feat: Move the data bucket into the GuCDK stack

cdk/lib/__snapshots__/amigo.test.ts.snap

@@ -5,12 +5,12 @@ Object {
   "AWSTemplateFormatVersion": "2010-09-09",
   "Description": "AMIgo, an AMI bakery",
   "Mappings": Object {
-    "Config": Object {
+    "stagemapping": Object {
       "CODE": Object {
-        "LowerCaseName": "code",
+        "DataBucketName": "amigo-data-code",
       },
       "PROD": Object {
-        "LowerCaseName": "prod",
+        "DataBucketName": "amigo-data-prod",
       },
     },
   },
@@ -166,17 +166,6 @@ Object {
                 ],
               },
             },
-            Object {
-              "Action": Array [
-                "s3:GetObject",
-              ],
-              "Effect": "Allow",
-              "Resource": Array [
-                Object {
-                  "Fn::Sub": "arn:aws:s3:::\${AmigoDataBucket}/*",
-                },
-              ],
-            },
             Object {
               "Action": Array [
                 "iam:GetInstanceProfile",
@@ -201,19 +190,12 @@ Object {
       "DeletionPolicy": "Retain",
       "Properties": Object {
         "BucketName": Object {
-          "Fn::Sub": Array [
-            "amigo-data-\${LowerCaseStage}",
+          "Fn::FindInMap": Array [
+            "stagemapping",
             Object {
-              "LowerCaseStage": Object {
-                "Fn::FindInMap": Array [
-                  "Config",
-                  Object {
-                    "Ref": "Stage",
-                  },
-                  "LowerCaseName",
-                ],
-              },
+              "Ref": "Stage",
             },
+            "DataBucketName",
           ],
         },
         "Tags": Array [
@@ -242,6 +224,64 @@ Object {
         ],
       },
       "Type": "AWS::S3::Bucket",
+      "UpdateReplacePolicy": "Retain",
+    },
+    "AppPolicyF941AEC5": Object {
+      "Properties": Object {
+        "PolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": "s3:GetObject",
+              "Effect": "Allow",
+              "Resource": Object {
+                "Fn::Join": Array [
+                  "",
+                  Array [
+                    Object {
+                      "Fn::GetAtt": Array [
+                        "AmigoDataBucket",
+                        "Arn",
+                      ],
+                    },
+                    "/*",
+                  ],
+                ],
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": "app-policy",
+        "Roles": Array [
+          Object {
+            "Fn::Select": Array [
+              1,
+              Object {
+                "Fn::Split": Array [
+                  "/",
+                  Object {
+                    "Fn::Select": Array [
+                      5,
+                      Object {
+                        "Fn::Split": Array [
+                          ":",
+                          Object {
+                            "Fn::GetAtt": Array [
+                              "RootRole",
+                              "Arn",
+                            ],
+                          },
+                        ],
+                      },
+                    ],
+                  },
+                ],
+              },
+            ],
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
     },
     "ApplicationSecurityGroup": Object {
       "Properties": Object {

cdk/lib/amigo.ts

@@ -1,11 +1,13 @@
 import path from "path";
-import type { CfnRole, Policy } from "@aws-cdk/aws-iam";
-import { Effect, PolicyStatement, Role } from "@aws-cdk/aws-iam";
+import type { CfnRole } from "@aws-cdk/aws-iam";
+import { Effect, Policy, PolicyStatement, Role } from "@aws-cdk/aws-iam";
+import type { Bucket } from "@aws-cdk/aws-s3";
 import { CfnInclude } from "@aws-cdk/cloudformation-include";
 import type { App } from "@aws-cdk/core";
+import { Stage } from "@guardian/cdk/lib/constants";
 import type { GuStackProps, GuStageParameter } from "@guardian/cdk/lib/constructs/core";
 import { GuDistributionBucketParameter, GuStack } from "@guardian/cdk/lib/constructs/core";
-import type { AppIdentity } from "@guardian/cdk/lib/constructs/core/identity";
+import { AppIdentity } from "@guardian/cdk/lib/constructs/core/identity";
 import {
   GuAllowPolicy,
   GuAnghammaradSenderPolicy,
@@ -14,6 +16,7 @@ import {
   GuLogShippingPolicy,
   GuSSMRunCommandPolicy,
 } from "@guardian/cdk/lib/constructs/iam";
+import { GuS3Bucket } from "@guardian/cdk/lib/constructs/s3";
 
 const yamlTemplateFilePath = path.join(__dirname, "../../cloudformation.yaml");
 
@@ -22,9 +25,44 @@ export class AmigoStack extends GuStack {
     app: "amigo",
   };
 
+  private readonly dataBucket: Bucket;
+
+  private get appPolicy(): Policy {
+    return new Policy(this, "AppPolicy", {
+      policyName: "app-policy",
+      statements: [
+        /*
+        Permissions to enable listing of installed packages created during a bake
+        See https://github.com/guardian/amigo/pull/395
+         */
+        new PolicyStatement({
+          effect: Effect.ALLOW,
+          actions: ["s3:GetObject"],
+          resources: [`${this.dataBucket.bucketArn}/*`],
+        }),
+      ],
+    });
+  }
+
   constructor(scope: App, id: string, props: GuStackProps) {
     super(scope, id, props);
 
+    const importBucketName = this.withStageDependentValue({
+      variableName: "DataBucketName",
+      stageValues: {
+        [Stage.CODE]: "amigo-data-code",
+        [Stage.PROD]: "amigo-data-prod",
+      },
+    });
+
+    this.dataBucket = new GuS3Bucket(this, "AmigoDataBucket", {
+      bucketName: importBucketName,
+      existingLogicalId: {
+        logicalId: "AmigoDataBucket",
+        reason: "To prevent orphaning of the YAML defined bucket",
+      },
+    });
+
     const yamlDefinedStack = new CfnInclude(this, "YamlTemplate", {
       templateFile: yamlTemplateFilePath,
 
