feat: Custom policies IAM Policies for Lambda and Containers #8068

ammarkarachi · 2021-08-31T17:04:17Z

Description of changes

Issue #, if available

Description of how you validated changes

Checklist

PR description included
yarn test passes
Tests are changed or added
Relevant documentation is changed or added (and PR referenced)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

packages/amplify-cli-core/src/state-manager/stateManager.ts

packages/amplify-cli-core/src/customPoliciesUtils.ts

packages/amplify-e2e-tests/src/__tests__/custom_policies_container.test.ts

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts

packages/amplify-e2e-tests/src/__tests__/custom_policies_container.test.ts

packages/amplify-e2e-tests/src/__tests__/custom_policies_function.test.ts

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts

ammarkarachi · 2021-08-31T17:29:49Z

e2e test only includes happy path, needs unit tests for validation

lgtm-com · 2021-08-31T17:41:35Z

This pull request introduces 1 alert when merging e25aeff into 7b5de7b - view on LGTM.com

new alerts:

1 for Polynomial regular expression used on uncontrolled data

packages/amplify-provider-awscloudformation/src/push-resources.ts

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts

codecov-commenter · 2021-09-01T23:07:26Z

Codecov Report

Merging #8068 (64096b9) into master (b524870) will increase coverage by 0.04%.
The diff coverage is 69.56%.

@@            Coverage Diff             @@
##           master    #8068      +/-   ##
==========================================
+ Coverage   54.43%   54.47%   +0.04%     
==========================================
  Files         664      665       +1     
  Lines       37838    37947     +109     
  Branches     7768     7788      +20     
==========================================
+ Hits        20597    20672      +75     
- Misses      16401    16435      +34     
  Partials      840      840

Impacted Files	Coverage Δ
...tion/src/provider-utils/awscloudformation/index.ts	`13.27% <25.00%> (+0.21%)`	⬆️
...y-provider-awscloudformation/src/push-resources.ts	`9.36% <33.33%> (-0.02%)`	⬇️
...amplify-cli-core/src/state-manager/stateManager.ts	`40.00% <42.85%> (-0.97%)`	⬇️
.../amplify-cli-core/src/state-manager/pathManager.ts	`71.42% <50.00%> (-0.45%)`	⬇️
...on/src/pre-push-cfn-processor/cfn-pre-processor.ts	`74.74% <71.26%> (-25.26%)`	⬇️
...ckages/amplify-cli-core/src/customPoliciesUtils.ts	`100.00% <100.00%> (ø)`
packages/amplify-cli-core/src/errors/index.ts	`100.00% <100.00%> (ø)`
packages/amplify-cli-core/src/index.ts	`100.00% <100.00%> (ø)`

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b524870...64096b9. Read the comment docs.

lgtm-com · 2021-09-01T23:09:02Z

This pull request introduces 1 alert when merging def8d16 into a51463a - view on LGTM.com

new alerts:

1 for Polynomial regular expression used on uncontrolled data

lgtm-com · 2021-09-03T06:33:14Z

This pull request introduces 1 alert and fixes 1 when merging a079e01 into 4cacaad - view on LGTM.com

new alerts:

1 for Polynomial regular expression used on uncontrolled data

fixed alerts:

1 for Unused variable, import, function or class

add custom policies file to function and API container, merge the custom policies to CFN template, validation for regex of resources and actions in the custom policies file

1. Add Json Schema to validate the customers input 2. some minor changes related to format issue 3. error handle

…d env, and push

…-cloudformation, validation

lgtm-com · 2021-09-08T00:53:26Z

This pull request introduces 1 alert when merging 453b8b2 into 4ee9232 - view on LGTM.com

new alerts:

1 for Polynomial regular expression used on uncontrolled data

lgtm-com · 2021-09-08T06:09:13Z

This pull request introduces 1 alert when merging d9ed2e4 into 4ee9232 - view on LGTM.com

new alerts:

1 for Polynomial regular expression used on uncontrolled data

ammarkarachi · 2021-09-08T16:28:25Z

packages/amplify-cli-core/src/__tests__/customPoliciesUtils.test.ts

+import {addCustomPoliciesFile} from "../customPoliciesUtils"
+import { JSONUtilities } from "..";
+import { pathManager, PathConstants } from "../state-manager";
+import * as path from 'path';


Suggested change

import * as path from 'path';

import path from 'path';

* as path is the recommended way because it will work even if there is no default export in the module. In the case of 'path' it doesn't make a difference, but * as namespace is more consistent as it works everywhere

It was just to make it consistent with rest of the imports in Amplify CLI

ammarkarachi · 2021-09-08T16:33:12Z

packages/amplify-cli-core/src/state-manager/stateManager.ts

+    if (!(fs.existsSync(filePath)) || !isCustomPoliciesFile(filePath)) {
+      return undefined;
+    }


@luhanamz This is doing what JSONUtilities already does, you might not need it and then you can get rid of isCustomPoliciesFile(filepath)

packages/amplify-e2e-core/src/categories/api.ts

ammarkarachi · 2021-09-08T16:47:06Z

packages/amplify-e2e-core/src/utils/projectMeta.ts

@@ -28,6 +28,9 @@ function getProjectMeta(projectRoot: string) {
  const metaFilePath: string = path.join(projectRoot, 'amplify', '#current-cloud-backend', 'amplify-meta.json');
  return JSON.parse(fs.readFileSync(metaFilePath, 'utf8'));
 }
+function getCustomPoliciesPath(projectRoot: string, category: string, resourceName: string): string {


Can this be just used from pathmanager in core?

No, it failed

Ok I will have to take a look at it

edwardfoyle · 2021-09-08T16:56:47Z

packages/amplify-cli-core/src/__tests__/customPoliciesUtils.test.ts

+import {addCustomPoliciesFile} from "../customPoliciesUtils"
+import { JSONUtilities } from "..";
+import { pathManager, PathConstants } from "../state-manager";
+import * as path from 'path';


* as path is the recommended way because it will work even if there is no default export in the module. In the case of 'path' it doesn't make a difference, but * as namespace is more consistent as it works everywhere

edwardfoyle · 2021-09-08T16:57:19Z

packages/amplify-category-function/src/provider-utils/awscloudformation/index.ts

@@ -30,6 +30,7 @@ import {
  saveMutableState,
  updateLayerArtifacts,
 } from './utils/storeResources';
+import {addCustomPoliciesFile} from "amplify-cli-core";


need to run the linter

edwardfoyle · 2021-09-08T16:58:27Z

...core/src/__tests__/testFiles/custom-policies-test/function/functionTest/custom-policies.json

@@ -0,0 +1,8 @@
+{
+  "policies": [


I thought we decided on a top-level array in this file?

