@fishawack/lab-env 5.7.0-beta.1 → 5.7.0-beta.3

package/commands/create/services/aws/iam.js

@@ -9,25 +9,35 @@ const {
     CreateAccessKeyCommand,
     DeleteAccessKeyCommand,
     ListAccessKeysCommand,
+    AddUserToGroupCommand,
     GetRoleCommand,
     CreateRoleCommand,
+    DeleteRoleCommand,
     AttachRolePolicyCommand,
+    DetachRolePolicyCommand,
+    ListAttachedRolePoliciesCommand,
     CreateInstanceProfileCommand,
+    DeleteInstanceProfileCommand,
     AddRoleToInstanceProfileCommand,
+    RemoveRoleFromInstanceProfileCommand,
     PutRolePolicyCommand,
+    DeleteRolePolicyCommand,
+    ListRolePoliciesCommand,
+    CreateServiceLinkedRoleCommand,
 } = require("@aws-sdk/client-iam");
 const { Spinner } = require("../../libs/utilities");
+const { awsClientConfig } = require("../../libs/vars");
 
-module.exports.createIAMUser = async (UserName, tags = []) => {
-    const client = new IAMClient({});
+const getClient = () => new IAMClient(awsClientConfig);
 
+module.exports.createIAMUser = async (UserName, tags = []) => {
     let res;
 
     try {
         res = await Spinner.prototype.simple(
             `Creating IAM user ${UserName}`,
             () => {
-                return client.send(
+                return getClient().send(
                     new CreateUserCommand({
                         UserName,
                         Tags: [
@@ -41,7 +51,7 @@ module.exports.createIAMUser = async (UserName, tags = []) => {
         res = await Spinner.prototype.simple(
             `Retrieving the already existing IAM user ${UserName}`,
             () => {
-                return client.send(new GetUserCommand({ UserName }));
+                return getClient().send(new GetUserCommand({ UserName }));
             },
         );
     }
@@ -59,16 +69,25 @@ module.exports.createFWIAMUser = async (UserName, permissions) => {
     return res;
 };
 
-module.exports.removeIAMUser = async (UserName) => {
-    const client = new IAMClient({});
+module.exports.addUserToGroup = async (UserName, GroupName, iamClient) => {
+    const c = iamClient || getClient();
+
+    await Spinner.prototype.simple(
+        `Adding IAM user ${UserName} to group ${GroupName}`,
+        () => {
+            return c.send(new AddUserToGroupCommand({ UserName, GroupName }));
+        },
+    );
+};
 
+module.exports.removeIAMUser = async (UserName) => {
     let res;
 
     try {
         await Spinner.prototype.simple(
             `Checking if IAM user ${UserName} exists`,
             () => {
-                return client.send(new GetUserCommand({ UserName }));
+                return getClient().send(new GetUserCommand({ UserName }));
             },
         );
 
@@ -79,7 +98,7 @@ module.exports.removeIAMUser = async (UserName) => {
         res = await Spinner.prototype.simple(
             `Removing IAM user ${UserName}`,
             () => {
-                return client.send(new DeleteUserCommand({ UserName }));
+                return getClient().send(new DeleteUserCommand({ UserName }));
             },
         );
     } catch {
@@ -90,12 +109,10 @@ module.exports.removeIAMUser = async (UserName) => {
 };
 
 module.exports.attachIAMPolicy = async (UserName, policy) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(
         `Attaching IAM policy ${policy}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new AttachUserPolicyCommand({ UserName, PolicyArn: policy }),
             );
         },
@@ -107,68 +124,83 @@ module.exports.attachIAMPolicy = async (UserName, policy) => {
 module.exports.syncFWIAMPolicies = async (
     UserName,
     permissions = ["auto-content", "deploy-static"],
+    preserve = [],
 ) => {
-    await module.exports.removeAllIAMPolicies(UserName);
+    let res = await module.exports.listIAMPolicies(UserName);
+
+    // Detach existing policies in parallel
+    const toDetach = res.AttachedPolicies.filter(
+        (p) => !preserve.includes(p.PolicyArn),
+    );
+    if (toDetach.length) {
+        await Spinner.prototype.simple(
+            `Detaching ${toDetach.length} IAM policies`,
+            () =>
+                Promise.all(
+                    toDetach.map((p) =>
+                        getClient().send(
+                            new DetachUserPolicyCommand({
+                                UserName,
+                                PolicyArn: p.PolicyArn,
+                            }),
+                        ),
+                    ),
+                ),
+        );
+    }
+
+    // Collect policies to attach
+    const policies = [];
 
