Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(cli): support SSO #19454

Merged
merged 28 commits into from Mar 21, 2022
Merged

feat(cli): support SSO #19454

Show file tree
Hide file tree
Changes from 18 commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
f12a0ac
rewrite Construct imports
comcalvi Feb 17, 2022
03c3a26
undo
comcalvi Feb 17, 2022
27437e8
Merge branch 'master' of github.com:aws/aws-cdk
comcalvi Feb 18, 2022
0d43399
Merge branch 'master' of github.com:aws/aws-cdk
comcalvi Feb 18, 2022
6d8f6d9
Merge branch 'master' of github.com:aws/aws-cdk
comcalvi Feb 24, 2022
71a9596
Merge branch 'master' of github.com:aws/aws-cdk
comcalvi Feb 28, 2022
182635f
Merge branch 'master' of github.com:aws/aws-cdk
comcalvi Mar 4, 2022
841ab25
added sso support to cdk
comcalvi Mar 10, 2022
2e1b803
Merge branch 'master' of github.com:aws/aws-cdk into sso-support
comcalvi Mar 10, 2022
c5e3153
changed sso creds object name
comcalvi Mar 10, 2022
7972f52
added unit test
comcalvi Mar 15, 2022
7c9884c
updated sdk dependency
comcalvi Mar 16, 2022
24df923
Merge branch 'master' of github.com:aws/aws-cdk into sso-support
comcalvi Mar 16, 2022
17348cd
fixed comiplation type checking issue
comcalvi Mar 17, 2022
30768d6
AWS_PROFILE now loads it
comcalvi Mar 17, 2022
504a56c
removed tests
comcalvi Mar 17, 2022
47b4d93
yarn.lock
comcalvi Mar 18, 2022
11a9a01
readme
comcalvi Mar 18, 2022
b4d7c18
removed conditional credential loading
comcalvi Mar 18, 2022
5d36999
fixed test
comcalvi Mar 18, 2022
00da3f7
removed brace
comcalvi Mar 18, 2022
778a58b
merge conflicts
comcalvi Mar 18, 2022
7f99bc1
yarn pkglint (again)
comcalvi Mar 18, 2022
0cccd51
Refactor, version bump
rix0rrr Mar 21, 2022
e322095
Merge remote-tracking branch 'origin/master' into pr/comcalvi/19454
rix0rrr Mar 21, 2022
c44e364
Remove duplication
rix0rrr Mar 21, 2022
e0cf8b1
Licenses take 2358925
rix0rrr Mar 21, 2022
d61de2b
Merge branch 'master' into sso-support
mergify[bot] Mar 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/aws-cdk/README.md
View file
Open in desktop
Expand Up @@ -622,6 +622,11 @@ role_arn=arn:aws:iam::123456789123:role/role_to_be_assumed
mfa_serial=arn:aws:iam::123456789123:mfa/my_user
```

## SSO support

If you create an SSO profile with `aws configure sso` and run `aws sso login`, the CDK can use those credentials
if you set the profile name as the value of `AWS_PROFILE` or pass it to `--profile`.

## Configuration

On top of passing configuration through command-line arguments, it is possible to use JSON configuration files. The
Expand Down
12 changes: 11 additions & 1 deletion packages/aws-cdk/THIRD_PARTY_LICENSES
View file
Open in desktop
Expand Up @@ -357,7 +357,7 @@ IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

----------------

** aws-sdk@2.1089.0 - https://www.npmjs.com/package/aws-sdk/v/2.1089.0 | Apache-2.0
** aws-sdk@2.1095.0 - https://www.npmjs.com/package/aws-sdk/v/2.1095.0 | Apache-2.0
AWS SDK for JavaScript
Copyright 2012-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.

Expand Down Expand Up @@ -3241,6 +3241,16 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

----------------
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I want Eli to have a look at this.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure why, but looks like the aws-sdk upgrade in the CLI package broke the hoisting.

Currently on master we have:

<repoRoot>/node_modules/aws-sdk (version 2.1094.0)

When I upgraded aws-sdk@^2.979.0 to aws-sdk@^2.1093.0 and ran yarn install, I got the following directory structure:

<repoRoot>/node_modules/aws-sdk (version 2.1094.0)
<repoRoot>/packages/aws-cdk/node_modules/aws-sdk (version 2.1096.0)

I expected version 2.1096.0 to be hoisted and replace 2.1094.0 - but thats not what happens.

So in practice the CLI uses two different versions of aws-sdk. One coming from its own direct dependency, which isn't hoisted anymore (2.1096.0), and one coming transitively from cdk-assets, which is hoisted (2.1094.0).

We need to figure out why yarn isn't hoisting it. @rix0rrr Any ideas?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, feels like it should be able to. Wonder if there's a constraint somewhere that's preventing the hoist?


** aws-sdk@2.1089.0 - https://www.npmjs.com/package/aws-sdk/v/2.1089.0 | Apache-2.0
AWS SDK for JavaScript
Copyright 2012-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.

This product includes software developed at
