feat(servicecatalog): Add Product Stack Asset Support

packages/@aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts

@@ -38,6 +38,13 @@ export interface BucketDeploymentProps {
    */
   readonly destinationKeyPrefix?: string;
 
+  /**
+   * If this is set, the zip file will be synced to the destination S3 bucket and unzipped.
+   * If false, the file will remain zipped in the destination bucket.
+   * @default true
+   */
+  readonly unzipFile?: boolean;
+
   /**
    * If this is set, matching files or objects will be excluded from the deployment's sync
    * command. This can be used to exclude a file from being pruned in the destination bucket.
@@ -349,6 +356,7 @@ export class BucketDeployment extends Construct {
         SourceMarkers: hasMarkers ? sources.map(source => source.markers ?? {}) : undefined,
         DestinationBucketName: props.destinationBucket.bucketName,
         DestinationBucketKeyPrefix: props.destinationKeyPrefix,
+        UnzipFile: props.unzipFile,
         RetainOnDelete: props.retainOnDelete,
         Prune: props.prune ?? true,
         Exclude: props.exclude,

packages/@aws-cdk/aws-s3-deployment/lib/lambda/index.py

@@ -49,6 +49,7 @@ def cfn_error(message=None):
             source_markers      = props.get('SourceMarkers', None)
             dest_bucket_name    = props['DestinationBucketName']
             dest_bucket_prefix  = props.get('DestinationBucketKeyPrefix', '')
+            unzip_file          = props.get('UnzipFile', 'true') == 'true'
             retain_on_delete    = props.get('RetainOnDelete', "true") == "true"
             distribution_id     = props.get('DistributionId', '')
             user_metadata       = props.get('UserMetadata', {})
@@ -113,7 +114,7 @@ def cfn_error(message=None):
             aws_command("s3", "rm", old_s3_dest, "--recursive")
 
         if request_type == "Update" or request_type == "Create":
-            s3_deploy(s3_source_zips, s3_dest, user_metadata, system_metadata, prune, exclude, include, source_markers)
+            s3_deploy(s3_source_zips, s3_dest, user_metadata, system_metadata, prune, exclude, include, source_markers, unzip_file)
 
         if distribution_id:
             cloudfront_invalidate(distribution_id, distribution_paths)
@@ -130,7 +131,7 @@ def cfn_error(message=None):
 
 #---------------------------------------------------------------------------------------------------
 # populate all files from s3_source_zips to a destination bucket
-def s3_deploy(s3_source_zips, s3_dest, user_metadata, system_metadata, prune, exclude, include, source_markers):
+def s3_deploy(s3_source_zips, s3_dest, user_metadata, system_metadata, prune, exclude, include, source_markers, unzip_file):
     # list lengths are equal
     if len(s3_source_zips) != len(source_markers):
         raise Exception("'source_markers' and 's3_source_zips' must be the same length")
@@ -154,12 +155,15 @@ def s3_deploy(s3_source_zips, s3_dest, user_metadata, system_metadata, prune, ex
             s3_source_zip = s3_source_zips[i]
             markers       = source_markers[i]
 
-            archive=os.path.join(workdir, str(uuid4()))
-            logger.info("archive: %s" % archive)
-            aws_command("s3", "cp", s3_source_zip, archive)
-            logger.info("| extracting archive to: %s\n" % contents_dir)
-            logger.info("| markers: %s" % markers)
-            extract_and_replace_markers(archive, contents_dir, markers)
+            if (unzip_file):
+                archive=os.path.join(workdir, str(uuid4()))
+                logger.info("archive: %s" % archive)
+                aws_command("s3", "cp", s3_source_zip, archive)
+                logger.info("| extracting archive to: %s\n" % contents_dir)
+                logger.info("| markers: %s" % markers)
+                extract_and_replace_markers(archive, contents_dir, markers)
+            else:
+                aws_command("s3", "cp", s3_source_zip, contents_dir)
 
