cloudmason2 1.5.0 → 1.7.0

package/commands/new_app.js

@@ -105,6 +105,25 @@ function createLocalMarketplace(){
     console.log(`Created ${destDir}`);
 }
 
+// Trust policy allowing GitHub Actions OIDC assumption from one repo.
+// Shared with update-listing's -repo trust update
+exports.githubTrustPolicy = function(oidcArn, repo){
+    return {
+        Version: "2012-10-17",
+        Statement: [
+            {
+                Effect: "Allow",
+                Principal: { Federated: oidcArn },
+                Action: "sts:AssumeRoleWithWebIdentity",
+                Condition: {
+                    StringEquals: { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
+                    StringLike: { "token.actions.githubusercontent.com:sub": `repo:${repo}:*` }
+                }
+            }
+        ]
+    };
+}
+
 // Create a role GitHub Actions can assume via OIDC from the given repo.
 // Permissions cover update-listing, update-app, launch, and publish - not new-app
 async function ensureGithubRole(repo, bucket, appPrefix, appName, productId){
@@ -115,34 +134,27 @@ async function ensureGithubRole(repo, bucket, appPrefix, appName, productId){
 
     const oidcArn = await ensureOidcProvider(iam, accountId);
 
+    // Reuse the role if it already exists - the permissions policy below is
+    // still re-applied, so re-running new-app refreshes an existing role
+    let roleArn = null;
     try {
         const existing = await iam.send(new GetRoleCommand({ RoleName: roleName }));
         console.log(`Role ${roleName} already exists (${existing.Role.Arn})`);
-        return existing.Role.Arn;
+        roleArn = existing.Role.Arn;
     } catch (e){
         if (!/NoSuchEntity/.test(e)){ throw e }
     }
 
-    // Trust: only GitHub Actions workflows from this repo
-    const trustPolicy = {
-        Version: "2012-10-17",
-        Statement: [
-            {
-                Effect: "Allow",
-                Principal: { Federated: oidcArn },
-                Action: "sts:AssumeRoleWithWebIdentity",
-                Condition: {
-                    StringEquals: { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
-                    StringLike: { "token.actions.githubusercontent.com:sub": `repo:${repo}:*` }
-                }
-            }
-        ]
-    };
-    const created = await iam.send(new CreateRoleCommand({
-        RoleName: roleName,
-        AssumeRolePolicyDocument: JSON.stringify(trustPolicy),
-        Description: `Mason CI role for ${appName} (github.com/${repo})`
-    }));
+    if (!roleArn){
+        // Trust: only GitHub Actions workflows from this repo
+        const trustPolicy = exports.githubTrustPolicy(oidcArn, repo);
+        const created = await iam.send(new CreateRoleCommand({
+            RoleName: roleName,
+            AssumeRolePolicyDocument: JSON.stringify(trustPolicy),
+            Description: `Mason CI role for ${appName} (github.com/${repo})`
+        }));
+        roleArn = created.Role.Arn;
+    }
 
     // Scoped to the app prefix, product id, and app stack names where the
     // services support it. EC2 build permissions cannot be scoped
@@ -181,6 +193,14 @@ async function ensureGithubRole(repo, bucket, appPrefix, appName, productId){
                 Action: ["cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DescribeStacks"],
                 Resource: `arn:aws:cloudformation:*:${accountId}:stack/${appName}-*/*`
             },
+            {
+                Sid: "ReadTemplateSummary",
+                Effect: "Allow",
+                // launch calls GetTemplateSummary with a TemplateURL, which IAM
+                // evaluates against * rather than a stack ARN
+                Action: "cloudformation:GetTemplateSummary",
+                Resource: "*"
+            },
             {
                 Sid: "ReadRoleParam",
                 Effect: "Allow",
@@ -201,9 +221,9 @@ async function ensureGithubRole(repo, bucket, appPrefix, appName, productId){
         PolicyDocument: JSON.stringify(policy)
     }));
 
-    console.log(`Created role ${roleName} (${created.Role.Arn})`);
-    console.log(`Use in GitHub Actions with: role-to-assume: ${created.Role.Arn}`);
-    return created.Role.Arn;
+    console.log(`Configured role ${roleName} (${roleArn})`);
+    console.log(`Use in GitHub Actions with: role-to-assume: ${roleArn}`);
+    return roleArn;
 }
 
 async function ensureOidcProvider(iam, accountId){

package/commands/update_listing.js

@@ -1,9 +1,12 @@
 const fs = require('fs');
 const path = require('path');
 const { S3Client, PutObjectCommand } = require("@aws-sdk/client-s3");
+const { IAMClient, GetRoleCommand, UpdateAssumeRolePolicyCommand } = require("@aws-sdk/client-iam");
+const { STSClient, GetCallerIdentityCommand } = require("@aws-sdk/client-sts");
 const OrgConfig = require('./helpers/org_config');
 const Apps = require('./helpers/apps');
 const Mime = require('./helpers/mime');
+const { githubTrustPolicy } = require('./new_app');
 
