mongodb-js · drichmdb · Apr 8, 2025 · Mar 18, 2025
@@ -4295,10 +4295,17 @@ functions:
       params:
         file: tmp/expansions.yaml
         redacted: true
+    - command: ec2.assume_role
+      params:
+        role_arn: "arn:aws:iam::119629040606:role/s3-access.cdn-origin-compass"
     - command: shell.exec
       params:
         working_dir: src
         shell: bash
+        env:
+          DOWNLOAD_CENTER_AWS_KEY_NEW: ${AWS_ACCESS_KEY_ID}
+          DOWNLOAD_CENTER_AWS_SECRET_NEW: ${AWS_SECRET_ACCESS_KEY}
+          DOWNLOAD_CENTER_AWS_SESSION_TOKEN_NEW: ${AWS_SESSION_TOKEN}
         script: |
           set -e
           {
@@ -4362,6 +4369,9 @@ functions:
       params:
         file: tmp/expansions.yaml
         redacted: true
+    - command: ec2.assume_role
+      params:
+        role_arn: "arn:aws:iam::119629040606:role/s3-access.cdn-origin-compass"
     - command: shell.exec
       # silent: true
       params:
@@ -4370,6 +4380,9 @@ functions:
         env:
           devtoolsbot_npm_token: ${devtoolsbot_npm_token}
           node_js_version: ${node_js_version}
+          DOWNLOAD_CENTER_AWS_KEY_NEW: ${AWS_ACCESS_KEY_ID}
+          DOWNLOAD_CENTER_AWS_SECRET_NEW: ${AWS_SECRET_ACCESS_KEY}
+          DOWNLOAD_CENTER_AWS_SESSION_TOKEN_NEW: ${AWS_SESSION_TOKEN}
         script: |
           set -e
           export PUPPETEER_SKIP_DOWNLOAD="true"

@@ -19,6 +19,7 @@ on:
         default: CTA-Production
 
 permissions:
+  id-token: write
   contents: read
 
 jobs:
@@ -34,16 +35,27 @@ jobs:
       DOWNLOAD_CENTER_AWS_SECRET: ${{ secrets.DOWNLOAD_CENTER_AWS_SECRET }}
     steps:
       - uses: actions/checkout@v4
+      - name: configure aws credentials
+        uses: aws-actions/[email protected]
+        with:
+          role-to-assume: arn:aws:iam::119629040606:role/s3-access.cdn-origin-compass
+          aws-region: us-east-1
+      - name: Sts GetCallerIdentity
+        run: |
+          aws sts get-caller-identity
       - uses: actions/setup-node@v4
         with:
           node-version: ^20.x
           cache: "npm"
-
       - name: Install Dependencies and Compile
         run: |
           npm ci
           npm run compile
 
       - name: Update greeting CTA
+        env:
+          DOWNLOAD_CENTER_AWS_KEY_NEW: "${{ env.AWS_ACCESS_KEY_ID }}"
+          DOWNLOAD_CENTER_AWS_SECRET_NEW: "${{ env.AWS_SECRET_KEY }}"
+          DOWNLOAD_CENTER_AWS_SESSION_TOKEN_NEW: "${{ env.AWS_SESSION_TOKEN }}"
         run: |
           npm run update-cta ${{ github.event.inputs.dry-run && '-- --dry-run' || '' }}
@@ -97,6 +97,9 @@ module.exports = {
   evgAwsSecret: process.env.AWS_SECRET,
   downloadCenterAwsKey: process.env.DOWNLOAD_CENTER_AWS_KEY,
   downloadCenterAwsSecret: process.env.DOWNLOAD_CENTER_AWS_SECRET,
+  downloadCenterAwsKeyNew: process.env.DOWNLOAD_CENTER_AWS_KEY_NEW,
+  downloadCenterAwsSecretNew: process.env.DOWNLOAD_CENTER_AWS_SECRET_NEW,
+  downloadCenterAwsSessionTokenNew: process.env.DOWNLOAD_CENTER_AWS_SESSION_TOKEN_NEW,
   injectedJsonFeedFile: path.join(ROOT, 'config', 'mongosh-versions.json'),
   githubToken: process.env.GITHUB_TOKEN,
   segmentKey: process.env.SEGMENT_API_KEY,

