sst 2.14.0 → 2.16.0

package/cdk/cloudformation-deployments.js

@@ -1,267 +0,0 @@
-// Copied from https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk/lib/api/cloudformation-deployments.ts
-import * as cxapi from "@aws-cdk/cx-api";
-import { AssetManifest } from "cdk-assets";
-import { debug, warning } from "sst-aws-cdk/lib/logging.js";
-import { buildAssets, publishAssets, } from "sst-aws-cdk/lib/util/asset-publishing.js";
-import { Mode } from "sst-aws-cdk/lib/api/aws-auth/credentials.js";
-import { deployStack, destroyStack, makeBodyParameterAndUpload, } from "./deploy-stack.js";
-import { loadCurrentTemplateWithNestedStacks, loadCurrentTemplate, } from "sst-aws-cdk/lib/api/nested-stack-helpers.js";
-import { ToolkitInfo } from "sst-aws-cdk/lib/api/toolkit-info.js";
-import { CloudFormationStack, } from "sst-aws-cdk/lib/api/util/cloudformation.js";
-import { replaceEnvPlaceholders } from "sst-aws-cdk/lib/api/util/placeholders.js";
-import { callWithRetry } from "./util.js";
-/**
- * Try to use the bootstrap lookupRole. There are two scenarios that are handled here
- *  1. The lookup role may not exist (it was added in bootstrap stack version 7)
- *  2. The lookup role may not have the correct permissions (ReadOnlyAccess was added in
- *      bootstrap stack version 8)
- *
- * In the case of 1 (lookup role doesn't exist) `forEnvironment` will either:
- *   1. Return the default credentials if the default credentials are for the stack account
- *   2. Throw an error if the default credentials are not for the stack account.
- *
- * If we successfully assume the lookup role we then proceed to 2 and check whether the bootstrap
- * stack version is valid. If it is not we throw an error which should be handled in the calling
- * function (and fallback to use a different role, etc)
- *
- * If we do not successfully assume the lookup role, but do get back the default credentials
- * then return those and note that we are returning the default credentials. The calling
- * function can then decide to use them or fallback to another role.
- */
-export async function prepareSdkWithLookupRoleFor(sdkProvider, stack) {
-    const resolvedEnvironment = await sdkProvider.resolveEnvironment(stack.environment);
-    // Substitute any placeholders with information about the current environment
-    const arns = await replaceEnvPlaceholders({
-        lookupRoleArn: stack.lookupRole?.arn,
-    }, resolvedEnvironment, sdkProvider);
-    // try to assume the lookup role
-    const warningMessage = `Could not assume ${arns.lookupRoleArn}, proceeding anyway.`;
-    const upgradeMessage = `(To get rid of this warning, please upgrade to bootstrap version >= ${stack.lookupRole?.requiresBootstrapStackVersion})`;
-    try {
-        const stackSdk = await sdkProvider.forEnvironment(resolvedEnvironment, Mode.ForReading, {
-            assumeRoleArn: arns.lookupRoleArn,
-            assumeRoleExternalId: stack.lookupRole?.assumeRoleExternalId,
-        });
-        // if we succeed in assuming the lookup role, make sure we have the correct bootstrap stack version
-        if (stackSdk.didAssumeRole &&
-            stack.lookupRole?.bootstrapStackVersionSsmParameter &&
-            stack.lookupRole.requiresBootstrapStackVersion) {
-            const version = await ToolkitInfo.versionFromSsmParameter(stackSdk.sdk, stack.lookupRole.bootstrapStackVersionSsmParameter);
-            if (version < stack.lookupRole.requiresBootstrapStackVersion) {
-                throw new Error(`Bootstrap stack version '${stack.lookupRole.requiresBootstrapStackVersion}' is required, found version '${version}'.`);
-            }
-            // we may not have assumed the lookup role because one was not provided
-            // if that is the case then don't print the upgrade warning
-        }
-        else if (!stackSdk.didAssumeRole &&
-            stack.lookupRole?.requiresBootstrapStackVersion) {
-            warning(upgradeMessage);
-        }
-        return { ...stackSdk, resolvedEnvironment };
-    }
-    catch (e) {
-        debug(e);
-        // only print out the warnings if the lookupRole exists AND there is a required
-        // bootstrap version, otherwise the warnings will print `undefined`
-        if (stack.lookupRole && stack.lookupRole.requiresBootstrapStackVersion) {
-            warning(warningMessage);
-            warning(upgradeMessage);
-        }
-        throw e;
-    }
-}
-/**
- * Helper class for CloudFormation deployments
- *
- * Looks us the right SDK and Bootstrap stack to deploy a given
- * stack artifact.
