feat: Air gap EC2 and Sagemaker workspaces #555
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## feat-secure-workspace-egress #555 +/- ##
================================================================
- Coverage 50.63% 49.54% -1.10%
================================================================
Files 225 249 +24
Lines 11975 12893 +918
Branches 1945 2061 +116
================================================================
+ Hits 6064 6388 +324
- Misses 5131 5681 +550
- Partials 780 824 +44
Continue to review full report at Codecov.
|
jn1119
reviewed
Jun 29, 2021
...as/packages/base-raas-cfn-templates/src/templates/service-catalog/ec2-linux-instance.cfn.yml
Outdated
Show resolved
Hide resolved
nguyen102
commented
Jun 29, 2021
.../packages/base-raas-cfn-templates/src/templates/service-catalog/ec2-windows-instance.cfn.yml
Outdated
Show resolved
Hide resolved
jn1119
reviewed
Jun 30, 2021
...s/packages/base-raas-workflow-steps/lib/steps/provision-environment/provision-environment.js
Outdated
Show resolved
Hide resolved
added 6 commits
June 30, 2021 12:25
jn1119
reviewed
Jul 2, 2021
addons/addon-base-raas/packages/base-raas-cfn-templates/src/templates/onboard-account.cfn.yml
Show resolved
Hide resolved
...as/packages/base-raas-cfn-templates/src/templates/service-catalog/ec2-linux-instance.cfn.yml
Show resolved
Hide resolved
jn1119
reviewed
Jul 6, 2021
.../packages/base-raas-cfn-templates/src/templates/service-catalog/ec2-windows-instance.cfn.yml
Show resolved
Hide resolved
jn1119
approved these changes
Jul 6, 2021
jn1119
added a commit
that referenced
this pull request
Oct 14, 2021
* Add Egress Store Toggle Setting * feat: Add iEgress Store Toggle Setting * feat: GALI-933 and GALI-934 add UI changes for egress store request submission and potential error * minor comment fix * fix: data-egress-controller lint issue * docs: Update docs to specify Packer version 1.6.0 (#484) * fix: adds 'stopped' filter for workspaces * bulkUserAdd API bugfix (#490) * fix: bug in openapi.yaml introduced in previous PR with unescaped asterisk causing malformed YAML file * fix: adds validation checks and more informative error messages for bulk-add-users API call. * fix: added unit and integration tests for changes * fix: moved notification boxes to avoid blocking the top ribbon. (#483) * chore: Update UI to show 3.1 (#493) * chore: Update issue templates (#487) * chore: Update issue templates * Trigger notification * fix: changes per review Co-authored-by: Robert Smayda <smayda44@gmail.com> * fix: Redirect non admin users to "/" if they try to access "/users" (#489) * chore: update PR checklist (#494) * chore: Add GH action to check for dependency vulnerabilities (#498) * fix: react compilation error (#500) * docs: hyperlink corrections (#497) * <docs: added hyperlinks in packer readme> * Revert "<docs: added hyperlinks in packer readme>" This reverts commit 501b7de. * docs: corrected the hyperlinks * feat: study permissions only shown to Study Admin (#501) * fix: add termination status for non-found workspaces (#502) * fix: Do not allow users to change root password (#503) * chore: docs dependency fix (#505) * chore(deps): bump dns-packet from 1.3.1 to 1.3.4 in /docs (#507) * chore(deps): bump dns-packet from 1.3.1 to 1.3.4 in /docs Bumps [dns-packet](https://github.com/mafintosh/dns-packet) from 1.3.1 to 1.3.4. - [Release notes](https://github.com/mafintosh/dns-packet/releases) - [Changelog](https://github.com/mafintosh/dns-packet/blob/master/CHANGELOG.md) - [Commits](mafintosh/dns-packet@v1.3.1...v1.3.4) Signed-off-by: dependabot[bot] <support@github.com> * feat: Add warning that internal authentication shouldn't be used in production (#506) * feat: Encrypt s3 buckets for EMR log bucket and CICD Artifact bucket (#508) * chore: Disable EBS volume for storage gateway (#511) Co-authored-by: Tim Nguyen <thingut@amazon.com> * chore: Add encryption to CICD SNS topic (#512) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: minor UI fix, add demo info * fix: remove console output and message update * feat: App Stream vpc (#523) * feat: [feat-secure-workspace-egress] GALI-884 Backend Egress Store Initiation (#510) * update Service Catalog template * add Egress Store init function when workspace is created * fix: data-egress-service lint * fix: environment-config-var-service.test testing with data-egress-service as dependency * fix: move reusable function into utiil * fix: update create-egress-store.json schema validation * fix: remove duplicate function in environment-resource-service.js * fix: update egress store