cloudmason2 1.0.0

package/.marketplace/AdditionalResources.json

@@ -0,0 +1 @@
+[]

package/README.md

@@ -0,0 +1,5 @@
+# cloudmason2
+
+
+
+CI/CD Tool for AWS Marketplace Deployments

package/commands/app_details.js

@@ -0,0 +1,108 @@
+const { CloudFormationClient, DescribeStacksCommand } = require('@aws-sdk/client-cloudformation');
+const { EC2Client, DescribeRegionsCommand } = require('@aws-sdk/client-ec2');
+const { S3Client } = require("@aws-sdk/client-s3");
+const OrgConfig = require('./helpers/org_config');
+const Apps = require('./helpers/apps');
+
+// app-details: print the manifest and every launched stack across all regions
+exports.main = async function(args){
+    const cfg = OrgConfig.read();
+    if (!cfg){ throw new Error('No org config found. Run set-org') }
+    const { bucket, prefix } = parseCdn(cfg.cdn);
+    const s3 = new S3Client({ region: cfg.region });
+
+    const appName = args.app.toLowerCase();
+
+    const app = await Apps.resolveApp(s3, bucket, prefix, appName);
+    if (!app){ throw new Error('No app named ' + args.app + '. Run new-app') }
+    const manifest = app.manifest;
+
+    // --- I MANIFEST ---
+    printManifest(manifest);
+
+    // --- II STACKS ---
+    // Stacks are found by the mason=<app> tag applied on launch, in every region
+    console.log('\nSTACKS');
+    console.log('-'.repeat(50));
+    const ec2 = new EC2Client({ region: cfg.region });
+    const regionResp = await ec2.send(new DescribeRegionsCommand({}));
+    const regions = regionResp.Regions.map(r=>{ return r.RegionName }).sort();
+
+    const results = await Promise.all(regions.map(region=>{
+        return appStacks(appName, region).catch(e=>{
+            console.log(`${region}: ERR ${e.message}`);
+            return [];
+        });
+    }));
+
+    let found = 0;
+    regions.forEach((region, i)=>{
+        results[i].forEach(s=>{
+            found++;
+            console.log(`${region.padEnd(16)} ${s.name.padEnd(30)} v${(s.version || '?').padEnd(22)} ${s.status}`);
+        });
+    });
+    if (found === 0){ console.log('No stacks found') }
+    return true;
+}
+
+
+/////////////////////////////////////////
+////////////// FUNCS ////////////////////
+////////////////////////////////////////
+
+function parseCdn(cdn){
+    const p = cdn.trim().replace(/^s3:\/\//i, '').replace(/\/+$/, '');
+    const parts = p.split('/');
+    return { bucket: parts[0], prefix: parts.slice(1).join('/') };
+}
+
+function printManifest(m){
+    console.log('='.repeat(50));
+    console.log(m.name);
+    console.log('='.repeat(50));
+    Object.keys(m).forEach(k=>{
+        if (k === 'versions' || k === 'name'){ return }
+        let v = m[k];
+        if (v && typeof v === 'object'){ v = JSON.stringify(v) }
+        v = String(v ?? '').replace(/\s+/g, ' ').trim();
+        if (v.length > 70){ v = v.slice(0, 67) + '...' }
+        console.log(`${k.padEnd(26)} ${v || '-'}`);
+    });
+
+    console.log('\nVERSIONS');
+    console.log('-'.repeat(50));
+    if (!m.versions || m.versions.length === 0){
+        console.log('No versions. Run update-app');
+        return;
+    }
+    m.versions.forEach(v=>{
+        const published = v.published ? `published ${v.publish_date || ''}`.trim() : 'unpublished';
+        console.log(`${v.version.padEnd(24)} ${(v.ami_id || 'no-ami').padEnd(24)} ${published}`);
+        console.log(`${''.padEnd(24)} updated ${v.updated_on}`);
+    });
+}
+
+// All stacks in a region tagged mason=<app> on launch
+async function appStacks(appName, region){
+    const client = new CloudFormationClient({ region });
+    const stacks = [];
+    let token;
+    do {
+        const r = await client.send(new DescribeStacksCommand({ NextToken: token }));
+        (r.Stacks || []).forEach(s=>{
+            const tags = s.Tags || [];
+            const isApp = tags.some(t=>{ return t.Key === 'mason' && t.Value === appName });
+            if (!isApp){ return }
+            const versionTag = tags.find(t=>{ return t.Key === 'version' });
+            stacks.push({
+                name: s.StackName,
+                status: s.StackStatus,
+                version: versionTag ? versionTag.Value : null
+            });
+        });
+        token = r.NextToken;
+    } while (token);
+    return stacks;
+}
+

