-
Notifications
You must be signed in to change notification settings - Fork 10
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Breaking change] Refactor AWS credential initialization steps and mutation of `AWS_PROFILE`, `ARC_AWS_CREDS` Temporarily revert to `tap-spec`
- Loading branch information
Showing
8 changed files
with
152 additions
and
290 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| let awsLite = require('@aws-lite/client') | ||
| async function main () { | ||
| try { | ||
| let options = { autoloadPlugins: false, region: 'us-west-1' } | ||
| if (process.env._ARC_PROFILE) options.profile = process.env._ARC_PROFILE | ||
| await awsLite(options) | ||
| console.log(JSON.stringify({ ok: true })) | ||
| } | ||
| catch (err) { | ||
| console.log(JSON.stringify({ | ||
| error: err.message, | ||
| stack: err.stack, | ||
| })) | ||
| } | ||
| } | ||
| main() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| let { join } = require('path') | ||
|
|
||
| /** | ||
| * Credential check and possible backstop | ||
| * - aws-lite requires credentials to initialize | ||
| * - Architect needs credentials for some things (e.g. Deploy), but also has a variety of offline workflows that interface with AWS service API emulators (e.g. Sandbox) | ||
| * - Thus, sometimes it's ok to use dummy creds, sometimes we need to halt | ||
| */ | ||
| module.exports = function credCheck ({ checkCreds = true, inventory, needsValidCreds = false }) { | ||
| if (!checkCreds) return | ||
|
|
||
| // eslint-disable-next-line | ||
| let { execFileSync } = require('child_process') | ||
| let script = join(__dirname, '_get-creds.js') | ||
| function check () { | ||
| try { | ||
| let env = { ...process.env } | ||
| if (inventory.inv?.aws?.profile) { | ||
| env._ARC_PROFILE = inventory.inv?.aws?.profile | ||
| } | ||
| let result = execFileSync('node', [ script ], { env }) | ||
| return JSON.parse(result) | ||
| } | ||
| catch (err) { | ||
| console.error('Unknown credential check error') | ||
| throw err | ||
| } | ||
| } | ||
|
|
||
| let creds = check() | ||
| if (creds.error && needsValidCreds) { | ||
| return Error('Valid credentials needed to run this command; missing or invalid credentials') | ||
| } | ||
| else if (creds.error) { | ||
| /** | ||
| * Backfill creds - any creds will do for local service emulation | ||
| * - Be sure we backfill Lambda's prepopulated env vars | ||
| * - sessionToken / AWS_SESSION_TOKEN is optional, skip so as not to introduce unintended side-effects | ||
| */ | ||
| process.env.ARC_AWS_CREDS = 'dummy' | ||
| process.env.AWS_ACCESS_KEY_ID = 'arc_dummy_access_key' | ||
| process.env.AWS_SECRET_ACCESS_KEY = 'arc_dummy_secret_key' | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| let test = require('tape') | ||
| let credCheck = require('../../banner/cred-check') | ||
|
|
||
| function reset (t) { | ||
| let envVars = [ | ||
| 'ARC_AWS_CREDS', | ||
| 'AWS_PROFILE', | ||
| 'AWS_REGION', | ||
| 'AWS_ACCESS_KEY_ID', | ||
| 'AWS_SECRET_ACCESS_KEY', | ||
| 'AWS_SESSION_TOKEN', | ||
| 'AWS_SHARED_CREDENTIALS_FILE', | ||
| ] | ||
| envVars.forEach(v => delete process.env[v]) | ||
| envVars.forEach(v => { | ||
| if (process.env[v]) t.fail(`Found errant env var: ${v}`) | ||
| }) | ||
| } | ||
|
|
||
| let inventory = { inv: { aws: {} } } | ||
|
|
||
| test('Set up env', t => { | ||
| t.plan(1) | ||
| t.ok(credCheck, 'Found credCheck') | ||
| }) | ||
|
|
||
| test('Credential check is disabled', t => { | ||
| t.plan(2) | ||
| let err = credCheck({ checkCreds: false, inventory }) | ||
| t.notOk(err, 'No credential loading error reported') | ||
| t.notOk(process.env.ARC_AWS_CREDS, 'Did not mutate ARC_AWS_CREDS') | ||
| reset(t) | ||
| }) | ||
|
|
||
| test('Credential checks', t => { | ||
| t.plan(3) | ||
| let err | ||
|
|
||
| // Count on aws-lite finding creds (via env) | ||
| process.env.AWS_ACCESS_KEY_ID = 'yo' | ||
| process.env.AWS_SECRET_ACCESS_KEY = 'yo' | ||
| err = credCheck({ inventory }) | ||
| t.notOk(err, 'No credential loading error reported') | ||
| t.notOk(process.env.ARC_AWS_CREDS, 'Did not mutate ARC_AWS_CREDS') | ||
|
|
||
| // Fail a cred check | ||
| reset(t) | ||
| process.env.AWS_PROFILE = 'random_profile_name_that_does_not_exist' | ||
| err = credCheck({ inventory, needsValidCreds: true }) | ||
| t.ok(err, 'Reported credential loading error') | ||
| console.log(err) | ||
| reset(t) | ||
| }) | ||
|
|
||
| test('Credential backfill', t => { | ||
| t.plan(4) | ||
| process.env.AWS_PROFILE = 'random_profile_name_that_does_not_exist' | ||
| let err = credCheck({ inventory }) | ||
| t.notOk(err, 'No credential loading error reported') | ||
| t.equal(process.env.ARC_AWS_CREDS, 'dummy', 'Mutated ARC_AWS_CREDS') | ||
| t.equal(process.env.AWS_ACCESS_KEY_ID, 'arc_dummy_access_key', 'Mutated AWS_ACCESS_KEY_ID') | ||
| t.equal(process.env.AWS_SECRET_ACCESS_KEY, 'arc_dummy_secret_key', 'Mutated AWS_SECRET_ACCESS_KEY') | ||
| reset(t) | ||
| }) |
Oops, something went wrong.