Yes, forgot to change here

edwardfoyle · 2021-09-08T16:59:01Z

packages/amplify-cli-core/src/cfnUtilities.ts

@@ -231,7 +231,7 @@ const CF_SCHEMA = yaml.JSON_SCHEMA.extend([
  }),
 ]);

-function isJsonFileContent(fileContent: string): boolean {
+export function isJsonFileContent(fileContent: string): boolean {


why exported? I don't see it used anywhere else in this PR?

I was using this before, forgot to take out the export

edwardfoyle · 2021-09-08T17:01:51Z

packages/amplify-cli-core/src/customPoliciesUtils.ts

+    ]
+  });
+
+export function addCustomPoliciesFile(categoryName: string, resourceName: string) {


nit:

Suggested change

export function addCustomPoliciesFile(categoryName: string, resourceName: string) {

export function createDefaultCustomPoliciesFile(categoryName: string, resourceName: string) {

edwardfoyle · 2021-09-08T17:32:41Z

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts

+}
+
+//replace or add env parameter in the front of the resource customers enter to the current env
+async function replaceEnvForCustomPolicies(policy: CustomIAMPolicy, currentEnv: string) : Promise<CustomIAMPolicy> {


doesn't need to be async, currentEnv is not used

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts

edwardfoyle · 2021-09-08T17:38:24Z

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts

+  resourceDir: string,
+  cfnFile: string,
+  category: string,
+  filePath: string


is filePath ever different from path.join(resourceDir, cfnFile)? If not, remove this parameter and just use that

edwardfoyle · 2021-09-08T17:40:16Z

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts

+export async function writeCustomPoliciesToCFNTemplate(
+  resourceName: string,
+  service: string,
+  resourceDir: string,


this can be derived from category and resourceName using pathManager.getResourceDirectoryPath(undefined, category, resourceName)

edwardfoyle · 2021-09-08T17:42:16Z

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts

+  category: string,
+  filePath: string
+) {
+  if (!(service === 'Lambda' || service === 'ElasticContainer')) {


recommend changing to:

Suggested change

if (!(service === 'Lambda' || service === 'ElasticContainer')) {

if (!customPolicySupportedServices.includes(service)) {

then define

const customPolicySupportedServices = ['Lambda', 'ElasticContainer']

at the top of the file. This should make it easier to extend this feature to other services in the future

packages/amplify-cli-core/src/customPoliciesUtils.ts

edwardfoyle · 2021-09-08T18:28:07Z

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts

+  const resourceRegex = new RegExp('arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\\-])+:([a-z]{2}(-gov)?-[a-z]+-\\d{1})?:(\\d{12})?:(.*)');
+  const actionRegex = new RegExp('[a-zA-Z0-9]+:[a-z|A-Z|0-9|*]+');


you may be able to add these regexs to the json schema and get this validation for free with ajv
http://json-schema.org/understanding-json-schema/reference/regular_expressions.html

I cannot find a way to print out the wrong resource or action using ajv to validate for regex

if(!validatePolicy(data)) { let errorMessage = ``; validatePolicy .errors .forEach(error => error.keyword === 'pattern'? errorMessage += `Invalid custom IAM policy for ${resourceName}. Incorrect "Resource": ${error.data}\n Edit ${customPoliciesPath} to fix` :errorMessage += `Invalid custom IAM policies in the ${resourceName} ${categoryName}.\n Edit <project-dir>/amplify/backend/function/${resourceName}/custom-policies.json to fix Learn more about custom IAM policies for ${categoryName}: https://docs.amplify.aws/function/custom-policies\n)`; throw new CustomPoliciesFormatError(errorMessage); }

Above is what I tried but didn't work. The error.data is undefined

In that case, I would move the validateCustomPolicy call within the validateCustomPoliciesSchema function just to keep all of the validation together

akshbhu

Overall looks Good

I have some questions , plus some of Eds comment can be addressed

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts

akshbhu · 2021-09-08T18:33:30Z

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts

+  }
+  const { templateFormat, cfnTemplate } = await readCFNTemplate(path.join(resourceDir, cfnFile));
+  const customPolicies = stateManager.getCustomPolicies(category, resourceName);
+  if (!validateExistCustomPolicies(customPolicies)) {


whats the differecne between validateExistCustomPolicies and validateCustomPoliciesSchema function?

validateExistCustomPolicies is to validate if customers add any custom policies, if not, we will see if exists and delete the policies in the CFN template and skip the process. validateCustomPoliciesSchema is to validate if they enter the right schema of policies, if not, we will throw an error

lgtm-com · 2021-09-09T08:10:55Z

This pull request introduces 1 alert when merging b7dda25 into 2bd7103 - view on LGTM.com

new alerts:

1 for Polynomial regular expression used on uncontrolled data

lgtm-com · 2021-09-09T17:30:34Z

This pull request introduces 1 alert when merging c0c01d5 into 2bd7103 - view on LGTM.com

new alerts:

1 for Polynomial regular expression used on uncontrolled data

lgtm-com · 2021-09-09T18:18:38Z

This pull request introduces 1 alert when merging 64096b9 into 2bd7103 - view on LGTM.com

new alerts:

1 for Polynomial regular expression used on uncontrolled data

packages/amplify-cli-core/src/state-manager/stateManager.ts

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts

edwardfoyle · 2021-09-09T18:54:27Z

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts

+  const resourceRegex = new RegExp('arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\\-])+:([a-z]{2}(-gov)?-[a-z]+-\\d{1})?:(\\d{12})?:(.*)');
+  const actionRegex = new RegExp('[a-zA-Z0-9]+:[a-z|A-Z|0-9|*]+');


In that case, I would move the validateCustomPolicy call within the validateCustomPoliciesSchema function just to keep all of the validation together

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts

lgtm-com · 2021-09-09T22:46:46Z

This pull request introduces 1 alert when merging 22c178e into 8624305 - view on LGTM.com

new alerts:

1 for Polynomial regular expression used on uncontrolled data

edwardfoyle

Functionally LGTM! If you have time, I think there's still an opportunity to improve the testing, particularly around non-happy path logic.

ammarkarachi · 2021-10-04T23:47:46Z

Test link
https://app.circleci.com/pipelines/github/aws-amplify/amplify-cli?branch=run-e2e%2Fammkara%2FcustomPolicies

github-actions · 2021-10-06T17:13:22Z

👋 Hi, this pull request was referenced in the v6.2.0 release!

