deployment_preference_collection.py

import copy
from typing import Any, Dict, List, Optional, Union, cast

from samtranslator.model.codedeploy import CodeDeployApplication, CodeDeployDeploymentGroup
from samtranslator.model.exceptions import InvalidResourceException
from samtranslator.model.iam import IAMRole
from samtranslator.model.intrinsics import (
    fnGetAtt,
    fnSub,
    is_intrinsic,
    is_intrinsic_if,
    is_intrinsic_no_value,
    make_combined_condition,
    ref,
    validate_intrinsic_if_items,
)
from samtranslator.model.update_policy import UpdatePolicy
from samtranslator.translator.arn_generator import ArnGenerator

from .deployment_preference import DeploymentPreference

CODE_DEPLOY_SERVICE_ROLE_LOGICAL_ID = "CodeDeployServiceRole"
CODEDEPLOY_APPLICATION_LOGICAL_ID = "ServerlessDeploymentApplication"
CODEDEPLOY_PREDEFINED_CONFIGURATIONS_LIST = [
    "Canary10Percent5Minutes",
    "Canary10Percent10Minutes",
    "Canary10Percent15Minutes",
    "Canary10Percent30Minutes",
    "Linear10PercentEvery1Minute",
    "Linear10PercentEvery2Minutes",
    "Linear10PercentEvery3Minutes",
    "Linear10PercentEvery10Minutes",
    "AllAtOnce",
]
CODE_DEPLOY_CONDITION_NAME = "ServerlessCodeDeployCondition"


class DeploymentPreferenceCollection:
    """
    This class contains the collection of all global and
    specific / per function deployment preferences. It includes ways to add
    the deployment preference information from the SAM template and how to
    generate the update policy (and dependencies of the update policy) for
    each function alias. Dependencies include the codedeploy cloudformation
    resources.
    """

    def __init__(self) -> None:
        """
        This collection stores an internal dict of the deployment preferences for each function's
        deployment preference in the SAM Template.
        """
        self._resource_preferences: Dict[str, Any] = {}

    def add(self, logical_id: str, deployment_preference_dict: Dict[str, Any], condition: Optional[str] = None) -> None:
        """
        Add this deployment preference to the collection

        :raise ValueError if an existing logical id already exists in the _resource_preferences
        :param logical_id: logical id of the resource where this deployment preference applies
        :param deployment_preference_dict: the input SAM template deployment preference mapping
        :param condition: the condition (if it exists) on the serverless function
        """
        if logical_id in self._resource_preferences:
            raise ValueError(f"logical_id {logical_id} previously added to this deployment_preference_collection")

        self._resource_preferences[logical_id] = DeploymentPreference.from_dict(  # type: ignore[no-untyped-call]
            logical_id, deployment_preference_dict, condition
        )

    def get(self, logical_id: str) -> DeploymentPreference:
        """
        :rtype: DeploymentPreference object previously added for this given logical_id
        """
        # Note: it never returns None
        # TODO: find a way to deal with this implicit assumption
        return cast(DeploymentPreference, self._resource_preferences.get(logical_id))

    def any_enabled(self) -> bool:
        """
        :return: boolean whether any deployment preferences in the collection are enabled
        """
        return any(preference.enabled for preference in self._resource_preferences.values())

    def can_skip_service_role(self) -> bool:
        """
        If every one of the deployment preferences have a custom IAM role provided, we can skip creating the
        service role altogether.
        :return: True, if we can skip creating service role. False otherwise
        """
        return all(preference.role or not preference.enabled for preference in self._resource_preferences.values())

    def needs_resource_condition(self) -> Union[Dict[str, Any], bool]:
        """
        If all preferences have a condition, all code deploy resources need to be conditionally created
        :return: True, if a condition needs to be created
        """
        # If there are any enabled deployment preferences without conditions, return false
        return self._resource_preferences and not any(
            not preference.condition and preference.enabled for preference in self._resource_preferences.values()
        )

    def get_all_deployment_conditions(self) -> List[str]:
        """
        Returns a list of all conditions associated with the deployment preference resources
        :return: List of condition names
        """
        conditions_set = {preference.condition for preference in self._resource_preferences.values()}
        if None in conditions_set:
            # None can exist if there are disabled deployment preference(s)
            conditions_set.remove(None)
        return list(conditions_set)

