@deployfoundation/foundation-deploy 0.1.0

package/dist/bin/release-account.js

@@ -0,0 +1,154 @@
+#!/usr/bin/env bun
+import {
+  DEFAULT_RELEASE_BUCKET
+} from "../chunk-v7tz8g50.js";
+import"../chunk-9ddxyvq2.js";
+
+// bin/release-account.ts
+import * as cdk2 from "aws-cdk-lib";
+
+// src/stacks/release-account-stack.ts
+import * as cdk from "aws-cdk-lib";
+import * as ecr from "aws-cdk-lib/aws-ecr";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as kms from "aws-cdk-lib/aws-kms";
+import * as s3 from "aws-cdk-lib/aws-s3";
+
+class ReleaseAccountStack extends cdk.Stack {
+  bucket;
+  repository;
+  signingKey;
+  releaseRole;
+  constructor(scope, id, props) {
+    super(scope, id, props);
+    const repositoryName = props.repositoryName ?? "foundation/agent";
+    const customers = [...props.customerAccountIds];
+    const customerPrincipals = customers.map((account) => new iam.AccountPrincipal(account));
+    this.bucket = new s3.Bucket(this, "ReleaseBucket", {
+      bucketName: props.bucketName,
+      versioned: true,
+      encryption: s3.BucketEncryption.S3_MANAGED,
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+      enforceSSL: true,
+      removalPolicy: cdk.RemovalPolicy.RETAIN
+    });
+    if (customerPrincipals.length > 0)
+      this.bucket.addToResourcePolicy(new iam.PolicyStatement({
+        sid: "CustomersReadReleases",
+        principals: customerPrincipals,
+        actions: ["s3:GetObject", "s3:GetObjectVersion"],
+        resources: [this.bucket.arnForObjects("releases/*")]
+      }));
+    this.repository = new ecr.Repository(this, "AgentRepository", {
+      repositoryName,
+      imageScanOnPush: true,
+      imageTagMutability: ecr.TagMutability.IMMUTABLE,
+      encryption: ecr.RepositoryEncryption.AES_256,
+      removalPolicy: cdk.RemovalPolicy.RETAIN
+    });
+    if (customerPrincipals.length > 0)
+      this.repository.addToResourcePolicy(new iam.PolicyStatement({
+        sid: "CustomersPullAgentImage",
+        principals: customerPrincipals,
+        actions: [
+          "ecr:BatchGetImage",
+          "ecr:GetDownloadUrlForLayer",
+          "ecr:BatchCheckLayerAvailability",
+          "ecr:DescribeImages"
+        ]
+      }));
+    this.signingKey = new kms.Key(this, "ReleaseSigningKey", {
+      alias: props.signingKeyAlias ?? "foundation-release",
+      description: "Signs Foundation release manifests. Customers verify against it.",
+      keySpec: kms.KeySpec.RSA_4096,
+      keyUsage: kms.KeyUsage.SIGN_VERIFY,
+      removalPolicy: cdk.RemovalPolicy.RETAIN
+    });
+    if (customerPrincipals.length > 0)
+      this.signingKey.addToResourcePolicy(new iam.PolicyStatement({
+        sid: "CustomersVerifyManifests",
+        principals: customerPrincipals,
+        actions: ["kms:Verify", "kms:GetPublicKey", "kms:DescribeKey"],
+        resources: ["*"]
+      }));
+    const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, "GitHubOidc", `arn:${this.partition}:iam::${this.account}:oidc-provider/token.actions.githubusercontent.com`);
+    const [owner, repo] = props.githubRepository.split("/");
+    const ids = props.githubRepositoryIds;
+    const tagSubjects = [
+      `repo:${props.githubRepository}:ref:refs/tags/v*`,
+      `repo:${owner}@${ids.owner}/${repo}@${ids.repo}:ref:refs/tags/v*`
+    ];
+    this.releaseRole = new iam.Role(this, "ReleaseRole", {
+      roleName: props.releaseRoleName ?? "FoundationRelease",
