Skip to content

Commit 1466806

Browse files
drichmdbdrichmdb
authored
chore(release): write to new release s3 bucket MONGOSH-2124 (#2421)
This commit adjusts the mongosh release process to dual write to our new release S3 bucket. Instead of using long-lived static credentials, we have moved over to an IAM role and are assuming it via Evergreen's ec2.assume_role and in GitHub Actions via configure-aws-credentials.
1 parent 2b03591 commit 1466806

File tree

13 files changed

+187
-7
lines changed

13 files changed

+187
-7
lines changed

‎.evergreen.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4299,10 +4299,17 @@ functions:
42994299
params:
43004300
file: tmp/expansions.yaml
43014301
redacted: true
4302+
- command: ec2.assume_role
4303+
params:
4304+
role_arn: "arn:aws:iam::119629040606:role/s3-access.cdn-origin-compass"
43024305
- command: shell.exec
43034306
params:
43044307
working_dir: src
43054308
shell: bash
4309+
env:
4310+
DOWNLOAD_CENTER_AWS_KEY_NEW: ${AWS_ACCESS_KEY_ID}
4311+
DOWNLOAD_CENTER_AWS_SECRET_NEW: ${AWS_SECRET_ACCESS_KEY}
4312+
DOWNLOAD_CENTER_AWS_SESSION_TOKEN_NEW: ${AWS_SESSION_TOKEN}
43064313
script: |
43074314
set -e
43084315
{
@@ -4366,6 +4373,9 @@ functions:
43664373
params:
43674374
file: tmp/expansions.yaml
43684375
redacted: true
4376+
- command: ec2.assume_role
4377+
params:
4378+
role_arn: "arn:aws:iam::119629040606:role/s3-access.cdn-origin-compass"
43694379
- command: shell.exec
43704380
# silent: true
43714381
params:
@@ -4374,6 +4384,9 @@ functions:
43744384
env:
43754385
devtoolsbot_npm_token: ${devtoolsbot_npm_token}
43764386
node_js_version: ${node_js_version}
4387+
DOWNLOAD_CENTER_AWS_KEY_NEW: ${AWS_ACCESS_KEY_ID}
4388+
DOWNLOAD_CENTER_AWS_SECRET_NEW: ${AWS_SECRET_ACCESS_KEY}
4389+
DOWNLOAD_CENTER_AWS_SESSION_TOKEN_NEW: ${AWS_SESSION_TOKEN}
43774390
script: |
43784391
set -e
43794392
export PUPPETEER_SKIP_DOWNLOAD="true"

‎.github/workflows/update-cta.yml

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ on:
1919
default: CTA-Production
2020

2121
permissions:
22+
id-token: write
2223
contents: read
2324

2425
jobs:
@@ -34,16 +35,27 @@ jobs:
3435
DOWNLOAD_CENTER_AWS_SECRET: ${{ secrets.DOWNLOAD_CENTER_AWS_SECRET }}
3536
steps:
3637
- uses: actions/checkout@v4
38+
- name: configure aws credentials
39+
uses: aws-actions/[email protected]
40+
with:
41+
role-to-assume: arn:aws:iam::119629040606:role/s3-access.cdn-origin-compass
42+
aws-region: us-east-1
43+
- name: Sts GetCallerIdentity
44+
run: |
45+
aws sts get-caller-identity
3746
- uses: actions/setup-node@v4
3847
with:
3948
node-version: ^20.x
4049
cache: "npm"
41-
4250
- name: Install Dependencies and Compile
4351
run: |
4452
npm ci
4553
npm run compile
4654
4755
- name: Update greeting CTA
56+
env:
57+
DOWNLOAD_CENTER_AWS_KEY_NEW: "${{ env.AWS_ACCESS_KEY_ID }}"
58+
DOWNLOAD_CENTER_AWS_SECRET_NEW: "${{ env.AWS_SECRET_KEY }}"
59+
DOWNLOAD_CENTER_AWS_SESSION_TOKEN_NEW: "${{ env.AWS_SESSION_TOKEN }}"
4860
run: |
4961
npm run update-cta ${{ github.event.inputs.dry-run && '-- --dry-run' || '' }}

‎config/build.conf.js

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,9 @@ module.exports = {
9797
evgAwsSecret: process.env.AWS_SECRET,
9898
downloadCenterAwsKey: process.env.DOWNLOAD_CENTER_AWS_KEY,
9999
downloadCenterAwsSecret: process.env.DOWNLOAD_CENTER_AWS_SECRET,
100+
downloadCenterAwsKeyNew: process.env.DOWNLOAD_CENTER_AWS_KEY_NEW,
101+
downloadCenterAwsSecretNew: process.env.DOWNLOAD_CENTER_AWS_SECRET_NEW,
102+
downloadCenterAwsSessionTokenNew: process.env.DOWNLOAD_CENTER_AWS_SESSION_TOKEN_NEW,
100103
injectedJsonFeedFile: path.join(ROOT, 'config', 'mongosh-versions.json'),
101104
githubToken: process.env.GITHUB_TOKEN,
102105
segmentKey: process.env.SEGMENT_API_KEY,

