apx-aws-lambda 0.1.0__tar.gz → 0.3.0__tar.gz

apx_aws_lambda-0.3.0/PKG-INFO

@@ -0,0 +1,93 @@
+Metadata-Version: 2.4
+Name: apx-aws-lambda
+Version: 0.3.0
+Summary: AWS Lambda for Action Platform: the aws/lambda deploy target (SAM) with its overlay, and tools to read stacks and functions.
+Author-email: Action Platform <cloud@actionplatform.io>
+License-Expression: Apache-2.0
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: action-platform>=0.17
+Requires-Dist: awscli>=1.34
+Requires-Dist: aws-sam-cli>=1.120
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+Requires-Dist: action-platform[mcp]; extra == "dev"
+Dynamic: license-file
+
+# apx-aws-lambda
+
+AWS Lambda for [Action Platform](https://github.com/actionplatform/action-platform): the `aws/lambda` deploy target (SAM) with its overlay, read-only tools and commands. `apx-` is the prefix every Action Platform extension carries.
+
+```bash
+action-platform plugin install aws-lambda
+action-platform cloud set aws/lambda        # overlay files come from this plugin
+action-platform deploy --dry-run            # preflight: sam validate, credentials
+action-platform deploy                      # sam build + sam deploy --config-env <stage>
+action-platform diagnose
+```
+
+| | |
+|---|---|
+| Overlay | `template.yaml`, `samconfig.toml`, `lambda_handler.py`, `Makefile`, `requirements/` (IAM), `.github/workflows/deploy.yml` |
+| Deploy | `sam build` + `sam deploy --config-env <stage>` (`dev` → `default`, `prod` → `prod`) |
+| Rollback | CloudFormation `rollback-stack` — previous stack state |
+| Diagnose | stack status and the HTTP API url |
+| Destroy | `sam delete` |
+
+`[deploy]` in platform.toml:
+
+```toml
+[deploy]
+target = "aws/lambda"
+region = "us-east-1"          # optional; samconfig.toml / AWS_REGION otherwise
+```
+
+## Credentials without keys
+
+Set `role_arn` and nothing else: the target assumes that role with a short-lived OIDC token the platform signs (`sts assume-role-with-web-identity`). No access key on the platform, on your machine or in the repository; what the app may do is the role's policy.
+
+```toml
+[deploy]
+target = "aws/lambda"
+role_arn = "arn:aws:iam::123456789012:role/shop-deploy"
+```
+
+Once per AWS account, register the platform as an identity provider — its discovery document is `https://<platform>/.well-known/openid-configuration`:
+
+```bash
+aws iam create-open-id-connect-provider --url https://platform.example.com --client-id-list sts.amazonaws.com
+```
+
+Then a role per app (or per project) whose trust policy names the platform and the app; `requirements/policy.json` from the overlay is its permission policy:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Principal": { "Federated": "arn:aws:iam::123456789012:oidc-provider/platform.example.com" },
+    "Action": "sts:AssumeRoleWithWebIdentity",
+    "Condition": {
+      "StringEquals": { "platform.example.com:aud": "sts.amazonaws.com" },
+      "StringLike": { "platform.example.com:sub": "org:acme:project:shop:app:orders" }
+    }
+  }]
+}
+```
+
+`sub` is `org:<org>:project:<project>:app:<app>` for a deploy the platform runs; `org:<org>` plus an `actor` claim for `action-platform deploy` from a logged-in machine (`StringLike` with `org:acme:*` covers both). Without `role_arn` the AWS CLI's own chain applies: `aws sso login`, a profile, an instance role — still no key in a file when you use SSO.
+
+Tools (`action-platform mcp`): `aws_lambda_stacks`, `aws_lambda_functions`. Commands: `action-platform aws-lambda stacks|functions`. Deploying itself goes through the core's `deploy` / `rollback` / `diagnose`, which drive the target.
+
+Needs: `aws` and `sam` — on PATH when present, otherwise the `awscli` and `aws-sam-cli` packages the plugin depends on run as `python -m`, which is how the hosted platform deploys without the CLIs in its image; `AWS_REGION` (or `region` under `[deploy]`), and either `role_arn` (OIDC, no keys) or the AWS CLI's own credentials. Talks to `*.amazonaws.com` only.
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+```
+
+The tests fake `aws` and `sam`; nothing reaches AWS.

