apx-aws-lambda 0.1.0__tar.gz → 0.2.0__tar.gz

{apx_aws_lambda-0.1.0 → apx_aws_lambda-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apx-aws-lambda
-Version: 0.1.0
+Version: 0.2.0
 Summary: AWS Lambda for Action Platform: the aws/lambda deploy target (SAM) with its overlay, and tools to read stacks and functions.
 Author-email: Action Platform <cloud@actionplatform.io>
 License-Expression: Apache-2.0
@@ -42,9 +42,44 @@ target = "aws/lambda"
 region = "us-east-1"          # optional; samconfig.toml / AWS_REGION otherwise
 ```
 
+## Credentials without keys
+
+Set `role_arn` and nothing else: the target assumes that role with a short-lived OIDC token the platform signs (`sts assume-role-with-web-identity`). No access key on the platform, on your machine or in the repository; what the app may do is the role's policy.
+
+```toml
+[deploy]
+target = "aws/lambda"
+role_arn = "arn:aws:iam::123456789012:role/shop-deploy"
+```
+
+Once per AWS account, register the platform as an identity provider — its discovery document is `https://<platform>/.well-known/openid-configuration`:
+
+```bash
+aws iam create-open-id-connect-provider --url https://platform.example.com --client-id-list sts.amazonaws.com
+```
+
+Then a role per app (or per project) whose trust policy names the platform and the app; `requirements/policy.json` from the overlay is its permission policy:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Principal": { "Federated": "arn:aws:iam::123456789012:oidc-provider/platform.example.com" },
+    "Action": "sts:AssumeRoleWithWebIdentity",
+    "Condition": {
+      "StringEquals": { "platform.example.com:aud": "sts.amazonaws.com" },
+      "StringLike": { "platform.example.com:sub": "org:acme:project:shop:app:orders" }
+    }
+  }]
+}
+```
+
+`sub` is `org:<org>:project:<project>:app:<app>` for a deploy the platform runs; `org:<org>` plus an `actor` claim for `action-platform deploy` from a logged-in machine (`StringLike` with `org:acme:*` covers both). Without `role_arn` the AWS CLI's own chain applies: `aws sso login`, a profile, an instance role — still no key in a file when you use SSO.
+
 Tools (`action-platform mcp`): `aws_lambda_stacks`, `aws_lambda_functions`. Commands: `action-platform aws-lambda stacks|functions`. Deploying itself goes through the core's `deploy` / `rollback` / `diagnose`, which drive the target.
 
-Needs: AWS CLI v2 (`aws`), SAM CLI (`sam`), credentials in the environment (`AWS_PROFILE` or keys), `AWS_REGION`. Talks to `*.amazonaws.com` only.
+Needs: AWS CLI v2 (`aws`), SAM CLI (`sam`), `AWS_REGION` (or `region` under `[deploy]`), and either `role_arn` (OIDC, no keys) or the AWS CLI's own credentials. Talks to `*.amazonaws.com` only.
 
 ## Development
 

apx_aws_lambda-0.2.0/README.md

@@ -0,0 +1,75 @@
+# apx-aws-lambda
+
+AWS Lambda for [Action Platform](https://github.com/actionplatform/action-platform): the `aws/lambda` deploy target (SAM) with its overlay, read-only tools and commands. `apx-` is the prefix every Action Platform extension carries.
+
+```bash
+action-platform plugin install aws-lambda
+action-platform cloud set aws/lambda        # overlay files come from this plugin
+action-platform deploy --dry-run            # preflight: sam validate, credentials
+action-platform deploy                      # sam build + sam deploy --config-env <stage>
+action-platform diagnose
+```
+
+| | |
+|---|---|
+| Overlay | `template.yaml`, `samconfig.toml`, `lambda_handler.py`, `Makefile`, `requirements/` (IAM), `.github/workflows/deploy.yml` |
+| Deploy | `sam build` + `sam deploy --config-env <stage>` (`dev` → `default`, `prod` → `prod`) |
+| Rollback | CloudFormation `rollback-stack` — previous stack state |
+| Diagnose | stack status and the HTTP API url |
+| Destroy | `sam delete` |
+
+`[deploy]` in platform.toml:
+
+```toml
+[deploy]
+target = "aws/lambda"
+region = "us-east-1"          # optional; samconfig.toml / AWS_REGION otherwise
+```
+
+## Credentials without keys
+
+Set `role_arn` and nothing else: the target assumes that role with a short-lived OIDC token the platform signs (`sts assume-role-with-web-identity`). No access key on the platform, on your machine or in the repository; what the app may do is the role's policy.
+
+```toml
+[deploy]
+target = "aws/lambda"
+role_arn = "arn:aws:iam::123456789012:role/shop-deploy"
+```
+
+Once per AWS account, register the platform as an identity provider — its discovery document is `https://<platform>/.well-known/openid-configuration`:
+
+```bash
+aws iam create-open-id-connect-provider --url https://platform.example.com --client-id-list sts.amazonaws.com
+```
+
