cloudmason2 1.7.9 → 1.8.0

package/commands/new_app.js

@@ -1,8 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const { S3Client, PutObjectCommand, GetObjectCommand, ListObjectsV2Command } = require("@aws-sdk/client-s3");
-const { IAMClient, GetRoleCommand, CreateRoleCommand, PutRolePolicyCommand, GetOpenIDConnectProviderCommand, CreateOpenIDConnectProviderCommand } = require("@aws-sdk/client-iam");
-const { STSClient, GetCallerIdentityCommand } = require("@aws-sdk/client-sts");
+const { S3Client, PutObjectCommand, ListObjectsV2Command } = require("@aws-sdk/client-s3");
 const OrgConfig = require('./helpers/org_config');
 const Apps = require('./helpers/apps');
 
@@ -16,8 +14,8 @@ const MANIFEST_TEMPLATE = {
     versions: []
 };
 
-// new-app: create the app's core assets in s3, the local template folder,
-// and (if -repo) the GitHub Actions CI role. Listing content is set by update-listing
+// new-app: create the app's core assets in s3 and the local template folder.
+// Listing content is set by update-listing; the CI role is managed by set-repo
 exports.main = async function(args){
     const cfg = OrgConfig.read();
     if (!cfg){ throw new Error('No org config found. Run set-org') }
@@ -45,13 +43,6 @@ exports.main = async function(args){
         await Apps.addToIndex(s3, bucket, prefix, appPrefix);
     }
     createLocalMarketplace();
-
-    // --- III REPO ROLE ---
-    if (args.repo){
-        if (!/^[\w.-]+\/[\w.-]+$/.test(args.repo)){ throw new Error('Invalid repo. Use org/repo format') }
-        const manifest = await getManifest(s3, bucket, appPrefix);
-        await ensureGithubRole(args.repo, bucket, appPrefix, appName, manifest.productId);
-    }
     return true;
 }
 