apx_aws_lambda-0.3.0/README.md

@@ -0,0 +1,75 @@
+# apx-aws-lambda
+
+AWS Lambda for [Action Platform](https://github.com/actionplatform/action-platform): the `aws/lambda` deploy target (SAM) with its overlay, read-only tools and commands. `apx-` is the prefix every Action Platform extension carries.
+
+```bash
+action-platform plugin install aws-lambda
+action-platform cloud set aws/lambda        # overlay files come from this plugin
+action-platform deploy --dry-run            # preflight: sam validate, credentials
+action-platform deploy                      # sam build + sam deploy --config-env <stage>
+action-platform diagnose
+```
+
+| | |
+|---|---|
+| Overlay | `template.yaml`, `samconfig.toml`, `lambda_handler.py`, `Makefile`, `requirements/` (IAM), `.github/workflows/deploy.yml` |
+| Deploy | `sam build` + `sam deploy --config-env <stage>` (`dev` → `default`, `prod` → `prod`) |
+| Rollback | CloudFormation `rollback-stack` — previous stack state |
+| Diagnose | stack status and the HTTP API url |
+| Destroy | `sam delete` |
+
+`[deploy]` in platform.toml:
+
+```toml
+[deploy]
+target = "aws/lambda"
+region = "us-east-1"          # optional; samconfig.toml / AWS_REGION otherwise
+```
+
+## Credentials without keys
+
+Set `role_arn` and nothing else: the target assumes that role with a short-lived OIDC token the platform signs (`sts assume-role-with-web-identity`). No access key on the platform, on your machine or in the repository; what the app may do is the role's policy.
+
+```toml
+[deploy]
+target = "aws/lambda"
+role_arn = "arn:aws:iam::123456789012:role/shop-deploy"
+```
+
+Once per AWS account, register the platform as an identity provider — its discovery document is `https://<platform>/.well-known/openid-configuration`:
+
+```bash
+aws iam create-open-id-connect-provider --url https://platform.example.com --client-id-list sts.amazonaws.com
+```
+
+Then a role per app (or per project) whose trust policy names the platform and the app; `requirements/policy.json` from the overlay is its permission policy:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Principal": { "Federated": "arn:aws:iam::123456789012:oidc-provider/platform.example.com" },
+    "Action": "sts:AssumeRoleWithWebIdentity",
+    "Condition": {
+      "StringEquals": { "platform.example.com:aud": "sts.amazonaws.com" },
+      "StringLike": { "platform.example.com:sub": "org:acme:project:shop:app:orders" }
+    }
+  }]
+}
+```
+
+`sub` is `org:<org>:project:<project>:app:<app>` for a deploy the platform runs; `org:<org>` plus an `actor` claim for `action-platform deploy` from a logged-in machine (`StringLike` with `org:acme:*` covers both). Without `role_arn` the AWS CLI's own chain applies: `aws sso login`, a profile, an instance role — still no key in a file when you use SSO.
+
+Tools (`action-platform mcp`): `aws_lambda_stacks`, `aws_lambda_functions`. Commands: `action-platform aws-lambda stacks|functions`. Deploying itself goes through the core's `deploy` / `rollback` / `diagnose`, which drive the target.
+
+Needs: `aws` and `sam` — on PATH when present, otherwise the `awscli` and `aws-sam-cli` packages the plugin depends on run as `python -m`, which is how the hosted platform deploys without the CLIs in its image; `AWS_REGION` (or `region` under `[deploy]`), and either `role_arn` (OIDC, no keys) or the AWS CLI's own credentials. Talks to `*.amazonaws.com` only.
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+```
+
+The tests fake `aws` and `sam`; nothing reaches AWS.

{apx_aws_lambda-0.1.0 → apx_aws_lambda-0.3.0}/apx_aws_lambda/lambda_.py

@@ -1,4 +1,6 @@
-"""`aws/lambda`: a SAM stack per stage. Deploy = `sam build` + `sam deploy --config-env <stage>`; rollback = CloudFormation rollback to the previous stack state; diagnose = stack status and the HTTP API url."""
+"""`aws/lambda`: a SAM stack per stage. Deploy = `sam build` + `sam deploy --config-env <stage>`; rollback = CloudFormation rollback to the previous stack state; diagnose = stack status and the HTTP API url.
+
+Credentials: with `role_arn` under `[deploy]`, the target assumes that role with a short-lived OIDC token the platform signs (`sts assume-role-with-web-identity`) — no access key anywhere. Without it, the AWS CLI's own chain applies (profile, SSO, instance role)."""
 