+Then a role per app (or per project) whose trust policy names the platform and the app; `requirements/policy.json` from the overlay is its permission policy:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Principal": { "Federated": "arn:aws:iam::123456789012:oidc-provider/platform.example.com" },
+    "Action": "sts:AssumeRoleWithWebIdentity",
+    "Condition": {
+      "StringEquals": { "platform.example.com:aud": "sts.amazonaws.com" },
+      "StringLike": { "platform.example.com:sub": "org:acme:project:shop:app:orders" }
+    }
+  }]
+}
+```
+
+`sub` is `org:<org>:project:<project>:app:<app>` for a deploy the platform runs; `org:<org>` plus an `actor` claim for `action-platform deploy` from a logged-in machine (`StringLike` with `org:acme:*` covers both). Without `role_arn` the AWS CLI's own chain applies: `aws sso login`, a profile, an instance role — still no key in a file when you use SSO.
+
+Tools (`action-platform mcp`): `aws_lambda_stacks`, `aws_lambda_functions`. Commands: `action-platform aws-lambda stacks|functions`. Deploying itself goes through the core's `deploy` / `rollback` / `diagnose`, which drive the target.
+
+Needs: AWS CLI v2 (`aws`), SAM CLI (`sam`), `AWS_REGION` (or `region` under `[deploy]`), and either `role_arn` (OIDC, no keys) or the AWS CLI's own credentials. Talks to `*.amazonaws.com` only.
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+```
+
+The tests fake `aws` and `sam`; nothing reaches AWS.

{apx_aws_lambda-0.1.0 → apx_aws_lambda-0.2.0}/apx_aws_lambda/lambda_.py

@@ -1,4 +1,6 @@
-"""`aws/lambda`: a SAM stack per stage. Deploy = `sam build` + `sam deploy --config-env <stage>`; rollback = CloudFormation rollback to the previous stack state; diagnose = stack status and the HTTP API url."""
+"""`aws/lambda`: a SAM stack per stage. Deploy = `sam build` + `sam deploy --config-env <stage>`; rollback = CloudFormation rollback to the previous stack state; diagnose = stack status and the HTTP API url.
+
+Credentials: with `role_arn` under `[deploy]`, the target assumes that role with a short-lived OIDC token the platform signs (`sts assume-role-with-web-identity`) — no access key anywhere. Without it, the AWS CLI's own chain applies (profile, SSO, instance role)."""
 
 from __future__ import annotations
 
@@ -7,7 +9,8 @@ import tomllib
 
 from action_platform.abc import DeployTarget
 from action_platform.core.context import Context, DeployResult, Diagnosis
-from action_platform.core.exception import DeployError
+from action_platform.core.exception import ActionPlatformError, DeployError
+from action_platform.remote.client import Remote
 
 from apx_aws_lambda import shell
 
@@ -16,7 +19,12 @@ class LambdaTarget(DeployTarget):
     name = "aws/lambda"
 
     def __init__(
-        self, region: str | None = None, config: str = "samconfig.toml", **_: object
+        self,
+        region: str | None = None,
+        config: str = "samconfig.toml",
+        role_arn: str | None = None,
+        session_name: str = "action-platform",
+        **_: object,
     ) -> None:
         self.region = (
             region
@@ -24,6 +32,22 @@ class LambdaTarget(DeployTarget):
             or os.environ.get("AWS_DEFAULT_REGION")
         )
         self.config = config
+        self.role_arn = role_arn or os.environ.get("AWS_ROLE_ARN")
+        self.session_name = session_name
+        self._env: dict[str, str] | None = None
+
+    def env(self, ctx: Context) -> dict[str, str] | None:
+        """The environment `aws` and `sam` run with: temporary credentials from `role_arn` when set, the caller's own otherwise."""
+        if not self.role_arn:
+            return None
+
+        if self._env is None:
+            self._env = {
+                **os.environ,
+                **assume_role(ctx, self.role_arn, self.session_name, self.region),
+            }
+
+        return self._env
 
     def _stage(self, ctx: Context) -> str:
         return "prod" if ctx.stage == "prod" else "default"
@@ -72,19 +96,25 @@ class LambdaTarget(DeployTarget):
             )
 
         self._stack(ctx)
-        shell.aws("sts", "get-caller-identity", region=self._region(ctx))
-        shell.run([shell.require("sam", ""), "validate", "--lint"], cwd=ctx.repo_root)
+        shell.aws(
+            "sts", "get-caller-identity", region=self._region(ctx), env=self.env(ctx)
+        )
+        shell.run(
+            [shell.require("sam", ""), "validate", "--lint"],
+            cwd=ctx.repo_root,
+            env=self.env(ctx),
+        )
 
     def deploy(self, ctx: Context) -> DeployResult:
         sam = shell.require("sam", "pip install aws-sam-cli")
