@fishawack/lab-env 5.6.1 → 5.7.0-beta.2

package/commands/create/services/aws/elasticbeanstalk.js

@@ -10,8 +10,11 @@ const {
     DescribeEnvironmentsCommand,
     DescribeApplicationsCommand,
     DescribeApplicationVersionsCommand,
+    DescribeConfigurationSettingsCommand,
+    UpdateEnvironmentCommand,
     CreateApplicationVersionCommand,
     ListAvailableSolutionStacksCommand,
+    RestartAppServerCommand,
 } = require("@aws-sdk/client-elastic-beanstalk");
 const { Spinner, poll } = require("../../libs/utilities");
 const { eb } = require("../../libs/vars");
@@ -31,6 +34,16 @@ module.exports.createElasticBeanstalkApplication = async (name) => {
     return res;
 };
 
+module.exports.describeEnvironment = async (name) => {
+    const client = new ElasticBeanstalkClient({});
+
+    return client.send(
+        new DescribeEnvironmentsCommand({
+            EnvironmentNames: [name],
+        }),
+    );
+};
+
 module.exports.createElasticBeanstalkEnvironment = async (
     name,
     { language },
@@ -230,3 +243,60 @@ module.exports.deleteApplicationVersion = async (
         }),
     );
 };
+
+module.exports.describeConfigurationSettings = async (
+    applicationName,
+    environmentName,
+) => {
+    const client = new ElasticBeanstalkClient({});
+
+    const res = await Spinner.prototype.simple(
+        `Retrieving configuration for ${environmentName}`,
+        () => {
+            return client.send(
+                new DescribeConfigurationSettingsCommand({
+                    ApplicationName: applicationName,
+                    EnvironmentName: environmentName,
+                }),
+            );
+        },
+    );
+
+    return res.ConfigurationSettings[0]?.OptionSettings || [];
+};
+
+module.exports.updateEnvironmentSettings = async (
+    environmentName,
+    optionSettings = [],
+    optionsToRemove = [],
+) => {
+    const client = new ElasticBeanstalkClient({});
+
+    await Spinner.prototype.simple(
+        `Updating environment ${environmentName}`,
+        () => {
+            return client.send(
+                new UpdateEnvironmentCommand({
+                    EnvironmentName: environmentName,
+                    OptionSettings: optionSettings,
+                    OptionsToRemove: optionsToRemove,
+                }),
+            );
+        },
+    );
+};
+
+module.exports.restartAppServer = async (environmentName) => {
+    const client = new ElasticBeanstalkClient({});
+
+    await Spinner.prototype.simple(
+        `Restarting app server for ${environmentName}`,
+        () => {
+            return client.send(
+                new RestartAppServerCommand({
+                    EnvironmentName: environmentName,
+                }),
+            );
+        },
+    );
+};

package/commands/create/services/aws/iam.js

@@ -11,10 +11,18 @@ const {
     ListAccessKeysCommand,
     GetRoleCommand,
     CreateRoleCommand,
+    DeleteRoleCommand,
     AttachRolePolicyCommand,
+    DetachRolePolicyCommand,
+    ListAttachedRolePoliciesCommand,
     CreateInstanceProfileCommand,
+    DeleteInstanceProfileCommand,
     AddRoleToInstanceProfileCommand,
+    RemoveRoleFromInstanceProfileCommand,
     PutRolePolicyCommand,
+    DeleteRolePolicyCommand,
+    ListRolePoliciesCommand,
+    CreateServiceLinkedRoleCommand,
 } = require("@aws-sdk/client-iam");
 const { Spinner } = require("../../libs/utilities");
 
@@ -147,6 +155,11 @@ module.exports.syncFWIAMPolicies = async (
             UserName,
             "arn:aws:iam::aws:policy/AmazonElastiCacheFullAccess",
         );
+
+        await module.exports.attachIAMPolicy(
+            UserName,
+            "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
+        );
     }
 
     if (permissions.includes("manage-users")) {
@@ -393,6 +406,14 @@ module.exports.ensureEBInstanceProfileExists = async () => {
         role,
         "arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker",
     );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSSecretsManagerClientReadOnlyAccess",
+    );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
+    );
     await module.exports.attachInlineRolePolicy(
         role,
         "lab-env-elasticbeanstalk-describe-env",
@@ -465,6 +486,11 @@ module.exports.ensureEBManagedUpdateProfileExists = async () => {
         "arn:aws:iam::aws:policy/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy",
     );
 
