delete assume role which might cause leak of the role arn
MODIFY
aws-ts-netlify-cms-and-oauth/cms-oauth/.github/workflows/build-and-deploy.yml
aws-ts-netlify-cms-and-oauth/cms-oauth/.github/workflows/build-and-deploy.yml
@@ -21,19 +21,6 @@ jobs:
- name: Install pulumi deps
run: yarn install --cwd infrastructure
- - name: Assume Role
- env:
- AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
- AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
- IAM_ROLE_ARN: ${{ secrets.IAM_ROLE_ARN }}
- EXTERNAL_ID: ${{ secrets.EXTERNAL_ID }}
- run: |
- unset AWS_SESSION_TOKEN
- source ./scripts/assume-role.sh; assume_iam_role "${{secrets.IAM_ROLE_ARN}}" "cmsOAuthSession" "${{secrets.EXTERNAL_ID}}"
- echo '::set-env name=AWS_ACCESS_KEY_ID::'$AWS_ACCESS_KEY_ID
- echo '::set-env name=AWS_SECRET_ACCESS_KEY::'$AWS_SECRET_ACCESS_KEY
- echo '::set-env name=AWS_SESSION_TOKEN::'$AWS_SESSION_TOKEN
-
- name: Preview infrastructure
if: ${{ github.event_name == 'pull_request' }}
env:

MODIFY
aws-ts-netlify-cms-and-oauth/cms-oauth/README.md
aws-ts-netlify-cms-and-oauth/cms-oauth/README.md
# About the Project
This OAuth Server Project is connected with CMS project which deploy on AWS S3 rather than on Netlify. In this way, it requires us to create a OAuth Client Server for Netlify CMS. Netlify use the Netlify Identity Service which provides OAuth provider server. Based on [Netlify's instruction](https://www.netlifycms.org/docs/external-oauth-clients/) of customize this step we need to provide our own OAuth client.
+In this example, we are using [Netlify CMS's Github backends](https://www.netlifycms.org/docs/github-backend/) for CMS, but the OAuth Provider code enabled more types of backends Bitbucket and Gitlab. If you are using these [backends](https://www.netlifycms.org/docs/backends-overview/), simply update the callback url you are register Github OAuth Applicationc (See step 1 in the Getting Started section) to be https://{{the domain of your OAuth App}}/bitbucket/callback or https://{{the domain of your OAuth App}}/gitlab/callback
+
## References
The provider's content code is referencing to the [External OAuth Client example from Netlify CMS](https://www.netlifycms.org/docs/external-oauth-clients/).
Here are some reference:
@@ -18,11 +20,13 @@ Here are some reference:
- ./main.go the code for the provider itself and it's front end
- It is fetching the access token sent from Github API using Github's goth library.
- .github/workflow contain code for the workflow
-- scripts/assume-role.sh the script for assume role into the AWS admin account with IAM user role
-## Deployment to AWS
+## Infrastructure
The OAuth Client Server was deployed on AWS using Pulumi. The Pulumi code use AWS Certificate Manager to create certificate and validate it. It is using AWS ECS Fargate to read docker image and establish a Fargate Service. Then it is also creating Alias Record on Route53 for the OAuth Server.
+### Assume Role (Optional)
+If you are working with an organization, it is better to ask for the AWS token for IAM user role that you could use to assume the admin role of your AWS account. In this way it is more secure. You could refer to the [aws-ts-assume-role example](https://github.com/pulumi/examples/tree/master/aws-ts-assume-role) for more information. There is also assume role example of different language in [our example repostiory](https://github.com/pulumi/examples)
+
# Getting Start (Replace content in {{}} with correct informations)
These steps are now automated using the Github Workflow. If you push to the master or merge a pull request, the OAuth Client Server would be automatically deployed. Open a new branch and push to the branch would only do a pulumi preview where the logs could be check on Github Actions.
@@ -69,16 +73,6 @@ $ pulumi config get netlify-cms-oauth-provider-infrastructure:githubKey
$ pulumi config get netlify-cms-oauth-provider-infrastructure:githubSecret
```
-
-6. Don't forget to update AWS token before next step!!!!