package/commands/create_cdn.js

@@ -0,0 +1,130 @@
+const { S3Client, CreateBucketCommand, HeadBucketCommand, PutBucketPolicyCommand, PutPublicAccessBlockCommand } = require("@aws-sdk/client-s3");
+const { IAMClient, GetRoleCommand, CreateRoleCommand, AttachRolePolicyCommand, PutRolePolicyCommand } = require("@aws-sdk/client-iam");
+const { SSMClient, PutParameterCommand } = require("@aws-sdk/client-ssm");
+
+// All CDN resources are created in us-east-1
+const REGION = 'us-east-1';
+
+exports.main = async function(args){
+    const bucket = args.name;
+    const s3 = new S3Client({ region: REGION });
+
+    // --- I CREATE BUCKET ---
+    const exists = await bucketExists(s3, bucket);
+    if (exists){ throw new Error(`Bucket ${bucket} already exists`) }
+    await s3.send(new CreateBucketCommand({ Bucket: bucket }));
+    console.log(`Created bucket ${bucket} in ${REGION}`);
+
+    // --- II PUBLIC ACCESS POLICY ---
+    // New buckets block public policies by default; allow them (ACLs stay blocked)
+    await s3.send(new PutPublicAccessBlockCommand({
+        Bucket: bucket,
+        PublicAccessBlockConfiguration: {
+            BlockPublicAcls: true,
+            IgnorePublicAcls: true,
+            BlockPublicPolicy: false,
+            RestrictPublicBuckets: false
+        }
+    }));
+    // Everything is publicly readable except files beginning with "_", at any depth
+    const policy = {
+        Version: "2012-10-17",
+        Statement: [
+            {
+                Sid: "PublicReadExceptUnderscore",
+                Effect: "Allow",
+                Principal: "*",
+                Action: "s3:GetObject",
+                NotResource: [
+                    `arn:aws:s3:::${bucket}/_*`,
+                    `arn:aws:s3:::${bucket}/*/_*`
+                ]
+            }
+        ]
+    };
+    await s3.send(new PutBucketPolicyCommand({ Bucket: bucket, Policy: JSON.stringify(policy) }));
+    console.log('Set public access policy (keys starting with "_" are private)');
+
+    // --- III MARKETPLACE ROLE ---
+    const roleArn = await createMarketplaceRole(bucket);
+    const ssm = new SSMClient({ region: REGION });
+    await ssm.send(new PutParameterCommand({
+        Name: `mason-cdn-${bucket}`,
+        Value: roleArn,
+        Type: 'String',
+        Overwrite: true
+    }));
+    console.log(`Saved marketplace role to SSM parameter mason-cdn-${bucket}`);
+    return true;
+}
+
+
+/////////////////////////////////////////
+////////////// FUNCS ////////////////////
+////////////////////////////////////////
+
+async function bucketExists(s3, bucket){
+    try {
+        await s3.send(new HeadBucketCommand({ Bucket: bucket }));
+        return true;
+    } catch (e){
+        if (/NotFound|NoSuchBucket/.test(e)){ return false }
+        if (/Forbidden|403/.test(e)){ return true } // exists in another account
+        throw e;
+    }
+}
+
+async function createMarketplaceRole(bucket){
+    const roleName = `mason-cdn-${bucket}`;
+    const iam = new IAMClient({ region: REGION });
+
+    try {
+        const existing = await iam.send(new GetRoleCommand({ RoleName: roleName }));
+        console.log(`Role ${roleName} already exists`);
+        return existing.Role.Arn;
+    } catch (e){
+        if (!/NoSuchEntity/.test(e)){ throw e }
+    }
+
+    const trustPolicy = {
+        Version: "2012-10-17",
+        Statement: [
+            {
+                Effect: "Allow",
+                Principal: { Service: "assets.marketplace.amazonaws.com" },
+                Action: "sts:AssumeRole"
+            }
+        ]
+    };
+    const created = await iam.send(new CreateRoleCommand({
+        RoleName: roleName,
+        AssumeRolePolicyDocument: JSON.stringify(trustPolicy),
+        Description: 'Allows AWS Marketplace to access AMIs and the CDN bucket'
+    }));
+
+    // AMI ingestion permissions
+    await iam.send(new AttachRolePolicyCommand({
+        RoleName: roleName,
+        PolicyArn: 'arn:aws:iam::aws:policy/AWSMarketplaceAmiIngestion'
+    }));
+
+    // Full read access to the CDN bucket, including private "_" keys
+    const cdnPolicy = {
+        Version: "2012-10-17",
+        Statement: [
+            {
+                Effect: "Allow",
+                Action: ["s3:GetObject", "s3:ListBucket"],
+                Resource: [`arn:aws:s3:::${bucket}`, `arn:aws:s3:::${bucket}/*`]
+            }
+        ]
+    };
+    await iam.send(new PutRolePolicyCommand({
+        RoleName: roleName,
+        PolicyName: 'mason-cdn-access',
+        PolicyDocument: JSON.stringify(cdnPolicy)
+    }));
+
+    console.log(`Created role ${roleName} (${created.Role.Arn})`);
+    return created.Role.Arn;
+}

