connec / cloudformatious Goto Github PK

A CloudFormation library offering richly typed higher-level APIs to perform long-running operations and await their termination or observe their progress.

License: MIT License

Rust 100.00%

cloudformatious's People

Contributors

Watchers

cloudformatious's Issues

Unexpected panic when there are no changes to apply

thread 'main' panicked at 'Stack without change_set_id', cloudformatious-0.1.2/src/apply_stack.rs:434:48
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Assumed to be related to there being no changes. It's not clear why this does seem to work in some cases, e.g.

cloudformatious/tests/it/apply_stack.rs

Lines 211 to 239 in 82fdf77

 #[tokio::test] 

 async fn apply_overall_idempotent() -> Result<(), Box<dyn std::error::Error>> { 

 let client = get_client(); 

 let stack_name = generated_name(); 

 let input = ApplyStackInput::new(&stack_name, TemplateSource::inline(EMPTY_TEMPLATE)); 

 let mut apply = client.apply_stack(input.clone()); 

 let change_set = apply.change_set().await?; 

 assert_eq!(change_set.status, ChangeSetStatus::CreateComplete); 

 assert_eq!(change_set.execution_status, ExecutionStatus::Available); 

 assert!(change_set.changes.is_empty()); 

 let output1 = apply.await?; 

 let mut apply = client.apply_stack(input); 

 let change_set = apply.change_set().await?; 

 assert_eq!(change_set.status, ChangeSetStatus::Failed); 

 assert!(change_set.status_reason.is_some()); 

 assert_eq!(change_set.execution_status, ExecutionStatus::Unavailable); 

 assert!(change_set.changes.is_empty()); 

 let output2 = apply.await?; 

 assert_eq!(output2.stack_status, StackStatus::CreateComplete); 

 assert_eq!(output1, output2); 

 clean_up(&client, stack_name).await?; 

 Ok(()) 

 }

Authz hint missing for IAM OIDC provider APIs

E.g.

Resource handler returned message: "User: ... is not authorized to perform: iam:DeleteOpenIDConnectProvider on resource: ... because no identity-based policy allows the iam:DeleteOpenIDConnectProvider action (Service: Iam, Status Code: 403, Request ID: ...)" (RequestToken: ..., HandlerErrorCode: AccessDenied)

The filter for permission errors needs to be a bit more flexible.

Some templates with no updates to perform lead to errors creating change set

The error message seems to sometimes be "No updates are to be performed.", rather than the expected "The submitted information didn't contain changes.".

Edit: it's perhaps when using transforms?

Panic when modifying `AWS::SecretsManager::Secret` tags

thread 'main' panicked at 'ResourceTargetDefinition with attribute "Tags" with requires_recreation', /cloudformatious-0.1.1/src/change_set.rs:588:17
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

        {
            "Type": "Resource",
            "ResourceChange": {
                "Action": "Modify",
                "LogicalResourceId": "...",
                "PhysicalResourceId": "arn:aws:secretsmanager:eu-west-1:...:secret:...",
                "ResourceType": "AWS::SecretsManager::Secret",
                "Replacement": "Conditional",
                "Scope": [
                    "Properties",
                    "Tags"
                ],
                "Details": [
                    {
                        "Target": {
                            "Attribute": "Tags",
                            "RequiresRecreation": "Conditionally" // wat
                        },
                        "Evaluation": "Dynamic",
                        "ChangeSource": "DirectModification"
                    },
                    {
                        "Target": {
                            "Attribute": "Properties",
                            "Name": "SecretString",
                            "RequiresRecreation": "Conditionally"
                        },
                        "Evaluation": "Dynamic",
                        "ChangeSource": "ResourceAttribute",
                        "CausingEntity": "..."
                    },
                    {
                        "Target": {
                            "Attribute": "Tags",
                            "RequiresRecreation": "Never"
                        },
                        "Evaluation": "Static"
                    },
                    {
                        "Target": {
                            "Attribute": "Tags",
                            "RequiresRecreation": "Conditionally" // wat
                        },
                        "Evaluation": "Static",
                        "ChangeSource": "ParameterReference",
                        "CausingEntity": "..."
                    },
                    {
                        "Target": {
                            "Attribute": "Properties",
                            "Name": "Description",
                            "RequiresRecreation": "Conditionally"
                        },
                        "Evaluation": "Dynamic",
                        "ChangeSource": "ResourceReference",
                        "CausingEntity": "..."
                    }
                ]
            }
        },

