@devramps/cli 0.1.23 → 0.1.25

package/dist/index.js

@@ -1556,10 +1556,11 @@ function addOidcProviderResource(template, conditional = true, oidcProviderUrl)
     }
   };
 }
-function buildOidcTrustPolicy(accountId, subject, oidcProviderUrl, additionalTrustedAccounts) {
+function buildOidcTrustPolicy(accountId, subject, oidcProviderUrl, additionalTrustedAccounts, skipOidc) {
   const providerUrl = oidcProviderUrl || OIDC_PROVIDER_URL;
-  const statements = [
-    {
+  const statements = [];
+  if (!skipOidc) {
+    statements.push({
       Effect: "Allow",
       Principal: {
         Federated: `arn:aws:iam::${accountId}:oidc-provider/${providerUrl}`
@@ -1571,8 +1572,8 @@ function buildOidcTrustPolicy(accountId, subject, oidcProviderUrl, additionalTru
           [`${providerUrl}:aud`]: "sts.amazonaws.com"
         }
       }
-    }
-  ];
+    });
+  }
   if (additionalTrustedAccounts && additionalTrustedAccounts.length > 0) {
     statements.push({
       Effect: "Allow",
@@ -1948,7 +1949,7 @@ function createTerraformStateBucketPolicy(bucketName, cicdAccountId, allowedAcco
 
 // src/templates/org-stack.ts
 function generateOrgStackTemplate(options) {
-  const { orgSlug, cicdAccountId, targetAccountIds, oidcProviderUrl, additionalTrustedAccounts } = options;
+  const { orgSlug, cicdAccountId, targetAccountIds, oidcProviderUrl, additionalTrustedAccounts, skipOidc } = options;
   const template = createBaseTemplate(`DevRamps Org Stack for ${orgSlug}`);
   const kmsKeyPolicy = buildKmsKeyPolicy(cicdAccountId, targetAccountIds);
   template.Resources.DevRampsKMSKey = createKmsKeyResource(
@@ -1978,7 +1979,7 @@ function generateOrgStackTemplate(options) {
       PolicyDocument: bucketPolicy
     }
   };
-  const trustPolicy = buildOidcTrustPolicy(cicdAccountId, `org:${orgSlug}/cicd`, oidcProviderUrl, additionalTrustedAccounts);
+  const trustPolicy = buildOidcTrustPolicy(cicdAccountId, `org:${orgSlug}/cicd`, oidcProviderUrl, additionalTrustedAccounts, skipOidc);
   const orgRolePolicies = buildOrgRolePolicies(orgSlug);
   template.Resources.DevRampsCICDDeploymentRole = createIamRoleResource(
     getOrgRoleName(),
@@ -2139,7 +2140,8 @@ function buildOrgRolePolicies(orgSlug) {
 
 // src/templates/pipeline-stack.ts
 function generatePipelineStackTemplate(options) {
-  const { pipelineSlug, cicdAccountId, dockerArtifacts, bundleArtifacts } = options;
+  const { pipelineSlug, cicdAccountId, dockerArtifacts, bundleArtifacts, stageAccountIds } = options;
+  const allAccountIds = [.../* @__PURE__ */ new Set([cicdAccountId, ...stageAccountIds])];
   const template = createBaseTemplate(`DevRamps Pipeline Stack for ${pipelineSlug}`);
   const ecrOutputs = {};
   const s3Outputs = {};
@@ -2155,6 +2157,25 @@ function generatePipelineStackTemplate(options) {
         { Key: "ArtifactType", Value: artifact.type }
       ]
     );
+    if (stageAccountIds.length > 0) {
+      template.Resources[resourceId].Properties.RepositoryPolicyText = {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Sid: "AllowStageAccountPull",
+            Effect: "Allow",
+            Principal: {
+              AWS: allAccountIds.map((id) => `arn:aws:iam::${id}:root`)
+            },
+            Action: [
+              "ecr:GetDownloadUrlForLayer",
+              "ecr:BatchGetImage",
+              "ecr:BatchCheckLayerAvailability"
+            ]
+          }
+        ]
+      };
+    }
     ecrOutputs[artifact.name] = { repoName, resourceId };
   }
   for (const artifact of bundleArtifacts) {
@@ -2169,6 +2190,41 @@ function generatePipelineStackTemplate(options) {
         { Key: "ArtifactType", Value: artifact.type }
       ]
     );
+    if (stageAccountIds.length > 0) {
+      const policyResourceId = sanitizeResourceId(`BucketPolicy${artifactId}`);
+      template.Resources[policyResourceId] = {
+        Type: "AWS::S3::BucketPolicy",
+        Properties: {
+          Bucket: { Ref: resourceId },
+          PolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [
+              {
+                Sid: "AllowStageAccountRead",
+                Effect: "Allow",
