet,
67
+ cloudformation:ExecuteChangeSet,
68
+ cloudformation:DeleteChangeSet,
69
+ cloudformation:DescribeStacks,
70
+ cloudformation:DescribeStackEvents,
71
+ cloudformation:GetTemplate,
72
+ cloudformation:GetTemplateSummary,
73
+ ]
74
+ Resource: !Sub "arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${ApplicationStackName}/*"
65
75
  - Sid: InspectBootstrapStacks
66
76
  Effect: Allow
67
- Action: [cloudformation:DescribeStacks, cloudformation:DetectStackDrift, cloudformation:DescribeStackResourceDrifts]
77
+ Action:
78
+ [
79
+ cloudformation:DescribeStacks,
80
+ cloudformation:DetectStackDrift,
81
+ cloudformation:DescribeStackResourceDrifts,
82
+ ]
68
83
  Resource:
69
- - !Sub 'arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${CoreBootstrapStackName}/*'
70
- - !Sub 'arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}/*'
84
+ - !Sub "arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${CoreBootstrapStackName}/*"
85
+ - !Sub "arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}/*"
71
86
  # Detection-status requests are keyed by an opaque detection id, so AWS does not
72
87
  # support scoping this one read action to a stack ARN.
73
88
  - Sid: ReadBootstrapDriftDetectionStatus
74
89
  Effect: Allow
75
90
  Action: cloudformation:DescribeStackDriftDetectionStatus
76
- Resource: '*'
91
+ Resource: "*"
77
92
  # CloudFormation uses the caller's read permissions when these administrator-created
78
93
  # stacks have no service role. Keep resource inspection on the exact bootstrap bucket
79
94
  # and roles whose properties drift detection evaluates.
80
95
  - Sid: InspectBootstrapBucketConfiguration
81
96
  Effect: Allow
82
- Action: [s3:GetBucketAcl, s3:GetBucketPolicy, s3:GetBucketPublicAccessBlock, s3:GetEncryptionConfiguration, s3:GetBucketOwnershipControls, s3:GetBucketTagging]
83
- Resource: !Sub 'arn:${AWS::Partition}:s3:::${ArtifactBucketName}'
97
+ Action:
98
+ [
99
+ s3:GetBucketAcl,
100
+ s3:GetBucketPolicy,
101
+ s3:GetBucketPublicAccessBlock,
102
+ s3:GetEncryptionConfiguration,
103
+ s3:GetBucketOwnershipControls,
104
+ s3:GetBucketTagging,
105
+ ]
106
+ Resource: !Sub "arn:${AWS::Partition}:s3:::${ArtifactBucketName}"
84
107
  - Sid: InspectBootstrapRoleConfiguration
85
108
  Effect: Allow
86
- Action: [iam:GetRole, iam:GetRolePolicy, iam:ListRolePolicies, iam:ListAttachedRolePolicies, iam:ListRoleTags]
109
+ Action:
110
+ [
111
+ iam:GetRole,
112
+ iam:GetRolePolicy,
113
+ iam:ListRolePolicies,
114
+ iam:ListAttachedRolePolicies,
115
+ iam:ListRoleTags,
116
+ ]
87
117
  Resource:
88
118
  - !Ref CloudFormationExecutionRoleArn
89
- - !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${ApplicationStackName}-github-deploy'
119
+ - !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${ApplicationStackName}-github-deploy"
90
120
  - !If
91
121
  - HasConsumerGatewayStack
92
122
  - Sid: ReadConsumerGatewayStack
93
123
  Effect: Allow
94
124
  Action: cloudformation:DescribeStacks
95
- Resource: !Sub 'arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${ConsumerGatewayStackName}/*'
125
+ Resource: !Sub "arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${ConsumerGatewayStackName}/*"
96
126
  - !Ref AWS::NoValue
97
127
  - Sid: PassCoreExecutionRole
98
128
  Effect: Allow
99
129
  Action: iam:PassRole
100
130
  Resource: !Ref CloudFormationExecutionRoleArn
101
- Condition: { StringEquals: { 'iam:PassedToService': cloudformation.amazonaws.com } }
131
+ Condition: { StringEquals: { "iam:PassedToService": cloudformation.amazonaws.com } }
102
132
 
103
133
  Outputs:
104
- BootstrapContractVersion: { Value: '2' }
105
- BootstrapTemplateRevision: { Value: '2.3' }
134
+ BootstrapContractVersion: { Value: "2" }
135
+ BootstrapTemplateRevision: { Value: "2.3" }
106
136
  GitHubDeployRoleArn: { Value: !GetAtt GitHubDeployRole.Arn }