@devramps/cli 0.1.25 → 0.1.27

package/dist/index.js

@@ -2141,7 +2141,7 @@ function buildOrgRolePolicies(orgSlug) {
 // src/templates/pipeline-stack.ts
 function generatePipelineStackTemplate(options) {
   const { pipelineSlug, cicdAccountId, dockerArtifacts, bundleArtifacts, stageAccountIds } = options;
-  const allAccountIds = [.../* @__PURE__ */ new Set([cicdAccountId, ...stageAccountIds])];
+  const crossAccountIds = stageAccountIds.filter((id) => id !== cicdAccountId);
   const template = createBaseTemplate(`DevRamps Pipeline Stack for ${pipelineSlug}`);
   const ecrOutputs = {};
   const s3Outputs = {};
@@ -2157,7 +2157,7 @@ function generatePipelineStackTemplate(options) {
         { Key: "ArtifactType", Value: artifact.type }
       ]
     );
-    if (stageAccountIds.length > 0) {
+    if (crossAccountIds.length > 0) {
       template.Resources[resourceId].Properties.RepositoryPolicyText = {
         Version: "2012-10-17",
         Statement: [
@@ -2165,7 +2165,7 @@ function generatePipelineStackTemplate(options) {
             Sid: "AllowStageAccountPull",
             Effect: "Allow",
             Principal: {
-              AWS: allAccountIds.map((id) => `arn:aws:iam::${id}:root`)
+              AWS: crossAccountIds.map((id) => `arn:aws:iam::${id}:root`)
             },
             Action: [
               "ecr:GetDownloadUrlForLayer",
@@ -2190,7 +2190,7 @@ function generatePipelineStackTemplate(options) {
         { Key: "ArtifactType", Value: artifact.type }
       ]
     );
-    if (stageAccountIds.length > 0) {
+    if (crossAccountIds.length > 0) {
       const policyResourceId = sanitizeResourceId(`BucketPolicy${artifactId}`);
       template.Resources[policyResourceId] = {
         Type: "AWS::S3::BucketPolicy",
@@ -2203,7 +2203,7 @@ function generatePipelineStackTemplate(options) {
                 Sid: "AllowStageAccountRead",
                 Effect: "Allow",
                 Principal: {
-                  AWS: allAccountIds.map((id) => `arn:aws:iam::${id}:root`)
+                  AWS: crossAccountIds.map((id) => `arn:aws:iam::${id}:root`)
                 },
                 Action: [
                   "s3:GetObject",
@@ -2215,7 +2215,7 @@ function generatePipelineStackTemplate(options) {
                 Sid: "AllowStageAccountList",
                 Effect: "Allow",
                 Principal: {
-                  AWS: allAccountIds.map((id) => `arn:aws:iam::${id}:root`)
+                  AWS: crossAccountIds.map((id) => `arn:aws:iam::${id}:root`)
                 },
                 Action: "s3:ListBucket",
                 Resource: `arn:aws:s3:::${bucketName}`
@@ -2508,7 +2508,7 @@ function generateStageStackTemplate(options) {
   );
   const roleName = generateStageRoleName(pipelineSlug, stageName);
   const trustPolicy = buildStageTrustPolicy(accountId, orgSlug, pipelineSlug, oidcProviderUrl, additionalTrustedAccounts, skipOidc);
-  const policies = buildStagePolicies(steps, additionalPolicies, dockerArtifacts, bundleArtifacts);
+  const policies = buildStagePolicies(steps, additionalPolicies, dockerArtifacts, bundleArtifacts, orgSlug);
   template.Resources.StageDeploymentRole = createIamRoleResource(
     roleName,
     trustPolicy,
@@ -2597,7 +2597,7 @@ function buildStageTrustPolicy(accountId, orgSlug, pipelineSlug, oidcProviderUrl
   const subject = `org:${orgSlug}/pipeline:${pipelineSlug}`;
   return buildOidcTrustPolicy(accountId, subject, oidcProviderUrl, additionalTrustedAccounts, skipOidc);
 }
-function buildStagePolicies(steps, additionalPolicies, dockerArtifacts, bundleArtifacts) {
+function buildStagePolicies(steps, additionalPolicies, dockerArtifacts, bundleArtifacts, orgSlug) {
   const policies = [];
   policies.push({
     PolicyName: "DevRampsValidationPolicy",
@@ -2618,6 +2618,47 @@ function buildStagePolicies(steps, additionalPolicies, dockerArtifacts, bundleAr
       ]
     }
   });
+  const tfStateBucketName = generateTerraformStateBucketName(orgSlug);
+  policies.push({
+    PolicyName: "DevRampsTerraformStatePolicy",
+    PolicyDocument: {
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Sid: "AllowTerraformStateReadWrite",
+          Effect: "Allow",
+          Action: [
+            "s3:GetObject",
+            "s3:PutObject",
+            "s3:DeleteObject"
+          ],
+          Resource: `arn:aws:s3:::${tfStateBucketName}/*`
+        },
+        {
+          Sid: "AllowTerraformStateList",
+          Effect: "Allow",
+          Action: "s3:ListBucket",
+          Resource: `arn:aws:s3:::${tfStateBucketName}`
+        },
+        {
+          Sid: "AllowKMSForTerraformState",
+          Effect: "Allow",
+          Action: [
+            "kms:Encrypt",
+            "kms:Decrypt",
+            "kms:GenerateDataKey*",
+            "kms:DescribeKey"
+          ],
+          Resource: "*",
+          Condition: {
+            StringLike: {
+              "kms:ViaService": "s3.*.amazonaws.com"
+            }
+          }
+        }
+      ]
+    }
+  });
   if (dockerArtifacts.length > 0) {
     policies.push({
       PolicyName: "DevRampsMirrorECRPolicy",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devramps/cli",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "DevRamps CLI - Bootstrap AWS infrastructure for CI/CD pipelines",
   "main": "dist/index.js",
   "bin": {