feat: additional options when assuming publishing roles

.projenrc.ts

@@ -32,6 +32,7 @@ const project = new typescript.TypeScriptProject({
     '@types/glob',
     '@types/mime',
     '@types/yargs',
+    '@types/mock-fs',
     'fs-extra',
     'graceful-fs',
     'jszip',

lib/aws.ts

@@ -14,10 +14,17 @@ export interface IAws {
   secretsManagerClient(options: ClientOptions): Promise<AWS.SecretsManager>;
 }
 
+// Partial because `RoleSessionName` is required in STS, but we have a default value for it.
+export type AssumeRoleAdditionalOptions = Partial<
+  // cloud-assembly-schema validates that `ExternalId` and `RoleArn` are not configured
+  Omit<AWS.STS.Types.AssumeRoleRequest, 'ExternalId' | 'RoleArn'>
+>;
+
 export interface ClientOptions {
   region?: string;
   assumeRoleArn?: string;
   assumeRoleExternalId?: string;
+  assumeRoleAdditionalOptions?: AssumeRoleAdditionalOptions;
   quiet?: boolean;
 }
 
@@ -118,7 +125,8 @@ export class DefaultAwsClient implements IAws {
       credentials = await this.assumeRole(
         options.region,
         options.assumeRoleArn,
-        options.assumeRoleExternalId
+        options.assumeRoleExternalId,
+        options.assumeRoleAdditionalOptions
       );
     }
 
@@ -140,13 +148,22 @@ export class DefaultAwsClient implements IAws {
   private async assumeRole(
     region: string | undefined,
     roleArn: string,
-    externalId?: string
+    externalId?: string,
+    additionalOptions?: AssumeRoleAdditionalOptions
   ): Promise<AWS.Credentials> {
+    if (
+      additionalOptions?.Tags &&
+      additionalOptions.Tags.length > 0 &&
+      !additionalOptions.TransitiveTagKeys
+    ) {
+      additionalOptions.TransitiveTagKeys = additionalOptions.Tags?.map((t) => t.Key);
+    }
     return new this.AWS.ChainableTemporaryCredentials({
       params: {
         RoleArn: roleArn,
         ExternalId: externalId,
         RoleSessionName: `cdk-assets-${safeUsername()}`,
+        ...(additionalOptions ?? {}),
       },
       stsConfig: {
         region,

lib/private/handlers/container-images.ts

@@ -105,7 +105,10 @@ export class ContainerImageAssetHandler implements IAssetHandler {
 
     const destination = await replaceAwsPlaceholders(this.asset.destination, this.host.aws);
     const ecr = await this.host.aws.ecrClient({
-      ...destination,
+      assumeRoleArn: destination.assumeRoleArn,
+      assumeRoleExternalId: destination.assumeRoleExternalId,
+      assumeRoleAdditionalOptions: destination.assumeRoleAdditionalOptions,
+      region: destination.region,
       quiet: options.quiet,
     });
     const account = async () => (await this.host.aws.discoverCurrentAccount())?.accountId;

lib/private/handlers/files.ts

@@ -35,7 +35,10 @@ export class FileAssetHandler implements IAssetHandler {
     const s3Url = `s3://${destination.bucketName}/${destination.objectKey}`;
     try {
       const s3 = await this.host.aws.s3Client({
-        ...destination,
+        assumeRoleArn: destination.assumeRoleArn,
+        assumeRoleExternalId: destination.assumeRoleExternalId,
+        assumeRoleAdditionalOptions: destination.assumeRoleAdditionalOptions,
+        region: destination.region,
         quiet: true,
       });
       this.host.emitMessage(EventType.CHECK, `Check ${s3Url}`);
@@ -53,14 +56,27 @@ export class FileAssetHandler implements IAssetHandler {
   public async publish(): Promise<void> {
     const destination = await replaceAwsPlaceholders(this.asset.destination, this.host.aws);
     const s3Url = `s3://${destination.bucketName}/${destination.objectKey}`;
-    const s3 = await this.host.aws.s3Client(destination);
+    const s3 = await this.host.aws.s3Client({
+      assumeRoleArn: destination.assumeRoleArn,
+      assumeRoleExternalId: destination.assumeRoleExternalId,
+      assumeRoleAdditionalOptions: destination.assumeRoleAdditionalOptions,
+      region: destination.region,
+    });
     this.host.emitMessage(EventType.CHECK, `Check ${s3Url}`);
 
     const bucketInfo = BucketInformation.for(this.host);
 