Check out the release notes here https://github.com/aws-amplify/amplify-cli/releases/tag/v6.2.0.

* Custom policy implementation * feat: add custom policies file to function and API container add custom policies file to function and API container, merge the custom policies to CFN template, validation for regex of resources and actions in the custom policies file * feat: changes for first PR * feat: Some changes according to the PR comments 1. Add Json Schema to validate the customers input 2. some minor changes related to format issue 3. error handle * feat: replace env to current env in the resource when checkout and add env, and push * feat: e2e test and replacing env * feat: Minor changes for env replacement * feat: remove changing env between env * feat: Add cloudform type for type safety, move validation to provider-cloudformation, validation * feat: remove some unused function and import, change regex for resource * feat: Some changes according to the PR comment * feat: changes according to PR comments * feat: remove unused import * feat: remove previous unused code * feat: Changes according to PR comments * feat: some changes according to PR comments * feat: work on PR comments * feat: rebase for conflict * feat: rebase for failure of hooksmanager test failed * feat: unit test * feat: fix fail test * feat: change default template of custom policies * feat: fix failed test * feat: PR comments * feat: pr comments * feat: fix failed test * feat: PR comments from ED Co-authored-by: Lu Han <[email protected]>

* chore(release): Publish [ci skip] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] * ci: improve parallelism, add windows for e2e tests (#8282) * chore: add additional instance types to @searchable directive (#8284) * ci: support multi-account e2e cleanup (#8082) * test: update pinpoint test region mapping (#8295) * ci: improve parallelization (#8292) * test: fix cci pipeline flow (#8296) * test: remove aws cli win install step (#8299) * fix: logic to display searchable instance warning (#8297) * test: dont run geo e2e tests on windows (#8300) * test: revert test timeout change (#8301) * Automatically retry CircleCi e2e tasks (#8306) * test: fix gql e2e split test logic, remove unnecessary inter-job requirements (#8309) * ci: remove retry wrapper on windows tests to prevent hanging (#8312) * ci: use powershell to run windows tests (#8314) * ci: skip rate limited windows tests (#8319) * chore(release): Publish [ci skip] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] * chore: add cloud-e2e script (#8334) * ci: add automatic retry of failed tasks (#8338) * test: update snapshot file to match renamed test file (#8333) * build: run circleci validator on split-e2e-tests (#8313) * ci: fix retry function (#8343) * ci: track flaky tests in cloudwatch (#8339) * ci: fix cleanup script context (#8344) * feat: Custom policies IAM Policies for Lambda and Containers (#8068) * Custom policy implementation * feat: add custom policies file to function and API container add custom policies file to function and API container, merge the custom policies to CFN template, validation for regex of resources and actions in the custom policies file * feat: changes for first PR * feat: Some changes according to the PR comments 1. Add Json Schema to validate the customers input 2. some minor changes related to format issue 3. error handle * feat: replace env to current env in the resource when checkout and add env, and push * feat: e2e test and replacing env * feat: Minor changes for env replacement * feat: remove changing env between env * feat: Add cloudform type for type safety, move validation to provider-cloudformation, validation * feat: remove some unused function and import, change regex for resource * feat: Some changes according to the PR comment * feat: changes according to PR comments * feat: remove unused import * feat: remove previous unused code * feat: Changes according to PR comments * feat: some changes according to PR comments * feat: work on PR comments * feat: rebase for conflict * feat: rebase for failure of hooksmanager test failed * feat: unit test * feat: fix fail test * feat: change default template of custom policies * feat: fix failed test * feat: PR comments * feat: pr comments * feat: fix failed test * feat: PR comments from ED Co-authored-by: Lu Han <[email protected]> * ci: split some migration tests, fix retry issues, remove per-job cleanup (#8340) * fix(graphql-model-transformer): fix open search instance check for v1 and v2 transformers (#8354) * chore(release): Publish [ci skip] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] * fix: opensearch warning, add optional chaining to get api category (#8371) * fix: opensearch warning, add optional chaining to get api category * fix: opensearch warning, add test with existing categories * chore(graphql-model-transformer): use lodash for accessing deep object property (#8374) * fix(amplify-category-api): custom policies attached to TaskRoleArn (#8376) * test(amplify-e2e-tests): ignore custom policies container tests for windows (#8378) * chore(release): Publish [ci skip] - @aws-amplify/[email protected] - [email protected] - [email protected] * feat(graphql-default-value-transformer): implemented default value directive (#8291) * feat(graphql-model-transformer): index/primarykey datastore selective sync capability (#8240) * feat(amplify-provider-awscloudformation): merge user config with transform generated resolvers (#8262) * feat(amplify-provider-awscloudformation): enable custom resolvers for v2 transformer (#8332) * feat(cli): add post env add plugin event (#8220) * feat(cli): add post env add plugin event * chore(cli): run post env add hook on amplify init * chore: conditionally print update auth warning (#8207) * Revert "fix: fixes e2e bug" (#8397) * Revert "fix: fixes e2e bug (#7067)" This reverts commit 18c9a31. * Update packages/amplify-cli/src/context-manager.ts added ? for type checking * fix(amplify-category-api): fixed api to reference stack name and deployment bucket (#8145) * fix(amplify-category-api): fixed api to reference stack name and deployment bucket * fix: addressed pr comments * revert: temporarily setup new apps with old pluralization (#8401) * test(graphql-model-transformer): fixed plurality e2e test (#8406) * Revert custom override resolvers (#8409) * Revert "feat(amplify-provider-awscloudformation): enable custom resolvers for v2 transformer (#8332)" This reverts commit 1c73042. * Revert "feat(amplify-provider-awscloudformation): merge user config with transform generated resolvers (#8262)" This reverts commit f25abbf. * chore(amplify-e2e-tests): fix config.yml file (#8411) * chore(release): Publish [ci skip] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] * fix: api containers on repushing does not fail (#8416) * fix: api containers on repushing does not fail * feat: Geo category plugin - support for additional regions (#8373) * feat(amplify-category-geo): use custom resource constructs * fix(amplify-category-geo): remove pre-push hook * fix(amplify-category-geo): move lambdas to separate files * fix(amplify-category-geo): update stack test snapshots * fix: null check (#8429) * chore(release): Publish [ci skip] - [email protected] - [email protected] - [email protected] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] * feat: FF for override stacks (#8228) * feat: root stack override (#8276) * feat: added root stack transformation * feat: adding root-stack-builder * feat: added e2e and migration tests * fix: minor fixes * fix: fixes unit tests * fix: address comments * feat: adding rootstack types to overrides helper package (#8298) * feat: ddb overrides and flow refactor * feat: ddb overrides * feat: add migration logic * fix: remove older files post migration * fix: address PR comments * fix: remove inquirer and use amplify prompts instead Co-authored-by: Ghosh <[email protected]> * chore: ddb walkthrough refactor and override tests (#8364) * chore: overrides ddb and walthrough refactor tests * chore: address pr comments Co-authored-by: Ghosh <[email protected]> * feat: Auth refactor to use cdk, eliminate EJS, overrides functionality (#8355) * feat: add auth override * fix: auth state unit tests working * feat: auth e2e fixes and migration e2e included * fix: fixes package name * fix: unit tests fix * fix: unit tests * fix: fixing overwritten files * fix: added vm2 and addressed comments * fix: minor fixes and e2e test for overrides * fix: cli-core unit test * fix: userPool group unit test * fix: minor refractor and comments * chore: lgtm warnings * fix: minor fixes * fix: unit tests * fix: version mismatch Co-authored-by: aws-amplify-bot <[email protected]> Co-authored-by: John Corser <[email protected]> Co-authored-by: Yathi <[email protected]> Co-authored-by: Edward Foyle <[email protected]> Co-authored-by: josef <[email protected]> Co-authored-by: Ammar <[email protected]> Co-authored-by: Lu Han <[email protected]> Co-authored-by: Pavel Lazar <[email protected]> Co-authored-by: Danielle Adams <[email protected]> Co-authored-by: Phani Srikar Edupuganti <[email protected]> Co-authored-by: Kaustav Ghosh <[email protected]> Co-authored-by: Ghosh <[email protected]>