+                Principal: {
+                  AWS: allAccountIds.map((id) => `arn:aws:iam::${id}:root`)
+                },
+                Action: [
+                  "s3:GetObject",
+                  "s3:HeadObject"
+                ],
+                Resource: `arn:aws:s3:::${bucketName}/*`
+              },
+              {
+                Sid: "AllowStageAccountList",
+                Effect: "Allow",
+                Principal: {
+                  AWS: allAccountIds.map((id) => `arn:aws:iam::${id}:root`)
+                },
+                Action: "s3:ListBucket",
+                Resource: `arn:aws:s3:::${bucketName}`
+              }
+            ]
+          }
+        }
+      };
+    }
     s3Outputs[artifact.name] = { bucketName, resourceId };
   }
   for (const [artifactName, { resourceId }] of Object.entries(ecrOutputs)) {
@@ -2444,14 +2500,15 @@ function generateStageStackTemplate(options) {
     dockerArtifacts,
     bundleArtifacts,
     oidcProviderUrl,
-    additionalTrustedAccounts
+    additionalTrustedAccounts,
+    skipOidc
   } = options;
   const template = createBaseTemplate(
     `DevRamps Stage Stack for ${pipelineSlug}/${stageName}`
   );
   const roleName = generateStageRoleName(pipelineSlug, stageName);
-  const trustPolicy = buildStageTrustPolicy(accountId, orgSlug, pipelineSlug, oidcProviderUrl, additionalTrustedAccounts);
-  const policies = buildStagePolicies(steps, additionalPolicies);
+  const trustPolicy = buildStageTrustPolicy(accountId, orgSlug, pipelineSlug, oidcProviderUrl, additionalTrustedAccounts, skipOidc);
+  const policies = buildStagePolicies(steps, additionalPolicies, dockerArtifacts, bundleArtifacts);
   template.Resources.StageDeploymentRole = createIamRoleResource(
     roleName,
     trustPolicy,
@@ -2494,8 +2551,6 @@ function generateStageStackTemplate(options) {
     );
     s3Outputs[artifact.name] = { resourceId };
   }
-  const providerUrl = oidcProviderUrl || OIDC_PROVIDER_URL;
-  const oidcProviderArn = `arn:aws:iam::${accountId}:oidc-provider/${providerUrl}`;
   template.Outputs = {
     StageRoleArn: {
       Description: "ARN of the stage deployment role",
@@ -2506,10 +2561,6 @@ function generateStageStackTemplate(options) {
       Description: "Name of the stage deployment role",
       Value: { Ref: "StageDeploymentRole" }
     },
-    OIDCProviderArn: {
-      Description: "ARN of the OIDC provider (created by Account Bootstrap stack)",
-      Value: oidcProviderArn
-    },
     PipelineSlug: {
       Description: "Pipeline slug",
       Value: pipelineSlug
@@ -2519,6 +2570,13 @@ function generateStageStackTemplate(options) {
       Value: stageName
     }
   };
+  if (!skipOidc) {
+    const providerUrl = oidcProviderUrl || OIDC_PROVIDER_URL;
+    template.Outputs.OIDCProviderArn = {
+      Description: "ARN of the OIDC provider (created by Account Bootstrap stack)",
+      Value: `arn:aws:iam::${accountId}:oidc-provider/${providerUrl}`
+    };
+  }
   for (const [artifactName, { resourceId }] of Object.entries(ecrOutputs)) {
     const safeName = sanitizeResourceId(artifactName);
     template.Outputs[`${safeName}RepoUri`] = {
@@ -2535,11 +2593,11 @@ function generateStageStackTemplate(options) {
   }
   return template;
 }
-function buildStageTrustPolicy(accountId, orgSlug, pipelineSlug, oidcProviderUrl, additionalTrustedAccounts) {
+function buildStageTrustPolicy(accountId, orgSlug, pipelineSlug, oidcProviderUrl, additionalTrustedAccounts, skipOidc) {
   const subject = `org:${orgSlug}/pipeline:${pipelineSlug}`;
-  return buildOidcTrustPolicy(accountId, subject, oidcProviderUrl, additionalTrustedAccounts);
+  return buildOidcTrustPolicy(accountId, subject, oidcProviderUrl, additionalTrustedAccounts, skipOidc);
 }
-function buildStagePolicies(steps, additionalPolicies) {
+function buildStagePolicies(steps, additionalPolicies, dockerArtifacts, bundleArtifacts) {
   const policies = [];
   policies.push({
     PolicyName: "DevRampsValidationPolicy",
@@ -2560,6 +2618,38 @@ function buildStagePolicies(steps, additionalPolicies) {
       ]
     }
   });
