@fishawack/lab-env 5.7.0-beta.1 → 5.7.0-beta.2

package/commands/create/services/aws/iam.js

@@ -11,10 +11,18 @@ const {
     ListAccessKeysCommand,
     GetRoleCommand,
     CreateRoleCommand,
+    DeleteRoleCommand,
     AttachRolePolicyCommand,
+    DetachRolePolicyCommand,
+    ListAttachedRolePoliciesCommand,
     CreateInstanceProfileCommand,
+    DeleteInstanceProfileCommand,
     AddRoleToInstanceProfileCommand,
+    RemoveRoleFromInstanceProfileCommand,
     PutRolePolicyCommand,
+    DeleteRolePolicyCommand,
+    ListRolePoliciesCommand,
+    CreateServiceLinkedRoleCommand,
 } = require("@aws-sdk/client-iam");
 const { Spinner } = require("../../libs/utilities");
 
@@ -402,6 +410,10 @@ module.exports.ensureEBInstanceProfileExists = async () => {
         role,
         "arn:aws:iam::aws:policy/AWSSecretsManagerClientReadOnlyAccess",
     );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
+    );
     await module.exports.attachInlineRolePolicy(
         role,
         "lab-env-elasticbeanstalk-describe-env",
@@ -504,3 +516,245 @@ module.exports.ensureEBManagedUpdateProfileExists = async () => {
         }),
     );
 };
+
+module.exports.ensureEnvironmentInstanceProfile = async (
+    ebSlug,
+    s3BucketName,
+    opensearchDomainArn,
+) => {
+    const role = `${ebSlug}-role`;
+
+    try {
+        await module.exports.getRole(role);
+    } catch {
+        await module.exports.createRole(
+            role,
+            JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Action: ["sts:AssumeRole"],
+                        Principal: {
+                            Service: ["ec2.amazonaws.com"],
+                        },
+                    },
+                ],
+            }),
+        );
+
+        await module.exports.createInstanceProfile(role);
+        await module.exports.attachRoleToInstanceProfile(role, role);
+    }
+
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier",
+    );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier",
+    );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker",
+    );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSSecretsManagerClientReadOnlyAccess",
+    );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
+    );
+    await module.exports.attachInlineRolePolicy(
+        role,
+        "lab-env-elasticbeanstalk-describe-env",
+        JSON.stringify({
+            Version: "2012-10-17",
+            Statement: [
+                {
+                    Sid: "VisualEditor0",
+                    Effect: "Allow",
+                    Action: [
+                        "ec2:DescribeTags",
+                        "autoscaling:DescribeAutoScalingGroups",
+                        "elasticbeanstalk:DescribeEvents",
+                    ],
+                    Resource: "*",
+                },
+            ],
+        }),
+    );
+
+    if (s3BucketName) {
+        await module.exports.attachInlineRolePolicy(
+            role,
+            "lab-env-s3-bucket-access",
+            JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Sid: "S3BucketAccess",
+                        Effect: "Allow",
+                        Action: [
+                            "s3:GetObject",
+                            "s3:PutObject",
+                            "s3:DeleteObject",
+                        ],
+                        Resource: `arn:aws:s3:::${s3BucketName}/*`,
+                    },
+                    {
+                        Sid: "S3BucketList",
+                        Effect: "Allow",
+                        Action: ["s3:ListBucket", "s3:GetBucketLocation"],
+                        Resource: `arn:aws:s3:::${s3BucketName}`,
+                    },
+                ],
+            }),
+        );
+    }
+
+    if (opensearchDomainArn) {
+        await module.exports.attachInlineRolePolicy(
+            role,
+            "lab-env-opensearch-access",
+            JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Sid: "OpenSearchAccess",
+                        Effect: "Allow",
+                        Action: [
+                            "es:ESHttpGet",
+                            "es:ESHttpPost",
+                            "es:ESHttpPut",
+                            "es:ESHttpDelete",
+                            "es:ESHttpHead",
+                            "es:ESHttpPatch",
+                        ],
+                        Resource: `${opensearchDomainArn}/*`,
+                    },
+                ],
+            }),
+        );
+    }
+
+    return role;
+};
+
+module.exports.ensureOpenSearchServiceRole = async () => {
+    const client = new IAMClient({});
+
+    try {
+        await Spinner.prototype.simple(
+            "Ensuring OpenSearch service-linked role exists",
+            () => {
+                return client.send(
+                    new CreateServiceLinkedRoleCommand({
+                        AWSServiceName: "opensearchservice.amazonaws.com",
+                    }),
+                );
+            },
+        );
+    } catch (e) {
+        if (
+            e.Code !== "InvalidInput" &&
+            e.name !== "InvalidInputException" &&
+            e.name !== "InvalidInput"
+        ) {
+            throw e;
+        }
+        // Role already exists — safe to continue
+    }
+};
+
+module.exports.removeEnvironmentInstanceProfile = async (ebSlug) => {
+    const client = new IAMClient({});
+    const role = `${ebSlug}-role`;
+
+    try {
+        await module.exports.getRole(role);
+    } catch {
+        return;
+    }
+
+    const attachedPolicies = await Spinner.prototype.simple(
+        `Listing attached policies for ${role}`,
+        () => {
+            return client.send(
+                new ListAttachedRolePoliciesCommand({ RoleName: role }),
+            );
+        },
+    );
+
+    for (const policy of attachedPolicies.AttachedPolicies || []) {
+        await Spinner.prototype.simple(
+            `Detaching policy ${policy.PolicyName}`,
+            () => {
+                return client.send(
+                    new DetachRolePolicyCommand({
+                        RoleName: role,
+                        PolicyArn: policy.PolicyArn,
+                    }),
+                );
+            },
+        );
+    }
+
+    const inlinePolicies = await Spinner.prototype.simple(
+        `Listing inline policies for ${role}`,
+        () => {
+            return client.send(new ListRolePoliciesCommand({ RoleName: role }));
+        },
+    );
+
+    for (const policyName of inlinePolicies.PolicyNames || []) {
+        await Spinner.prototype.simple(
+            `Deleting inline policy ${policyName}`,
+            () => {
+                return client.send(
+                    new DeleteRolePolicyCommand({
+                        RoleName: role,
+                        PolicyName: policyName,
+                    }),
+                );
+            },
+        );
+    }
+
+    try {
+        await Spinner.prototype.simple(
+            `Removing role from instance profile ${role}`,
+            () => {
+                return client.send(
+                    new RemoveRoleFromInstanceProfileCommand({
+                        RoleName: role,
+                        InstanceProfileName: role,
+                    }),
+                );
+            },
+        );
+    } catch {
+        /* empty */
+    }
+
+    try {
+        await Spinner.prototype.simple(
+            `Deleting instance profile ${role}`,
+            () => {
+                return client.send(
+                    new DeleteInstanceProfileCommand({
+                        InstanceProfileName: role,
+                    }),
+                );
+            },
+        );
+    } catch {
+        /* empty */
+    }
+
+    await Spinner.prototype.simple(`Deleting role ${role}`, () => {
+        return client.send(new DeleteRoleCommand({ RoleName: role }));
+    });
+};