         stage = self._stage(ctx)
-        shell.run([sam, "build"], cwd=ctx.repo_root)
+        shell.run([sam, "build"], cwd=ctx.repo_root, env=self.env(ctx))
         args = [sam, "deploy", "--no-confirm-changeset", "--no-fail-on-empty-changeset"]
 
         if stage != "default":
             args += ["--config-env", stage]
 
-        shell.run(args, cwd=ctx.repo_root)
+        shell.run(args, cwd=ctx.repo_root, env=self.env(ctx))
         url = self._url(ctx)
 
         return DeployResult(
@@ -104,6 +134,7 @@ class LambdaTarget(DeployTarget):
             "--stack-name",
             self._stack(ctx),
             region=self._region(ctx),
+            env=self.env(ctx),
         )
 
     def diagnose(self, ctx: Context) -> Diagnosis:
@@ -116,6 +147,7 @@ class LambdaTarget(DeployTarget):
                 "--stack-name",
                 stack,
                 region=self._region(ctx),
+                env=self.env(ctx),
             )
         except DeployError as e:
             return Diagnosis(
@@ -151,10 +183,59 @@ class LambdaTarget(DeployTarget):
         if region:
             args += ["--region", region]
 
-        shell.run(args, cwd=ctx.repo_root)
+        shell.run(args, cwd=ctx.repo_root, env=self.env(ctx))
 
     def _url(self, ctx: Context) -> str | None:
         try:
             return self.diagnose(ctx).url
         except DeployError:
             return None
+
+
+def assume_role(
+    ctx: Context, role_arn: str, session_name: str, region: str | None
+) -> dict[str, str]:
+    """Temporary credentials for `role_arn` from an OIDC token: the platform's for a deploy it runs, the platform the CLI is logged in to otherwise."""
+    token = ctx.identity_token("sts.amazonaws.com")
+
+    if token is None:
+        try:
+            token = Remote.from_credentials().identity_token("sts.amazonaws.com")[
+                "token"
+            ]
+        except ActionPlatformError as e:
+            raise DeployError(
+                f"role_arn is set but nothing can sign an identity token here: {e}. "
+                "Deploy from the platform, or log in with `action-platform login`."
+            ) from e
+
+    data = shell.aws(
+        "sts",
+        "assume-role-with-web-identity",
+        "--role-arn",
+        role_arn,
+        "--role-session-name",
+        session_name,
+        "--web-identity-token",
+        token,
+        "--duration-seconds",
+        "3600",
+        region=region,
+        env={
+            k: v
+            for k, v in os.environ.items()
+            if not k.startswith("AWS_ACCESS") and k != "AWS_SESSION_TOKEN"
+        },
+    )
+    creds = data.get("Credentials") or {}
+
+    if not creds.get("AccessKeyId"):
+        raise DeployError(
+            f"assume-role-with-web-identity gave no credentials for {role_arn}"
+        )
+
+    return {
+        "AWS_ACCESS_KEY_ID": creds["AccessKeyId"],
+        "AWS_SECRET_ACCESS_KEY": creds["SecretAccessKey"],
+        "AWS_SESSION_TOKEN": creds["SessionToken"],
+    }

{apx_aws_lambda-0.1.0 → apx_aws_lambda-0.2.0}/apx_aws_lambda/plugin.py

@@ -18,7 +18,7 @@ class AwsLambdaPlugin(Plugin):
     min_core = "0.16"
     needs = [
         "tool: aws (AWS CLI v2), sam (AWS SAM CLI)",
-        "env: AWS_PROFILE or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, AWS_REGION",
+        "env: AWS_REGION; credentials from role_arn (OIDC, no keys) or the AWS CLI chain (SSO, profile, instance role)",
         "net: *.amazonaws.com",
     ]
 

{apx_aws_lambda-0.1.0 → apx_aws_lambda-0.2.0}/apx_aws_lambda/shell.py

@@ -35,12 +35,17 @@ def run(
     return result.stdout
 
 
-def aws(*args: str, region: str | None = None, cwd: Path | None = None) -> Any:
+def aws(
+    *args: str,
+    region: str | None = None,
+    cwd: Path | None = None,
+    env: dict[str, str] | None = None,
+) -> Any:
     command = [require("aws", "https://aws.amazon.com/cli/"), *args, "--output", "json"]
 
     if region:
         command += ["--region", region]
 
-    out = run(command, cwd=cwd)
+    out = run(command, cwd=cwd, env=env)
 
     return json.loads(out) if out.strip() else {}

{apx_aws_lambda-0.1.0 → apx_aws_lambda-0.2.0}/apx_aws_lambda.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apx-aws-lambda
-Version: 0.1.0
+Version: 0.2.0
 Summary: AWS Lambda for Action Platform: the aws/lambda deploy target (SAM) with its overlay, and tools to read stacks and functions.
 Author-email: Action Platform <cloud@actionplatform.io>
 License-Expression: Apache-2.0
@@ -42,9 +42,44 @@ target = "aws/lambda"
 region = "us-east-1"          # optional; samconfig.toml / AWS_REGION otherwise
 ```
 
