fix: Various TRE bugfixes #642

nguyen102 · 2021-08-06T20:27:27Z

Issue #, if available:

Description of changes:

List of bug fixes below

Unable to launch linux workspaces with AppStream is turned off
When removing CIDR from AppStream enabled workspaces, our validator failed because it expects the CIDR field
When user try to view a workspace by clicking Connect there is no sign the the connection is happening because the Connect button does not change to the "loading" state
User needs to turn off popup blocker for the domain so we can open a new AppStream tab for them. Instructions is added for users.
When AppStream is turned off, we're still asking users for AppStream specific configs
We don't need to ask users IsAppStreamEnabled. We should be pulling that from our settings file.
Checklist:

Have you successfully deployed to an AWS account with your changes?

AS review ticket id:

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

nguyen102 · 2021-08-06T20:27:50Z

addons/addon-base-raas-ui/packages/base-raas-ui/src/models/forms/AddUpdateAwsAccountForm.js

@@ -36,13 +36,14 @@ const addUpdateBaseAwsAccountFormFields = {
 const addUpdateAwsAccountAppStreamFormFields = {
  appStreamFleetDesiredInstances: {
    label: 'AppStream Fleet Desired Instance',
-    placeholder: 'Number of users that can concurrently access a workspace through AppStream',
+    placeholder:


Various text enhancements suggested by Jolie

nguyen102 · 2021-08-06T20:30:04Z

...ckages/base-raas-services/lib/environment/service-catalog/environment-config-vars-service.js

-    if (enableEgressStore && enableEgressStore.toUpperCase() === 'TRUE') {
-      result.egressStoreIamPolicyDocument = JSON.stringify(egressStoreIamPolicyDocument);
-    }
+    result.egressStoreIamPolicyDocument = JSON.stringify(egressStoreIamPolicyDocument);


Our workspace cfn template expect a value for this attribute, and will error out if we don't provide it. If the attribute is {} then EgressPolicy is not added. Incase where Egress is turned off, the egressStoreIamPolicyDocument will be {}

nguyen102 · 2021-08-06T20:30:44Z

addons/addon-base-raas/packages/base-raas-services/lib/schema/create-egress-store.json

@@ -100,7 +100,6 @@
    "rev",
    "inWorkflow",
    "status",


With Jeet's change of removing CIDR from AppStream enabled accounts, we don't always pass in cidr. Therefore we need to remove it from here, or it will cause a validation error.

Can cidr be completely removed? I wonder why egress store needs it.

codecov · 2021-08-06T20:31:41Z

Codecov Report

Merging #642 (25c0159) into feat-secure-workspace-egress (eadde76) will increase coverage by 0.05%.
The diff coverage is n/a.

@@                       Coverage Diff                        @@
##           feat-secure-workspace-egress     #642      +/-   ##
================================================================
+ Coverage                         51.98%   52.03%   +0.05%     
================================================================
  Files                               260      260              
  Lines                             14109    14127      +18     
  Branches                           2210     2211       +1     
================================================================
+ Hits                               7334     7351      +17     
- Misses                             5943     5944       +1     
  Partials                            832      832

Impacted Files	Coverage Δ
...service-catalog/environment-config-vars-service.js	`81.05% <0.00%> (-0.20%)`	⬇️
src/models/forms/CfnParamsForm.js	`100.00% <0.00%> (ø)`
src/models/forms/CreateAwsAccountForm.js	`75.00% <0.00%> (ø)`
src/models/forms/AddUpdateAwsAccountForm.js	`75.00% <0.00%> (ø)`
lib/data-egress/data-egress-service.js	`96.37% <0.00%> (+0.01%)`	⬆️
...ironment/service-catalog/environment-sc-service.js	`71.68% <0.00%> (+0.06%)`	⬆️
lib/helpers/utils.js	`67.76% <0.00%> (+0.26%)`	⬆️
lib/environment-type/env-type-config-service.js	`69.73% <0.00%> (+1.65%)`	⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 146406f...25c0159. Read the comment docs.

nguyen102 · 2021-08-06T20:34:01Z

...-api/packages/environment-type-mgmt-services/lib/environment-type/env-type-config-service.js

@@ -241,6 +240,33 @@ class EnvTypeConfigService extends Service {
    return savedConfig;
  }

+  async checkAndUpdateParams(envType, config) {


Setting default values for the env params, depending on if AppStream is turned on or not.

jn1119 · 2021-08-09T19:20:16Z

...-api/packages/environment-type-mgmt-services/lib/environment-type/env-type-config-service.js

+    if (isAppStreamEnabled) {
+      params.push({
+        key: 'AccessFromCIDRBlock',
+        value: '',
+      });
+    } else {


I guess this is ok but was wondering if this is required if all the templates have a default value already?

The validation of the fields will fail if we don't provide an attribute for them, which is why we're setting the values here. But yes, an alternative is to remove these fields from the validation schema and set default values in all of the templates.

