Build has been set to done!

832399332

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/MikeSouza/serverless-deployment-bucket/commit/<a class=hub.com/MikeSouza/serverless-deployment-bucket/commit/058c29e6b04ea6c8f146cf1d61ac1dc11329e9f4">058c29e6b<a href="https://github.com/MikeSouza/serverless-deployment-bucket/commit/058c29e6b04ea6c8f146cf1d61ac1dc11329e9f4">">Merge </a><a class="double-link" href="https://github.com/MikeSouza/serverless-deployment-bucket/commit/<a class="double-link" href="https://github.com/MikeSouza/serverless-deployment-bucket/commit/8d5b9ea4fbcf840532d2b02c1d5c9f7941798284">8d5b9ea4f</a>">8d5b9ea4f</a><a href="https://github.com/MikeSouza/serverless-deployment-bucket/commit/058c29e6b04ea6c8f146cf1d61ac1dc11329e9f4"> into 9796603e4">9796603e4</a>

Pull Request Pull Request #47: Update to support custom KMS Keys

Run Details

79 of 81 branches covered (97.53%)

Branch coverage included in aggregate %.

7 of 8 new or added lines in 1 file covered. (87.5%)

132 of 133 relevant lines covered (99.25%)

64.04 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

98.4

/lib/index.js

'use strict'

const chalk = require('chalk')
const util = require('./util')

const get = (obj, path, defaultValue) => {
  return path.split('.').filter(Boolean).every(step => !(step && !(obj = obj[step]))) ? obj : defaultValue
}

const getPublicAccessBlock = block => block === true
  ? { BlockPublicAcls: true, BlockPublicPolicy: true, IgnorePublicAcls: true, RestrictPublicBuckets: true }
  : { BlockPublicAcls: false, BlockPublicPolicy: false, IgnorePublicAcls: false, RestrictPublicBuckets: false }

class DeploymentBucketPlugin {
  constructor(serverless, options) {
    this.serverless = serverless

    const TopLevelPropSchema = {
      type: 'object',
      properties: {
        name: { type: 'string' },
        serverSideEncryption: { type: 'string' },
        kmsKeyID: { type: 'string' },
      },
      required: ['name']
    }

    const CustomPropSchema = {
      type: 'object',
      properties: {
        enabled: { type: 'boolean' },
        versioning: { type: 'boolean' },
        accelerate: { type: 'boolean' },
        policy: { type: 'any' },
        tags: { type: 'any' },
        blockPublicAccess: { type: 'boolean' },
      },
    }

    serverless.configSchemaHandler.defineTopLevelProperty('deploymentBucket', TopLevelPropSchema);
    serverless.configSchemaHandler.defineCustomProperties(CustomPropSchema);

    this.provider = this.serverless.providers.aws

    const deploymentBucketProp = util.deploymentBucketProperty(this.serverless.version)
    this.deploymentBucket = get(this.serverless.service, `provider.${deploymentBucketProp}`, {})

    this.config = get(this.serverless.service, 'custom.deploymentBucket', {})

    this.hooks = {}

    if (this.config.enabled !== undefined && this.config.enabled === false) {
      return;
    }

    if (this.deploymentBucket.name) {
      this.config.versioning = get(this.config, 'versioning', false)
      this.config.accelerate = get(this.config, 'accelerate', false)
      this.config.policy = get(this.config, 'policy', undefined)
      this.config.tags = util.filterValidBucketTags(get(this.config, 'tags', undefined))
      this.config.blockPublicAccess = get(this.config, 'blockPublicAccess', undefined)

      const serverlessCommand = get(this.serverless, 'processedInput.commands', [])
      if (!serverlessCommand.includes('package')) {
        this.hooks['before:aws:common:validate:validate'] = this.applyDeploymentBucket.bind(this)
      }
    }
  }

  async bucketExists(name) {
    var params = {
      Bucket: name
    };

    try {
      await this.provider.request('S3', 'headBucket', params)
      return true
    } catch (e) {
      return false
    }
  }

