Skip to content

Commit 0e0c00d

Browse files
author
AWS
committed
Release: 1.5.0
1 parent eed6959 commit 0e0c00d

32 files changed

+444
-922
lines changed

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.4.2
1+
1.5.0

‎modules/aft-customizations/buildspecs/aft-account-customizations-api-helpers.yml‎

Lines changed: 0 additions & 50 deletions
This file was deleted.

‎modules/aft-customizations/buildspecs/aft-account-customizations-terraform.yml‎

Lines changed: 95 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,13 @@
44
version: 0.2
55

66
phases:
7-
pre_build:
7+
install:
8+
on-failure: ABORT
89
commands:
10+
- set -e
11+
# Populate Required Variables
912
- DEFAULT_PATH=$(pwd)
1013
- TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
11-
- AWS_MODULE_SOURCE=$(aws ssm get-parameter --name "/aft/config/aft-pipeline-code-source/repo-url" --query "Parameter.Value" --output text)
12-
- AWS_MODULE_GIT_REF=$(aws ssm get-parameter --name "/aft/config/aft-pipeline-code-source/repo-git-ref" --query "Parameter.Value" --output text)
1314
- TF_VERSION=$(aws ssm get-parameter --name "/aft/config/terraform/version" --query "Parameter.Value" --output text)
1415
- TF_DISTRIBUTION=$(aws ssm get-parameter --name "/aft/config/terraform/distribution" --query "Parameter.Value" --output text)
1516
- CT_MGMT_REGION=$(aws ssm get-parameter --name "/aft/config/ct-management-region" --query "Parameter.Value" --output text)
@@ -19,6 +20,19 @@ phases:
1920
- AFT_ADMIN_ROLE_NAME=$(aws ssm get-parameter --name /aft/resources/iam/aft-administrator-role-name | jq --raw-output ".Parameter.Value")
2021
- AFT_ADMIN_ROLE_ARN=arn:aws:iam::$AFT_MGMT_ACCOUNT:role/$AFT_ADMIN_ROLE_NAME
2122
- ROLE_SESSION_NAME=$(aws ssm get-parameter --name /aft/resources/iam/aft-session-name | jq --raw-output ".Parameter.Value")
23+
- |
24+
CUSTOMIZATION=$(aws dynamodb get-item --table-name aft-request-metadata --key "{\"id\": {\"S\": \"$VENDED_ACCOUNT_ID\"}}" --attributes-to-get "account_customizations_name" | jq --raw-output ".Item.account_customizations_name.S")
25+
26+
# Check if customization directory exists
27+
- |
28+
if [[ ! -d "$DEFAULT_PATH/$CUSTOMIZATION" ]]; then
29+
echo "${CUSTOMIZATION} directory does not exist"
30+
exit 1
31+
else
32+
echo "Found customization" $CUSTOMIZATION
33+
fi
34+
35+
# Configure Development SSH Key
2236
- |
2337
ssh_key_parameter=$(aws ssm get-parameter --name /aft/config/aft-ssh-key --with-decryption 2> /dev/null || echo "None")
2438
if [[ $ssh_key_parameter != "None" ]]; then
@@ -32,64 +46,89 @@ phases:
3246
chmod 600 ~/.ssh/ssh_key
3347
eval "$(ssh-agent -s)"
3448
ssh-add ~/.ssh/ssh_key
35-
fi
49+
fi
50+
51+
# Clone AFT
52+
- AWS_MODULE_SOURCE=$(aws ssm get-parameter --name "/aft/config/aft-pipeline-code-source/repo-url" --query "Parameter.Value" --output text)
53+
- AWS_MODULE_GIT_REF=$(aws ssm get-parameter --name "/aft/config/aft-pipeline-code-source/repo-git-ref" --query "Parameter.Value" --output text)
3654
- git config --global credential.helper '!aws codecommit credential-helper $@'