Yeah, that's what I meant. I think all the templates have a default value for AccessFromCIDRBlock so the validation shouldn't fail. I approved your change though since this seemed a minor point.

jn1119 · 2021-08-10T02:52:59Z

...nvironment-type-mgmt-services/lib/environment-type/__tests__/env-type-config-service.test.js

+      if (settingKey === 'isAppStreamEnabled') {
+        return true;
+      }
+      return undefined;


throw error instead to replicate the settingsService?

jn1119 · 2021-08-10T03:01:45Z

.../addon-environment-sc-ui/packages/environment-type-mgmt-ui/src/models/forms/CfnParamsForm.js

+    } else {
+      keysToFilterOut.push('EgressStoreIamPolicyDocument');
+      keysToFilterOut.push('SolutionNamespace');
+    }


I didn't quite get why EgressStoreIamPolicyDocument and SolutionNamespace need to be filtered out only if AppStream is disabled.

Is there an advantage of making SolutionNamespace configurable when we are deriving it anyways from stackId.

EgressStoreIamPolicyDocument seems like something that should either not be configurable or only show up when egress config is enabled.

Also update unit tests for this method?

Good point. Let's not make EgressStoreIamPolicyDocument and SolutionNamespace configurable by the customer.

I'll also update the unit test.

jn1119 · 2021-08-10T03:03:04Z

scripts/app-stream/SETUP.md

@@ -29,7 +29,7 @@ Note: Please set up your [AWS Profile](https://docs.aws.amazon.com/cli/latest/us
 cd ~\Documents

 # Pull the Image Builder script from Github
-Invoke-WebRequest -Uri https://raw.githubusercontent.com/awslabs/service-workbench-on-aws/mainline/scripts/app-stream/buildImage.ps1 -OutFile buildImage.ps1
+Invoke-WebRequest -Uri https://raw.githubusercontent.com/awslabs/service-workbench-on-aws/feat-secure-workspace-egress/scripts/app-stream/buildImage.ps1 -OutFile buildImage.ps1


make sure we add a task to change it back to mainline when releasing

let me add todos for these

jn1119 · 2021-08-10T03:06:06Z

.../addon-environment-sc-ui/packages/environment-type-mgmt-ui/src/models/forms/CfnParamsForm.js

+    const keysToFilterOut = ['IsAppStreamEnabled'];
+    if (isAppStreamEnabled) {
+      keysToFilterOut.push('AccessFromCIDRBlock');
+    } else {
+      keysToFilterOut.push('EgressStoreIamPolicyDocument');
+      keysToFilterOut.push('SolutionNamespace');
+    }


Seems like this can be defined outside the filter

jn1119 · 2021-08-10T03:06:56Z

.../addon-environment-sc-ui/packages/environment-type-mgmt-ui/src/models/forms/CfnParamsForm.js

  const fields = {};
-  _.forEach(cfnParams, ({ ParameterKey, Description, DefaultValue }) => {
+  filteredCfnParams.forEach(({ ParameterKey, Description, DefaultValue }) => {
    const existingValue = _.get(_.find(existingParamValues, { key: ParameterKey }), 'value') || DefaultValue;
    if (!isAppStreamEnabled || (isAppStreamEnabled && !(ParameterKey === 'AccessFromCIDRBlock'))) {


seems like ParameterKey === 'AccessFromCIDRBlock' can be removed now?

