Skip to content

v20.1.0 — version visibility + batched IAM preflight + stack-state preflight

Choose a tag to compare

View all tags
@hyunsies hyunsies released this 21 Apr 13:57
· 101 commits to main since this release
v20.1.0
648414b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First release under the new SemVer policy (see VERSIONING.md). MINOR bump from the v20 baseline — new capabilities, safe in-place update for existing deployments.

What's new

Version visibility

  • New CFN AWS::SSM::Parameter at /auto-map-tagger/${MpeId}/version
  • New CFN stack Output TemplateVersion
  • Lambda cold-start log: auto-map-tagger v20.1.0 cold start

Zero outbound calls — version is pinned at deploy time, readable via aws ssm get-parameter, describe-stacks --query "Stacks[0].Outputs", or CloudWatch Logs.

Batched deploy-time IAM preflight

Extends deploy.sh to simulate the 21 IAM actions the deploy itself needs (CFN + IAM + Lambda + Events + SQS + SSM + Logs + SNS + S3) in a single iam:simulate-principal-policy call (~200ms). Multi-account mode adds 5 StackSets + Organizations actions for 26 total.

Fails on both explicitDeny (SCP blocks) and implicitDeny (principal missing grant). Replaces the 15-min-into-deploy AccessDenied-tarpit with a ~200ms fast fail + per-action remediation.

Correctly handles both IAM users and assumed-role (SSO) callers — the latter required converting the session ARN to the role ARN before passing to simulate-principal-policy.

Stack-state preflight

deploy.sh previously fell through to update-stack for any existing stack state that wasn't NOT_FOUND, DELETE_COMPLETE, or ROLLBACK_COMPLETE. Customers hit stuck states (*_IN_PROGRESS, UPDATE_ROLLBACK_FAILED, ROLLBACK_FAILED, DELETE_FAILED) and got cryptic CFN errors.

New preflight catches the four failure classes with specific remediation commands — including the exact continue-update-rollback invocation for stuck update rollbacks.

For existing customers

Safe in-place update. Re-run deploy.sh from the configurator to get v20.1.0. No breaking changes.

Manual validation

Six end-to-end tests run against the single-account test environment:

  • Rendering: ✅ single (21 actions) + multi (26 actions)
  • Admin happy path: ✅
  • Under-privileged assumed role: ✅ all 20 missing permissions caught (caught a bug during testing where the assumed-role ARN needed translation to role ARN for simulate-principal-policy)
  • Stack state ROLLBACK_COMPLETE: ✅ passes through (deploy.sh auto-recovers)
  • Stack state CREATE_IN_PROGRESS: ✅ fails with remediation
  • Stack state ROLLBACK_FAILED: ✅ fails with remediation
  • Empty caller ARN fail-safe: ✅ warns and continues

Full diff

See PR #23: #23

Assets 2
Loading