geni-bioinfo 0.1.0

package/dist/templates/setup.yaml

@@ -0,0 +1,503 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: GENI - Cross-account IAM setup
+
+Parameters:
+  GeniAccount:
+    Type: String
+    Description: AWS account ID of the GENI account that will assume the cross-account role
+
+Resources:
+  GeniCrossAccountRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: GeniCrossAccountRole
+      Description: Cross-account role for GENI to manage CloudFormation stacks
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              AWS: !Sub 'arn:aws:iam::${GeniAccount}:root'
+            Action: sts:AssumeRole
+      Tags:
+        - Key: CreatedBy
+          Value: GENI
+        - Key: GeniName
+          Value: GeniCrossAccountRole
+        - Key: GeniStack
+          Value: !Sub '${AWS::StackName}'
+
+  GeniCrossAccountPolicy:
+    Type: AWS::IAM::ManagedPolicy
+    Properties:
+      ManagedPolicyName: GeniCrossAccountPolicy
+      Description: Permissions policy for GENI app role (CloudFormation management)
+      Roles:
+        - !Ref GeniCrossAccountRole
+      PolicyDocument: !Sub |
+        {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "CFNCreateWithTag",
+              "Effect": "Allow",
+              "Action": ["cloudformation:CreateStack"],
+              "Resource": "*",
+              "Condition": {
+                "StringEquals": { "aws:RequestTag/CreatedBy": "GENI" }
+              }
+            },
+            {
+              "Sid": "CFNManageTagged",
+              "Effect": "Allow",
+              "Action": [
+                "cloudformation:UpdateStack",
+                "cloudformation:DeleteStack",
+                "cloudformation:TagResource"
+              ],
+              "Resource": "*",
+              "Condition": {
+                "StringEquals": { "aws:ResourceTag/CreatedBy": "GENI" }
+              }
+            },
+            {
+              "Sid": "CFNReadOnly",
+              "Effect": "Allow",
+              "Action": [
+                "cloudformation:DescribeStacks",
+                "cloudformation:DescribeStackEvents",
+                "cloudformation:GetTemplate",
+                "cloudformation:ListStacks"
+              ],
+              "Resource": "*"
+            },
+            {
+              "Sid": "EC2DescribeAZs",
+              "Effect": "Allow",
+              "Action": ["ec2:DescribeAvailabilityZones"],
+              "Resource": "*"
+            },
+            {
+              "Sid": "IAMPassCfnServiceRole",
+              "Effect": "Allow",
+              "Action": ["iam:PassRole"],
+              "Resource": "arn:aws:iam::*:role/GeniCfnServiceRole"
+            },
+            {
+              "Sid": "BatchOperations",
+              "Effect": "Allow",
+              "Action": ["batch:SubmitJob", "batch:DescribeJobs", "batch:TerminateJob"],
+              "Resource": "*"
+            },
+            {
+              "Sid": "ECSDescribe",
+              "Effect": "Allow",
+              "Action": ["ecs:DescribeContainerInstances"],
+              "Resource": "*"
+            },
+            {
+              "Sid": "EC2Describe",
+              "Effect": "Allow",
+              "Action": [
+                "ec2:DescribeInstances",
+                "ec2:DescribeVolumes",
+                "ec2:DescribeSpotPriceHistory"
+              ],
+              "Resource": "*"
+            },
+            {
+              "Sid": "LogsRead",
+              "Effect": "Allow",
+              "Action": ["logs:GetLogEvents", "logs:DescribeLogStreams"],
+              "Resource": "arn:aws:logs:*:*:log-group:/aws/batch/job/*"
+            },
+            {
+              "Sid": "SQSPoll",
+              "Effect": "Allow",
+              "Action": [
+                "sqs:ReceiveMessage",
+                "sqs:DeleteMessage",
+                "sqs:GetQueueAttributes"
+              ],
+              "Resource": [
+                "arn:aws:sqs:*:*:geni-queue-batch-*",
+                "arn:aws:sqs:*:*:geni-queue-instance-*"
+              ]
+            }
+          ]
+        }
+
+  GeniCfnServiceRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: GeniCfnServiceRole
+      Description: CloudFormation service role for GENI resource provisioning
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: cloudformation.amazonaws.com
+            Action: sts:AssumeRole
+      Tags:
+        - Key: CreatedBy
+          Value: GENI
+        - Key: GeniName
+          Value: GeniCfnServiceRole
+        - Key: GeniStack
+          Value: !Sub '${AWS::StackName}'
+
+  GeniCfnServicePolicy:
+    Type: AWS::IAM::ManagedPolicy
