Initial commit

aws/scripts/configure/create-role-profile.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+# Parse parameters
+while [[ "$#" -gt 0 ]]; do case $1 in
+  --user-profile) USER_PROFILE="$2"; shift;;
+  --role-profile) ROLE_PROFILE="$2"; shift;;
+  --role-arn) ROLE_ARN="$2"; shift;;
+  --session) SESSION="$2";shift;;
+  --region) REGION="$2";shift;;
+  *) echo "Unknown parameter passed: $1"; exit 1;;
+esac; shift; done
+
+# Verify parameters
+if [ -z "$USER_PROFILE" ]; then echo "User profile name is not set."; exit 1; fi;
+if [ -z "$ROLE_PROFILE" ]; then echo "Role profile name is not set."; exit 1; fi;
+if [ -z "$ROLE_ARN" ]; then echo "Role ARN is not set"; exit 1; fi;
+if [ -z "$SESSION" ]; then echo "Session name is not set."; exit 1; fi;
+if [ -z "$REGION" ]; then echo "Region is not set."; exit 1; fi;
+
+creds=$(aws sts assume-role --role-arn $ROLE_ARN --role-session-name $SESSION --profile $USER_PROFILE)
+
+aws_access_key_id=$(echo $creds | jq -r '.Credentials.AccessKeyId')
+echo ::add-mask::$aws_access_key_id
+aws_secret_access_key=$(echo $creds | jq -r '.Credentials.SecretAccessKey')
+echo ::add-mask::$aws_secret_access_key
+aws_session_token=$(echo $creds | jq -r '.Credentials.SessionToken')
+echo ::add-mask::$aws_session_token
+
+aws configure --profile $ROLE_PROFILE set aws_access_key_id $aws_access_key_id
+aws configure --profile $ROLE_PROFILE set aws_secret_access_key $aws_secret_access_key
+aws configure --profile $ROLE_PROFILE set aws_session_token $aws_session_token
+aws configure --profile $ROLE_PROFILE set region $REGION
+
+echo Profile $ROLE_PROFILE is created
+
+bash "${BASH_SOURCE%/*}/mask-identity.sh" --profile $ROLE_PROFILE

aws/scripts/configure/create-user-profile.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# Parse parameters
+while [[ "$#" -gt 0 ]]; do case $1 in
+  --profile) PROFILE="$2"; shift;;
+  --access-key-id) ACCESS_KEY_ID="$2"; shift;;
+  --secret-access-key) SECRET_ACCESS_KEY="$2"; shift;;
+  --region) REGION="$2";shift;;
+  *) echo "Unknown parameter passed: $1"; exit 1;;
+esac; shift; done
+
+# Verify parameters
+if [ -z "$PROFILE" ]; then echo "Profile name is not set."; exit 1; fi;
+echo $PROFILE
+if [ -z "$ACCESS_KEY_ID" ]; then echo "Access key ID is not set"; exit 1; fi;
+if [ -z "$SECRET_ACCESS_KEY" ]; then echo "Secret access key is not set."; exit 1; fi;
+if [ -z "$REGION" ]; then echo "Region is not set."; exit 1; fi;
+
+aws configure --profile $PROFILE set aws_access_key_id $ACCESS_KEY_ID
+aws configure --profile $PROFILE set aws_secret_access_key $SECRET_ACCESS_KEY
+aws configure --profile $PROFILE set region $REGION
+
+echo Profile $PROFILE is created
+
+bash "${BASH_SOURCE%/*}/mask-identity.sh" --profile $PROFILE

aws/scripts/configure/mask-identity.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+# Parse parameters
+while [[ "$#" -gt 0 ]]; do case $1 in
+  --profile) PROFILE="$2";shift;;
+  *) echo "Unknown parameter passed: $1"; exit 1;;
+esac; shift; done
+
+# Verify parameters
+if [ -z "$PROFILE" ]; then echo "Profile name is not set."; exit 1; fi;
+
+aws_identity=$(aws sts get-caller-identity --profile $PROFILE)
+echo ::add-mask::$(echo $aws_identity | jq -r '.Account')
+echo ::add-mask::$(echo $aws_identity | jq -r '.UserId')
+echo ::add-mask::$(echo $aws_identity | jq -r '.Arn')
+
+echo Credentials are masked

aws/scripts/deploy/deploy-stack.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+
+# Parse parameters
+while [[ "$#" -gt 0 ]]; do case $1 in
+  --template-file) TEMPLATE_FILE="$2"; shift;;
+  --stack-name) STACK_NAME="$2"; shift;;
+  --profile) PROFILE="$2"; shift;;
+  --capabilities) CAPABILITY_IAM="$2"; shift;;
+  --role-arn) ROLE_ARN="$2";shift;;
+  --session) SESSION="$2";shift;;
+  --region) REGION="$2";shift;;
+  *) echo "Unknown parameter passed: $1"; exit 1;;
+esac; shift; done
+
+# Verify parameters
+if [ -z "$TEMPLATE_FILE" ]; then echo "Template file is not set."; exit 1; fi;
+if [ -z "$STACK_NAME" ]; then echo "Template file is not set."; exit 1; fi;
+if [ -z "$PROFILE" ]; then echo "Profile is not set."; exit 1; fi;
+if [ -z "$ROLE_ARN" ]; then echo "Role ARN is not set."; exit 1; fi;
+if [ -z "$SESSION" ]; then echo "Role session is not set."; exit 1; fi;
+
+
+echo Validating stack "$STACK_NAME"
+aws cloudformation validate-template \
+    --template-body file://$TEMPLATE_FILE \
+    --profile $PROFILE
+
+ROLE_PROFILE=$STACK_NAME
+
+echo Assuming role
+bash "${BASH_SOURCE%/*}/../configure/create-role-profile.sh" \
+    --role-profile $ROLE_PROFILE --user-profile $PROFILE \
+    --role-arn $ROLE_ARN \
+    --session $SESSION \
+    --region $REGION
+
+echo Deploying stack "$TEMPLATE_FILE"
+aws cloudformation deploy \
+    --template-file $TEMPLATE_FILE \
+    --stack-name $STACK_NAME \
+    ${CAPABILITY_IAM:+ --capabilities $CAPABILITY_IAM} \
+    --no-fail-on-empty-changeset \
+    --profile $ROLE_PROFILE

aws/scripts/deploy/deploy-to-s3.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# Parse parameters
+while [[ "$#" -gt 0 ]]; do case $1 in
+  --folder) FOLDER="$2"; shift;;
+  --web-stack-name) WEB_STACK_NAME="$2"; shift;;
+  --web-stack-s3-name-output-name) WEB_STACK_S3_NAME_OUTPUT_NAME="$2"; shift;;
+  --storage-class) STORAGE_CLASS="$2"; shift;;
+  --profile) PROFILE="$2"; shift;;
+  --role-arn) ROLE_ARN="$2";shift;;
+  --session) SESSION="$2";shift;;
+  --region) REGION="$2";shift;;
+  *) echo "Unknown parameter passed: $1"; exit 1;;
+esac; shift; done
+
+# Verify parameters
+if [ -z "$FOLDER" ]; then echo "Folder is not set."; exit 1; fi;
+if [ -z "$PROFILE" ]; then echo "Profile is not set."; exit 1; fi;
+if [ -z "$ROLE_ARN" ]; then echo "Role ARN is not set."; exit 1; fi;
+if [ -z "$SESSION" ]; then echo "Role session is not set."; exit 1; fi;
+if [ -z "$WEB_STACK_NAME" ]; then echo "Web stack name is not set."; exit 1; fi;
+if [ -z "$WEB_STACK_S3_NAME_OUTPUT_NAME" ]; then echo "S3 name output name is not set."; exit 1; fi;
+if [ -z "$STORAGE_CLASS" ]; then echo "S3 object storage class is not set."; exit 1; fi;
+
+echo Assuming role
+ROLE_PROFILE=deploy-s3
+bash "${BASH_SOURCE%/*}/../configure/create-role-profile.sh" \
+    --role-profile $ROLE_PROFILE --user-profile $PROFILE \
+    --role-arn $ROLE_ARN \
+    --session $SESSION \
+    --region $REGION
+
+echo Getting S3 bucket name from stack "$WEB_STACK_NAME" with output "$WEB_STACK_S3_NAME_OUTPUT_NAME"
+S3_BUCKET_NAME=$(aws cloudformation describe-stacks \
+            --stack-name $WEB_STACK_NAME \
+            --query "Stacks[0].Outputs[?OutputKey=='$WEB_STACK_S3_NAME_OUTPUT_NAME'].OutputValue" \
+            --output text \
+            --profile $ROLE_PROFILE)
+if [ -z "$S3_BUCKET_NAME" ]; then echo "Could not read S3 bucket name"; exit 1; fi;
+echo ::add-mask::$S3_BUCKET_NAME # Just being extra cautious
+
+echo Syncing folder to S3
+
+aws s3 sync $FOLDER s3://$S3_BUCKET_NAME \
+    --storage-class $STORAGE_CLASS  \
+    --no-progress --follow-symlinks --delete \
+    --profile $ROLE_PROFILE

aws/scripts/deploy/invalidate-cloudfront-cache.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# Parse parameters
+while [[ "$#" -gt 0 ]]; do case $1 in
+  --paths) PATHS="$2"; shift;;
+  --web-stack-name) WEB_STACK_NAME="$2"; shift;;
+  --web-stack-cloudfront-arn-output-name) WEB_STACK_CLOUDFRONT_ARN_OUTPUT_NAME="$2"; shift;;
+  --profile) PROFILE="$2"; shift;;
+  --role-arn) ROLE_ARN="$2";shift;;
+  --session) SESSION="$2";shift;;
+  --region) REGION="$2";shift;;
+  *) echo "Unknown parameter passed: $1"; exit 1;;
+esac; shift; done
+
+# Verify parameters
+if [ -z "$PATHS" ]; then echo "Paths is not set."; exit 1; fi;
+if [ -z "$PROFILE" ]; then echo "Profile is not set."; exit 1; fi;
+if [ -z "$ROLE_ARN" ]; then echo "Role ARN is not set."; exit 1; fi;
+if [ -z "$SESSION" ]; then echo "Role session is not set."; exit 1; fi;
+if [ -z "$WEB_STACK_NAME" ]; then echo "Web stack name is not set."; exit 1; fi;
+if [ -z "$WEB_STACK_CLOUDFRONT_ARN_OUTPUT_NAME" ]; then echo "CloudFront ARN output name is not set."; exit 1; fi;
+
+
+echo Assuming role
+ROLE_PROFILE=invalidate-cloudfront
+bash "${BASH_SOURCE%/*}/../configure/create-role-profile.sh" \
+    --role-profile $ROLE_PROFILE --user-profile $PROFILE \
+    --role-arn $ROLE_ARN \
+    --session $SESSION \
+    --region $REGION
+
+echo Getting CloudFront ARN from stack "$WEB_STACK_NAME" with output "$WEB_STACK_CLOUDFRONT_ARN_OUTPUT_NAME"
+CLOUDFRONT_ARN=$(aws cloudformation describe-stacks \
+            --stack-name $WEB_STACK_NAME \
+            --query "Stacks[0].Outputs[?OutputKey=='$WEB_STACK_CLOUDFRONT_ARN_OUTPUT_NAME'].OutputValue" \
+            --output text \
+            --profile $ROLE_PROFILE)
+if [ -z "$CLOUDFRONT_ARN" ]; then echo "Could not read CloudFront ARN"; exit 1; fi;
+echo :add-mask::$CLOUDFRONT_ARN
+
+echo Syncing folder to S3
+aws cloudfront create-invalidation \
+    --paths $PATHS \
+    --distribution-id $CLOUDFRONT_ARN \
+    --profile $ROLE_PROFILE