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSSecretsManagerClientReadOnlyAccess",
+    );
+
     await module.exports.attachInlineRolePolicy(
         role,
         "lab-env-elasticbeanstalk-custom-managed-updates-permissions",
@@ -490,3 +516,245 @@ module.exports.ensureEBManagedUpdateProfileExists = async () => {
         }),
     );
 };
+
+module.exports.ensureEnvironmentInstanceProfile = async (
+    ebSlug,
+    s3BucketName,
+    opensearchDomainArn,
+) => {
+    const role = `${ebSlug}-role`;
+
+    try {
+        await module.exports.getRole(role);
+    } catch {
+        await module.exports.createRole(
+            role,
+            JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Action: ["sts:AssumeRole"],
+                        Principal: {
+                            Service: ["ec2.amazonaws.com"],
+                        },
+                    },
+                ],
+            }),
+        );
+
+        await module.exports.createInstanceProfile(role);
+        await module.exports.attachRoleToInstanceProfile(role, role);
+    }
+
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier",
+    );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier",
+    );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker",
+    );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSSecretsManagerClientReadOnlyAccess",
+    );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
+    );
+    await module.exports.attachInlineRolePolicy(
+        role,
+        "lab-env-elasticbeanstalk-describe-env",
+        JSON.stringify({
+            Version: "2012-10-17",
+            Statement: [
+                {
+                    Sid: "VisualEditor0",
+                    Effect: "Allow",
+                    Action: [
+                        "ec2:DescribeTags",
+                        "autoscaling:DescribeAutoScalingGroups",
+                        "elasticbeanstalk:DescribeEvents",
+                    ],
+                    Resource: "*",
+                },
+            ],
+        }),
+    );
+
+    if (s3BucketName) {
+        await module.exports.attachInlineRolePolicy(
+            role,
+            "lab-env-s3-bucket-access",
+            JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Sid: "S3BucketAccess",
+                        Effect: "Allow",
+                        Action: [
+                            "s3:GetObject",
+                            "s3:PutObject",
+                            "s3:DeleteObject",
+                        ],
+                        Resource: `arn:aws:s3:::${s3BucketName}/*`,
+                    },
+                    {
+                        Sid: "S3BucketList",
+                        Effect: "Allow",
+                        Action: ["s3:ListBucket", "s3:GetBucketLocation"],
+                        Resource: `arn:aws:s3:::${s3BucketName}`,
+                    },
+                ],
+            }),
+        );
+    }
+
+    if (opensearchDomainArn) {
+        await module.exports.attachInlineRolePolicy(
+            role,
+            "lab-env-opensearch-access",
+            JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Sid: "OpenSearchAccess",
+                        Effect: "Allow",
+                        Action: [
+                            "es:ESHttpGet",
+                            "es:ESHttpPost",
+                            "es:ESHttpPut",
+                            "es:ESHttpDelete",
+                            "es:ESHttpHead",
+                            "es:ESHttpPatch",
+                        ],
+                        Resource: `${opensearchDomainArn}/*`,
+                    },
+                ],
+            }),
+        );
+    }
+
+    return role;
+};
+
+module.exports.ensureOpenSearchServiceRole = async () => {
+    const client = new IAMClient({});
+
+    try {
+        await Spinner.prototype.simple(
+            "Ensuring OpenSearch service-linked role exists",
+            () => {
+                return client.send(
+                    new CreateServiceLinkedRoleCommand({
+                        AWSServiceName: "opensearchservice.amazonaws.com",
+                    }),
+                );
+            },
+        );
+    } catch (e) {
+        if (
+            e.Code !== "InvalidInput" &&
+            e.name !== "InvalidInputException" &&
+            e.name !== "InvalidInput"
+        ) {
+            throw e;
+        }
+        // Role already exists — safe to continue
+    }
+};
+
+module.exports.removeEnvironmentInstanceProfile = async (ebSlug) => {
+    const client = new IAMClient({});
+    const role = `${ebSlug}-role`;
+
+    try {
+        await module.exports.getRole(role);
+    } catch {
+        return;
+    }
+
+    const attachedPolicies = await Spinner.prototype.simple(
+        `Listing attached policies for ${role}`,
+        () => {
+            return client.send(
+                new ListAttachedRolePoliciesCommand({ RoleName: role }),
+            );
+        },
+    );
+
+    for (const policy of attachedPolicies.AttachedPolicies || []) {
+        await Spinner.prototype.simple(
+            `Detaching policy ${policy.PolicyName}`,
+            () => {
+                return client.send(
+                    new DetachRolePolicyCommand({
+                        RoleName: role,
+                        PolicyArn: policy.PolicyArn,
+                    }),
+                );
+            },
+        );
+    }
+
+    const inlinePolicies = await Spinner.prototype.simple(
+        `Listing inline policies for ${role}`,
+        () => {
+            return client.send(new ListRolePoliciesCommand({ RoleName: role }));
+        },
+    );
+
+    for (const policyName of inlinePolicies.PolicyNames || []) {
+        await Spinner.prototype.simple(
+            `Deleting inline policy ${policyName}`,
+            () => {
+                return client.send(
+                    new DeleteRolePolicyCommand({
+                        RoleName: role,
+                        PolicyName: policyName,
+                    }),
+                );
+            },
+        );
+    }
+
+    try {
+        await Spinner.prototype.simple(
+            `Removing role from instance profile ${role}`,
+            () => {
+                return client.send(
+                    new RemoveRoleFromInstanceProfileCommand({
+                        RoleName: role,
+                        InstanceProfileName: role,
+                    }),
+                );
+            },
+        );
+    } catch {
+        /* empty */
+    }
+
+    try {
+        await Spinner.prototype.simple(
+            `Deleting instance profile ${role}`,
+            () => {
+                return client.send(
+                    new DeleteInstanceProfileCommand({
+                        InstanceProfileName: role,
+                    }),
+                );
+            },
+        );
+    } catch {
+        /* empty */
+    }
+
+    await Spinner.prototype.simple(`Deleting role ${role}`, () => {
+        return client.send(new DeleteRoleCommand({ RoleName: role }));
+    });
+};