resource config and update pnpm-lock * fix: add unit test of data egress service * fix: rephrase config note * fix: add more unit test for data egress service Co-authored-by: Xian Zhang <zhaxan@amazon.com> Co-authored-by: Jeet <68876606+jn1119@users.noreply.github.com> * feat: addon-egress-store-stack-policy * fix: lint in unit test * fix: add enableEgressStore in setting file * fix: store lint issue * feat: Extend account onboarding template to include AppStream resources (#539) * feat: Add image builder scripts (#541) * fix: remove redundant policy code * fix: change addon name to general name and update config explanation * fix: update pnpm-lock file * Minor changes to .defaults.yml * docs: Minor doc changes to example.yml * chore: delete terminate-egress-store.json * feat: add egress store termination * fix: update openapi * fix: update controller with no response for delete * fix: update codecov.yml * fix: codecov.yml * fix: add user test * fix: update openapi.yaml * fix: apply more test and user validation on calling ES termination function * fix: update error msg * fix: add lock for updating/write DDB item * fix: use workspace id as egress store id to aviod situation multiple egress store attached to one workspace. * fix: add s3-service test and update s3-service with error catch * fix: update pnpm-lock file * fix: update high_vul_threshold to 4 * fix: add test cases for s3 service * fix: fix lint issue of S3-service.test.js * fix: add list user test * fix: post deployment step check if egress store is enabled. * fix: shorten the workflowlooprunner role policy size * fix: update uppercase in post deployment step * fix: temp set high_vul_threshold to 4 * fix: update test of cfn stack policy updater * fix: update stack policy from empty stack policy * fix: resolve lint issue * fix: add unit test for updating stack policy * feat: Air gap EC2 and Sagemaker workspaces (#555) * feat: add object tagging functionality * fix: clean up test * fix: add egress test * fix: add s3 tests * fix: fix s3 tests * fix: add s3 service test and data-egress-serviice * feat: Allow creating new AppStream enabled account (#566) * feat: Story update connect (#571) * feat: adding logic to connect API * feat: adding scripts for firefox appstream * test: buildImage changes * test: launch params in abs path * fix: add missing space in launch params * fix: copy firefox ps script to App * feat: changing appstream stack name * feat: appstream returns dest url in connection * feat: adding UI changes for url scheme * fix: using isAppStreamEnabled flag * feat: update link in apsstream setup * code cleanup * chore: update lock file * fix: pull variable from env * fix: throw error for appstream resource not found * remove unreachable code * fix: workspace provision error when egressStoreIAMPolicyDocument is null * fix: add compute-platform-service test * feat: added backend code for connecting with Windows environments via AppStream (#576) * fix: Provision environment pulls namespace value from stack id (#575) * feat: Appstream connection updates (#578) * feat: editing UI components for appstream * feat: adding ec2linux ps1 file * fix: add ec2linux in buildImage * feat: update ec2linux ps1 location * feat: UI improvements appstream * testing changes * feat: adding UI changes for appstream * feat: changes per review * fix: single quotes to double * fix: update MobX observable in action * fix: mobx observable fix * update observables * fix: move egressStoreObjectHandler into postdeployment to avoid deployment with s3 bucket not found error * fix: test fix * fix: add compute-*-service tests * fix: add compute-price-service test * feat: appstream connect UI changes (#580) * fix: test coverage addition for appstream * feat: update instructions for appstream * feat: adding flag for list call * feat: adding appstream instruction * fix: add egress service tests * fix: serverless-plugin-ifelse dependency * feat: add notification * chore: Add provision account unit test (#572) * feat: add object list for egress store * fix: add db access for role:RoleEgressStoreObjectsHandler in post-deployment * fix: remove unused function in store * fix: fix data egress tests * fix: remove used data in UI * fix: lint * fix: lint * fix: lint and clean code * fix: lint issue in service and test * fix: add data-egress service * fix: add s3 tests * fix: lint in test * Update AppStream feat branch with latest code from develop (#585) * feat: AppStream code hardening (#583) * test: adding appstream unit tests * feat: adding unit tests for appstream URL