agentcore-cli 0.31.1__py3-none-any.whl

agentcore/cli/commands/import_/phase2_import.py

@@ -0,0 +1,206 @@
+"""Phase 2 of a CloudFormation import: IMPORT change set (port of commands/import/phase2-import.ts).
+
+Uses ``create_change_set(ChangeSetType="IMPORT")`` to bring pre-existing resources under stack
+management. An IMPORT change set cannot create other resources, update existing ones, or change Outputs.
+"""
+
+from __future__ import annotations
+
+import io
+import json
+import os
+import re
+import time
+import zipfile
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Any
+
+from agentcore.aws._aws_errors import get_error_message
+from agentcore.aws.account import create_aws_client
+from agentcore.lib.errors.types import PollExhaustedError, PollTimeoutError
+from agentcore.lib.utils.polling import PollResult, is_throttling_error, poll
+
+from .template_utils import CfnTemplate, build_import_template
+from .types import ResourceToImport
+
+# Overridable in tests.
+POLL_DELAY_MS = 5000
+
+
+@dataclass
+class Phase2Result:
+    success: bool
+    error: str | None = None
+
+
+def execute_phase2(
+    region: str,
+    stack_name: str,
+    deployed_template: CfnTemplate,
+    synth_template: CfnTemplate,
+    resources_to_import: list[ResourceToImport],
+    assembly_directory: str,
+    on_progress: Callable[[str], None] | None = None,
+) -> Phase2Result:
+    progress = on_progress or (lambda _m: None)
+    if not resources_to_import:
+        progress("No resources to import")
+        return Phase2Result(True)
+
+    cfn = create_aws_client("cloudformation", region)
+
+    progress("Publishing CDK assets to S3...")
+    publish_cdk_assets(assembly_directory, region, on_progress)
+
+    import_template = build_import_template(
+        deployed_template, synth_template, [r.logical_resource_id for r in resources_to_import]
+    )
+    change_set_name = f"import-{int(time.time() * 1000)}"
+    progress(f"Creating IMPORT change set: {change_set_name}")
+
+    try:
+        cfn.create_change_set(
+            StackName=stack_name,
+            ChangeSetName=change_set_name,
+            ChangeSetType="IMPORT",
+            TemplateBody=json.dumps(import_template),
+            ResourcesToImport=[
+                {
+                    "ResourceType": r.resource_type,
+                    "LogicalResourceId": r.logical_resource_id,
+                    "ResourceIdentifier": r.resource_identifier,
+                }
+                for r in resources_to_import
+            ],
+            Capabilities=["CAPABILITY_IAM", "CAPABILITY_NAMED_IAM"],
+        )
+        progress("Waiting for change set to be created...")
+        _wait_for_change_set_ready(cfn, stack_name, change_set_name)
+
+        description = cfn.describe_change_set(StackName=stack_name, ChangeSetName=change_set_name)
+        progress(f"Change set has {len(description.get('Changes') or [])} changes. Executing...")
+        cfn.execute_change_set(StackName=stack_name, ChangeSetName=change_set_name)
+
+        progress("Waiting for IMPORT to complete...")