+      description: `Publishes Foundation releases from tag pushes on ${props.githubRepository}`,
+      maxSessionDuration: cdk.Duration.hours(1),
+      assumedBy: new iam.WebIdentityPrincipal(provider.openIdConnectProviderArn, {
+        StringEquals: { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
+        StringLike: { "token.actions.githubusercontent.com:sub": tagSubjects }
+      }),
+      inlinePolicies: {
+        PublishRelease: new iam.PolicyDocument({
+          statements: [
+            new iam.PolicyStatement({
+              sid: "UploadRelease",
+              actions: ["s3:PutObject", "s3:GetObject", "s3:ListBucket"],
+              resources: [this.bucket.bucketArn, this.bucket.arnForObjects("releases/*")]
+            }),
+            new iam.PolicyStatement({
+              sid: "PushAgentImage",
+              actions: [
+                "ecr:BatchCheckLayerAvailability",
+                "ecr:CompleteLayerUpload",
+                "ecr:InitiateLayerUpload",
+                "ecr:PutImage",
+                "ecr:UploadLayerPart",
+                "ecr:BatchGetImage",
+                "ecr:DescribeImages"
+              ],
+              resources: [this.repository.repositoryArn]
+            }),
+            new iam.PolicyStatement({
+              sid: "EcrLogin",
+              actions: ["ecr:GetAuthorizationToken"],
+              resources: ["*"]
+            }),
+            new iam.PolicyStatement({
+              sid: "SignManifest",
+              actions: ["kms:Sign", "kms:GetPublicKey", "kms:DescribeKey"],
+              resources: [this.signingKey.keyArn]
+            })
+          ]
+        })
+      }
+    });
+    new cdk.CfnOutput(this, "ReleaseBucketName", { value: this.bucket.bucketName });
+    new cdk.CfnOutput(this, "AgentRepositoryUri", { value: this.repository.repositoryUri });
+    new cdk.CfnOutput(this, "SigningKeyArn", { value: this.signingKey.keyArn });
+    new cdk.CfnOutput(this, "ReleaseRoleArn", { value: this.releaseRole.roleArn });
+    new cdk.CfnOutput(this, "CustomerAccountIds", { value: customers.join(",") });
+  }
+}
+
+// bin/release-account.ts
+var app = new cdk2.App;
+var customerAccountIds = String(app.node.tryGetContext("customerAccountIds") ?? "").split(",").map((id) => id.trim()).filter((id) => id !== "");
+for (const id of customerAccountIds)
+  if (!/^\d{12}$/.test(id))
+    throw new Error(`customerAccountIds: "${id}" is not a 12-digit AWS account id`);
+new ReleaseAccountStack(app, "FoundationRelease", {
+  env: {
+    account: process.env.CDK_DEFAULT_ACCOUNT,
+    region: process.env.CDK_DEFAULT_REGION ?? "us-east-1"
+  },
+  bucketName: app.node.tryGetContext("releaseBucket") ?? DEFAULT_RELEASE_BUCKET,
+  ...app.node.tryGetContext("agentRepository") === undefined ? {} : { repositoryName: app.node.tryGetContext("agentRepository") },
+  customerAccountIds,
+  githubRepository: app.node.tryGetContext("githubRepository") ?? "CitrusNest/foundation",
+  githubRepositoryIds: {
+    owner: Number(app.node.tryGetContext("githubOwnerId") ?? 325214756),
+    repo: Number(app.node.tryGetContext("githubRepoId") ?? 1376990599)
+  },
+  ...app.node.tryGetContext("signingKeyAlias") === undefined ? {} : { signingKeyAlias: app.node.tryGetContext("signingKeyAlias") },
+  ...app.node.tryGetContext("releaseRoleName") === undefined ? {} : { releaseRoleName: app.node.tryGetContext("releaseRoleName") }
+});
+app.synth();