plugin * fix: UI typo fix * feat: adding e2e tests for appstream instructions * test: optimizing e2e appstream tests * fix: potential dep vulnerabilities * fix: deployment with config * fix: data-egress service and tests * fix: remove console.log * fix: test * fix: lint * fix: tests for s3 service and data egress service * fix: s3-service tests * fix: s3 service to export api when init * feat: workspace provisioning mgmt (#594) * feat: env prov API update for appstream * feat: UI changes to verify proj appstream config * test: adding project service appstream tests * test: adding e2e test to verify create disabled * fix: changes per review * fix: await async methods (#599) * fix: prevent redundant looping (#600) * fix: unit test env connection & S3 service (#601) * fix: unit test env connection * fix: update s3 service to initiate S3 * feat: add disable BYOB when egress store feature is enabled * fix: add study service test * fix: lint * fix: using the string value of AppStream flag (#604) * Fix: ui and backend egress logic while terminating workspace * fix: data-egress service * fix: lint * feat: Restrict SageMaker presigned URL access to private VPC endpoint (#608) * fix: modify create-egress-store json validation * fix: hot fix for enable egress store submission * feat: post deploy appstream step (#612) * feat: add post dep step for appstream stack policy * test: adding unit tests update cfn policy * fix: changes per review * feat: Update Account page to use cards for Accounts. Update Account onboarding to use CFN template links. PRs: https://github.com/awslabs/service-workbench-on-aws/pulls?q=is%3Apr+author%3Aahl27+is%3Aclosed+APU * feat: Update APU feature to support onboarding and updating AppStream accounts (#606) * docs: onboarding account gali 1059 * docs: PR feedback addressed * fix: egress button submission error * fix: add egress store service tests * fix: lint issue * fix: get appstream setting optional bool (#633) * fix: get appstream setting optional bool * fix: changing optionalBoolean to getBoolean * fix: unit tests for getBoolean * undo potential merge conflict * feat: Disable CIDR feature when AppStream is enabled (#632) feat: Disable CIDR feature when AppStream is enabled * fix: egress store data access cross account * fix: add remove kms key policy unit test * fix: update kms policy when no study selected * fix: update method name to updateKMSPolicyForEgress * fix: Filter out empty CIDR blocks from security group details (#645) * fix: egress store should be terminated if it's not used after creation * fix: add error msg when error occurs in putting bucket policy * fix: lint issue * fix: edit error message * fix: lint * feat: Onboard instruction update (#647) * Update onboard account instructions * Trigger notification Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: edit bucket policy * fix: Various TRE bugfixes (#642) * fix: add pre-deployment * fix: add pre-deployment to delete environment * fix: lint * fix: minor egress update * fix: egress error message * fix: fix BYOB studies to work with SageMaker and EC2 Linux when AppStream is enabled (#658) * feat: Allow termination of non-appstream envs (#655) * feat: warn users to terminate non-appstream envs * feat: add check plugin for awsAccount APIs * fix: older unit tests * updated optionalBoolean to getBoolean in unit test * fix: changes per review * test: added unit tests for aws mgmt appstream * code cleanup * fix: remove unsed setting * fix: update error message in util function * fix: fix BYOB to work for EC2 Windows when AppStream is enabled (#662) * doc: adding pre-requisite info for appstream (#664) * doc: adding pre-requisite info for appstream * fix: Trigger Build * fix: lambda error (#670) * fix: account status check lambda * code cleanup * test: Split integration and E2E tests for AppStream/NonAppStream (#663) * test: connection url appstream (#673) * feat: adding appstream integ tests for connect URL * code cleanup * fix: changes per review * code cleanup * fix: Fix AccountOnboardingHandler to correctly check for non-AppStream environments (#677) * feat: adding Egress integ tests (#679) * feat: adding Egress integ tests * fix: code cleanup * change per review * test: Added appstream workspace tests (#671) * fix: Correct stage name for deploying TRE SWB (#681) * fix: Correct stage name for deploying TRE SWB * Second line Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Enable AppStream and Egress Store (#682) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Run AppStream version of the tests (#683) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Correct Appstream test command to pick up spec files (#684) * Rstudio AppStream integration (#678) * feat: Integrate RStudio workspaces with AppStream * chore: change condition for SSM endpoint to include custom domain presence * fix: open data lambda in appstream env (#687) * chore: Merge mainline into feat-secure-workspace-egress (#659) * fix: Use bucket region if available while mounting BYOB studies (#692) * fix: Allow Sagemaker Appstream workspaces to autostop (#689) * fix:Add AppStream param to envPollHandler error and allow Sagemaker instance access to Sagemaker API Endpoint * Remove commented out code Co-authored-by: Tim Nguyen <thingut@amazon.com> * test: Added infrastructure tests (#696) * fix: member account share appstream bug (#712) * fix: externalId requirement for add account form (#713) * fix: externalId requirement for add account form * test: adding unit test for add member account * fix: add required attribute to unit test * fix: remove hardcoded externalId string * feat: swb main study role (#710) * fix: enableEgressStore flag is boolean, not string (#715) * feat: Pull AppStream create connection test env id from config file (#718) Co-authored-by: Tim Nguyen <thingut@amazon.com> * feat: remove egress bucket pol (#720) * feat: removing egress bucket policy * test: adjusting unit tests for new business logic * fix: update main role prefix for workflow perms * add swb prefix for main study role in apiHandler * chore: Make Egress store function with roles and remove kms whitelisting of member accounts (#723) * fix: converting Egress flag from boolean to string bug (#730) * fix: Disable public IP address for Linux, Windows, and RStudio when AppStream is enabled(#731) * chore: Update aws-sdk to latest V2 version (#734) * Update Cypress tests to match tests from develop * Update integration test to include isAppStreamEnabled flag * Bump axios version for integratio test * Trigger notification * fix linting issues * Update test * chore: Merge develop and feat-egress-store-role into feat-secure-workspace-egress (#735) * feat: Create dedicated SGs for environment and interface endpoints (#736) * Revert "chore: Merge develop and feat-egress-store-role into feat-secure-workspace-egress (#735)" This reverts commit 40d54e8. * feat: Fetch egress store data by id instead of using a scan (#741) * fix: Delete egress role in workflow instead of API (#740) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Remove PolicyWorkflowLoopRunner DependsOn PermissionBoundaryPolicyStudyBucket * WIP: Allow shareAppStreamImage for update accoutn request * Update tests * Fix typos * Update AppStream egress disabled tests * chore: update docs and script to reference * docs: egress docs (#742) * docs: egress docs * Fix prepare_master_account file and remove yarn.lock file * docs: post deployment guide updates * docs: pr review * docs: spelling correction * docs: new post depl guide * docs: new post depl manual Co-authored-by: Sharma <shyogesh@88665a06ebc4.ant.amazon.com> Co-authored-by: Tim Nguyen <thingut@amazon.com> * docs: Minor comment updates and add copyright headers (#751) Co-authored-by: Xian Zhang <zhaxan@amazon.com> Co-authored-by: Tim Nguyen <nguyen102@users.noreply.github.com> Co-authored-by: ahl27 <lakaidan@amazon.com> Co-authored-by: Aidan Lakshman <aidanlakshman@gmail.com> Co-authored-by: Robert Smayda <smayda44@gmail.com> Co-authored-by: Sanket Dharwadkar <sdharwad@amazon.com> Co-authored-by: shyogesh-sw <79225266+shyogesh-sw@users.noreply.github.com> Co-authored-by: Yanyu Zheng <yz2690@columbia.edu> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tim Nguyen <thingut@amazon.com> Co-authored-by: zhaxan <25250067+MBtea@users.noreply.github.com> Co-authored-by: Aidan Lakshman <ahl27@pitt.edu> Co-authored-by: Yogesh Sharma <shyogesh@amazon.com> Co-authored-by: Marianna Ghirardelli <43092418+maghirardelli@users.noreply.github.com> Co-authored-by: Sharma <shyogesh@88665a06ebc4.ant.amazon.com>
jxuamazon
pushed a commit
to jxuamazon/service-workbench-on-aws
that referenced
this pull request
Feb 15, 2022