3755
- git config --global credential.UseHttpPath true
38-
- git clone -b $AWS_MODULE_GIT_REF $AWS_MODULE_SOURCE aws-aft-core-framework
39-
- python3 -m venv ./venv
40-
- source ./venv/bin/activate
41-
- pip install jinja2-cli==0.7.0 Jinja2==3.0.1 MarkupSafe==2.0.1 boto3==1.18.56 requests==2.26.0
42-
- |
43-
CUSTOMIZATION=$(aws dynamodb get-item --table-name aft-request-metadata --key "{\"id\": {\"S\": \"$VENDED_ACCOUNT_ID\"}}" --attributes-to-get "account_customizations_name" | jq --raw-output ".Item.account_customizations_name.S")
44-
- echo $CUSTOMIZATION
45-
- |
46-
if [ -d "$CUSTOMIZATION" ]; then
47-
echo "Found customization" $CUSTOMIZATION
48-
if [ $TF_DISTRIBUTION = "oss" ]; then
49-
TF_BACKEND_REGION=$(aws ssm get-parameter --name "/aft/config/oss-backend/primary-region" --query "Parameter.Value" --output text)
50-
TF_KMS_KEY_ID=$(aws ssm get-parameter --name "/aft/config/oss-backend/kms-key-id" --query "Parameter.Value" --output text)
51-
TF_DDB_TABLE=$(aws ssm get-parameter --name "/aft/config/oss-backend/table-id" --query "Parameter.Value" --output text)
52-
TF_S3_BUCKET=$(aws ssm get-parameter --name "/aft/config/oss-backend/bucket-id" --query "Parameter.Value" --output text)
53-
TF_S3_KEY=$VENDED_ACCOUNT_ID-aft-account-customizations/terraform.tfstate
54-
cd /tmp
55-
echo "Installing Terraform"
56-
curl -o terraform_${TF_VERSION}_linux_amd64.zip https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip
57-
unzip -o terraform_${TF_VERSION}_linux_amd64.zip && mv terraform /usr/bin
58-
terraform --version
59-
cd $DEFAULT_PATH/$CUSTOMIZATION/terraform
60-
for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D tf_distribution_type=$TF_DISTRIBUTION -D provider_region=$CT_MGMT_REGION -D region=$TF_BACKEND_REGION -D aft_admin_role_arn=$AFT_EXEC_ROLE_ARN -D target_admin_role_arn=$VENDED_EXEC_ROLE_ARN -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID >> ./$(basename $f .jinja).tf; done
61-
for f in *.tf; do echo "\n \n"; echo $f; cat $f; done
62-
JSON=$(aws sts assume-role --role-arn ${AFT_ADMIN_ROLE_ARN} --role-session-name ${ROLE_SESSION_NAME})
63-
#Make newly assumed role default session
64-
export AWS_ACCESS_KEY_ID=$(echo ${JSON} | jq --raw-output ".Credentials[\"AccessKeyId\"]")
65-
export AWS_SECRET_ACCESS_KEY=$(echo ${JSON} | jq --raw-output ".Credentials[\"SecretAccessKey\"]")
66-
export AWS_SESSION_TOKEN=$(echo ${JSON} | jq --raw-output ".Credentials[\"SessionToken\"]")
67-
terraform init
68-
else
69-
TF_BACKEND_REGION=$(aws ssm get-parameter --name "/aft/config/oss-backend/primary-region" --query "Parameter.Value" --output text)
70-
TF_ORG_NAME=$(aws ssm get-parameter --name "/aft/config/terraform/org-name" --query "Parameter.Value" --output text)
71-
TF_TOKEN=$(aws ssm get-parameter --name "/aft/config/terraform/token" --with-decryption --query "Parameter.Value" --output text)
72-
TF_ENDPOINT=$(aws ssm get-parameter --name "/aft/config/terraform/api-endpoint" --query "Parameter.Value" --output text)
73-
