pulumi-community #general

stocky-spoon-28903

08/08/2018, 6:46 PM

An AMI locator might be a nice abstraction for the Typescript SDK. Basically a priority selection between: - a specific AMI ID - an AMI name/owner pair + maybe additional filters - some default fallback (potentially)

stocky-spoon-28903

08/08/2018, 6:46 PM

It’s a pattern I’ve had to use 2-3 times over the last day or two

stocky-spoon-28903

08/08/2018, 7:35 PM

Also, is there a way to do a “targeted update”?

stocky-spoon-28903

08/08/2018, 8:46 PM

Another one; has anyone done an initial run of newly created lambda function from the pulumi program that created it?

stocky-spoon-28903

08/08/2018, 10:38 PM

Is there a way to arrange a component such that all resources it creates must be created before it is considered fully created, such that using the component in

dependsOn

works across other components?

bland-lamp-97030

08/08/2018, 11:05 PM

I'm trying to create a policy for SSM and need the accountId for the urn, but I can't seem to figure out a way to get it using the js lib. I see aws.getCallerIdentity, but that returns a promise. Any hints?

stocky-spoon-28903

08/08/2018, 11:05 PM

@bland-lamp-97030 You can await the result of the promise

bland-lamp-97030

08/08/2018, 11:06 PM

outside of a function?

stocky-spoon-28903

08/08/2018, 11:06 PM

Not outside, no. Are you in the global scope at the moment?

bland-lamp-97030

08/08/2018, 11:07 PM

yes, just creating resources in index.js

stocky-spoon-28903

08/08/2018, 11:08 PM

One pattern I’ve used (as recommended by various people here) is an “async main” function, like this: https://gist.github.com/jen20/ccc91ab961843babf93b119fe67e1938

stocky-spoon-28903

08/08/2018, 11:08 PM

(Note that that particular gist is reproducing a crash though, so probably not the best one to copy/paste - the pattern is there though)

microscopic-florist-22719

08/08/2018, 11:09 PM

Do you just need to pass the account ID into the input of another resource?

bland-lamp-97030

08/08/2018, 11:09 PM

right, thanks, that makes sense!

stocky-spoon-28903

08/08/2018, 11:09 PM

I’m guessing for a policy it needs to go into a stringified object

bland-lamp-97030

08/08/2018, 11:09 PM

Resource: aws.getCallerIdentity().then(resp => arn:aws:ssm:${region}:${resp.accountId}:parameter/myapp*)

bland-lamp-97030

08/08/2018, 11:10 PM

basically that

bland-lamp-97030

08/08/2018, 11:10 PM

within a policy json stringify

microscopic-florist-22719

08/08/2018, 11:10 PM

Got it. Can you DM me the full stringify?

microscopic-florist-22719

08/08/2018, 11:10 PM

(assuming that you don't want to post it here)

bland-lamp-97030

08/08/2018, 11:11 PM

no, I don't mind, but I think the async func will work for my purposes

bland-lamp-97030

08/08/2018, 11:11 PM

Copy code

const policy = new aws.iam.RolePolicy("ksub-application-role-policy", {
  role: role.name,
  policy: JSON.stringify({
    Version: "2012-10-17",
    Statement: [
      {
        Action: ["ssm:GetParameters"],
        Effect: "Allow",
        Resource: aws.getCallerIdentity().then(resp => `arn:aws:ssm:${region}:${resp.accountId}:parameter/KSUB_*`), // how??
      },
      {
        Action: ["kms:Decrypt"],
        Effect: "Allow",
        Resource: kmsKey.arn,
      },
      {
        Action: [
          "autoscaling:Describe*",
          "ec2:Describe*",
          "ec2:Get*",
          "ecs:Describe*",
          "ecs:List*",
          "elasticache:Describe*",
          "elasticache:List*",
          "elasticloadbalancing:Describe*",
          "iam:Get*",
          "iam:List*",
          "ssm:DescribeParameters",
          "rds:Describe*",
          "rds:List*",
        ],
        Effect: "Allow",
        Resource: "*",
      },
    ],
  }),
});

stocky-spoon-28903

08/08/2018, 11:11 PM

Here’s a good example of using a promise value in a policy btw: https://github.com/jen20/lambda-cert/blob/master/pulumi/src/index.ts#L190-L253

bland-lamp-97030

08/08/2018, 11:11 PM

I didn't think the promise.then would work, but I found it in an example and figured I'd try it out

bland-lamp-97030

08/08/2018, 11:12 PM

I should just stick to the python libs 🙂

microscopic-florist-22719

08/08/2018, 11:12 PM

The canonical way to achieve what you need is to lift the `.then`:

Copy code

const policy = new aws.iam.RolePolicy("ksub-application-role-policy", {
  role: role.name,
  policy: aws.getCallerIdentity().then(resp => JSON.stringify({
    Version: "2012-10-17",
    Statement: [
      {
        Action: ["ssm:GetParameters"],
        Effect: "Allow",
        Resource:  `arn:aws:ssm:${region}:${resp.accountId}:parameter/KSUB_*`,
      },
      {
        Action: ["kms:Decrypt"],
        Effect: "Allow",
        Resource: kmsKey.arn,
      },
      {
        Action: [
          "autoscaling:Describe*",
          "ec2:Describe*",
          "ec2:Get*",
          "ecs:Describe*",
          "ecs:List*",
          "elasticache:Describe*",
          "elasticache:List*",
          "elasticloadbalancing:Describe*",
          "iam:Get*",
          "iam:List*",
          "ssm:DescribeParameters",
          "rds:Describe*",
          "rds:List*",
        ],
        Effect: "Allow",
        Resource: "*",
      },
    ],
  })),
});

stocky-spoon-28903

08/08/2018, 11:13 PM

That’s quite a lot nicer.

bland-lamp-97030

08/08/2018, 11:13 PM

oh, of course 👍

stocky-spoon-28903

08/08/2018, 11:14 PM

The other important thing to know about there is

pulumi.all

for if you need to depend on multiple promised parameters

👍 1

stocky-spoon-28903

08/09/2018, 11:25 AM

I’m getting a lot of this kind of thing when modifying security group rules:

Copy code

Do you want to perform this update? yes
Updating stack 'vault-dev'
Performing changes:

     Type                                      Name                         Status                  Info
 *   pulumi:pulumi:Stack                       pulumi-vault-test-vault-dev  done
 *   └─ operator-error:aws:vault:VaultServers  algo-vault-servers           unchanged
 ~      └─ aws:ec2:SecurityGroup               algo-vault-server-sg         **updating failed**     changes: ~ ingress, 2 errors

Diagnostics:
  aws:ec2:SecurityGroup: algo-vault-server-sg
    error: Plan apply failed: updating urn:pulumi:vault-dev::pulumi-vault-test::operator-error:aws:vault:VaultServers$aws:ec2/securityGroup:SecurityGroup::algo-vault-server-sg: Error revoking security group ingress rules: InvalidPermission.NotFound: The specified rule does not exist in this security group.
    	status code: 400, request id: 72b0d525-f31f-4fff-a0dc-7229cfb50af3

    error: update failed

info: no changes required:
      50 resources unchanged