* Add Egress Store Toggle Setting * feat: Add iEgress Store Toggle Setting * feat: GALI-933 and GALI-934 add UI changes for egress store request submission and potential error * minor comment fix * fix: data-egress-controller lint issue * docs: Update docs to specify Packer version 1.6.0 (awslabs#484) * fix: adds 'stopped' filter for workspaces * bulkUserAdd API bugfix (awslabs#490) * fix: bug in openapi.yaml introduced in previous PR with unescaped asterisk causing malformed YAML file * fix: adds validation checks and more informative error messages for bulk-add-users API call. * fix: added unit and integration tests for changes * fix: moved notification boxes to avoid blocking the top ribbon. (awslabs#483) * chore: Update UI to show 3.1 (awslabs#493) * chore: Update issue templates (awslabs#487) * chore: Update issue templates * Trigger notification * fix: changes per review Co-authored-by: Robert Smayda <smayda44@gmail.com> * fix: Redirect non admin users to "/" if they try to access "/users" (awslabs#489) * chore: update PR checklist (awslabs#494) * chore: Add GH action to check for dependency vulnerabilities (awslabs#498) * fix: react compilation error (awslabs#500) * docs: hyperlink corrections (awslabs#497) * <docs: added hyperlinks in packer readme> * Revert "<docs: added hyperlinks in packer readme>" This reverts commit 501b7de. * docs: corrected the hyperlinks * feat: study permissions only shown to Study Admin (awslabs#501) * fix: add termination status for non-found workspaces (awslabs#502) * fix: Do not allow users to change root password (awslabs#503) * chore: docs dependency fix (awslabs#505) * chore(deps): bump dns-packet from 1.3.1 to 1.3.4 in /docs (awslabs#507) * chore(deps): bump dns-packet from 1.3.1 to 1.3.4 in /docs Bumps [dns-packet](https://github.com/mafintosh/dns-packet) from 1.3.1 to 1.3.4. - [Release notes](https://github.com/mafintosh/dns-packet/releases) - [Changelog](https://github.com/mafintosh/dns-packet/blob/master/CHANGELOG.md) - [Commits](mafintosh/dns-packet@v1.3.1...v1.3.4) Signed-off-by: dependabot[bot] <support@github.com> * feat: Add warning that internal authentication shouldn't be used in production (awslabs#506) * feat: Encrypt s3 buckets for EMR log bucket and CICD Artifact bucket (awslabs#508) * chore: Disable EBS volume for storage gateway (awslabs#511) Co-authored-by: Tim Nguyen <thingut@amazon.com> * chore: Add encryption to CICD SNS topic (awslabs#512) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: minor UI fix, add demo info * fix: remove console output and message update * feat: App Stream vpc (awslabs#523) * feat: [feat-secure-workspace-egress] GALI-884 Backend Egress Store Initiation (awslabs#510) * update Service Catalog template * add Egress Store init function when workspace is created * fix: data-egress-service lint * fix: environment-config-var-service.test testing with data-egress-service as dependency * fix: move reusable function into utiil * fix: update create-egress-store.json schema validation * fix: remove duplicate function in environment-resource-service.js * fix: update egress store resource config and update pnpm-lock * fix: add unit test of data egress service * fix: rephrase config note * fix: add more unit test for data egress service Co-authored-by: Xian Zhang <zhaxan@amazon.com> Co-authored-by: Jeet <68876606+jn1119@users.noreply.github.com> * feat: addon-egress-store-stack-policy * fix: lint in unit test * fix: add enableEgressStore in setting file * fix: store lint issue * feat: Extend account onboarding template to include AppStream resources (awslabs#539) * feat: Add image builder scripts (awslabs#541) * fix: remove redundant policy code * fix: change addon name to general name and update config explanation * fix: update pnpm-lock file * Minor changes to .defaults.yml * docs: Minor doc changes to example.yml * chore: delete terminate-egress-store.json * feat: add egress store termination * fix: update openapi * fix: update controller with no response for delete * fix: update codecov.yml * fix: codecov.yml * fix: add user test * fix: update openapi.yaml * fix: apply more test and user validation on calling ES termination function * fix: update error msg * fix: add lock for updating/write DDB item * fix: use workspace id as egress store id to aviod situation multiple egress store attached to one workspace. * fix: add s3-service test and update s3-service with error catch * fix: update pnpm-lock file * fix: update high_vul_threshold to 4 * fix: add test cases for s3 service * fix: fix lint issue of S3-service.test.js * fix: add list user test * fix: post deployment step check if egress store is enabled. * fix: shorten the workflowlooprunner role policy size * fix: update uppercase in post deployment step * fix: temp set high_vul_threshold to 4 * fix: update test of cfn stack policy updater * fix: update stack policy from empty stack policy * fix: resolve lint issue * fix: add unit test for updating stack policy * feat: Air gap EC2 and Sagemaker workspaces (awslabs#555) * feat: add object tagging functionality * fix: clean up test * fix: add egress test * fix: add s3 tests * fix: fix s3 tests * fix: add s3 service test and data-egress-serviice * feat: Allow creating new AppStream enabled account (awslabs#566) * feat: Story update connect (awslabs#571) * feat: adding logic to connect API * feat: adding scripts for firefox appstream * test: buildImage changes * test: launch params in abs path * fix: add missing space in launch params * fix: copy firefox ps script to App * feat: changing appstream stack name * feat: appstream returns dest url in connection * feat: adding UI changes for url scheme * fix: using isAppStreamEnabled flag * feat: update link in apsstream setup * code cleanup * chore: update lock file * fix: pull variable from env * fix: throw error for appstream resource not found * remove unreachable code * fix: workspace provision error when egressStoreIAMPolicyDocument is null * fix: add compute-platform-service test * feat: added backend code for connecting with Windows environments via AppStream (awslabs#576) * fix: Provision environment pulls namespace value from stack id (awslabs#575) * feat: Appstream connection updates (awslabs#578) * feat: editing UI components for appstream * feat: adding ec2linux ps1 file * fix: add ec2linux in buildImage * feat: update ec2linux ps1 location * feat: UI improvements appstream * testing changes * feat: adding UI changes for appstream * feat: changes per review * fix: single quotes to double * fix: update MobX observable in action * fix: mobx observable fix * update observables * fix: move egressStoreObjectHandler into postdeployment to avoid deployment with s3 bucket not found error * fix: test fix * fix: add compute-*-service tests * fix: add compute-price-service test * feat: appstream connect UI changes (awslabs#580) * fix: test coverage addition for appstream * feat: update instructions for appstream * feat: adding flag for list call * feat: adding appstream instruction * fix: add egress service tests * fix: serverless-plugin-ifelse dependency * feat: add notification * chore: Add provision account unit test (awslabs#572) * feat: add object list for egress store * fix: add db access for role:RoleEgressStoreObjectsHandler in post-deployment * fix: remove unused function in store * fix: fix data egress tests * fix: remove used data in UI * fix: lint * fix: lint * fix: lint and clean code * fix: lint issue in service and test * fix: add data-egress service * fix: add s3 tests * fix: lint in test * Update AppStream feat branch with latest code from develop (awslabs#585) * feat: AppStream code hardening (awslabs#583) * test: adding appstream unit tests * feat: adding unit tests for appstream URL plugin * fix: UI typo fix * feat: adding e2e tests for appstream instructions * test: optimizing e2e appstream tests * fix: potential dep vulnerabilities * fix: deployment with config * fix: data-egress service and tests * fix: remove console.log * fix: test * fix: lint * fix: tests for s3 service and data egress service * fix: s3-service tests * fix: s3 service to export api when init * feat: workspace provisioning mgmt (awslabs#594) * feat: env prov API update for appstream * feat: UI changes to verify proj appstream config * test: adding project service appstream tests * test: adding e2e test to verify create disabled * fix: changes per review * fix: await async methods (awslabs#599) * fix: prevent redundant looping (awslabs#600) * fix: unit test env connection & S3 service (awslabs#601) * fix: unit test env connection * fix: update s3 service to initiate S3 * feat: add disable BYOB when egress store feature is enabled * fix: add study service test * fix: lint * fix: using the string value of AppStream flag (awslabs#604) * Fix: ui and backend egress logic while terminating workspace * fix: data-egress service * fix: lint * feat: Restrict SageMaker presigned URL access to private VPC endpoint (awslabs#608) * fix: modify create-egress-store json validation * fix: hot fix for enable egress store submission * feat: post deploy appstream step (awslabs#612) * feat: add post dep step for appstream stack policy * test: adding unit tests update cfn policy * fix: changes per review * feat: Update Account page to use cards for Accounts. Update Account onboarding to use CFN template links. PRs: https://github.com/awslabs/service-workbench-on-aws/pulls?q=is%3Apr+author%3Aahl27+is%3Aclosed+APU * feat: Update APU feature to support onboarding and updating AppStream accounts (awslabs#606) * docs: onboarding account gali 