Merge pull request #583 from aws/dev

chore: release 0.46

.github/workflows/codebuild-ci.yml

@@ -6,17 +6,25 @@ on:
       - main
       - dev
 
+permissions:
+  id-token: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v1
         with:
-          aws-access-key-id: ${{ secrets.CI_AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.CI_AWS_ACCESS_KEY_SECRET }}
+          role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
           aws-region: us-west-2
       - name: Run CodeBuild
+        id: codebuild
         uses: aws-actions/[email protected]
         with:
-          project-name: aws-dotnet-deploy-ci
+          project-name: ${{ secrets.CI_AWS_CODE_BUILD_PROJECT_NAME }}
+      - name: CodeBuild Link
+        shell: pwsh
+        run: |
+          $buildId = "${{ steps.codebuild.outputs.aws-build-id }}"
+          echo $buildId

THIRD_PARTY_LICENSES

@@ -1,5 +1,3 @@
-
-
 ** AWSSDK.AppRunner; version 3.7.3.11 -- https://www.nuget.org/packages/AWSSDK.AppRunner/
 ** AWSSDK.CloudFront; version 3.7.3.10 -- https://www.nuget.org/packages/AWSSDK.CloudFront/
 ** AWSSDK.CloudWatchEvents; version 3.7.3.14 -- https://www.nuget.org/packages/AWSSDK.CloudWatchEvents/
@@ -18,10 +16,11 @@
 ** AWSSDK.Extensions.NETCore.Setup; version 3.7.1 -- https://www.nuget.org/packages/AWSSDK.Extensions.NETCore.Setup
 ** AWSSDK.IdentityManagement; version 3.7.2.25 -- https://www.nuget.org/packages/AWSSDK.IdentityManagement
 ** AWSSDK.SecurityToken; version 3.7.1.35 -- https://www.nuget.org/packages/AWSSDK.SecurityToken
-** AWSSDK.SimpleSystemsManagement; version 3.7.16 -- https://www.nuget.org/packages/AWSSDK.SimpleSystemsManagement
 ** Constructs; version 10.0.0 -- https://www.nuget.org/packages/Constructs
 ** Amazon.CDK.Lib; version 2.13.0 -- https://www.nuget.org/packages/Amazon.CDK.Lib/
 ** Amazon.JSII.Runtime; version 1.54.0 -- https://www.nuget.org/packages/Amazon.JSII.Runtime
+** AWSSDK.CloudControlApi; version 3.7.2 -- https://www.nuget.org/packages/AWSSDK.CloudControlApi/
+** AWSSDK.SimpleSystemsManagement; version 3.7.16 -- https://www.nuget.org/packages/AWSSDK.SimpleSystemsManagement/
 
 Apache License
 Version 2.0, January 2004
@@ -250,6 +249,36 @@ limitations under the License.
 * For Amazon.JSII.Runtime see also this required NOTICE:
     AWS Cloud Development Kit (AWS CDK)
     Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+* For AWSSDK.CloudControlApi see also this required NOTICE:
+    Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+* For AWSSDK.SimpleSystemsManagement see also this required NOTICE:
+    Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+
+------
+
+** Material for MkDocs; version 8.2.9 -- https://github.com/squidfunk/mkdocs-material
+Copyright (c) 2016-2022 Martin Donath <[email protected]>
+
+MIT License
+
+Copyright (c) <year> <copyright holders>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ------
 
@@ -351,9 +380,7 @@ Copyright (c) 2016 Richard Morris
 Copyright (c) 2016 Richard Morris
 ** Swashbuckle.AspNetCore.SwaggerGen ; version 6.1.2 -- https://www.nuget.org/packages/Swashbuckle.AspNetCore.SwaggerGen/
 Copyright (c) 2016 Richard Morris
-** mkdocs-material; version 8.2.9 -- https://pypi.org/project/mkdocs-material/
-Copyright (c) 2016-2022 Martin Donath
-
+
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in
 the Software without restriction, including without limitation the rights to

buildtools/README.md

@@ -0,0 +1,19 @@
+# Setup
+
+1. Create CF template using `buildtools/ci.template`
+2. Copy output `CodeBuildProjectName` & `OidcRole` output variables.
+3. Create `CI_AWS_ROLE_ARN` repository secret with `OidcRole` value and
+   `CI_AWS_CODE_BUILD_PROJECT_NAME` repository secret with `CodeBuildProjectName`
+   value.
+4. Voila!
+
+# Troubleshooting
+
+## thumbprint rotation
+```
+Error: OpenIDConnect provider's HTTPS certificate doesn't match configured thumbprint
+```
+
+This can happen if GitHub has rotated the thumbprint of the certificate. Follow [this guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html) to generate new thumbprint.
+
+Redeploy the ci.template with the new thumbprint. Additionally, contact https://github.com/aws-actions/configure-aws-credentials/issues for the thumbprint rotation.