  async waitFor(name, state) {
    var params = {
      Bucket: name
    };

    try {
      const service = new this.provider.sdk['S3'](this.provider.getCredentials())
      await service.waitFor(state, params).promise()

      return true
    } catch (e) {
      this.serverless.cli.log(`Unable to wait for '${state}' - ${e.message}`)

      return false
    }
  }

  async createBucket(name) {
    const params = {
      Bucket: name,
      ACL: 'private'
    };

    return await this.provider.request('S3', 'createBucket', params)
  }

  async hasBucketEncryption(name) {
    const params = {
      Bucket: name
    };

    try {
      await this.provider.request('S3', 'getBucketEncryption', params)
      return true
    } catch (e) {
      return false
    }
  }

  async putBucketEncryption(name, sseAlgorithm, kmsMasterKeyId) {
    const params = {
      Bucket: name,
      ServerSideEncryptionConfiguration: {
        Rules: [
          {
            ApplyServerSideEncryptionByDefault: {
              SSEAlgorithm: sseAlgorithm,
              KMSMasterKeyID: kmsMasterKeyId
            }
          }
        ]
      }
    }

    return await this.provider.request('S3', 'putBucketEncryption', params)
  }

  async hasBucketVersioning(name) {
    const params = {
      Bucket: name
    };

    try {
      const response = await this.provider.request('S3', 'getBucketVersioning', params)
      if (response.Status && response.Status == 'Enabled') {
        return true
      }

      return false
    } catch (e) {
      return false
    }
  }

  async putBucketVersioning(name, status) {
    const params = {
      Bucket: name,
      VersioningConfiguration: {
        Status: status ? 'Enabled' : 'Suspended'
      }
    };

    return await this.provider.request('S3', 'putBucketVersioning', params)
  }

  async hasBucketAcceleration(name) {
    const params = {
      Bucket: name
    };

    try {
      const response = await this.provider.request('S3', 'getBucketAccelerateConfiguration', params)
      if (response.Status && response.Status == 'Enabled') {
        return true
      }

      return false
    } catch (e) {
      return false
    }
  }

  async putBucketAcceleration(name, status) {
    const params = {
      Bucket: name,
      AccelerateConfiguration: {
        Status: status ? 'Enabled' : 'Suspended'
      }
    };

    return await this.provider.request('S3', 'putBucketAccelerateConfiguration', params)
  }

  async putBucketPolicy(name, policy) {
    const params = {
      Bucket: name,
      Policy: JSON.stringify(policy),
    };
    return await this.provider.request('S3', 'putBucketPolicy', params)
  }

  async hasChangedBucketTags(name, tags) {
    try {
      const response = await this.provider.request('S3', 'getBucketTagging', { Bucket: name })
      return response && JSON.stringify(response.TagSet) !== JSON.stringify(tags)
    } catch (e) {
      return false
    }
  }

  async updateBucketTags(name, tags) {
    if (Array.isArray(tags) && tags.length) {
      return await this.provider.request('S3', 'putBucketTagging', {
        Bucket: name,
        Tagging: { TagSet: tags }
      })
    } else {
      return await this.provider.request('S3', 'deleteBucketTagging', {
        Bucket: name
      })
    }
  }

  async hasChangedPublicAccessBlock(name, blockPublicAccess) {
    try {
      const config = getPublicAccessBlock(blockPublicAccess)
      const response = await this.provider.request('S3', 'getPublicAccessBlock', { Bucket: name })
      return response && JSON.stringify(response.PublicAccessBlockConfiguration) !== JSON.stringify(config)
    } catch (e) {
      return blockPublicAccess
    }
  }

  async updatePublicAccessBlock(name, blockPublicAccess) {
    if (blockPublicAccess === true) {
      return await this.provider.request('S3', 'putPublicAccessBlock', {
        Bucket: name,
        PublicAccessBlockConfiguration: getPublicAccessBlock(blockPublicAccess)
      })
    } else {
      return await this.provider.request('S3', 'deletePublicAccessBlock', {
        Bucket: name
      })
    }
  }