- */
-export class CloudFormationDeployments {
-    sdkProvider;
-    constructor(props) {
-        this.sdkProvider = props.sdkProvider;
-    }
-    async readCurrentTemplateWithNestedStacks(rootStackArtifact, retrieveProcessedTemplate = false) {
-        const sdk = (await this.prepareSdkWithLookupOrDeployRole(rootStackArtifact))
-            .stackSdk;
-        return (await loadCurrentTemplateWithNestedStacks(rootStackArtifact, sdk, retrieveProcessedTemplate)).deployedTemplate;
-    }
-    async readCurrentTemplate(stackArtifact) {
-        debug(`Reading existing template for stack ${stackArtifact.displayName}.`);
-        const sdk = (await this.prepareSdkWithLookupOrDeployRole(stackArtifact))
-            .stackSdk;
-        return loadCurrentTemplate(stackArtifact, sdk);
-    }
-    async resourceIdentifierSummaries(stackArtifact, toolkitStackName) {
-        debug(`Retrieving template summary for stack ${stackArtifact.displayName}.`);
-        // Currently, needs to use `deploy-role` since it may need to read templates in the staging
-        // bucket which have been encrypted with a KMS key (and lookup-role may not read encrypted things)
-        const { stackSdk, resolvedEnvironment } = await this.prepareSdkFor(stackArtifact, undefined, Mode.ForReading);
-        const cfn = stackSdk.cloudFormation();
-        const toolkitInfo = await ToolkitInfo.lookup(resolvedEnvironment, stackSdk, toolkitStackName);
-        // Upload the template, if necessary, before passing it to CFN
-        const cfnParam = await makeBodyParameterAndUpload(stackArtifact, resolvedEnvironment, toolkitInfo, this.sdkProvider, stackSdk);
-        const response = await cfn.getTemplateSummary(cfnParam).promise();
-        if (!response.ResourceIdentifierSummaries) {
-            debug('GetTemplateSummary API call did not return "ResourceIdentifierSummaries"');
-        }
-        return response.ResourceIdentifierSummaries ?? [];
-    }
-    async deployStack(options) {
-        let deploymentMethod = options.deploymentMethod;
-        if (options.changeSetName || options.execute !== undefined) {
-            if (deploymentMethod) {
-                throw new Error("You cannot supply both 'deploymentMethod' and 'changeSetName/execute'. Supply one or the other.");
-            }
-            deploymentMethod = {
-                method: "change-set",
-                changeSetName: options.changeSetName,
-                execute: options.execute,
-            };
-        }
-        const { stackSdk, resolvedEnvironment, cloudFormationRoleArn } = await this.prepareSdkFor(options.stack, options.roleArn);
-        const toolkitInfo = await callWithRetry(() => ToolkitInfo.lookup(resolvedEnvironment, stackSdk, options.toolkitStackName));
-        // Publish any assets before doing the actual deploy (do not publish any assets on import operation)
-        if (options.resourcesToImport === undefined) {
-            await this.publishStackAssets(options.stack, toolkitInfo, {
-                buildAssets: options.buildAssets ?? true,
-                publishOptions: {
-                    quiet: options.quiet,
-                    parallel: options.assetParallelism,
-                },
-            });
-        }
-        // Do a verification of the bootstrap stack version
-        await this.validateBootstrapStackVersion(options.stack.stackName, options.stack.requiresBootstrapStackVersion, options.stack.bootstrapStackVersionSsmParameter, toolkitInfo);
-        return deployStack({
-            stack: options.stack,
-            noMonitor: true,
-            resolvedEnvironment,
-            deployName: options.deployName,
-            notificationArns: options.notificationArns,
-            quiet: options.quiet,
-            sdk: stackSdk,
-            sdkProvider: this.sdkProvider,
-            roleArn: cloudFormationRoleArn,
-            reuseAssets: options.reuseAssets,
-            toolkitInfo,
-            tags: options.tags,
-            deploymentMethod,
-            force: options.force,
-            parameters: options.parameters,
-            usePreviousParameters: options.usePreviousParameters,
-            progress: options.progress,
-            ci: options.ci,
-            rollback: options.rollback,
-            hotswap: options.hotswap,
-            extraUserAgent: options.extraUserAgent,
-            resourcesToImport: options.resourcesToImport,
-            overrideTemplate: options.overrideTemplate,
-            assetParallelism: options.assetParallelism,
-        });
-    }
-    async destroyStack(options) {
-        const { stackSdk, cloudFormationRoleArn: roleArn } = await this.prepareSdkFor(options.stack, options.roleArn);
-        return destroyStack({
-            sdk: stackSdk,
-            roleArn,
-            stack: options.stack,
-            deployName: options.deployName,
-            quiet: options.quiet,
-            ci: options.ci,
-        });
-    }
-    async stackExists(options) {
-        const { stackSdk } = await this.prepareSdkFor(options.stack, undefined, Mode.ForReading);
-        const stack = await CloudFormationStack.lookup(stackSdk.cloudFormation(), options.deployName ?? options.stack.stackName);
-        return stack.exists;
-    }
-    async prepareSdkWithLookupOrDeployRole(stackArtifact) {
-        // try to assume the lookup role
-        try {
-            const result = await prepareSdkWithLookupRoleFor(this.sdkProvider, stackArtifact);
-            if (result.didAssumeRole) {
-                return {
-                    resolvedEnvironment: result.resolvedEnvironment,
-                    stackSdk: result.sdk,
-                };
-            }
-        }
-        catch { }
-        // fall back to the deploy role
-        return this.prepareSdkFor(stackArtifact, undefined, Mode.ForReading);
-    }
-    /**
-     * Get the environment necessary for touching the given stack
-     *
-     * Returns the following:
-     *
-     * - The resolved environment for the stack (no more 'unknown-account/unknown-region')
-     * - SDK loaded with the right credentials for calling `CreateChangeSet`.