+## Credentials without keys
+
+Set `role_arn` and nothing else: the target assumes that role with a short-lived OIDC token the platform signs (`sts assume-role-with-web-identity`). No access key on the platform, on your machine or in the repository; what the app may do is the role's policy.
+
+```toml
+[deploy]
+target = "aws/lambda"
+role_arn = "arn:aws:iam::123456789012:role/shop-deploy"
+```
+
+Once per AWS account, register the platform as an identity provider — its discovery document is `https://<platform>/.well-known/openid-configuration`:
+
+```bash
+aws iam create-open-id-connect-provider --url https://platform.example.com --client-id-list sts.amazonaws.com
+```
+
+Then a role per app (or per project) whose trust policy names the platform and the app; `requirements/policy.json` from the overlay is its permission policy:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Principal": { "Federated": "arn:aws:iam::123456789012:oidc-provider/platform.example.com" },
+    "Action": "sts:AssumeRoleWithWebIdentity",
+    "Condition": {
+      "StringEquals": { "platform.example.com:aud": "sts.amazonaws.com" },
+      "StringLike": { "platform.example.com:sub": "org:acme:project:shop:app:orders" }
+    }
+  }]
+}
+```
+
+`sub` is `org:<org>:project:<project>:app:<app>` for a deploy the platform runs; `org:<org>` plus an `actor` claim for `action-platform deploy` from a logged-in machine (`StringLike` with `org:acme:*` covers both). Without `role_arn` the AWS CLI's own chain applies: `aws sso login`, a profile, an instance role — still no key in a file when you use SSO.
+
 Tools (`action-platform mcp`): `aws_lambda_stacks`, `aws_lambda_functions`. Commands: `action-platform aws-lambda stacks|functions`. Deploying itself goes through the core's `deploy` / `rollback` / `diagnose`, which drive the target.
 