‎packages/build/src/config/config.ts

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,9 @@ export interface Config {
4141
evgAwsSecret?: string;
4242
downloadCenterAwsKey?: string;
4343
downloadCenterAwsSecret?: string;
44+
downloadCenterAwsKeyNew?: string;
45+
downloadCenterAwsSecretNew?: string;
46+
downloadCenterAwsSessionTokenNew?: string;
4447
injectedJsonFeedFile?: string;
4548
githubToken?: string;
4649
segmentKey?: string;

‎packages/build/src/download-center/artifacts.ts

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
import { DownloadCenter as DownloadCenterCls } from '@mongodb-js/dl-center';
22
import * as fs from 'fs';
33
import path from 'path';
4-
import { ARTIFACTS_BUCKET, ARTIFACTS_FOLDER } from './constants';
4+
import {
5+
ARTIFACTS_BUCKET,
6+
ARTIFACTS_BUCKET_NEW,
7+
ARTIFACTS_FOLDER,
8+
} from './constants';
59

610
export async function uploadArtifactToDownloadCenter(
711
filePath: string,
@@ -20,3 +24,23 @@ export async function uploadArtifactToDownloadCenter(
2024
fs.createReadStream(filePath)
2125
);
2226
}
27+
28+
export async function uploadArtifactToDownloadCenterNew(
29+
filePath: string,
30+
awsAccessKeyId: string,
31+
awsSecretAccessKey: string,
32+
awsSessionToken: string,
33+
DownloadCenter: typeof DownloadCenterCls = DownloadCenterCls
34+
): Promise<void> {
35+
const dlcenter = new DownloadCenter({
36+
bucket: ARTIFACTS_BUCKET_NEW,
37+
accessKeyId: awsAccessKeyId,
38+
secretAccessKey: awsSecretAccessKey,
39+
sessionToken: awsSessionToken,
40+
});
41+
42+
await dlcenter.uploadAsset(
43+
`${ARTIFACTS_FOLDER}/${path.basename(filePath)}`,
44+
fs.createReadStream(filePath)
45+
);
46+
}

‎packages/build/src/download-center/config.spec.ts

Lines changed: 55 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ const packageInformation = (version: string) =>
4040

4141
const DUMMY_ACCESS_KEY = 'accessKey';
4242
const DUMMY_SECRET_KEY = 'secretKey';
43+
const DUMMY_SESSION_TOKEN = 'sessionToken';
4344
const DUMMY_CTA_CONFIG: CTAConfig = {};
4445

4546
describe('DownloadCenter config', function () {
@@ -273,6 +274,9 @@ describe('DownloadCenter config', function () {
273274
packageInformation('2.0.1'),
274275
DUMMY_ACCESS_KEY,
275276
DUMMY_SECRET_KEY,
277+
DUMMY_ACCESS_KEY,
278+
DUMMY_SECRET_KEY,
279+
DUMMY_SESSION_TOKEN,
276280
'',
277281
false,
278282
DUMMY_CTA_CONFIG,
@@ -290,6 +294,12 @@ describe('DownloadCenter config', function () {
290294
accessKeyId: DUMMY_ACCESS_KEY,
291295
secretAccessKey: DUMMY_SECRET_KEY,
292296
});
297+
expect(dlCenter).to.have.been.calledWith({
298+
bucket: 'cdn-origin-compass',
299+
accessKeyId: DUMMY_ACCESS_KEY,
300+
secretAccessKey: DUMMY_SECRET_KEY,
301+
sessionToken: DUMMY_SESSION_TOKEN,
302+
});
293303

294304
expect(uploadConfig).to.be.calledOnce;
295305

@@ -321,7 +331,7 @@ describe('DownloadCenter config', function () {
321331
tutorial_link: 'test',
322332
});
323333

324-
expect(uploadAsset).to.be.calledOnce;
334+
expect(uploadAsset).to.be.calledTwice;
325335
const [assetKey] = uploadAsset.lastCall.args;
326336
expect(assetKey).to.equal('compass/mongosh.json');
327337
});
@@ -332,6 +342,9 @@ describe('DownloadCenter config', function () {
332342
packageInformation('1.2.2'),
333343
DUMMY_ACCESS_KEY,
334344
DUMMY_SECRET_KEY,
345+
DUMMY_ACCESS_KEY,
346+
DUMMY_SECRET_KEY,
347+
DUMMY_SESSION_TOKEN,
335348
'',
336349
false,
337350
DUMMY_CTA_CONFIG,
@@ -349,6 +362,12 @@ describe('DownloadCenter config', function () {
349362
accessKeyId: DUMMY_ACCESS_KEY,
350363
secretAccessKey: DUMMY_SECRET_KEY,
351364
});
365+
expect(dlCenter).to.have.been.calledWith({
366+
bucket: 'cdn-origin-compass',
367+
accessKeyId: DUMMY_ACCESS_KEY,
368+
secretAccessKey: DUMMY_SECRET_KEY,
369+
sessionToken: DUMMY_SESSION_TOKEN,
370+
});
352371

