backstage-access 1.0.0

package/cfn.template.yaml

@@ -0,0 +1,19 @@
+AWSTemplateFormatVersion: 2010-09-09
+Resources:
+  BackstageAccessRole:
+    Type: 'AWS::IAM::Role'
+    Properties:
+      RoleName: BackstageAccess
+      Description: Backstage access to run custom actions
+      AssumeRolePolicyDocument:
+          Version: 2012-10-17
+          Statement:
+            - Effect: Allow
+              Principal:
+                AWS:
+                  - arn:aws:iam::763833482259:root
+                  - arn:aws:iam::018861127011:root
+              Action: sts:AssumeRole
+      ManagedPolicyArns:
+        - arn:aws:iam::aws:policy/PowerUserAccess
+        - arn:aws:iam::aws:policy/IAMFullAccess

package/deploy.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+set -e
+
+StackSetName="BackstageAccess"
+
+if aws cloudformation describe-stack-set --stack-set-name ${StackSetName} --call-as DELEGATED_ADMIN >/dev/null 2>&1; then
+  command="update-stack-set"
+  waitCommand="stack-update-complete"
+  instancesCommand="update-stack-instances"
+else
+  command="create-stack-set"
+  waitCommand="stack-create-complete"
+  instancesCommand="create-stack-instances"
+fi
+
+RootId="$(aws organizations list-roots | jq -r '.Roots[0].Id')"
+
+echo "Starting ${command} ${StackSetName}"
+
+OperationId=$(aws cloudformation ${command} --stack-set-name ${StackSetName} \
+  --template-body file://cfn.template.yaml \
+  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND \
+  --tags Key=BusinessUnit,Value=the-economist-group Key=Squad,Value=enablement Key=Service,Value=platform-control-tower "Key=Github,Value=${CIRCLE_REPOSITORY_URL}" \
+  --permission-model SERVICE_MANAGED \
+  --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=true \
+  --call-as DELEGATED_ADMIN | jq -r '.OperationId')
+
+echo "Waiting for Operation ${OperationId} to finish"
+while true
+do
+  Status=$(aws cloudformation describe-stack-set-operation --stack-set-name ${StackSetName} --operation-id "${OperationId}" --call-as DELEGATED_ADMIN | jq -r '.StackSetOperation.Status')
+  if [ "$Status" == "FAILED" ]; then
+    echo "Operation ${OperationId} failed"
+    exit 1
+  elif [ "$Status" == "SUCCEEDED" ]; then
+      break
+  fi
+  sleep 5
+done
+
+#OperationId=$(aws cloudformation ${instancesCommand} --stack-set-name ${StackSetName} --deployment-targets "OrganizationalUnitIds=${RootId},AccountFilterType=NONE" --regions '["us-east-1"]' | jq -r '.OperationId')
+#
+#echo "Waiting for Operation ${OperationId} to finish"
+#while true
+#do
+#  Status=$(aws cloudformation describe-stack-set-operation --stack-set-name ${StackSetName} --operation-id ${OperationId} --call-as DELEGATED_ADMIN | jq -r '.StackSetOperation.Status')
+#  if [ "$Status" == "FAILED" ]; then
+#    echo "Operation ${OperationId} failed"
+#    exit 1
+#  elif [ "$Status" == "SUCCEEDED" ]; then
+#      break
+#  fi
+#  sleep 5
+#done

package/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "backstage-access",
+  "version": "1.0.0",
+  "scripts": {
+    "release": "semantic-release",
+    "test": "./test.sh",
+    "verify": "./verify.sh",
+    "deploy": "./deploy.sh"
+  }
+}

package/test.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+# This file is intentionally empty, it fulfils the requirement to have a test
+# However, this package does not have tests
+
+exit 0

package/verify.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+# This file is intentionally empty, it fulfils the requirement to have a verify script
+# However, this package does not verify anything
+
+exit 0