-Needs: AWS CLI v2 (`aws`), SAM CLI (`sam`), credentials in the environment (`AWS_PROFILE` or keys), `AWS_REGION`. Talks to `*.amazonaws.com` only.
+Needs: AWS CLI v2 (`aws`), SAM CLI (`sam`), `AWS_REGION` (or `region` under `[deploy]`), and either `role_arn` (OIDC, no keys) or the AWS CLI's own credentials. Talks to `*.amazonaws.com` only.
 
 ## Development
 

{apx_aws_lambda-0.1.0 → apx_aws_lambda-0.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "apx-aws-lambda"
-version = "0.1.0"
+version = "0.2.0"
 description = "AWS Lambda for Action Platform: the aws/lambda deploy target (SAM) with its overlay, and tools to read stacks and functions."
 readme = "README.md"
 license = "Apache-2.0"

{apx_aws_lambda-0.1.0 → apx_aws_lambda-0.2.0}/tests/test_targets.py

@@ -141,3 +141,51 @@ class PluginTest(unittest.TestCase):
         names = {t.name for t in asyncio.run(server.build().list_tools())}
 
         self.assertLessEqual({"aws_lambda_stacks", "aws_lambda_functions"}, names)
+
+
+class AssumeRoleTest(unittest.TestCase):
+    def test_role_arn_turns_the_platform_token_into_temporary_credentials(self):
+        calls: list[list[str]] = []
+
+        def run(args, cwd=None, env=None):
+            calls.append([Path(args[0]).name, *args[1:]])
+            if args[1:3] == ["sts", "assume-role-with-web-identity"]:
+                return json.dumps(
+                    {
+                        "Credentials": {
+                            "AccessKeyId": "AKIA",
+                            "SecretAccessKey": "s",
+                            "SessionToken": "t",
+                        }
+                    }
+                )
+            return json.dumps(
+                {"Stacks": [{"StackStatus": "UPDATE_COMPLETE", "Outputs": []}]}
+            )
+
+        ctx = Context(repo_root=Path("."), identity=lambda aud: f"jwt-for-{aud}")
+
+        with mock.patch.multiple(shell, run=run, require=lambda t, h: f"/usr/bin/{t}"):
+            env = LambdaTarget(
+                role_arn="arn:aws:iam::1:role/deploy", region="us-east-1"
+            ).env(ctx)
+
+        self.assertEqual(env["AWS_ACCESS_KEY_ID"], "AKIA")
+        self.assertEqual(env["AWS_SESSION_TOKEN"], "t")
+        sts = next(
+            c for c in calls if c[1:3] == ["sts", "assume-role-with-web-identity"]
+        )
+        self.assertIn("jwt-for-sts.amazonaws.com", sts)
+        self.assertIn("arn:aws:iam::1:role/deploy", sts)
+
+    def test_without_an_issuer_or_a_login_it_says_so(self):
+        with (
+            mock.patch.object(shell, "require", lambda t, h: "/usr/bin/aws"),
+            mock.patch.dict("os.environ", {"AP_HOME": "/nonexistent"}, clear=False),
+        ):
+            with self.assertRaises(DeployError) as caught:
+                LambdaTarget(role_arn="arn:aws:iam::1:role/deploy").env(
+                    Context(repo_root=Path("."))
+                )
+
+        self.assertIn("log in", str(caught.exception))

apx_aws_lambda-0.1.0/README.md

@@ -1,40 +0,0 @@
-# apx-aws-lambda
-
-AWS Lambda for [Action Platform](https://github.com/actionplatform/action-platform): the `aws/lambda` deploy target (SAM) with its overlay, read-only tools and commands. `apx-` is the prefix every Action Platform extension carries.
-
-```bash
-action-platform plugin install aws-lambda
-action-platform cloud set aws/lambda        # overlay files come from this plugin
-action-platform deploy --dry-run            # preflight: sam validate, credentials
-action-platform deploy                      # sam build + sam deploy --config-env <stage>
-action-platform diagnose
-```
-
-| | |
-|---|---|
-| Overlay | `template.yaml`, `samconfig.toml`, `lambda_handler.py`, `Makefile`, `requirements/` (IAM), `.github/workflows/deploy.yml` |
-| Deploy | `sam build` + `sam deploy --config-env <stage>` (`dev` → `default`, `prod` → `prod`) |
-| Rollback | CloudFormation `rollback-stack` — previous stack state |
-| Diagnose | stack status and the HTTP API url |
-| Destroy | `sam delete` |
-
-`[deploy]` in platform.toml:
-
-```toml
-[deploy]
-target = "aws/lambda"
-region = "us-east-1"          # optional; samconfig.toml / AWS_REGION otherwise
-```
-
-Tools (`action-platform mcp`): `aws_lambda_stacks`, `aws_lambda_functions`. Commands: `action-platform aws-lambda stacks|functions`. Deploying itself goes through the core's `deploy` / `rollback` / `diagnose`, which drive the target.
-
-Needs: AWS CLI v2 (`aws`), SAM CLI (`sam`), credentials in the environment (`AWS_PROFILE` or keys), `AWS_REGION`. Talks to `*.amazonaws.com` only.
-
-## Development
-
-```bash
-pip install -e ".[dev]"
-pytest
-```
-
-The tests fake `aws` and `sam`; nothing reaches AWS.