-     * - The Execution Role that should be passed to CloudFormation.
-     */
-    async prepareSdkFor(stack, roleArn, mode = Mode.ForWriting) {
-        if (!stack.environment) {
-            throw new Error(`The stack ${stack.displayName} does not have an environment`);
-        }
-        const resolvedEnvironment = await this.sdkProvider.resolveEnvironment(stack.environment);
-        // Substitute any placeholders with information about the current environment
-        const arns = await replaceEnvPlaceholders({
-            assumeRoleArn: stack.assumeRoleArn,
-            // Use the override if given, otherwise use the field from the stack
-            cloudFormationRoleArn: roleArn ?? stack.cloudFormationExecutionRoleArn,
-        }, resolvedEnvironment, this.sdkProvider);
-        const stackSdk = await this.sdkProvider.forEnvironment(resolvedEnvironment, mode, {
-            assumeRoleArn: arns.assumeRoleArn,
-            assumeRoleExternalId: stack.assumeRoleExternalId,
-        });
-        return {
-            stackSdk: stackSdk.sdk,
-            resolvedEnvironment,
-            cloudFormationRoleArn: arns.cloudFormationRoleArn,
-        };
-    }
-    /**
-     * Build a stack's assets.
-     */
-    async buildStackAssets(options) {
-        const { stackSdk, resolvedEnvironment } = await this.prepareSdkFor(options.stack, options.roleArn);
-        const toolkitInfo = await ToolkitInfo.lookup(resolvedEnvironment, stackSdk, options.toolkitStackName);
-        const stackEnv = await this.sdkProvider.resolveEnvironment(options.stack.environment);
-        const assetArtifacts = options.stack.dependencies.filter(cxapi.AssetManifestArtifact.isAssetManifestArtifact);
-        for (const assetArtifact of assetArtifacts) {
-            await this.validateBootstrapStackVersion(options.stack.stackName, assetArtifact.requiresBootstrapStackVersion, assetArtifact.bootstrapStackVersionSsmParameter, toolkitInfo);
-            const manifest = AssetManifest.fromFile(assetArtifact.file);
-            await buildAssets(manifest, this.sdkProvider, stackEnv, options.buildOptions);
-        }
-    }
-    /**
-     * Publish all asset manifests that are referenced by the given stack
-     */
-    async publishStackAssets(stack, toolkitInfo, options = {}) {
-        const stackEnv = await this.sdkProvider.resolveEnvironment(stack.environment);
-        const assetArtifacts = stack.dependencies.filter(cxapi.AssetManifestArtifact.isAssetManifestArtifact);
-        for (const assetArtifact of assetArtifacts) {
-            await this.validateBootstrapStackVersion(stack.stackName, assetArtifact.requiresBootstrapStackVersion, assetArtifact.bootstrapStackVersionSsmParameter, toolkitInfo);
-            const manifest = AssetManifest.fromFile(assetArtifact.file);
-            await publishAssets(manifest, this.sdkProvider, stackEnv, {
-                ...options.publishOptions,
-                buildAssets: options.buildAssets ?? true,
-            });
-        }
-    }
-    /**
-     * Validate that the bootstrap stack has the right version for this stack
-     */
-    async validateBootstrapStackVersion(stackName, requiresBootstrapStackVersion, bootstrapStackVersionSsmParameter, toolkitInfo) {
-        if (requiresBootstrapStackVersion === undefined) {
-            return;
-        }
-        try {
-            await toolkitInfo.validateVersion(requiresBootstrapStackVersion, bootstrapStackVersionSsmParameter);
-        }
-        catch (e) {
-            throw new Error(`${stackName}: ${e.message}`);
-        }
-    }
-}