TF_WORKSPACE_NAME=$VENDED_ACCOUNT_ID-aft-account-customizations
74-
TF_CONFIG_PATH="./temp_configuration_file.tar.gz"
75-
cd $DEFAULT_PATH/$CUSTOMIZATION/terraform
76-
for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D provider_region=$CT_MGMT_REGION -D tf_distribution_type=$TF_DISTRIBUTION -D aft_admin_role_arn=$AFT_EXEC_ROLE_ARN -D target_admin_role_arn=$VENDED_EXEC_ROLE_ARN -D terraform_org_name=$TF_ORG_NAME -D terraform_workspace_name=$TF_WORKSPACE_NAME >> ./$(basename $f .jinja).tf; done
77-
for f in *.tf; do echo "\n \n"; echo $f; cat $f; done
78-
cd $DEFAULT_PATH/$CUSTOMIZATION
79-
tar -czf temp_configuration_file.tar.gz -C terraform --exclude .git --exclude venv .
80-
python3 $DEFAULT_PATH/aws-aft-core-framework/sources/scripts/workspace_manager.py --operation "deploy" --organization_name $TF_ORG_NAME --workspace_name $TF_WORKSPACE_NAME --assume_role_arn $AFT_ADMIN_ROLE_ARN --assume_role_session_name $ROLE_SESSION_NAME --api_endpoint $TF_ENDPOINT --api_token $TF_TOKEN --terraform_version $TF_VERSION --config_file $TF_CONFIG_PATH
81-
fi
82-
fi
56+
- git clone --quiet -b $AWS_MODULE_GIT_REF $AWS_MODULE_SOURCE aws-aft-core-framework
57+
58+
# Install AFT Python Dependencies
59+
- python3 -m venv $DEFAULT_PATH/aft-venv
60+
- $DEFAULT_PATH/aft-venv/bin/pip install pip==22.1.2
61+
- $DEFAULT_PATH/aft-venv/bin/pip install jinja2-cli==0.7.0 Jinja2==3.0.1 MarkupSafe==2.0.1 boto3==1.18.56 requests==2.26.0
62+
63+
# Install API Helper Python Dependencies
64+
- python3 -m venv $DEFAULT_PATH/api-helpers-venv
65+
- $DEFAULT_PATH/api-helpers-venv/bin/pip install -r ./$CUSTOMIZATION/api_helpers/python/requirements.txt
66+
67+
# Mark helper scripts as executable
68+
- chmod +x $DEFAULT_PATH/$CUSTOMIZATION/api_helpers/pre-api-helpers.sh
69+
- chmod +x $DEFAULT_PATH/$CUSTOMIZATION/api_helpers/post-api-helpers.sh
70+
71+
# Generate session profiles
72+
- chmod +x $DEFAULT_PATH/aws-aft-core-framework/sources/scripts/creds.sh
73+
- $DEFAULT_PATH/aws-aft-core-framework/sources/scripts/creds.sh
74+
75+
76+
pre_build:
77+
on-failure: ABORT
78+
commands:
79+
- source $DEFAULT_PATH/api-helpers-venv/bin/activate
80+
- export AWS_PROFILE=aft-target
81+
- $DEFAULT_PATH/$CUSTOMIZATION/api_helpers/pre-api-helpers.sh
82+
- unset AWS_PROFILE
83+
8384
build:
85+
on-failure: ABORT
8486
commands:
85-
- cd $DEFAULT_PATH
87+
# Apply Customizations
88+
- source $DEFAULT_PATH/aft-venv/bin/activate
8689
- |
87-
if [ -d "$CUSTOMIZATION" ]; then
88-
if [ $TF_DISTRIBUTION = "oss" ]; then
89-
cd $DEFAULT_PATH/$CUSTOMIZATION/terraform
90-
terraform apply --auto-approve
91-
fi
90+
if [ $TF_DISTRIBUTION = "oss" ]; then
91+
TF_BACKEND_REGION=$(aws ssm get-parameter --name "/aft/config/oss-backend/primary-region" --query "Parameter.Value" --output text)
92+
TF_KMS_KEY_ID=$(aws ssm get-parameter --name "/aft/config/oss-backend/kms-key-id" --query "Parameter.Value" --output text)
93+
TF_DDB_TABLE=$(aws ssm get-parameter --name "/aft/config/oss-backend/table-id" --query "Parameter.Value" --output text)