+  if (dockerArtifacts.length > 0) {
+    policies.push({
+      PolicyName: "DevRampsMirrorECRPolicy",
+      PolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Sid: "AllowECRMirror",
+            Effect: "Allow",
+            Action: MIRROR_ECR_PERMISSIONS.actions,
+            Resource: MIRROR_ECR_PERMISSIONS.resources || ["*"]
+          }
+        ]
+      }
+    });
+  }
+  if (bundleArtifacts.length > 0) {
+    policies.push({
+      PolicyName: "DevRampsMirrorS3Policy",
+      PolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Sid: "AllowS3Mirror",
+            Effect: "Allow",
+            Action: MIRROR_S3_PERMISSIONS.actions,
+            Resource: MIRROR_S3_PERMISSIONS.resources || ["*"]
+          }
+        ]
+      }
+    });
+  }
   for (const step of steps) {
     if (!hasPermissions(step.type)) {
       continue;
@@ -2606,12 +2696,12 @@ function buildStagePolicies(steps, additionalPolicies) {
 
 // src/templates/import-stack.ts
 function generateImportStackTemplate(options) {
-  const { pipelineSlug, orgSlug, accountId, oidcProviderUrl, additionalTrustedAccounts } = options;
+  const { pipelineSlug, orgSlug, accountId, oidcProviderUrl, additionalTrustedAccounts, skipOidc } = options;
   const template = createBaseTemplate(
     `DevRamps Import Stack for ${pipelineSlug} - grants read access for artifact imports`
   );
   const roleName = generateImportRoleName(pipelineSlug);
-  const trustPolicy = buildOidcTrustPolicy(accountId, `org:${orgSlug}/cicd`, oidcProviderUrl, additionalTrustedAccounts);
+  const trustPolicy = buildOidcTrustPolicy(accountId, `org:${orgSlug}/cicd`, oidcProviderUrl, additionalTrustedAccounts, skipOidc);
   const policies = buildImportRolePolicies();
   template.Resources.ImportRole = createIamRoleResource(
     roleName,
@@ -2739,6 +2829,15 @@ function getOidcProviderUrlFromEndpoint(endpointOverride) {
     return void 0;
   }
 }
+function isLocalhostEndpoint(endpointOverride) {
+  if (!endpointOverride) return false;
+  try {
+    const url = new URL(endpointOverride);
+    return url.hostname === "localhost" || url.hostname === "127.0.0.1";
+  } catch {
+    return false;
+  }
+}
 async function bootstrapCommand(options) {
   try {
     if (options.verbose) {
@@ -2790,7 +2889,11 @@ async function bootstrapCommand(options) {
     }
     const oidcProviderUrl = getOidcProviderUrlFromEndpoint(options.endpointOverride);
     const additionalTrustedAccounts = options.additionalTrustedAccounts ? options.additionalTrustedAccounts.split(",").map((s) => s.trim()) : void 0;
-    await executeDeployment(plan, pipelines, pipelineArtifacts, authData, identity.accountId, options, oidcProviderUrl, additionalTrustedAccounts);
+    const skipOidc = isLocalhostEndpoint(options.endpointOverride);
+    if (skipOidc) {
+      info("Localhost endpoint detected \u2014 OIDC provider creation will be skipped");
+    }
+    await executeDeployment(plan, pipelines, pipelineArtifacts, authData, identity.accountId, options, oidcProviderUrl, additionalTrustedAccounts, skipOidc);
   } catch (error2) {
     if (error2 instanceof DevRampsError) {
       error(error2.message);
@@ -2847,7 +2950,8 @@ async function buildDeploymentPlan(pipelines, pipelineArtifacts, authData, curre
       action: await determineStackAction(stackName, cicdCredentials, cicdRegion),
       pipelineSlug: pipeline.slug,
       dockerArtifacts: filteredArtifacts.docker,
-      bundleArtifacts: filteredArtifacts.bundle
+      bundleArtifacts: filteredArtifacts.bundle,
+      stageAccountIds: pipeline.targetAccountIds
     });
   }
   const accountStacks = [];
@@ -3063,48 +3167,53 @@ async function confirmDeploymentPlan(plan) {
     ]
   });
 }
-async function executeDeployment(plan, pipelines, pipelineArtifacts, authData, currentAccountId, options, oidcProviderUrl, additionalTrustedAccounts) {
+async function executeDeployment(plan, pipelines, pipelineArtifacts, authData, currentAccountId, options, oidcProviderUrl, additionalTrustedAccounts, skipOidc) {
   const results = { success: 0, failed: 0 };
