@mesh-tech/mesh-cli/dist/src/utils/bastion.js

CLI for Mesh platform development utilities

import { SSMClient, GetParameterCommand } from "@aws-sdk/client-ssm";
import { logInfo, logSuccess, logError } from "./log.js";
export async function getPlatformBastionInfo(tenant, platformEnv, region) {
    const ssm = new SSMClient(region ? { region } : {});
    let primaryError;
    const platformPath = `/mesh-platform/${tenant}/${platformEnv}/platform`;
    logInfo(`Looking up platform bastion from ${platformPath}...`);
    try {
        const response = await ssm.send(new GetParameterCommand({ Name: platformPath }));
        if (response.Parameter?.Value) {
            const platform = JSON.parse(response.Parameter.Value);
            if (platform.platformBastion) {
                const info = platform.platformBastion;
                logSuccess(`Found bastion: ${info.instanceId}`);
                const serviceNames = Object.keys(info.services);
                if (serviceNames.length > 0) {
                    logInfo(`Available services: ${serviceNames.join(", ")}`);
                }
                return info;
            }
        }
    }
    catch (err) {
        primaryError = err;
    }
    const legacyPath = `/mesh-platform/${tenant}/${platformEnv}/platform-bastion`;
    logInfo(`Trying legacy path ${legacyPath}...`);
    try {
        const response = await ssm.send(new GetParameterCommand({ Name: legacyPath }));
        if (!response.Parameter?.Value) {
            throw new Error(`Platform bastion not found`);
        }
        const info = JSON.parse(response.Parameter.Value);
        logSuccess(`Found bastion: ${info.instanceId}`);
        const serviceNames = Object.keys(info.services);
        if (serviceNames.length > 0) {
            logInfo(`Available services: ${serviceNames.join(", ")}`);
        }
        return info;
    }
    catch (legacyError) {
        const cause = primaryError ?? legacyError;
        const name = cause?.name ?? "";
        const credsProblem = /Expired|UnrecognizedClient|InvalidClientTokenId|InvalidSignature|CredentialsProviderError|AccessDenied/i.test(name);
        if (credsProblem) {
            logError(`Could not read the platform bastion from ${platformPath} — AWS error: ${name}.`);
            logInfo("This is almost always a CREDENTIALS problem, not a missing bastion.");
            logInfo("  • The read uses the ambient AWS creds of this process; they must be valid AND able to read the HUB param above.");
            logInfo("  • Check: `aws sts get-caller-identity` (ExpiredToken → refresh; AccessDenied → those creds lack hub read — use InfraAdmin-grade creds).");
            logInfo("  • Stale creds often hide in the tmux GLOBAL env (`tmux show-environment -g | grep AWS_`); a per-shell `unset` won't clear them.");
        }
        else {
            logError(`Platform bastion not found in ${platformPath} or ${legacyPath}`);
            logInfo("Make sure platformBastion is enabled in your platform config and deployed.");
        }
        throw cause;
    }
}
export async function getBastionInfo(tenant, platformEnv) {
    const info = await getPlatformBastionInfo(tenant, platformEnv);
    const rdsService = info.services["rds"];
    if (!rdsService) {
        throw new Error("RDS service not available in platform bastion. Is RDS enabled?");
    }
    return {
        instanceId: info.instanceId,
        rdsEndpoint: rdsService.host,
        rdsPort: rdsService.port,
    };
}