@@ -104,187 +95,3 @@ function createLocalMarketplace(){
     });
     console.log(`Created ${destDir}`);
 }
-
-// Trust policy allowing GitHub Actions OIDC assumption from one repo.
-// Shared with update-listing's -repo trust update
-exports.githubTrustPolicy = function(oidcArn, repo){
-    return {
-        Version: "2012-10-17",
-        Statement: [
-            {
-                Effect: "Allow",
-                Principal: { Federated: oidcArn },
-                Action: "sts:AssumeRoleWithWebIdentity",
-                Condition: {
-                    StringEquals: { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
-                    StringLike: { "token.actions.githubusercontent.com:sub": `repo:${repo}:*` }
-                }
-            }
-        ]
-    };
-}
-
-// Create a role GitHub Actions can assume via OIDC from the given repo.
-// Permissions cover update-listing, update-app, launch, and publish - not new-app
-async function ensureGithubRole(repo, bucket, appPrefix, appName, productId){
-    const roleName = `mason-gha-${appName}`;
-    const iam = new IAMClient({ region: 'us-east-1' });
-    const sts = new STSClient({ region: 'us-east-1' });
-    const accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
-
-    const oidcArn = await ensureOidcProvider(iam, accountId);
-
-    // Reuse the role if it already exists - the permissions policy below is
-    // still re-applied, so re-running new-app refreshes an existing role
-    let roleArn = null;
-    try {
-        const existing = await iam.send(new GetRoleCommand({ RoleName: roleName }));
-        console.log(`Role ${roleName} already exists (${existing.Role.Arn})`);
-        roleArn = existing.Role.Arn;
-    } catch (e){
-        if (!/NoSuchEntity/.test(e)){ throw e }
-    }
-
-    if (!roleArn){
-        // Trust: only GitHub Actions workflows from this repo
-        const trustPolicy = exports.githubTrustPolicy(oidcArn, repo);
-        const created = await iam.send(new CreateRoleCommand({
-            RoleName: roleName,
-            AssumeRolePolicyDocument: JSON.stringify(trustPolicy),
-            Description: `Mason CI role for ${appName} (github.com/${repo})`
-        }));
-        roleArn = created.Role.Arn;
-    }
-
-    // Scoped to the app prefix, product id, and app stack names where the
-    // services support it. EC2 build permissions cannot be scoped
-    if (!productId){ console.log('WARNING: No productId in manifest. Marketplace access is scoped to all products. Re-create the role after update-listing -pid to scope it') }
-    const marketplaceEntity = productId
-        ? `arn:aws:aws-marketplace:us-east-1:${accountId}:AWSMarketplace/AmiProduct/${productId}`
-        : `arn:aws:aws-marketplace:us-east-1:${accountId}:AWSMarketplace/AmiProduct/*`;
-    const policy = {
-        Version: "2012-10-17",
-        Statement: [
-            {
-                Sid: "AppPrefixWrite",
-                Effect: "Allow",
-                Action: ["s3:GetObject", "s3:PutObject"],
-                Resource: `arn:aws:s3:::${bucket}/${appPrefix}/*`
-            },
-            {
-                Sid: "AppPrefixList",
-                Effect: "Allow",
-                Action: "s3:ListBucket",
-                Resource: `arn:aws:s3:::${bucket}`,
-                Condition: { StringLike: { "s3:prefix": `${appPrefix}/*` } }
-            },
-            {
-                Sid: "MarketplacePublish",
-                Effect: "Allow",
-                Action: ["aws-marketplace:StartChangeSet", "aws-marketplace:DescribeChangeSet", "aws-marketplace:DescribeEntity"],
-                Resource: [
-                    marketplaceEntity,
-                    `arn:aws:aws-marketplace:us-east-1:${accountId}:AWSMarketplace/ChangeSet/*`
-                ]
-            },
-            {
-                Sid: "AppStacks",
-                Effect: "Allow",
-                Action: ["cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DescribeStacks"],
-                Resource: `arn:aws:cloudformation:*:${accountId}:stack/${appName}-*/*`
-            },
-            {
-                Sid: "ReadTemplateSummary",
-                Effect: "Allow",
-                // launch calls GetTemplateSummary with a TemplateURL, which IAM
-                // evaluates against * rather than a stack ARN
-                Action: "cloudformation:GetTemplateSummary",
-                Resource: "*"
-            },
-            {
-                Sid: "LaunchStackServices",
-                Effect: "Allow",
-                // CloudFormation provisions stack resources with the caller's
-                // credentials. Certs, DNS records, and user pools get
-                // unpredictable ARNs, so these cannot be resource-scoped
-                Action: ["acm:*", "route53:*", "cognito-idp:*"],
-                Resource: "*"
-            },
-            {
-                Sid: "AppStackIam",
-                Effect: "Allow",
-                Action: [
-                    "iam:CreateRole", "iam:DeleteRole", "iam:GetRole", "iam:UpdateRole", "iam:TagRole", "iam:UntagRole",
-                    "iam:PutRolePolicy", "iam:DeleteRolePolicy", "iam:GetRolePolicy", "iam:ListRolePolicies",
-                    "iam:AttachRolePolicy", "iam:DetachRolePolicy", "iam:ListAttachedRolePolicies", "iam:PassRole",
-                    "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:GetInstanceProfile",
-                    "iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:TagInstanceProfile"
-                ],
-                // CFN-generated role/profile names start with the stack name,
-                // and launch names every stack <app>-<title>
-                Resource: [
-                    `arn:aws:iam::${accountId}:role/${appName}-*`,
-                    `arn:aws:iam::${accountId}:instance-profile/${appName}-*`
-                ]
-            },
-            {
-                Sid: "AppStackBuckets",
-                Effect: "Allow",
-                Action: "s3:*",
-                Resource: [`arn:aws:s3:::${appName}-*`, `arn:aws:s3:::${appName}-*/*`]
-            },
-            {
-                Sid: "AppStackTables",
-                Effect: "Allow",
-                Action: "dynamodb:*",
-                Resource: `arn:aws:dynamodb:*:${accountId}:table/${appName}-*`
-            },
-            {
-                Sid: "ReadRoleParam",
-                Effect: "Allow",
-                Action: "ssm:GetParameter",
-                Resource: `arn:aws:ssm:us-east-1:${accountId}:parameter/mason-cdn-${bucket}`
-            },
-            {
-                Sid: "AmiBuildAndLaunch",
-                Effect: "Allow",
-                Action: ["ec2:*", "autoscaling:*", "elasticloadbalancing:*"],
-                Resource: "*"
-            }
-        ]
-    };
-    await iam.send(new PutRolePolicyCommand({
-        RoleName: roleName,
-        PolicyName: 'mason-app-access',
-        PolicyDocument: JSON.stringify(policy)
-    }));
-
-    console.log(`Configured role ${roleName} (${roleArn})`);
-    console.log(`Use in GitHub Actions with: role-to-assume: ${roleArn}`);
-    return roleArn;
-}
-
-async function ensureOidcProvider(iam, accountId){
-    const arn = `arn:aws:iam::${accountId}:oidc-provider/token.actions.githubusercontent.com`;
-    try {
-        await iam.send(new GetOpenIDConnectProviderCommand({ OpenIDConnectProviderArn: arn }));
-        return arn;
-    } catch (e){
-        if (!/NoSuchEntity/.test(e)){ throw e }
-    }
-    await iam.send(new CreateOpenIDConnectProviderCommand({
-        Url: 'https://token.actions.githubusercontent.com',
-        ClientIDList: ['sts.amazonaws.com'],
-        ThumbprintList: ['6938fd4d98bab03faadb97b34396831e3780aea1']
-    }));
-    console.log('Created GitHub OIDC identity provider');
-    return arn;
-}
-
-async function getManifest(s3, bucket, appPrefix){
-    const r = await s3.send(new GetObjectCommand({
-        Bucket: bucket,
-        Key: `${appPrefix}/manifest.json`
-    }));
-    return JSON.parse(await r.Body.transformToString());
-}

