sst 2.18.4 → 2.19.0

package/cdk/asset-publishing.d.ts

@@ -0,0 +1,74 @@
+import * as cxapi from "@aws-cdk/cx-api";
+import * as AWS from "aws-sdk";
+import * as cdk_assets from "cdk-assets";
+import { SdkProvider } from "sst-aws-cdk/lib/api/aws-auth/sdk-provider.js";
+export interface PublishAssetsOptions {
+    /**
+     * Print progress at 'debug' level
+     */
+    readonly quiet?: boolean;
+    /**
+     * Whether to build assets before publishing.
+     *
+     * @default true To remain backward compatible.
+     */
+    readonly buildAssets?: boolean;
+    /**
+     * Whether to build/publish assets in parallel
+     *
+     * @default true To remain backward compatible.
+     */
+    readonly parallel?: boolean;
+}
+/**
+ * Use cdk-assets to publish all assets in the given manifest.
+ */
+export declare function publishAssets(manifest: cdk_assets.AssetManifest, sdk: SdkProvider, targetEnv: cxapi.Environment, options?: PublishAssetsOptions): Promise<void>;
+export interface BuildAssetsOptions {
+    /**
+     * Print progress at 'debug' level
+     */
+    readonly quiet?: boolean;
+    /**
+     * Build assets in parallel
+     *
+     * @default true
+     */
+    readonly parallel?: boolean;
+}
+/**
+ * Use cdk-assets to build all assets in the given manifest.
+ */
+export declare function buildAssets(manifest: cdk_assets.AssetManifest, sdk: SdkProvider, targetEnv: cxapi.Environment, options?: BuildAssetsOptions): Promise<void>;
+export declare class PublishingAws implements cdk_assets.IAws {
+    /**
+     * The base SDK to work with
+     */
+    private readonly aws;
+    /**
+     * Environment where the stack we're deploying is going
+     */
+    private readonly targetEnv;
+    private sdkCache;
+    constructor(
+    /**
+     * The base SDK to work with
+     */
+    aws: SdkProvider, 
+    /**
+     * Environment where the stack we're deploying is going
+     */
+    targetEnv: cxapi.Environment);
+    discoverPartition(): Promise<string>;
+    discoverDefaultRegion(): Promise<string>;
+    discoverCurrentAccount(): Promise<cdk_assets.Account>;
+    discoverTargetAccount(options: cdk_assets.ClientOptions): Promise<cdk_assets.Account>;
+    s3Client(options: cdk_assets.ClientOptions): Promise<AWS.S3>;
+    ecrClient(options: cdk_assets.ClientOptions): Promise<AWS.ECR>;
+    secretsManagerClient(options: cdk_assets.ClientOptions): Promise<AWS.SecretsManager>;
+    /**
+     * Get an SDK appropriate for the given client options
+     */
+    private sdk;
+}
+export declare const EVENT_TO_LOGGER: Record<cdk_assets.EventType, (x: string) => void>;