buildtools/ci.buildspec.yml

@@ -0,0 +1,37 @@
+version: 0.2
+
+phases:
+  install:
+    runtime-versions:
+      nodejs: 12
+    commands:
+      # install .NET SDK
+      - curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --channel 5.0
+      - curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --channel 6.0
+      - export PATH="$PATH:$HOME/.dotnet"
+  pre_build:
+    commands:
+      - export ORIGINAL_AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID
+      - export ORIGINAL_AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY
+      - export ORIGINAL_AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN
+      - export DOTNET_CLI_TELEMETRY_OPTOUT=1
+      - eval $(aws sts assume-role --role-arn arn:aws:iam::610240510716:role/aws-dotnet-deploy-ci-test-runner --role-session-name test | jq -r '.Credentials | "export AWS_ACCESS_KEY_ID=\(.AccessKeyId)\nexport AWS_SECRET_ACCESS_KEY=\(.SecretAccessKey)\nexport AWS_SESSION_TOKEN=\(.SessionToken)\n"')
+
+  build:
+    commands:
+      - dotnet build AWS.Deploy.sln -c Release
+      - dotnet test AWS.Deploy.sln -c Release --no-build --logger trx --results-directory ./testresults
+  post_build:
+    commands:
+      - export AWS_ACCESS_KEY_ID=${ORIGINAL_AWS_ACCESS_KEY_ID}
+      - export AWS_SECRET_ACCESS_KEY=${ORIGINAL_AWS_SECRET_ACCESS_KEY}
+      - export AWS_SESSION_TOKEN=${ORIGINAL_AWS_SESSION_TOKEN}
+      - unset ORIGINAL_AWS_ACCESS_KEY_ID
+      - unset ORIGINAL_AWS_SECRET_ACCESS_KEY
+      - unset ORIGINAL_AWS_SESSION_TOKEN
+reports:
+    aws-dotnet-deploy-tests:
+        file-format: VisualStudioTrx
+        files:
+            - '**/*'
+        base-directory: './testresults'

buildtools/ci.template.yml

@@ -0,0 +1,169 @@
+Parameters:
+  GitHubOrg:
+    Type: String
+    Default: "aws"
+    Description: The GitHub organization to use for the repository.
+  GitHubRepositoryName:
+    Description: The name of the GitHub repository to create the role template in and to use for the CodeBuild.
+    Type: String
+    Default: "aws-dotnet-deploy"
+  OIDCProviderArn:
+    Description: Arn for the GitHub OIDC Provider.  Leave blank to create a new one or provide an existing Provider.  There can only be one GitHub OIDC Provider per GitHubOrg per AWS Account.  Example arn:aws:iam::665544332211:oidc-provider/token.actions.githubusercontent.com
+    Default: ""
+    Type: String
+  CodeBuildProjectName:
+    Description: Name of the CodeBuild project.
+    Default: "aws-dotnet-deploy-ci"
+    Type: String
+  CodeBuildArtifactsBucketName:
+    Description: Name of the buckets where the CodeBuild artifacts will be stored.
+    Default: "aws-dotnet-deploy-codebuild-artifacts"
+    Type: String
+  TestRunnerRoleArn:
+    Description: Role to assume when running tests.  This role must already exsit.  Role can be a different account.  Example arn:aws:iam:112233445566::role/awsdotnet-deploy-ci-test-runner
+    Default: ""
+    Type: String
+  OidcRoleRoleName:
+    Description: Name of the role to use for the OIDC provider.
+    Default: "aws-dotnet-deploy-ci-role"
+    Type: String
+
+
+Conditions:
+  CreateOIDCProvider: !Equals
+    - !Ref OIDCProviderArn
+    - ""
+
+Resources:
+  OidcRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Ref OidcRoleRoleName
+      AssumeRolePolicyDocument:
+        Statement:
+          - Effect: Allow
+            Action: sts:AssumeRoleWithWebIdentity
+            Principal:
+              Federated: !If
+                - CreateOIDCProvider
+                - !Ref GithubOidc
+                - !Ref OIDCProviderArn
+            Condition:
+              StringLike:
+                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/${GitHubRepositoryName}:*
+      Policies:
+        - PolicyName: !Sub "${AWS::StackName}-OIDC-Policy"
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: Allow
+                Action:
+                  - codebuild:StartBuild
+                  - codebuild:BatchGetBuilds
+                Resource:
+                  - !Sub arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${CodeBuildProjectName}
+              - Effect: Allow
+                Action:
+                  - logs:GetLogEvents
+                Resource:
+                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${CodeBuildProjectName}:*
+              - Effect: Allow
+                Action:
+                  - s3:GetObject
+                  - s3:GetObjectVersion
+                Resource:
+                  - !Sub "${CodeBuildArtifactsBucket.Arn}/*"
+
+  GithubOidc:
+    Type: AWS::IAM::OIDCProvider
+    Condition: CreateOIDCProvider
+    Properties:
+      Url: https://token.actions.githubusercontent.com
+      ClientIdList:
+        - sts.amazonaws.com
+      ThumbprintList:
+        - 6938fd4d98bab03faadb97b34396831e3780aea1
+
+  CodeBuildProject:
+    Type: AWS::CodeBuild::Project
+    Properties:
+      ConcurrentBuildLimit: 1
+      Name: !Sub ${CodeBuildProjectName}
+      ServiceRole: !GetAtt CodeBuildProjectRole.Arn
+      Environment:
+        PrivilegedMode: true
+        ComputeType: BUILD_GENERAL1_LARGE
+        Type: LINUX_CONTAINER
+        ImagePullCredentialsType: CODEBUILD
+        Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0
+        EnvironmentVariables:
+        - Name: TEST_RUNNER_ROLE_ARN
+          Type: PLAINTEXT
+          Value: !Ref TestRunnerRoleArn
+      Source:
+        Type: GITHUB
+        Location: !Sub https://github.com/${GitHubOrg}/${GitHubRepositoryName}
+        BuildSpec: buildtools/ci.buildspec.yml
+      Artifacts:
+        Type: S3
+        Packaging: ZIP
+        Location: !GetAtt CodeBuildArtifactsBucket.Arn
+        OverrideArtifactName: true
+
+
+  CodeBuildProjectRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub ${CodeBuildProjectName}-codebuild-service-role
+      AssumeRolePolicyDocument:
+        Statement:
+        - Action: ['sts:AssumeRole']
+          Effect: Allow
+          Principal:
+            Service: [codebuild.amazonaws.com]
+        Version: '2012-10-17'
+      Path: /
+      Policies:
+        - PolicyName: !Sub "${AWS::StackName}-codebuild-service-role-policy"
+          PolicyDocument:
+            Version: '2012-10-17'
+            Statement:
+              - Action:
+                - 'logs:CreateLogGroup'
+                - 'logs:PutLogEvents'
+                - 'logs:CreateLogStream'
+                Effect: Allow
+                Resource:
+                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${CodeBuildProjectName}"
+                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${CodeBuildProjectName}:*"
+              - Action:
+                - 'sts:AssumeRole'
+                Effect: Allow
+                Resource:
+                  - !Ref TestRunnerRoleArn
+              - Action:
+                - codebuild:BatchPutTestCases
+                - codebuild:CreateReport
+                - codebuild:CreateReportGroup
+                - codebuild:UpdateReport
+                - codebuild:UpdateReportGroup
+                Effect: Allow
+                Resource:
+                  - !Sub arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:report-group/*
+              - Action:
+                - 's3:PutObject'
+                Effect: Allow
+                Resource:
+                  - !Sub "${CodeBuildArtifactsBucket.Arn}/*"
+
+  CodeBuildArtifactsBucket:
+    Type: 'AWS::S3::Bucket'
+    DeletionPolicy: Retain
+    Properties:
+      BucketName: !Ref CodeBuildArtifactsBucketName
+
+Outputs:
+  OidcRole:
+    Value: !GetAtt OidcRole.Arn
+  CodeBuildProjectName:
+    Value: !Sub ${CodeBuildProjectName}