     if (
         permissions.includes("auto-content") ||
         permissions.includes("deploy-static")
     ) {
-        await module.exports.attachIAMPolicy(
-            UserName,
-            "arn:aws:iam::aws:policy/AmazonS3FullAccess",
-        );
+        policies.push("arn:aws:iam::aws:policy/AmazonS3FullAccess");
     }
 
     if (permissions.includes("deploy-static")) {
-        await module.exports.attachIAMPolicy(
-            UserName,
-            "arn:aws:iam::aws:policy/CloudFrontFullAccess",
-        );
+        policies.push("arn:aws:iam::aws:policy/CloudFrontFullAccess");
     }
 
     if (permissions.includes("deploy-fullstack")) {
-        await module.exports.attachIAMPolicy(
-            UserName,
+        policies.push(
             "arn:aws:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk",
-        );
-
-        await module.exports.attachIAMPolicy(
-            UserName,
             "arn:aws:iam::aws:policy/AmazonOpenSearchServiceFullAccess",
-        );
-
-        await module.exports.attachIAMPolicy(
-            UserName,
             "arn:aws:iam::aws:policy/AmazonRDSFullAccess",
-        );
-
-        await module.exports.attachIAMPolicy(
-            UserName,
             "arn:aws:iam::aws:policy/AmazonElastiCacheFullAccess",
-        );
-
-        await module.exports.attachIAMPolicy(
-            UserName,
             "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
         );
     }
 
     if (permissions.includes("manage-users")) {
-        await module.exports.attachIAMPolicy(
-            UserName,
-            "arn:aws:iam::aws:policy/IAMFullAccess",
+        policies.push("arn:aws:iam::aws:policy/IAMFullAccess");
+    }
+
+    // Attach all policies in parallel
+    if (policies.length) {
+        await Spinner.prototype.simple(
+            `Attaching ${policies.length} IAM policies`,
+            () =>
+                Promise.all(
+                    policies.map((p) =>
+                        getClient().send(
+                            new AttachUserPolicyCommand({
+                                UserName,
+                                PolicyArn: p,
+                            }),
+                        ),
+                    ),
+                ),
         );
     }
 };
 
 module.exports.removeIAMPolicy = async (UserName, policy) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(
         `Detaching IAM policy ${policy}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new DetachUserPolicyCommand({ UserName, PolicyArn: policy }),
             );
         },
@@ -178,10 +210,10 @@ module.exports.removeIAMPolicy = async (UserName, policy) => {
 };
 
 module.exports.listIAMPolicies = async (UserName) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(`Listing IAM policies`, () => {
-        return client.send(new ListAttachedUserPoliciesCommand({ UserName }));
+        return getClient().send(
+            new ListAttachedUserPoliciesCommand({ UserName }),
+        );
     });
 
     return res;
@@ -190,10 +222,20 @@ module.exports.listIAMPolicies = async (UserName) => {
 module.exports.removeAllIAMPolicies = async (UserName) => {
     let res = await module.exports.listIAMPolicies(UserName);
 
-    for (let i = 0; i < res.AttachedPolicies.length; i++) {
-        await module.exports.removeIAMPolicy(
-            UserName,
-            res.AttachedPolicies[i].PolicyArn,
+    if (res.AttachedPolicies.length) {
+        await Spinner.prototype.simple(
+            `Detaching ${res.AttachedPolicies.length} IAM policies`,
+            () =>
+                Promise.all(
+                    res.AttachedPolicies.map((p) =>
+                        getClient().send(
+                            new DetachUserPolicyCommand({
+                                UserName,
+                                PolicyArn: p.PolicyArn,
+                            }),
+                        ),
+                    ),
+                ),
         );
     }
 