94+
TF_S3_BUCKET=$(aws ssm get-parameter --name "/aft/config/oss-backend/bucket-id" --query "Parameter.Value" --output text)
95+
TF_S3_KEY=$VENDED_ACCOUNT_ID-aft-account-customizations/terraform.tfstate
96+
97+
cd /tmp
98+
echo "Installing Terraform"
99+
curl -q -o terraform_${TF_VERSION}_linux_amd64.zip https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip
100+
mkdir -p /opt/aft/bin
101+
unzip -q -o terraform_${TF_VERSION}_linux_amd64.zip
102+
mv terraform /opt/aft/bin
103+
/opt/aft/bin/terraform --version
104+
105+
cd $DEFAULT_PATH/$CUSTOMIZATION/terraform
106+
for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D tf_distribution_type=$TF_DISTRIBUTION -D provider_region=$CT_MGMT_REGION -D region=$TF_BACKEND_REGION -D aft_admin_role_arn=$AFT_EXEC_ROLE_ARN -D target_admin_role_arn=$VENDED_EXEC_ROLE_ARN -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID >> ./$(basename $f .jinja).tf; done
107+
for f in *.tf; do echo "\n \n"; echo $f; cat $f; done
108+
109+
cd $DEFAULT_PATH/$CUSTOMIZATION/terraform
110+
export AWS_PROFILE=aft-management-admin
111+
/opt/aft/bin/terraform init
112+
/opt/aft/bin/terraform apply --auto-approve
113+
else
114+
TF_BACKEND_REGION=$(aws ssm get-parameter --name "/aft/config/oss-backend/primary-region" --query "Parameter.Value" --output text)
115+
TF_ORG_NAME=$(aws ssm get-parameter --name "/aft/config/terraform/org-name" --query "Parameter.Value" --output text)
116+
TF_TOKEN=$(aws ssm get-parameter --name "/aft/config/terraform/token" --with-decryption --query "Parameter.Value" --output text)
117+
TF_ENDPOINT=$(aws ssm get-parameter --name "/aft/config/terraform/api-endpoint" --query "Parameter.Value" --output text)
118+
TF_WORKSPACE_NAME=$VENDED_ACCOUNT_ID-aft-account-customizations
119+
TF_CONFIG_PATH="./temp_configuration_file.tar.gz"
120+
121+
cd $DEFAULT_PATH/$CUSTOMIZATION/terraform
122+
for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D provider_region=$CT_MGMT_REGION -D tf_distribution_type=$TF_DISTRIBUTION -D aft_admin_role_arn=$AFT_EXEC_ROLE_ARN -D target_admin_role_arn=$VENDED_EXEC_ROLE_ARN -D terraform_org_name=$TF_ORG_NAME -D terraform_workspace_name=$TF_WORKSPACE_NAME >> ./$(basename $f .jinja).tf; done
123+
for f in *.tf; do echo "\n \n"; echo $f; cat $f; done
124+
125+
cd $DEFAULT_PATH/$CUSTOMIZATION
126+
tar -czf temp_configuration_file.tar.gz -C terraform --exclude .git --exclude venv .
127+
python3 $DEFAULT_PATH/aws-aft-core-framework/sources/scripts/workspace_manager.py --operation "deploy" --organization_name $TF_ORG_NAME --workspace_name $TF_WORKSPACE_NAME --assume_role_arn $AFT_ADMIN_ROLE_ARN --assume_role_session_name $ROLE_SESSION_NAME --api_endpoint $TF_ENDPOINT --api_token $TF_TOKEN --terraform_version $TF_VERSION --config_file $TF_CONFIG_PATH
92128
fi
93129
post_build:
130+
on-failure: ABORT
94131
commands:
95-
- echo "Post-Build"
132+
- source $DEFAULT_PATH/api-helpers-venv/bin/activate
133+
- export AWS_PROFILE=aft-target
134+
- $DEFAULT_PATH/$CUSTOMIZATION/api_helpers/post-api-helpers.sh