 from __future__ import annotations
 
@@ -7,7 +9,8 @@ import tomllib
 
 from action_platform.abc import DeployTarget
 from action_platform.core.context import Context, DeployResult, Diagnosis
-from action_platform.core.exception import DeployError
+from action_platform.core.exception import ActionPlatformError, DeployError
+from action_platform.remote.client import Remote
 
 from apx_aws_lambda import shell
 
@@ -16,7 +19,12 @@ class LambdaTarget(DeployTarget):
     name = "aws/lambda"
 
     def __init__(
-        self, region: str | None = None, config: str = "samconfig.toml", **_: object
+        self,
+        region: str | None = None,
+        config: str = "samconfig.toml",
+        role_arn: str | None = None,
+        session_name: str = "action-platform",
+        **_: object,
     ) -> None:
         self.region = (
             region
@@ -24,6 +32,22 @@ class LambdaTarget(DeployTarget):
             or os.environ.get("AWS_DEFAULT_REGION")
         )
         self.config = config
+        self.role_arn = role_arn or os.environ.get("AWS_ROLE_ARN")
+        self.session_name = session_name
+        self._env: dict[str, str] | None = None
+
+    def env(self, ctx: Context) -> dict[str, str] | None:
+        """The environment `aws` and `sam` run with: temporary credentials from `role_arn` when set, the caller's own otherwise."""
+        if not self.role_arn:
+            return None
+
+        if self._env is None:
+            self._env = {
+                **os.environ,
+                **assume_role(ctx, self.role_arn, self.session_name, self.region),
+            }
+
+        return self._env
 
     def _stage(self, ctx: Context) -> str:
         return "prod" if ctx.stage == "prod" else "default"
@@ -72,19 +96,30 @@ class LambdaTarget(DeployTarget):
             )
 
         self._stack(ctx)
-        shell.aws("sts", "get-caller-identity", region=self._region(ctx))
-        shell.run([shell.require("sam", ""), "validate", "--lint"], cwd=ctx.repo_root)
+        shell.aws(
+            "sts", "get-caller-identity", region=self._region(ctx), env=self.env(ctx)
+        )
+        shell.run(
+            [*shell.require("sam", ""), "validate", "--lint"],
+            cwd=ctx.repo_root,
+            env=self.env(ctx),
+        )
 
     def deploy(self, ctx: Context) -> DeployResult:
         sam = shell.require("sam", "pip install aws-sam-cli")
         stage = self._stage(ctx)
-        shell.run([sam, "build"], cwd=ctx.repo_root)
-        args = [sam, "deploy", "--no-confirm-changeset", "--no-fail-on-empty-changeset"]
+        shell.run([*sam, "build"], cwd=ctx.repo_root, env=self.env(ctx))
+        args = [
+            *sam,
+            "deploy",
+            "--no-confirm-changeset",
+            "--no-fail-on-empty-changeset",
+        ]
 
         if stage != "default":
             args += ["--config-env", stage]
 
-        shell.run(args, cwd=ctx.repo_root)
+        shell.run(args, cwd=ctx.repo_root, env=self.env(ctx))
         url = self._url(ctx)
 
         return DeployResult(
@@ -104,6 +139,7 @@ class LambdaTarget(DeployTarget):
             "--stack-name",
             self._stack(ctx),
             region=self._region(ctx),
+            env=self.env(ctx),
         )
 
     def diagnose(self, ctx: Context) -> Diagnosis:
@@ -116,6 +152,7 @@ class LambdaTarget(DeployTarget):
                 "--stack-name",
                 stack,
                 region=self._region(ctx),
+                env=self.env(ctx),
             )
         except DeployError as e:
             return Diagnosis(
@@ -145,16 +182,65 @@ class LambdaTarget(DeployTarget):
 
     def delete(self, ctx: Context) -> None:
         sam = shell.require("sam", "pip install aws-sam-cli")
-        args = [sam, "delete", "--no-prompts", "--stack-name", self._stack(ctx)]
+        args = [*sam, "delete", "--no-prompts", "--stack-name", self._stack(ctx)]
         region = self._region(ctx)
 
         if region:
             args += ["--region", region]
 