* Add Egress Store Toggle Setting * feat: Add iEgress Store Toggle Setting * feat: GALI-933 and GALI-934 add UI changes for egress store request submission and potential error * minor comment fix * fix: data-egress-controller lint issue * docs: Update docs to specify Packer version 1.6.0 (#484) * fix: adds 'stopped' filter for workspaces * bulkUserAdd API bugfix (#490) * fix: bug in openapi.yaml introduced in previous PR with unescaped asterisk causing malformed YAML file * fix: adds validation checks and more informative error messages for bulk-add-users API call. * fix: added unit and integration tests for changes * fix: moved notification boxes to avoid blocking the top ribbon. (#483) * chore: Update UI to show 3.1 (#493) * chore: Update issue templates (#487) * chore: Update issue templates * Trigger notification * fix: changes per review Co-authored-by: Robert Smayda <smayda44@gmail.com> * fix: Redirect non admin users to "/" if they try to access "/users" (#489) * chore: update PR checklist (#494) * chore: Add GH action to check for dependency vulnerabilities (#498) * fix: react compilation error (#500) * docs: hyperlink corrections (#497) * <docs: added hyperlinks in packer readme> * Revert "<docs: added hyperlinks in packer readme>" This reverts commit 501b7de. * docs: corrected the hyperlinks * feat: study permissions only shown to Study Admin (#501) * fix: add termination status for non-found workspaces (#502) * fix: Do not allow users to change root password (#503) * chore: docs dependency fix (#505) * chore(deps): bump dns-packet from 1.3.1 to 1.3.4 in /docs (#507) * chore(deps): bump dns-packet from 1.3.1 to 1.3.4 in /docs Bumps [dns-packet](https://github.com/mafintosh/dns-packet) from 1.3.1 to 1.3.4. - [Release notes](https://github.com/mafintosh/dns-packet/releases) - [Changelog](https://github.com/mafintosh/dns-packet/blob/master/CHANGELOG.md) - [Commits](mafintosh/dns-packet@v1.3.1...v1.3.4) Signed-off-by: dependabot[bot] <support@github.com> * feat: Add warning that internal authentication shouldn't be used in production (#506) * feat: Encrypt s3 buckets for EMR log bucket and CICD Artifact bucket (#508) * chore: Disable EBS volume for storage gateway (#511) Co-authored-by: Tim Nguyen <thingut@amazon.com> * chore: Add encryption to CICD SNS topic (#512) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: minor UI fix, add demo info * fix: remove console output and message update * feat: App Stream vpc (#523) * feat: [feat-secure-workspace-egress] GALI-884 Backend Egress Store Initiation (#510) * update Service Catalog template * add Egress Store init function when workspace is created * fix: data-egress-service lint * fix: environment-config-var-service.test testing with data-egress-service as dependency * fix: move reusable function into utiil * fix: update create-egress-store.json schema validation * fix: remove duplicate function in environment-resource-service.js * fix: update egress store resource config and update pnpm-lock * fix: add unit test of data egress service * fix: rephrase config note * fix: add more unit test for data egress service Co-authored-by: Xian Zhang <zhaxan@amazon.com> Co-authored-by: Jeet <68876606+jn1119@users.noreply.github.com> * feat: addon-egress-store-stack-policy * fix: lint in unit test * fix: add enableEgressStore in setting file * fix: store lint issue * feat: Extend account onboarding template to include AppStream resources (#539) * feat: Add image builder scripts (#541) * fix: remove redundant policy code * fix: change addon name to general name and update config explanation * fix: update pnpm-lock file * Minor changes to .defaults.yml * docs: Minor doc changes to example.yml * chore: delete terminate-egress-store.json * feat: add egress store termination * fix: update openapi * fix: update controller with no response for delete * fix: update codecov.yml * fix: codecov.yml * fix: add user test * fix: update openapi.yaml * fix: apply more test and user validation on calling ES termination function * fix: update error msg * fix: add lock for updating/write DDB item * fix: use workspace id as egress store id to aviod situation multiple egress store attached to one workspace. * fix: add s3-service test and update s3-service with error catch * fix: update pnpm-lock file * fix: update high_vul_threshold to 4 * fix: add test cases for s3 service * fix: fix lint issue of S3-service.test.js * fix: add list user test * fix: post deployment step check if egress store is enabled. * fix: shorten the workflowlooprunner role policy size * fix: update uppercase in post deployment step * fix: temp set high_vul_threshold to 4 * fix: update test of cfn stack policy updater * fix: update stack policy from empty stack policy * fix: resolve lint issue * fix: add unit test for updating stack policy * feat: Air gap EC2 and Sagemaker workspaces (#555) * feat: add object tagging functionality * fix: clean up test * fix: add egress test * fix: add s3 tests * fix: fix s3 tests * fix: add s3 service test and data-egress-serviice * feat: Allow creating new AppStream enabled account (#566) * feat: Story update connect (#571) * feat: adding logic to connect API * feat: adding scripts for firefox appstream * test: buildImage changes * test: launch params in abs path * fix: add missing space in launch params * fix: copy firefox ps script to App * feat: changing appstream stack name * feat: appstream returns dest url in connection * feat: adding UI changes for url scheme * fix: using isAppStreamEnabled flag * feat: update link in apsstream setup * code cleanup * chore: update lock file * fix: pull variable from env * fix: throw error for appstream resource not found * remove unreachable code * fix: workspace provision error when egressStoreIAMPolicyDocument is null * fix: add compute-platform-service test * feat: added backend code for connecting with Windows environments via AppStream (#576) * fix: Provision environment pulls namespace value from stack id (#575) * feat: Appstream connection updates (#578) * feat: editing UI components for appstream * feat: adding ec2linux ps1 file * fix: add ec2linux in buildImage * feat: update ec2linux ps1 location * feat: UI improvements appstream * testing changes * feat: adding UI changes for appstream * feat: changes per review * fix: single quotes to double * fix: update MobX observable in action * fix: mobx observable fix * update observables * fix: move egressStoreObjectHandler into postdeployment to avoid deployment with s3 bucket not found error * fix: test fix * fix: add compute-*-service tests * fix: add compute-price-service test * feat: appstream connect UI changes (#580) * fix: test coverage addition for appstream * feat: update instructions for appstream * feat: adding flag for list call * feat: adding appstream instruction * fix: add egress service tests * fix: serverless-plugin-ifelse dependency * feat: add notification * chore: Add provision account unit test (#572) * feat: add object list for egress store * fix: add db access for role:RoleEgressStoreObjectsHandler in post-deployment * fix: remove unused function in store * fix: fix data egress tests * fix: remove used data in UI * fix: lint * fix: lint * fix: lint and clean code * fix: lint issue in service and test * fix: add data-egress service * fix: add s3 tests * fix: lint in test * Update AppStream feat branch with latest code from develop (#585) * feat: AppStream code hardening (#583) * test: adding appstream unit tests * feat: adding unit tests for appstream URL plugin * fix: UI typo fix * feat: adding e2e tests for appstream instructions * test: optimizing e2e appstream tests * fix: potential dep vulnerabilities * fix: deployment with config * fix: data-egress service and tests * fix: remove console.log * fix: test * fix: lint * fix: tests for s3 service and data egress service * fix: s3-service tests * fix: s3 service to export api when init * feat: workspace provisioning mgmt (#594) * feat: env prov API update for appstream * feat: UI changes to verify proj appstream config * test: adding project service appstream tests * test: adding e2e test to verify create disabled * fix: changes per review * fix: await async methods (#599) * fix: prevent redundant looping (#600) * fix: unit test env connection & S3 service (#601) * fix: unit test env connection * fix: update s3 service to initiate S3 * feat: add disable BYOB when egress store feature is enabled * fix: add study service test * fix: lint * fix: using the string value of AppStream flag (#604) * Fix: ui and backend egress logic while terminating workspace * fix: data-egress service * fix: lint * feat: Restrict SageMaker presigned URL access to private VPC endpoint (#608) * fix: modify create-egress-store json validation * fix: hot fix for enable egress store submission * feat: post deploy appstream step (#612) * feat: add post dep step for appstream stack policy * test: adding unit tests update cfn policy * fix: changes per review * feat: Update Account page to use cards for Accounts. Update Account onboarding to use CFN template links. PRs: https://github.com/awslabs/service-workbench-on-aws/pulls?q=is%3Apr+author%3Aahl27+is%3Aclosed+APU * feat: Update APU feature to support onboarding and updating AppStream accounts (#606) * docs: onboarding account gali 1059 * docs: PR feedback addressed * fix: egress button submission error * fix: add egress store service tests * fix: lint issue * fix: get appstream setting optional bool (#633) * fix: get appstream setting optional bool * fix: changing optionalBoolean to getBoolean * fix: unit tests for getBoolean * undo potential merge conflict * feat: Disable CIDR feature when AppStream is enabled (#632) feat: Disable CIDR feature when AppStream is enabled * fix: egress store data access cross account * fix: add remove kms key policy unit test * fix: update kms policy when no study selected * fix: update method name to updateKMSPolicyForEgress * fix: Filter out empty CIDR blocks from security group details (#645) * fix: egress store should be terminated if it's not used after creation * fix: add error msg when error occurs in putting bucket policy * fix: lint issue * fix: edit error message * fix: lint * feat: Onboard instruction update (#647) * Update onboard account instructions * Trigger notification Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: edit bucket policy * fix: Various TRE bugfixes (#642) * fix: add pre-deployment * fix: add pre-deployment to delete environment * fix: lint * fix: minor egress update * fix: egress error message * fix: fix BYOB studies to work with SageMaker and EC2 Linux when AppStream is enabled (#658) * feat: Allow termination of non-appstream envs (#655) * feat: warn users to terminate non-appstream envs * feat: add check plugin for awsAccount APIs * fix: older unit tests * updated optionalBoolean to getBoolean in unit test * fix: changes per review * test: added unit tests for aws mgmt appstream * code cleanup * fix: remove unsed setting * fix: update error message in util function * fix: fix BYOB to work for EC2 Windows when AppStream is enabled (#662) * doc: adding pre-requisite info for appstream (#664) * doc: adding pre-requisite info for appstream * fix: Trigger Build * fix: lambda error (#670) * fix: account status check lambda * code cleanup * test: Split integration and E2E tests for AppStream/NonAppStream (#663) * test: connection url appstream (#673) * feat: adding appstream integ tests for connect URL * code cleanup * fix: changes per review * code cleanup * fix: Fix AccountOnboardingHandler to correctly check for non-AppStream environments (#677) * feat: adding Egress integ tests (#679) * feat: adding Egress integ tests * fix: code cleanup * change per review * test: Added appstream workspace tests (#671) * fix: Correct stage name for deploying TRE SWB (#681) * fix: Correct stage name for deploying TRE SWB * Second line Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Enable AppStream and Egress Store (#682) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Run AppStream version of the tests (#683) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Correct Appstream test command to pick up spec files (#684) * Rstudio AppStream integration (#678) * feat: Integrate RStudio workspaces with AppStream * chore: change condition for SSM endpoint to include custom domain presence * fix: open data lambda in appstream env (#687) * chore: Merge mainline into feat-secure-workspace-egress (#659) * fix: Use bucket region if available while mounting BYOB studies (#692) * fix: Allow Sagemaker Appstream workspaces to autostop (#689) * fix:Add AppStream param to envPollHandler error and allow Sagemaker instance access to Sagemaker API Endpoint * Remove commented out code Co-authored-by: Tim Nguyen <thingut@amazon.com> * test: Added infrastructure tests (#696) * fix: member account share appstream bug (#712) * fix: externalId requirement for add account form (#713) * fix: externalId requirement for add account form * test: adding unit test for add member account * fix: add required attribute to unit test * fix: remove hardcoded externalId string * feat: swb main study role (#710) * fix: enableEgressStore flag is boolean, not string (#715) * feat: Pull AppStream create connection test env id from config file (#718) Co-authored-by: Tim Nguyen <thingut@amazon.com> * feat: remove egress bucket pol (#720) * feat: removing egress bucket policy * test: adjusting unit tests for new business logic * fix: update main role prefix for workflow perms * add swb prefix for main study role in apiHandler * chore: Make Egress store function with roles and remove kms whitelisting of member accounts (#723) * fix: converting Egress flag from boolean to string bug (#730) * fix: Disable public IP address for Linux, Windows, and RStudio when AppStream is enabled(#731) * chore: Update aws-sdk to latest V2 version (#734) * Update Cypress tests to match tests from develop * Update integration test to include isAppStreamEnabled flag * Bump axios version for integratio test * Trigger notification * fix linting issues * Update test * chore: Merge develop and feat-egress-store-role into feat-secure-workspace-egress (#735) * feat: Create dedicated SGs for environment and interface endpoints (#736) * Revert "chore: Merge develop and feat-egress-store-role into feat-secure-workspace-egress (#735)" This reverts commit 40d54e8. * feat: Fetch egress store data by id instead of using a scan (#741) * fix: Delete egress role in workflow instead of API (#740) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Remove PolicyWorkflowLoopRunner DependsOn PermissionBoundaryPolicyStudyBucket * WIP: Allow shareAppStreamImage for update accoutn request * Update tests * Fix typos * Update AppStream egress disabled tests * chore: update docs and script to reference * docs: egress docs (#742) * docs: egress docs * Fix prepare_master_account file and remove yarn.lock file * docs: post deployment guide updates * docs: pr review * docs: spelling correction * docs: new post depl guide * docs: new post depl manual Co-authored-by: Sharma <shyogesh@88665a06ebc4.ant.amazon.com> Co-authored-by: Tim Nguyen <thingut@amazon.com> * docs: Minor comment updates and add copyright headers (#751) Co-authored-by: Xian Zhang <zhaxan@amazon.com> Co-authored-by: Tim Nguyen <nguyen102@users.noreply.github.com> Co-authored-by: ahl27 <lakaidan@amazon.com> Co-authored-by: Aidan Lakshman <aidanlakshman@gmail.com> Co-authored-by: Robert Smayda <smayda44@gmail.com> Co-authored-by: Sanket Dharwadkar <sdharwad@amazon.com> Co-authored-by: shyogesh-sw <79225266+shyogesh-sw@users.noreply.github.com> Co-authored-by: Yanyu Zheng <yz2690@columbia.edu> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tim Nguyen <thingut@amazon.com> Co-authored-by: zhaxan <25250067+MBtea@users.noreply.github.com> Co-authored-by: Aidan Lakshman <ahl27@pitt.edu> Co-authored-by: Yogesh Sharma <shyogesh@amazon.com> Co-authored-by: Marianna Ghirardelli <43092418+maghirardelli@users.noreply.github.com> Co-authored-by: Sharma <shyogesh@88665a06ebc4.ant.amazon.com>