package/commands/delete.js

@@ -0,0 +1,194 @@
+const { CloudFormationClient, DescribeStacksCommand, DeleteStackCommand } = require('@aws-sdk/client-cloudformation');
+const { EC2Client, DescribeRegionsCommand, DescribeImagesCommand, DeregisterImageCommand, DeleteSnapshotCommand } = require('@aws-sdk/client-ec2');
+const { S3Client, ListObjectsV2Command, DeleteObjectsCommand } = require('@aws-sdk/client-s3');
+const { IAMClient, DeleteRoleCommand, DeleteRolePolicyCommand, ListRolePoliciesCommand, ListAttachedRolePoliciesCommand, DetachRolePolicyCommand } = require('@aws-sdk/client-iam');
+const OrgConfig = require('./helpers/org_config');
+const Apps = require('./helpers/apps');
+
+// delete-instance: roll back (delete) the stack of the specified instance
+exports.delete_instance = async function(args){
+    const cfg = OrgConfig.read();
+    if (!cfg){ throw new Error('No org config found. Run set-org') }
+
+    const appName = args.app.toLowerCase();
+    const stackName = `${appName}-${args.title}`;
+
+    // Find the stack - in the given region, or by searching all regions
+    let regions;
+    if (args.region){
+        regions = [args.region];
+    } else {
+        const ec2 = new EC2Client({ region: cfg.region });
+        const r = await ec2.send(new DescribeRegionsCommand({}));
+        regions = r.Regions.map(rg=>{ return rg.RegionName });
+    }
+
+    const found = [];
+    await Promise.all(regions.map(region=>{
+        return findStack(stackName, appName, region).then(s=>{
+            if (s){ found.push({ region: region, status: s.status }) }
+        }).catch(e=>{ console.log(`${region}: ERR ${e.message}`) });
+    }));
+
+    if (found.length === 0){
+        throw new Error(`No stack named ${stackName} found`);
+    }
+    if (found.length > 1){
+        found.forEach(f=>{ console.log(`  ${f.region}  ${stackName}  ${f.status}`) });
+        throw new Error(`Stack ${stackName} exists in multiple regions. Pass -region`);
+    }
+
+    const target = found[0];
+    const client = new CloudFormationClient({ region: target.region });
+    await client.send(new DeleteStackCommand({ StackName: stackName }));
+    console.log(`Rolling back stack ${stackName} in ${target.region}`);
+    return true;
+}
+
+// delete-app: remove the app's s3 folder, all its AMIs in every region,
+// and its IAM role. Refuses while launched instance stacks still exist.
+// The CDN role/param and the OIDC provider are shared and are not touched
+exports.delete_app = async function(args){
+    const cfg = OrgConfig.read();
+    if (!cfg){ throw new Error('No org config found. Run set-org') }
+    const { bucket, prefix } = parseCdn(cfg.cdn);
+    const s3 = new S3Client({ region: cfg.region });
+
+    const appName = args.app.toLowerCase();
+
+    const app = await Apps.resolveApp(s3, bucket, prefix, appName);
+    if (!app){ throw new Error('No app named ' + args.app) }
+    const appPrefix = app.appPrefix;
+
+    const ec2 = new EC2Client({ region: cfg.region });
+    const regionResp = await ec2.send(new DescribeRegionsCommand({}));
+    const regions = regionResp.Regions.map(r=>{ return r.RegionName });
+
+    // --- I REFUSE IF INSTANCES STILL EXIST ---
+    const live = [];
+    await Promise.all(regions.map(region=>{
+        return regionStacks(appName, region).then(list=>{
+            list.forEach(s=>{ live.push(`${region}  ${s.name}  ${s.status}`) });
+        }).catch(e=>{ console.log(`${region}: ERR ${e.message}`) });
+    }));
+    if (live.length){
+        live.forEach(l=>{ console.log('  ' + l) });
+        throw new Error(`${live.length} instance stack(s) still exist. Run delete-instance first`);
+    }
+
+    // --- II DELETE S3 APP FOLDER ---
+    const deleted = await deleteFolder(s3, bucket, `${appPrefix}/`);
+    console.log(`Deleted ${deleted} objects from s3://${bucket}/${appPrefix}/`);
+
+    // --- III DELETE AMIS IN ALL REGIONS ---
+    for (const region of regions){
+        try {
+            await deleteAppAmis(appName, region);
+        } catch (e){
+            console.log(`AMI cleanup failed in ${region}: ${e.message}`);
+        }
+    }
+
+    // --- IV DELETE IAM ROLE ---