@@ -201,22 +243,18 @@ module.exports.removeAllIAMPolicies = async (UserName) => {
 };
 
 module.exports.createAccessKey = async (UserName) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(`Creating access key`, () => {
-        return client.send(new CreateAccessKeyCommand({ UserName }));
+        return getClient().send(new CreateAccessKeyCommand({ UserName }));
     });
 
     return res;
 };
 
 module.exports.removeAccessKey = async (UserName, AccessKeyId) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(
         `Removing access key ${AccessKeyId}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new DeleteAccessKeyCommand({ AccessKeyId, UserName }),
             );
         },
@@ -226,10 +264,8 @@ module.exports.removeAccessKey = async (UserName, AccessKeyId) => {
 };
 
 module.exports.listAccessKeys = async (UserName) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(`Listing access keys`, () => {
-        return client.send(new ListAccessKeysCommand({ UserName }));
+        return getClient().send(new ListAccessKeysCommand({ UserName }));
     });
 
     return res;
@@ -238,10 +274,20 @@ module.exports.listAccessKeys = async (UserName) => {
 module.exports.removeAllAccessKeys = async (UserName) => {
     let res = await module.exports.listAccessKeys(UserName);
 
-    for (let i = 0; i < res.AccessKeyMetadata.length; i++) {
-        await module.exports.removeAccessKey(
-            UserName,
-            res.AccessKeyMetadata[i].AccessKeyId,
+    if (res.AccessKeyMetadata.length) {
+        await Spinner.prototype.simple(
+            `Removing ${res.AccessKeyMetadata.length} access keys`,
+            () =>
+                Promise.all(
+                    res.AccessKeyMetadata.map((k) =>
+                        getClient().send(
+                            new DeleteAccessKeyCommand({
+                                UserName,
+                                AccessKeyId: k.AccessKeyId,
+                            }),
+                        ),
+                    ),
+                ),
         );
     }
 
@@ -258,13 +304,52 @@ module.exports.createAccessKeySafe = async (UserName) => {
     return res;
 };
 
-module.exports.getRole = async (RoleName) => {
-    const client = new IAMClient({});
+module.exports.rotateAccessKey = async (UserName) => {
+    let res = await module.exports.listAccessKeys(UserName);
+    let keys = res.AccessKeyMetadata;
+
+    if (keys.length === 2) {
+        console.log(
+            `\n⚠ ${UserName} has 2 existing keys (likely from a failed previous rotation). Removing the older key to make room.\n`,
+        );
+
+        keys.sort((a, b) => new Date(a.CreateDate) - new Date(b.CreateDate));
+
+        await module.exports.removeAccessKey(UserName, keys[0].AccessKeyId);
+
+        keys = [keys[1]];
+    }
+
+    let newKey = await module.exports.createAccessKey(UserName);
+
+    if (keys.length === 1) {
+        await module.exports.removeAccessKey(UserName, keys[0].AccessKeyId);
+    }
+
+    return newKey;
+};
+
+module.exports.rotateFWIAMUser = async (UserName, permissions) => {
+    await module.exports.createIAMUser(UserName);
+
+    let preserve = [];
+
+    if (permissions && permissions.includes("manage-users")) {
+        preserve.push("arn:aws:iam::aws:policy/IAMFullAccess");
+    }
+
+    await module.exports.syncFWIAMPolicies(UserName, permissions, preserve);
+
+    let res = await module.exports.rotateAccessKey(UserName);
 
+    return res;
+};
+
+module.exports.getRole = async (RoleName) => {
     let res = await Spinner.prototype.simple(
         `Retrieving the role ${RoleName}`,
         () => {
-            return client.send(new GetRoleCommand({ RoleName }));
+            return getClient().send(new GetRoleCommand({ RoleName }));
         },
     );
 
