aws-cloudformation · ericzbeard · Oct 12, 2023 · Oct 11, 2023 · Oct 12, 2023 · Oct 12, 2023
diff --git a/.../src/main/java/com/awscommunity/appsync/breakingchangedetection/PreUpdateHookHandler.java b/.../src/main/java/com/awscommunity/appsync/breakingchangedetection/PreUpdateHookHandler.java
@@ -52,7 +52,7 @@ public ProgressEvent<HookTargetModel, CallbackContext> handleRequest(
         final AwsAppsyncGraphqlschema resourceProperties = targetModel.getResourceProperties();
 
         boolean considerDangerousChanges = false;
-        if (typeConfiguration != null) {
+        if (typeConfiguration != null && typeConfiguration.getConsiderDangerousChangesBreaking() != null) {
             considerDangerousChanges = typeConfiguration.getConsiderDangerousChangesBreaking();
         }
 

diff --git a/...ngeDetection/test/configuration_undo.json → ...ngeDetection/test/configuration-undo.json b/...ngeDetection/test/configuration_undo.json → ...ngeDetection/test/configuration-undo.json
diff --git a/hooks/AppSync_BreakingChangeDetection/test/integ-fail.yml b/hooks/AppSync_BreakingChangeDetection/test/integ-fail.yml
@@ -0,0 +1,29 @@
+Resources:
+  BasicGraphqlApi:
+    Type: "AWS::AppSync::GraphQLApi"
+    Properties:
+      Name: "TestAPI with IAM auth"
+      AuthenticationType: "AWS_IAM"
+
+  BasicApiSchema:
+    Type: "AWS::AppSync::GraphQLSchema"
+    Properties:
+      ApiId: !GetAtt BasicGraphqlApi.ApiId
+      Definition: |
+        schema {
+          query: Query
+          mutation: Mutation
+        }
+
+        type Query {
+          singlePost(id: ID!): Post2
+        }
+
+        type Mutation {
+          putPost(id: ID!, title: String!): Post2
+        }
+
+        type Post2 {
+          id: ID!
+          title: String!
+        }
diff --git a/hooks/AppSync_BreakingChangeDetection/test/integ-setup.yml b/hooks/AppSync_BreakingChangeDetection/test/integ-setup.yml
@@ -0,0 +1,29 @@
+Resources:
+  BasicGraphqlApi:
+    Type: "AWS::AppSync::GraphQLApi"
+    Properties:
+      Name: "TestAPI with IAM auth"
+      AuthenticationType: "AWS_IAM"
+
+  BasicApiSchema:
+    Type: "AWS::AppSync::GraphQLSchema"
+    Properties:
+      ApiId: !GetAtt BasicGraphqlApi.ApiId
+      Definition: |
+        schema {
+          query: Query
+          mutation: Mutation
+        }
+
+        type Query {
+          singlePost(id: ID!): Post
+        }
+
+        type Mutation {
+          putPost(id: ID!, title: String!): Post
+        }
+
+        type Post {
+          id: ID!
+          title: String!
+        }
diff --git a/hooks/AppSync_BreakingChangeDetection/test/integ-succeed.yml b/hooks/AppSync_BreakingChangeDetection/test/integ-succeed.yml
@@ -0,0 +1,30 @@
+Resources:
+  BasicGraphqlApi:
+    Type: "AWS::AppSync::GraphQLApi"
+    Properties:
+      Name: "TestAPI with IAM auth"
+      AuthenticationType: "AWS_IAM"
+
+  BasicApiSchema:
+    Type: "AWS::AppSync::GraphQLSchema"
+    Properties:
+      ApiId: !GetAtt BasicGraphqlApi.ApiId
+      Definition: |
+        schema {
+          query: Query
+          mutation: Mutation
+        }
+
+        type Query {
+          singlePost(id: ID!): Post
+          allThePosts: [Post]
+        }
+
+        type Mutation {
+          putPost(id: ID!, title: String!): Post
+        }
+
+        type Post {
+          id: ID!
+          title: String!
+        }
diff --git a/hooks/AppSync_BreakingChangeDetection/test/setup.json b/hooks/AppSync_BreakingChangeDetection/test/setup.json
diff --git a/hooks/CloudFront_LoggingEnabled/.rpdk-config b/hooks/CloudFront_LoggingEnabled/.rpdk-config
@@ -1,8 +1,8 @@
 {
     "artifact_type": "HOOK",
     "typeName": "AwsCommunity::CloudFront::LoggingEnabled",
-    "language": "python37",
-    "runtime": "python3.7",
+    "language": "python38",
+    "runtime": "python3.8",
     "entrypoint": "awscommunity_cloudfront_loggingenabled.handlers.hook",
     "testEntrypoint": "awscommunity_cloudfront_loggingenabled.handlers.test_entrypoint",
     "settings": {