+    await deleteGithubRole(appName);
+
+    console.log(`Deleted app ${args.app}`);
+    return true;
+}
+
+
+/////////////////////////////////////////
+////////////// FUNCS ////////////////////
+////////////////////////////////////////
+
+function parseCdn(cdn){
+    const p = cdn.trim().replace(/^s3:\/\//i, '').replace(/\/+$/, '');
+    const parts = p.split('/');
+    return { bucket: parts[0], prefix: parts.slice(1).join('/') };
+}
+
+// All stacks in a region tagged mason=<app> on launch
+async function regionStacks(appName, region){
+    const client = new CloudFormationClient({ region });
+    const stacks = [];
+    let token;
+    do {
+        const r = await client.send(new DescribeStacksCommand({ NextToken: token }));
+        (r.Stacks || []).forEach(s=>{
+            const isApp = (s.Tags || []).some(t=>{ return t.Key === 'mason' && t.Value === appName });
+            if (isApp){ stacks.push({ name: s.StackName, status: s.StackStatus }) }
+        });
+        token = r.NextToken;
+    } while (token);
+    return stacks;
+}
+
+// Delete every object under the prefix, in batches
+async function deleteFolder(s3, bucket, prefix){
+    let count = 0;
+    let truncated = true;
+    while (truncated){
+        const r = await s3.send(new ListObjectsV2Command({ Bucket: bucket, Prefix: prefix }));
+        const keys = (r.Contents || []).map(o=>{ return { Key: o.Key } });
+        if (keys.length === 0){ break }
+        await s3.send(new DeleteObjectsCommand({ Bucket: bucket, Delete: { Objects: keys } }));
+        count += keys.length;
+        truncated = r.IsTruncated;
+    }
+    return count;
+}
+
+// Deregister every build of the app in the region, along with its snapshots
+async function deleteAppAmis(appName, region){
+    const client = new EC2Client({ region });
+    const r = await client.send(new DescribeImagesCommand({
+        Owners: ['self'],
+        Filters: [{ Name: 'name', Values: [`${appName}-v*`] }]
+    }));
+    for (const img of (r.Images || [])){
+        console.log(`Deleting AMI ${img.Name} (${img.ImageId}) in ${region}`);
+        await client.send(new DeregisterImageCommand({ ImageId: img.ImageId }));
+        for (const bdm of (img.BlockDeviceMappings || [])){
+            if (bdm.Ebs && bdm.Ebs.SnapshotId){
+                await client.send(new DeleteSnapshotCommand({ SnapshotId: bdm.Ebs.SnapshotId }));
+            }
+        }
+    }
+}
+
+// Delete the app's GitHub Actions role: inline policies, attachments, then the role
+async function deleteGithubRole(appName){
+    const roleName = `mason-gha-${appName}`;
+    const iam = new IAMClient({ region: 'us-east-1' });
+    try {
+        const inline = await iam.send(new ListRolePoliciesCommand({ RoleName: roleName }));
+        for (const p of (inline.PolicyNames || [])){
+            await iam.send(new DeleteRolePolicyCommand({ RoleName: roleName, PolicyName: p }));
+        }
+        const attached = await iam.send(new ListAttachedRolePoliciesCommand({ RoleName: roleName }));
+        for (const p of (attached.AttachedPolicies || [])){
+            await iam.send(new DetachRolePolicyCommand({ RoleName: roleName, PolicyArn: p.PolicyArn }));
+        }
+        await iam.send(new DeleteRoleCommand({ RoleName: roleName }));
+        console.log(`Deleted role ${roleName}`);
+    } catch (e){
+        if (/NoSuchEntity/.test(e)){ console.log(`No role ${roleName} to delete`); return }
+        throw e;
+    }
+}
+
+// Returns the stack only if it carries the mason=<app> tag set on launch,
+// so an unrelated stack with a matching name can never be deleted
+async function findStack(stackName, appName, region){
+    const client = new CloudFormationClient({ region });
+    try {
+        const r = await client.send(new DescribeStacksCommand({ StackName: stackName }));
+        const stack = r.Stacks[0];
+        const isApp = (stack.Tags || []).some(t=>{ return t.Key === 'mason' && t.Value === appName });
+        if (!isApp){ return null }
+        return { status: stack.StackStatus };
+    } catch (e){
+        if (e.name === 'ValidationError'){ return null } // does not exist
+        throw e;
+    }
+}