package/cdk/asset-publishing.js

@@ -0,0 +1,147 @@
+import * as cxapi from "@aws-cdk/cx-api";
+import * as cdk_assets from "cdk-assets";
+// TODO: remove after PR is merged
+import { AssetPublishing } from "../cdk-assets/publishing.js";
+import { Mode } from "sst-aws-cdk/lib/api/aws-auth/credentials.js";
+import { debug, error, print } from "sst-aws-cdk/lib/logging.js";
+/**
+ * Use cdk-assets to publish all assets in the given manifest.
+ */
+export async function publishAssets(manifest, sdk, targetEnv, options = {}) {
+    // This shouldn't really happen (it's a programming error), but we don't have
+    // the types here to guide us. Do an runtime validation to be super super sure.
+    if (targetEnv.account === undefined ||
+        targetEnv.account === cxapi.UNKNOWN_ACCOUNT ||
+        targetEnv.region === undefined ||
+        targetEnv.account === cxapi.UNKNOWN_REGION) {
+        throw new Error(`Asset publishing requires resolved account and region, got ${JSON.stringify(targetEnv)}`);
+    }
+    const publisher = new AssetPublishing(manifest, {
+        aws: new PublishingAws(sdk, targetEnv),
+        progressListener: new PublishingProgressListener(options.quiet ?? false),
+        throwOnError: false,
+        publishInParallel: options.parallel ?? true,
+        buildAssets: options.buildAssets ?? true,
+        publishAssets: true,
+        // TODO: remove after PR is merged
+        quiet: options.quiet,
+    });
+    await publisher.publish();
+    if (publisher.hasFailures) {
+        console.log(publisher.failures);
+        throw new Error("Failed to publish one or more assets. See the error messages above for more information.");
+    }
+}
+/**
+ * Use cdk-assets to build all assets in the given manifest.
+ */
+export async function buildAssets(manifest, sdk, targetEnv, options = {}) {
+    // This shouldn't really happen (it's a programming error), but we don't have
+    // the types here to guide us. Do an runtime validation to be super super sure.
+    if (targetEnv.account === undefined ||
+        targetEnv.account === cxapi.UNKNOWN_ACCOUNT ||
+        targetEnv.region === undefined ||
+        targetEnv.account === cxapi.UNKNOWN_REGION) {
+        throw new Error(`Asset building requires resolved account and region, got ${JSON.stringify(targetEnv)}`);
+    }
+    const publisher = new cdk_assets.AssetPublishing(manifest, {
+        aws: new PublishingAws(sdk, targetEnv),
+        progressListener: new PublishingProgressListener(options.quiet ?? false),
+        throwOnError: false,
+        publishInParallel: options.parallel ?? true,
+        buildAssets: true,
+        publishAssets: false,
+    });
+    await publisher.publish();
+    if (publisher.hasFailures) {
+        throw new Error("Failed to build one or more assets. See the error messages above for more information.");
+    }
+}
+export class PublishingAws {
+    aws;
+    targetEnv;
+    sdkCache = new Map();
+    constructor(
+    /**
+     * The base SDK to work with
+     */
+    aws, 
+    /**
+     * Environment where the stack we're deploying is going
+     */
+    targetEnv) {
+        this.aws = aws;
+        this.targetEnv = targetEnv;
+    }
+    async discoverPartition() {
+        return ((await this.aws.baseCredentialsPartition(this.targetEnv, Mode.ForWriting)) ?? "aws");
+    }
+    async discoverDefaultRegion() {
+        return this.targetEnv.region;
+    }
+    async discoverCurrentAccount() {
+        const account = await this.aws.defaultAccount();
+        return (account ?? {
+            accountId: "<unknown account>",
+            partition: "aws",
+        });
+    }
+    async discoverTargetAccount(options) {
+        return (await this.sdk(options)).currentAccount();
+    }
+    async s3Client(options) {
+        return (await this.sdk(options)).s3();
+    }
+    async ecrClient(options) {
+        return (await this.sdk(options)).ecr();
+    }
+    async secretsManagerClient(options) {
+        return (await this.sdk(options)).secretsManager();
+    }
+    /**
+     * Get an SDK appropriate for the given client options
+     */
+    async sdk(options) {
+        const env = {
+            ...this.targetEnv,
+            region: options.region ?? this.targetEnv.region, // Default: same region as the stack
+        };
+        const cacheKey = JSON.stringify({
+            env,
+            assumeRuleArn: options.assumeRoleArn,
+            assumeRoleExternalId: options.assumeRoleExternalId,
+            quiet: options.quiet,
+        });
+        const maybeSdk = this.sdkCache.get(cacheKey);
+        if (maybeSdk) {
+            return maybeSdk;
+        }
+        const sdk = (await this.aws.forEnvironment(env, Mode.ForWriting, {
+            assumeRoleArn: options.assumeRoleArn,
+            assumeRoleExternalId: options.assumeRoleExternalId,
+        }, options.quiet)).sdk;
+        this.sdkCache.set(cacheKey, sdk);
+        return sdk;
+    }
+}
+export const EVENT_TO_LOGGER = {
+    build: debug,
+    cached: debug,
+    check: debug,
+    debug,
+    fail: error,
+    found: debug,
+    start: print,
+    success: print,
+    upload: debug,
+};
+class PublishingProgressListener {
+    quiet;
+    constructor(quiet) {
+        this.quiet = quiet;
+    }
+    onPublishEvent(type, event) {
+        const handler = this.quiet && type !== "fail" ? debug : EVENT_TO_LOGGER[type];
+        handler(`[${event.percentComplete}%] ${type}: ${event.message}`);
+    }
+}