diff --git a/hooks/CloudTrail_LogValidation/.rpdk-config b/hooks/CloudTrail_LogValidation/.rpdk-config
@@ -1,8 +1,8 @@
 {
     "artifact_type": "HOOK",
     "typeName": "AwsCommunity::CloudTrail::LogValidationEnabled",
-    "language": "python37",
-    "runtime": "python3.7",
+    "language": "python38",
+    "runtime": "python3.8",
     "entrypoint": "awscommunity_cloudtrail_logvalidationenabled.handlers.hook",
     "testEntrypoint": "awscommunity_cloudtrail_logvalidationenabled.handlers.test_entrypoint",
     "settings": {

diff --git a/hooks/EC2_SecurityGroupRestrictedSSH/.rpdk-config b/hooks/EC2_SecurityGroupRestrictedSSH/.rpdk-config
@@ -1,8 +1,8 @@
 {
     "artifact_type": "HOOK",
     "typeName": "AwsCommunity::EC2::SecurityGroupRestrictedSSH",
-    "language": "python37",
-    "runtime": "python3.7",
+    "language": "python38",
+    "runtime": "python3.8",
     "entrypoint": "awscommunity_ec2_securitygrouprestrictedssh.handlers.hook",
     "testEntrypoint": "awscommunity_ec2_securitygrouprestrictedssh.handlers.test_entrypoint",
     "settings": {

diff --git a/hooks/S3_BucketVersioningEnabled/.rpdk-config b/hooks/S3_BucketVersioningEnabled/.rpdk-config
@@ -1,8 +1,8 @@
 {
     "artifact_type": "HOOK",
     "typeName": "AwsCommunity::S3::BucketVersioningEnabled",
-    "language": "python37",
-    "runtime": "python3.7",
+    "language": "python38",
+    "runtime": "python3.8",
     "entrypoint": "awscommunity_s3_bucketversioningenabled.handlers.hook",
     "testEntrypoint": "awscommunity_s3_bucketversioningenabled.handlers.test_entrypoint",
     "settings": {

diff --git a/hooks/alpha-buildspec-java.yml b/hooks/alpha-buildspec-java.yml
@@ -3,7 +3,7 @@ version: 0.2
 phases:
   install:
     runtime-versions:
-      python: 3.7
+      python: 3.8
       java: corretto11
     commands:
       - echo Entered the install phase...

diff --git a/hooks/alpha-buildspec-python.yml b/hooks/alpha-buildspec-python.yml
@@ -3,7 +3,7 @@ version: 0.2
 phases:
   install:
     runtime-versions:
-      python: 3.7
+      python: 3.8
     commands:
       - echo Entered the install phase...
       - echo About to build $HOOK_PATH