@@ -272,12 +357,10 @@ module.exports.getRole = async (RoleName) => {
 };
 
 module.exports.createRole = async (RoleName, AssumeRolePolicyDocument) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(
         `Creating the role ${RoleName}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new CreateRoleCommand({ RoleName, AssumeRolePolicyDocument }),
             );
         },
@@ -287,12 +370,10 @@ module.exports.createRole = async (RoleName, AssumeRolePolicyDocument) => {
 };
 
 module.exports.createInstanceProfile = async (InstanceProfileName) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(
         `Creating the instance profile ${InstanceProfileName}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new CreateInstanceProfileCommand({ InstanceProfileName }),
             );
         },
@@ -305,12 +386,10 @@ module.exports.attachRoleToInstanceProfile = async (
     RoleName,
     InstanceProfileName,
 ) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(
         `Attaching role ${RoleName} to the instance profile ${InstanceProfileName}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new AddRoleToInstanceProfileCommand({
                     RoleName,
                     InstanceProfileName,
@@ -323,12 +402,10 @@ module.exports.attachRoleToInstanceProfile = async (
 };
 
 module.exports.attachRolePolicy = async (RoleName, PolicyArn) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(
         `Attaching Role policy ${PolicyArn}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new AttachRolePolicyCommand({ RoleName, PolicyArn }),
             );
         },
@@ -342,12 +419,10 @@ module.exports.attachInlineRolePolicy = async (
     PolicyName,
     PolicyDocument,
 ) => {
-    const client = new IAMClient({});
-
     let res = await Spinner.prototype.simple(
         `Attaching Inline Role policy ${PolicyName}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new PutRolePolicyCommand({
                     RoleName,
                     PolicyName,
@@ -402,6 +477,10 @@ module.exports.ensureEBInstanceProfileExists = async () => {
         role,
         "arn:aws:iam::aws:policy/AWSSecretsManagerClientReadOnlyAccess",
     );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
+    );
     await module.exports.attachInlineRolePolicy(
         role,
         "lab-env-elasticbeanstalk-describe-env",
@@ -504,3 +583,244 @@ module.exports.ensureEBManagedUpdateProfileExists = async () => {
         }),
     );
 };
+
+module.exports.ensureEnvironmentInstanceProfile = async (
+    ebSlug,
+    s3BucketName,
+    opensearchDomainArn,
+) => {
+    const role = `${ebSlug}-role`;
+
+    try {
+        await module.exports.getRole(role);
+    } catch {
+        await module.exports.createRole(
+            role,
+            JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Action: ["sts:AssumeRole"],
+                        Principal: {
+                            Service: ["ec2.amazonaws.com"],
+                        },
+                    },
+                ],
+            }),
+        );
+
+        await module.exports.createInstanceProfile(role);
+        await module.exports.attachRoleToInstanceProfile(role, role);
+    }
+
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier",
+    );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier",
+    );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker",
+    );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSSecretsManagerClientReadOnlyAccess",
+    );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
+    );
+    await module.exports.attachInlineRolePolicy(
+        role,
+        "lab-env-elasticbeanstalk-describe-env",
+        JSON.stringify({
+            Version: "2012-10-17",
+            Statement: [
+                {
+                    Sid: "VisualEditor0",
+                    Effect: "Allow",
+                    Action: [
+                        "ec2:DescribeTags",
+                        "autoscaling:DescribeAutoScalingGroups",
+                        "elasticbeanstalk:DescribeEvents",
+                    ],
+                    Resource: "*",
+                },
+            ],
+        }),
+    );
+
+    if (s3BucketName) {
+        await module.exports.attachInlineRolePolicy(
+            role,
+            "lab-env-s3-bucket-access",
+            JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Sid: "S3BucketAccess",
+                        Effect: "Allow",
+                        Action: [
+                            "s3:GetObject",
+                            "s3:PutObject",
+                            "s3:DeleteObject",