         # sync from "contents" to destination
 

packages/@aws-cdk/aws-servicecatalog/README.md

@@ -185,6 +185,36 @@ const product = new servicecatalog.CloudFormationProduct(this, 'Product', {
 });
 ```
 
+You can now reference assets in a Product Stack. For example, we can add a handler to a Lambda function or a S3 Asset directly from a local asset file.
+
+```ts
+import * as lambda from '@aws-cdk/aws-lambda';
+import * as cdk from '@aws-cdk/core';
+
+class LambdaProduct extends servicecatalog.ProductStack {
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+
+    new lambda.Function(this, 'LambdaProduct', {
+      runtime: lambda.Runtime.PYTHON_3_9,
+      code: lambda.Code.fromAsset("./assets"),
+      handler: 'index.handler'
+    });
+  }
+}
+
+const product = new servicecatalog.CloudFormationProduct(this, 'Product', {
+  productName: "My Product",
+  owner: "Product Owner",
+  productVersions: [
+    {
+      productVersionName: "v1",
+      cloudFormationTemplate: servicecatalog.CloudFormationTemplate.fromProductStack(new LambdaProduct(this, 'LambdaFunctionProduct')),
+    },
+  ],
+});
+```
+
 ### Creating a Product from a stack with a history of previous versions
 
 The default behavior of Service Catalog is to overwrite each product version upon deployment.

packages/@aws-cdk/aws-servicecatalog/lib/cloudformation-template.ts

@@ -1,4 +1,5 @@
 import * as s3_assets from '@aws-cdk/aws-s3-assets';
+import { IBucket } from '@aws-cdk/aws-s3';
 import { Construct } from 'constructs';
 import { hashValues } from './private/util';
 import { ProductStack } from './product-stack';
@@ -46,9 +47,15 @@ export abstract class CloudFormationTemplate {
  */
 export interface CloudFormationTemplateConfig {
   /**
-    * The http url of the template in S3.
-    */
+  * The http url of the template in S3.
+  */
   readonly httpUrl: string;
+
+  /**
+  * The S3 bucket containing product stack assets.
+  * @default -
+  */
+  readonly assetBucket?: IBucket;
 }
 
 /**
@@ -108,6 +115,7 @@ class CloudFormationProductStackTemplate extends CloudFormationTemplate {
   public bind(_scope: Construct): CloudFormationTemplateConfig {
     return {
       httpUrl: this.productStack._getTemplateUrl(),
+      assetBucket: this.productStack._getAssetBucket(),
     };
   }
 }

packages/@aws-cdk/aws-servicecatalog/lib/portfolio.ts

@@ -1,7 +1,8 @@
 import * as iam from '@aws-cdk/aws-iam';
 import * as sns from '@aws-cdk/aws-sns';
 import * as cdk from '@aws-cdk/core';
-import { Construct } from 'constructs';
+import { IBucket } from '@aws-cdk/aws-s3';
+import { Construct, IConstruct } from 'constructs';
 import { MessageLanguage } from './common';
 import {
   CloudFormationRuleConstraintOptions, CommonConstraintOptions,
@@ -81,6 +82,11 @@ export interface IPortfolio extends cdk.IResource {
    */
   addProduct(product: IProduct): void;
 
+  /**
+   * Grants all shared accounts read permissions to each asset bucket.
+   */
+  giveAssetBucketsReadToSharedAccounts(): void;
+
   /**
    * Associate Tag Options.
    * A TagOption is a key-value pair managed in AWS Service Catalog.
@@ -105,7 +111,7 @@ export interface IPortfolio extends cdk.IResource {
    * @param product A service catalog product.
    * @param options options for the constraint.
    */
-  constrainCloudFormationParameters(product:IProduct, options: CloudFormationRuleConstraintOptions): void;
+  constrainCloudFormationParameters(product: IProduct, options: CloudFormationRuleConstraintOptions): void;
 