+    Properties:
+      ManagedPolicyName: GeniCfnServicePolicy
+      Description: Permissions policy for GENI CloudFormation service role (resource creation)
+      Roles:
+        - !Ref GeniCfnServiceRole
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Sid: S3Manage
+            Effect: Allow
+            Action:
+              - s3:CreateBucket
+              - s3:DeleteBucket
+              - s3:PutBucketTagging
+              - s3:PutBucketPolicy
+              - s3:DeleteBucketPolicy
+            Resource: arn:aws:s3:::geni-*
+          - Sid: S3ReadOnly
+            Effect: Allow
+            Action:
+              - s3:ListBucket
+              - s3:GetObject
+              - s3:GetBucketLocation
+              - s3:GetBucketTagging
+              - s3:PutObject
+              - s3:DeleteObject
+            Resource:
+              - arn:aws:s3:::geni-*
+              - arn:aws:s3:::geni-*/*
+          - Sid: IAMManage
+            Effect: Allow
+            Action:
+              - iam:CreateRole
+              - iam:CreatePolicy
+              - iam:CreateInstanceProfile
+              - iam:TagRole
+              - iam:TagPolicy
+              - iam:TagInstanceProfile
+              - iam:AddRoleToInstanceProfile
+              - iam:RemoveRoleFromInstanceProfile
+              - iam:DeleteRole
+              - iam:UpdateRole
+              - iam:UpdateAssumeRolePolicy
+              - iam:AttachRolePolicy
+              - iam:DetachRolePolicy
+              - iam:PutRolePolicy
+              - iam:DeleteRolePolicy
+              - iam:PassRole
+              - iam:DeletePolicy
+              - iam:CreatePolicyVersion
+              - iam:DeletePolicyVersion
+              - iam:DeleteInstanceProfile
+            Resource: '*'
+          - Sid: IAMReadOnly
+            Effect: Allow
+            Action:
+              - iam:ListRoles
+              - iam:ListPolicies
+              - iam:ListPolicyVersions
+              - iam:ListAttachedRolePolicies
+              - iam:ListRolePolicies
+              - iam:ListInstanceProfiles
+              - iam:ListInstanceProfilesForRole
+              - iam:GetRole
+              - iam:GetRolePolicy
+              - iam:GetPolicy
+              - iam:GetPolicyVersion
+              - iam:GetInstanceProfile
+            Resource: '*'
+          - Sid: IAMServiceLinkedRoles
+            Effect: Allow
+            Action: iam:CreateServiceLinkedRole
+            Resource: '*'
+            Condition:
+              StringEquals:
+                iam:AWSServiceName:
+                  - elasticloadbalancing.amazonaws.com
+                  - batch.amazonaws.com
+                  - ecs.amazonaws.com
+
+  GeniCfnComputePolicy:
+    Type: AWS::IAM::ManagedPolicy
+    Properties:
+      ManagedPolicyName: GeniCfnComputePolicy
+      Description: Compute permissions for GENI CloudFormation service role
+      Roles:
+        - !Ref GeniCfnServiceRole
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Sid: BatchManage
+            Effect: Allow
+            Action:
+              - batch:CreateComputeEnvironment
+              - batch:UpdateComputeEnvironment
+              - batch:DeleteComputeEnvironment
+              - batch:CreateJobQueue
+              - batch:UpdateJobQueue
+              - batch:DeleteJobQueue
+              - batch:RegisterJobDefinition
+              - batch:DeregisterJobDefinition
+              - batch:TagResource
+              - batch:SubmitJob
+              - batch:TerminateJob
+              - batch:CancelJob
+            Resource: '*'
+          - Sid: BatchReadOnly
+            Effect: Allow
+            Action:
+              - batch:DescribeComputeEnvironments
+              - batch:DescribeJobQueues
+              - batch:DescribeJobDefinitions
+              - batch:DescribeJobs
+              - batch:ListJobs
+              - batch:ListTagsForResource
+            Resource: '*'
+          - Sid: EC2Manage
+            Effect: Allow
+            Action:
+              - ec2:CreateLaunchTemplate
+              - ec2:DeleteLaunchTemplate
+              - ec2:RunInstances
+              - ec2:TerminateInstances
+              - ec2:CreateTags
+            Resource: '*'
+          - Sid: EC2ReadOnly
+            Effect: Allow
+            Action:
+              - ec2:DescribeAccountAttributes
+              - ec2:DescribeInstances
+              - ec2:DescribeInstanceTypes
+              - ec2:DescribeInstanceAttribute
+              - ec2:DescribeInstanceStatus
+              - ec2:DescribeLaunchTemplates
+              - ec2:DescribeLaunchTemplateVersions
+              - ec2:DescribeSecurityGroups