Updating only tags for `AWS::AppRunner::Service` causes panic

Low priority since CloudFormation itself fails on tag-only updates to AWS::AppRunner::Service. The panic originates here:

cloudformatious/src/change_set.rs

Lines 666 to 677 in 73cf5ae

 assert!( 

 // We assume that changes to these attributes would never require recreation. 

 // NOTE: CloudFormation may report tag changes on AWS::SecretsManager::Secret 

 // resources as conditionally requiring recreation. We assume this is a bug in 

 // CloudFormation and ignore it. 

 matches!( 

 target.requires_recreation, 

 None | Some(aws_sdk_cloudformation::model::RequiresRecreation::Never) 

 ) || resource_type == "AWS::SecretsManager::Secret", 

 "ResourceTargetDefinition with attribute {:?} with requires_recreation", 

 attribute 

 );

Note that there's already an exception for AWS::SecretsManager::Secret (introduced in 7e5e35d). For now we could simply add an additional exception for AWS::AppRunner::Service.

Timestamp display is not fixed width

In the unlikely event that a stack event occurs exactly on a second, the milliseconds aren't rendered:

connec / cloudformatious Goto Github PK

cloudformatious's People

Contributors

Watchers

cloudformatious's Issues

Unexpected panic when there are no changes to apply

Authz hint missing for IAM OIDC provider APIs

Some templates with no updates to perform lead to errors creating change set

Panic when modifying `AWS::SecretsManager::Secret` tags

Updating only tags for `AWS::AppRunner::Service` causes panic

Timestamp display is not fixed width

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

Jobs

	#[tokio::test]
	async fn apply_overall_idempotent() -> Result<(), Box<dyn std::error::Error>> {
	let client = get_client();

	let stack_name = generated_name();
	let input = ApplyStackInput::new(&stack_name, TemplateSource::inline(EMPTY_TEMPLATE));

	let mut apply = client.apply_stack(input.clone());
	let change_set = apply.change_set().await?;
	assert_eq!(change_set.status, ChangeSetStatus::CreateComplete);
	assert_eq!(change_set.execution_status, ExecutionStatus::Available);
	assert!(change_set.changes.is_empty());
	let output1 = apply.await?;

	let mut apply = client.apply_stack(input);
	let change_set = apply.change_set().await?;
	assert_eq!(change_set.status, ChangeSetStatus::Failed);
	assert!(change_set.status_reason.is_some());
	assert_eq!(change_set.execution_status, ExecutionStatus::Unavailable);
	assert!(change_set.changes.is_empty());
	let output2 = apply.await?;

	assert_eq!(output2.stack_status, StackStatus::CreateComplete);
	assert_eq!(output1, output2);

	clean_up(&client, stack_name).await?;

	Ok(())
	}

	assert!(
	// We assume that changes to these attributes would never require recreation.
	// NOTE: CloudFormation may report tag changes on AWS::SecretsManager::Secret
	// resources as conditionally requiring recreation. We assume this is a bug in
	// CloudFormation and ignore it.
	matches!(
	target.requires_recreation,
	None \| Some(aws_sdk_cloudformation::model::RequiresRecreation::Never)
	) \|\| resource_type == "AWS::SecretsManager::Secret",
	"ResourceTargetDefinition with attribute {:?} with requires_recreation",
	attribute
	);