package/cdk/deployments.d.ts

@@ -1,7 +1,7 @@
 import * as cxapi from "@aws-cdk/cx-api";
 import { AssetManifest, IManifestEntry } from "cdk-assets";
 import { Tag } from "sst-aws-cdk/lib/cdk-toolkit.js";
-import { BuildAssetsOptions, PublishAssetsOptions } from "sst-aws-cdk/lib/util/asset-publishing.js";
+import { BuildAssetsOptions, PublishAssetsOptions } from "./asset-publishing.js";
 import { Mode } from "sst-aws-cdk/lib/api/aws-auth/credentials.js";
 import { ISDK } from "sst-aws-cdk/lib/api/aws-auth/sdk.js";
 import { SdkProvider } from "sst-aws-cdk/lib/api/aws-auth/sdk-provider.js";

package/cdk/deployments.js

@@ -3,7 +3,7 @@ import * as cxapi from "@aws-cdk/cx-api";
 import * as cdk_assets from "cdk-assets";
 import { AssetManifest } from "cdk-assets";
 import { debug, warning } from "sst-aws-cdk/lib/logging.js";
-import { buildAssets, publishAssets, PublishingAws, EVENT_TO_LOGGER, } from "sst-aws-cdk/lib/util/asset-publishing.js";
+import { buildAssets, publishAssets, PublishingAws, EVENT_TO_LOGGER, } from "./asset-publishing.js";
 import { Mode } from "sst-aws-cdk/lib/api/aws-auth/credentials.js";
 import { deployStack, destroyStack, makeBodyParameterAndUpload, } from "./deploy-stack.js";
 import { loadCurrentTemplateWithNestedStacks, loadCurrentTemplate, } from "sst-aws-cdk/lib/api/nested-stack-helpers.js";
@@ -72,8 +72,6 @@ export class Deployments {
         const assetArtifacts = options.stack.dependencies.filter(cxapi.AssetManifestArtifact.isAssetManifestArtifact);
         for (const asset of assetArtifacts) {
             const manifest = AssetManifest.fromFile(asset.file);
-            //await buildAssets(manifest, sdkProvider, resolvedEnvironment, {
-            //});
             await publishAssets(manifest, this.sdkProvider, resolvedEnvironment, {
                 buildAssets: true,
                 quiet: options.quiet,

package/cdk-assets/private/asset-handler.d.ts

@@ -0,0 +1,29 @@
+import { DockerFactory } from "./docker.js";
+import { IAws } from "cdk-assets/lib/aws.js";
+import { EventType } from "cdk-assets/lib/progress.js";
+/**
+ * Handler for asset building and publishing.
+ */
+export interface IAssetHandler {
+    /**
+     * Build the asset.
+     */
+    build(): Promise<void>;
+    /**
+     * Publish the asset.
+     */
+    publish(): Promise<void>;
+    /**
+     * Return whether the asset already exists
+     */
+    isPublished(): Promise<boolean>;
+}
+export interface IHandlerHost {
+    readonly aws: IAws;
+    readonly aborted: boolean;
+    readonly dockerFactory: DockerFactory;
+    emitMessage(type: EventType, m: string): void;
+}
+export interface IHandlerOptions {
+    readonly quiet?: boolean;
+}

package/cdk-assets/private/asset-handler.js

@@ -0,0 +1 @@
+export {};