1059 * docs: PR feedback addressed * fix: egress button submission error * fix: add egress store service tests * fix: lint issue * fix: get appstream setting optional bool (awslabs#633) * fix: get appstream setting optional bool * fix: changing optionalBoolean to getBoolean * fix: unit tests for getBoolean * undo potential merge conflict * feat: Disable CIDR feature when AppStream is enabled (awslabs#632) feat: Disable CIDR feature when AppStream is enabled * fix: egress store data access cross account * fix: add remove kms key policy unit test * fix: update kms policy when no study selected * fix: update method name to updateKMSPolicyForEgress * fix: Filter out empty CIDR blocks from security group details (awslabs#645) * fix: egress store should be terminated if it's not used after creation * fix: add error msg when error occurs in putting bucket policy * fix: lint issue * fix: edit error message * fix: lint * feat: Onboard instruction update (awslabs#647) * Update onboard account instructions * Trigger notification Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: edit bucket policy * fix: Various TRE bugfixes (awslabs#642) * fix: add pre-deployment * fix: add pre-deployment to delete environment * fix: lint * fix: minor egress update * fix: egress error message * fix: fix BYOB studies to work with SageMaker and EC2 Linux when AppStream is enabled (awslabs#658) * feat: Allow termination of non-appstream envs (awslabs#655) * feat: warn users to terminate non-appstream envs * feat: add check plugin for awsAccount APIs * fix: older unit tests * updated optionalBoolean to getBoolean in unit test * fix: changes per review * test: added unit tests for aws mgmt appstream * code cleanup * fix: remove unsed setting * fix: update error message in util function * fix: fix BYOB to work for EC2 Windows when AppStream is enabled (awslabs#662) * doc: adding pre-requisite info for appstream (awslabs#664) * doc: adding pre-requisite info for appstream * fix: Trigger Build * fix: lambda error (awslabs#670) * fix: account status check lambda * code cleanup * test: Split integration and E2E tests for AppStream/NonAppStream (awslabs#663) * test: connection url appstream (awslabs#673) * feat: adding appstream integ tests for connect URL * code cleanup * fix: changes per review * code cleanup * fix: Fix AccountOnboardingHandler to correctly check for non-AppStream environments (awslabs#677) * feat: adding Egress integ tests (awslabs#679) * feat: adding Egress integ tests * fix: code cleanup * change per review * test: Added appstream workspace tests (awslabs#671) * fix: Correct stage name for deploying TRE SWB (awslabs#681) * fix: Correct stage name for deploying TRE SWB * Second line Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Enable AppStream and Egress Store (awslabs#682) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Run AppStream version of the tests (awslabs#683) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Correct Appstream test command to pick up spec files (awslabs#684) * Rstudio AppStream integration (awslabs#678) * feat: Integrate RStudio workspaces with AppStream * chore: change condition for SSM endpoint to include custom domain presence * fix: open data lambda in appstream env (awslabs#687) * chore: Merge mainline into feat-secure-workspace-egress (awslabs#659) * fix: Use bucket region if available while mounting BYOB studies (awslabs#692) * fix: Allow Sagemaker Appstream workspaces to autostop (awslabs#689) * fix:Add AppStream param to envPollHandler error and allow Sagemaker instance access to Sagemaker API Endpoint * Remove commented out code Co-authored-by: Tim Nguyen <thingut@amazon.com> * test: Added infrastructure tests (awslabs#696) * fix: member account share appstream bug (awslabs#712) * fix: externalId requirement for add account form (awslabs#713) * fix: externalId requirement for add account form * test: adding unit test for add member account * fix: add required attribute to unit test * fix: remove hardcoded externalId string * feat: swb main study role (awslabs#710) * fix: enableEgressStore flag is boolean, not string (awslabs#715) * feat: Pull AppStream create connection test env id from config file (awslabs#718) Co-authored-by: Tim Nguyen <thingut@amazon.com> * feat: remove egress bucket pol (awslabs#720) * feat: removing egress bucket policy * test: adjusting unit tests for new business logic * fix: update main role prefix for workflow perms * add swb prefix for main study role in apiHandler * chore: Make Egress store function with roles and remove kms