publish-s3-bucket

#!/usr/bin/env bash
#
# Publish an S3 bucket containing the following from this repository:
#  - CloudFormation templates
#  - AMI assets.

set -o errexit
set -o nounset
set -o pipefail

show_help() {
    >&2 echo "Usage: publish-s3-bucket [-h]"
    >&2 echo ""
    >&2 echo "Publish an S3 bucket with the resources from this repository."
    >&2 echo "Must be run from the root of the xrd-eks repository."
}

# Parse the arguments
while [ $# -gt 0 ]; do
  case $1 in
    -h|--help )
      show_help
      exit 255
      ;;
    * )
      >&2 echo "Unknown option $1"
      show_help
      exit 1
      ;;
  esac
done

ACCOUNT_ID=$(aws sts get-caller-identity --query "Account" --output text)
BUCKET_NAME=${BUCKET_NAME:-"${ACCOUNT_ID}-xrd-quickstart"}
BUCKET_KEY_PREFIX=${BUCKET_KEY_PREFIX:-"xrd-eks/"}

AWS_REGION=${AWS_REGION:-$(aws configure get region)}

CF_DIR=cf-templates
AMI_ASSETS_DIR=ami_assets
SUBMODULES_DIR=submodules

# Lambdas in the upstream QuickStart bucket that the XRd stack depends on.
LAMBDAS=(
    "CleanupLambdas/lambda.zip"
    "CleanupLoadBalancers/lambda.zip"
    "CleanupSecurityGroupDependencies/lambda.zip"
    "DeleteBucketContents/lambda.zip"
    "EksClusterResource/awsqs-eks-cluster.zip"
    "FargateProfile/lambda.zip"
    "GetCallerArn/lambda.zip"
    "HelmReleaseResource/awsqs-kubernetes-helm.zip"
    "KubeGet/lambda.zip"
    "KubeManifest/lambda.zip"
    "ResourceReader/lambda.zip"
    "awscliLayer/lambda.zip"
    "boto3Layer/lambda.zip"
    "crhelperLayer/lambda.zip"
    "kubectlLayer/lambda.zip"
    "kubernetesResources/awsqs_kubernetes_apply.zip"
    "kubernetesResources/awsqs_kubernetes_apply_vpc.zip"
    "kubernetesResources/awsqs_kubernetes_get.zip"
    "kubernetesResources/awsqs_kubernetes_get_vpc.zip"
    "registerCustomResource/lambda.zip"
    "registerType/lambda.zip"
)

# Pinned versions of lambdas in the upstream QuickStart bucket, in the
# us-east-1 region (bucket name 'aws-quickstart-us-east-1').
get_lambda_version() {
    case $1 in
        "CleanupLambdas/lambda.zip")
            echo "xa.Oy15ZoH7.mIp_BuRwsL53sGNbT7WL"
            ;;
        "CleanupLoadBalancers/lambda.zip")
            echo "5CvkA46x0j2uGCcYVFeQwRhQlDnOonex"
            ;;
        "CleanupSecurityGroupDependencies/lambda.zip")
            echo "gBBk2SBA0PMtXpLCX3NfVcyx4iLYQffa"
            ;;
        "DeleteBucketContents/lambda.zip")
            echo "TXgf9J8CzPlR9pIq2q8PAGichTjSVVQs"
            ;;
        "EksClusterResource/awsqs-eks-cluster.zip")
            echo "BH57pAffePQxbR3HVmok1FIeuQAEwPQB"
            ;;
        "FargateProfile/lambda.zip")
            echo "6TSPoPHqDS5RBuhHXK7c5nY1cWSQQWAN"
            ;;
        "GetCallerArn/lambda.zip")
            echo "aHK8rwSAtRi_VvXb93WSZeAPfkJRP1i1"
            ;;
        "HelmReleaseResource/awsqs-kubernetes-helm.zip")
            echo "mICndQson0cH88MTYmSHI8nD34BtUv6L"
            ;;
        "KubeGet/lambda.zip")
            echo "D4Ie05qzJFw9phLxGl0c4jokEDe_3vOr"
            ;;
        "KubeManifest/lambda.zip")
            echo "FjNMguZ.ewamJlVG5FA7njCIPOY_wfBv"
            ;;
        "ResourceReader/lambda.zip")
            echo "CPRyESVYBRyOn88XbJBRff9BH6FdUPNV"
            ;;
        "awscliLayer/lambda.zip")
            echo "5bq9jw0Uy6nWpvAdzB3jHnTOsXqVAdNe"
            ;;
        "boto3Layer/lambda.zip")
            echo "_tm_qNEfTaXbxhdEoMIsevtndWWgVYW8"
            ;;
        "crhelperLayer/lambda.zip")
            echo "JiHzMw61.BY6cixU9XKvkYdjpf2Pw2o5"
            ;;
        "kubectlLayer/lambda.zip")
            echo "js0Jh5I5tHcHm3uDQPmzDHefiWrVzLdv"
            ;;
        "kubernetesResources/awsqs_kubernetes_apply.zip")
            echo "zur88zGrO3y28JtyZkFHdgrIOWgZiQVA"
            ;;
        "kubernetesResources/awsqs_kubernetes_apply_vpc.zip")
            echo "h5p9y6olTWxdrOkk81ZZZbcV3w15K_10"
            ;;
        "kubernetesResources/awsqs_kubernetes_get.zip")
            echo "TOU3OQH4ZjItln8yMy1cX2N1o4ET6tAQ"
            ;;
        "kubernetesResources/awsqs_kubernetes_get_vpc.zip")
            echo "mi26IfkUgVG4kCZ2EB2Zn915cYgJPFLL"
            ;;
        "registerCustomResource/lambda.zip")
            echo "VYQpmfwS.PKRdHIAXTtWe_.K1dBuc3XX"
            ;;
        "registerType/lambda.zip")
            echo "s3kDkK67t2.qn1caBkqBLlHL2Bblf.b9"
            ;;
        *)
            2>&1 "Unrecognized lambda: $1"
            exit 2
    esac
}