package/cdk-assets/private/docker.d.ts

@@ -0,0 +1,94 @@
+import { Logger } from "cdk-assets/lib/private/shell.js";
+interface BuildOptions {
+    readonly directory: string;
+    /**
+     * Tag the image with a given repoName:tag combination
+     */
+    readonly tag: string;
+    readonly target?: string;
+    readonly file?: string;
+    readonly buildArgs?: Record<string, string>;
+    readonly buildSecrets?: Record<string, string>;
+    readonly networkMode?: string;
+    readonly platform?: string;
+    readonly outputs?: string[];
+    readonly cacheFrom?: DockerCacheOption[];
+    readonly cacheTo?: DockerCacheOption;
+    readonly quiet?: boolean;
+}
+interface PushOptions {
+    readonly tag: string;
+    readonly quiet?: boolean;
+}
+export interface DockerCredentialsConfig {
+    readonly version: string;
+    readonly domainCredentials: Record<string, DockerDomainCredentials>;
+}
+export interface DockerDomainCredentials {
+    readonly secretsManagerSecretId?: string;
+    readonly ecrRepository?: string;
+}
+export interface DockerCacheOption {
+    readonly type: string;
+    readonly params?: {
+        [key: string]: string;
+    };
+}
+export declare class Docker {
+    private readonly logger?;
+    private configDir;
+    constructor(logger?: Logger | undefined);
+    /**
+     * Whether an image with the given tag exists
+     */
+    exists(tag: string): Promise<boolean>;
+    build(options: BuildOptions): Promise<void>;
+    /**
+     * Get credentials from ECR and run docker login
+     */
+    login(ecr: AWS.ECR): Promise<void>;
+    tag(sourceTag: string, targetTag: string): Promise<void>;
+    push(options: PushOptions): Promise<void>;
+    /**
+     * If a CDK Docker Credentials file exists, creates a new Docker config directory.
+     * Sets up `docker-credential-cdk-assets` to be the credential helper for each domain in the CDK config.
+     * All future commands (e.g., `build`, `push`) will use this config.
+     *
+     * See https://docs.docker.com/engine/reference/commandline/login/#credential-helpers for more details on cred helpers.
+     *
+     * @returns true if CDK config was found and configured, false otherwise
+     */
+    configureCdkCredentials(): boolean;
+    /**
+     * Removes any configured Docker config directory.
+     * All future commands (e.g., `build`, `push`) will use the default config.
+     *
+     * This is useful after calling `configureCdkCredentials` to reset to default credentials.
+     */
+    resetAuthPlugins(): void;
+    private execute;
+    private cacheOptionToFlag;
+}
+export interface DockerFactoryOptions {
+    readonly repoUri: string;
+    readonly ecr: AWS.ECR;
+    readonly logger: (m: string) => void;
+}
+/**
+ * Helps get appropriately configured Docker instances during the container
+ * image publishing process.
+ */
+export declare class DockerFactory {
+    private enterLoggedInDestinationsCriticalSection;
+    private loggedInDestinations;
+    /**
+     * Gets a Docker instance for building images.
+     */
+    forBuild(options: DockerFactoryOptions): Promise<Docker>;
+    /**
+     * Gets a Docker instance for pushing images to ECR.
+     */
+    forEcrPush(options: DockerFactoryOptions): Promise<Docker>;
+    private loginOncePerDestination;
+}
+export {};

