alchemy 0.3.0 → 0.4.0

package/src/aws/oidc/oidc-provider.ts

@@ -9,7 +9,7 @@ import {
 } from "@aws-sdk/client-iam";
 import type { Context } from "../../context";
 import { Resource } from "../../resource";
-import { getAccountId } from "../account-id";
+import { AccountId } from "../account-id";
 
 /**
  * Properties for configuring an AWS OIDC provider for GitHub Actions
@@ -121,7 +121,7 @@ export const OIDCProvider = Resource(
   async function (
     this: Context<OIDCProvider>,
     id: string,
-    props: OIDCProviderProps,
+    props: OIDCProviderProps
   ) {
     // Initialize AWS SDK client
     const client = new IAMClient({
@@ -135,24 +135,24 @@ export const OIDCProvider = Resource(
           const getRole = await client.send(
             new GetRoleCommand({
               RoleName: props.roleArn.split("/").pop(),
-            }),
+            })
           );
 
           if (getRole.Role?.AssumeRolePolicyDocument) {
             const policy = JSON.parse(
-              decodeURIComponent(getRole.Role.AssumeRolePolicyDocument),
+              decodeURIComponent(getRole.Role.AssumeRolePolicyDocument)
             );
 
             // Remove our specific statement while preserving others
             policy.Statement = policy.Statement.filter(
-              (stmt: any) => stmt.Sid !== TRUST_POLICY_SID,
+              (stmt: any) => stmt.Sid !== TRUST_POLICY_SID
             );
 
             await client.send(
               new UpdateAssumeRolePolicyCommand({
                 RoleName: props.roleArn.split("/").pop(),
                 PolicyDocument: JSON.stringify(policy),
-              }),
+              })
             );
           }
 
@@ -160,7 +160,7 @@ export const OIDCProvider = Resource(
           const provider = await client.send(
             new GetOpenIDConnectProviderCommand({
               OpenIDConnectProviderArn: this.output.providerArn,
-            }),
+            })
           );
 
           // Only delete the provider if it exists and has no other tags
@@ -168,7 +168,7 @@ export const OIDCProvider = Resource(
             await client.send(
               new DeleteOpenIDConnectProviderCommand({
                 OpenIDConnectProviderArn: this.output.providerArn,
-              }),
+              })
             );
           }
         } catch (error) {
@@ -197,13 +197,13 @@ export const OIDCProvider = Resource(
                 Value: "alchemy",
               },
             ] as Tag[],
-          }),
+          })
         );
         providerArn = createProvider.OpenIDConnectProviderArn!;
       } catch (error: any) {
         if (error.name === "EntityAlreadyExistsException") {
           // Provider exists, use its ARN
-          providerArn = `arn:aws:iam::${await getAccountId()}:oidc-provider/${url}`;
+          providerArn = `arn:aws:iam::${await AccountId()}:oidc-provider/${url}`;
         } else {
           throw error;
         }
@@ -213,13 +213,13 @@ export const OIDCProvider = Resource(
       const getRole = await client.send(
         new GetRoleCommand({
           RoleName: props.roleArn.split("/").pop(),
-        }),
+        })
       );
 
       let policy: any;
       if (getRole.Role?.AssumeRolePolicyDocument) {
         policy = JSON.parse(
-          decodeURIComponent(getRole.Role.AssumeRolePolicyDocument),
+          decodeURIComponent(getRole.Role.AssumeRolePolicyDocument)
         );
       } else {
         policy = {
@@ -240,7 +240,7 @@ export const OIDCProvider = Resource(
         conditions.StringEquals["token.actions.githubusercontent.com:sub"] =
           props.branches.map(
             (branch) =>
-              `repo:${props.owner}/${props.repository}:ref:refs/heads/${branch}`,
+              `repo:${props.owner}/${props.repository}:ref:refs/heads/${branch}`
           );
       }
 