@@ -99,8 +137,17 @@ export class AmigoStack extends GuStack {
       }),
       GuDescribeEC2Policy.getInstance(this),
       GuAnghammaradSenderPolicy.getInstance(this),
+      this.appPolicy,
     ];
 
     policiesToAttachToRootRole.forEach((policy) => policy.attachToRole(rootRole));
+
+    /*
+    Looks like some @guardian/cdk constructs are not applying the App tag.
+    I suspect since https://github.com/guardian/cdk/pull/326.
+    Until that is fixed, we can safely, manually apply it to all constructs in tree from `this` as it's a single app stack.
+    TODO: remove this once @guardian/cdk has been fixed.
+    */
+    AppIdentity.taggedConstruct(AmigoStack.app, this);
   }
 }

cdk/package.json

@@ -36,7 +36,7 @@
     "@aws-cdk/aws-s3": "1.107.0",
     "@aws-cdk/cloudformation-include": "1.107.0",
     "@aws-cdk/core": "1.107.0",
-    "@guardian/cdk": "19.2.1",
+    "@guardian/cdk": "19.3.0",
     "source-map-support": "^0.5.16"
   }
 }

cdk/yarn.lock

@@ -2299,10 +2299,10 @@
     minimatch "^3.0.4"
     strip-json-comments "^3.1.1"
 
-"@guardian/cdk@19.2.1":
-  version "19.2.1"
-  resolved "https://registry.yarnpkg.com/@guardian/cdk/-/cdk-19.2.1.tgz#c89265fb61c47ec2f70f375740e2899f51758497"
-  integrity sha512-c+5w/wxvx8+1+9DorUWqqh+8VY2iIGgjqnZ9FCTrFbFN/l77W6eyv8tA9Qx1C7uWpPGWG+x3/hwfL8tCK/6gtA==
+"@guardian/cdk@19.3.0":
+  version "19.3.0"
+  resolved "https://registry.yarnpkg.com/@guardian/cdk/-/cdk-19.3.0.tgz#03d124e5a1922643075b6288267cc1b6a1a32644"
+  integrity sha512-QtUCnche0VhzPw4oU9W/VlZs0tiXESoxGyu6GnEyltg54UPr9JXpnN553u/z4k9NFPnak/Qo2S7bOLpR/ami+Q==
   dependencies:
     "@aws-cdk/assert" "1.107.0"
     "@aws-cdk/aws-apigateway" "1.107.0"
@@ -2319,7 +2319,7 @@
     "@aws-cdk/aws-rds" "1.107.0"
     "@aws-cdk/aws-s3" "1.107.0"
     "@aws-cdk/core" "1.107.0"
-    aws-sdk "^2.929.0"
+    aws-sdk "^2.932.0"
     execa "^5.1.1"
     git-url-parse "^11.4.4"
     read-pkg-up "7.0.1"
@@ -3031,10 +3031,10 @@ aws-sdk@^2.848.0:
     uuid "3.3.2"
     xml2js "0.4.19"
 
-aws-sdk@^2.929.0:
-  version "2.932.0"
-  resolved "https://registry.yarnpkg.com/aws-sdk/-/aws-sdk-2.932.0.tgz#43da32ab6de58a0eac6c7976feb6c9879fe09e7c"
-  integrity sha512-U6MWUtFD0npWa+ReVEgm0fCIM0fMOYahFp14GLv8fC+BWOTvh5Iwt/gF8NrLomx42bBjA1Abaw6yhmiaSJDQHQ==
+aws-sdk@^2.932.0:
+  version "2.933.0"
+  resolved "https://registry.yarnpkg.com/aws-sdk/-/aws-sdk-2.933.0.tgz#42f2cab2ebb63291ce6e764510e8bfa997847256"
+  integrity sha512-WJBQSE3zdX5YbzTa5+k45hzUAL5EPyiZJAnzCV6TIkPEYPMY215q8iloBATqbntbvAyWC4j2Rto6+RYmki1MOQ==
   dependencies:
     buffer "4.9.2"
     events "1.1.1"

cloudformation.yaml

@@ -35,13 +35,6 @@ Parameters:
     Type: AWS::SSM::Parameter::Value<String>
     Default: /account/services/artifact.bucket
 
-Mappings:
-  Config:
-    CODE:
-      LowerCaseName: code
-    PROD:
-      LowerCaseName: prod
-
 Resources:
   RootRole:
     Type: AWS::IAM::Role
@@ -101,11 +94,6 @@ Resources:
           - s3:PutBucketPolicy
           Resource: !Join [ "", [ "arn:aws:s3::*:", !Ref DistributionBucketName ] ]
 
-        - Effect: Allow
-          Action:
-            - s3:GetObject
-          Resource:
-            - !Sub 'arn:aws:s3:::${AmigoDataBucket}/*'
         - Effect: Allow
           Action:
             - iam:GetInstanceProfile
@@ -234,21 +222,6 @@ Resources:
           Value: deploy
         - Key: Stage
           Value: !Ref 'Stage'
-  AmigoDataBucket:
-    Type: AWS::S3::Bucket
-    DeletionPolicy: Retain
-    Properties:
-      BucketName:
-        Fn::Sub:
-          - amigo-data-${LowerCaseStage}
-          - LowerCaseStage: !FindInMap [ Config, Ref: Stage, LowerCaseName ]
-      Tags:
-        - Key: App
-          Value: amigo
-        - Key: Stack
-          Value: deploy
-        - Key: Stage
-          Value: !Ref 'Stage'
   PackerSecurityGroup:
     Type: AWS::EC2::SecurityGroup
     Properties: