cloudmason 1.0.11 → 1.0.12

package/commands/helpers/cf.js

@@ -61,6 +61,28 @@ exports.deployS3Stack = async function(stackName,s3Url,params,tag,region){
     return result.StackId;
 }
 
+exports.updateOrgStack = async function(region,params){
+    const client = new CloudFormationClient({ region });
+    const cfParams = Object.keys(params).map(k=>{ return { ParameterKey: k, ParameterValue: params[k] } })
+    
+    const stackPath = path.resolve(__dirname,'stacks',`infra.yaml`);
+    if (!fs.existsSync(stackPath)){
+        console.log('Infra Stack not found');
+        throw { message: 'Infra stack not found', at: 'deployStack'}
+    }
+    const stackYML = fs.readFileSync(stackPath,'utf-8');
+    
+    const cmd = {
+        StackName: 'CoreInfra',
+        TemplateBody: stackYML,
+        Parameters: cfParams,
+        Capabilities: ["CAPABILITY_IAM", "CAPABILITY_NAMED_IAM"]
+    };
+    const command = new UpdateStackCommand(cmd);
+    const response = await client.send(command);
+    return response.StackId;
+}
+
 exports.updateStack = async function(stackName,s3Url,params,region){
     const client = new CloudFormationClient({ region });
     const cfParams = Object.keys(params).map(k=>{ return { ParameterKey: k, ParameterValue: params[k] } })

package/commands/helpers/stacks/infra.yaml

@@ -117,6 +117,8 @@ Resources:
             Action: "sts:AssumeRoleWithWebIdentity"
             Condition:
               StringEquals:
+                "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
+              StringLike:
                 "token.actions.githubusercontent.com:sub": !Sub "repo:${GitHubRepoName}:*"
       Policies:
         - PolicyName: "GitHubActionsPolicy"
@@ -126,8 +128,11 @@ Resources:
               - Effect: "Allow"
                 Action: "*"
                 Resource: "*"
-
-Outputs:
-  GithubRoleArn:
-    Description: "ARN of the GitHub Actions IAM Role"
-    Value: !GetAtt GitHubActionsRole.Arn
+  GitHubOidcProvider:
+    Type: 'AWS::IAM::OIDCProvider'
+    Properties:
+      Url: 'https://token.actions.githubusercontent.com'
+      ClientIdList:
+        - 'sts.amazonaws.com'
+      ThumbprintList:
+        - '6938fd4d98bab03faadb97b34396831e3780aea1'

package/commands/init_org.js

@@ -28,6 +28,25 @@ exports.main = async function(args){
     return true;
 }
 
+exports.updateOrgStack = async function(args){
+    console.log(`Updating ${args.name}@ in ${args.region} with repo ${args.repo}`)
+
+    // Get VPC ID
+    const VpcId = await getDefaultVPC(args.region);
+    console.log(`Default VPC: ${VpcId}`);
+    
+    // Deploy Stack
+    const success = await CF.updateOrgStack(args.region, {orgName: args.name, VpcId: VpcId, GitHubRepoName: args.repo})
+    if (success === false){
+        console.log('ERR:', success);
+        throw new Error('Unknown error updating org stack')
+    }
+
+    // Set org.txt
+    console.log('Updated org')
+    return true;
+}
+
 exports.setOrg = async function(args){
     // Set org.txt
     const orgPath = path.resolve(__dirname,'..','org.txt');