    def create_aggregate_deployment_condition(self) -> Union[None, Dict[str, Dict[str, List[Dict[str, Any]]]]]:
        """
        Creates an aggregate deployment condition if necessary
        :return: None if <2 conditions are found, otherwise a dictionary of new conditions to add to template
        """
        return make_combined_condition(self.get_all_deployment_conditions(), CODE_DEPLOY_CONDITION_NAME)

    def enabled_logical_ids(self) -> List[str]:
        """
        :return: only the logical id's for the deployment preferences in this collection which are enabled
        """
        return [logical_id for logical_id, preference in self._resource_preferences.items() if preference.enabled]

    def get_codedeploy_application(self) -> CodeDeployApplication:
        codedeploy_application_resource = CodeDeployApplication(CODEDEPLOY_APPLICATION_LOGICAL_ID)
        codedeploy_application_resource.ComputePlatform = "Lambda"
        if self.needs_resource_condition():
            conditions = self.get_all_deployment_conditions()
            condition_name = CODE_DEPLOY_CONDITION_NAME
            if len(conditions) <= 1:
                condition_name = conditions.pop()
            codedeploy_application_resource.set_resource_attribute("Condition", condition_name)
        return codedeploy_application_resource

    def get_codedeploy_iam_role(self) -> IAMRole:
        iam_role = IAMRole(CODE_DEPLOY_SERVICE_ROLE_LOGICAL_ID)
        iam_role.AssumeRolePolicyDocument = {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Action": ["sts:AssumeRole"],
                    "Effect": "Allow",
                    "Principal": {"Service": ["codedeploy.amazonaws.com"]},
                }
            ],
        }

        # CodeDeploy has a new managed policy. We cannot update any existing partitions, without customer reach out
        # that support AWSCodeDeployRoleForLambda since this could regress stacks that are currently deployed.
        if ArnGenerator.get_partition_name() in ["aws-iso", "aws-iso-b"]:
            iam_role.ManagedPolicyArns = [
                ArnGenerator.generate_aws_managed_policy_arn("service-role/AWSCodeDeployRoleForLambdaLimited")
            ]
        else:
            iam_role.ManagedPolicyArns = [
                ArnGenerator.generate_aws_managed_policy_arn("service-role/AWSCodeDeployRoleForLambda")
            ]

        if self.needs_resource_condition():
            conditions = self.get_all_deployment_conditions()
            condition_name = CODE_DEPLOY_CONDITION_NAME
            if len(conditions) <= 1:
                condition_name = conditions.pop()
            iam_role.set_resource_attribute("Condition", condition_name)
        return iam_role

    def deployment_group(self, function_logical_id: str) -> CodeDeployDeploymentGroup:
        """
        :param function_logical_id: logical_id of the function this deployment group belongs to
        :return: CodeDeployDeploymentGroup resource
        """

        deployment_preference = self.get(function_logical_id)

        deployment_group = CodeDeployDeploymentGroup(self.deployment_group_logical_id(function_logical_id))  # type: ignore[no-untyped-call, no-untyped-call]

        try:
            deployment_group.AlarmConfiguration = self._convert_alarms(deployment_preference.alarms)  # type: ignore[no-untyped-call]
        except ValueError as e:
            raise InvalidResourceException(function_logical_id, str(e)) from e

        deployment_group.ApplicationName = ref(CODEDEPLOY_APPLICATION_LOGICAL_ID)
        deployment_group.AutoRollbackConfiguration = {
            "Enabled": True,
            "Events": ["DEPLOYMENT_FAILURE", "DEPLOYMENT_STOP_ON_ALARM", "DEPLOYMENT_STOP_ON_REQUEST"],
        }

        deployment_group.DeploymentConfigName = self._replace_deployment_types(  # type: ignore[no-untyped-call]
            copy.deepcopy(deployment_preference.deployment_type)
        )

        deployment_group.DeploymentStyle = {"DeploymentType": "BLUE_GREEN", "DeploymentOption": "WITH_TRAFFIC_CONTROL"}