diff --git a/hooks/beta-buildspec-java-pre-update-only.yml b/hooks/beta-buildspec-java-pre-update-only.yml
@@ -0,0 +1,42 @@
+version: 0.2
+
+phases:
+  install:
+    runtime-versions:
+      python: 3.8
+      java: corretto11
+    commands:
+      - echo Entered the install phase...
+      - echo About to build $HOOK_PATH
+      - export PATH="/usr/local/bin:$PATH"
+      - TYPE_NAME=$(python scripts/type_name.py $HOOK_PATH/.rpdk-config)
+      - TYPE_CLEAN_NAME="$(echo $TYPE_NAME | sed s/::/-/g | tr ‘[:upper:]’ ‘[:lower:]’)"
+      - echo TYPE_CLEAN_NAME is $TYPE_CLEAN_NAME
+      - BUILD_FILE_NAME=$(cat TYPE_CLEAN_NAME | sed s/_/-/g)
+      - BUILD_FILE_NAME="${BUILD_FILE_NAME}.zip"
+      - pip install git+https://github.com/aws-cloudformation/cloudformation-cli.git@master
+      - pip install git+https://github.com/aws-cloudformation/cloudformation-cli-java-plugin.git@master
+      - cd $HOOK_PATH
+      - cfn --version
+      - sam --version
+  build:
+    commands:
+      - echo Entered the build phase...
+      - cfn validate
+      - cfn generate
+      - mvn clean verify -B -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn
+      - cfn submit --set-default
+      - HOOK_TYPE_ARN=$(aws cloudformation list-types --visibility PRIVATE --type HOOK --filters TypeNamePrefix=$TYPE_NAME --output json | jq -r '.TypeSummaries[0].TypeArn')
+      - aws cloudformation set-type-configuration --configuration file://test/configuration.json --type-arn $HOOK_TYPE_ARN
+      - INTEG_STACK_NAME="integ-$(echo $TYPE_CLEAN_NAME | sed s/_/-/g)"
+      - rain deploy test/integ-setup.yml $INTEG_STACK_NAME -y
+      - rain deploy test/integ-succeed.yml $INTEG_STACK_NAME -y
+      - rain deploy test/integ-fail.yml $INTEG_STACK_NAME -y || [ $? -eq 1 ]
+    finally:
+      - cat rpdk.log
+      - aws cloudformation set-type-configuration --configuration file://test/configuration-undo.json --type-arn $HOOK_TYPE_ARN
+      - rain rm $INTEG_STACK_NAME -y
+artifacts:
+  files:
+    - $BUILD_FILE_NAME
+  name: extensions-build
diff --git a/hooks/beta-buildspec-java.yml b/hooks/beta-buildspec-java.yml
@@ -3,7 +3,7 @@ version: 0.2
 phases:
   install:
     runtime-versions:
-      python: 3.7
+      python: 3.8
       java: corretto11
     commands:
       - echo Entered the install phase...

diff --git a/hooks/beta-buildspec-python.yml b/hooks/beta-buildspec-python.yml
@@ -3,7 +3,7 @@ version: 0.2
 phases:
   install:
     runtime-versions:
-      python: 3.7
+      python: 3.8
     commands:
       - echo Entered the install phase...
       - echo About to build $HOOK_PATH

diff --git a/hooks/prod-buildspec-java.yml b/hooks/prod-buildspec-java.yml
@@ -3,7 +3,7 @@ version: 0.2
 phases:
   install:
     runtime-versions:
-      python: 3.7
+      python: 3.8
       java: corretto11
     commands:
       - echo Entered the install phase...

diff --git a/hooks/prod-buildspec-python.yml b/hooks/prod-buildspec-python.yml
@@ -3,7 +3,7 @@ version: 0.2
 phases:
   install:
     runtime-versions:
-      python: 3.7
+      python: 3.8
     commands:
       - echo Entered the install phase...
       - echo About to build $HOOK_PATH

diff --git a/release/awscommunity/cicd.yml b/release/awscommunity/cicd.yml
@@ -114,6 +114,19 @@ Resources:
       ManagedPolicyArns:
         - Fn::ImportValue: !Sub "cep-${Env}-common-build-project-policy"
 
+  AppSyncSchemaBreakingChangDetectionBuildProjectRole:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Statement:
+          - Action: sts:AssumeRole
+            Effect: Allow
+            Principal:
+              Service: codebuild.amazonaws.com
+        Version: '2012-10-17'
+      ManagedPolicyArns:
+        - Fn::ImportValue: !Sub "cep-${Env}-common-build-project-policy"
+
   S3AccessControlBuildProjectRole:
     Type: AWS::IAM::Role
     Properties:
@@ -849,6 +862,20 @@ Resources:
       Roles:
         - !Ref KMSEncryptionSettingsBuildProjectRole
 