   /**
    * Force users to assume a certain role when launching a product.
@@ -155,6 +161,8 @@ abstract class PortfolioBase extends cdk.Resource implements IPortfolio {
   public abstract readonly portfolioArn: string;
   public abstract readonly portfolioId: string;
   private readonly associatedPrincipals: Set<string> = new Set();
+  private readonly assetBuckets: Set<IBucket> = new Set<IBucket>();
+  private readonly sharedAccounts: String[] = [];
 
   public giveAccessToRole(role: iam.IRole): void {
     this.associatePrincipal(role.roleArn, role.node.addr);
@@ -169,10 +177,14 @@ abstract class PortfolioBase extends cdk.Resource implements IPortfolio {
   }
 
   public addProduct(product: IProduct): void {
+    if (product.assetBucket) {
+      this.assetBuckets.add(product.assetBucket);
+    }
     AssociationManager.associateProductWithPortfolio(this, product, undefined);
   }
 
   public shareWithAccount(accountId: string, options: PortfolioShareOptions = {}): void {
+    this.sharedAccounts.push(accountId);
     const hashId = this.generateUniqueHash(accountId);
     new CfnPortfolioShare(this, `PortfolioShare${hashId}`, {
       portfolioId: this.portfolioId,
@@ -220,6 +232,14 @@ abstract class PortfolioBase extends cdk.Resource implements IPortfolio {
     AssociationManager.deployWithStackSets(this, product, options);
   }
 
+  public giveAssetBucketsReadToSharedAccounts() {
+    for (const bucket of this.assetBuckets) {
+      for (const accountId of this.sharedAccounts) {
+        bucket.grantRead(new iam.AccountPrincipal(accountId));
+      }
+    }
+  }
+
   /**
    * Associate a principal with the portfolio.
    * If the principal is already associated, it will skip.
@@ -336,6 +356,7 @@ export class Portfolio extends PortfolioBase {
     if (props.tagOptions !== undefined) {
       this.associateTagOptions(props.tagOptions);
     }
+    cdk.Aspects.of(this).add(new PortfolioAssetBucketSharer());
   }
 
   protected generateUniqueHash(value: string): string {
@@ -348,3 +369,12 @@ export class Portfolio extends PortfolioBase {
     InputValidator.validateLength(this.node.path, 'portfolio description', 0, 2000, props.description);
   }
 }
+
+class PortfolioAssetBucketSharer implements cdk.IAspect {
+  public visit(node: IConstruct): void {
+    if (node instanceof Portfolio) {
+      const portfolio = node as Portfolio;
+      portfolio.giveAssetBucketsReadToSharedAccounts();
+    }
+  }
+}

packages/@aws-cdk/aws-servicecatalog/lib/private/product-stack-asset-bucket.ts

@@ -0,0 +1,83 @@
+import * as cdk from '@aws-cdk/core';
+import { IBucket, BlockPublicAccess, Bucket } from '../../../aws-s3';
+import { BucketDeployment, ISource, Source } from '../../../aws-s3-deployment';
+import { Construct } from 'constructs';
+import { hashValues } from './util';
+
+/**
+ * A Service Catalog product stack asset bucket, which is similar in form to an Amazon S3 bucket.
+ * You can store multiple product stack assets and collectively deploy them to S3.
+ */
+export class ProductStackAssetBucket extends Construct {
+  private readonly bucketName: string;
+  private readonly bucket: IBucket;
+  private readonly assets: ISource[];
+
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+
+    this.bucketName = this.generateBucketName(id);
+
+    this.bucket = new Bucket(scope, `${id}S3Bucket`, {
+      bucketName: this.bucketName,
+      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
+    });
+
+    this.assets = [];
+  }
+