@@ -248,7 +248,7 @@ export const OIDCProvider = Resource(
         conditions.StringEquals["token.actions.githubusercontent.com:sub"] =
           props.environments.map(
             (env) =>
-              `repo:${props.owner}/${props.repository}:environment:${env}`,
+              `repo:${props.owner}/${props.repository}:environment:${env}`
           );
       }
 
@@ -266,7 +266,7 @@ export const OIDCProvider = Resource(
       // Remove any existing statement with our SID and add the new one
       policy.Statement = [
         ...policy.Statement.filter(
-          (stmt: any) => stmt.Sid !== TRUST_POLICY_SID,
+          (stmt: any) => stmt.Sid !== TRUST_POLICY_SID
         ),
         ourStatement,
       ];
@@ -276,7 +276,7 @@ export const OIDCProvider = Resource(
         new UpdateAssumeRolePolicyCommand({
           RoleName: props.roleArn.split("/").pop(),
           PolicyDocument: JSON.stringify(policy),
-        }),
+        })
       );
 
       return this({
@@ -288,5 +288,5 @@ export const OIDCProvider = Resource(
       console.error("Error configuring OIDC provider:", error);
       throw error;
     }
-  },
+  }
 );

package/src/aws/role.ts

@@ -219,58 +219,72 @@ export const Role = Resource(
   async function (
     this: Context<Role>,
     id: string,
-    props: RoleProps,
+    props: RoleProps
   ): Promise<Role> {
     const client = new IAMClient({});
 
     if (this.phase === "delete") {
-      // Delete any inline policies first
-      if (props.policies) {
-        for (const policy of props.policies) {
-          await ignore(NoSuchEntityException.name, () =>
-            client.send(
-              new DeleteRolePolicyCommand({
-                RoleName: props.roleName,
-                PolicyName: policy.policyName,
-              }),
-            ),
-          );
-        }
-      }
-
-      // We need to detach managed policies before deleting the role
-      // First, get all attached policies
       try {
-        const attachedPoliciesResponse = await client.send(
-          new ListAttachedRolePoliciesCommand({
-            RoleName: props.roleName,
-          }),
-        );
+        // Delete any inline policies first
+        if (props.policies) {
+          for (const policy of props.policies) {
+            await ignore(NoSuchEntityException.name, () =>
+              client.send(
+                new DeleteRolePolicyCommand({
+                  RoleName: props.roleName,
+                  PolicyName: policy.policyName,
+                })
+              )
+            );
+          }
+        }
 
-        // Detach all managed policies
-        const attachedPolicies =
-          attachedPoliciesResponse.AttachedPolicies || [];
-        for (const policy of attachedPolicies) {
-          await client.send(
-            new DetachRolePolicyCommand({
+        // We need to detach managed policies before deleting the role
+        // First, get all attached policies
+        try {
+          const attachedPoliciesResponse = await client.send(
+            new ListAttachedRolePoliciesCommand({
               RoleName: props.roleName,
-              PolicyArn: policy.PolicyArn!,
-            }),
+            })
           );
+
+          // Detach all managed policies
+          const attachedPolicies =
+            attachedPoliciesResponse.AttachedPolicies || [];
+          for (const policy of attachedPolicies) {
+            await ignore(NoSuchEntityException.name, () =>
+              client.send(
+                new DetachRolePolicyCommand({
+                  RoleName: props.roleName,
+                  PolicyArn: policy.PolicyArn!,
+                })
+              )
+            );
+          }
+        } catch (error: any) {
+          if (error.name !== NoSuchEntityException.name) {
+            throw error;
+          }
+          // Role doesn't exist, no need to continue with detaching policies
         }
+
+        // Try to delete the role, ignoring if it doesn't exist
+        await ignore(NoSuchEntityException.name, () =>
+          client.send(
+            new DeleteRoleCommand({
+              RoleName: props.roleName,
+            })
+          )
+        );
       } catch (error: any) {
+        // If we get any other error besides NoSuchEntityException, log it but don't fail
+        // This ensures the resource is still marked as destroyed
         if (error.name !== NoSuchEntityException.name) {
-          throw error;
+          console.error(`Error deleting role ${props.roleName}:`, error);
         }
       }
 