* Add Egress Store Toggle Setting * feat: Add iEgress Store Toggle Setting * feat: GALI-933 and GALI-934 add UI changes for egress store request submission and potential error * minor comment fix * fix: data-egress-controller lint issue * docs: Update docs to specify Packer version 1.6.0 (awslabs#484) * fix: adds 'stopped' filter for workspaces * bulkUserAdd API bugfix (awslabs#490) * fix: bug in openapi.yaml introduced in previous PR with unescaped asterisk causing malformed YAML file * fix: adds validation checks and more informative error messages for bulk-add-users API call. * fix: added unit and integration tests for changes * fix: moved notification boxes to avoid blocking the top ribbon. (awslabs#483) * chore: Update UI to show 3.1 (awslabs#493) * chore: Update issue templates (awslabs#487) * chore: Update issue templates * Trigger notification * fix: changes per review Co-authored-by: Robert Smayda <smayda44@gmail.com> * fix: Redirect non admin users to "/" if they try to access "/users" (awslabs#489) * chore: update PR checklist (awslabs#494) * chore: Add GH action to check for dependency vulnerabilities (awslabs#498) * fix: react compilation error (awslabs#500) * docs: hyperlink corrections (awslabs#497) * <docs: added hyperlinks in packer readme> * Revert "<docs: added hyperlinks in packer readme>" This reverts commit 501b7de. * docs: corrected the hyperlinks * feat: study permissions only shown to Study Admin (awslabs#501) * fix: add termination status for non-found workspaces (awslabs#502) * fix: Do not allow users to change root password (awslabs#503) * chore: docs dependency fix (awslabs#505) * chore(deps): bump dns-packet from 1.3.1 to 1.3.4 in /docs (awslabs#507) * chore(deps): bump dns-packet from 1.3.1 to 1.3.4 in /docs Bumps [dns-packet](https://github.com/mafintosh/dns-packet) from 1.3.1 to 1.3.4. - [Release notes](https://github.com/mafintosh/dns-packet/releases) - [Changelog](https://github.com/mafintosh/dns-packet/blob/master/CHANGELOG.md) - [Commits](mafintosh/dns-packet@v1.3.1...v1.3.4) Signed-off-by: dependabot[bot] <support@github.com> * feat: Add warning that internal authentication shouldn't be used in production (awslabs#506) * feat: Encrypt s3 buckets for EMR log bucket and CICD Artifact bucket (awslabs#508) * chore: Disable EBS volume for storage gateway (awslabs#511) Co-authored-by: Tim Nguyen <thingut@amazon.com> * chore: Add encryption to CICD SNS topic (awslabs#512) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: minor UI fix, add demo info * fix: remove console output and message update * feat: App Stream vpc (awslabs#523) * feat: [feat-secure-workspace-egress] GALI-884 Backend Egress Store Initiation (awslabs#510) * update Service Catalog template * add Egress Store init function when workspace is created * fix: data-egress-service lint * fix: environment-config-var-service.test testing with data-egress-service as dependency * fix: move reusable function into utiil * fix: update create-egress-store.json schema validation * fix: remove duplicate function in environment-resource-service.js * fix: update egress store resource config and update pnpm-lock * fix: add unit test of data egress service * fix: rephrase config note * fix: add more unit test for data egress service Co-authored-by: Xian Zhang <zhaxan@amazon.com> Co-authored-by: Jeet <68876606+jn1119@users.noreply.github.com> * feat: addon-egress-store-stack-policy * fix: lint in unit test * fix: add enableEgressStore in setting file * fix: store lint issue * feat: Extend account onboarding template to include AppStream resources (awslabs#539) * feat: Add image builder scripts (awslabs#541) * fix: remove redundant policy code * fix: change addon name to general name and update config explanation * fix: update pnpm-lock file * Minor changes to .defaults.yml * docs: Minor doc changes to example.yml * chore: delete terminate-egress-store.json * feat: add egress store termination * fix: update openapi * fix: update controller with no response for delete * fix: update codecov.yml * fix: codecov.yml * fix: add user test * fix: update openapi.yaml * fix: apply more test and user validation on calling ES termination function * fix: update error msg * fix: add lock for updating/write DDB item * fix: use workspace id as egress store id to aviod situation multiple egress store attached to one workspace. * fix: add s3-service test and update s3-service with error catch * fix: update pnpm-lock file * fix: update high_vul_threshold to 4 * fix: add test cases for s3 service * fix: fix lint issue of S3-service.test.js * fix: add list user test * fix: post deployment step check if egress store is enabled. * fix: shorten the workflowlooprunner role policy size * fix: update uppercase in post deployment step * fix: temp set high_vul_threshold to 4 * fix: update test of cfn stack policy updater * fix: update stack policy from empty stack policy * fix: resolve lint issue * fix: add unit test for updating stack policy * feat: Air gap EC2 and Sagemaker workspaces (awslabs#555) * feat: add object tagging functionality * fix: clean up test * fix: add egress test * fix: add s3 tests * fix: fix s3 tests * fix: add s3 service test and data-egress-serviice * feat: Allow creating new AppStream enabled account (awslabs#566) * feat: Story update connect (awslabs#571) * feat: adding logic to connect API * feat: adding scripts for firefox appstream * test: buildImage changes * test: launch params in abs path * fix: add missing space in launch params * fix: copy firefox ps script to App * feat: changing