+        _wait_for_stack_import_complete(cfn, stack_name)
+        progress("Phase 2 IMPORT complete")
+        return Phase2Result(True)
+    except Exception as exc:  # noqa: BLE001
+        message = get_error_message(exc)
+        match = re.search(r"(.+) already exists in stack (.+)", message)
+        if match:
+            return Phase2Result(
+                False,
+                f'Resource "{match.group(1)}" is already managed by CloudFormation stack "{match.group(2)}". It must '
+                "be removed from that stack before importing into this project.",
+            )
+        return Phase2Result(False, f"Import change set failed: {message}")
+
+
+def _on_error(err: BaseException) -> str:
+    return "retry" if is_throttling_error(err) else "abort"
+
+
+def _wait_for_change_set_ready(cfn: Any, stack_name: str, change_set_name: str) -> None:
+    def check() -> PollResult[None]:
+        response = cfn.describe_change_set(StackName=stack_name, ChangeSetName=change_set_name)
+        status = response.get("Status")
+        if status == "CREATE_COMPLETE":
+            return PollResult(True)
+        if status == "FAILED":
+            raise RuntimeError(f"Change set creation failed: {response.get('StatusReason') or 'Unknown reason'}")
+        return PollResult(False)
+
+    try:
+        poll(check, max_attempts=60, delay_ms=POLL_DELAY_MS, on_error=_on_error)
+    except (PollExhaustedError, PollTimeoutError) as exc:
+        raise RuntimeError("Timed out waiting for change set creation") from exc
+
+
+def _wait_for_stack_import_complete(cfn: Any, stack_name: str) -> None:
+    def check() -> PollResult[None]:
+        stacks = cfn.describe_stacks(StackName=stack_name).get("Stacks") or []
+        if not stacks:
+            raise RuntimeError(f"Stack {stack_name} not found during import wait")
+        status = stacks[0].get("StackStatus") or ""
+        if status == "IMPORT_COMPLETE":
+            return PollResult(True)
+        if "FAILED" in status or "ROLLBACK" in status:
+            raise RuntimeError(
+                f"Import failed with status: {status}. Reason: {stacks[0].get('StackStatusReason') or 'Unknown'}"
+            )
+        return PollResult(False)
+
+    try:
+        poll(check, max_attempts=120, delay_ms=POLL_DELAY_MS, on_error=_on_error)
+    except (PollExhaustedError, PollTimeoutError) as exc:
+        raise RuntimeError("Timed out waiting for import to complete") from exc
+
+
+def _zip_directory(path: str) -> bytes:
+    """Equivalent of ``cd <path> && zip -rq out.zip .``."""
+    buffer = io.BytesIO()
+    with zipfile.ZipFile(buffer, "w", zipfile.ZIP_DEFLATED) as zf:
+        for root, _dirs, files in os.walk(path):
+            for name in files:
+                full = os.path.join(root, name)
+                zf.write(full, os.path.relpath(full, path))
+    return buffer.getvalue()
+
+
+def publish_cdk_assets(assembly_directory: str, region: str, on_progress: Callable[[str], None] | None = None) -> None:
+    """Upload CDK file assets (code zips, templates) listed in ``*.assets.json`` to the bootstrap bucket."""
+    progress = on_progress or (lambda _m: None)
+    manifests = [f for f in os.listdir(assembly_directory) if f.endswith(".assets.json")]
+    if not manifests:
+        progress("No assets manifest found, skipping asset publishing")
+        return
+
+    for manifest_file in manifests:
+        with open(os.path.join(assembly_directory, manifest_file), encoding="utf-8") as fh:
+            manifest = json.load(fh)
+        for asset in (manifest.get("files") or {}).values():
+            source = asset["source"]
+            source_path = os.path.join(assembly_directory, source["path"])
+            if not os.path.exists(source_path):
+                progress(f"Asset file not found: {source['path']}, skipping")
+                continue
+            if os.path.isdir(source_path):
+                if source.get("packaging") == "zip":
+                    body = _zip_directory(source_path)
+                else:
+                    progress(f"Skipping directory asset: {source['path']} (packaging: {source.get('packaging')})")
+                    continue
+            else:
+                with open(source_path, "rb") as fh:
+                    body = fh.read()
+
+            for dest in asset["destinations"].values():
+                dest_region = dest.get("region") or region
+                s3 = _s3_client(dest_region, dest.get("assumeRoleArn"))
+                progress(f"Uploading {source['path']} → s3://{dest['bucketName']}/{dest['objectKey']}")
+                s3.put_object(Bucket=dest["bucketName"], Key=dest["objectKey"], Body=body)
+
+
+def _s3_client(region: str, assume_role_arn: str | None) -> Any:
+    """S3 client, using the asset publishing role when one is given (falling back to default credentials)."""