-        shell.run(args, cwd=ctx.repo_root)
+        shell.run(args, cwd=ctx.repo_root, env=self.env(ctx))
 
     def _url(self, ctx: Context) -> str | None:
         try:
             return self.diagnose(ctx).url
         except DeployError:
             return None
+
+
+def assume_role(
+    ctx: Context, role_arn: str, session_name: str, region: str | None
+) -> dict[str, str]:
+    """Temporary credentials for `role_arn` from an OIDC token: the platform's for a deploy it runs, the platform the CLI is logged in to otherwise."""
+    token = ctx.identity_token("sts.amazonaws.com")
+
+    if token is None:
+        try:
+            token = Remote.from_credentials().identity_token("sts.amazonaws.com")[
+                "token"
+            ]
+        except ActionPlatformError as e:
+            raise DeployError(
+                f"role_arn is set but nothing can sign an identity token here: {e}. "
+                "Deploy from the platform, or log in with `action-platform login`."
+            ) from e
+
+    data = shell.aws(
+        "sts",
+        "assume-role-with-web-identity",
+        "--role-arn",
+        role_arn,
+        "--role-session-name",
+        session_name,
+        "--web-identity-token",
+        token,
+        "--duration-seconds",
+        "3600",
+        region=region,
+        env={
+            k: v
+            for k, v in os.environ.items()
+            if not k.startswith("AWS_ACCESS") and k != "AWS_SESSION_TOKEN"
+        },
+    )
+    creds = data.get("Credentials") or {}
+
+    if not creds.get("AccessKeyId"):
+        raise DeployError(
+            f"assume-role-with-web-identity gave no credentials for {role_arn}"
+        )
+
+    return {
+        "AWS_ACCESS_KEY_ID": creds["AccessKeyId"],
+        "AWS_SECRET_ACCESS_KEY": creds["SecretAccessKey"],
+        "AWS_SESSION_TOKEN": creds["SessionToken"],
+    }

{apx_aws_lambda-0.1.0 → apx_aws_lambda-0.3.0}/apx_aws_lambda/overlays/cloud/aws/lambda/{{cookiecutter.project_slug}}/_lang/python/lambda_handler.py

@@ -7,9 +7,10 @@ milliseconds. Stateless transports are the app's own concern (see create_app).
 
 import os
 
-from app import create_app
 from mangum import Mangum
 
+from app import create_app
+
 
 def lambda_handler(event, context):
     adapter = Mangum(

{apx_aws_lambda-0.1.0 → apx_aws_lambda-0.3.0}/apx_aws_lambda/plugin.py

@@ -15,10 +15,10 @@ class AwsLambdaPlugin(Plugin):
     description = (
         "Deploy to AWS Lambda with SAM; read CloudFormation stacks and functions"
     )
-    min_core = "0.16"
+    min_core = "0.17"
     needs = [
-        "tool: aws (AWS CLI v2), sam (AWS SAM CLI)",
-        "env: AWS_PROFILE or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, AWS_REGION",
+        "tool: aws, sam (bundled as Python packages when not on PATH)",
+        "env: AWS_REGION; credentials from role_arn (OIDC, no keys) or the AWS CLI chain (SSO, profile, instance role)",
         "net: *.amazonaws.com",
     ]
 

apx_aws_lambda-0.3.0/apx_aws_lambda/shell.py

@@ -0,0 +1,66 @@
+"""Running `aws` and `sam` — the two CLIs the targets drive — and reading their JSON."""
+
+from __future__ import annotations
+
+import importlib.util
+import json
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+from typing import Any
+
+from action_platform.core.exception import DeployError
+
+MODULES = {"aws": "awscli", "sam": "samcli"}
+
+
+def require(tool: str, hint: str) -> list[str]:
+    """How to run `tool`: the binary on PATH, else the Python module the plugin depends on (`python -m awscli` / `python -m samcli`) — what makes the hosted platform work without the CLIs in its image."""
+    path = shutil.which(tool)
+
+    if path:
+        return [path]
+
+    module = MODULES.get(tool)
+
+    if module and importlib.util.find_spec(module) is not None:
+        return [sys.executable, "-m", module]
+
+    raise DeployError(f"{tool} is not installed: {hint}")
+
+
+def run(
+    args: list[str], cwd: Path | None = None, env: dict[str, str] | None = None
+) -> str:
+    result = subprocess.run(
+        args, cwd=cwd, env=env, capture_output=True, text=True, check=False
+    )
+
+    if result.returncode != 0:
+        raise DeployError(
+            f"{' '.join(args[:2])} failed: {(result.stderr or result.stdout).strip()[-2000:]}"
+        )
+
+    return result.stdout
+
+
+def aws(
+    *args: str,
+    region: str | None = None,
+    cwd: Path | None = None,
+    env: dict[str, str] | None = None,
+) -> Any:
+    command = [
+        *require("aws", "https://aws.amazon.com/cli/"),
+        *args,
+        "--output",
+        "json",
+    ]
+
+    if region:
+        command += ["--region", region]
+
+    out = run(command, cwd=cwd, env=env)
+
+    return json.loads(out) if out.strip() else {}

