Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: Allow adding permissions boundaries via app upgrade #5949

Open
wants to merge 1 commit into
base: mainline
Choose a base branch
from
Open

feat: Allow adding permissions boundaries via app upgrade #5949

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 24 additions & 7 deletions internal/pkg/cli/app_upgrade.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,9 @@ const (

// appUpgradeVars holds flag values.
type appUpgradeVars struct {
name string
name string
forceUpdate bool
permissionsBoundary string
}

// appUpgradeOpts represents the app upgrade command and holds the necessary data
Expand Down Expand Up @@ -152,6 +154,13 @@ func (o *appUpgradeOpts) shouldUpgradeApp(appVersion string) bool {
return true
}

if o.forceUpdate {
msg := fmt.Sprintf("Application %s is already on the latest version %s, forcing upgrade.", o.name, o.templateVersion)
log.Debugln(msg)

return true
}

msg := fmt.Sprintf("Application %s is already on the latest version %s, skip upgrade.", o.name, o.templateVersion)
if diff > 0 {
// It's possible that a teammate used a different version of the CLI to upgrade the application
Expand All @@ -175,11 +184,12 @@ func (o *appUpgradeOpts) upgradeApplication(app *config.Application, fromVersion
}
// Upgrade app CloudFormation resources.
if err := o.upgrader.UpgradeApplication(&deploy.CreateAppInput{
Name: o.name,
AccountID: caller.Account,
DomainName: app.Domain,
DomainHostedZoneID: app.DomainHostedZoneID,
Version: toVersion,
Name: o.name,
AccountID: caller.Account,
DomainName: app.Domain,
DomainHostedZoneID: app.DomainHostedZoneID,
PermissionsBoundary: app.PermissionsBoundary,
Version: toVersion,
}); err != nil {
return fmt.Errorf("upgrade application %s from version %s to version %s: %v", app.Name, fromVersion, toVersion, err)
}
Expand All @@ -194,6 +204,9 @@ func (o *appUpgradeOpts) upgradeAppSSMStore(app *config.Application) error {
}
app.DomainHostedZoneID = hostedZoneID
}
if app.PermissionsBoundary == "" && o.permissionsBoundary != "" {
app.PermissionsBoundary = o.permissionsBoundary
}
if err := o.store.UpdateApplication(app); err != nil {
return fmt.Errorf("update application %s: %w", app.Name, err)
}
Expand All @@ -208,7 +221,9 @@ func buildAppUpgradeCmd() *cobra.Command {
Short: "Upgrades the template of an application to the latest version.",
Example: `
Upgrade the application "my-app" to the latest version
/code $ copilot app upgrade -n my-app`,
/code $ copilot app upgrade -n my-app
Upgrade the application and add an existing IAM policy as the permissions boundary for roles.
/code $ copilot app upgrade --permissions-boundary myPermissionsBoundaryPolicy`,
RunE: runCmdE(func(cmd *cobra.Command, args []string) error {
opts, err := newAppUpgradeOpts(vars)
if err != nil {
Expand All @@ -218,5 +233,7 @@ func buildAppUpgradeCmd() *cobra.Command {
}),
}
cmd.Flags().StringVarP(&vars.name, nameFlag, nameFlagShort, tryReadingAppName(), appFlagDescription)
cmd.Flags().StringVar(&vars.permissionsBoundary, permissionsBoundaryFlag, "", permissionsBoundaryFlagDescription)
cmd.Flags().BoolVar(&vars.forceUpdate, forceFlag, false, forceAppUpgradeFlagDescription)
return cmd
}
1 change: 1 addition & 0 deletions internal/pkg/cli/flag.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -443,6 +443,7 @@ permissions boundary for all roles generated within the application.`
prodEnvFlagDescription = "If the environment contains production services."
deployEnvFlagDescription = "Deploy the target environment before deploying the workload."
yesInitEnvFlagDescription = "Confirm initializing the target environment if it does not exist."
forceAppUpgradeFlagDescription = "Optional. Force an application upgrade to the latest version."
)

type portOverride struct {
Expand Down