package/commands/helpers/apps.js

@@ -0,0 +1,20 @@
+const { GetObjectCommand } = require("@aws-sdk/client-s3");
+
+// Resolve an app name to its s3 folder and manifest. Private apps live under
+// a _ prefixed folder, so both locations are probed - callers always use the
+// clean app name and never need to know where the app is stored
+exports.resolveApp = async function(s3, bucket, orgPrefix, appName){
+    for (const folder of [appName, `_${appName}`]){
+        const appPrefix = orgPrefix ? `${orgPrefix}/${folder}` : folder;
+        try {
+            const r = await s3.send(new GetObjectCommand({
+                Bucket: bucket,
+                Key: `${appPrefix}/manifest.json`
+            }));
+            return { appPrefix: appPrefix, manifest: JSON.parse(await r.Body.transformToString()) };
+        } catch (e){
+            if (!/NoSuchKey|NotFound/.test(e)){ throw e }
+        }
+    }
+    return null;
+}

package/commands/helpers/org_config.js

@@ -0,0 +1,20 @@
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+// Stored in the user's home dir so config survives upgrades/reinstalls of the utility
+const CONFIG_DIR = path.join(os.homedir(), '.cloudmason2');
+const CONFIG_PATH = path.join(CONFIG_DIR, 'config.json');
+
+exports.read = function () {
+    if (fs.existsSync(CONFIG_PATH)) {
+        return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8'));
+    }
+    return null;
+};
+
+exports.write = function (cfg) {
+    if (!fs.existsSync(CONFIG_DIR)) fs.mkdirSync(CONFIG_DIR, { recursive: true });
+    fs.writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2), 'utf-8');
+    return CONFIG_PATH;
+};

package/commands/init_org.js

@@ -0,0 +1,10 @@
+const OrgConfig = require('./helpers/org_config');
+
+// set-org: persist the CDN bucket name locally. All core resources live in us-east-1,
+// so consumers construct s3 urls from the bucket name + fixed region
+exports.main = async function(args){
+    const configPath = OrgConfig.write({ cdn: args.cdn, region: 'us-east-1' });
+    console.log(`Set org CDN ${args.cdn} (us-east-1)`);
+    console.log(`Config saved to ${configPath}`);
+    return true;
+}