package/commands/set_repo.js

@@ -0,0 +1,271 @@
+const fs = require('fs');
+const path = require('path');
+const { S3Client, GetObjectCommand } = require("@aws-sdk/client-s3");
+const { CloudFormationClient, GetTemplateSummaryCommand, DescribeTypeCommand } = require("@aws-sdk/client-cloudformation");
+const { IAMClient, GetRoleCommand, CreateRoleCommand, PutRolePolicyCommand, UpdateAssumeRolePolicyCommand, GetOpenIDConnectProviderCommand, CreateOpenIDConnectProviderCommand } = require("@aws-sdk/client-iam");
+const { STSClient, GetCallerIdentityCommand } = require("@aws-sdk/client-sts");
+const OrgConfig = require('./helpers/org_config');
+const Apps = require('./helpers/apps');
+
+// Inline role policies cap at 10240 chars; collapse derived actions if we get close
+const POLICY_CHAR_LIMIT = 10000;
+
+// set-repo: create or update the app's GitHub Actions CI role. Sets the trust
+// policy to the given repo and derives the stack template's required permissions
+// from the CloudFormation registry. Run locally under elevated permissions -
+// the CI role deliberately cannot modify itself
+exports.main = async function(args){
+    if (!/^[\w.-]+\/[\w.-]+$/.test(args.repo)){ throw new Error('Invalid repo. Use org/repo format') }
+
+    const cfg = OrgConfig.read();
+    if (!cfg){ throw new Error('No org config found. Run set-org') }
+    const { bucket, prefix } = parseCdn(cfg.cdn);
+    const s3 = new S3Client({ region: cfg.region });
+
+    const appName = args.app.toLowerCase();
+    const app = await Apps.resolveApp(s3, bucket, prefix, appName);
+    if (!app){ throw new Error('No app named ' + args.app + '. Run new-app') }
+    const { appPrefix, manifest } = app;
+
+    // --- I GET TEMPLATE ---
+    let stackText = null;
+    if (args.stack){
+        const stackPath = path.resolve(args.stack);
+        if (!fs.existsSync(stackPath)){ throw new Error('Stack not found: ' + stackPath) }
+        stackText = fs.readFileSync(stackPath, 'utf-8');
+    } else {
+        const latest = [...(manifest.versions || [])]
+            .sort((a, b)=>{ return String(b.updated_on || '').localeCompare(String(a.updated_on || '')) })[0];
+        if (latest){
+            const vFolder = latest.version.split('.').slice(0, 2).join('.');
+            stackText = await getFileText(s3, bucket, `${appPrefix}/versions/${vFolder}/stack.yaml`);
+        }
+    }
+    if (!stackText){
+        console.log('No stack template found. Applying baseline permissions only. Pass -stack to derive template permissions');
+    }
+
+    // --- II DERIVE PERMISSIONS FROM THE CF REGISTRY ---
+    let derived = [];
+    if (stackText){
+        derived = await derivePermissions(cfg.region, stackText);
+        console.log(`Derived ${derived.length} actions from the template`);
+    }
+
+    // --- III ENSURE ROLE + TRUST ---
+    const iam = new IAMClient({ region: 'us-east-1' });
+    const sts = new STSClient({ region: 'us-east-1' });
+    const accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
+    const oidcArn = await ensureOidcProvider(iam, accountId);
+
+    const roleName = `mason-gha-${appName}`;
+    const trustPolicy = githubTrustPolicy(oidcArn, args.repo);
+    let roleArn;
+    try {
+        const existing = await iam.send(new GetRoleCommand({ RoleName: roleName }));
+        roleArn = existing.Role.Arn;
+        await iam.send(new UpdateAssumeRolePolicyCommand({
+            RoleName: roleName,
+            PolicyDocument: JSON.stringify(trustPolicy)
+        }));
+        console.log(`Updated ${roleName} trust to repo ${args.repo}`);
+    } catch (e){
+        if (!/NoSuchEntity/.test(e)){ throw e }
+        const created = await iam.send(new CreateRoleCommand({
+            RoleName: roleName,
+            AssumeRolePolicyDocument: JSON.stringify(trustPolicy),