appstream stack name * feat: appstream returns dest url in connection * feat: adding UI changes for url scheme * fix: using isAppStreamEnabled flag * feat: update link in apsstream setup * code cleanup * chore: update lock file * fix: pull variable from env * fix: throw error for appstream resource not found * remove unreachable code * fix: workspace provision error when egressStoreIAMPolicyDocument is null * fix: add compute-platform-service test * feat: added backend code for connecting with Windows environments via AppStream (awslabs#576) * fix: Provision environment pulls namespace value from stack id (awslabs#575) * feat: Appstream connection updates (awslabs#578) * feat: editing UI components for appstream * feat: adding ec2linux ps1 file * fix: add ec2linux in buildImage * feat: update ec2linux ps1 location * feat: UI improvements appstream * testing changes * feat: adding UI changes for appstream * feat: changes per review * fix: single quotes to double * fix: update MobX observable in action * fix: mobx observable fix * update observables * fix: move egressStoreObjectHandler into postdeployment to avoid deployment with s3 bucket not found error * fix: test fix * fix: add compute-*-service tests * fix: add compute-price-service test * feat: appstream connect UI changes (awslabs#580) * fix: test coverage addition for appstream * feat: update instructions for appstream * feat: adding flag for list call * feat: adding appstream instruction * fix: add egress service tests * fix: serverless-plugin-ifelse dependency * feat: add notification * chore: Add provision account unit test (awslabs#572) * feat: add object list for egress store * fix: add db access for role:RoleEgressStoreObjectsHandler in post-deployment * fix: remove unused function in store * fix: fix data egress tests * fix: remove used data in UI * fix: lint * fix: lint * fix: lint and clean code * fix: lint issue in service and test * fix: add data-egress service * fix: add s3 tests * fix: lint in test * Update AppStream feat branch with latest code from develop (awslabs#585) * feat: AppStream code hardening (awslabs#583) * test: adding appstream unit tests * feat: adding unit tests for appstream URL plugin * fix: UI typo fix * feat: adding e2e tests for appstream instructions * test: optimizing e2e appstream tests * fix: potential dep vulnerabilities * fix: deployment with config * fix: data-egress service and tests * fix: remove console.log * fix: test * fix: lint * fix: tests for s3 service and data egress service * fix: s3-service tests * fix: s3 service to export api when init * feat: workspace provisioning mgmt (awslabs#594) * feat: env prov API update for appstream * feat: UI changes to verify proj appstream config * test: adding project service appstream tests * test: adding e2e test to verify create disabled * fix: changes per review * fix: await async methods (awslabs#599) * fix: prevent redundant looping (awslabs#600) * fix: unit test env connection & S3 service (awslabs#601) * fix: unit test env connection * fix: update s3 service to initiate S3 * feat: add disable BYOB when egress store feature is enabled * fix: add study service test * fix: lint * fix: using the string value of AppStream flag (awslabs#604) * Fix: ui and backend egress logic while terminating workspace * fix: data-egress service * fix: lint * feat: Restrict SageMaker presigned URL access to private VPC endpoint (awslabs#608) * fix: modify create-egress-store json validation * fix: hot fix for enable egress store submission * feat: post deploy appstream step (awslabs#612) * feat: add post dep step for appstream stack policy * test: adding unit tests update cfn policy * fix: changes per review * feat: Update Account page to use cards for Accounts. Update Account onboarding to use CFN template links. PRs: https://github.com/awslabs/service-workbench-on-aws/pulls?q=is%3Apr+author%3Aahl27+is%3Aclosed+APU * feat: Update APU feature to support onboarding and updating AppStream accounts (awslabs#606) * docs: onboarding account gali 1059 * docs: PR feedback addressed * fix: egress button submission error * fix: add egress store service tests * fix: lint issue * fix: get appstream setting optional bool (awslabs#633) * fix: get appstream setting optional bool * fix: changing optionalBoolean to getBoolean * fix: unit tests for getBoolean * undo potential merge conflict * feat: Disable CIDR feature when AppStream is enabled (awslabs#632) feat: Disable CIDR feature when AppStream is enabled * fix: egress store data access cross account * fix: add remove kms key policy unit test * fix: update kms policy when no study selected * fix: update method name to updateKMSPolicyForEgress * fix: Filter out empty CIDR blocks from security group details (awslabs#645) * fix: egress store should be terminated if it's not used after creation * fix: add error msg when error occurs in putting bucket policy * fix: lint issue * fix: edit error message * fix: lint * feat: Onboard instruction update (awslabs#647) * Update onboard account instructions * Trigger notification Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: edit bucket policy * fix: Various TRE bugfixes (awslabs#642) * fix: add pre-deployment * fix: add pre-deployment to delete environment * fix: lint * fix: minor egress update * fix: egress error message * fix: fix BYOB studies to work with SageMaker and EC2 Linux when AppStream is enabled (awslabs#658) * feat: Allow termination of non-appstream envs (awslabs#655) * feat: warn users to terminate non-appstream envs * feat: add check plugin for