cloudmason2 1.6.0 → 1.7.9

package/commands/new_app.js

@@ -134,21 +134,27 @@ async function ensureGithubRole(repo, bucket, appPrefix, appName, productId){
 
     const oidcArn = await ensureOidcProvider(iam, accountId);
 
+    // Reuse the role if it already exists - the permissions policy below is
+    // still re-applied, so re-running new-app refreshes an existing role
+    let roleArn = null;
     try {
         const existing = await iam.send(new GetRoleCommand({ RoleName: roleName }));
         console.log(`Role ${roleName} already exists (${existing.Role.Arn})`);
-        return existing.Role.Arn;
+        roleArn = existing.Role.Arn;
     } catch (e){
         if (!/NoSuchEntity/.test(e)){ throw e }
     }
 
-    // Trust: only GitHub Actions workflows from this repo
-    const trustPolicy = exports.githubTrustPolicy(oidcArn, repo);
-    const created = await iam.send(new CreateRoleCommand({
-        RoleName: roleName,
-        AssumeRolePolicyDocument: JSON.stringify(trustPolicy),
-        Description: `Mason CI role for ${appName} (github.com/${repo})`
-    }));
+    if (!roleArn){
+        // Trust: only GitHub Actions workflows from this repo
+        const trustPolicy = exports.githubTrustPolicy(oidcArn, repo);
+        const created = await iam.send(new CreateRoleCommand({
+            RoleName: roleName,
+            AssumeRolePolicyDocument: JSON.stringify(trustPolicy),
+            Description: `Mason CI role for ${appName} (github.com/${repo})`
+        }));
+        roleArn = created.Role.Arn;
+    }
 
     // Scoped to the app prefix, product id, and app stack names where the
     // services support it. EC2 build permissions cannot be scoped
@@ -187,6 +193,52 @@ async function ensureGithubRole(repo, bucket, appPrefix, appName, productId){
                 Action: ["cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DescribeStacks"],
                 Resource: `arn:aws:cloudformation:*:${accountId}:stack/${appName}-*/*`
             },
+            {
+                Sid: "ReadTemplateSummary",
+                Effect: "Allow",
+                // launch calls GetTemplateSummary with a TemplateURL, which IAM
+                // evaluates against * rather than a stack ARN
+                Action: "cloudformation:GetTemplateSummary",
+                Resource: "*"
+            },
+            {
+                Sid: "LaunchStackServices",
+                Effect: "Allow",
+                // CloudFormation provisions stack resources with the caller's
+                // credentials. Certs, DNS records, and user pools get
+                // unpredictable ARNs, so these cannot be resource-scoped
+                Action: ["acm:*", "route53:*", "cognito-idp:*"],
+                Resource: "*"
+            },
+            {
+                Sid: "AppStackIam",
+                Effect: "Allow",
+                Action: [
+                    "iam:CreateRole", "iam:DeleteRole", "iam:GetRole", "iam:UpdateRole", "iam:TagRole", "iam:UntagRole",
+                    "iam:PutRolePolicy", "iam:DeleteRolePolicy", "iam:GetRolePolicy", "iam:ListRolePolicies",
+                    "iam:AttachRolePolicy", "iam:DetachRolePolicy", "iam:ListAttachedRolePolicies", "iam:PassRole",
+                    "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:GetInstanceProfile",
+                    "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:TagInstanceProfile"
+                ],
+                // CFN-generated role/profile names start with the stack name,
+                // and launch names every stack <app>-<title>
+                Resource: [
+                    `arn:aws:iam::${accountId}:role/${appName}-*`,
+                    `arn:aws:iam::${accountId}:instance-profile/${appName}-*`
+                ]
+            },
+            {
+                Sid: "AppStackBuckets",
+                Effect: "Allow",
+                Action: "s3:*",
+                Resource: [`arn:aws:s3:::${appName}-*`, `arn:aws:s3:::${appName}-*/*`]
+            },
+            {
+                Sid: "AppStackTables",
+                Effect: "Allow",
+                Action: "dynamodb:*",
+                Resource: `arn:aws:dynamodb:*:${accountId}:table/${appName}-*`
+            },
             {
                 Sid: "ReadRoleParam",
                 Effect: "Allow",
@@ -207,9 +259,9 @@ async function ensureGithubRole(repo, bucket, appPrefix, appName, productId){
         PolicyDocument: JSON.stringify(policy)
     }));
 
-    console.log(`Created role ${roleName} (${created.Role.Arn})`);
-    console.log(`Use in GitHub Actions with: role-to-assume: ${created.Role.Arn}`);
-    return created.Role.Arn;
+    console.log(`Configured role ${roleName} (${roleArn})`);
+    console.log(`Use in GitHub Actions with: role-to-assume: ${roleArn}`);
+    return roleArn;
 }
 
 async function ensureOidcProvider(iam, accountId){

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudmason2",
-  "version": "1.6.0",
+  "version": "1.7.9",
   "description": "",
   "main": "main.js",
   "files": [