   const remainingStacks = 1 + plan.pipelineStacks.length + plan.stageStacks.length + plan.importStacks.length;
-  newline();
-  header("Phase 1: Deploying Account Bootstrap Stacks");
-  info(`Deploying ${plan.accountStacks.length} account stack(s) in parallel...`);
-  newline();
-  const accountProgress = getMultiStackProgress();
-  for (const stack of plan.accountStacks) {
-    accountProgress.addStack(stack.stackName, "account", stack.accountId, stack.region, 1);
-  }
-  accountProgress.start();
-  const accountResults = await Promise.all(
-    plan.accountStacks.map(async (stack) => {
-      try {
-        await deployAccountStack(stack, currentAccountId, options, oidcProviderUrl);
-        return { stack: `${stack.stackName} (${stack.accountId})`, success: true };
-      } catch (error2) {
-        return {
-          stack: `${stack.stackName} (${stack.accountId})`,
-          success: false,
-          error: error2 instanceof Error ? error2.message : String(error2)
-        };
+  if (skipOidc) {
+    newline();
+    header("Phase 1: Skipping Account Bootstrap Stacks (localhost endpoint, OIDC not needed)");
+  } else {
+    newline();
+    header("Phase 1: Deploying Account Bootstrap Stacks");
+    info(`Deploying ${plan.accountStacks.length} account stack(s) in parallel...`);
+    newline();
+    const accountProgress = getMultiStackProgress();
+    for (const stack of plan.accountStacks) {
+      accountProgress.addStack(stack.stackName, "account", stack.accountId, stack.region, 1);
+    }
+    accountProgress.start();
+    const accountResults = await Promise.all(
+      plan.accountStacks.map(async (stack) => {
+        try {
+          await deployAccountStack(stack, currentAccountId, options, oidcProviderUrl);
+          return { stack: `${stack.stackName} (${stack.accountId})`, success: true };
+        } catch (error2) {
+          return {
+            stack: `${stack.stackName} (${stack.accountId})`,
+            success: false,
+            error: error2 instanceof Error ? error2.message : String(error2)
+          };
+        }
+      })
+    );
+    clearMultiStackProgress();
+    newline();
+    for (const result of accountResults) {
+      if (result.success) {
+        success(`${result.stack} deployed`);
+        results.success++;
+      } else {
+        error(`${result.stack} failed: ${result.error}`);
+        results.failed++;
       }
-    })
-  );
-  clearMultiStackProgress();
-  newline();
-  for (const result of accountResults) {
-    if (result.success) {
-      success(`${result.stack} deployed`);
-      results.success++;
-    } else {
-      error(`${result.stack} failed: ${result.error}`);
-      results.failed++;
     }
-  }
-  if (results.failed > 0) {
-    newline();
-    header("Deployment Summary");
-    error(`${results.failed} account stack(s) failed. Skipping remaining ${remainingStacks} stack(s).`);
-    process.exit(1);
+    if (results.failed > 0) {
+      newline();
+      header("Deployment Summary");
+      error(`${results.failed} account stack(s) failed. Skipping remaining ${remainingStacks} stack(s).`);
+      process.exit(1);
+    }
   }
   newline();
   header("Phase 2: Deploying Org, Pipeline, Stage, and Import Stacks");
@@ -3126,7 +3235,7 @@ async function executeDeployment(plan, pipelines, pipelineArtifacts, authData, c
   mainProgress.start();
   const orgPromise = (async () => {
     try {
-      await deployOrgStack(plan, pipelines, authData, currentAccountId, options, oidcProviderUrl, additionalTrustedAccounts);
+      await deployOrgStack(plan, pipelines, authData, currentAccountId, options, oidcProviderUrl, additionalTrustedAccounts, skipOidc);
       return { stack: plan.orgStack.stackName, success: true };
     } catch (error2) {
       return {
@@ -3150,7 +3259,7 @@ async function executeDeployment(plan, pipelines, pipelineArtifacts, authData, c
   });
   const stagePromises = plan.stageStacks.map(async (stack) => {
     try {
-      await deployStageStack(stack, authData, currentAccountId, options, oidcProviderUrl, additionalTrustedAccounts);
+      await deployStageStack(stack, authData, currentAccountId, options, oidcProviderUrl, additionalTrustedAccounts, skipOidc);