-      await ignore(NoSuchEntityException.name, () =>
-        client.send(
-          new DeleteRoleCommand({
-            RoleName: props.roleName,
-          }),
-        ),
-      );
+      // Always return destroyed state regardless of any errors
       return this.destroy();
     }
 
@@ -302,7 +316,7 @@ export const Role = Resource(
                 Value: this.id,
               },
             ],
-          }),
+          })
         );
       }
     } catch (error: any) {
@@ -314,7 +328,7 @@ export const Role = Resource(
         const existingRole = await client.send(
           new GetRoleCommand({
             RoleName: props.roleName,
-          }),
+          })
         );
         const roleTags =
           existingRole.Role?.Tags?.reduce(
@@ -322,7 +336,7 @@ export const Role = Resource(
               acc[tag.Key!] = tag.Value!;
               return acc;
             },
-            {} as Record<string, string>,
+            {} as Record<string, string>
           ) || {};
 
         if (
@@ -340,7 +354,7 @@ export const Role = Resource(
     role = await client.send(
       new GetRoleCommand({
         RoleName: props.roleName,
-      }),
+      })
     );
 
     // Update assume role policy if it changed
@@ -349,7 +363,7 @@ export const Role = Resource(
         new UpdateAssumeRolePolicyCommand({
           RoleName: props.roleName,
           PolicyDocument: assumeRolePolicyDocument,
-        }),
+        })
       );
     }
 
@@ -363,7 +377,7 @@ export const Role = Resource(
           RoleName: props.roleName,
           Description: props.description,
           MaxSessionDuration: props.maxSessionDuration,
-        }),
+        })
       );
     }
 
@@ -381,7 +395,7 @@ export const Role = Resource(
       new TagRoleCommand({
         RoleName: props.roleName,
         Tags: tags,
-      }),
+      })
     );
 
     // Handle policy changes
@@ -393,7 +407,7 @@ export const Role = Resource(
     for (const oldPolicy of previousPolicies) {
       if (
         !currentPolicies.some(
-          (p: { policyName: string }) => p.policyName === oldPolicy.policyName,
+          (p: { policyName: string }) => p.policyName === oldPolicy.policyName
         )
       ) {
         await ignore(NoSuchEntityException.name, () =>
@@ -401,8 +415,8 @@ export const Role = Resource(
             new DeleteRolePolicyCommand({
               RoleName: props.roleName,
               PolicyName: oldPolicy.policyName,
-            }),
-          ),
+            })
+          )
         );
       }
     }
@@ -410,7 +424,7 @@ export const Role = Resource(
     // Update or create policies
     for (const policy of currentPolicies) {
       const oldPolicy = previousPolicies.find(
-        (p) => p.policyName === policy.policyName,
+        (p) => p.policyName === policy.policyName
       );
       if (
         !oldPolicy ||
@@ -422,7 +436,7 @@ export const Role = Resource(
             RoleName: props.roleName,
             PolicyName: policy.policyName,
             PolicyDocument: JSON.stringify(policy.policyDocument),
-          }),
+          })
         );
       }
     }
@@ -432,7 +446,7 @@ export const Role = Resource(
     const attachedPoliciesResponse = await client.send(
       new ListAttachedRolePoliciesCommand({
         RoleName: props.roleName,
-      }),
+      })
     );
 
     const currentAttachedPolicies =
@@ -450,7 +464,7 @@ export const Role = Resource(
           new DetachRolePolicyCommand({
             RoleName: props.roleName,
             PolicyArn: policyArn,
-          }),
+          })
         );
       }
     }
@@ -462,7 +476,7 @@ export const Role = Resource(
           new AttachRolePolicyCommand({
             RoleName: props.roleName,
             PolicyArn: policyArn,
-          }),
+          })
         );
       }
     }
@@ -479,5 +493,5 @@ export const Role = Resource(
       roleName: role.Role.RoleName ?? props.roleName,
       createDate: role.Role.CreateDate!,
     });
-  },
+  }
 );