-
Notifications
You must be signed in to change notification settings - Fork 440
fix: custom resource upload should be namespaced by env #3998
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
d1b1316
699e8a0
71f9d51
f394d84
a0a7e3b
2c34505
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,8 +5,6 @@ | |
| package s3 | ||
|
|
||
| import ( | ||
| "archive/zip" | ||
| "bytes" | ||
| "fmt" | ||
| "io" | ||
| "strings" | ||
|
|
@@ -56,28 +54,6 @@ func New(s *session.Session) *S3 { | |
| } | ||
| } | ||
|
|
||
| // ZipAndUpload zips all files and uploads the zipped file to an S3 bucket under the specified key. | ||
| // Per s3's recommendation https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html: | ||
| // The bucket owner, in addition to the object owner, is granted full control. | ||
| func (s *S3) ZipAndUpload(bucket, key string, files ...NamedBinary) (string, error) { | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. |
||
| buf := new(bytes.Buffer) | ||
| w := zip.NewWriter(buf) | ||
| for _, file := range files { | ||
| f, err := w.Create(file.Name()) | ||
| if err != nil { | ||
| return "", fmt.Errorf("create zip file %s: %w", file.Name(), err) | ||
| } | ||
| _, err = f.Write(file.Content()) | ||
| if err != nil { | ||
| return "", fmt.Errorf("write zip file %s: %w", file.Name(), err) | ||
| } | ||
| } | ||
| if err := w.Close(); err != nil { | ||
| return "", err | ||
| } | ||
| return s.upload(bucket, key, buf) | ||
| } | ||
|
|
||
| // Upload uploads a file to an S3 bucket under the specified key. | ||
| // Per s3's recommendation https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html: | ||
| // The bucket owner, in addition to the object owner, is granted full control. | ||
|
|
||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -89,7 +89,7 @@ func NewEnvDeployer(in *NewEnvDeployerInput) (*envDeployer, error) { | |||||||||||||||||||||
| env: in.Env, | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| templateFS: template.New(), | ||||||||||||||||||||||
| s3: s3.New(envRegionSession), | ||||||||||||||||||||||
| s3: s3.New(envManagerSession), | ||||||||||||||||||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I actually don't get why this issue is happening copilot-cli/internal/pkg/aws/s3/s3.go Line 217 in 4b45d66
and the bucket allows all actions from the env accounts: copilot-cli/internal/pkg/template/templates/app/cf.yml Lines 74 to 82 in 4b45d66
Then why is there an access denied error? What am I missing? I'd have guessed that as long as the objects are uploaded with BucketOwnership then it wouldn't matter if they're overriden.
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. thanks for fixing the session here! |
||||||||||||||||||||||
| prefixListGetter: ec2.New(envRegionSession), | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| appCFN: deploycfn.New(defaultSession, deploycfn.WithProgressTracker(os.Stderr)), | ||||||||||||||||||||||
|
|
@@ -120,7 +120,7 @@ func (d *envDeployer) UploadArtifacts() (map[string]string, error) { | |||||||||||||||||||||
| func (d *envDeployer) uploadCustomResources(bucket string) (map[string]string, error) { | ||||||||||||||||||||||
| crs, err := customresource.Env(d.templateFS) | ||||||||||||||||||||||
| if err != nil { | ||||||||||||||||||||||
| return nil, fmt.Errorf("read custom resources for environments: %w", err) | ||||||||||||||||||||||
| return nil, fmt.Errorf("read custom resources for environment %s: %w", d.env.Name, err) | ||||||||||||||||||||||
| } | ||||||||||||||||||||||
| urls, err := customresource.Upload(func(key string, dat io.Reader) (url string, err error) { | ||||||||||||||||||||||
| return d.s3.Upload(bucket, key, dat) | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -97,7 +97,6 @@ type imageBuilderPusher interface { | |
|
|
||
| type uploader interface { | ||
| Upload(bucket, key string, data io.Reader) (string, error) | ||
| ZipAndUpload(bucket, key string, files ...s3.NamedBinary) (string, error) | ||
| } | ||
|
|
||
| type templater interface { | ||
|
|
@@ -208,9 +207,6 @@ func newWorkloadDeployer(in *WorkloadDeployerInput) (*workloadDeployer, error) { | |
| if err != nil { | ||
| return nil, fmt.Errorf("create default: %w", err) | ||
| } | ||
| if err != nil { | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. :doge |
||
| return nil, fmt.Errorf("create env session with region %s: %w", in.Env.Region, err) | ||
| } | ||
| envSession, err := in.SessionProvider.FromRole(in.Env.ManagerRoleARN, in.Env.Region) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("create env session with region %s: %w", in.Env.Region, err) | ||
|
|
||


There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
:rip