cloudmason2 1.6.0 → 1.7.0

package/commands/new_app.js

@@ -134,21 +134,27 @@ async function ensureGithubRole(repo, bucket, appPrefix, appName, productId){
 
     const oidcArn = await ensureOidcProvider(iam, accountId);
 
+    // Reuse the role if it already exists - the permissions policy below is
+    // still re-applied, so re-running new-app refreshes an existing role
+    let roleArn = null;
     try {
         const existing = await iam.send(new GetRoleCommand({ RoleName: roleName }));
         console.log(`Role ${roleName} already exists (${existing.Role.Arn})`);
-        return existing.Role.Arn;
+        roleArn = existing.Role.Arn;
     } catch (e){
         if (!/NoSuchEntity/.test(e)){ throw e }
     }
 
-    // Trust: only GitHub Actions workflows from this repo
-    const trustPolicy = exports.githubTrustPolicy(oidcArn, repo);
-    const created = await iam.send(new CreateRoleCommand({
-        RoleName: roleName,
-        AssumeRolePolicyDocument: JSON.stringify(trustPolicy),
-        Description: `Mason CI role for ${appName} (github.com/${repo})`
-    }));
+    if (!roleArn){
+        // Trust: only GitHub Actions workflows from this repo
+        const trustPolicy = exports.githubTrustPolicy(oidcArn, repo);
+        const created = await iam.send(new CreateRoleCommand({
+            RoleName: roleName,
+            AssumeRolePolicyDocument: JSON.stringify(trustPolicy),
+            Description: `Mason CI role for ${appName} (github.com/${repo})`
+        }));
+        roleArn = created.Role.Arn;
+    }
 
     // Scoped to the app prefix, product id, and app stack names where the
     // services support it. EC2 build permissions cannot be scoped
@@ -187,6 +193,14 @@ async function ensureGithubRole(repo, bucket, appPrefix, appName, productId){
                 Action: ["cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DescribeStacks"],
                 Resource: `arn:aws:cloudformation:*:${accountId}:stack/${appName}-*/*`
             },
+            {
+                Sid: "ReadTemplateSummary",
+                Effect: "Allow",
+                // launch calls GetTemplateSummary with a TemplateURL, which IAM
+                // evaluates against * rather than a stack ARN
+                Action: "cloudformation:GetTemplateSummary",
+                Resource: "*"
+            },
             {
                 Sid: "ReadRoleParam",
                 Effect: "Allow",
@@ -207,9 +221,9 @@ async function ensureGithubRole(repo, bucket, appPrefix, appName, productId){
         PolicyDocument: JSON.stringify(policy)
     }));
 
-    console.log(`Created role ${roleName} (${created.Role.Arn})`);
-    console.log(`Use in GitHub Actions with: role-to-assume: ${created.Role.Arn}`);
-    return created.Role.Arn;
+    console.log(`Configured role ${roleName} (${roleArn})`);
+    console.log(`Use in GitHub Actions with: role-to-assume: ${roleArn}`);
+    return roleArn;
 }
 
 async function ensureOidcProvider(iam, accountId){

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudmason2",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "",
   "main": "main.js",
   "files": [