Skip to content

chore(layers): add workflows for govcloud layers #3747

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Mar 21, 2025
Merged

chore(layers): add workflows for govcloud layers #3747

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
1758376
chore: add workflows for govloud layers
am29d Mar 19, 2025
4ac7f9f
chore: remove matrix and address other review comments
am29d Mar 19, 2025
cc249e9
fix comment and removed another matrix conf
am29d Mar 19, 2025
970dfa2
chore: add layer arn in docs: WIP - need acc numbers
am29d Mar 19, 2025
541cf06
chore: add govcloud accounts
am29d Mar 20, 2025
c665256
chore: set permission to none explictly for ossf
am29d Mar 20, 2025
90d9257
Merge branch 'main' into issue3423/govcloud-layers
am29d Mar 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
91 changes: 91 additions & 0 deletions .github/workflows/layer_govcloud_verify.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,91 @@
# GovCloud Layer Verification
# ---
# This workflow queries the GovCloud layer info in production only

on:
workflow_dispatch:
inputs:
version:
description: Layer version to verify information
type: string
required: true
workflow_call:
inputs:
version:
description: Layer version to verify information
type: string
required: true

name: Layer Verification (GovCloud)
run-name: Layer Verification (GovCloud)

jobs:
commercial:
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
strategy:
matrix:
layer:
- AWSLambdaPowertoolsTypeScriptV2
environment: Prod (Readonly)
steps:
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: us-east-1
mask-aws-account-id: true
- name: Output ${{ matrix.layer }}
run: |
aws --region us-east-1 lambda get-layer-version-by-arn --arn 'arn:aws:lambda:us-east-1:094274105915:layer:${{ matrix.layer }}:${{ inputs.version }}' | jq -r '{"Layer Version Arn": .LayerVersionArn, "Version": .Version, "Description": .Description, "Compatible Runtimes": .CompatibleRuntimes[0], "Compatible Architectures": .CompatibleArchitectures[0], "SHA": .Content.CodeSha256} | keys[] as $k | [$k, .[$k]] | @tsv' | column -t -s $'\t'

gov_east:
name: Verify (East)
needs: commercial
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
strategy:
matrix:
layer:
- AWSLambdaPowertoolsTypeScriptV2
environment: GovCloud Prod (East)
steps:
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: us-gov-east-1
mask-aws-account-id: true
- name: Verify Layer ${{ matrix.layer }}
id: verify-layer
run: |
aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}:${{ inputs.version }}' | jq -r '{"Layer Version Arn": .LayerVersionArn, "Version": .Version, "Description": .Description, "Compatible Runtimes": .CompatibleRuntimes[0], "Compatible Architectures": .CompatibleArchitectures[0], "SHA": .Content.CodeSha256} | keys[] as $k | [$k, .[$k]] | @tsv' | column -t -s $'\t'

gov_west:
name: Verify (West)
needs: commercial
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
strategy:
matrix:
layer:
- AWSLambdaPowertoolsTypeScriptV2

environment: GovCloud Prod (West)
steps:
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: us-gov-east-1
mask-aws-account-id: true
- name: Verify Layer ${{ matrix.layer }}
id: verify-layer
run: |
aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }}' | jq -r '{"Layer Version Arn": .LayerVersionArn, "Version": .Version, "Description": .Description, "Compatible Runtimes": .CompatibleRuntimes[0], "Compatible Architectures": .CompatibleArchitectures[0], "SHA": .Content.CodeSha256} | keys[] as $k | [$k, .[$k]] | @tsv' | column -t -s $'\t'
200 changes: 200 additions & 0 deletions .github/workflows/layers_govcloud.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,200 @@
name: Layer Deployment (GovCloud)

# GovCloud Layer Publish
# ---
# This workflow publishes a specific layer version in an AWS account based on the environment input.
#
# Using a matrix, we pull each architecture and python version of the layer and store them as artifacts
# we upload them to each of the GovCloud AWS accounts.
#
# A number of safety checks are performed to ensure safety.

on:
workflow_dispatch:
inputs:
environment:
description: Deployment environment
type: choice
options:
- Gamma
- Prod
required: true
version:
description: Layer version to duplicate
type: string
required: true
workflow_call:
inputs:
environment:
description: Deployment environment
type: string
required: true
version:
description: Layer version to duplicate
type: string
required: true

run-name: Layer Deployment (GovCloud) - ${{ inputs.environment }}

permissions:
contents: read

jobs:
download:
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
strategy:
matrix:
layer:
- AWSLambdaPowertoolsTypeScriptV2
environment: Prod (Readonly)
steps:
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: us-east-1
mask-aws-account-id: true
- name: Grab Zip
run: |
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:094274105915:layer:${{ matrix.layer }}:${{ inputs.version }} --query 'Content.Location' | xargs curl -L -o ${{ matrix.layer }}.zip
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:094274105915:layer:${{ matrix.layer }}:${{ inputs.version }} > ${{ matrix.layer }}.json
- name: Store Zip
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
with:
name: ${{ matrix.layer }}.zip
path: ${{ matrix.layer }}.zip
retention-days: 1
if-no-files-found: error
- name: Store Metadata
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
with:
name: ${{ matrix.layer }}.json
path: ${{ matrix.layer }}.json
retention-days: 1
if-no-files-found: error

copy_east:
name: Copy (East)
needs: download
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
strategy:
matrix:
layer:
- AWSLambdaPowertoolsTypeScriptV2
environment: GovCloud ${{ inputs.environment }} (East)
steps:
- name: Download Zip
uses: actions/download-artifact@b14cf4c92620c250e1c074ab0a5800e37df86765 # v4.2.0
with:
name: ${{ matrix.layer }}.zip
- name: Download Metadata
uses: actions/download-artifact@b14cf4c92620c250e1c074ab0a5800e37df86765 # v4.2.0
with:
name: ${{ matrix.layer }}.json
- name: Verify Layer Signature
run: |
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}.json')
test "$(openssl dgst -sha256 -binary ${{ matrix.layer }}.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: us-gov-east-1
mask-aws-account-id: true
- name: Create Layer
id: create-layer
run: |
LAYER_VERSION=$(aws --region us-gov-east-1 lambda publish-layer-version \
--layer-name ${{ matrix.layer }} \
--zip-file fileb://./${{ matrix.layer }}.zip \
--compatible-runtimes "$(jq -r '.CompatibleRuntimes[0]' '${{ matrix.layer }}.json')" \
--compatible-architectures "$(jq -r '.CompatibleArchitectures[0]' '${{ matrix.layer }}.json')" \
--license-info "MIT-0" \
--description "$(jq -r '.Description' '${{ matrix.layer }}.json')" \
--query 'Version' \
--output text)

echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"

aws --region us-gov-east-1 lambda add-layer-version-permission \
--layer-name '${{ matrix.layer }}' \
--statement-id 'PublicLayer' \
--action lambda:GetLayerVersion \
--principal '*' \
--version-number "$LAYER_VERSION"
- name: Verify Layer
env:
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
run: |
REMOTE_SHA=$(aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}:${{ env.LAYER_VERSION }}' --query 'Content.CodeSha256' --output text)
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}.json')
test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}:${{ env.LAYER_VERSION }}' --output table

copy_west:
name: Copy (West)
needs: download
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
strategy:
matrix:
layer:
- AWSLambdaPowertoolsTypeScriptV2
environment:
name: GovCloud ${{ inputs.environment }} (West)
steps:
- name: Download Zip
uses: actions/download-artifact@b14cf4c92620c250e1c074ab0a5800e37df86765 # v4.2.0
with:
name: ${{ matrix.layer }}.zip
- name: Download Metadata
uses: actions/download-artifact@b14cf4c92620c250e1c074ab0a5800e37df86765 # v4.2.0
with:
name: ${{ matrix.layer }}.json
- name: Verify Layer Signature
run: |
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}.json')
test "$(openssl dgst -sha256 -binary ${{ matrix.layer }}.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: us-gov-west-1
mask-aws-account-id: true
- name: Create Layer
id: create-layer
run: |
LAYER_VERSION=$(aws --region us-gov-west-1 lambda publish-layer-version \
--layer-name ${{ matrix.layer }} \
--zip-file fileb://./${{ matrix.layer }}.zip \
--compatible-runtimes "$(jq -r '.CompatibleRuntimes[0]' '${{ matrix.layer }}.json')" \
--compatible-architectures "$(jq -r '.CompatibleArchitectures[0]' '${{ matrix.layer }}.json')" \
--license-info "MIT-0" \
--description "$(jq -r '.Description' '${{ matrix.layer }}.json')" \
--query 'Version' \
--output text)

echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"

aws --region us-gov-west-1 lambda add-layer-version-permission \
--layer-name '${{ matrix.layer }}' \
--statement-id 'PublicLayer' \
--action lambda:GetLayerVersion \
--principal '*' \
--version-number "$LAYER_VERSION"
- name: Verify Layer
env:
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
run: |
REMOTE_SHA=$(aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}:${{ env.LAYER_VERSION }}' --query 'Content.CodeSha256' --output text)
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}.json')
test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}:${{ env.LAYER_VERSION }}' --output table
Loading