@model

* chore(release): Publish [ci skip] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] * ci: improve parallelism, add windows for e2e tests (#8282) * chore: add additional instance types to @searchable directive (#8284) * ci: support multi-account e2e cleanup (#8082) * test: update pinpoint test region mapping (#8295) * ci: improve parallelization (#8292) * test: fix cci pipeline flow (#8296) * test: remove aws cli win install step (#8299) * fix: logic to display searchable instance warning (#8297) * test: dont run geo e2e tests on windows (#8300) * test: revert test timeout change (#8301) * Automatically retry CircleCi e2e tasks (#8306) * test: fix gql e2e split test logic, remove unnecessary inter-job requirements (#8309) * ci: remove retry wrapper on windows tests to prevent hanging (#8312) * ci: use powershell to run windows tests (#8314) * ci: skip rate limited windows tests (#8319) * chore(release): Publish [ci skip] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] * chore: add cloud-e2e script (#8334) * ci: add automatic retry of failed tasks (#8338) * test: update snapshot file to match renamed test file (#8333) * build: run circleci validator on split-e2e-tests (#8313) * ci: fix retry function (#8343) * ci: track flaky tests in cloudwatch (#8339) * ci: fix cleanup script context (#8344) * feat: Custom policies IAM Policies for Lambda and Containers (#8068) * Custom policy implementation * feat: add custom policies file to function and API container add custom policies file to function and API container, merge the custom policies to CFN template, validation for regex of resources and actions in the custom policies file * feat: changes for first PR * feat: Some changes according to the PR comments 1. Add Json Schema to validate the customers input 2. some minor changes related to format issue 3. error handle * feat: replace env to current env in the resource when checkout and add env, and push * feat: e2e test and replacing env * feat: Minor changes for env replacement * feat: remove changing env between env * feat: Add cloudform type for type safety, move validation to provider-cloudformation, validation * feat: remove some unused function and import, change regex for resource * feat: Some changes according to the PR comment * feat: changes according to PR comments * feat: remove unused import * feat: remove previous unused code * feat: Changes according to PR comments * feat: some changes according to PR comments * feat: work on PR comments * feat: rebase for conflict * feat: rebase for failure of hooksmanager test failed * feat: unit test * feat: fix fail test * feat: change default template of custom policies * feat: fix failed test * feat: PR comments * feat: pr comments * feat: fix failed test * feat: PR comments from ED Co-authored-by: Lu Han <[email protected]> * ci: split some migration tests, fix retry issues, remove per-job cleanup (#8340) * fix(graphql-model-transformer): fix open search instance check for v1 and v2 transformers (#8354) * chore(release): Publish [ci skip] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] * fix: opensearch warning, add optional chaining to get api category (#8371) * fix: opensearch warning, add optional chaining to get api category * fix: opensearch warning, add test with existing categories * chore(graphql-model-transformer): use lodash for accessing deep object property (#8374) * fix(amplify-category-api): custom policies attached to TaskRoleArn (#8376) * test(amplify-e2e-tests): ignore custom policies container tests for windows (#8378) * chore(release): Publish [ci skip] - @aws-amplify/[email protected] - [email protected] - [email protected] * feat(graphql-default-value-transformer): implemented default value directive (#8291) * feat(graphql-model-transformer): index/primarykey datastore selective sync capability (#8240) * feat(amplify-provider-awscloudformation): merge user config with transform generated resolvers (#8262) * feat(amplify-provider-awscloudformation): enable custom resolvers for v2 transformer (#8332) * feat(cli): add post env add plugin event (#8220) * feat(cli): add post env add plugin event * chore(cli): run post env add hook on amplify init * chore: conditionally print update auth warning (#8207) * Revert "fix: fixes e2e bug" (#8397) * Revert "fix: fixes e2e bug (#7067)" This reverts commit 18c9a31. * Update packages/amplify-cli/src/context-manager.ts added ? for type checking * fix(amplify-category-api): fixed api to reference stack name and deployment bucket (#8145) * fix(amplify-category-api): fixed api to reference stack name and deployment bucket * fix: addressed pr comments * revert: temporarily setup new apps with old pluralization (#8401) * test(graphql-model-transformer): fixed plurality e2e test (#8406) * Revert custom override resolvers (#8409) * Revert "feat(amplify-provider-awscloudformation): enable custom resolvers for v2 transformer (#8332)" This reverts commit 1c73042. * Revert "feat(amplify-provider-awscloudformation): merge user config with transform generated resolvers (#8262)" This reverts commit f25abbf. * chore(amplify-e2e-tests): fix config.yml file (#8411) * chore(release): Publish [ci skip] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] * fix: api containers on repushing does not fail (#8416) * fix: api containers on repushing does not fail * feat: Geo category plugin - support for additional regions (#8373) * feat(amplify-category-geo): use custom resource constructs * fix(amplify-category-geo): remove pre-push hook * fix(amplify-category-geo): move lambdas to separate files * fix(amplify-category-geo): update stack test snapshots * fix: null check (#8429) * chore(release): Publish [ci skip] - [email protected] - [email protected] - [email protected] - @aws-amplify/[email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] - [email protected] * Merge GraphQL v-next to master (#8287) * feat(cli-api): improve add and update api * Delete sam.schema.json * Delete cloudformation.schema.json * remove auto apply authmode code from update api workflow * remove unused import * fix lint issues * relative import * fix dependencies * fix lint comments * remove unused code * updated v2 templates * remove unused import * change to use executeProviderUtils * fixed formatting * several minor tweaks to add and update api workflow * update conflict detection label * remove app not deployed message * auto apply auth mode * auto apply authmode for v2 tranformer * add type amplify_global to v2 schemas * Update many-relationship-schema-v2.graphql * Update single-object-auth-schema-v2.graphql * Update single-object-schema-v2.graphql * feat: add @auth (#1) * feat: add @auth base package with Access Control * feat: graphql auth v2 add schemaChanges, iam policy generation, and query/read resolvers * feat: graphql auth v2 add auth on mutation and subscription resolvers * feat(amplify-category-api): add global sandbox mode directive on schema generation (#8074) * feat(amplify-category-api): add global sandbox mode directive on schema generation * test(amplify-e2e-tests): add e2e tests for sandbox mode * test(amplify-category-api): add unit test for generating sandbox mode directive; rm unused method * feat(cli): add sandbox mode warning to amplify status (#8078) * feat(amplify-category-api): prompt api key creation on amplify push (#8124) * feat(amplify-category-api): prompt api key create when invalid with sandbox mode * test(amplify-category-api): add unit tests for provider utils * test(amplify-category-api): fix test for adding api key prompt * refactor(cli): refactor api key prompt * refactor(amplify-category-api): add api key with gql compiled * feat: @model conflict resolution * auth directive support for index, searchable, predictions, functions, and relational directives (#8146) * feat: add support for index and updated unit and e2e tests * feat: directive suport for functions, predictions, searchable, and relational * test: updated unit tests for updated auth on directives * @auth support for datastore and add has auth flag (#8168) * feat: @auth v2 on datastore and updated unit tests * feat: add hasAuthFlag * feat(graphql-model-transformer): set up transformer for sandbox mode directive (#8138) * feat(graphql-model-transformer): add sandbox mode support to model transformer * refactor(graphql-transformer-core): do not persist sandbox mode meta data * fix: add command to show access control and field auth evaluation in access control (#8174) * fix: admin ui app state check and auth transformer index resolver name (#8175) * fix: has auth typo and qref on field conditions for private rule (#8180) * fix(graphql-model-transformer): use hasAuth flag when sandbox mode is disabled (#8179) * fix: update hasMany to use join table name, sync config warning, updated unit test * fix: add empty payload for sandbox mode * fix: snapshot test for @searchable * fix: udpated snapshot for index and relation directives * fix: use same none datasource name as resolver manager * fix: iam resolver check and relational payload (#8234) * fix: add datastore query in config for auth (#8246) * fix: auth filter expression (#8248) * fix: update iam auth to include roles in before template (#8259) * chore: rebase and update auth dependencies * fix(graphql-model-transformer): iam role name does not exceed 64 characters * fix: add base e2e tests with auth fixes Co-authored-by: Danielle Adams <[email protected]> Co-authored-by: lazpavel <[email protected]> * fix: update dependency versions * feat(amplify-provider-awscloudformation): match env directive field for sandbox mode (#3) * fix(amplify-provider-awscloudformation): invoke api function from invoker plugin (#8274) * fix(amplify-provider-awscloudformation): invoke api function from invoker plugin * fix(graphql-index-transformer): update snapshots for tests * test(amplify-provider-awscloudformation): fix tests for sandbox helpers * fix(amplify-provider-awscloudformation): remove sandbox mode directive from schema before transform (#8272) * chore(graphql-auth-transformer): update deps for auth transformer and api category * fix(graphql-model-transformer): revert code to master version * test(graphql-model-transformer): update the snapshot for the amplify/graphql-model-transformer test * chore: remove showacm as that was for testing purposes only * test(amplify-e2e-tests): update to use correct helpers * test(graphql-transformers-e2e-tests): enable sandbox mode on v2 transforms * test(amplify-e2e-tests): replace updateAPIResolution imports with new methods * fix: get item query for @model and relational directives * auto apply auth fix * auto apply auth modes v2 fix (#4) * test(amplify-e2e-tests): rm sandbox e2e test * fix(amplify-provider-awscloudformation): fix api key creation when sandbox mode enable * test(amplify-e2e-tests): create random app name generator for broken tests * fix api e2e workflow * test(amplify-e2e-core): add random app name generator, update snapshots and imports * chore(graphql-auth-transformer): upgrade deps in auth transformer * update e2e test to use new api workflow (#5) * feat(graphql-model-transformer): fix default value e2e test (#6) * test(amplify-e2e-tests): add missing helper * e2e fix for auth tests using new api workflow (#7) * update e2e test to use new api workflow * fix(test): update auth tests with new api workflow * test(amplify-e2e-tests): add missing helper and fix broken test Co-authored-by: Christopher Sundersingh <[email protected]> Co-authored-by: Christopher Sundersingh <[email protected]> Co-authored-by: Josue Ruiz <[email protected]> Co-authored-by: lazpavel <[email protected]> Co-authored-by: Colin Ihrig <[email protected]> * fix: loosen @Index validation (#8445) Previously, the validation was too strict, and did not match the v1 behavior. This commit updates the validationt to match v1. Co-authored-by: Colin Ihrig <[email protected]> * feat(graphql-model-transformer): added transformer version feature flag (#8328) * feat(amplify-provider-awscloudformation): merge user config with transform generated resolvers (#8447) * fix(graphql-model-transformer): fixed schema template options check for transformer version (#8449) * fix(amplify-appsync-simulator): fixed app sync simulator util auth type mock (#8451) * fix: @auth fix relational auth, authv2 e2e with utils