@mesh-tech/mesh-cli/dist/src/utils/pulumi-run.js

CLI for Mesh platform development utilities

import { logError, logWarn } from "./log.js";
import { readStackConfig } from "./pulumi.js";
import { derivePlatformContext, resolveAwsCredentials } from "./aws-auth.js";
import { probeCredentials } from "../commands/login.js";
export function credProbeToPreflightError(probe, context) {
    switch (probe.state) {
        case "ok":
            return null;
        case "no-session":
            return {
                fatal: true,
                message: `Not logged in for ${context}. Run:\n` +
                    `    mesh login ${context} --device`,
            };
        case "expired-session":
            return {
                fatal: true,
                message: `Your mesh login session for ${context} expired. Run:\n` +
                    `    mesh login ${context} --device`,
            };
        case "assume-denied":
            return {
                fatal: true,
                message: `Logged in, but couldn't assume the deployer role — ${probe.detail}\n` +
                    `  Check mesh:deployerRole in the stack config and your IAM access.`,
            };
        case "stale-env-override":
            return {
                fatal: false,
                message: `Stale AWS_* env vars are set and will override your mesh login.\n` +
                    `  If pulumi fails with an auth error, clear them first:\n` +
                    `    unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN`,
            };
    }
}
export async function resolvePulumiEnv(opts) {
    const { appRoot, stack } = opts;
    const roleArn = readStackConfig(appRoot, stack, "mesh:deployerRole");
    if (!roleArn) {
        if (process.env.AWS_ACCESS_KEY_ID) {
            return {};
        }
        logError(`No mesh:deployerRole in Pulumi.${stack}.yaml — mesh needs it to assume a ` +
            `role for the Pulumi backend.\n` +
            `  Set it (copy the value from a base stack), e.g.:\n` +
            `    mesh deploy config set mesh:deployerRole arn:aws:iam::<account>:role/<tenant>-<stage>-apps-deployer --stack ${stack}\n` +
            `  (or provide operator AWS credentials in the environment for platform stacks).`);
        process.exit(1);
    }
    const hasAmbientCreds = !!process.env.AWS_ACCESS_KEY_ID;
    const context = derivePlatformContext(appRoot, stack);
    if (!hasAmbientCreds && context) {
        const probe = await probeCredentials(context, roleArn);
        const preflight = credProbeToPreflightError(probe, context);
        if (preflight?.fatal) {
            logError(preflight.message);
            process.exit(1);
        }
        if (preflight)
            logWarn(preflight.message);
    }
    const resolved = await resolveAwsCredentials(roleArn, appRoot, stack);
    if (!resolved) {
        logError(`Failed to obtain AWS credentials for ${roleArn}.\n` +
            (context ? `  Try: mesh login ${context} --device\n` : "") +
            `  (or provide AWS credentials in the environment).`);
        process.exit(1);
    }
    return { ...resolved.env };
}