stackctl 1.7.0.0 → 1.7.1.0

raw patch · 4 files changed

+68/−3 lines, 4 files

Files

CHANGELOG.md +5/−1
README.md +27/−0
src/Stackctl/AWS/Core.hs +35/−1
stackctl.cabal +1/−1

CHANGELOG.md view

@@ -1,4 +1,8 @@-## [_Unreleased_](https://github.com/freckle/stackctl/compare/v1.7.0.0...main)+## [_Unreleased_](https://github.com/freckle/stackctl/compare/v1.7.1.0...main)++## [v1.7.1.0](https://github.com/freckle/stackctl/compare/v1.7.0.0...v1.7.1.0)++- Add `withAssumedRole`, deprecate `assumeRole`  ## [v1.7.0.0](https://github.com/freckle/stackctl/compare/v1.6.1.2...v1.7.0.0)

README.md view

@@ -76,6 +76,33 @@ The man pages are also available [online](https://freckle.github.io/stackctl/), but contain documentation as of `main`, and not your installed version. +## Comparison to AWS CloudFormation Git Sync++[AWS CloudFormation Git Sync][aws-git-sync] was recently released by AWS. It+allows you to link a repository on GitHub to a CloudFormation Stack. The+repository contains a "deployment file" that defines a `template-file-path`,+`parameters`, and `tags` -- effectively, a Stack Specification.++When AWS notices updates to the deployment or template file land on a defined+branch, it updates the configured Stack accordingly, emitting events to SNS as+it does.++This is great for simple use-cases, and we fully expect they'll improve and+extend it such that it obviates Stackctl one day. In the meantime, there are+currently the following limitations when compared to Stackctl:++1. A repository can only target a single account and region+1. There is no changeset flow amenable to previewing changes via PRs. You update+   the file(s) on `main` and it syncs, that's it. If you're using a PR, you have+   only linting and human review as possible pre-deployment steps.+1. There is no way to specify description, capabilities, or dependencies+1. As of 12/23, there seemed to be some bugs, and the setup installs a managed+   event bridge that "phones home", sending events about your updates to some+   other AWS account ([source][first-look-blog])++[aws-git-sync]: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/git-sync.html+[first-look-blog]: https://medium.com/@mattgillard/first-look-git-sync-for-cloudformation-stacks-9e2f39c311ac+ ## Relationship to CloudGenesis  [CloudGenesis][] is a project that also takes a directory of Stack

src/Stackctl/AWS/Core.hs view

@@ -9,7 +9,7 @@     -- * "Control.Monad.AWS" extensions   , simple   , discover-  , assumeRole+  , withAssumedRole      -- * Error-handling   , handlingServiceError@@ -22,6 +22,9 @@   , Region (..)   , FromText (..)   , ToText (..)++    -- * Deprecated+  , assumeRole   ) where  import Stackctl.Prelude@@ -29,6 +32,7 @@ import Amazonka   ( AWSRequest   , AWSResponse+  , Env' (auth)   , Region   , ServiceError   , serviceError_code@@ -38,6 +42,7 @@   , _ServiceError   ) import qualified Amazonka+import Amazonka.Auth.Background (fetchAuthInBackground) import Amazonka.Auth.Keys (fromSession) import Amazonka.Data.Text (FromText (..), ToText (..)) import qualified Amazonka.Env as Amazonka@@ -87,6 +92,11 @@    maybe (throwString err) pure $ post resp +-- | Use 'withAssumedRole' instead+--+-- This function is like 'withAssumedRole' except it doesn't spawn a background+-- thread to keep credentials refreshed. You may encounter expired credentials+-- if the block used under 'assumeRole' goes for long enough. assumeRole   :: (MonadIO m, MonadAWS m)   => Text@@ -111,6 +121,30 @@     pure $ fromSession accessKeyId secretAccessKey sessionToken    localEnv assumeEnv f+{-# DEPRECATED assumeRole "Use withAssumedRole instead" #-}++-- | Assume a role using the @sts:AssumeRole@ API and run an action+withAssumedRole+  :: (MonadUnliftIO m, MonadAWS m)+  => Text+  -- ^ Role ARN+  -> Text+  -- ^ Role session name+  -> m a+  -- ^ Action to run as the assumed role+  -> m a+withAssumedRole roleArn roleSessionName f = do+  keys <- withRunInIO $ \runInIO -> do+    let getCredentials = do+          resp <-+            runInIO+              $ send+              $ newAssumeRole roleArn roleSessionName+          pure $ resp ^. assumeRoleResponse_credentials++    fetchAuthInBackground getCredentials++  localEnv (\env -> env {auth = Identity keys}) f  newtype AccountId = AccountId   { unAccountId :: Text

stackctl.cabal view

@@ -1,6 +1,6 @@ cabal-version:   1.18 name:            stackctl-version:         1.7.0.0+version:         1.7.1.0 license:         MIT license-file:    LICENSE copyright:       2022 Renaissance Learning Inc