and fixes (#8450) * feat(amplify-provider-awscloudformation): enable custom resolvers for v2 transformer (#8454) * chore: update update-notifier dependency (#8457) * chore: update update-notifier dependency * Update config.yml * fix: auth on getting related model name and searchablevNext e2e (#8455) * test(amplify-e2e-tests): ignore resolvers tests for windows (#8458) * fix(graphql): correct api key type on auto apply auth mode (#8459) * test(graphql-model-transformer): added e2e test for query and mutation rename (#8461) * fix: add @manytomany join table auth (#8460) * fix: add @manytomany join table auth This commit adds auth to the many to many join table. * fix: break dependency cycle This commit moves several tests from the @auth v2 package to the relational v2 package to break a dependency cycle. * fix: address lgtm bot comment Co-authored-by: Colin Ihrig <[email protected]> * fix: @function vNext payload, remove unused code, and update common mapping tempalte function (#8462) * test: fix auth configuration for test file (#8463) Co-authored-by: Colin Ihrig <[email protected]> * test: fix sign in for gql clients (#8464) * test: split up flaky test suite (#8468) Co-authored-by: Colin Ihrig <[email protected]> * test: update split script for new suites (#8469) migration-api-key-migration2 was recently split into multiple suites. The original suite was special cased in the split-e2e-tests.ts script. This commit updates the new suites to have the same special casing. Co-authored-by: Colin Ihrig <[email protected]> * feat(amplify-category-storage): headless support for S3 (#8423) Co-authored-by: Attila Hajdrik <[email protected]> Co-authored-by: Edward Foyle <[email protected]> * test: fix e2e failures for import_s3 (#8483) * test: fix some Windows e2e tests (#8372) * fix: use proper singleselect for windows e2e tests * ci: prevent jest from hanging aftetr completion * ci: do not use node for pkg binary * ci: try running all windows to see which pass * ci: use multi-account retries on windows * ci: use correct env var * ci: pare down list of failing windows tests * chore: skip additional tests * chore: skip necessary windows tests * chore: fix test lint * fix(amplify-category-storage): add auth by default (#8498) * test: fix post-test account cleanup (#8489) * test: fix post-test account cleanup * test: clarify error message * build(deps): bump vm2 from 3.9.3 to 3.9.5 (#8493) Bumps [vm2](https://github.com/patriksimek/vm2) from 3.9.3 to 3.9.5. - [Release notes](https://github.com/patriksimek/vm2/releases) - [Changelog](https://github.com/patriksimek/vm2/blob/master/CHANGELOG.md) - [Commits](patriksimek/vm2@3.9.3...3.9.5) --- updated-dependencies: - dependency-name: vm2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: function comments to use os.EOL constant, ref #8177 (#8327) * test: add test for get-project-details.ts (#8390) * test: add test for fet-project-details.ts * chore: fixed the description * fix: update appsync simulators ip address validation (#8375) * fix: update appsync simulators ip address validation fix #8359 * address review comment * test: port @http e2e tests to v2 (#8478) * test: port @http e2e tests to v2 * fixup! test: port @http e2e tests to v2 Co-authored-by: Colin Ihrig <[email protected]> * fix(import-auth): headless interface test (#8402) Co-authored-by: Abhishek Raj <[email protected]> * fix(graphql): searchable default sort direction (#8481) * fix(graphql): searchable default sort direction * update snapshots * fix(graphql): change aggregate field type to enum (#8484) * fix(graphql): change aggregate field type to enum * update E2E test * chore(feature-req form): remove auto label and adjust wording to reflect form type (#8434) * fix mismatch ajv version between amplify-cli-core and amplify-provider-awscloudformation (#8415) * fix: improve trigger update error handling, ref #8280 (#8329) * fix(amplify-nodejs-function-runtime-provider): catch yarn 2 error on lambda build (#8263) * fix: #8254 invalid url is shown for branches with dash (#8260) * feat: add byValue and byValues helper functions to select pick options by value (#8253) * test(cli): add test for compare-plugins plugin-helpers (#8064) * fix: pinpoint feature flag read (#8496) * feat: flag to allow destructive schema changes (#8273) * chore: dumping table changes * chore: drop table POC * feat: plumb destructive-updates flag * feat: plumb rebuild * chore: fix rebuild prompts * test: adding unit and e2e tests * feat: sweet jesus it works * fix: iterative push lambda with updates * chore: organize code better * test: add unit and e2e tests * chore: fit and finish * chore: didn't save all the files * test: fix some tests and add a couple more * chore: address PR comments * test: fix e2e failures * chore: fix prompts dep version * test: exclude new api tests from windows * test: update test schema * chore: address PR comments * fix: messed up merge * test: fix e2e failures * test(graphql-predictions-transformer): added e2e tests for v2 predictions transformer (#8477) * test(graphql-predictions-transformer): added e2e tests for v2 predictions transformer * test(graphql-predictions-transformer): added e2e tests for v2 predictions transformer * feat: version blocking for CLI (#8512) * feat: version blocking for CLI * chore: run split-tests * ci: autogen cci config (#8510) * test: remove quotes from enum in @searchable v2 test (#8523) Refs: #8484 Co-authored-by: Colin Ihrig <[email protected]> * Revert "feat: version blocking for CLI (#8512)" (#8522) This reverts commit 52edf2b. Co-authored-by: Colin Ihrig <[email protected]> * fix: add schema directives for sync operation when conflict resolution is enabled (#8521) * ci: reenable nightly jobs (#8529) * Revert "ci: reenable nightly jobs" (#8530) This reverts commit 0bbcd9e. * fix(cli): amplify plugin scan command print correct version of inactive hosting plugins (#8130) * fix(cli): amplify plugin scan command print correct version of inactive hosting plugins Fix missing plugin version case of exists multiple plugins in same category fix #8127 * refactor(cli): using `const` instead of `let` * fix(amplify-dynamodb-simulator):callback