+            Description: `Mason CI role for ${appName} (github.com/${args.repo})`
+        }));
+        roleArn = created.Role.Arn;
+        console.log(`Created role ${roleName} for repo ${args.repo}`);
+    }
+
+    // --- IV APPLY PERMISSIONS ---
+    if (!manifest.productId){
+        console.log('WARNING: No productId in manifest. Marketplace access is scoped to all products. Re-run set-repo after update-listing -pid to scope it');
+    }
+    const policy = buildPolicy(accountId, bucket, appPrefix, appName, manifest.productId, derived);
+    await iam.send(new PutRolePolicyCommand({
+        RoleName: roleName,
+        PolicyName: 'mason-app-access',
+        PolicyDocument: JSON.stringify(policy)
+    }));
+
+    console.log(`Configured role ${roleName} (${roleArn})`);
+    console.log(`Use in GitHub Actions with: role-to-assume: ${roleArn}`);
+    return true;
+}
+
+
+/////////////////////////////////////////
+////////////// FUNCS ////////////////////
+////////////////////////////////////////
+
+function parseCdn(cdn){
+    const p = cdn.trim().replace(/^s3:\/\//i, '').replace(/\/+$/, '');
+    const parts = p.split('/');
+    return { bucket: parts[0], prefix: parts.slice(1).join('/') };
+}
+
+// Union the registry schema handler permissions for every resource type in the
+// template, plus property-conditional extras the schemas cannot express
+async function derivePermissions(region, stackText){
+    const cf = new CloudFormationClient({ region });
+    const summary = await cf.send(new GetTemplateSummaryCommand({ TemplateBody: stackText }));
+    const types = [...new Set(summary.ResourceTypes || [])];
+    console.log('Template resources: ' + types.join(', '));
+
+    const actions = new Set();
+    for (const t of types){
+        try {
+            const r = await cf.send(new DescribeTypeCommand({ Type: 'RESOURCE', TypeName: t }));
+            const schema = JSON.parse(r.Schema);
+            ['create', 'read', 'update', 'delete', 'list'].forEach(h=>{
+                const perms = schema.handlers && schema.handlers[h] && schema.handlers[h].permissions;
+                (perms || []).forEach(p=>{ actions.add(p) });
+            });
+        } catch (e){
+            console.log(`WARNING: No registry schema for ${t} (${e.name}). Add its permissions manually if needed`);
+        }
+    }
+
+    // Property-conditional permissions the registry schemas do not declare
+    if (/InstanceProfile|AWS::IAM::Role|RoleArn/i.test(stackText)){
+        actions.add('iam:PassRole');
+        actions.add('iam:GetRole');
+    }
+    if (/kms/i.test(stackText)){
+        ['kms:DescribeKey', 'kms:CreateGrant', 'kms:Decrypt', 'kms:GenerateDataKey'].forEach(a=>{ actions.add(a) });
+    }
+    return [...actions].sort();
+}
+
+function buildPolicy(accountId, bucket, appPrefix, appName, productId, derived){
+    const marketplaceEntity = productId
+        ? `arn:aws:aws-marketplace:us-east-1:${accountId}:AWSMarketplace/AmiProduct/${productId}`
+        : `arn:aws:aws-marketplace:us-east-1:${accountId}:AWSMarketplace/AmiProduct/*`;
+
+    const statements = [
+        {
+            Sid: "AppPrefixWrite",
+            Effect: "Allow",
+            Action: ["s3:GetObject", "s3:PutObject"],
+            Resource: `arn:aws:s3:::${bucket}/${appPrefix}/*`
+        },
+        {
+            Sid: "AppPrefixList",
+            Effect: "Allow",
+            Action: "s3:ListBucket",
+            Resource: `arn:aws:s3:::${bucket}`,
+            Condition: { StringLike: { "s3:prefix": `${appPrefix}/*` } }
+        },
+        {
+            Sid: "MarketplacePublish",
+            Effect: "Allow",
+            Action: ["aws-marketplace:StartChangeSet", "aws-marketplace:DescribeChangeSet", "aws-marketplace:DescribeEntity"],
+            Resource: [
+                marketplaceEntity,