package/commands/launch_app.js

@@ -0,0 +1,155 @@
+const { CloudFormationClient, CreateStackCommand, UpdateStackCommand, DescribeStacksCommand } = require('@aws-sdk/client-cloudformation');
+const { EC2Client, DescribeImagesCommand, CopyImageCommand } = require('@aws-sdk/client-ec2');
+const { S3Client } = require("@aws-sdk/client-s3");
+const OrgConfig = require('./helpers/org_config');
+const Apps = require('./helpers/apps');
+
+// CLI args consumed by the command itself; everything else is passed through as a CF stack parameter
+const CLI_ARGS = ['app', 'v', 'title', 'region'];
+
+exports.main = async function(args){
+    const cfg = OrgConfig.read();
+    if (!cfg){ throw new Error('No org config found. Run set-org') }
+    const { bucket, prefix } = parseCdn(cfg.cdn);
+    const s3 = new S3Client({ region: cfg.region });
+
+    const appName = args.app.toLowerCase();
+
+    // Get App
+    const app = await Apps.resolveApp(s3, bucket, prefix, appName);
+    if (!app){ throw new Error('No app named ' + args.app + '. Run new-app') }
+    const manifest = app.manifest;
+
+    // Find matching version (args.v is major.minor; manifest versions are major.minor.timestamp)
+    const targetVersion = manifest.versions.find(v=>{ return v.version === args.v || v.version.startsWith(args.v + '.') });
+    if (!targetVersion){ throw new Error(`No version ${args.v} of ${args.app}. Run update-app`) }
+
+    const stackName = `${appName}-${args.title}`;
+    console.log(`Launching ${args.app} v${targetVersion.version} as ${stackName} in ${args.region}`);
+
+    // --- I GET AMI ---
+    // AMI ids are region-scoped: outside the org region, find the AMI by name or copy it over.
+    // The regional copy is looked up by name on later launches, so it is not recorded in the manifest
+    let amiId = targetVersion.ami_id;
+    if (!manifest.noami && args.region !== cfg.region){
+        const amiName = `${appName}-v${targetVersion.version}`;
+        amiId = await findAMI(amiName, args.region);
+        if (amiId){
+            console.log(`Found existing image ${amiId} in ${args.region}`);
+        } else {
+            console.log(`Copying ${amiName} from ${cfg.region} to ${args.region}`);
+            amiId = await copyAMI(amiName, targetVersion.ami_id, cfg.region, args.region);
+        }
+        await waitForAMI(amiId, args.region);
+    }
+
+    // --- II DEPLOY CF STACK ---
+    // CF params: AmiId from the manifest version (unless noami) + any extra CLI args.
+    // No previous values are reused
+    const cfParams = manifest.noami ? [] : [{ ParameterKey: 'AmiId', ParameterValue: amiId }];
+    Object.keys(args).forEach(k=>{
+        if (CLI_ARGS.includes(k) || k === 'AmiId'){ return }
+        cfParams.push({ ParameterKey: k, ParameterValue: args[k] });
+    });
+
+    const input = {
+        StackName: stackName,
+        TemplateURL: targetVersion.stack_url,
+        Parameters: cfParams,
+        Capabilities: ["CAPABILITY_IAM", "CAPABILITY_NAMED_IAM", "CAPABILITY_AUTO_EXPAND"],
+        // Stack-level tags: CloudFormation propagates these to every created resource
+        // that supports tagging - no per-resource tags needed in the template
+        Tags: [
+            { Key: 'mason', Value: appName },