       return { stack: stack.stackName, success: true };
     } catch (error2) {
       return {
@@ -3162,7 +3271,7 @@ async function executeDeployment(plan, pipelines, pipelineArtifacts, authData, c
   });
   const importPromises = plan.importStacks.map(async (stack) => {
     try {
-      await deployImportStack(stack, currentAccountId, options, oidcProviderUrl, additionalTrustedAccounts);
+      await deployImportStack(stack, currentAccountId, options, oidcProviderUrl, additionalTrustedAccounts, skipOidc);
       return { stack: `${stack.stackName} (${stack.accountId})`, success: true };
     } catch (error2) {
       return {
@@ -3199,7 +3308,7 @@ async function executeDeployment(plan, pipelines, pipelineArtifacts, authData, c
     process.exit(1);
   }
 }
-async function deployOrgStack(plan, pipelines, authData, currentAccountId, options, oidcProviderUrl, additionalTrustedAccounts) {
+async function deployOrgStack(plan, pipelines, authData, currentAccountId, options, oidcProviderUrl, additionalTrustedAccounts, skipOidc) {
   const { orgSlug, cicdAccountId, cicdRegion } = authData;
   const credentials = cicdAccountId !== currentAccountId ? (await assumeRoleForAccount({
     targetAccountId: cicdAccountId,
@@ -3231,7 +3340,8 @@ async function deployOrgStack(plan, pipelines, authData, currentAccountId, optio
     cicdAccountId,
     targetAccountIds,
     oidcProviderUrl,
-    additionalTrustedAccounts
+    additionalTrustedAccounts,
+    skipOidc
   });
   const deployOptions = {
     stackName: plan.orgStack.stackName,
@@ -3254,7 +3364,8 @@ async function deployPipelineStack(stack, authData, currentAccountId, options) {
     pipelineSlug: stack.pipelineSlug,
     cicdAccountId,
     dockerArtifacts: stack.dockerArtifacts,
-    bundleArtifacts: stack.bundleArtifacts
+    bundleArtifacts: stack.bundleArtifacts,
+    stageAccountIds: stack.stageAccountIds
   });
   const deployOptions = {
     stackName: stack.stackName,
@@ -3283,7 +3394,7 @@ async function deployAccountStack(stack, currentAccountId, options, oidcProvider
   await previewStackChanges(deployOptions);
   await deployStack(deployOptions);
 }
-async function deployStageStack(stack, authData, currentAccountId, options, oidcProviderUrl, additionalTrustedAccounts) {
+async function deployStageStack(stack, authData, currentAccountId, options, oidcProviderUrl, additionalTrustedAccounts, skipOidc) {
   const credentials = stack.accountId !== currentAccountId ? (await assumeRoleForAccount({
     targetAccountId: stack.accountId,
     currentAccountId,
@@ -3299,7 +3410,8 @@ async function deployStageStack(stack, authData, currentAccountId, options, oidc
     dockerArtifacts: stack.dockerArtifacts,
     bundleArtifacts: stack.bundleArtifacts,
     oidcProviderUrl,
-    additionalTrustedAccounts
+    additionalTrustedAccounts,
+    skipOidc
   });
   const deployOptions = {
     stackName: stack.stackName,
@@ -3311,7 +3423,7 @@ async function deployStageStack(stack, authData, currentAccountId, options, oidc
   await previewStackChanges(deployOptions);
   await deployStack(deployOptions);
 }
-async function deployImportStack(stack, currentAccountId, options, oidcProviderUrl, additionalTrustedAccounts) {
+async function deployImportStack(stack, currentAccountId, options, oidcProviderUrl, additionalTrustedAccounts, skipOidc) {
   const credentials = stack.accountId !== currentAccountId ? (await assumeRoleForAccount({
     targetAccountId: stack.accountId,
     currentAccountId,
@@ -3322,7 +3434,8 @@ async function deployImportStack(stack, currentAccountId, options, oidcProviderU
     orgSlug: stack.orgSlug,
     accountId: stack.accountId,
     oidcProviderUrl,
-    additionalTrustedAccounts
+    additionalTrustedAccounts,
+    skipOidc
   });
   const deployOptions = {
     stackName: stack.stackName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devramps/cli",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "DevRamps CLI - Bootstrap AWS infrastructure for CI/CD pipelines",
   "main": "dist/index.js",
   "bin": {