Amazon Web Services, Inc. (http://aws.amazon.com/).


----------------

** wrap-ansi@7.0.0 - https://www.npmjs.com/package/wrap-ansi/v/7.0.0 | MIT
Expand Down
6 changes: 6 additions & 0 deletions packages/aws-cdk/lib/api/aws-auth/awscli-compatible.ts
View file
Open in desktop
Expand Up @@ -42,6 +42,7 @@ export class AwsCliCompatible {
const theProfile = options.profile;
return new AWS.CredentialProviderChain([
() => profileCredentials(theProfile),
() => new AWS.SsoCredentials({ profile: theProfile }),
() => new AWS.ProcessCredentials({ profile: theProfile }),
]);
}
Expand All @@ -53,6 +54,11 @@ export class AwsCliCompatible {
() => new AWS.EnvironmentCredentials('AMAZON'),
];

if (process.env.AWS_PROFILE) {
await forceSdkToReadConfigIfPresent();
sources.push(() => new AWS.SsoCredentials({ profile: implicitProfile }));
}

if (await fs.pathExists(credentialsFileName())) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you try it without this if, and putting the SsoCredentials inside the sources array below?

Copy link
Contributor Author

@comcalvi comcalvi Mar 18, 2022 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rix0rrr yep, this change works, with both an existing (but empty) credentials file and with no credentials file. Removing the config file breaks it, but that's expected. I also had to change one of the tests to use the 5th member of the chain instead of the 2nd (see diff), but this should be fine because that test seems to check for existence only.

// Force reading the `config` file if it exists by setting the appropriate
// environment variable.
Expand Down
2 changes: 1 addition & 1 deletion packages/aws-cdk/package.json
View file
Open in desktop
Expand Up @@ -94,7 +94,7 @@
"@aws-cdk/region-info": "0.0.0",
"@jsii/check-node": "1.54.0",
"archiver": "^5.3.0",
"aws-sdk": "^2.979.0",
"aws-sdk": "^2.1093.0",
"camelcase": "^6.3.0",
"cdk-assets": "0.0.0",
"chokidar": "^3.5.3",
Expand Down
6 changes: 5 additions & 1 deletion packages/aws-cdk/test/context-providers/amis.test.ts
View file
Open in desktop
Expand Up @@ -3,7 +3,11 @@ import * as AWS from 'aws-sdk-mock';
import { AmiContextProviderPlugin } from '../../lib/context-providers/ami';
import { MockSdkProvider } from '../util/mock-sdk';

AWS.setSDKInstance(aws);
// If the 'aws-sdk' package imported here and the 'aws-sdk' package imported by 'aws-sdk-mock' aren't
// the same physical package on disk (if version mismatches cause hoisting/deduping to not happen),
// the type check here takes too long and makes the TypeScript compiler fail.
// Suppress the type check using 'as any' to make this more robust.
AWS.setSDKInstance(aws as any);

afterEach(done => {
AWS.restore();
Expand Down
6 changes: 5 additions & 1 deletion packages/aws-cdk/test/context-providers/asymmetric-vpcs.test.ts
View file
Open in desktop
Expand Up @@ -3,7 +3,11 @@ import * as AWS from 'aws-sdk-mock';
import { VpcNetworkContextProviderPlugin } from '../../lib/context-providers/vpcs';
import { MockSdkProvider } from '../util/mock-sdk';

AWS.setSDKInstance(aws);
// If the 'aws-sdk' package imported here and the 'aws-sdk' package imported by 'aws-sdk-mock' aren't
// the same physical package on disk (if version mismatches cause hoisting/deduping to not happen),
// the type check here takes too long and makes the TypeScript compiler fail.
// Suppress the type check using 'as any' to make this more robust.
AWS.setSDKInstance(aws as any);

afterEach(done => {
AWS.restore();
Expand Down
17 changes: 16 additions & 1 deletion yarn.lock
View file
Open in desktop
Expand Up @@ -2562,7 +2562,22 @@ aws-sdk-mock@5.6.0:
sinon "^11.1.1"
traverse "^0.6.6"

aws-sdk@^2.596.0, aws-sdk@^2.848.0, aws-sdk@^2.928.0, aws-sdk@^2.979.0:
aws-sdk@^2.1093.0:
version "2.1095.0"
resolved "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1095.0.tgz#7847493b09a326a0613010ed9db53302f760edf6"
integrity sha512-OrZq2pTDsnfOJYsAdRlw+NXTGLQYqWldSZR3HugW8JT4JPWyFZrgB2yPP2ElFHX+4J4SZg5QvkAXl/7s9gLTgA==
dependencies:
buffer "4.9.2"
events "1.1.1"
ieee754 "1.1.13"
jmespath "0.16.0"
querystring "0.2.0"
sax "1.2.1"
url "0.10.3"
uuid "3.3.2"
xml2js "0.4.19"

aws-sdk@^2.596.0, aws-sdk@^2.848.0, aws-sdk@^2.928.0:
version "2.1089.0"
resolved "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1089.0.tgz#198ee116f3d6f70cd26cd6f7efa6adba46a54768"
integrity sha512-QhawXCxhOLR+SJHuKXNzyx1hd+oA1HqaDRjbeTKUrz7g2KF4EyPWvLwzf1fNaOTPK3Vp3JDYijusdKlfV69efw==
Expand Down