-If you are working with an organization and assume role is needed:
- - you should ask your organization for creating new IAM user and providing credential for the user. Then after set credential as environment variable, assume the role of admin to your companies' production account use this:
-
- ```bash
- $ source ./scripts/assume-role.sh; assume_iam_role "{{IAM_ROLE_ARN}}" "cmsSession" "{{EXTERNAL_ID}}"
- ```
-IAM_ROLE_ARN and EXTERNAL_ID is the information provided by iam role we should assume. The script file in ./scripts/assume-role.sh contain assume_iam_role function
-
### Step 3. Running Infrastructure
```bash
$ pulumi up

DELETE
aws-ts-netlify-cms-and-oauth/cms-oauth/scripts/assume-role.sh
-#!/bin/bash
-#
-# Configures the local AWS credentials and adds some useful functions to
-# the environment. For use in our CI/CD workflows where we use a common
-# set of environments and just provide an access key via environment variable.
-#
-# USAGE:
-# 1. Set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment
-# for the CI/CD workflow. They should be to a low privledged user.
-# 2. Source this file. It will create files in the ~/.aws folder and
-# unset AWS_ACCESS_KEY_ID.
-#
-# After that, use the AWS SDK like normal. The default profile will use the
-# credentials in the initial environment variable. But you can easily change
-# AWS accounts by setting the AWS_PROFILE environment variable. (You will set
-# AWS_PROFILE="pulumi-ci" in most cases.)
-#
-# This script also exports two functions: assume_iam_role and unassume_iam_role
-# which can be used to assume an IAM role without using AWS_PROFILE.
-
-# Function to use the current AWS credentials to assume an IAM Role.
-# This is necessary for situations where we cannot rely on a profile from the
-# ~/.aws/config file, or where we need to specify an external ID.
-# Usage: assume_iam_role <role-arn> <session-name> [external-id]
-function assume_iam_role() {
- # IAM Role ARN to be assumed.
- local ROLE_ARN=${1}
- # Name of the session for auditing purposes.
- local SESSION_NAME=${2}
- # External ID which may be required to assume the role. (Optional)
- local EXTERNAL_ID=${3}
-
- echo "Assuming IAM Role '${ROLE_ARN}"
- echo " Session : ${SESSION_NAME}"
- echo " External ID: ${EXTERNAL_ID}"
-
- local CREDS_JSON="{}"
- if [ -z ${EXTERNAL_ID} ]; then
- CREDS_JSON=$(aws sts assume-role \
- --role-arn "${ROLE_ARN}" \
- --role-session-name "${SESSION_NAME}" )
- else
- CREDS_JSON=$(aws sts assume-role \
- --role-arn "${ROLE_ARN}" \
- --role-session-name "${SESSION_NAME}" \
- --external-id "${EXTERNAL_ID}" )
- fi
-
- export AWS_ACCESS_KEY_ID=$(echo ${CREDS_JSON} | jq ".Credentials.AccessKeyId" --raw-output)
- export AWS_SECRET_ACCESS_KEY=$(echo ${CREDS_JSON} | jq ".Credentials.SecretAccessKey" --raw-output)
- export AWS_SESSION_TOKEN=$(echo ${CREDS_JSON} | jq ".Credentials.SessionToken" --raw-output)
-}
-
-# Clear the environment variables set after calling assume_iam_role to get back to
-# the initial state. (Using the default credentials or ${AWS_PROFILE}.)
-function unassume_iam_role() {
- unset {AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_SECURITY_TOKEN}
-}
-
-# Check information.
-if [ -z ${AWS_ACCESS_KEY_ID} ]; then
- echo "ERROR: AWS_ACCESS_KEY_ID not set. Something is not right. (AWS creds not set?)"
-fi
-
-if [ ! -z ${AWS_SECURITY_TOKEN} ]; then
- echo "ERROR: AWS_SECURITY_TOKEN is set. Something is not right. (In an assumed role?)"