‎modules/aft-customizations/buildspecs/aft-create-pipeline.yml‎

Lines changed: 37 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,21 @@
44
version: 0.2
55

66
phases:
7-
pre_build:
7+
install:
88
commands:
9+
- set -e
10+
# Populate Required Variables
911
- DEFAULT_PATH=$(pwd)
10-
- AWS_MODULE_SOURCE=$(aws ssm get-parameter --name $SSM_AWS_MODULE_SOURCE --query "Parameter.Value" --output text)
11-
- AWS_MODULE_GIT_REF=$(aws ssm get-parameter --name $SSM_AWS_MODULE_GIT_REF --query "Parameter.Value" --output text)
12+
- TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
13+
- TF_S3_BUCKET=$(aws ssm get-parameter --name $SSM_TF_S3_BUCKET --query "Parameter.Value" --output text)
14+
- TF_S3_KEY=$VENDED_ACCOUNT_ID-customizations-pipeline/terraform.tfstate
15+
- TF_BACKEND_REGION=$(aws ssm get-parameter --name $SSM_TF_BACKEND_REGION --query "Parameter.Value" --output text)
16+
- TF_KMS_KEY_ID=$(aws ssm get-parameter --name $SSM_TF_KMS_KEY_ID --query "Parameter.Value" --output text)
17+
- TF_DDB_TABLE=$(aws ssm get-parameter --name $SSM_TF_DDB_TABLE --query "Parameter.Value" --output text)
18+
- TF_VERSION=$(aws ssm get-parameter --name $SSM_TF_VERSION --query "Parameter.Value" --output text)
19+
20+
21+
# Configure Development SSH Key
1222
- |
1323
ssh_key_parameter=$(aws ssm get-parameter --name /aft/config/aft-ssh-key --with-decryption 2> /dev/null || echo "None")
1424
if [[ $ssh_key_parameter != "None" ]]; then
@@ -23,34 +33,40 @@ phases:
2333
eval "$(ssh-agent -s)"
2434
ssh-add ~/.ssh/ssh_key
2535
fi
26-
- TF_S3_BUCKET=$(aws ssm get-parameter --name $SSM_TF_S3_BUCKET --query "Parameter.Value" --output text)
27-
- TF_S3_KEY=$VENDED_ACCOUNT_ID-customizations-pipeline/terraform.tfstate
28-
- TF_BACKEND_REGION=$(aws ssm get-parameter --name $SSM_TF_BACKEND_REGION --query "Parameter.Value" --output text)
29-
- TF_KMS_KEY_ID=$(aws ssm get-parameter --name $SSM_TF_KMS_KEY_ID --query "Parameter.Value" --output text)
30-
- TF_DDB_TABLE=$(aws ssm get-parameter --name $SSM_TF_DDB_TABLE --query "Parameter.Value" --output text)
31-
- TF_VERSION=$(aws ssm get-parameter --name $SSM_TF_VERSION --query "Parameter.Value" --output text)
36+
37+
# Clone AFT
38+
- AWS_MODULE_SOURCE=$(aws ssm get-parameter --name $SSM_AWS_MODULE_SOURCE --query "Parameter.Value" --output text)
39+
- AWS_MODULE_GIT_REF=$(aws ssm get-parameter --name $SSM_AWS_MODULE_GIT_REF --query "Parameter.Value" --output text)
3240
- git config --global credential.helper '!aws codecommit credential-helper $@'
3341
- git config --global credential.UseHttpPath true
34-
- git clone -b $AWS_MODULE_GIT_REF $AWS_MODULE_SOURCE aws-aft-core-framework
35-
- chmod +x ./aws-aft-core-framework/sources/scripts/creds.sh
36-
- ./aws-aft-core-framework/sources/scripts/creds.sh --aft-mgmt
37-
- TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
42+
- git clone --quiet -b $AWS_MODULE_GIT_REF $AWS_MODULE_SOURCE aws-aft-core-framework
43+
44+
# Generate session profiles
45+
- chmod +x $DEFAULT_PATH/aws-aft-core-framework/sources/scripts/creds.sh
46+
- $DEFAULT_PATH/aws-aft-core-framework/sources/scripts/creds.sh
47+
48+
# Install Terraform
3849
- cd /tmp
3950
- echo "Installing Terraform"
40-
- curl -o terraform_${TF_VERSION}_linux_amd64.zip https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip
41-
- unzip -o terraform_${TF_VERSION}_linux_amd64.zip && mv terraform /usr/bin
51+
- curl -q -o terraform_${TF_VERSION}_linux_amd64.zip https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip
52+
- unzip -q -o terraform_${TF_VERSION}_linux_amd64.zip && mv terraform /usr/bin
4253
- terraform --version
43-
- cd $DEFAULT_PATH
44-
- cd ./aws-aft-core-framework/sources/aft-customizations-common/templates/customizations_pipeline
54+
55+
# Install Python Dependencies
4556
- python3 -m venv ./venv
4657
- source ./venv/bin/activate
58+
- pip install pip==22.1.2
4759
- pip install jinja2-cli==0.7.0 Jinja2==3.0.1
60+
61+
pre_build:
62+
on-failure: ABORT
63+
commands:
64+
- cd $DEFAULT_PATH/aws-aft-core-framework/sources/aft-customizations-common/templates/customizations_pipeline
4865
- for f in *.jinja; do jinja2 $f -D timestamp="$TIMESTAMP" -D region=$TF_BACKEND_REGION -D bucket=$TF_S3_BUCKET -D key=$TF_S3_KEY -D dynamodb_table=$TF_DDB_TABLE -D kms_key_id=$TF_KMS_KEY_ID >> $(basename $f .jinja).tf; done
4966
- for f in *.tf; do echo "\n \n"; echo $f; cat $f; done
50-
- terraform init
5167
build:
68+
on-failure: ABORT
5269
commands:
70+
- export AWS_PROFILE=aft-management-admin
71+
- terraform init
5372
- terraform apply -var="account_id=$VENDED_ACCOUNT_ID" --auto-approve
54-
post_build:
55-
commands:
56-
- echo "Post-Build"

0 commit comments

Comments
 (0)