  async applyDeploymentBucket() {
    try {
      let isNewBucket = false

      if (await this.bucketExists(this.deploymentBucket.name)) {
        this.serverless.cli.log(`Using deployment bucket '${this.deploymentBucket.name}'`)
      } else {
        this.serverless.cli.log(`Creating deployment bucket '${this.deploymentBucket.name}'...`)

        await this.createBucket(this.deploymentBucket.name)
        await this.waitFor(this.deploymentBucket.name, 'bucketExists')
        isNewBucket = true
      }

      if (this.deploymentBucket.serverSideEncryption) {
        if (!(await this.hasBucketEncryption(this.deploymentBucket.name))) {
          if (this.deploymentBucket.serverSideEncryption === "aws:kms") {
            await this.putBucketEncryption(this.deploymentBucket.name, this.deploymentBucket.serverSideEncryption, this.deploymentBucket.kmsKeyID)
          }

          if (this.deploymentBucket.serverSideEncryption === "AES256") {
            await this.putBucketEncryption(this.deploymentBucket.name, this.deploymentBucket.serverSideEncryption)
          }

          this.serverless.cli.log(`Applied SSE (${this.deploymentBucket.serverSideEncryption}) to deployment bucket`)
        }
      }

      if ((await this.hasBucketVersioning(this.deploymentBucket.name)) != this.config.versioning) {
        await this.putBucketVersioning(this.deploymentBucket.name, this.config.versioning)

        if (this.config.versioning) {
          this.serverless.cli.log('Enabled versioning on deployment bucket')
        } else {
          this.serverless.cli.log('Suspended versioning on deployment bucket')
        }
      }

      if ((await this.hasBucketAcceleration(this.deploymentBucket.name)) != this.config.accelerate) {
        await this.putBucketAcceleration(this.deploymentBucket.name, this.config.accelerate)

        if (this.config.accelerate) {
          this.serverless.cli.log('Enabled acceleration on deployment bucket')
        } else {
          this.serverless.cli.log('Suspended acceleration on deployment bucket')
        }
      }

      if (this.config.policy) {
        await this.putBucketPolicy(this.deploymentBucket.name, this.config.policy)
        this.serverless.cli.log(`Applied deployment bucket policy`)
      }

      const hasChangedBucketTags = (isNewBucket && Array.isArray(this.config.tags) && this.config.tags.length) ||
        (await this.hasChangedBucketTags(this.deploymentBucket.name, this.config.tags));
      if (hasChangedBucketTags) {
        await this.updateBucketTags(this.deploymentBucket.name, this.config.tags)
        this.serverless.cli.log('Updated deployment bucket tags')
      }

      const hasChangedPublicAccessBlock = (isNewBucket && typeof this.config.blockPublicAccess === 'boolean') ||
        (await this.hasChangedPublicAccessBlock(this.deploymentBucket.name, this.config.blockPublicAccess));
      if (hasChangedPublicAccessBlock) {
        await this.updatePublicAccessBlock(this.deploymentBucket.name, this.config.blockPublicAccess)
        this.serverless.cli.log('Updated deployment bucket public access block')
      }
    } catch (e) {
      console.error(chalk.red(`\n-------- Deployment Bucket Error --------\n${e.message}`))
    }
  }
}