apx_aws_lambda-0.3.0/apx_aws_lambda.egg-info/PKG-INFO

@@ -0,0 +1,93 @@
+Metadata-Version: 2.4
+Name: apx-aws-lambda
+Version: 0.3.0
+Summary: AWS Lambda for Action Platform: the aws/lambda deploy target (SAM) with its overlay, and tools to read stacks and functions.
+Author-email: Action Platform <cloud@actionplatform.io>
+License-Expression: Apache-2.0
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: action-platform>=0.17
+Requires-Dist: awscli>=1.34
+Requires-Dist: aws-sam-cli>=1.120
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+Requires-Dist: action-platform[mcp]; extra == "dev"
+Dynamic: license-file
+
+# apx-aws-lambda
+
+AWS Lambda for [Action Platform](https://github.com/actionplatform/action-platform): the `aws/lambda` deploy target (SAM) with its overlay, read-only tools and commands. `apx-` is the prefix every Action Platform extension carries.
+
+```bash
+action-platform plugin install aws-lambda
+action-platform cloud set aws/lambda        # overlay files come from this plugin
+action-platform deploy --dry-run            # preflight: sam validate, credentials
+action-platform deploy                      # sam build + sam deploy --config-env <stage>
+action-platform diagnose
+```
+
+| | |
+|---|---|
+| Overlay | `template.yaml`, `samconfig.toml`, `lambda_handler.py`, `Makefile`, `requirements/` (IAM), `.github/workflows/deploy.yml` |
+| Deploy | `sam build` + `sam deploy --config-env <stage>` (`dev` → `default`, `prod` → `prod`) |
+| Rollback | CloudFormation `rollback-stack` — previous stack state |
+| Diagnose | stack status and the HTTP API url |
+| Destroy | `sam delete` |
+
+`[deploy]` in platform.toml:
+
+```toml
+[deploy]
+target = "aws/lambda"
+region = "us-east-1"          # optional; samconfig.toml / AWS_REGION otherwise
+```
+
+## Credentials without keys
+
+Set `role_arn` and nothing else: the target assumes that role with a short-lived OIDC token the platform signs (`sts assume-role-with-web-identity`). No access key on the platform, on your machine or in the repository; what the app may do is the role's policy.
+
+```toml
+[deploy]
+target = "aws/lambda"
+role_arn = "arn:aws:iam::123456789012:role/shop-deploy"
+```
+
+Once per AWS account, register the platform as an identity provider — its discovery document is `https://<platform>/.well-known/openid-configuration`:
+
+```bash
+aws iam create-open-id-connect-provider --url https://platform.example.com --client-id-list sts.amazonaws.com
+```
+
+Then a role per app (or per project) whose trust policy names the platform and the app; `requirements/policy.json` from the overlay is its permission policy:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Principal": { "Federated": "arn:aws:iam::123456789012:oidc-provider/platform.example.com" },
+    "Action": "sts:AssumeRoleWithWebIdentity",
+    "Condition": {
+      "StringEquals": { "platform.example.com:aud": "sts.amazonaws.com" },
+      "StringLike": { "platform.example.com:sub": "org:acme:project:shop:app:orders" }
+    }
+  }]
+}
+```
+
+`sub` is `org:<org>:project:<project>:app:<app>` for a deploy the platform runs; `org:<org>` plus an `actor` claim for `action-platform deploy` from a logged-in machine (`StringLike` with `org:acme:*` covers both). Without `role_arn` the AWS CLI's own chain applies: `aws sso login`, a profile, an instance role — still no key in a file when you use SSO.
+
+Tools (`action-platform mcp`): `aws_lambda_stacks`, `aws_lambda_functions`. Commands: `action-platform aws-lambda stacks|functions`. Deploying itself goes through the core's `deploy` / `rollback` / `diagnose`, which drive the target.
+
+Needs: `aws` and `sam` — on PATH when present, otherwise the `awscli` and `aws-sam-cli` packages the plugin depends on run as `python -m`, which is how the hosted platform deploys without the CLIs in its image; `AWS_REGION` (or `region` under `[deploy]`), and either `role_arn` (OIDC, no keys) or the AWS CLI's own credentials. Talks to `*.amazonaws.com` only.
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+```
+
+The tests fake `aws` and `sam`; nothing reaches AWS.