package/cdk-assets/private/docker.js

@@ -0,0 +1,237 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { cdkCredentialsConfig, obtainEcrCredentials, } from "cdk-assets/lib/private/docker-credentials.js";
+import { shell, } from "cdk-assets/lib/private/shell.js";
+import { createCriticalSection } from "cdk-assets/lib/private/util.js";
+var InspectImageErrorCode;
+(function (InspectImageErrorCode) {
+    InspectImageErrorCode[InspectImageErrorCode["Docker"] = 1] = "Docker";
+    InspectImageErrorCode[InspectImageErrorCode["Podman"] = 125] = "Podman";
+})(InspectImageErrorCode || (InspectImageErrorCode = {}));
+export class Docker {
+    logger;
+    configDir = undefined;
+    constructor(logger) {
+        this.logger = logger;
+    }
+    /**
+     * Whether an image with the given tag exists
+     */
+    async exists(tag) {
+        try {
+            await this.execute(["inspect", tag], { quiet: true });
+            return true;
+        }
+        catch (e) {
+            const error = e;
+            /**
+             * The only error we expect to be thrown will have this property and value.
+             * If it doesn't, it's unrecognized so re-throw it.
+             */
+            if (error.code !== "PROCESS_FAILED") {
+                throw error;
+            }
+            /**
+             * If we know the shell command above returned an error, check to see
+             * if the exit code is one we know to actually mean that the image doesn't
+             * exist.
+             */
+            switch (error.exitCode) {
+                case InspectImageErrorCode.Docker:
+                case InspectImageErrorCode.Podman:
+                    // Docker and Podman will return this exit code when an image doesn't exist, return false
+                    // context: https://github.com/aws/aws-cdk/issues/16209
+                    return false;
+                default:
+                    // This is an error but it's not an exit code we recognize, throw.
+                    throw error;
+            }
+        }
+    }
+    async build(options) {
+        const buildCommand = [
+            "build",
+            ...flatten(Object.entries(options.buildArgs || {}).map(([k, v]) => [
+                "--build-arg",
+                `${k}=${v}`,
+            ])),
+            ...flatten(Object.entries(options.buildSecrets || {}).map(([k, v]) => [
+                "--secret",
+                `id=${k},${v}`,
+            ])),
+            "--tag",
+            options.tag,
+            ...(options.target ? ["--target", options.target] : []),
+            ...(options.file ? ["--file", options.file] : []),
+            ...(options.networkMode ? ["--network", options.networkMode] : []),
+            ...(options.platform ? ["--platform", options.platform] : []),
+            ...(options.outputs
+                ? options.outputs.map((output) => [`--output=${output}`])
+                : []),
+            ...(options.cacheFrom
+                ? [
+                    ...options.cacheFrom
+                        .map((cacheFrom) => [
+                        "--cache-from",
+                        this.cacheOptionToFlag(cacheFrom),
+                    ])
+                        .flat(),
+                ]
+                : []),
+            ...(options.cacheTo
+                ? ["--cache-to", this.cacheOptionToFlag(options.cacheTo)]
+                : []),
+            ".",
+        ];
+        await this.execute(buildCommand, {
+            cwd: options.directory,
+            // TODO: remove after PR is merged
+            quiet: options.quiet,
+        });
+    }
+    /**
+     * Get credentials from ECR and run docker login
+     */
+    async login(ecr) {
+        const credentials = await obtainEcrCredentials(ecr);
+        // Use --password-stdin otherwise docker will complain. Loudly.
+        await this.execute([
+            "login",
+            "--username",
+            credentials.username,
+            "--password-stdin",
+            credentials.endpoint,
+        ], {
+            input: credentials.password,
+            // Need to quiet otherwise Docker will complain
+            // 'WARNING! Your password will be stored unencrypted'
+            // doesn't really matter since it's a token.
+            quiet: true,
+        });
+    }
+    async tag(sourceTag, targetTag) {
+        await this.execute(["tag", sourceTag, targetTag]);
+    }
+    // TODO: remove after PR is merged
+    async push(options) {
+        await this.execute(["push", options.tag], { quiet: options.quiet });
+    }
+    /**
+     * If a CDK Docker Credentials file exists, creates a new Docker config directory.
+     * Sets up `docker-credential-cdk-assets` to be the credential helper for each domain in the CDK config.
+     * All future commands (e.g., `build`, `push`) will use this config.
+     *
+     * See https://docs.docker.com/engine/reference/commandline/login/#credential-helpers for more details on cred helpers.
+     *
+     * @returns true if CDK config was found and configured, false otherwise
+     */
+    configureCdkCredentials() {
+        const config = cdkCredentialsConfig();
+        if (!config) {
+            return false;
+        }