353372
expect(uploadConfig).to.be.calledOnce;
354373

@@ -377,7 +396,7 @@ describe('DownloadCenter config', function () {
377396
tutorial_link: 'test',
378397
});
379398

380-
expect(uploadAsset).to.be.calledOnce;
399+
expect(uploadAsset).to.be.calledTwice;
381400
const [assetKey, uploadedAsset] = uploadAsset.lastCall.args;
382401
expect(assetKey).to.equal('compass/mongosh.json');
383402
const jsonFeedData = JSON.parse(uploadedAsset);
@@ -431,6 +450,9 @@ describe('DownloadCenter config', function () {
431450
packageInformation('2.0.0'),
432451
DUMMY_ACCESS_KEY,
433452
DUMMY_SECRET_KEY,
453+
DUMMY_ACCESS_KEY,
454+
DUMMY_SECRET_KEY,
455+
DUMMY_SESSION_TOKEN,
434456
path.resolve(
435457
__dirname,
436458
'..',
@@ -455,6 +477,12 @@ describe('DownloadCenter config', function () {
455477
accessKeyId: DUMMY_ACCESS_KEY,
456478
secretAccessKey: DUMMY_SECRET_KEY,
457479
});
480+
expect(dlCenter).to.have.been.calledWith({
481+
bucket: 'cdn-origin-compass',
482+
accessKeyId: DUMMY_ACCESS_KEY,
483+
secretAccessKey: DUMMY_SECRET_KEY,
484+
sessionToken: DUMMY_SESSION_TOKEN,
485+
});
458486

459487
expect(uploadConfig).to.be.calledOnce;
460488

@@ -486,7 +514,7 @@ describe('DownloadCenter config', function () {
486514
tutorial_link: 'test',
487515
});
488516

489-
expect(uploadAsset).to.be.calledOnce;
517+
expect(uploadAsset).to.be.calledTwice;
490518
const [assetKey, uploadedAsset] = uploadAsset.lastCall.args;
491519
expect(assetKey).to.equal('compass/mongosh.json');
492520
const jsonFeedData = JSON.parse(uploadedAsset);
@@ -593,6 +621,9 @@ describe('DownloadCenter config', function () {
593621
config,
594622
DUMMY_ACCESS_KEY,
595623
DUMMY_SECRET_KEY,
624+
DUMMY_ACCESS_KEY,
625+
DUMMY_SECRET_KEY,
626+
DUMMY_SESSION_TOKEN,
596627
dryRun,
597628
dlCenter as any
598629
);
@@ -630,6 +661,9 @@ describe('DownloadCenter config', function () {
630661
config,
631662
DUMMY_ACCESS_KEY,
632663
DUMMY_SECRET_KEY,
664+
DUMMY_ACCESS_KEY,
665+
DUMMY_SECRET_KEY,
666+
DUMMY_SESSION_TOKEN,
633667
false,
634668
dlCenter as any
635669
);
@@ -655,6 +689,9 @@ describe('DownloadCenter config', function () {
655689
ctas,
656690
DUMMY_ACCESS_KEY,
657691
DUMMY_SECRET_KEY,
692+
DUMMY_ACCESS_KEY,
693+
DUMMY_SECRET_KEY,
694+
DUMMY_SESSION_TOKEN,
658695
false,
659696
dlCenter as any
660697
);
@@ -677,6 +714,9 @@ describe('DownloadCenter config', function () {
677714
config,
678715
DUMMY_ACCESS_KEY,
679716
DUMMY_SECRET_KEY,
717+
DUMMY_ACCESS_KEY,
718+
DUMMY_SECRET_KEY,
719+
DUMMY_SESSION_TOKEN,
680720
false,
681721
dlCenter as any
682722
);
@@ -699,6 +739,9 @@ describe('DownloadCenter config', function () {
699739
config,
700740
DUMMY_ACCESS_KEY,
701741
DUMMY_SECRET_KEY,
742+
DUMMY_ACCESS_KEY,
743+
DUMMY_SECRET_KEY,
744+
DUMMY_SESSION_TOKEN,
702745
false,
703746
dlCenter as any
704747
);
@@ -721,6 +764,9 @@ describe('DownloadCenter config', function () {
721764
config,
722765
DUMMY_ACCESS_KEY,
723766
DUMMY_SECRET_KEY,
767+
DUMMY_ACCESS_KEY,
768+
DUMMY_SECRET_KEY,
769+
DUMMY_SESSION_TOKEN,
724770
false,
725771
dlCenter as any
726772
);
@@ -750,6 +796,9 @@ describe('DownloadCenter config', function () {
750796
config,
751797
DUMMY_ACCESS_KEY,
752798
DUMMY_SECRET_KEY,
799+
DUMMY_ACCESS_KEY,
800+
DUMMY_SECRET_KEY,
801+
DUMMY_SESSION_TOKEN,
753802
false,
754803
dlCenter as any
755804
);
@@ -779,6 +828,9 @@ describe('DownloadCenter config', function () {
779828
config,
780829
DUMMY_ACCESS_KEY,
781830
DUMMY_SECRET_KEY,
831+
DUMMY_ACCESS_KEY,
832+
DUMMY_SECRET_KEY,
833+
DUMMY_SESSION_TOKEN,
782834
false,
783835
dlCenter as any
784836
);