create_bucket() {
    if [ "${AWS_REGION}" != "us-east-1" ]; then
        aws s3api head-bucket --bucket "${BUCKET_NAME}" >/dev/null 2>&1 || aws s3api create-bucket --bucket "${BUCKET_NAME}" --create-bucket-configuration "{ \"LocationConstraint\": \"${AWS_REGION}\" }"
    else
        aws s3api head-bucket --bucket "${BUCKET_NAME}" >/dev/null 2>&1 || aws s3api create-bucket --bucket "${BUCKET_NAME}"
    fi

    POLICY='{
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": "*",
                "Action": "s3:GetObject",
                "Resource": "arn:aws:s3:::'"${BUCKET_NAME}"'/'"${BUCKET_KEY_PREFIX}"''"${CF_DIR}"'/*"
            },
            {
                "Effect": "Allow",
                "Principal": "*",
                "Action": "s3:GetObject",
                "Resource": "arn:aws:s3:::'"${BUCKET_NAME}"'/'"${BUCKET_KEY_PREFIX}"''"${AMI_ASSETS_DIR}"'/*"
            }
        ]
    }'

    aws s3api put-public-access-block --bucket "${BUCKET_NAME}" --public-access-block-configuration "BlockPublicPolicy=false"
    aws s3api put-bucket-policy --bucket "${BUCKET_NAME}" --policy "${POLICY}"

    aws s3api put-bucket-tagging \
        --bucket "${BUCKET_NAME}" \
        --tagging "TagSet=[{Key='Data Classification',Value='Cisco Public'},{Key=IntendedPublic,Value=true}]"
}

sync_dir() {
    local DIR=$1
    aws s3 sync --delete "./${DIR}/" "s3://${BUCKET_NAME}/${BUCKET_KEY_PREFIX}${DIR}/"
}

# Copy a lambda from the upstream QuickStart bucket, in us-east-1, to the
# user's XRd bucket.
# Note that we _must_ copy from 'aws-quickstart-us-east-1', regardless of the
# user's current AWS region, because the pinned versions defined above are
# valid only for this bucket and not for QuickStart buckets in other regions.
copy_lambda() {
    local KEY=$1
    local VERSION=$2
    echo "copy: s3://aws-quickstart-us-east-1/${KEY} to s3://${BUCKET_NAME}/${BUCKET_KEY_PREFIX}submodules/${KEY}"
    >/dev/null aws s3api copy-object \
        --bucket "${BUCKET_NAME}" \
        --key "${BUCKET_KEY_PREFIX}submodules/${KEY}" \
        --copy-source "aws-quickstart-us-east-1/${KEY}?versionId=${VERSION}" \
        --metadata-directive REPLACE
}

echo "Checking git submodules are recursively checked out..."
git submodule status --recursive 2>/dev/null | while IFS= read -r LINE; do
    if [ "${LINE:0:1}" = "-" ]; then
        2>&1 echo "Submodules are not recursively checked out."
        2>&1 echo "Run 'git submodule update --init --recursive' and try again."
        exit 1
    fi
done

echo "Creating bucket ${BUCKET_NAME}..."
create_bucket

echo "Syncing CF templates to bucket..."
sync_dir ${CF_DIR}

echo "Syncing AMI assets to bucket..."
sync_dir ${AMI_ASSETS_DIR}

echo "Syncing submodules to bucket..."
sync_dir ${SUBMODULES_DIR}

echo "Syncing QuickStart packages to bucket..."
for LAMBDA in "${LAMBDAS[@]}"; do
    VERSION=$(get_lambda_version "${LAMBDA}")
    copy_lambda "quickstart-amazon-eks/functions/packages/${LAMBDA}" "${VERSION}"
done

# Output the details to be used in the CF stacks.
echo ""
echo "Successfully populated S3 bucket"
echo "Use the following values in your XRd CloudFormation stack:"
echo "  XRd resource S3 bucket name: ${BUCKET_NAME}"
echo "  XRd resource S3 bucket region: ${AWS_REGION}"
echo "  XRd resource S3 bucket key prefix: ${BUCKET_KEY_PREFIX}"