revoked within time-limit (#7843) * fix(amplify-dynamodb-simulator):callback revoked within time-limit * fix(amplify-dynamodb-simulator):merged all beforeEach()/afterEach() into one * try...catch added to clean up * fix(graphql): add defensive check on getTablesRequiringReplacement (#8528) * fix(graphql): add defensive check on getTablesRequiringReplacement * correct return statement * feat: generate list types as non-null (#8166) * feat: generate list types as non-null * test: update more snapshots * fix: make corresponding change in v2 transformer * fix: non null lists in v2 transformer * chore: force cci rerun * test: update one more snapshot * test: who knew there were so many snapshots to update * fix: add field auth on aggregation queries (#8508) * fix: add a validation check for aws environment variables (#7933) * fix: Move credential validation to the top function call getProfileCredentials isn't always pulling from a file with an access key/secret key, so validation can error out in the case of source profiles. Moving this to the top function getProfiledAwsConfig and performing the validation on the AWS config instead means we can accommodate source profiles. * Fix: add a validation check for aws environment variables Co-authored-by: Vandenberg <[email protected]> * fix: broken docs link in error message (#8436) * ci: prevent setup from timing out during yarn installation (#8542) * ci: prevent setup from timing out during yarn installation * ci: use new package.json inside scripts dir * ci: extract repoRoot to variable * ci: re-enable nightly workflows (#8543) * Revert "Revert "ci: reenable nightly jobs" (#8530)" This reverts commit 5fead3e. * ci: re-enable nightly workflows * ci: use pipeline params to trigger workflows * ci: allow schedule to be determined by nightly-jobs branch * feat: FF for override stacks (#8228) * feat: root stack override (#8276) * feat: added root stack transformation * feat: adding root-stack-builder * feat: added e2e and migration tests * fix: minor fixes * fix: fixes unit tests * fix: address comments * feat: adding rootstack types to overrides helper package (#8298) * feat: ddb overrides and flow refactor * feat: ddb overrides * feat: add migration logic * fix: remove older files post migration * fix: address PR comments * fix: remove inquirer and use amplify prompts instead Co-authored-by: Ghosh <[email protected]> * chore: ddb walkthrough refactor and override tests (#8364) * chore: overrides ddb and walthrough refactor tests * chore: address pr comments Co-authored-by: Ghosh <[email protected]> * feat: Auth refactor to use cdk, eliminate EJS, overrides functionality (#8355) * feat: add auth override * fix: auth state unit tests working * feat: auth e2e fixes and migration e2e included * fix: fixes package name * fix: unit tests fix * fix: unit tests * fix: fixing overwritten files * fix: added vm2 and addressed comments * fix: minor fixes and e2e test for overrides * fix: cli-core unit test * fix: userPool group unit test * fix: minor refractor and comments * chore: lgtm warnings * fix: minor fixes * fix: unit tests * (feat) Override for S3 - ( includues refactor s3-walkthrough and migrate) (#8383) Co-authored-by: Sachin Panemangalore <[email protected]> * fix: fixes dependsOn parameter and auth migration test (#8480) * fix: dependsOn fix * chore: address comments * chore: remove JSON parsing * fix: default migration set to true * fix: added public access to scoped packages (#8485) * fix: adds typescript json dependency (#8487) * fix: enable scoped packages in plugin platform (#8492) * fix: adds userPool resourceName instead of authResource (#8497) * fix: adds userPool resourceName instead of authResource * fix: roleName in userPool groups * (bug-fix/reconcile-headless) remove groupList from userInputs, fix single-group, deploy errors (#8501) Co-authored-by: Sachin Panemangalore <[email protected]> * fix: userPool group template fixes (#8515) * fix: template and naming fixed * fix: addressed comments * (fix) Call Auth migration from S3 migration for all auth resources in S3 (#8511) * (fix) Call Auth migration from S3 migration for all auth resources used by S3 * (fix) use invokePluginMethod instead of direct category calls * (fix) unit-test for s3 migration Co-authored-by: Sachin Panemangalore <[email protected]> * (fix) s3 add with no-auth resource should succeed (#8520) Co-authored-by: Sachin Panemangalore <[email protected]> * (fix) amplify override storage fails with missing tsconfig.json (#8556) Co-authored-by: Sachin Panemangalore <[email protected]> * fix: rebase extOverrides with master * fix: getSupportedServices function * fix: rebase leftovers Co-authored-by: aws-amplify-bot <[email protected]> Co-authored-by: John Corser <[email protected]> Co-authored-by: Yathi <[email protected]> Co-authored-by: Edward Foyle <[email protected]> Co-authored-by: josef <[email protected]> Co-authored-by: Ammar <[email protected]> Co-authored-by: Lu Han <[email protected]> Co-authored-by: Pavel Lazar <[email protected]> Co-authored-by: Danielle Adams <[email protected]> Co-authored-by: Phani Srikar Edupuganti <[email protected]> Co-authored-by: Christopher Sundersingh <[email protected]> Co-authored-by: Christopher Sundersingh <[email protected]> Co-authored-by: Josue Ruiz <[email protected]> Co-authored-by: Colin Ihrig <[email protected]> Co-authored-by: Colin Ihrig <[email protected]> Co-authored-by: Attila Hajdrik <[email protected]> Co-authored-by: John Hockett <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yoshiaki Togami <[email protected]> Co-authored-by: Abhishek Raj <[email protected]> Co-authored-by: Abhishek Raj <[email protected]> Co-authored-by: siegerts <[email protected]> Co-authored-by: osddeitf <[email protected]> Co-authored-by: MURAKAMI Masahiko <[email protected]> Co-authored-by: Stuti Prasad <[email protected]> Co-authored-by: Marc VandenBerg <[email protected]> Co-authored-by: Vandenberg <[email protected]> Co-authored-by: Kaustav Ghosh <[email protected]> Co-authored-by: Ghosh <[email protected]> Co-authored-by: Sachin Panemangalore <[email protected]> Co-authored-by: Sachin Panemangalore <[email protected]>