-fi
-
-# Write the AWS access key found in an environment variable to disk, allowing for
-# transparent IAM role assumption via the AWS SDK.
-function write_aws_config_files() {
- mkdir -p ${HOME}/.aws/
-
- cat <<EOF >> ${HOME}/.aws/credentials
-[default]
-aws_access_key_id = ${AWS_ACCESS_KEY_ID}
-aws_secret_access_key = ${AWS_SECRET_ACCESS_KEY}
-EOF
-
- cat <<EOF >> ${HOME}/.aws/config
-[default]
-region = us-west-2
-[profile pulumi-ci]
-role_arn = arn:aws:iam::894850187425:role/ContinuousDeliveryAdminRole
-source_profile = default
-EOF
-
- # Unset AWS_ACCESS_* so that we don't get confused later when we use AWS_PROFILE.
- echo "Unsetting AWS environment variables to rely on the credentials files."
- unset {AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY}
-}
-
-if [ -f "${HOME}/.aws/config" -o -f "${HOME}/.aws/credentials" ]; then
- echo "ERROR: ~/.aws/config or ~/.aws/credentials exist. Not overwriting."
-else
- echo "Writing ~/.aws/config and ~/.aws/credentials"
- write_aws_config_files
-fi
-
-echo "Current user: $(aws sts get-caller-identity | jq '.Arn')"
\ No newline at end of file

MODIFY
aws-ts-netlify-cms-and-oauth/cms/README.md
aws-ts-netlify-cms-and-oauth/cms/README.md
@@ -26,10 +26,6 @@ Special thanks to the template provided by [@talves](https://github.com/ADARTA/n
- index.html the html for the web app to check
- cms/Readme-Screenshots
- The screen shots for this README file
-- cms/scripts
- - Only useful if you are working with an organization and need to do AWS assume role
- - The script code to use IAM User role to assume into the admin role of AWS account
- - Use source ./scripts/assume-role.sh; assume_iam_role "${{secrets.IAM_ROLE_ARN}}" "cmsSession" "${{secrets.EXTERNAL_ID}}" and relace the IAM_ROLE_ARN and EXTERNAL_ID with infomation of the role you want to assume.
- cms/src
- React content for this web app
@@ -50,7 +46,10 @@ The infrastructure takes three argument: pathToWebsiteContents,targetDomain, cer
- This is optional.
- If you have already had a certificate inside the AWS's Certificate Manager for this CMS app, then put it's arn as the value for this variable
-### Substitution for Netlify Identity Service: OAuth Client Server
+### Assume Role (Optional)
+If you are working with an organization, it is better to ask for the AWS token for IAM user role that you could use to assume the admin role of your AWS account. In this way it is more secure. You could refer to the [aws-ts-assume-role example](https://github.com/pulumi/examples/tree/master/aws-ts-assume-role) for more information. There is also assume role example of different language in [our example repostiory](https://github.com/pulumi/examples)
+
+## Substitution for Netlify Identity Service: OAuth Client Server
Deploying the CMS app on AWS but not Netlify cause we could not use the Netlify Identity Service with the Netlify console. Thus, we created a new OAuth Client Server follow [instruction of Netlify CMS](https://www.netlifycms.org/docs/external-oauth-clients/). In short it fetch access token from Github API to grant people access to use the CMS. The resource of the OAuth Server is inside the ./cms-oauth folder in the root directory.
After deploying the cms-oauth web app, we should also put the domain of the oauth-server we build in the cms/public/config.yml's base_url configuration
@@ -79,8 +78,6 @@ Open a new branch and commit to the new branch would only do a pulumi preview un
site_domain is the domain name for the CMS web application
base_url is the domain name for the oauth server that we specify in cms-oauth folder
-
-
1. To check if config.yml works and do a simple local deployment
```bash
@@ -110,13 +107,6 @@ $ pulumi config set pulumi-website-cms:targetDomain https://some-cms-domain.pulu
- target domain is the domain for the App now it is as subdomain under pulumi-demos.net
-3. Only if you are working with an organization you should ask organization for creating new IAM user and provding credential for the user. Then after set credential as environment variable, assume the role of admin to the pulumi-corp account use this:
-```bash
-source ./scripts/assume-role.sh; assume_iam_role "${{IAM_ROLE_ARN}}" "cmsSession" "${{EXTERNAL_ID}}"
-```
-IAM_ROLE_ARN and EXTERNAL_ID is the information provided by iam role we should assume.
-The script file in ./scripts/assume-role.sh contain assume_iam_role function
-
4. Run pulumi up
```bash
$ pulumi up

MODIFY
aws-ts-netlify-cms-and-oauth/cms/public/config.yml
aws-ts-netlify-cms-and-oauth/cms/public/config.yml
@@ -5,8 +5,8 @@ backend:
# This site_domain and base_url are sudo domains
# Replace site_domain with targetDomain pulumi stack configuration inside cms/infrastructure folder
# Replace base_url with targetDomain pulumi stack configuration inside cms-oauth/infrastructure folder
- site_domain: https://some-cms-domain.pulumi-demos.com
- base_url: https://some-oauth-domain.pulumi-demos.com
+ site_domain: https://some-cms-domain.com
+ base_url: https://some-oauth-domain.com
publish_mode: editorial_workflow

DELETE
aws-ts-netlify-cms-and-oauth/cms/scripts/assume-role.sh
-#!/bin/bash
-#
-# This script exports two functions: assume_iam_role and unassume_iam_role
-# which can be used to assume an IAM role without using AWS_PROFILE.
-
-# Function to use the current AWS credentials to assume an IAM Role.
-# This is necessary for situations where we cannot rely on a profile from the
-# ~/.aws/config file, or where we need to specify an external ID.
-# Usage: assume_iam_role <role-arn> <session-name> [external-id]
-function assume_iam_role() {
- # IAM Role ARN to be assumed.
- local ROLE_ARN=${1}
- # Name of the session for auditing purposes.
- local SESSION_NAME=${2}
- # External ID which may be required to assume the role. (Optional)
- local EXTERNAL_ID=${3}
-
- echo "Assuming IAM Role '${ROLE_ARN}"
- echo " Session : ${SESSION_NAME}"
- echo " External ID: ${EXTERNAL_ID}"
-
- local CREDS_JSON="{}"
- if [ -z ${EXTERNAL_ID} ]; then
- CREDS_JSON=$(aws sts assume-role \
- --role-arn "${ROLE_ARN}" \
- --role-session-name "${SESSION_NAME}" )
- else
- CREDS_JSON=$(aws sts assume-role \
- --role-arn "${ROLE_ARN}" \
- --role-session-name "${SESSION_NAME}" \
- --external-id "${EXTERNAL_ID}" )
- fi
-
- export AWS_ACCESS_KEY_ID=$(echo ${CREDS_JSON} | jq ".Credentials.AccessKeyId" --raw-output)
- export AWS_SECRET_ACCESS_KEY=$(echo ${CREDS_JSON} | jq ".Credentials.SecretAccessKey" --raw-output)
- export AWS_SESSION_TOKEN=$(echo ${CREDS_JSON} | jq ".Credentials.SessionToken" --raw-output)
-}
-
-# Clear the environment variables set after calling assume_iam_role to get back to
-# the initial state. (Using the default credentials or ${AWS_PROFILE}.)
-function unassume_iam_role() {
- unset {AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_SECURITY_TOKEN}
-}
-
-# Check information.
-if [ -z ${AWS_ACCESS_KEY_ID} ]; then
- echo "ERROR: AWS_ACCESS_KEY_ID not set. Something is not right. (AWS creds not set?)"
-fi
-
-if [ ! -z ${AWS_SECURITY_TOKEN} ]; then
- echo "ERROR: AWS_SECURITY_TOKEN is set. Something is not right. (In an assumed role?)"
-fi
-

delete assume role which might cause leak of the role arn