+    if assume_role_arn and "${" not in assume_role_arn:
+        try:
+            creds = (
+                create_aws_client("sts", region)
+                .assume_role(RoleArn=assume_role_arn, RoleSessionName="agentcore-import-publish")
+                .get("Credentials")
+            )
+            if creds:
+                import boto3
+
+                return boto3.session.Session(
+                    aws_access_key_id=creds["AccessKeyId"],
+                    aws_secret_access_key=creds["SecretAccessKey"],
+                    aws_session_token=creds.get("SessionToken"),
+                    region_name=region,
+                ).client("s3")
+        except Exception:  # noqa: BLE001 - fall back to default credentials
+            pass
+    return create_aws_client("s3", region)

agentcore/cli/commands/import_/resource_import.py

@@ -0,0 +1,228 @@
+"""Generic single-resource import orchestrator (port of commands/import/resource-import.ts).
+
+Owns the sequence shared by ``import runtime|memory|evaluator|online-eval``; each resource type
+supplies a :class:`ResourceImportDescriptor`.
+"""
+
+from __future__ import annotations
+
+import copy
+import sys
+from typing import Any
+
+from agentcore.lib.errors.types import to_error
+from agentcore.lib.schemas.io.config_io import to_jsonable
+
+from . import import_pipeline
+from .constants import NAME_REGEX
+from .import_utils import (
+    ImportContext,
+    fail_result,
+    find_resource_in_deployed_state,
+    resolve_import_context,
+    to_stack_name,
+)
+from .template_utils import find_logical_id_by_property, find_logical_ids_by_type
+from .types import (
+    BeforeWriteContext,
+    ImportResourceOptions,
+    ImportResourceResult,
+    ResourceImportDescriptor,
+    ResourceToImport,
+)
+
+
+def execute_resource_import(
+    descriptor: ResourceImportDescriptor[Any, Any], options: ImportResourceOptions
+) -> ImportResourceResult:  # noqa: C901, PLR0911, PLR0915
+    config_snapshot: dict[str, Any] | None = None
+    config_written = False
+    import_ctx: ImportContext | None = None
+
+    def rollback() -> None:
+        if config_written and config_snapshot is not None and import_ctx is not None:
+            try:
+                import_ctx.ctx.config_io.write_project_spec(config_snapshot)
+            except Exception as exc:  # noqa: BLE001
+                print(f"Warning: Could not restore agentcore.json: {exc}", file=sys.stderr)
+        if descriptor.rollback_extra:
+            descriptor.rollback_extra()
+
+    try:
+        import_ctx = resolve_import_context(options, descriptor.log_command)
+        ctx, target, logger, on_progress = import_ctx.ctx, import_ctx.target, import_ctx.logger, import_ctx.on_progress
+        name = descriptor.display_name
+
+        logger.start_step(f"Fetch {name} from AWS")
+        if options.arn:
+            resource_id = descriptor.parse_resource_id(options.arn, target)
+        else:
+            on_progress(f"Listing {name}s in your account...")
+            summaries = descriptor.list_resources(target["region"])
+            if not summaries:
+                return fail_result(logger, f"No {name}s found in your account.", descriptor.resource_type, "")
+            if len(summaries) == 1:
+                resource_id = descriptor.extract_summary_id(summaries[0])
+                on_progress(descriptor.format_auto_select_message(summaries[0]))
+            else:
+                print(f"\nFound {len(summaries)} {name}(s):\n")
+                for i, summary in enumerate(summaries):
+                    print(descriptor.format_list_item(summary, i))
+                print("")
+                return fail_result(
+                    logger,
+                    f"Multiple {name}s found. Use --arn <arn> to specify which {name} to import.",
+                    descriptor.resource_type,
+                    "",
+                )
+
+        on_progress(f"Fetching {name} details for {resource_id}...")
+        detail = descriptor.get_detail(target["region"], resource_id)
+        status = descriptor.extract_detail_status(detail)
+        if status != descriptor.ready_status:
+            on_progress(f"Warning: {name} status is {status}, not {descriptor.ready_status}")
+
+        local_name = options.name if options.name is not None else descriptor.extract_detail_name(detail)
+        if not NAME_REGEX.match(local_name or ""):
+            return fail_result(
+                logger,
+                f'Invalid name "{local_name}". Name must start with a letter and contain only letters, numbers, and '
+                "underscores (max 48 chars).",
+                descriptor.resource_type,
+                local_name,
+            )
+        on_progress(f"{name}: {descriptor.extract_detail_name(detail)} → local name: {local_name}")
+        logger.end_step("success")
+
+        logger.start_step("Check for duplicates")
+        project_spec = to_jsonable(ctx.config_io.read_project_spec())
+        if local_name in set(descriptor.get_existing_names(project_spec)):
+            return fail_result(
+                logger,
+                f'{name} "{local_name}" already exists in the project. Use --name to specify a different local name.',
+                descriptor.resource_type,
+                local_name,
+            )
+        target_name = target.get("name") or "default"
+        existing = find_resource_in_deployed_state(ctx.config_io, target_name, descriptor.resource_type, resource_id)
+        is_reimport = bool(existing)
+        if existing:
+            if not options.name:
+                local_name = existing
+            on_progress(f"{name} already managed by CloudFormation — re-adding to project config")
+        logger.end_step("success")
+
+        if descriptor.before_config_write:
+            hook = descriptor.before_config_write(
+                BeforeWriteContext(detail, local_name, project_spec, ctx, target, options, on_progress, logger)
+            )
+            if hook is not None:
+                return hook
+
+        logger.start_step("Update project config")
+        config_snapshot = copy.deepcopy(project_spec)
+        add_result = descriptor.add_to_project_spec(detail, local_name, project_spec)
+        if not add_result.success:
+            logger.end_step("error", str(add_result.error))
+            logger.finalize(False)
+            add_result.log_path = logger.get_relative_log_path()
+            return add_result
+        ctx.config_io.write_project_spec(project_spec)
+        config_written = True
+        on_progress(f'Added {name} "{local_name}" to agentcore.json')
+        logger.end_step("success")
+
+        logger.start_step("Build and synth CDK")
+        stack_name = to_stack_name(ctx.project_name, target_name)
+
+        def build_resources(
+            synth_template: dict[str, Any], deployed_template: dict[str, Any]
+        ) -> list[ResourceToImport]:
+            deployed_ids = set(deployed_template.get("Resources", {}).keys())
+            logical_id = find_logical_id_by_property(
+                synth_template,
+                descriptor.cfn_resource_type,
+                descriptor.cfn_name_property,
+                local_name,
+                exclude_logical_ids=deployed_ids,
+            )
+            if not logical_id:
+                logical_id = find_logical_id_by_property(
+                    synth_template,
+                    descriptor.cfn_resource_type,
+                    descriptor.cfn_name_property,
+                    f"{ctx.project_name}_{local_name}",
+                    exclude_logical_ids=deployed_ids,
+                )
+            if not logical_id:
+                candidates = [
+                    i
+                    for i in find_logical_ids_by_type(synth_template, descriptor.cfn_resource_type)
+                    if i not in deployed_ids
+                ]
+                if len(candidates) == 1:
+                    logical_id = candidates[0]
+            if not logical_id:
+                return []
+            return [
+                ResourceToImport(descriptor.cfn_resource_type, logical_id, {descriptor.cfn_identifier_key: resource_id})
+            ]
+
+        pipeline = import_pipeline.execute_cdk_import_pipeline(
+            project_root=ctx.project_root,
+            stack_name=stack_name,
+            target=target,
+            config_io=ctx.config_io,
+            target_name=target_name,
+            on_progress=on_progress,
+            build_resources_to_import=build_resources,
+            deployed_state_entries=[descriptor.build_deployed_state_entry(local_name, resource_id, detail)],
+        )
+
+        if pipeline.no_resources:
+            if is_reimport:
+                logger.end_step("success")
+                logger.finalize(True)
+                return ImportResourceResult(
+                    success=True,
+                    resource_type=descriptor.resource_type,
+                    resource_name=local_name,
+                    resource_id=resource_id,
+                    log_path=logger.get_relative_log_path(),
+                )
+            error = f'Could not find logical ID for {name} "{local_name}" in CloudFormation template'
+            rollback()
+            return fail_result(logger, error, descriptor.resource_type, local_name)
+
+        if not pipeline.success:
+            rollback()
+            logger.end_step("error", pipeline.error)
+            logger.finalize(False)
+            return ImportResourceResult(
+                success=False,
+                error=Exception(pipeline.error or "Pipeline failed"),
+                resource_type=descriptor.resource_type,
+                resource_name=local_name,
+                log_path=logger.get_relative_log_path(),
+            )
+        logger.end_step("success")
+        logger.finalize(True)
+        return ImportResourceResult(
+            success=True,
+            resource_type=descriptor.resource_type,
+            resource_name=local_name,
+            resource_id=resource_id,
+            log_path=logger.get_relative_log_path(),
+        )
+    except Exception as exc:  # noqa: BLE001 - every failure becomes a failed result, as upstream
+        rollback()
+        if import_ctx is not None:
+            import_ctx.logger.log(str(exc), "error")
+            import_ctx.logger.finalize(False)
+        return ImportResourceResult(
+            success=False,
+            error=to_error(exc),
+            resource_type=descriptor.resource_type,
+            resource_name=options.name or "",
+            log_path=import_ctx.logger.get_relative_log_path() if import_ctx else None,
+        )

agentcore/cli/commands/import_/template_utils.py

@@ -0,0 +1,148 @@
+"""CloudFormation template helpers for import (port of commands/import/template-utils.ts).
+
+Templates are plain JSON dicts (``{"Resources": {...}, "Outputs": {...}}``).
+"""
+
+from __future__ import annotations
+
+import copy
+import json
+import re
+from collections.abc import Collection
+from typing import Any
+
+from agentcore.cli.commands.import_.constants import PRIMARY_RESOURCE_TYPES
+
+CfnTemplate = dict[str, Any]
+
+
+def _js_json(value: Any) -> str:
+    """``JSON.stringify`` (compact, non-ASCII kept)."""
+    return json.dumps(value, separators=(",", ":"), ensure_ascii=False)
+
+
+def _is_primary_resource_type(type_: str) -> bool:
+    return any(type_.startswith(t) for t in PRIMARY_RESOURCE_TYPES)
+
+
+def _replace_dangling_refs(value: Any, removed_ids: set[str]) -> Any:
+    """Replace Ref / Fn::GetAtt / Fn::Sub references to removed logical IDs with ``"*"``.
+
+    "*" because these references usually land in IAM policy Resource fields; Phase 3
+    (``agentcore deploy``) replaces the whole template with the real synthesized values.
+    """
+    if value is None or not isinstance(value, (dict, list)):
+        return value
+    if isinstance(value, list):
+        return [_replace_dangling_refs(item, removed_ids) for item in value]
+
+    ref = value.get("Ref")
+    if isinstance(ref, str) and ref in removed_ids:
+        return "*"
+
+    if "Fn::GetAtt" in value:
+        get_att = value["Fn::GetAtt"]
+        if isinstance(get_att, list) and len(get_att) >= 1 and get_att[0] in removed_ids:
+            return "*"
+
+    if "Fn::Sub" in value:
+        sub = value["Fn::Sub"]
+        if isinstance(sub, str):
+            replaced = sub
+            for logical_id in removed_ids:
+                replaced = re.sub(r"\$\{" + logical_id + r"[^}]*\}", "*", replaced)
+            if replaced != sub:
+                return {"Fn::Sub": replaced}
+
+    return {key: _replace_dangling_refs(val, removed_ids) for key, val in value.items()}
+
+
+def filter_companion_only_template(synth_template: CfnTemplate) -> CfnTemplate:
+    """Keep only companion resources (no ``AWS::BedrockAgentCore::*``) for the Phase 1 UPDATE."""
+    filtered: CfnTemplate = {**synth_template, "Resources": {}, "Outputs": {}}
+    removed: set[str] = set()
+
+    for logical_id, resource in synth_template["Resources"].items():
+        if _is_primary_resource_type(resource["Type"]):
+            removed.add(logical_id)
+        else:
+            filtered["Resources"][logical_id] = copy.deepcopy(resource)
+
+    for logical_id, resource in list(filtered["Resources"].items()):
+        filtered["Resources"][logical_id] = _replace_dangling_refs(resource, removed)
+
+    for output_key, output_value in (synth_template.get("Outputs") or {}).items():
+        output_json = _js_json(output_value)
+        if not any(rid in output_json for rid in removed):
+            filtered["Outputs"][output_key] = output_value
+
+    for resource in filtered["Resources"].values():
+        depends_on = resource.get("DependsOn")
+        if depends_on:
+            if isinstance(depends_on, str):
+                if depends_on in removed:
+                    del resource["DependsOn"]
+            elif isinstance(depends_on, list):
+                kept = [d for d in depends_on if d not in removed]
+                if kept:
+                    resource["DependsOn"] = kept
+                else:
+                    del resource["DependsOn"]
+
+    return filtered
+
+
+def build_import_template(
+    deployed_template: CfnTemplate, synth_template: CfnTemplate, logical_ids_to_import: list[str]
+) -> CfnTemplate:
+    """Deployed template + the primary resources to import (``DeletionPolicy: Retain``, no DependsOn)."""
+    import_template = copy.deepcopy(deployed_template)
+    for logical_id in logical_ids_to_import:
+        resource = synth_template["Resources"].get(logical_id)
+        if not resource:
+            raise RuntimeError(f"Logical ID {logical_id} not found in synthesized template")
+        imported = copy.deepcopy(resource)
+        imported["DeletionPolicy"] = "Retain"
+        imported["UpdateReplacePolicy"] = "Retain"
+        imported.pop("DependsOn", None)
+        import_template["Resources"][logical_id] = imported
+    return import_template
+
+
+def find_logical_id_by_property(
+    template: CfnTemplate,
+    resource_type: str,
+    property_name: str,
+    property_value: str,
+    *,
+    exclude_logical_ids: Collection[str] | None = None,
+) -> str | None:
+    """Logical ID of a resource of ``resource_type`` whose ``property_name`` matches ``property_value``."""
+    exclude = exclude_logical_ids or ()
+    resources: dict[str, Any] = template["Resources"]
+
+    # First pass: exact string match (highest confidence).
+    for logical_id, resource in resources.items():
+        if logical_id in exclude:
+            continue
+        props = resource.get("Properties")
+        if resource.get("Type") == resource_type and props:
+            if props.get(property_name) == property_value:
+                return logical_id
+
+    # Second pass: intrinsic functions (Fn::Join, Fn::Sub, ...) with a boundary check so that
+    # "agent1" does not match "agent1_v2".
+    pattern = re.compile(re.escape(property_value) + r"(?=[^a-zA-Z0-9_]|$)")
+    for logical_id, resource in resources.items():
+        if logical_id in exclude:
+            continue
+        props = resource.get("Properties")
+        if resource.get("Type") == resource_type and props:
+            prop_val = props.get(property_name)
+            if isinstance(prop_val, (dict, list)) and pattern.search(_js_json(prop_val)):
+                return logical_id
+    return None
+
+
+def find_logical_ids_by_type(template: CfnTemplate, resource_type: str) -> list[str]:
+    return [lid for lid, resource in template["Resources"].items() if resource.get("Type") == resource_type]