whitelisting of member accounts (awslabs#723) * fix: converting Egress flag from boolean to string bug (awslabs#730) * fix: Disable public IP address for Linux, Windows, and RStudio when AppStream is enabled(awslabs#731) * chore: Update aws-sdk to latest V2 version (awslabs#734) * Update Cypress tests to match tests from develop * Update integration test to include isAppStreamEnabled flag * Bump axios version for integratio test * Trigger notification * fix linting issues * Update test * chore: Merge develop and feat-egress-store-role into feat-secure-workspace-egress (awslabs#735) * feat: Create dedicated SGs for environment and interface endpoints (awslabs#736) * Revert "chore: Merge develop and feat-egress-store-role into feat-secure-workspace-egress (awslabs#735)" This reverts commit 40d54e8. * feat: Fetch egress store data by id instead of using a scan (awslabs#741) * fix: Delete egress role in workflow instead of API (awslabs#740) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Remove PolicyWorkflowLoopRunner DependsOn PermissionBoundaryPolicyStudyBucket * WIP: Allow shareAppStreamImage for update accoutn request * Update tests * Fix typos * Update AppStream egress disabled tests * chore: update docs and script to reference * docs: egress docs (awslabs#742) * docs: egress docs * Fix prepare_master_account file and remove yarn.lock file * docs: post deployment guide updates * docs: pr review * docs: spelling correction * docs: new post depl guide * docs: new post depl manual Co-authored-by: Sharma <shyogesh@88665a06ebc4.ant.amazon.com> Co-authored-by: Tim Nguyen <thingut@amazon.com> * docs: Minor comment updates and add copyright headers (awslabs#751) Co-authored-by: Xian Zhang <zhaxan@amazon.com> Co-authored-by: Tim Nguyen <nguyen102@users.noreply.github.com> Co-authored-by: ahl27 <lakaidan@amazon.com> Co-authored-by: Aidan Lakshman <aidanlakshman@gmail.com> Co-authored-by: Robert Smayda <smayda44@gmail.com> Co-authored-by: Sanket Dharwadkar <sdharwad@amazon.com> Co-authored-by: shyogesh-sw <79225266+shyogesh-sw@users.noreply.github.com> Co-authored-by: Yanyu Zheng <yz2690@columbia.edu> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tim Nguyen <thingut@amazon.com> Co-authored-by: zhaxan <25250067+MBtea@users.noreply.github.com> Co-authored-by: Aidan Lakshman <ahl27@pitt.edu> Co-authored-by: Yogesh Sharma <shyogesh@amazon.com> Co-authored-by: Marianna Ghirardelli <43092418+maghirardelli@users.noreply.github.com> Co-authored-by: Sharma <shyogesh@88665a06ebc4.ant.amazon.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue #, if available:
Description of changes:
Removed external dependencies and put them into the
environment-filesfolder in S3.These are the dependencies placed into the S3 folder.
Dependencies for Sagemaker and Ec2-Linux
Dependencies for Sagemaker
Dependencies for EC2-Linux
Network Configuration
EC2-Linux and EC2-Windows requires access to Cloudformation Private Endpoint to signal that they have successfully finished their
goofyssetup script. This allows Cloudformation to mark their respective stack asSuccessfully CreatedTo allow these respective workspace access to Cloudformation Endpoint, we need these workspaces to set their Security group outbound rules to point to the CF Endpoint's security group. We also need the CF Endpoint to set their Security group inbound rules to be the workspace SG.
To accomplish this we've set up this network topology.
EC2 Linux/ EC2 Windows Workspace has
DefaultSGandCustomSGattached to itCFN SGCFN Endpoint has
CFN SGattached to itDefaultSGBy attaching the
DefaultSGto the workspaces we can have CFN endpoint point to the workspaces when the CFN Endpoint is initially created.To allow AppStream to connect to ec2 instances
EC2 Linux/ EC2 Windows Workspace has
DefaultSGandCustomSGattached to itAppStreamSGAppStream has
AppStreamSGattached to itDefaultSGBy attaching the
DefaultSGto the workspaces we can have AppStream allow access to the workspaces when AppStream resources are initially created duringonboard-account.We export
CFN Security Group,Default SG, andAppStreamSGin the Cloudformation stack to make it easy for the workspaces to consume these variables.Testing
Manually created new Cloudformation stacks with ec2-window, ec2-linux, and sagemaker Cloudformation templates. These stacks were placed in the Private AppStream Workspace. I then logged into each of these workspaces and tested that they didn't have internet access but were able to access S3 studies.
Checklist:
AS review ticket id:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.