     // A thunk for describing the current account. Used when we need to format an error
     // message, not in the success case.
-    const account = async () => (await this.host.aws.discoverTargetAccount(destination))?.accountId;
+    const account = async () =>
+      (
+        await this.host.aws.discoverTargetAccount({
+          assumeRoleArn: destination.assumeRoleArn,
+          assumeRoleExternalId: destination.assumeRoleExternalId,
+          assumeRoleAdditionalOptions: destination.assumeRoleAdditionalOptions,
+          region: destination.region,
+        })
+      )?.accountId;
     switch (await bucketInfo.bucketOwnership(s3, destination.bucketName)) {
       case BucketOwnership.MINE:
         break;

test/aws.test.ts

@@ -0,0 +1,136 @@
+import * as os from 'os';
+import { DefaultAwsClient } from '../lib';
+
+beforeEach(() => {
+  jest.requireActual('aws-sdk');
+});
+
+test('assumeRole passes the right parameters to STS', async () => {
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const AWS = require('aws-sdk');
+
+  jest.mock('aws-sdk', () => {
+    return {
+      STS: jest.fn().mockReturnValue({
+        getCallerIdentity: jest.fn().mockReturnValue({
+          promise: jest.fn().mockResolvedValue({
+            Account: '123456789012',
+            Arn: 'arn:aws:iam::123456789012:role/my-role',
+          }),
+        }),
+      }),
+      ChainableTemporaryCredentials: jest.fn(),
+    };
+  });
+  const aws = new DefaultAwsClient();
+  await withMocked(os, 'userInfo', async (userInfo) => {
+    userInfo.mockReturnValue({
+      username: 'foo',
+      uid: 1,
+      gid: 1,
+      homedir: '/here',
+      shell: '/bin/sh',
+    });
+    await aws.discoverTargetAccount({
+      region: 'us-east-1',
+      assumeRoleArn: 'arn:aws:iam::123456789012:role/my-role',
+      assumeRoleExternalId: 'external-id',
+      assumeRoleAdditionalOptions: {
+        DurationSeconds: 3600,
+      },
+    });
+    expect(AWS.ChainableTemporaryCredentials).toHaveBeenCalledWith({
+      params: {
+        ExternalId: 'external-id',
+        RoleArn: 'arn:aws:iam::123456789012:role/my-role',
+        DurationSeconds: 3600,
+        RoleSessionName: `cdk-assets-foo`,
+      },
+      stsConfig: {
+        customUserAgent: 'cdk-assets',
+        region: 'us-east-1',
+      },
+    });
+  });
+});
+
+test('assumeRole defaults session tags to all', async () => {
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const AWS = require('aws-sdk');
+
+  jest.mock('aws-sdk', () => {
+    return {
+      STS: jest.fn().mockReturnValue({
+        getCallerIdentity: jest.fn().mockReturnValue({
+          promise: jest.fn().mockResolvedValue({
+            Account: '123456789012',
+            Arn: 'arn:aws:iam::123456789012:role/my-role',
+          }),
+        }),
+      }),
+      ChainableTemporaryCredentials: jest.fn(),
+    };
+  });
+  const aws = new DefaultAwsClient();
+  await withMocked(os, 'userInfo', async (userInfo) => {
+    userInfo.mockReturnValue({
+      username: 'foo',
+      uid: 1,
+      gid: 1,
+      homedir: '/here',
+      shell: '/bin/sh',
+    });
+    await aws.discoverTargetAccount({
+      region: 'us-east-1',
+      assumeRoleArn: 'arn:aws:iam::123456789012:role/my-role',
+      assumeRoleExternalId: 'external-id',
+      assumeRoleAdditionalOptions: {
+        Tags: [{ Key: 'Departement', Value: 'Engineering' }],
+      },
+    });
+    expect(AWS.ChainableTemporaryCredentials).toHaveBeenCalledWith({
+      params: {
+        ExternalId: 'external-id',
+        RoleArn: 'arn:aws:iam::123456789012:role/my-role',
+        Tags: [{ Key: 'Departement', Value: 'Engineering' }],
+        TransitiveTagKeys: ['Departement'],
+        RoleSessionName: `cdk-assets-foo`,
+      },
+      stsConfig: {
+        customUserAgent: 'cdk-assets',
+        region: 'us-east-1',
+      },
+    });
+  });
+});
+
+export function withMocked<A extends object, K extends keyof A, B>(
+  obj: A,
+  key: K,
+  block: (fn: jest.Mocked<A>[K]) => B
+): B {
+  const original = obj[key];
+  const mockFn = jest.fn();
+  (obj as any)[key] = mockFn;
+
+  let asyncFinally: boolean = false;
+  try {
+    const ret = block(mockFn as any);
+    if (!isPromise(ret)) {
+      return ret;
+    }
+
+    asyncFinally = true;
+    return ret.finally(() => {
+      obj[key] = original;
+    }) as any;
+  } finally {
+    if (!asyncFinally) {
+      obj[key] = original;
+    }
+  }
+}
+
+function isPromise<A>(object: any): object is Promise<A> {
+  return Promise.resolve(object) === object;
+}

test/docker-images.test.ts

@@ -29,6 +29,10 @@ beforeEach(() => {
             theDestination: {
               region: 'us-north-50',
               assumeRoleArn: 'arn:aws:role',
+              assumeRoleExternalId: 'external-id',
+              assumeRoleAdditionalOptions: {
+                Tags: [{ Key: 'Departement', Value: 'Engineering' }],
+              },
               repositoryName: 'repo',
               imageTag: 'abcdef',
             },
@@ -249,6 +253,10 @@ test('pass destination properties to AWS client', async () => {
     expect.objectContaining({
       region: 'us-north-50',
       assumeRoleArn: 'arn:aws:role',
+      assumeRoleExternalId: 'external-id',
+      assumeRoleAdditionalOptions: {
+        Tags: [{ Key: 'Departement', Value: 'Engineering' }],
+      },
     })
   );
 });

test/files.test.ts

@@ -1,6 +1,6 @@
 jest.mock('child_process');
 
-import { Manifest } from '@aws-cdk/cloud-assembly-schema';
+import { FileDestination, Manifest } from '@aws-cdk/cloud-assembly-schema';
 import * as mockfs from 'mock-fs';
 import { FakeListener } from './fake-listener';
 import { mockAws, mockedApiFailure, mockedApiResult, mockUpload } from './mock-aws';
@@ -9,9 +9,13 @@ import { AssetPublishing, AssetManifest } from '../lib';
 
 const ABS_PATH = '/simple/cdk.out/some_external_file';
 
-const DEFAULT_DESTINATION = {
+const DEFAULT_DESTINATION: FileDestination = {
   region: 'us-north-50',
   assumeRoleArn: 'arn:aws:role',
+  assumeRoleExternalId: 'external-id',
+  assumeRoleAdditionalOptions: {
+    Tags: [{ Key: 'Departement', Value: 'Engineering' }],
+  },
   bucketName: 'some_bucket',
   objectKey: 'some_key',
 };
@@ -114,6 +118,10 @@ test('pass destination properties to AWS client', async () => {
     expect.objectContaining({
       region: 'us-north-50',
       assumeRoleArn: 'arn:aws:role',
+      assumeRoleExternalId: 'external-id',
+      assumeRoleAdditionalOptions: {
+        Tags: [{ Key: 'Departement', Value: 'Engineering' }],
+      },
     })
   );
 });