+            { Key: 'version', Value: targetVersion.version },
+            { Key: `mason-${appName}`, Value: appName }
+        ]
+    };
+
+    // Create if the stack doesn't exist, update if it does
+    const client = new CloudFormationClient({ region: args.region });
+    const status = await stackStatus(client, stackName);
+    let stackId;
+    if (status === null){
+        console.log(`Creating stack ${stackName}`);
+        input.OnFailure = 'DELETE';
+        const r = await client.send(new CreateStackCommand(input));
+        stackId = r.StackId;
+    } else {
+        if (status.endsWith('_IN_PROGRESS')){
+            console.log(`Stack ${stackName} is ${status}. Wait for completion before relaunching`);
+            throw new Error('Stack operation in progress');
+        }
+        console.log(`Updating stack ${stackName}`);
+        try {
+            const r = await client.send(new UpdateStackCommand(input));
+            stackId = r.StackId;
+        } catch (e){
+            if (/No updates are to be performed/.test(e)){
+                console.log('Stack is already up to date');
+                return true;
+            }
+            throw e;
+        }
+    }
+    console.log('Stack:', stackId);
+    return true;
+}
+
+
+///////////////////////////////////////////////
+///////////////////////////////////////////////
+///////////////////////////////////////////////
+
+function parseCdn(cdn){
+    const p = cdn.trim().replace(/^s3:\/\//i, '').replace(/\/+$/, '');
+    const parts = p.split('/');
+    return { bucket: parts[0], prefix: parts.slice(1).join('/') };
+}
+
+async function findAMI(amiName, region){
+    const client = new EC2Client({ region });
+    const r = await client.send(new DescribeImagesCommand({
+        Filters: [{ Name: "name", Values: [amiName] }],
+        Owners: ['self'],
+        IncludeDeprecated: true
+    }));
+    if (!r.Images || !r.Images[0]){ return null }
+    return r.Images[0].ImageId;
+}
+
+async function copyAMI(amiName, srcAmiId, srcRegion, destRegion){
+    const client = new EC2Client({ region: destRegion });
+    const r = await client.send(new CopyImageCommand({
+        SourceRegion: srcRegion,
+        SourceImageId: srcAmiId,
+        Name: amiName
+    }));
+    return r.ImageId;
+}
+
+async function waitForAMI(amiId, region){
+    console.log(`Waiting for AMI ${amiId} to be available in ${region}`);
+    const client = new EC2Client({ region });
+    for (let i=0; i<40; i++){
+        const r = await client.send(new DescribeImagesCommand({ ImageIds: [amiId] }));
+        if (r.Images && r.Images[0] && r.Images[0].State.toLowerCase() === 'available'){
+            console.log(`AMI ${amiId} available after ${i*30}s`);
+            return;
+        }
+        console.log(`\tAMI Status Check ${i} @${i*30}s : Not Available`);
+        await new Promise(res=>{ setTimeout(res, 30000) });
+    }
+    throw new Error('AMI not available after 20 minutes. Try again in a few minutes.');
+}
+
+async function stackStatus(client, stackName){
+    try {
+        const r = await client.send(new DescribeStacksCommand({ StackName: stackName }));
+        return r.Stacks[0].StackStatus;
+    } catch (e){
+        if (e.name === 'ValidationError'){ return null }
+        throw e;
+    }
+}
+