apx_aws_lambda-0.3.0/apx_aws_lambda.egg-info/requires.txt

@@ -0,0 +1,8 @@
+action-platform>=0.17
+awscli>=1.34
+aws-sam-cli>=1.120
+
+[dev]
+pytest>=8
+ruff>=0.6
+action-platform[mcp]

{apx_aws_lambda-0.1.0 → apx_aws_lambda-0.3.0}/pyproject.toml

@@ -1,12 +1,12 @@
 [project]
 name = "apx-aws-lambda"
-version = "0.1.0"
+version = "0.3.0"
 description = "AWS Lambda for Action Platform: the aws/lambda deploy target (SAM) with its overlay, and tools to read stacks and functions."
 readme = "README.md"
 license = "Apache-2.0"
 requires-python = ">=3.11"
 authors = [{ name = "Action Platform", email = "cloud@actionplatform.io" }]
-dependencies = ["action-platform>=0.16"]
+dependencies = ["action-platform>=0.17", "awscli>=1.34", "aws-sam-cli>=1.120"]
 
 [project.optional-dependencies]
 dev = ["pytest>=8", "ruff>=0.6", "action-platform[mcp]"]

{apx_aws_lambda-0.1.0 → apx_aws_lambda-0.3.0}/tests/test_targets.py

@@ -43,7 +43,7 @@ class LambdaTargetTest(unittest.TestCase):
             return json.dumps(answers.get(key, {}))
 
         return mock.patch.multiple(
-            shell, run=run, require=lambda tool, hint: f"/usr/bin/{tool}"
+            shell, run=run, require=lambda tool, hint: [f"/usr/bin/{tool}"]
         )
 
     def ctx(self, stage="dev"):
@@ -141,3 +141,53 @@ class PluginTest(unittest.TestCase):
         names = {t.name for t in asyncio.run(server.build().list_tools())}
 
         self.assertLessEqual({"aws_lambda_stacks", "aws_lambda_functions"}, names)
+
+
+class AssumeRoleTest(unittest.TestCase):
+    def test_role_arn_turns_the_platform_token_into_temporary_credentials(self):
+        calls: list[list[str]] = []
+
+        def run(args, cwd=None, env=None):
+            calls.append([Path(args[0]).name, *args[1:]])
+            if args[1:3] == ["sts", "assume-role-with-web-identity"]:
+                return json.dumps(
+                    {
+                        "Credentials": {
+                            "AccessKeyId": "AKIA",
+                            "SecretAccessKey": "s",
+                            "SessionToken": "t",
+                        }
+                    }
+                )
+            return json.dumps(
+                {"Stacks": [{"StackStatus": "UPDATE_COMPLETE", "Outputs": []}]}
+            )
+
+        ctx = Context(repo_root=Path("."), identity=lambda aud: f"jwt-for-{aud}")
+
+        with mock.patch.multiple(
+            shell, run=run, require=lambda t, h: [f"/usr/bin/{t}"]
+        ):
+            env = LambdaTarget(
+                role_arn="arn:aws:iam::1:role/deploy", region="us-east-1"
+            ).env(ctx)
+
+        self.assertEqual(env["AWS_ACCESS_KEY_ID"], "AKIA")
+        self.assertEqual(env["AWS_SESSION_TOKEN"], "t")
+        sts = next(
+            c for c in calls if c[1:3] == ["sts", "assume-role-with-web-identity"]
+        )
+        self.assertIn("jwt-for-sts.amazonaws.com", sts)
+        self.assertIn("arn:aws:iam::1:role/deploy", sts)
+
+    def test_without_an_issuer_or_a_login_it_says_so(self):
+        with (
+            mock.patch.object(shell, "require", lambda t, h: "/usr/bin/aws"),
+            mock.patch.dict("os.environ", {"AP_HOME": "/nonexistent"}, clear=False),
+        ):
+            with self.assertRaises(DeployError) as caught:
+                LambdaTarget(role_arn="arn:aws:iam::1:role/deploy").env(
+                    Context(repo_root=Path("."))
+                )
+
+        self.assertIn("log in", str(caught.exception))

