cloudmason2 1.8.0 → 2.0.0

package/commands/publish.js

@@ -51,7 +51,8 @@ exports.main = async function(args){
     const stackText = await getFileText(s3, bucket, stackKey);
     if (stackText === null){ throw new Error('No stack found for v' + fullVersion) }
 
-    const amiAlias = `resolve:ssm:/aws/service/marketplace/${manifest.productId}/${fullVersion}`;
+    // Marketplace lowercases the version title in the SSM alias parameter name
+    const amiAlias = `resolve:ssm:/aws/service/marketplace/${manifest.productId}/${fullVersion.toLowerCase()}`;
     const upgradeText = buildUpgradeTemplate(stackText, amiAlias);
     const upgradeKey = `${appPrefix}/versions/${vFolder}/upgrade.yaml`;
     await s3.send(new PutObjectCommand({ Bucket: bucket, Key: upgradeKey, Body: upgradeText, ContentType: Mime.contentType(upgradeKey) }));

package/commands/set_repo.js

@@ -2,7 +2,7 @@ const fs = require('fs');
 const path = require('path');
 const { S3Client, GetObjectCommand } = require("@aws-sdk/client-s3");
 const { CloudFormationClient, GetTemplateSummaryCommand, DescribeTypeCommand } = require("@aws-sdk/client-cloudformation");
-const { IAMClient, GetRoleCommand, CreateRoleCommand, PutRolePolicyCommand, UpdateAssumeRolePolicyCommand, GetOpenIDConnectProviderCommand, CreateOpenIDConnectProviderCommand } = require("@aws-sdk/client-iam");
+const { IAMClient, GetRoleCommand, CreateRoleCommand, UpdateRoleCommand, PutRolePolicyCommand, UpdateAssumeRolePolicyCommand, GetOpenIDConnectProviderCommand, CreateOpenIDConnectProviderCommand } = require("@aws-sdk/client-iam");
 const { STSClient, GetCallerIdentityCommand } = require("@aws-sdk/client-sts");
 const OrgConfig = require('./helpers/org_config');
 const Apps = require('./helpers/apps');
@@ -10,6 +10,10 @@ const Apps = require('./helpers/apps');
 // Inline role policies cap at 10240 chars; collapse derived actions if we get close
 const POLICY_CHAR_LIMIT = 10000;
 
+// 4h sessions (AWS allows up to 12h): publish -await can poll the marketplace
+// change set for 90m+, which outlives the 1h default
+const MAX_SESSION_SECONDS = 14400;
+
 // set-repo: create or update the app's GitHub Actions CI role. Sets the trust
 // policy to the given repo and derives the stack template's required permissions
 // from the CloudFormation registry. Run locally under elevated permissions -
@@ -68,13 +72,17 @@ exports.main = async function(args){
             RoleName: roleName,
             PolicyDocument: JSON.stringify(trustPolicy)
         }));
+        if (existing.Role.MaxSessionDuration !== MAX_SESSION_SECONDS){
+            await iam.send(new UpdateRoleCommand({ RoleName: roleName, MaxSessionDuration: MAX_SESSION_SECONDS }));
+        }
         console.log(`Updated ${roleName} trust to repo ${args.repo}`);
     } catch (e){
         if (!/NoSuchEntity/.test(e)){ throw e }
         const created = await iam.send(new CreateRoleCommand({
             RoleName: roleName,
             AssumeRolePolicyDocument: JSON.stringify(trustPolicy),
-            Description: `Mason CI role for ${appName} (github.com/${args.repo})`
+            Description: `Mason CI role for ${appName} (github.com/${args.repo})`,
+            MaxSessionDuration: MAX_SESSION_SECONDS
         }));
         roleArn = created.Role.Arn;
         console.log(`Created role ${roleName} for repo ${args.repo}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudmason2",
-  "version": "1.8.0",
+  "version": "2.0.0",
   "description": "",
   "main": "main.js",
   "files": [