‎packages/build/src/download-center/config.ts

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import type {
99
} from '@mongodb-js/dl-center/dist/download-center-config';
1010
import {
1111
ARTIFACTS_BUCKET,
12+
ARTIFACTS_BUCKET_NEW,
1213
JSON_FEED_ARTIFACT_KEY,
1314
ARTIFACTS_URL_PUBLIC_BASE,
1415
CONFIGURATION_KEY,
@@ -55,6 +56,9 @@ export async function createAndPublishDownloadCenterConfig(
5556
packageInformation: PackageInformationProvider,
5657
awsAccessKeyId: string,
5758
awsSecretAccessKey: string,
59+
awsAccessKeyIdNew: string,
60+
awsSecretAccessKeyNew: string,
61+
awsSessionTokenNew: string,
5862
injectedJsonFeedFile: string,
5963
isDryRun: boolean,
6064
ctaConfig: CTAConfig,
@@ -100,6 +104,13 @@ export async function createAndPublishDownloadCenterConfig(
100104
secretAccessKey: awsSecretAccessKey,
101105
});
102106

107+
const dlcenterArtifactsNew = new DownloadCenter({
108+
bucket: ARTIFACTS_BUCKET_NEW,
109+
accessKeyId: awsAccessKeyIdNew,
110+
secretAccessKey: awsSecretAccessKeyNew,
111+
sessionToken: awsSessionTokenNew,
112+
});
113+
103114
const existingJsonFeed = await getCurrentJsonFeed(dlcenterArtifacts);
104115
const injectedJsonFeed: JsonFeed | undefined = injectedJsonFeedFile
105116
? JSON.parse(await fs.readFile(injectedJsonFeedFile, 'utf8'))
@@ -135,12 +146,20 @@ export async function createAndPublishDownloadCenterConfig(
135146
JSON.stringify(newJsonFeed, null, 2)
136147
),
137148
]);
149+
150+
await dlcenterArtifactsNew.uploadAsset(
151+
JSON_FEED_ARTIFACT_KEY,
152+
JSON.stringify(newJsonFeed, null, 2)
153+
);
138154
}
139155

140156
export async function updateJsonFeedCTA(
141157
config: CTAConfig,
142158
awsAccessKeyId: string,
143159
awsSecretAccessKey: string,
160+
awsAccessKeyIdNew: string,
161+
awsSecretAccessKeyNew: string,
162+
awsSessionTokenNew: string,
144163
isDryRun: boolean,
145164
DownloadCenter: typeof DownloadCenterCls = DownloadCenterCls
146165
) {
@@ -150,6 +169,13 @@ export async function updateJsonFeedCTA(
150169
secretAccessKey: awsSecretAccessKey,
151170
});
152171

172+
const dlcenterArtifactsNew = new DownloadCenter({
173+
bucket: ARTIFACTS_BUCKET_NEW,
174+
accessKeyId: awsAccessKeyIdNew,
175+
secretAccessKey: awsSecretAccessKeyNew,
176+
sessionToken: awsSessionTokenNew,
177+
});
178+
153179
const jsonFeed = await getCurrentJsonFeed(dlcenterArtifacts);
154180
if (!jsonFeed) {
155181
throw new Error('No existing JSON feed found');
@@ -165,6 +191,10 @@ export async function updateJsonFeedCTA(
165191
}
166192

167193
await dlcenterArtifacts.uploadAsset(JSON_FEED_ARTIFACT_KEY, patchedJsonFeed);
194+
await dlcenterArtifactsNew.uploadAsset(
195+
JSON_FEED_ARTIFACT_KEY,
196+
patchedJsonFeed
197+
);
168198
}
169199

170200
function populateJsonFeedCTAs(jsonFeed: JsonFeed, ctas: CTAConfig) {

0 commit comments

Comments
 (0)