module.exports = DeploymentBucketPlugin

1	'use strict'
2
3	const chalk = require('chalk')	3✔
4	const util = require('./util')	3✔
5
6	const get = (obj, path, defaultValue) => {	3✔
7	return path.split('.').filter(Boolean).every(step => !(step && !(obj = obj[step]))) ? obj : defaultValue	1,194✔
8	}
9
10	const getPublicAccessBlock = block => block === true	72✔
11	? { BlockPublicAcls: true, BlockPublicPolicy: true, IgnorePublicAcls: true, RestrictPublicBuckets: true }
12	: { BlockPublicAcls: false, BlockPublicPolicy: false, IgnorePublicAcls: false, RestrictPublicBuckets: false }
13
14	class DeploymentBucketPlugin {
15	constructor(serverless, options) {
16	this.serverless = serverless	126✔
17
18	const TopLevelPropSchema = {	126✔
19	type: 'object',
20	properties: {
21	name: { type: 'string' },
22	serverSideEncryption: { type: 'string' },
23	kmsKeyID: { type: 'string' },
24	},
25	required: ['name']
26	}
27
28	const CustomPropSchema = {	126✔
29	type: 'object',
30	properties: {
31	enabled: { type: 'boolean' },
32	versioning: { type: 'boolean' },
33	accelerate: { type: 'boolean' },
34	policy: { type: 'any' },
35	tags: { type: 'any' },
36	blockPublicAccess: { type: 'boolean' },
37	},
38	}
39
40	serverless.configSchemaHandler.defineTopLevelProperty('deploymentBucket', TopLevelPropSchema);	126✔
41	serverless.configSchemaHandler.defineCustomProperties(CustomPropSchema);	126✔
42
43	this.provider = this.serverless.providers.aws	126✔
44
45	const deploymentBucketProp = util.deploymentBucketProperty(this.serverless.version)	126✔
46	this.deploymentBucket = get(this.serverless.service, `provider.${deploymentBucketProp}`, {})	126✔
47
48	this.config = get(this.serverless.service, 'custom.deploymentBucket', {})	126✔
49
50	this.hooks = {}	126✔
51
52	if (this.config.enabled !== undefined && this.config.enabled === false) {	126✔
53	return;	3✔
54	}
55
56	if (this.deploymentBucket.name) {	123✔
57	this.config.versioning = get(this.config, 'versioning', false)	99✔
58	this.config.accelerate = get(this.config, 'accelerate', false)	99✔
59	this.config.policy = get(this.config, 'policy', undefined)	99✔
60	this.config.tags = util.filterValidBucketTags(get(this.config, 'tags', undefined))	99✔
61	this.config.blockPublicAccess = get(this.config, 'blockPublicAccess', undefined)	99✔
62
63	const serverlessCommand = get(this.serverless, 'processedInput.commands', [])	99✔
64	if (!serverlessCommand.includes('package')) {	99✔
65	this.hooks['before:aws:common:validate:validate'] = this.applyDeploymentBucket.bind(this)	96✔
66	}
67	}
68	}
69
70	async bucketExists(name) {
71	var params = {	75✔
72	Bucket: name
73	};
74
75	try {	75✔
76	await this.provider.request('S3', 'headBucket', params)	75✔
77	return true	30✔
78	} catch (e) {
79	return false	45✔
80	}
81	}
82
83	async waitFor(name, state) {
84	var params = {	42✔
85	Bucket: name
86	};
87
88	try {	42✔
89	const service = new this.provider.sdk['S3'](this.provider.getCredentials())	42✔
90	await service.waitFor(state, params).promise()	3✔
91
92	return true	3✔
93	} catch (e) {
94	this.serverless.cli.log(`Unable to wait for '${state}' - ${e.message}`)	39✔
95
96	return false	39✔
97	}
98	}
99
100	async createBucket(name) {
101	const params = {	45✔
102	Bucket: name,
103	ACL: 'private'
104	};
105
106	return await this.provider.request('S3', 'createBucket', params)	45✔
107	}
108
109	async hasBucketEncryption(name) {
110	const params = {	69✔
111	Bucket: name
112	};
113
114	try {	69✔
