@devramps/cli 0.1.24 → 0.1.26

package/dist/index.js

@@ -2140,7 +2140,8 @@ function buildOrgRolePolicies(orgSlug) {
 
 // src/templates/pipeline-stack.ts
 function generatePipelineStackTemplate(options) {
-  const { pipelineSlug, cicdAccountId, dockerArtifacts, bundleArtifacts } = options;
+  const { pipelineSlug, cicdAccountId, dockerArtifacts, bundleArtifacts, stageAccountIds } = options;
+  const crossAccountIds = stageAccountIds.filter((id) => id !== cicdAccountId);
   const template = createBaseTemplate(`DevRamps Pipeline Stack for ${pipelineSlug}`);
   const ecrOutputs = {};
   const s3Outputs = {};
@@ -2156,6 +2157,25 @@ function generatePipelineStackTemplate(options) {
         { Key: "ArtifactType", Value: artifact.type }
       ]
     );
+    if (crossAccountIds.length > 0) {
+      template.Resources[resourceId].Properties.RepositoryPolicyText = {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Sid: "AllowStageAccountPull",
+            Effect: "Allow",
+            Principal: {
+              AWS: crossAccountIds.map((id) => `arn:aws:iam::${id}:root`)
+            },
+            Action: [
+              "ecr:GetDownloadUrlForLayer",
+              "ecr:BatchGetImage",
+              "ecr:BatchCheckLayerAvailability"
+            ]
+          }
+        ]
+      };
+    }
     ecrOutputs[artifact.name] = { repoName, resourceId };
   }
   for (const artifact of bundleArtifacts) {
@@ -2170,6 +2190,41 @@ function generatePipelineStackTemplate(options) {
         { Key: "ArtifactType", Value: artifact.type }
       ]
     );
+    if (crossAccountIds.length > 0) {
+      const policyResourceId = sanitizeResourceId(`BucketPolicy${artifactId}`);
+      template.Resources[policyResourceId] = {
+        Type: "AWS::S3::BucketPolicy",
+        Properties: {
+          Bucket: { Ref: resourceId },
+          PolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [
+              {
+                Sid: "AllowStageAccountRead",
+                Effect: "Allow",
+                Principal: {
+                  AWS: crossAccountIds.map((id) => `arn:aws:iam::${id}:root`)
+                },
+                Action: [
+                  "s3:GetObject",
+                  "s3:HeadObject"
+                ],
+                Resource: `arn:aws:s3:::${bucketName}/*`
+              },
+              {
+                Sid: "AllowStageAccountList",
+                Effect: "Allow",
+                Principal: {
+                  AWS: crossAccountIds.map((id) => `arn:aws:iam::${id}:root`)
+                },
+                Action: "s3:ListBucket",
+                Resource: `arn:aws:s3:::${bucketName}`
+              }
+            ]
+          }
+        }
+      };
+    }
     s3Outputs[artifact.name] = { bucketName, resourceId };
   }
   for (const [artifactName, { resourceId }] of Object.entries(ecrOutputs)) {
@@ -2453,7 +2508,7 @@ function generateStageStackTemplate(options) {
   );
   const roleName = generateStageRoleName(pipelineSlug, stageName);
   const trustPolicy = buildStageTrustPolicy(accountId, orgSlug, pipelineSlug, oidcProviderUrl, additionalTrustedAccounts, skipOidc);
-  const policies = buildStagePolicies(steps, additionalPolicies);
+  const policies = buildStagePolicies(steps, additionalPolicies, dockerArtifacts, bundleArtifacts);
   template.Resources.StageDeploymentRole = createIamRoleResource(
     roleName,
     trustPolicy,
@@ -2542,7 +2597,7 @@ function buildStageTrustPolicy(accountId, orgSlug, pipelineSlug, oidcProviderUrl
   const subject = `org:${orgSlug}/pipeline:${pipelineSlug}`;
   return buildOidcTrustPolicy(accountId, subject, oidcProviderUrl, additionalTrustedAccounts, skipOidc);
 }
-function buildStagePolicies(steps, additionalPolicies) {
+function buildStagePolicies(steps, additionalPolicies, dockerArtifacts, bundleArtifacts) {
   const policies = [];
   policies.push({
     PolicyName: "DevRampsValidationPolicy",
@@ -2563,6 +2618,38 @@ function buildStagePolicies(steps, additionalPolicies) {
       ]
     }
   });
+  if (dockerArtifacts.length > 0) {
+    policies.push({
+      PolicyName: "DevRampsMirrorECRPolicy",
+      PolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Sid: "AllowECRMirror",
+            Effect: "Allow",
+            Action: MIRROR_ECR_PERMISSIONS.actions,
+            Resource: MIRROR_ECR_PERMISSIONS.resources || ["*"]
+          }
+        ]
+      }
+    });
+  }
+  if (bundleArtifacts.length > 0) {
+    policies.push({
+      PolicyName: "DevRampsMirrorS3Policy",
+      PolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Sid: "AllowS3Mirror",
+            Effect: "Allow",
+            Action: MIRROR_S3_PERMISSIONS.actions,
+            Resource: MIRROR_S3_PERMISSIONS.resources || ["*"]
+          }
+        ]
+      }
+    });
+  }
   for (const step of steps) {
     if (!hasPermissions(step.type)) {
       continue;
@@ -2863,7 +2950,8 @@ async function buildDeploymentPlan(pipelines, pipelineArtifacts, authData, curre
       action: await determineStackAction(stackName, cicdCredentials, cicdRegion),
       pipelineSlug: pipeline.slug,
       dockerArtifacts: filteredArtifacts.docker,
-      bundleArtifacts: filteredArtifacts.bundle
+      bundleArtifacts: filteredArtifacts.bundle,
+      stageAccountIds: pipeline.targetAccountIds
     });
   }
   const accountStacks = [];
@@ -3276,7 +3364,8 @@ async function deployPipelineStack(stack, authData, currentAccountId, options) {
     pipelineSlug: stack.pipelineSlug,
     cicdAccountId,
     dockerArtifacts: stack.dockerArtifacts,
-    bundleArtifacts: stack.bundleArtifacts
+    bundleArtifacts: stack.bundleArtifacts,
+    stageAccountIds: stack.stageAccountIds
   });
   const deployOptions = {
     stackName: stack.stackName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devramps/cli",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "DevRamps CLI - Bootstrap AWS infrastructure for CI/CD pipelines",
   "main": "dist/index.js",
   "bin": {