+              - ec2:DescribeSubnets
+              - ec2:DescribeVpcs
+              - ec2:DescribeKeyPairs
+              - ec2:DescribeImages
+              - ec2:DescribeAvailabilityZones
+              - ec2:DescribeNatGateways
+              - ec2:DescribeRouteTables
+              - ec2:DescribeInternetGateways
+              - ec2:DescribeAddresses
+              - ec2:DescribeVpcEndpoints
+            Resource: '*'
+          - Sid: ECSManage
+            Effect: Allow
+            Action:
+              - ecs:CreateCluster
+              - ecs:DeleteCluster
+              - ecs:RegisterTaskDefinition
+              - ecs:DeregisterTaskDefinition
+              - ecs:CreateService
+              - ecs:DeleteService
+              - ecs:UpdateService
+              - ecs:TagResource
+              - ecs:UntagResource
+            Resource: '*'
+          - Sid: ECSReadOnly
+            Effect: Allow
+            Action:
+              - ecs:DescribeClusters
+              - ecs:DescribeContainerInstances
+              - ecs:DescribeServices
+              - ecs:DescribeTaskDefinition
+              - ecs:DescribeTasks
+              - ecs:ListClusters
+              - ecs:ListServices
+              - ecs:ListTagsForResource
+              - ecs:ListTaskDefinitions
+            Resource: '*'
+          - Sid: AutoScalingManage
+            Effect: Allow
+            Action:
+              - autoscaling:CreateAutoScalingGroup
+              - autoscaling:UpdateAutoScalingGroup
+              - autoscaling:DeleteAutoScalingGroup
+              - autoscaling:CreateLaunchConfiguration
+              - autoscaling:DeleteLaunchConfiguration
+              - autoscaling:DescribeAutoScalingGroups
+              - autoscaling:DescribeLaunchConfigurations
+              - autoscaling:CreateOrUpdateTags
+            Resource: '*'
+
+  GeniCfnNetworkPolicy:
+    Type: AWS::IAM::ManagedPolicy
+    Properties:
+      ManagedPolicyName: GeniCfnNetworkPolicy
+      Description: Networking permissions for GENI CloudFormation service role
+      Roles:
+        - !Ref GeniCfnServiceRole
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Sid: EC2NetworkManage
+            Effect: Allow
+            Action:
+              - ec2:CreateVpc
+              - ec2:DeleteVpc
+              - ec2:ModifyVpcAttribute
+              - ec2:CreateSubnet
+              - ec2:DeleteSubnet
+              - ec2:ModifySubnetAttribute
+              - ec2:CreateInternetGateway
+              - ec2:DeleteInternetGateway
+              - ec2:AttachInternetGateway
+              - ec2:DetachInternetGateway
+              - ec2:CreateNatGateway
+              - ec2:DeleteNatGateway
+              - ec2:CreateRouteTable
+              - ec2:DeleteRouteTable
+              - ec2:CreateRoute
+              - ec2:DeleteRoute
+              - ec2:AssociateRouteTable
+              - ec2:DisassociateRouteTable
+              - ec2:CreateSecurityGroup
+              - ec2:DeleteSecurityGroup
+              - ec2:AuthorizeSecurityGroupEgress
+              - ec2:AuthorizeSecurityGroupIngress
+              - ec2:RevokeSecurityGroupEgress
+              - ec2:RevokeSecurityGroupIngress
+              - ec2:AllocateAddress
+              - ec2:ReleaseAddress
+              - ec2:CreateVpcEndpoint
+              - ec2:DeleteVpcEndpoints
+              - ec2:ModifyVpcEndpoint
+            Resource: '*'
+          - Sid: ELBManage
+            Effect: Allow
+            Action:
+              - elasticloadbalancing:CreateLoadBalancer
+              - elasticloadbalancing:DeleteLoadBalancer
+              - elasticloadbalancing:ModifyLoadBalancerAttributes
+              - elasticloadbalancing:CreateTargetGroup
+              - elasticloadbalancing:DeleteTargetGroup
+              - elasticloadbalancing:ModifyTargetGroup
+              - elasticloadbalancing:ModifyTargetGroupAttributes
+              - elasticloadbalancing:CreateListener
+              - elasticloadbalancing:DeleteListener
+              - elasticloadbalancing:ModifyListener
+              - elasticloadbalancing:RegisterTargets
+              - elasticloadbalancing:DeregisterTargets
+              - elasticloadbalancing:AddTags
+              - elasticloadbalancing:RemoveTags
+            Resource: '*'
+          - Sid: ELBReadOnly
+            Effect: Allow
+            Action:
+              - elasticloadbalancing:DescribeLoadBalancers
+              - elasticloadbalancing:DescribeLoadBalancerAttributes
+              - elasticloadbalancing:DescribeTargetGroups
+              - elasticloadbalancing:DescribeTargetGroupAttributes