+        this.configDir = fs.mkdtempSync(path.join(os.tmpdir(), "cdkDockerConfig"));
+        const domains = Object.keys(config.domainCredentials);
+        const credHelpers = domains.reduce((map, domain) => {
+            map[domain] = "cdk-assets"; // Use docker-credential-cdk-assets for this domain
+            return map;
+        }, {});
+        fs.writeFileSync(path.join(this.configDir, "config.json"), JSON.stringify({ credHelpers }), { encoding: "utf-8" });
+        return true;
+    }
+    /**
+     * Removes any configured Docker config directory.
+     * All future commands (e.g., `build`, `push`) will use the default config.
+     *
+     * This is useful after calling `configureCdkCredentials` to reset to default credentials.
+     */
+    resetAuthPlugins() {
+        this.configDir = undefined;
+    }
+    async execute(args, options = {}) {
+        const configArgs = this.configDir ? ["--config", this.configDir] : [];
+        // TODO: remove after PR is merged
+        //const pathToCdkAssets = path.resolve(__dirname, "..", "..", "bin");
+        const pathToCdkAssets = "";
+        try {
+            await shell([getDockerCmd(), ...configArgs, ...args], {
+                logger: this.logger,
+                ...options,
+                env: {
+                    ...process.env,
+                    ...options.env,
+                    PATH: `${pathToCdkAssets}${path.delimiter}${options.env?.PATH ?? process.env.PATH}`,
+                },
+            });
+        }
+        catch (e) {
+            if (e.code === "ENOENT") {
+                throw new Error("Unable to execute 'docker' in order to build a container asset. Please install 'docker' and try again.");
+            }
+            throw e;
+        }
+    }
+    cacheOptionToFlag(option) {
+        let flag = `type=${option.type}`;
+        if (option.params) {
+            flag +=
+                "," +
+                    Object.entries(option.params)
+                        .map(([k, v]) => `${k}=${v}`)
+                        .join(",");
+        }
+        return flag;
+    }
+}
+/**
+ * Helps get appropriately configured Docker instances during the container
+ * image publishing process.
+ */
+export class DockerFactory {
+    enterLoggedInDestinationsCriticalSection = createCriticalSection();
+    loggedInDestinations = new Set();
+    /**
+     * Gets a Docker instance for building images.
+     */
+    async forBuild(options) {
+        const docker = new Docker(options.logger);
+        // Default behavior is to login before build so that the Dockerfile can reference images in the ECR repo
+        // However, if we're in a pipelines environment (for example),
+        // we may have alternative credentials to the default ones to use for the build itself.
+        // If the special config file is present, delay the login to the default credentials until the push.
+        // If the config file is present, we will configure and use those credentials for the build.
+        let cdkDockerCredentialsConfigured = docker.configureCdkCredentials();
+        if (!cdkDockerCredentialsConfigured) {
+            await this.loginOncePerDestination(docker, options);
+        }
+        return docker;
+    }
+    /**
+     * Gets a Docker instance for pushing images to ECR.
+     */
+    async forEcrPush(options) {
+        const docker = new Docker(options.logger);
+        await this.loginOncePerDestination(docker, options);
+        return docker;
+    }
+    async loginOncePerDestination(docker, options) {
+        // Changes: 012345678910.dkr.ecr.us-west-2.amazonaws.com/tagging-test
+        // To this: 012345678910.dkr.ecr.us-west-2.amazonaws.com
+        const repositoryDomain = options.repoUri.split("/")[0];
+        // Ensure one-at-a-time access to loggedInDestinations.
+        await this.enterLoggedInDestinationsCriticalSection(async () => {
+            if (this.loggedInDestinations.has(repositoryDomain)) {
+                return;
+            }
+            await docker.login(options.ecr);
+            this.loggedInDestinations.add(repositoryDomain);
+        });
+    }
+}
+function getDockerCmd() {
+    return process.env.CDK_DOCKER ?? "docker";
+}
+function flatten(x) {
+    return Array.prototype.concat([], ...x);
+}

package/cdk-assets/private/handlers/container-images.d.ts

@@ -0,0 +1,22 @@
+import { DockerImageManifestEntry } from "cdk-assets/lib/asset-manifest.js";
+import { IAssetHandler, IHandlerHost, IHandlerOptions } from "../asset-handler.js";
+export declare class ContainerImageAssetHandler implements IAssetHandler {
+    private readonly workDir;
+    private readonly asset;
+    private readonly host;
+    private readonly options;
+    private init?;
+    constructor(workDir: string, asset: DockerImageManifestEntry, host: IHandlerHost, options: IHandlerOptions);
+    build(): Promise<void>;
+    isPublished(): Promise<boolean>;
+    publish(): Promise<void>;
+    private initOnce;
+    /**
+     * Check whether the image already exists in the ECR repo
+     *
+     * Use the fields from the destination to do the actual check. The imageUri
+     * should correspond to that, but is only used to print Docker image location
+     * for user benefit (the format is slightly different).
+     */
+    private destinationAlreadyExists;
+}