+                        ],
+                        Resource: `arn:aws:s3:::${s3BucketName}/*`,
+                    },
+                    {
+                        Sid: "S3BucketList",
+                        Effect: "Allow",
+                        Action: ["s3:ListBucket", "s3:GetBucketLocation"],
+                        Resource: `arn:aws:s3:::${s3BucketName}`,
+                    },
+                ],
+            }),
+        );
+    }
+
+    if (opensearchDomainArn) {
+        await module.exports.attachInlineRolePolicy(
+            role,
+            "lab-env-opensearch-access",
+            JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Sid: "OpenSearchAccess",
+                        Effect: "Allow",
+                        Action: [
+                            "es:ESHttpGet",
+                            "es:ESHttpPost",
+                            "es:ESHttpPut",
+                            "es:ESHttpDelete",
+                            "es:ESHttpHead",
+                            "es:ESHttpPatch",
+                        ],
+                        Resource: `${opensearchDomainArn}/*`,
+                    },
+                ],
+            }),
+        );
+    }
+
+    return role;
+};
+
+module.exports.ensureOpenSearchServiceRole = async () => {
+    try {
+        await Spinner.prototype.simple(
+            "Ensuring OpenSearch service-linked role exists",
+            () => {
+                return getClient().send(
+                    new CreateServiceLinkedRoleCommand({
+                        AWSServiceName: "opensearchservice.amazonaws.com",
+                    }),
+                );
+            },
+        );
+    } catch (e) {
+        if (
+            e.Code !== "InvalidInput" &&
+            e.name !== "InvalidInputException" &&
+            e.name !== "InvalidInput"
+        ) {
+            throw e;
+        }
+        // Role already exists — safe to continue
+    }
+};
+
+module.exports.removeEnvironmentInstanceProfile = async (ebSlug) => {
+    const role = `${ebSlug}-role`;
+
+    try {
+        await module.exports.getRole(role);
+    } catch {
+        return;
+    }
+
+    const attachedPolicies = await Spinner.prototype.simple(
+        `Listing attached policies for ${role}`,
+        () => {
+            return getClient().send(
+                new ListAttachedRolePoliciesCommand({ RoleName: role }),
+            );
+        },
+    );
+
+    for (const policy of attachedPolicies.AttachedPolicies || []) {
+        await Spinner.prototype.simple(
+            `Detaching policy ${policy.PolicyName}`,
+            () => {
+                return getClient().send(
+                    new DetachRolePolicyCommand({
+                        RoleName: role,
+                        PolicyArn: policy.PolicyArn,
+                    }),
+                );
+            },
+        );
+    }
+
+    const inlinePolicies = await Spinner.prototype.simple(
+        `Listing inline policies for ${role}`,
+        () => {
+            return getClient().send(
+                new ListRolePoliciesCommand({ RoleName: role }),
+            );
+        },
+    );
+
+    for (const policyName of inlinePolicies.PolicyNames || []) {
+        await Spinner.prototype.simple(
+            `Deleting inline policy ${policyName}`,
+            () => {
+                return getClient().send(
+                    new DeleteRolePolicyCommand({
+                        RoleName: role,
+                        PolicyName: policyName,
+                    }),
+                );
+            },
+        );
+    }
+
+    try {
+        await Spinner.prototype.simple(
+            `Removing role from instance profile ${role}`,
+            () => {
+                return getClient().send(
+                    new RemoveRoleFromInstanceProfileCommand({
+                        RoleName: role,
+                        InstanceProfileName: role,
+                    }),
+                );
+            },
+        );
+    } catch {
+        /* empty */
+    }
+
+    try {
+        await Spinner.prototype.simple(
+            `Deleting instance profile ${role}`,
+            () => {
+                return getClient().send(
+                    new DeleteInstanceProfileCommand({
+                        InstanceProfileName: role,
+                    }),
+                );
+            },
+        );
+    } catch {
+        /* empty */
+    }
+
+    await Spinner.prototype.simple(`Deleting role ${role}`, () => {
+        return getClient().send(new DeleteRoleCommand({ RoleName: role }));
+    });
+};