 // Marketplace listing text files stored as top-level manifest attributes.
 // Names match the keys the AWS Marketplace Catalog API expects
@@ -27,25 +30,32 @@ exports.main = async function(args){
     if (!app){ throw new Error('No app named ' + args.app + '. Run new-app') }
     const { appPrefix, manifest } = app;
 
-    if (!args.assets && !args.pid && !args.ec2){
-        console.log('Nothing to update. Pass -assets, -pid, or -ec2');
+    if (!args.assets && !args.pid && !args.ec2 && !args.repo){
+        console.log('Nothing to update. Pass -assets, -pid, -ec2, or -repo');
         return true;
     }
 
     // Apply all manifest updates in one download/update/upload pass
-    if (args.assets){
-        await applyAssets(s3, bucket, appPrefix, cfg.region, args.assets, manifest);
-    }
-    if (args.pid){
-        manifest.productId = args.pid;
-        console.log('Set productId');
+    if (args.assets || args.pid || args.ec2){
+        if (args.assets){
+            await applyAssets(s3, bucket, appPrefix, cfg.region, args.assets, manifest);
+        }
+        if (args.pid){
+            manifest.productId = args.pid;
+            console.log('Set productId');
+        }
+        if (args.ec2){
+            manifest.RecommendedInstanceType = args.ec2;
+            console.log('Set RecommendedInstanceType');
+        }
+        await putManifest(s3, bucket, appPrefix, manifest);
+        console.log('Updated manifest');
     }
-    if (args.ec2){
-        manifest.RecommendedInstanceType = args.ec2;
-        console.log('Set RecommendedInstanceType');
+
+    // Replace the CI role trust policy with one for the updated repo
+    if (args.repo){
+        await updateRepoTrust(appName, args.repo);
     }
-    await putManifest(s3, bucket, appPrefix, manifest);
-    console.log('Updated manifest');
     return true;
 }
 
@@ -115,6 +125,28 @@ async function applyAssets(s3, bucket, appPrefix, region, assetsPath, manifest){
     }
 }
 
+async function updateRepoTrust(appName, repo){
+    if (!/^[\w.-]+\/[\w.-]+$/.test(repo)){ throw new Error('Invalid repo. Use org/repo format') }
+    const roleName = `mason-gha-${appName}`;
+    const iam = new IAMClient({ region: 'us-east-1' });
+    const sts = new STSClient({ region: 'us-east-1' });
+
+    try {
+        await iam.send(new GetRoleCommand({ RoleName: roleName }));
+    } catch (e){
+        if (/NoSuchEntity/.test(e)){ throw new Error(`No CI role ${roleName} found. Run new-app with -repo first`) }
+        throw e;
+    }
+
+    const accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
+    const oidcArn = `arn:aws:iam::${accountId}:oidc-provider/token.actions.githubusercontent.com`;
+    await iam.send(new UpdateAssumeRolePolicyCommand({
+        RoleName: roleName,
+        PolicyDocument: JSON.stringify(githubTrustPolicy(oidcArn, repo))
+    }));
+    console.log(`Updated ${roleName} trust policy to repo ${repo}`);
+}
+
 async function putManifest(s3, bucket, appPrefix, manifest){
     await s3.send(new PutObjectCommand({
         Bucket: bucket,

package/main.js

@@ -39,7 +39,8 @@ const Commands = {
             {n: 'app', desc: 'Name of existing app', pattern: `^[A-Za-z]{2,20}$`, r: true},
             {n: 'assets', desc: 'Path to folder with application assets', r: false},
             {n: 'pid', desc: 'AWS Product ID', r: false},
-            {n: 'ec2', desc: 'Instance type (default r8g.medium)', r: false}
+            {n: 'ec2', desc: 'Instance type (default r8g.medium)', r: false},
+            {n: 'repo', desc: 'GitHub repo (org/repo). Replaces the CI role trust policy with this repo', r: false}
         ]
     },
     'update-assets': {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudmason2",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "",
   "main": "main.js",
   "files": [