        deployment_group.ServiceRoleArn = fnGetAtt(CODE_DEPLOY_SERVICE_ROLE_LOGICAL_ID, "Arn")
        if deployment_preference.role:
            deployment_group.ServiceRoleArn = deployment_preference.role

        if deployment_preference.trigger_configurations:
            deployment_group.TriggerConfigurations = deployment_preference.trigger_configurations

        if deployment_preference.condition:
            deployment_group.set_resource_attribute("Condition", deployment_preference.condition)

        return deployment_group

    def _convert_alarms(self, preference_alarms):  # type: ignore[no-untyped-def]
        """
        Converts deployment preference alarms to an AlarmsConfiguration

        Parameters
        ----------
        preference_alarms : dict
            Deployment preference alarms

        Returns
        -------
        dict
            AlarmsConfiguration if alarms is set, None otherwise

        Raises
        ------
        ValueError
            If Alarms is in the wrong format
        """
        if not preference_alarms or is_intrinsic_no_value(preference_alarms):
            return None

        if is_intrinsic_if(preference_alarms):
            processed_alarms = copy.deepcopy(preference_alarms)
            alarms_list = processed_alarms.get("Fn::If")
            validate_intrinsic_if_items(alarms_list)
            alarms_list[1] = self._build_alarm_configuration(alarms_list[1])  # type: ignore[no-untyped-call]
            alarms_list[2] = self._build_alarm_configuration(alarms_list[2])  # type: ignore[no-untyped-call]
            return processed_alarms

        return self._build_alarm_configuration(preference_alarms)  # type: ignore[no-untyped-call]

    def _build_alarm_configuration(self, alarms):  # type: ignore[no-untyped-def]
        """
        Builds an AlarmConfiguration from a list of alarms

        Parameters
        ----------
        alarms : list[str]
            Alarms

        Returns
        -------
        dict
            AlarmsConfiguration for a deployment group

        Raises
        ------
        ValueError
            If alarms is not a list
        """
        if not isinstance(alarms, list):
            raise ValueError("Alarms must be a list")

        if len(alarms) == 0 or is_intrinsic_no_value(alarms[0]):
            return {}

        return {
            "Enabled": True,
            "Alarms": [{"Name": alarm} for alarm in alarms],
        }

    def _replace_deployment_types(self, value, key=None):  # type: ignore[no-untyped-def]
        if isinstance(value, list):
            for i, v in enumerate(value):
                value[i] = self._replace_deployment_types(v)  # type: ignore[no-untyped-call]
            return value
        if is_intrinsic(value):
            for k, v in value.items():
                value[k] = self._replace_deployment_types(v, k)  # type: ignore[no-untyped-call]
            return value
        if value in CODEDEPLOY_PREDEFINED_CONFIGURATIONS_LIST:
            if key == "Fn::Sub":  # Don't nest a "Sub" in a "Sub"
                return ["CodeDeployDefault.Lambda${ConfigName}", {"ConfigName": value}]
            return fnSub("CodeDeployDefault.Lambda${ConfigName}", {"ConfigName": value})
        return value

    def update_policy(self, function_logical_id: str) -> UpdatePolicy:
        deployment_preference = self.get(function_logical_id)

        return UpdatePolicy(
            ref(CODEDEPLOY_APPLICATION_LOGICAL_ID),
            self.deployment_group(function_logical_id).get_runtime_attr("name"),
            deployment_preference.pre_traffic_hook,
            deployment_preference.post_traffic_hook,
        )

    def deployment_group_logical_id(self, function_logical_id):  # type: ignore[no-untyped-def]
        return function_logical_id + "DeploymentGroup"

    def __eq__(self, other):  # type: ignore[no-untyped-def]
        if isinstance(other, self.__class__):
            return self.__dict__ == other.__dict__
        return NotImplemented

    def __ne__(self, other):  # type: ignore[no-untyped-def]
        if isinstance(other, self.__class__):
            return not self.__eq__(other)  # type: ignore[no-untyped-call]
        return NotImplemented

    def __hash__(self) -> int:
        return hash(tuple(sorted(self.__dict__.items())))