115	await this.provider.request('S3', 'getBucketEncryption', params)	69✔
116	return true	57✔
117	} catch (e) {
118	return false	12✔
119	}
120	}
121
122	async putBucketEncryption(name, sseAlgorithm, kmsMasterKeyId) {
123	const params = {	12✔
124	Bucket: name,
125	ServerSideEncryptionConfiguration: {
126	Rules: [
127	{
128	ApplyServerSideEncryptionByDefault: {
129	SSEAlgorithm: sseAlgorithm,
130	KMSMasterKeyID: kmsMasterKeyId
131	}
132	}
133	]
134	}
135	}
136
137	return await this.provider.request('S3', 'putBucketEncryption', params)	12✔
138	}
139
140	async hasBucketVersioning(name) {
141	const params = {	72✔
142	Bucket: name
143	};
144
145	try {	72✔
146	const response = await this.provider.request('S3', 'getBucketVersioning', params)	72✔
147	if (response.Status && response.Status == 'Enabled') {	69✔
148	return true	15✔
149	}
150
151	return false	36✔
152	} catch (e) {
153	return false	21✔
154	}
155	}
156
157	async putBucketVersioning(name, status) {
158	const params = {	27✔
159	Bucket: name,
160	VersioningConfiguration: {
161	Status: status ? 'Enabled' : 'Suspended'	27✔
162	}
163	};
164
165	return await this.provider.request('S3', 'putBucketVersioning', params)	27✔
166	}
167
168	async hasBucketAcceleration(name) {
169	const params = {	72✔
170	Bucket: name
171	};
172
173	try {	72✔
174	const response = await this.provider.request('S3', 'getBucketAccelerateConfiguration', params)	72✔
175	if (response.Status && response.Status == 'Enabled') {	72✔
176	return true	6✔
177	}
178
179	return false	36✔
180	} catch (e) {
181	return false	30✔
182	}
183	}
184
185	async putBucketAcceleration(name, status) {
186	const params = {	36✔
187	Bucket: name,
188	AccelerateConfiguration: {
189	Status: status ? 'Enabled' : 'Suspended'	36✔
190	}
191	};
192
193	return await this.provider.request('S3', 'putBucketAccelerateConfiguration', params)	36✔
194	}
195
196	async putBucketPolicy(name, policy) {
197	const params = {	3✔
198	Bucket: name,
199	Policy: JSON.stringify(policy),
200	};
201	return await this.provider.request('S3', 'putBucketPolicy', params)	3✔
202	}
203
204	async hasChangedBucketTags(name, tags) {
205	try {	69✔
206	const response = await this.provider.request('S3', 'getBucketTagging', { Bucket: name })	69✔
207	return response && JSON.stringify(response.TagSet) !== JSON.stringify(tags)	66✔
208	} catch (e) {
209	return false	3✔
210	}
211	}
212
213	async updateBucketTags(name, tags) {
214	if (Array.isArray(tags) && tags.length) {	6✔
215	return await this.provider.request('S3', 'putBucketTagging', {	3✔
216	Bucket: name,
217	Tagging: { TagSet: tags }
218	})
219	} else {
220	return await this.provider.request('S3', 'deleteBucketTagging', {	3✔
221	Bucket: name
222	})
223	}
224	}
225
226	async hasChangedPublicAccessBlock(name, blockPublicAccess) {
227	try {	63✔
228	const config = getPublicAccessBlock(blockPublicAccess)	63✔
229	const response = await this.provider.request('S3', 'getPublicAccessBlock', { Bucket: name })	63✔
230	return response && JSON.stringify(response.PublicAccessBlockConfiguration) !== JSON.stringify(config)	57✔
231	} catch (e) {
232	return blockPublicAccess	6✔
233	}
234	}
235
236	async updatePublicAccessBlock(name, blockPublicAccess) {
237	if (blockPublicAccess === true) {	15✔
238	return await this.provider.request('S3', 'putPublicAccessBlock', {	9✔
239	Bucket: name,
240	PublicAccessBlockConfiguration: getPublicAccessBlock(blockPublicAccess)
241	})
242	} else {
243	return await this.provider.request('S3', 'deletePublicAccessBlock', {	6✔