apx_aws_lambda-0.1.0/PKG-INFO

@@ -1,56 +0,0 @@
-Metadata-Version: 2.4
-Name: apx-aws-lambda
-Version: 0.1.0
-Summary: AWS Lambda for Action Platform: the aws/lambda deploy target (SAM) with its overlay, and tools to read stacks and functions.
-Author-email: Action Platform <cloud@actionplatform.io>
-License-Expression: Apache-2.0
-Requires-Python: >=3.11
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: action-platform>=0.16
-Provides-Extra: dev
-Requires-Dist: pytest>=8; extra == "dev"
-Requires-Dist: ruff>=0.6; extra == "dev"
-Requires-Dist: action-platform[mcp]; extra == "dev"
-Dynamic: license-file
-
-# apx-aws-lambda
-
-AWS Lambda for [Action Platform](https://github.com/actionplatform/action-platform): the `aws/lambda` deploy target (SAM) with its overlay, read-only tools and commands. `apx-` is the prefix every Action Platform extension carries.
-
-```bash
-action-platform plugin install aws-lambda
-action-platform cloud set aws/lambda        # overlay files come from this plugin
-action-platform deploy --dry-run            # preflight: sam validate, credentials
-action-platform deploy                      # sam build + sam deploy --config-env <stage>
-action-platform diagnose
-```
-
-| | |
-|---|---|
-| Overlay | `template.yaml`, `samconfig.toml`, `lambda_handler.py`, `Makefile`, `requirements/` (IAM), `.github/workflows/deploy.yml` |
-| Deploy | `sam build` + `sam deploy --config-env <stage>` (`dev` → `default`, `prod` → `prod`) |
-| Rollback | CloudFormation `rollback-stack` — previous stack state |
-| Diagnose | stack status and the HTTP API url |
-| Destroy | `sam delete` |
-
-`[deploy]` in platform.toml:
-
-```toml
-[deploy]
-target = "aws/lambda"
-region = "us-east-1"          # optional; samconfig.toml / AWS_REGION otherwise
-```
-
-Tools (`action-platform mcp`): `aws_lambda_stacks`, `aws_lambda_functions`. Commands: `action-platform aws-lambda stacks|functions`. Deploying itself goes through the core's `deploy` / `rollback` / `diagnose`, which drive the target.
-
-Needs: AWS CLI v2 (`aws`), SAM CLI (`sam`), credentials in the environment (`AWS_PROFILE` or keys), `AWS_REGION`. Talks to `*.amazonaws.com` only.
-
-## Development
-
-```bash
-pip install -e ".[dev]"
-pytest
-```
-
-The tests fake `aws` and `sam`; nothing reaches AWS.

apx_aws_lambda-0.1.0/README.md

@@ -1,40 +0,0 @@
-# apx-aws-lambda
-
-AWS Lambda for [Action Platform](https://github.com/actionplatform/action-platform): the `aws/lambda` deploy target (SAM) with its overlay, read-only tools and commands. `apx-` is the prefix every Action Platform extension carries.
-
-```bash
-action-platform plugin install aws-lambda
-action-platform cloud set aws/lambda        # overlay files come from this plugin
-action-platform deploy --dry-run            # preflight: sam validate, credentials
-action-platform deploy                      # sam build + sam deploy --config-env <stage>
-action-platform diagnose
-```
-
-| | |
-|---|---|
-| Overlay | `template.yaml`, `samconfig.toml`, `lambda_handler.py`, `Makefile`, `requirements/` (IAM), `.github/workflows/deploy.yml` |
-| Deploy | `sam build` + `sam deploy --config-env <stage>` (`dev` → `default`, `prod` → `prod`) |
-| Rollback | CloudFormation `rollback-stack` — previous stack state |
-| Diagnose | stack status and the HTTP API url |
-| Destroy | `sam delete` |
-
-`[deploy]` in platform.toml:
-
-```toml
-[deploy]
-target = "aws/lambda"
-region = "us-east-1"          # optional; samconfig.toml / AWS_REGION otherwise
-```
-
-Tools (`action-platform mcp`): `aws_lambda_stacks`, `aws_lambda_functions`. Commands: `action-platform aws-lambda stacks|functions`. Deploying itself goes through the core's `deploy` / `rollback` / `diagnose`, which drive the target.
-
-Needs: AWS CLI v2 (`aws`), SAM CLI (`sam`), credentials in the environment (`AWS_PROFILE` or keys), `AWS_REGION`. Talks to `*.amazonaws.com` only.
-
-## Development
-
-```bash
-pip install -e ".[dev]"
-pytest
-```
-
-The tests fake `aws` and `sam`; nothing reaches AWS.