+                `arn:aws:aws-marketplace:us-east-1:${accountId}:AWSMarketplace/ChangeSet/*`
+            ]
+        },
+        {
+            Sid: "AppStacks",
+            Effect: "Allow",
+            Action: ["cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DescribeStacks"],
+            Resource: `arn:aws:cloudformation:*:${accountId}:stack/${appName}-*/*`
+        },
+        {
+            Sid: "ReadTemplateSummary",
+            Effect: "Allow",
+            // launch calls GetTemplateSummary with a TemplateURL, which IAM
+            // evaluates against * rather than a stack ARN
+            Action: "cloudformation:GetTemplateSummary",
+            Resource: "*"
+        },
+        {
+            Sid: "ReadRoleParam",
+            Effect: "Allow",
+            Action: "ssm:GetParameter",
+            Resource: `arn:aws:ssm:us-east-1:${accountId}:parameter/mason-cdn-${bucket}`
+        },
+        {
+            // The SSH AMI build creates untagged temporary resources and
+            // prunes images in every region - it cannot be scoped
+            Sid: "AmiBuild",
+            Effect: "Allow",
+            Action: "ec2:*",
+            Resource: "*"
+        }
+    ];
+
+    if (derived.length){
+        // ec2 is already covered wholesale by the build statement
+        let actions = derived.filter(a=>{ return !a.startsWith('ec2:') });
+        let policy = wrap(statements, actions);
+        if (JSON.stringify(policy).length > POLICY_CHAR_LIMIT){
+            // Collapse to per-service wildcards to stay under the inline policy size cap
+            actions = [...new Set(actions.map(a=>{ return a.split(':')[0] + ':*' }))].sort();
+            console.log('Derived actions exceed the policy size limit. Collapsed to service wildcards: ' + actions.join(', '));
+            policy = wrap(statements, actions);
+        }
+        return policy;
+    }
+    return { Version: "2012-10-17", Statement: statements };
+}
+
+function wrap(statements, derivedActions){
+    const all = [...statements];
+    if (derivedActions.length){
+        all.push({
+            Sid: "TemplateResources",
+            Effect: "Allow",
+            Action: derivedActions,
+            Resource: "*"
+        });
+    }
+    return { Version: "2012-10-17", Statement: all };
+}
+
+function githubTrustPolicy(oidcArn, repo){
+    return {
+        Version: "2012-10-17",
+        Statement: [
+            {
+                Effect: "Allow",
+                Principal: { Federated: oidcArn },
+                Action: "sts:AssumeRoleWithWebIdentity",
+                Condition: {
+                    StringEquals: { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
+                    StringLike: { "token.actions.githubusercontent.com:sub": `repo:${repo}:*` }
+                }
+            }
+        ]
+    };
+}
+
+async function ensureOidcProvider(iam, accountId){
+    const arn = `arn:aws:iam::${accountId}:oidc-provider/token.actions.githubusercontent.com`;
+    try {
+        await iam.send(new GetOpenIDConnectProviderCommand({ OpenIDConnectProviderArn: arn }));
+        return arn;
+    } catch (e){
+        if (!/NoSuchEntity/.test(e)){ throw e }
+    }
+    await iam.send(new CreateOpenIDConnectProviderCommand({
+        Url: 'https://token.actions.githubusercontent.com',
+        ClientIDList: ['sts.amazonaws.com'],
+        ThumbprintList: ['6938fd4d98bab03faadb97b34396831e3780aea1']
+    }));
+    console.log('Created GitHub OIDC identity provider');
+    return arn;
+}
+
+async function getFileText(s3, bucket, key){
+    try {
+        const r = await s3.send(new GetObjectCommand({ Bucket: bucket, Key: key }));
+        return await r.Body.transformToString();
+    } catch (e){
+        if (/NoSuchKey|NotFound/.test(e)){ return null }
+        throw e;
+    }
+}