244	Bucket: name
245	})
246	}
247	}
248
249	async applyDeploymentBucket() {
250	try {	75✔
251	let isNewBucket = false	75✔
252
253	if (await this.bucketExists(this.deploymentBucket.name)) {	75✔
254	this.serverless.cli.log(`Using deployment bucket '${this.deploymentBucket.name}'`)	30✔
255	} else {
256	this.serverless.cli.log(`Creating deployment bucket '${this.deploymentBucket.name}'...`)	45✔
257
258	await this.createBucket(this.deploymentBucket.name)	45✔
259	await this.waitFor(this.deploymentBucket.name, 'bucketExists')	42✔
260	isNewBucket = true	42✔
261	}
262
263	if (this.deploymentBucket.serverSideEncryption) {	72✔
264	if (!(await this.hasBucketEncryption(this.deploymentBucket.name))) {	69✔
265	if (this.deploymentBucket.serverSideEncryption === "aws:kms") {	12!
NEW 266	await this.putBucketEncryption(this.deploymentBucket.name, this.deploymentBucket.serverSideEncryption, this.deploymentBucket.kmsKeyID)	×
267	}
268
269	if (this.deploymentBucket.serverSideEncryption === "AES256") {	12!
270	await this.putBucketEncryption(this.deploymentBucket.name, this.deploymentBucket.serverSideEncryption)	12✔
271	}
272
273	this.serverless.cli.log(`Applied SSE (${this.deploymentBucket.serverSideEncryption}) to deployment bucket`)	12✔
274	}
275	}
276
277	if ((await this.hasBucketVersioning(this.deploymentBucket.name)) != this.config.versioning) {	72✔
278	await this.putBucketVersioning(this.deploymentBucket.name, this.config.versioning)	27✔
279
280	if (this.config.versioning) {	27✔
281	this.serverless.cli.log('Enabled versioning on deployment bucket')	24✔
282	} else {
283	this.serverless.cli.log('Suspended versioning on deployment bucket')	3✔
284	}
285	}
286
287	if ((await this.hasBucketAcceleration(this.deploymentBucket.name)) != this.config.accelerate) {	72✔
288	await this.putBucketAcceleration(this.deploymentBucket.name, this.config.accelerate)	36✔
289
290	if (this.config.accelerate) {	36✔
291	this.serverless.cli.log('Enabled acceleration on deployment bucket')	33✔
292	} else {
293	this.serverless.cli.log('Suspended acceleration on deployment bucket')	3✔
294	}
295	}
296
297	if (this.config.policy) {	72✔
298	await this.putBucketPolicy(this.deploymentBucket.name, this.config.policy)	3✔
299	this.serverless.cli.log(`Applied deployment bucket policy`)	3✔
300	}
301
302	const hasChangedBucketTags = (isNewBucket && Array.isArray(this.config.tags) && this.config.tags.length) \|\|	72✔
303	(await this.hasChangedBucketTags(this.deploymentBucket.name, this.config.tags));
304	if (hasChangedBucketTags) {	72✔
305	await this.updateBucketTags(this.deploymentBucket.name, this.config.tags)	6✔
306	this.serverless.cli.log('Updated deployment bucket tags')	6✔
307	}
308
309	const hasChangedPublicAccessBlock = (isNewBucket && typeof this.config.blockPublicAccess === 'boolean') \|\|	72✔
310	(await this.hasChangedPublicAccessBlock(this.deploymentBucket.name, this.config.blockPublicAccess));
311	if (hasChangedPublicAccessBlock) {	72✔
312	await this.updatePublicAccessBlock(this.deploymentBucket.name, this.config.blockPublicAccess)	15✔
313	this.serverless.cli.log('Updated deployment bucket public access block')	15✔
314	}
315	} catch (e) {
316	console.error(chalk.red(`\n-------- Deployment Bucket Error --------\n${e.message}`))	3✔
317	}
318	}
319	}
320
321	module.exports = DeploymentBucketPlugin	3✔

MikeSouza / serverless-deployment-bucket / 832399332

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous