linting and test updates.

Makefile

@@ -26,6 +26,7 @@ lint: $(all)
 		$(MAKE) lint -C $$dir || exit 1; \
 	done
 
+.PHONY: test
 test: $(all)
 	for dir in $(all); do \
 		$(MAKE) test -C $$dir || exit 1; \

cloud/aws/Makefile

@@ -22,8 +22,6 @@ runtimebin:
 predeploybin: runtimebin
 	@cp bin/runtime-aws deploy/runtime-aws
 
-# FIXME: proto server registration error
-# There appears to be an old namespace conflict with the protobuf definitions
 deploybin: predeploybin
 	@echo Building AWS Deployment Server
 	@CGO_ENABLED=0 go build -o bin/deploy-aws -ldflags="-s -w -extldflags=-static" -ldflags="-X google.golang.org/protobuf/reflect/protoregistry.conflictPolicy=ignore" ./cmd/deploy

cloud/aws/cmd/runtime/main.go

@@ -65,7 +65,6 @@ func main() {
 	membraneOpts.TopicsPlugin, _ = sns_service.New(provider)
 	membraneOpts.StoragePlugin, _ = s3_service.New(provider)
 	membraneOpts.ResourcesPlugin = provider
-	membraneOpts.CreateTracerProvider = newTracerProvider
 	membraneOpts.WebsocketPlugin, _ = websocket.NewAwsApiGatewayWebsocket(provider)
 	membraneOpts.QueuesPlugin, _ = sqs_service.New(provider)
 

cloud/aws/common/const.go

@@ -1,3 +1,19 @@
+// Copyright Nitric Pty Ltd.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at:
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package common
 
 const (

cloud/aws/deploy/api.go

@@ -23,6 +23,7 @@ import (
 	"github.com/getkin/kin-openapi/openapi3"
 	"github.com/nitrictech/nitric/cloud/common/deploy/resources"
 	"github.com/nitrictech/nitric/cloud/common/deploy/tags"
+	"github.com/nitrictech/nitric/core/pkg/help"
 	deploymentspb "github.com/nitrictech/nitric/core/pkg/proto/deployments/v1"
 	"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/apigatewayv2"
 	"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/lambda"
@@ -141,8 +142,8 @@ func (a *NitricAwsPulumiProvider) Api(ctx *pulumi.Context, parent pulumi.Resourc
 			if pair, ok := p.(nameArnPair); ok {
 				naps[pair.name] = pair.invokeArn
 			} else {
-				// XXX: Should not occur
-				return "", fmt.Errorf("invalid data %T %v", p, p)
+				// This error shouldn't occur.
+				return "", fmt.Errorf("failed to resolve lambda ARN for api %s, invalid name ARN pair value %T %v, %s", name, p, p, help.BugInNitricHelpText())
 			}
 		}
 

cloud/aws/deploy/policy.go

@@ -16,10 +16,8 @@
 
 package deploy
 
-//#nosec G501 -- md5 used only to produce a unique ID from non-sensistive information (policy IDs)
-
 import (
-	"crypto/md5"
+	"crypto/md5" //#nosec G501 -- md5 used only to produce a unique ID from non-sensistive information (policy IDs)
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
@@ -50,7 +48,7 @@ var awsActionsMap map[resourcespb.Action][]string = map[resourcespb.Action][]str
 	resourcespb.Action_BucketFileDelete: {
 		"s3:DeleteObject",
 	},
-	// XXX: Cannot be applied to single resources
+	// Cannot be applied to single resources
 	// v1.Action_TopicList: {
 	// 	"sns:ListTopics",
 	// },
@@ -73,7 +71,7 @@ var awsActionsMap map[resourcespb.Action][]string = map[resourcespb.Action][]str
 	resourcespb.Action_KeyValueStoreDelete: {
 		"dynamodb:DeleteItem",
 	},
-	// XXX: Cannot be applied to single resources
+	// Cannot be applied to single resources
 	// v1.Action_CollectionList: {
 	// 	"dynamodb:ListTables",
 	// },
@@ -93,7 +91,7 @@ var awsActionsMap map[resourcespb.Action][]string = map[resourcespb.Action][]str
 		"sqs:ReceiveMessage",
 		"sqs:DeleteMessage",
 	},
-	// XXX: Cannot be applied to single resources
+	// Cannot be applied to single resources
 	// v1.Action_QueueList: {
 	// 	"sqs:ListQueues",
 	// },
@@ -185,8 +183,10 @@ func (a *NitricAwsPulumiProvider) Policy(ctx *pulumi.Context, parent pulumi.Reso
 
 	for _, princ := range config.Principals {
 		if role, err := a.roleForPrincipal(princ); err == nil {
-			// TODO: Eventually we'll need to combine resource type with principal
-			// but only functions can really be principals for now
+			if princ.Id.Type != resourcespb.ResourceType_Service {
+				return fmt.Errorf("invalid principal type: %s. Only services can be principals", princ.Id.Type)
+			}
+
 			principalRoles[princ.Id.Name] = role
 		} else {
 			return err

cloud/aws/deploy/secret.go

@@ -39,7 +39,6 @@ func tagSecret(ctx *pulumi.Context, name string, importArn string, tags map[stri
 		ResourceARNList: aws.StringSlice([]string{secretLookup.Arn}),
 		Tags:            aws.StringMap(tags),
 	})
-
 	if err != nil {
 		return nil, err
 	}

cloud/aws/deploy/service.go

@@ -148,6 +148,7 @@ func (a *NitricAwsPulumiProvider) Service(ctx *pulumi.Context, parent pulumi.Res
 	}
 
 	listActions := []string{
+		// TODO: test that all resources still work without these permissions
 		"sns:ListTopics",
 		"sqs:ListQueues",
 		"dynamodb:ListTables",
@@ -156,6 +157,11 @@ func (a *NitricAwsPulumiProvider) Service(ctx *pulumi.Context, parent pulumi.Res
 		"apigateway:GET",
 	}
 
+	// This is a tag key unique to this instance of the deployed stack.
+	// Any resource with this unique tag will inherently be scoped to this stack.
+	// This is used to scope the permissions of the lambda to only resources created by this stack.
+	// stackScopedNameKey := tags.GetResourceNameKey(a.stackId)
+
 	// Add resource list permissions
 	// Currently the membrane will use list operations
 	tmpJSON, err = json.Marshal(map[string]interface{}{
@@ -165,15 +171,19 @@ func (a *NitricAwsPulumiProvider) Service(ctx *pulumi.Context, parent pulumi.Res
 				"Action":   append(listActions, telemetryActions...),
 				"Effect":   "Allow",
 				"Resource": "*",
+				// "Condition": map[string]map[string]string{
+				// 	// Only apply this to resources who have a resource name key that matches this stack
+				// 	"Null": {
+				// 		fmt.Sprintf("aws:ResourceTag/%s", stackScopedNameKey): "false",
+				// 	},
+				// },
 			},
 		},
 	})
 	if err != nil {
 		return err
 	}
 
-	// TODO: Lock this SNS topics for which this function has pub definitions
-	// FIXME: Limit to known resources
 	_, err = iam.NewRolePolicy(ctx, name+"ListAccess", &iam.RolePolicyArgs{
 		Role:   a.lambdaRoles[name].ID(),
 		Policy: pulumi.String(tmpJSON),

cloud/aws/deploy/topic.go

@@ -122,8 +122,7 @@ func (a *NitricAwsPulumiProvider) Topic(ctx *pulumi.Context, parent pulumi.Resou
 
 	// Enable a role with publish access to this stacks topics only
 	_, err = iam.NewRolePolicy(ctx, fmt.Sprintf("%s-delay-ctrl", name), &iam.RolePolicyArgs{
-		Role: sfnRole,
-		// TODO: Limit to only this stacks topics (deployed above)
+		Role:   sfnRole,
 		Policy: policy,
 	}, opts...)
 	if err != nil {

cloud/aws/deploy/websocket.go

@@ -38,8 +38,7 @@ func (a *NitricAwsPulumiProvider) Websocket(ctx *pulumi.Context, parent pulumi.R
 	websocketApi, err := apigatewayv2.NewApi(ctx, name, &apigatewayv2.ApiArgs{
 		ProtocolType: pulumi.String("WEBSOCKET"),
 		Tags:         pulumi.ToStringMap(tags.Tags(a.stackId, name, resources.Websocket)),
-		// TODO: We won't actually be using this, but it is required.
-		// Instead we'll be using the $default route
+		// This isn't used (see AWS docs), but it is required. Instead we use the $default route
 		RouteSelectionExpression: pulumi.String("$request.body.action"),
 	}, opts...)
 	if err != nil {