+  AppSyncSchemaBreakingChangeDetectionBuildProjectRolePolicy:
+    Type: AWS::IAM::Policy
+    Properties:
+      PolicyDocument:
+        Statement:
+          - Action:
+              - appsync:*
+            Effect: Allow
+            Resource: "*"
+        Version: '2012-10-17'
+      PolicyName: appsync-breaking-change-detection-build-project-policy
+      Roles:
+        - !Ref AppSyncSchemaBreakingChangDetectionBuildProjectRole
+
   S3AccessControlBuildProjectPolicy:
     Type: AWS::IAM::Policy
     Properties:
@@ -1319,6 +1346,31 @@ Resources:
         BuildSpec: !Sub "hooks/${Env}-buildspec-java.yml"
       TimeoutInMinutes: 480
 
+  AppSyncSchemaBreakingChangDetectionBuildProject:
+    Type: AWS::CodeBuild::Project
+    Properties:
+      Name: !Sub "${PrefixLower}-${Env}-appsync-breakingchangedetection"
+      Artifacts:
+        Type: CODEPIPELINE
+      Environment:
+        ComputeType: BUILD_GENERAL1_LARGE
+        Image: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/cep-cicd:latest"
+        ImagePullCredentialsType: SERVICE_ROLE
+        PrivilegedMode: true
+        Type: LINUX_CONTAINER
+        EnvironmentVariables:
+          - Name: HOOK_PATH
+            Type: PLAINTEXT
+            Value: "placeholder-for-path-to-hook"
+      ServiceRole: !GetAtt AppSyncSchemaBreakingChangDetectionBuildProjectRole.Arn
+      Source:
+        Type: CODEPIPELINE
+        BuildSpec: !If
+          - IsBeta
+          - "hooks/beta-buildspec-java-pre-update-only.yml"
+          - !Sub "hooks/${Env}-buildspec-java.yml"
+      TimeoutInMinutes: 480
+
   S3AccessControlBuildProject:
     Type: AWS::CodeBuild::Project
     Properties:
@@ -1443,6 +1495,7 @@ Resources:
               - !GetAtt KMSEncryptionSettingsBuildProject.Arn
               - !GetAtt S3AccessControlBuildProject.Arn
               - !GetAtt ApplicationAutoscalingScheduledActionBuildProject.Arn
+              - !GetAtt AppSyncSchemaBreakingChangDetectionBuildProject.Arn
           - Action:
               - kms:*
             Effect: Allow
@@ -1514,6 +1567,7 @@ Resources:
                 - !GetAtt KMSEncryptionSettingsBuildProjectRole.Arn
                 - !GetAtt S3AccessControlBuildProjectRole.Arn
                 - !GetAtt ApplicationAutoscalingScheduledActionBuildProjectRole.Arn
+                - !GetAtt AppSyncSchemaBreakingChangDetectionBuildProjectRole.Arn
             Resource: "*"
       MultiRegion: true
 
@@ -1866,6 +1920,25 @@ Resources:
                     }
                   ]
               RunOrder: 1
+            - Name: AppSyncSchemaBreakingChangeDetection
+              InputArtifacts:
+                - Name: extensions-source
+              ActionTypeId:
+                Category: Build
+                Owner: AWS
+                Provider: CodeBuild
+                Version: 1
+              Configuration:
+                ProjectName: !Ref AppSyncSchemaBreakingChangDetectionBuildProject
+                EnvironmentVariables: |-
+                  [
+                    {
+                      "name": "HOOK_PATH",
+                      "type": "PLAINTEXT",
+                      "value": "hooks/AppSync_BreakingChangeDetection"
+                    }
+                  ]
+              RunOrder: 1
         - !If
           - IsBeta
           - Name: CopyBuildToProd

diff --git a/resources/Account_AlternateContact/.rpdk-config b/resources/Account_AlternateContact/.rpdk-config
@@ -1,8 +1,8 @@
 {
     "artifact_type": "RESOURCE",
     "typeName": "AwsCommunity::Account::AlternateContact",
-    "language": "python37",
-    "runtime": "python3.7",
+    "language": "python38",
+    "runtime": "python3.8",
     "entrypoint": "awscommunity_account_alternatecontact.handlers.resource",
     "testEntrypoint": "awscommunity_account_alternatecontact.handlers.test_entrypoint",
     "settings": {