package/commands/update_listing.js

@@ -1,12 +1,9 @@
 const fs = require('fs');
 const path = require('path');
 const { S3Client, PutObjectCommand } = require("@aws-sdk/client-s3");
-const { IAMClient, GetRoleCommand, UpdateAssumeRolePolicyCommand } = require("@aws-sdk/client-iam");
-const { STSClient, GetCallerIdentityCommand } = require("@aws-sdk/client-sts");
 const OrgConfig = require('./helpers/org_config');
 const Apps = require('./helpers/apps');
 const Mime = require('./helpers/mime');
-const { githubTrustPolicy } = require('./new_app');
 
 // Marketplace listing text files stored as top-level manifest attributes.
 // Names match the keys the AWS Marketplace Catalog API expects
@@ -30,32 +27,25 @@ exports.main = async function(args){
     if (!app){ throw new Error('No app named ' + args.app + '. Run new-app') }
     const { appPrefix, manifest } = app;
 
-    if (!args.assets && !args.pid && !args.ec2 && !args.repo){
-        console.log('Nothing to update. Pass -assets, -pid, -ec2, or -repo');
+    if (!args.assets && !args.pid && !args.ec2){
+        console.log('Nothing to update. Pass -assets, -pid, or -ec2');
         return true;
     }
 
     // Apply all manifest updates in one download/update/upload pass
-    if (args.assets || args.pid || args.ec2){
-        if (args.assets){
-            await applyAssets(s3, bucket, appPrefix, cfg.region, args.assets, manifest);
-        }
-        if (args.pid){
-            manifest.productId = args.pid;
-            console.log('Set productId');
-        }
-        if (args.ec2){
-            manifest.RecommendedInstanceType = args.ec2;
-            console.log('Set RecommendedInstanceType');
-        }
-        await putManifest(s3, bucket, appPrefix, manifest);
-        console.log('Updated manifest');
+    if (args.assets){
+        await applyAssets(s3, bucket, appPrefix, cfg.region, args.assets, manifest);
     }
-
-    // Replace the CI role trust policy with one for the updated repo
-    if (args.repo){
-        await updateRepoTrust(appName, args.repo);
+    if (args.pid){
+        manifest.productId = args.pid;
+        console.log('Set productId');
+    }
+    if (args.ec2){
+        manifest.RecommendedInstanceType = args.ec2;
+        console.log('Set RecommendedInstanceType');
     }
+    await putManifest(s3, bucket, appPrefix, manifest);
+    console.log('Updated manifest');
     return true;
 }
 