+  /**
+   * Fetch the S3 bucket.
+   *
+   * @internal
+   */
+  public getBucket(): IBucket {
+    return this.bucket;
+  }
+
+  /**
+   * Generate unique name for S3 bucket.
+   *
+   * @internal
+   */
+  private generateBucketName(id: string): string {
+    const accountId = cdk.Stack.of(this).account;
+    if (cdk.Token.isUnresolved(accountId)) {
+      throw new Error('CDK Account ID must be defined in the application environment');
+    }
+    return `product-stack-asset-bucket-${accountId}-${hashValues(id)}`;
+  }
+
+  /**
+   * Fetch the expected S3 location of an asset.
+   *
+   * @internal
+   */
+  public addAsset(asset: cdk.FileAssetSource): cdk.FileAssetLocation {
+    const assetPath = './cdk.out/' + asset.fileName;
+    this.assets.push(Source.asset(assetPath));
+
+    const bucketName = this.bucketName;
+    const s3Filename = asset.fileName?.split('.')[1] + '.zip';
+    const objectKey = `${s3Filename}`;
+    const s3ObjectUrl = `s3://${bucketName}/${objectKey}`;
+    const httpUrl = `https://s3.${bucketName}/${objectKey}`;
+
+    return { bucketName, objectKey, httpUrl, s3ObjectUrl, s3Url: httpUrl };
+  }
+
+  /**
+   * Deploy all assets to S3.
+   *
+   * @internal
+   */
+  public deployAssets() {
+    if (this.assets.length > 0) {
+      new BucketDeployment(this, 'AssetsBucketDeployment', {
+        sources: this.assets,
+        destinationBucket: this.bucket,
+        unzipFile: false,
+      });
+    }
+  }
+}

packages/@aws-cdk/aws-servicecatalog/lib/private/product-stack-synthesizer.ts

@@ -1,4 +1,7 @@
 import * as cdk from '@aws-cdk/core';
+import { ProductStack } from '../product-stack';
+import { ProductStackAssetBucket } from './product-stack-asset-bucket';
+import { hashValues } from './util';
 
 /**
  * Deployment environment for an AWS Service Catalog product stack.
@@ -7,6 +10,7 @@ import * as cdk from '@aws-cdk/core';
  */
 export class ProductStackSynthesizer extends cdk.StackSynthesizer {
   private stack?: cdk.Stack;
+  private assetBucket?: ProductStackAssetBucket;
 
   public bind(stack: cdk.Stack): void {
     if (this.stack !== undefined) {
@@ -16,17 +20,28 @@ export class ProductStackSynthesizer extends cdk.StackSynthesizer {
   }
 
   public addFileAsset(_asset: cdk.FileAssetSource): cdk.FileAssetLocation {
-    throw new Error('Service Catalog Product Stacks cannot use Assets');
+    if (!this.stack) {
+      throw new Error('You must call bindStack() first');
+    }
+
+    if (!this.assetBucket) {
+      const parentStack = (this.stack as ProductStack)._getParentStack();
+      this.assetBucket = new ProductStackAssetBucket(parentStack, `ProductStackAssetBucket${hashValues(this.stack.stackName)}`);
+      (this.stack as ProductStack)._setAssetBucket(this.assetBucket.getBucket());
+    }
+
+    return this.assetBucket.addAsset(_asset);
   }
 
   public addDockerImageAsset(_asset: cdk.DockerImageAssetSource): cdk.DockerImageAssetLocation {
-    throw new Error('Service Catalog Product Stacks cannot use Assets');
+    throw new Error('Service Catalog Product Stacks cannot use DockerImageAssets');
   }
 
   public synthesize(session: cdk.ISynthesisSession): void {
     if (!this.stack) {
       throw new Error('You must call bindStack() first');
     }
+    this.assetBucket?.deployAssets();
     // Synthesize the template, but don't emit as a cloud assembly artifact.
     // It will be registered as an S3 asset of its parent instead.
     this.synthesizeStackTemplate(this.stack, session);