awsAccount APIs * fix: older unit tests * updated optionalBoolean to getBoolean in unit test * fix: changes per review * test: added unit tests for aws mgmt appstream * code cleanup * fix: remove unsed setting * fix: update error message in util function * fix: fix BYOB to work for EC2 Windows when AppStream is enabled (awslabs#662) * doc: adding pre-requisite info for appstream (awslabs#664) * doc: adding pre-requisite info for appstream * fix: Trigger Build * fix: lambda error (awslabs#670) * fix: account status check lambda * code cleanup * test: Split integration and E2E tests for AppStream/NonAppStream (awslabs#663) * test: connection url appstream (awslabs#673) * feat: adding appstream integ tests for connect URL * code cleanup * fix: changes per review * code cleanup * fix: Fix AccountOnboardingHandler to correctly check for non-AppStream environments (awslabs#677) * feat: adding Egress integ tests (awslabs#679) * feat: adding Egress integ tests * fix: code cleanup * change per review * test: Added appstream workspace tests (awslabs#671) * fix: Correct stage name for deploying TRE SWB (awslabs#681) * fix: Correct stage name for deploying TRE SWB * Second line Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Enable AppStream and Egress Store (awslabs#682) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Run AppStream version of the tests (awslabs#683) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Correct Appstream test command to pick up spec files (awslabs#684) * Rstudio AppStream integration (awslabs#678) * feat: Integrate RStudio workspaces with AppStream * chore: change condition for SSM endpoint to include custom domain presence * fix: open data lambda in appstream env (awslabs#687) * chore: Merge mainline into feat-secure-workspace-egress (awslabs#659) * fix: Use bucket region if available while mounting BYOB studies (awslabs#692) * fix: Allow Sagemaker Appstream workspaces to autostop (awslabs#689) * fix:Add AppStream param to envPollHandler error and allow Sagemaker instance access to Sagemaker API Endpoint * Remove commented out code Co-authored-by: Tim Nguyen <thingut@amazon.com> * test: Added infrastructure tests (awslabs#696) * fix: member account share appstream bug (awslabs#712) * fix: externalId requirement for add account form (awslabs#713) * fix: externalId requirement for add account form * test: adding unit test for add member account * fix: add required attribute to unit test * fix: remove hardcoded externalId string * feat: swb main study role (awslabs#710) * fix: enableEgressStore flag is boolean, not string (awslabs#715) * feat: Pull AppStream create connection test env id from config file (awslabs#718) Co-authored-by: Tim Nguyen <thingut@amazon.com> * feat: remove egress bucket pol (awslabs#720) * feat: removing egress bucket policy * test: adjusting unit tests for new business logic * fix: update main role prefix for workflow perms * add swb prefix for main study role in apiHandler * chore: Make Egress store function with roles and remove kms whitelisting of member accounts (awslabs#723) * fix: converting Egress flag from boolean to string bug (awslabs#730) * fix: Disable public IP address for Linux, Windows, and RStudio when AppStream is enabled(awslabs#731) * chore: Update aws-sdk to latest V2 version (awslabs#734) * Update Cypress tests to match tests from develop * Update integration test to include isAppStreamEnabled flag * Bump axios version for integratio test * Trigger notification * fix linting issues * Update test * chore: Merge develop and feat-egress-store-role into feat-secure-workspace-egress (awslabs#735) * feat: Create dedicated SGs for environment and interface endpoints (awslabs#736) * Revert "chore: Merge develop and feat-egress-store-role into feat-secure-workspace-egress (awslabs#735)" This reverts commit 40d54e8. * feat: Fetch egress store data by id instead of using a scan (awslabs#741) * fix: Delete egress role in workflow instead of API (awslabs#740) Co-authored-by: Tim Nguyen <thingut@amazon.com> * fix: Remove PolicyWorkflowLoopRunner DependsOn PermissionBoundaryPolicyStudyBucket * WIP: Allow shareAppStreamImage for update accoutn request * Update tests * Fix typos * Update AppStream egress disabled tests * chore: update docs and script to reference * docs: egress docs (awslabs#742) * docs: egress docs * Fix prepare_master_account file and remove yarn.lock file * docs: post deployment guide updates * docs: pr review * docs: spelling correction * docs: new post depl guide * docs: new post depl manual Co-authored-by: Sharma <shyogesh@88665a06ebc4.ant.amazon.com> Co-authored-by: Tim Nguyen <thingut@amazon.com> * docs: Minor comment updates and add copyright headers (awslabs#751) Co-authored-by: Xian Zhang <zhaxan@amazon.com> Co-authored-by: Tim Nguyen <nguyen102@users.noreply.github.com> Co-authored-by: ahl27 <lakaidan@amazon.com> Co-authored-by: Aidan Lakshman <aidanlakshman@gmail.com> Co-authored-by: Robert Smayda <smayda44@gmail.com> Co-authored-by: Sanket Dharwadkar <sdharwad@amazon.com> Co-authored-by: shyogesh-sw <79225266+shyogesh-sw@users.noreply.github.com> Co-authored-by: Yanyu Zheng <yz2690@columbia.edu> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tim Nguyen <thingut@amazon.com> Co-authored-by: zhaxan <25250067+MBtea@users.noreply.github.com> Co-authored-by: Aidan Lakshman <ahl27@pitt.edu> Co-authored-by: Yogesh Sharma <shyogesh@amazon.com> Co-authored-by: Marianna Ghirardelli <43092418+maghirardelli@users.noreply.github.com> Co-authored-by: Sharma <shyogesh@88665a06ebc4.ant.amazon.com>

