samcli/commands/pipeline/bootstrap/cli.py

""" CLI command for "pipeline bootstrap", which sets up the require pipeline infrastructure resources """ import os from textwrap import dedent from typing import Any, Dict, List, Optional import click from samcli.cli.cli_config_file import ConfigProvider, configuration_option, save_params_option from samcli.cli.main import aws_creds_options, common_options, pass_context, print_cmdline_args from samcli.commands._utils.click_mutex import ClickMutex from samcli.commands._utils.command_exception_handler import command_exception_handler from samcli.commands.pipeline.bootstrap.oidc_config import ( BitbucketOidcConfig, GitHubOidcConfig, GitLabOidcConfig, OidcConfig, ) from samcli.commands.pipeline.bootstrap.pipeline_oidc_provider import PipelineOidcProvider from samcli.lib.config.samconfig import SamConfig from samcli.lib.telemetry.metric import track_command from samcli.lib.utils.version_checker import check_newer_version from .guided_context import BITBUCKET, GITHUB_ACTIONS, GITLAB, IAM, OPEN_ID_CONNECT SHORT_HELP = "Generates the required AWS resources to connect your CI/CD system." HELP_TEXT = """ This command generates the required AWS infrastructure resources to connect to your CI/CD system. This step must be run for each deployment stage in your pipeline, prior to running the sam pipeline init command. """ PIPELINE_CONFIG_DIR = os.path.join(".aws-sam", "pipeline") PIPELINE_CONFIG_FILENAME = "pipelineconfig.toml" PERMISSIONS_PROVIDERS = [OPEN_ID_CONNECT, IAM] OPENID_CONNECT = "OpenID Connect (OIDC)" @click.command("bootstrap", short_help=SHORT_HELP, help=HELP_TEXT, context_settings=dict(max_content_width=120)) @configuration_option(provider=ConfigProvider(section="parameters")) @click.option( "--interactive/--no-interactive", is_flag=True, default=True, help="Disable interactive prompting for bootstrap parameters, and fail if any required arguments are missing.", ) @click.option( "--stage", help="The name of the corresponding deployment stage. " "It is used as a suffix for the created AWS infrastructure resources.", required=False, ) @click.option( "--pipeline-user", help="The Amazon Resource Name (ARN) of the IAM user having its access key ID and secret access key " "shared with the CI/CD system. It is used to grant this IAM user permission to access the " "corresponding AWS account. If not provided, the command will create one along with the access " "key ID and secret access key credentials.", required=False, ) @click.option( "--pipeline-execution-role", help="The ARN of the IAM role to be assumed by the pipeline user to operate on this stage. " "Provide it only if you want to use your own role, otherwise this command will create one.", required=False, ) @click.option( "--cloudformation-execution-role", help="The ARN of the IAM role to be assumed by the AWS CloudFormation service while deploying the " "application's stack. Provide only if you want to use your own role, otherwise the command will create one.", required=False, ) @click.option( "--bucket", help="The ARN of the Amazon S3 bucket to hold the AWS SAM artifacts.", required=False, ) @click.option( "--create-image-repository/--no-create-image-repository", is_flag=True, default=False, help="If set to true and no ECR image repository is provided, this command will create an ECR image repository " "to hold the container images of Lambda functions having an Image package type.", ) @click.option( "--image-repository", help="The ARN of an Amazon ECR image repository to hold the container images of Lambda functions or " "layers that have a package type of Image. If provided, the --create-image-repository options is ignored. " "If not provided and --create-image-repository is specified, the command will create one.", required=False, ) @click.option( "--confirm-changeset/--no-confirm-changeset", default=True, is_flag=True, help="Prompt to confirm if the resources are to be deployed.", ) @click.option( "--permissions-provider", default=IAM, required=False, type=click.Choice(PERMISSIONS_PROVIDERS), help="Choose a permissions provider to assume the pipeline execution role. Default is to use an IAM User.", ) @click.option( "--oidc-provider-url", help="The URL of the OIDC provider.", required=False, ) @click.option("--oidc-client-id", help="The client ID configured to use with the OIDC provider.", required=False) @click.option( "--github-org", help="The GitHub organization that the repository belongs to. " "If there is no organization enter the Username of the repository owner instead " "Only used if using GitHub Actions OIDC for user permissions", required=False, cls=ClickMutex, incompatible_params=["bitbucket_repo_uuid", "gitlab_group", "gitlab_project"], ) @click.option( "--github-repo", help="The name of the GitHub Repository that deployments will occur from. " "Only used if using GitHub Actions OIDC for permissions", required=False, cls=ClickMutex, incompatible_params=["bitbucket_repo_uuid", "gitlab_group", "gitlab_project"], ) @click.option( "--deployment-branch", help="The name of the branch that deployments will occur from. " "Only used if using GitHub Actions OIDC for permissions", required=False, ) @click.option( "--oidc-provider", help="The name of the CI/CD system that will be used for OIDC permissions " "Currently supported CI/CD systems are : GitLab, GitHub and Bitbucket", type=click.Choice([GITHUB_ACTIONS, GITLAB, BITBUCKET]), required=False, cls=ClickMutex, required_param_lists=[ ["gitlab_group", "gitlab_project"], ["github_org", "github_repo"], ["bitbucket_repo_uuid"], ], ) @click.option( "--gitlab-group", help="The GitLab group that the repository belongs to. Only used if using GitLab OIDC for permissions", required=False, cls=ClickMutex, incompatible_params=["bitbucket_repo_uuid", "github_org", "github_repo"], ) @click.option( "--gitlab-project", help="The GitLab project name. Only used if using GitLab OIDC for permissions", required=False, cls=ClickMutex, incompatible_params=["bitbucket_repo_uuid", "github_org", "github_repo"], ) @click.option( "--bitbucket-repo-uuid", help="The UUID of the Bitbucket repository. Only used if using Bitbucket OIDC for permissions. " "Found at https://bitbucket.org/<WORKSPACE>/<REPOSITORY>/admin/addon/admin/pipelines/openid-connect", required=False, cls=ClickMutex, incompatible_params=["gitlab_group", "gitlab_project", "github_org", "github_repo"], ) @click.option( "--cicd-provider", help="The CICD platform for the SAM Pipeline", required=False, ) @common_options @aws_creds_options @save_params_option @pass_context @track_command @check_newer_version @print_cmdline_args @command_exception_handler def cli( ctx: Any, interactive: bool, stage: Optional[str], pipeline_user: Optional[str], pipeline_execution_role: Optional[str], cloudformation_execution_role: Optional[str], bucket: Optional[str], create_image_repository: bool, image_repository: Optional[str], confirm_changeset: bool, config_file: Optional[str], config_env: Optional[str], permissions_provider: Optional[str], oidc_provider_url: Optional[str], oidc_client_id: Optional[str], github_org: Optional[str], github_repo: Optional[str], deployment_branch: Optional[str], oidc_provider: Optional[str], gitlab_group: Optional[str], gitlab_project: Optional[str], bitbucket_repo_uuid: Optional[str], cicd_provider: Optional[str], save_params: bool, ) -> None: """ `sam pipeline bootstrap` command entry point """ do_cli( region=ctx.region, profile=ctx.profile, interactive=interactive, stage_configuration_name=stage, pipeline_user_arn=pipeline_user, pipeline_execution_role_arn=pipeline_execution_role, cloudformation_execution_role_arn=cloudformation_execution_role, artifacts_bucket_arn=bucket, create_image_repository=create_image_repository, image_repository_arn=image_repository, confirm_changeset=confirm_changeset, config_file=config_env, config_env=config_file, permissions_provider=permissions_provider, oidc_provider_url=oidc_provider_url, oidc_client_id=oidc_client_id, github_org=github_org, github_repo=github_repo, deployment_branch=deployment_branch, oidc_provider=oidc_provider, gitlab_group=gitlab_group, gitlab_project=gitlab_project, bitbucket_repo_uuid=bitbucket_repo_uuid, cicd_provider=cicd_provider, ) # pragma: no cover def do_cli( region: Optional[str], profile: Optional[str], interactive: bool, stage_configuration_name: Optional[str], pipeline_user_arn: Optional[str], pipeline_execution_role_arn: Optional[str], cloudformation_execution_role_arn: Optional[str], artifacts_bucket_arn: Optional[str], create_image_repository: bool, image_repository_arn: Optional[str], confirm_changeset: bool, config_file: Optional[str], config_env: Optional[str], permissions_provider: Optional[str], oidc_provider_url: Optional[str], oidc_client_id: Optional[str], github_org: Optional[str], github_repo: Optional[str], deployment_branch: Optional[str], oidc_provider: Optional[str], gitlab_group: Optional[str], gitlab_project: Optional[str], bitbucket_repo_uuid: Optional[str], cicd_provider: Optional[str], standalone: bool = True, ) -> None: """ implementation of `sam pipeline bootstrap` command """ from samcli.commands.pipeline.bootstrap.guided_context import GuidedContext from samcli.commands.pipeline.external_links import CONFIG_AWS_CRED_ON_CICD_URL from samcli.lib.pipeline.bootstrap.stage import ( BITBUCKET_REPO_UUID, DEPLOYMENT_BRANCH, GITHUB_ORG, GITHUB_REPO, GITLAB_GROUP, GITLAB_PROJECT, OIDC_CLIENT_ID, OIDC_PROVIDER, OIDC_PROVIDER_URL, OIDC_SUPPORTED_PROVIDER, PERMISSIONS_PROVIDER, Stage, ) from samcli.lib.utils.colors import Colored config_parameters = _load_config_values() if not pipeline_user_arn and not permissions_provider == OPEN_ID_CONNECT: pipeline_user_arn = config_parameters.get("pipeline_user") enable_oidc_option = False if not cicd_provider or cicd_provider in OIDC_SUPPORTED_PROVIDER: enable_oidc_option = True oidc_provider = cicd_provider oidc_config = OidcConfig( oidc_client_id=oidc_client_id, oidc_provider=oidc_provider, oidc_provider_url=oidc_provider_url ) gitlab_config = GitLabOidcConfig( gitlab_group=gitlab_group, gitlab_project=gitlab_project, deployment_branch=deployment_branch ) github_config = GitHubOidcConfig( github_org=github_org, github_repo=github_repo, deployment_branch=deployment_branch ) bitbucket_config = BitbucketOidcConfig(bitbucket_repo_uuid=bitbucket_repo_uuid) if config_parameters: saved_provider = config_parameters.get(PERMISSIONS_PROVIDER) if saved_provider == OPENID_CONNECT: permissions_provider = OPEN_ID_CONNECT oidc_config.update_values( oidc_provider=config_parameters.get(OIDC_PROVIDER), oidc_provider_url=config_parameters.get(OIDC_PROVIDER_URL), oidc_client_id=config_parameters.get(OIDC_CLIENT_ID), ) github_config.update_values( github_org=config_parameters.get(GITHUB_ORG), github_repo=config_parameters.get(GITHUB_REPO), deployment_branch=config_parameters.get(DEPLOYMENT_BRANCH), ) gitlab_config.update_values( gitlab_group=config_parameters.get(GITLAB_GROUP), gitlab_project=config_parameters.get(GITLAB_PROJECT), deployment_branch=config_parameters.get(DEPLOYMENT_BRANCH), ) bitbucket_config.update_values(bitbucket_repo_uuid=config_parameters.get(BITBUCKET_REPO_UUID)) elif saved_provider == "AWS IAM": permissions_provider = IAM if interactive: if standalone: click.echo( dedent( """\ sam pipeline bootstrap generates the required AWS infrastructure resources to connect to your CI/CD system. This step must be run for each deployment stage in your pipeline, prior to running the sam pipeline init command. We will ask for [1] stage definition, [2] account details, and [3] references to existing resources in order to bootstrap these pipeline resources. """ ), ) guided_context = GuidedContext( profile=profile, stage_configuration_name=stage_configuration_name, pipeline_user_arn=pipeline_user_arn, pipeline_execution_role_arn=pipeline_execution_role_arn, cloudformation_execution_role_arn=cloudformation_execution_role_arn, artifacts_bucket_arn=artifacts_bucket_arn, create_image_repository=create_image_repository, image_repository_arn=image_repository_arn, region=region, permissions_provider=permissions_provider, oidc_config=oidc_config, github_config=github_config, gitlab_config=gitlab_config, bitbucket_config=bitbucket_config, enable_oidc_option=enable_oidc_option, ) guided_context.run() stage_configuration_name = guided_context.stage_configuration_name pipeline_user_arn = guided_context.pipeline_user_arn pipeline_execution_role_arn = guided_context.pipeline_execution_role_arn cloudformation_execution_role_arn = guided_context.cloudformation_execution_role_arn artifacts_bucket_arn = guided_context.artifacts_bucket_arn create_image_repository = guided_context.create_image_repository image_repository_arn = guided_context.image_repository_arn region = guided_context.region profile = guided_context.profile permissions_provider = guided_context.permissions_provider subject_claim = None pipeline_oidc_provider: Optional[PipelineOidcProvider] = None if permissions_provider == OPEN_ID_CONNECT: pipeline_oidc_provider = _get_pipeline_oidc_provider( oidc_config=oidc_config, github_config=github_config, gitlab_config=gitlab_config, bitbucket_config=bitbucket_config, ) subject_claim = pipeline_oidc_provider.get_subject_claim() if not stage_configuration_name: raise click.UsageError("Missing required parameter '--stage'") environment: Stage = Stage( name=stage_configuration_name, aws_profile=profile, aws_region=region, pipeline_user_arn=pipeline_user_arn, pipeline_execution_role_arn=pipeline_execution_role_arn, cloudformation_execution_role_arn=cloudformation_execution_role_arn, artifacts_bucket_arn=artifacts_bucket_arn, create_image_repository=create_image_repository, image_repository_arn=image_repository_arn, oidc_provider_url=oidc_config.oidc_provider_url, oidc_client_id=oidc_config.oidc_client_id, permissions_provider=permissions_provider, subject_claim=subject_claim, pipeline_oidc_provider=pipeline_oidc_provider, ) bootstrapped: bool = environment.bootstrap(confirm_changeset=confirm_changeset) if bootstrapped: environment.print_resources_summary() environment.save_config_safe( config_dir=PIPELINE_CONFIG_DIR, filename=PIPELINE_CONFIG_FILENAME, cmd_names=_get_bootstrap_command_names() ) click.secho( dedent( f"""\ View the definition in {os.path.join(PIPELINE_CONFIG_DIR, PIPELINE_CONFIG_FILENAME)}, run sam pipeline bootstrap to generate another set of resources, or proceed to sam pipeline init to create your pipeline configuration file. """ ) ) if not environment.pipeline_user.is_user_provided and not environment.use_oidc_provider: click.secho( dedent( f"""\ Before running {Colored().bold("sam pipeline init")}, we recommend first setting up AWS credentials in your CI/CD account. Read more about how to do so with your provider in {CONFIG_AWS_CRED_ON_CICD_URL}. """ ) ) def _get_pipeline_oidc_provider( oidc_config: OidcConfig, github_config: GitHubOidcConfig, gitlab_config: GitLabOidcConfig, bitbucket_config: BitbucketOidcConfig, ) -> PipelineOidcProvider: from samcli.commands.pipeline.bootstrap.pipeline_oidc_provider import ( BitbucketOidcProvider, GitHubOidcProvider, GitLabOidcProvider, ) if oidc_config.oidc_provider == GITHUB_ACTIONS: github_oidc_params: dict = { GitHubOidcProvider.GITHUB_ORG_PARAMETER_NAME: github_config.github_org, GitHubOidcProvider.GITHUB_REPO_PARAMETER_NAME: github_config.github_repo, GitHubOidcProvider.DEPLOYMENT_BRANCH_PARAMETER_NAME: github_config.deployment_branch, } return GitHubOidcProvider(github_oidc_params, oidc_config.get_oidc_parameters()) if oidc_config.oidc_provider == GITLAB: gitlab_oidc_params: dict = { GitLabOidcProvider.GITLAB_PROJECT_PARAMETER_NAME: gitlab_config.gitlab_project, GitLabOidcProvider.GITLAB_GROUP_PARAMETER_NAME: gitlab_config.gitlab_group, GitLabOidcProvider.DEPLOYMENT_BRANCH_PARAMETER_NAME: gitlab_config.deployment_branch, } return GitLabOidcProvider(gitlab_oidc_params, oidc_config.get_oidc_parameters()) if oidc_config.oidc_provider == BITBUCKET: bitbucket_oidc_params: dict = { BitbucketOidcProvider.BITBUCKET_REPO_UUID_PARAMETER_NAME: bitbucket_config.bitbucket_repo_uuid } return BitbucketOidcProvider(bitbucket_oidc_params, oidc_config.get_oidc_parameters()) raise click.UsageError("Missing required parameter '--oidc-provider'") def _load_config_values() -> Dict[str, str]: samconfig: SamConfig = SamConfig(config_dir=PIPELINE_CONFIG_DIR, filename=PIPELINE_CONFIG_FILENAME) if not samconfig.exists(): return {} config: Dict[str, str] = samconfig.get_all(cmd_names=_get_bootstrap_command_names(), section="parameters") return config def _get_bootstrap_command_names() -> List[str]: return ["pipeline", "bootstrap"]

samcli/commands/pipeline/bootstrap/cli.py (421 lines of code) (raw):