@@ -125,28 +115,6 @@ async function applyAssets(s3, bucket, appPrefix, region, assetsPath, manifest){
     }
 }
 
-async function updateRepoTrust(appName, repo){
-    if (!/^[\w.-]+\/[\w.-]+$/.test(repo)){ throw new Error('Invalid repo. Use org/repo format') }
-    const roleName = `mason-gha-${appName}`;
-    const iam = new IAMClient({ region: 'us-east-1' });
-    const sts = new STSClient({ region: 'us-east-1' });
-
-    try {
-        await iam.send(new GetRoleCommand({ RoleName: roleName }));
-    } catch (e){
-        if (/NoSuchEntity/.test(e)){ throw new Error(`No CI role ${roleName} found. Run new-app with -repo first`) }
-        throw e;
-    }
-
-    const accountId = (await sts.send(new GetCallerIdentityCommand({}))).Account;
-    const oidcArn = `arn:aws:iam::${accountId}:oidc-provider/token.actions.githubusercontent.com`;
-    await iam.send(new UpdateAssumeRolePolicyCommand({
-        RoleName: roleName,
-        PolicyDocument: JSON.stringify(githubTrustPolicy(oidcArn, repo))
-    }));
-    console.log(`Updated ${roleName} trust policy to repo ${repo}`);
-}
-
 async function putManifest(s3, bucket, appPrefix, manifest){
     await s3.send(new PutObjectCommand({
         Bucket: bucket,

package/main.js

@@ -27,7 +27,6 @@ const Commands = {
         exec: require('./commands/new_app').main,
         args: [
             {n: 'name', desc: 'Application name (letters only)', pattern: `^[A-Za-z]{2,20}$`, r: true},
-            {n: 'repo', desc: 'GitHub repo (org/repo). Creates a CI role assumable by GitHub Actions from that repo', r: false},
             {n: 'noami', desc: 'Serverless app: update-app skips the AMI build and launch passes no AmiId', r: false},
             {n: 'private', desc: 'Store the app under a private _ folder (not publicly accessible)', r: false}
         ]
@@ -39,8 +38,16 @@ const Commands = {
             {n: 'app', desc: 'Name of existing app', pattern: `^[A-Za-z]{2,20}$`, r: true},
             {n: 'assets', desc: 'Path to folder with application assets', r: false},
             {n: 'pid', desc: 'AWS Product ID', r: false},
-            {n: 'ec2', desc: 'Instance type (default r8g.medium)', r: false},
-            {n: 'repo', desc: 'GitHub repo (org/repo). Replaces the CI role trust policy with this repo', r: false}
+            {n: 'ec2', desc: 'Instance type (default r8g.medium)', r: false}
+        ]
+    },
+    'set-repo': {
+        desc: 'Create/update the GitHub Actions CI role: repo trust + permissions derived from the stack template',
+        exec: require('./commands/set_repo').main,
+        args: [
+            {n: 'app', desc: 'Name of existing app', pattern: `^[A-Za-z]{2,20}$`, r: true},
+            {n: 'repo', desc: 'GitHub repo (org/repo) allowed to assume the role', r: true},
+            {n: 'stack', desc: 'Path to stack template for permission derivation (default: latest version stack in s3)', r: false}
         ]
     },
     'update-assets': {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudmason2",
-  "version": "1.7.9",
+  "version": "1.8.0",
   "description": "",
   "main": "main.js",
   "files": [