Tim Nguyen added 10 commits August 3, 2021 17:30

Put connection in loading state when connecting to Windows instance.

2ea263c

Updated path for imagebuilder

b43e3b6

Update example file

74f8115

WIP

0ab258b

fix 'ReferenceError: egressStoreIamPolicyDocument is not defined' error

6a07a29

Merge branch 'feat-secure-workspace-egress' into tre-bugfixes

49dc873

Text changes for AppStream config

ce0682d

Remove config from workspace that we don't need from the user

668cc1f

Merge branch 'feat-secure-workspace-egress' into tre-bugfixes

4c2f27f

CIDR fixes

3243e1d

nguyen102 commented Aug 6, 2021

View reviewed changes

updates

5c035f6

nguyen102 commented Aug 6, 2021

View reviewed changes

nguyen102 marked this pull request as ready for review August 6, 2021 20:35

nguyen102 requested a review from a team as a code owner August 6, 2021 20:35

Tim Nguyen added 2 commits August 6, 2021 17:48

Update unit test

969128a

Update tests

201e2cb

nguyen102 requested review from jn1119 and SanketD92 August 9, 2021 18:44

Merge branch 'feat-secure-workspace-egress' into tre-bugfixes

3f0649c

jn1119 reviewed Aug 10, 2021

View reviewed changes

Updated base on PR comments

25c0159

nguyen102 requested a review from jn1119 August 10, 2021 19:16

jn1119 approved these changes Aug 11, 2021

View reviewed changes

nguyen102 merged commit 7b14b11 into awslabs:feat-secure-workspace-egress Aug 11, 2021

nguyen102 deleted the tre-bugfixes branch October 26, 2021 14:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: Various TRE bugfixes #642

fix: Various TRE bugfixes #642

nguyen102 commented Aug 6, 2021 •

edited

Loading

nguyen102 Aug 6, 2021

nguyen102 Aug 6, 2021

nguyen102 Aug 6, 2021

jn1119 Aug 10, 2021 •

edited

Loading

codecov bot commented Aug 6, 2021 •

edited

Loading

nguyen102 Aug 6, 2021

jn1119 Aug 9, 2021 •

edited

Loading

nguyen102 Aug 10, 2021

jn1119 Aug 11, 2021 •

edited

Loading

jn1119 Aug 10, 2021

nguyen102 Aug 10, 2021

jn1119 Aug 10, 2021

nguyen102 Aug 10, 2021

jn1119 Aug 10, 2021

nguyen102 Aug 10, 2021

jn1119 Aug 10, 2021

nguyen102 Aug 10, 2021

jn1119 Aug 10, 2021

nguyen102 Aug 10, 2021

fix: Various TRE bugfixes #642

fix: Various TRE bugfixes #642

Conversation

nguyen102 commented Aug 6, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jn1119 Aug 10, 2021 • edited Loading

Choose a reason for hiding this comment

codecov bot commented Aug 6, 2021 • edited Loading

Codecov Report

Choose a reason for hiding this comment

jn1119 Aug 9, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jn1119 Aug 11, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nguyen102 commented Aug 6, 2021 •

edited

Loading

jn1119 Aug 10, 2021 •

edited

Loading

codecov bot commented Aug 6, 2021 •

edited

Loading

jn1119 Aug 9, 2021 •

edited

Loading

jn1119 Aug 11, 2021 •

edited

Loading