ammarkarachi requested a review from a team as a code owner August 31, 2021 17:04

ammarkarachi commented Aug 31, 2021

View reviewed changes

ammarkarachi commented Sep 1, 2021

View reviewed changes

packages/amplify-provider-awscloudformation/src/push-resources.ts Show resolved Hide resolved

ammarkarachi commented Sep 1, 2021

View reviewed changes

packages/amplify-provider-awscloudformation/src/pre-push-cfn-processor/cfn-pre-processor.ts Outdated Show resolved Hide resolved

luhanamz force-pushed the customPolicies branch from 9875298 to a079e01 Compare September 3, 2021 06:15

luhanamz added 19 commits September 3, 2021 17:48

Custom policy implementation

fc5fef8

feat: add custom policies file to function and API container

85f7eea

add custom policies file to function and API container, merge the custom policies to CFN template, validation for regex of resources and actions in the custom policies file

feat: changes for first PR

5ae975a

feat: Some changes according to the PR comments

c6ceb2f

1. Add Json Schema to validate the customers input 2. some minor changes related to format issue 3. error handle

feat: replace env to current env in the resource when checkout and ad…

8ddd755

…d env, and push

feat: e2e test and replacing env

8966a7d

feat: Minor changes for env replacement

83e4155

feat: remove changing env between env

048b1e5

feat: Add cloudform type for type safety, move validation to provider…

a2cd9fa

…-cloudformation, validation

feat: remove some unused function and import, change regex for resource

b7038fe

feat: Some changes according to the PR comment

1f7efc7

feat: changes according to PR comments

c3f4d05

feat: remove unused import

41f242d

feat: remove previous unused code

1bb1a42

feat: Changes according to PR comments

28dab7d

feat: some changes according to PR comments

bb85696

feat: work on PR comments

cac4100

feat: rebase for conflict

d1da5e8

feat: rebase for failure of hooksmanager test failed

5f9bb10

luhanamz force-pushed the customPolicies branch from a079e01 to 5f9bb10 Compare September 4, 2021 00:55

feat: fix failed test

d9ed2e4

ammarkarachi commented Sep 8, 2021

View reviewed changes

packages/amplify-e2e-core/src/categories/api.ts Outdated Show resolved Hide resolved

ammarkarachi commented Sep 8, 2021

View reviewed changes

edwardfoyle reviewed Sep 8, 2021

View reviewed changes

akshbhu reviewed Sep 8, 2021

View reviewed changes

packages/amplify-cli-core/src/customPoliciesUtils.ts Outdated Show resolved Hide resolved

edwardfoyle reviewed Sep 8, 2021

View reviewed changes

akshbhu reviewed Sep 8, 2021

View reviewed changes

feat: PR comments

b7dda25

ammarkarachi changed the title ~~Custom policies~~ feat: Custom policies IAM Policies for Lambda and Containers Sep 9, 2021

feat: pr comments

c0c01d5

feat: fix failed test

64096b9

edwardfoyle reviewed Sep 9, 2021

View reviewed changes

feat: PR comments from ED

22c178e

edwardfoyle approved these changes Sep 10, 2021

View reviewed changes

ammarkarachi merged commit 3e1ce0d into aws-amplify:master Oct 4, 2021

github-actions bot added the referenced-in-release Issues referenced in a published release changelog label Oct 6, 2021

osddeitf mentioned this pull request Oct 8, 2021

Bug: Lambda custom policies not working #8392

Closed

4 tasks

	export function addCustomPoliciesFile(categoryName: string, resourceName: string) {
	export function createDefaultCustomPoliciesFile(categoryName: string, resourceName: string) {

	if (!(service === 'Lambda' \|\| service === 'ElasticContainer')) {
	if (!customPolicySupportedServices.includes(service)) {

		const resourceRegex = new RegExp('arn:(aws[a-zA-Z0-9-]):([a-zA-Z0-9\\-])+:([a-z]{2}(-gov)?-[a-z]+-\\d{1})?:(\\d{12})?:(.)');
		const actionRegex = new RegExp('[a-zA-Z0-9]+:[a-z\|A-Z\|0-9\|*]+');

feat: Custom policies IAM Policies for Lambda and Containers #8068

feat: Custom policies IAM Policies for Lambda and Containers #8068

Conversation

ammarkarachi commented Aug 31, 2021

Description of changes

Issue #, if available

Description of how you validated changes

Checklist

ammarkarachi commented Aug 31, 2021

lgtm-com bot commented Aug 31, 2021

codecov-commenter commented Sep 1, 2021 • edited Loading

Codecov Report

lgtm-com bot commented Sep 1, 2021

lgtm-com bot commented Sep 3, 2021

lgtm-com bot commented Sep 8, 2021

lgtm-com bot commented Sep 8, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

akshbhu left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lgtm-com bot commented Sep 9, 2021

lgtm-com bot commented Sep 9, 2021

lgtm-com bot commented Sep 9, 2021

Choose a reason for hiding this comment

lgtm-com bot commented Sep 9, 2021

edwardfoyle left a comment

Choose a reason for hiding this comment

ammarkarachi commented Oct 4, 2021

github-actions bot commented Oct 6, 2021

codecov-commenter commented Sep 1, 2021 •

edited

Loading