apx_aws_lambda-0.1.0/apx_aws_lambda/shell.py

@@ -1,46 +0,0 @@
-"""Running `aws` and `sam` — the two CLIs the targets drive — and reading their JSON."""
-
-from __future__ import annotations
-
-import json
-import shutil
-import subprocess
-from pathlib import Path
-from typing import Any
-
-from action_platform.core.exception import DeployError
-
-
-def require(tool: str, hint: str) -> str:
-    path = shutil.which(tool)
-
-    if not path:
-        raise DeployError(f"{tool} is not installed: {hint}")
-
-    return path
-
-
-def run(
-    args: list[str], cwd: Path | None = None, env: dict[str, str] | None = None
-) -> str:
-    result = subprocess.run(
-        args, cwd=cwd, env=env, capture_output=True, text=True, check=False
-    )
-
-    if result.returncode != 0:
-        raise DeployError(
-            f"{' '.join(args[:2])} failed: {(result.stderr or result.stdout).strip()[-2000:]}"
-        )
-
-    return result.stdout
-
-
-def aws(*args: str, region: str | None = None, cwd: Path | None = None) -> Any:
-    command = [require("aws", "https://aws.amazon.com/cli/"), *args, "--output", "json"]
-
-    if region:
-        command += ["--region", region]
-
-    out = run(command, cwd=cwd)
-
-    return json.loads(out) if out.strip() else {}

apx_aws_lambda-0.1.0/apx_aws_lambda.egg-info/PKG-INFO

@@ -1,56 +0,0 @@
-Metadata-Version: 2.4
-Name: apx-aws-lambda
-Version: 0.1.0
-Summary: AWS Lambda for Action Platform: the aws/lambda deploy target (SAM) with its overlay, and tools to read stacks and functions.
-Author-email: Action Platform <cloud@actionplatform.io>
-License-Expression: Apache-2.0
-Requires-Python: >=3.11
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: action-platform>=0.16
-Provides-Extra: dev
-Requires-Dist: pytest>=8; extra == "dev"
-Requires-Dist: ruff>=0.6; extra == "dev"
-Requires-Dist: action-platform[mcp]; extra == "dev"
-Dynamic: license-file
-
-# apx-aws-lambda
-
-AWS Lambda for [Action Platform](https://github.com/actionplatform/action-platform): the `aws/lambda` deploy target (SAM) with its overlay, read-only tools and commands. `apx-` is the prefix every Action Platform extension carries.
-
-```bash
-action-platform plugin install aws-lambda
-action-platform cloud set aws/lambda        # overlay files come from this plugin
-action-platform deploy --dry-run            # preflight: sam validate, credentials
-action-platform deploy                      # sam build + sam deploy --config-env <stage>
-action-platform diagnose
-```
-
-| | |
-|---|---|
-| Overlay | `template.yaml`, `samconfig.toml`, `lambda_handler.py`, `Makefile`, `requirements/` (IAM), `.github/workflows/deploy.yml` |
-| Deploy | `sam build` + `sam deploy --config-env <stage>` (`dev` → `default`, `prod` → `prod`) |
-| Rollback | CloudFormation `rollback-stack` — previous stack state |
-| Diagnose | stack status and the HTTP API url |
-| Destroy | `sam delete` |
-
-`[deploy]` in platform.toml:
-
-```toml
-[deploy]
-target = "aws/lambda"
-region = "us-east-1"          # optional; samconfig.toml / AWS_REGION otherwise
-```
-
-Tools (`action-platform mcp`): `aws_lambda_stacks`, `aws_lambda_functions`. Commands: `action-platform aws-lambda stacks|functions`. Deploying itself goes through the core's `deploy` / `rollback` / `diagnose`, which drive the target.
-
-Needs: AWS CLI v2 (`aws`), SAM CLI (`sam`), credentials in the environment (`AWS_PROFILE` or keys), `AWS_REGION`. Talks to `*.amazonaws.com` only.
-
-## Development
-
-```bash
-pip install -e ".[dev]"
-pytest
-```
-
-The tests fake `aws` and `sam`; nothing reaches AWS.

apx_aws_lambda-0.1.0/apx_aws_lambda.egg-info/requires.txt

@@ -1,6 +0,0 @@
-action-platform>=0.16
-
-[dev]
-pytest>=8
-ruff>=0.6
-action-platform[mcp]