package/commands/update_app.js

@@ -37,11 +37,18 @@ exports.main = async function(args){
     // --- II UPDATE STACK ---
     // If stack arg, upload stack
     const stackKey = `apps/${args.app}/${args.v}/stack.yaml`;
-    // If no stack arg, upload default stack if none exists
-    const stackExists = await S3.infraFileExists(stackKey)
-    if (!stackExists){
-        console.log('Copying default stack to ' +  `apps/${args.app}/${args.v}`);
-        await S3.copyInfraFile(app.stackKey,stackKey)
+    if (args.stack){
+        console.log('Updating Stack');
+        const stackPath = path.resolve(args.stack);
+        if (!fs.existsSync(stackPath)){ throw new Error("Stack not found:" + stackPath)}
+        await S3.uploadInfraFile(stackKey,stackPath);
+    } else {   
+        // If no stack arg, upload default stack if none exists
+        const stackExists = await S3.infraFileExists(stackKey)
+        if (!stackExists){
+            console.log('Copying default stack to ' +  `apps/${args.app}/${args.v}`);
+            await S3.copyInfraFile(app.stackKey,stackKey)
+        }
     }
 
     // --- III BUILD IMAGE ---

package/commands/update_stack.js

@@ -10,10 +10,10 @@ exports.main = async function(args){
         console.log('Err: No app named ' + args.app);
         throw new Error('Err: No app named ' + args.app)
     }
-    if (args.default ===  undefined && !app.versions[args.v]){
-        console.log('Err: No app version ' + args.app + ' ' + args.v);
-        throw new Error('Err: No app version ' + args.app + ' ' + args.v)
-    }
+    // if (args.default ===  undefined && !app.versions[args.v]){
+    //     console.log('Err: No app version ' + args.app + ' ' + args.v);
+    //     throw new Error('Err: No app version ' + args.app + ' ' + args.v)
+    // }
     if (args.default === null && args.v){
         console.log('Err: Cannot set default and specify version');
         throw new Error('Err: Cannot set default version and specify version')

package/main.js

@@ -15,6 +15,15 @@ const Commands = {
             {n: 'repo', desc: 'Github repo name', r: false}
         ]
     },
+    'update-org': {
+        desc: "Update org stack",
+        exec: require('./commands/init_org').updateOrgStack,
+        args: [
+            {n: 'name', desc: 'Unique org Name. Letters only', r: true, pattern: `[A-Za-z]{2,20}`},
+            {n: 'region', desc: 'AWS Region for Core Assets. Default us-east-1', r: false},
+            {n: 'repo', desc: 'Github repo name', r: false}
+        ]
+    },
     'set-org': {
         desc: "Set an exsiting organization",
         exec: require('./commands/init_org').setOrg,

package/package.json

@@ -1 +1 @@
-{"name":"cloudmason","version":"1.0.11","description":"","main":"main.js","scripts":{"build":"node build.js"},"bin":{"mason":"./main.js"},"repository":{"type":"git","url":"https://github.com/kai-harvey/secure-saas.git"},"author":"Kai Harvey","license":"ISC","dependencies":{"@aws-sdk/client-acm":"^3.418.0","@aws-sdk/client-auto-scaling":"^3.470.0","@aws-sdk/client-cloudformation":"^3.418.0","@aws-sdk/client-ec2":"^3.416.0","@aws-sdk/client-iam":"^3.418.0","@aws-sdk/client-route-53":"^3.425.0","@aws-sdk/client-s3":"^3.418.0","@aws-sdk/client-ssm":"^3.421.0","adm-zip":"^0.5.10"}}
+{"name":"cloudmason","version":"1.0.12","description":"","main":"main.js","scripts":{"build":"node build.js"},"bin":{"mason":"./main.js"},"repository":{"type":"git","url":"https://github.com/kai-harvey/secure-saas.git"},"author":"Kai Harvey","license":"ISC","dependencies":{"@aws-sdk/client-acm":"^3.418.0","@aws-sdk/client-auto-scaling":"^3.470.0","@aws-sdk/client-cloudformation":"^3.418.0","@aws-sdk/client-ec2":"^3.416.0","@aws-sdk/client-iam":"^3.418.0","@aws-sdk/client-route-53":"^3.425.0","@aws-sdk/client-s3":"^3.418.0","@aws-sdk/client-ssm":"^3.421.0","adm-zip":"^0.5.10"}}