+              - elasticloadbalancing:DescribeTargetHealth
+              - elasticloadbalancing:DescribeListeners
+              - elasticloadbalancing:DescribeTags
+            Resource: '*'
+          - Sid: Route53Manage
+            Effect: Allow
+            Action:
+              - route53:CreateHostedZone
+              - route53:DeleteHostedZone
+              - route53:AssociateVPCWithHostedZone
+              - route53:DisassociateVPCFromHostedZone
+              - route53:ChangeResourceRecordSets
+              - route53:ChangeTagsForResource
+            Resource: '*'
+          - Sid: Route53ReadOnly
+            Effect: Allow
+            Action:
+              - route53:GetHostedZone
+              - route53:GetChange
+              - route53:ListHostedZones
+              - route53:ListQueryLoggingConfigs
+              - route53:ListResourceRecordSets
+              - route53:ListTagsForResource
+            Resource: '*'
+
+  GeniCfnEventsPolicy:
+    Type: AWS::IAM::ManagedPolicy
+    Properties:
+      ManagedPolicyName: GeniCfnEventsPolicy
+      Description: Logs, queue, and event permissions for GENI CloudFormation service role
+      Roles:
+        - !Ref GeniCfnServiceRole
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Sid: ECRReadOnly
+            Effect: Allow
+            Action:
+              - ecr:BatchCheckLayerAvailability
+              - ecr:BatchGetImage
+              - ecr:DescribeImages
+              - ecr:DescribeRepositories
+              - ecr:GetAuthorizationToken
+              - ecr:GetDownloadUrlForLayer
+              - ecr:ListImages
+              - ecr:ListTagsForResource
+            Resource: '*'
+          - Sid: LogsManage
+            Effect: Allow
+            Action:
+              - logs:CreateLogGroup
+              - logs:DeleteLogGroup
+              - logs:CreateLogStream
+              - logs:PutLogEvents
+              - logs:PutRetentionPolicy
+              - logs:DeleteRetentionPolicy
+              - logs:DescribeLogGroups
+              - logs:DescribeLogStreams
+              - logs:GetLogEvents
+              - logs:TagResource
+              - logs:UntagResource
+              - logs:ListTagsForResource
+            Resource: '*'
+          - Sid: SQSManage
+            Effect: Allow
+            Action:
+              - sqs:CreateQueue
+              - sqs:DeleteQueue
+              - sqs:SetQueueAttributes
+              - sqs:GetQueueAttributes
+              - sqs:GetQueueUrl
+              - sqs:AddPermission
+              - sqs:RemovePermission
+              - sqs:TagQueue
+            Resource: "arn:aws:sqs:*:*:geni-queue-*"
+          - Sid: EventBridgeManage
+            Effect: Allow
+            Action:
+              - events:PutRule
+              - events:PutTargets
+              - events:DeleteRule
+              - events:RemoveTargets
+              - events:DescribeRule
+              - events:TagResource
+            Resource: '*'
+          - Sid: EventBridgeCrossAccount
+            Effect: Allow
+            Action:
+              - events:PutEvents
+            Resource:
+              - arn:aws:events:*:*:event-bus/geni-batch-events
+              - arn:aws:events:*:*:event-bus/geni-ec2-events
+
+Outputs:
+  CrossAccountRoleArn:
+    Value: !GetAtt GeniCrossAccountRole.Arn
+  CfnServiceRoleArn:
+    Value: !GetAtt GeniCfnServiceRole.Arn

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "geni-bioinfo",
+  "version": "0.1.0",
+  "description": "CLI for GENI — a control plane for running Nextflow bioinformatics pipelines on AWS",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wdesouza/geni-workflows.git",
+    "directory": "cli"
+  },
+  "homepage": "https://github.com/wdesouza/geni-workflows#readme",
+  "bugs": {
+    "url": "https://github.com/wdesouza/geni-workflows/issues"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "dist"
+  ],
+  "bin": {
+    "geni": "dist/index.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc && mkdir -p dist/templates && cp src/templates/*.yaml dist/templates/ && chmod +x dist/index.js",
+    "prepare": "npm run build",
+    "dev": "tsc -w",
+    "check": "tsc --noEmit",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "@aws-sdk/client-cloudformation": "^3.800.0",
+    "@aws-sdk/client-iam": "^3.800.0",
+    "@aws-sdk/client-s3": "^3.800.0",
+    "@aws-sdk/client-sts": "^3.800.0",
+    "@aws-sdk/credential-providers": "^3.800.0",
+    "cli-table3": "^0.6.5",
+    "commander": "^12.1.0",
+    "form-data": "^4.0.1"
+  },
+  "devDependencies": {
+    "@types/form-data": "^2.5.0",
+    "@types/node": "^24.10.1",
+    "typescript": "~5.9.3"
+  }
+}