@@ -41,6 +41,9 @@ export interface Config {
   evgAwsSecret?: string;
   downloadCenterAwsKey?: string;
   downloadCenterAwsSecret?: string;
+  downloadCenterAwsKeyNew?: string;
+  downloadCenterAwsSecretNew?: string;
+  downloadCenterAwsSessionTokenNew?: string;
   injectedJsonFeedFile?: string;
   githubToken?: string;
   segmentKey?: string;

@@ -1,7 +1,11 @@
 import { DownloadCenter as DownloadCenterCls } from '@mongodb-js/dl-center';
 import * as fs from 'fs';
 import path from 'path';
-import { ARTIFACTS_BUCKET, ARTIFACTS_FOLDER } from './constants';
+import {
+  ARTIFACTS_BUCKET,
+  ARTIFACTS_BUCKET_NEW,
+  ARTIFACTS_FOLDER,
+} from './constants';
 
 export async function uploadArtifactToDownloadCenter(
   filePath: string,
@@ -20,3 +24,23 @@ export async function uploadArtifactToDownloadCenter(
     fs.createReadStream(filePath)
   );
 }
+
+export async function uploadArtifactToDownloadCenterNew(
+  filePath: string,
+  awsAccessKeyId: string,
+  awsSecretAccessKey: string,
+  awsSessionToken: string,
+  DownloadCenter: typeof DownloadCenterCls = DownloadCenterCls
+): Promise<void> {
+  const dlcenter = new DownloadCenter({
+    bucket: ARTIFACTS_BUCKET_NEW,
+    accessKeyId: awsAccessKeyId,
+    secretAccessKey: awsSecretAccessKey,
+    sessionToken: awsSessionToken,
+  });
+
+  await dlcenter.uploadAsset(
+    `${ARTIFACTS_FOLDER}/${path.basename(filePath)}`,
+    fs.createReadStream(filePath)
+  );
+}
@@ -40,6 +40,7 @@ const packageInformation = (version: string) =>
 
 const DUMMY_ACCESS_KEY = 'accessKey';
 const DUMMY_SECRET_KEY = 'secretKey';
+const DUMMY_SESSION_TOKEN = 'sessionToken';
 const DUMMY_CTA_CONFIG: CTAConfig = {};
 
 describe('DownloadCenter config', function () {
@@ -273,6 +274,9 @@ describe('DownloadCenter config', function () {
           packageInformation('2.0.1'),
           DUMMY_ACCESS_KEY,
           DUMMY_SECRET_KEY,
+          DUMMY_ACCESS_KEY,
+          DUMMY_SECRET_KEY,
+          DUMMY_SESSION_TOKEN,
           '',
           false,
           DUMMY_CTA_CONFIG,
@@ -290,6 +294,12 @@ describe('DownloadCenter config', function () {
           accessKeyId: DUMMY_ACCESS_KEY,
           secretAccessKey: DUMMY_SECRET_KEY,
         });
+        expect(dlCenter).to.have.been.calledWith({
+          bucket: 'cdn-origin-compass',
+          accessKeyId: DUMMY_ACCESS_KEY,
+          secretAccessKey: DUMMY_SECRET_KEY,
+          sessionToken: DUMMY_SESSION_TOKEN,
+        });
 
         expect(uploadConfig).to.be.calledOnce;
 
@@ -321,7 +331,7 @@ describe('DownloadCenter config', function () {
           tutorial_link: 'test',
         });
 
-        expect(uploadAsset).to.be.calledOnce;
+        expect(uploadAsset).to.be.calledTwice;
         const [assetKey] = uploadAsset.lastCall.args;
         expect(assetKey).to.equal('compass/mongosh.json');
       });
@@ -332,6 +342,9 @@ describe('DownloadCenter config', function () {
           packageInformation('1.2.2'),
           DUMMY_ACCESS_KEY,
           DUMMY_SECRET_KEY,
+          DUMMY_ACCESS_KEY,
+          DUMMY_SECRET_KEY,
+          DUMMY_SESSION_TOKEN,
           '',
           false,
           DUMMY_CTA_CONFIG,
@@ -349,6 +362,12 @@ describe('DownloadCenter config', function () {
           accessKeyId: DUMMY_ACCESS_KEY,
           secretAccessKey: DUMMY_SECRET_KEY,
         });
+        expect(dlCenter).to.have.been.calledWith({
+          bucket: 'cdn-origin-compass',
+          accessKeyId: DUMMY_ACCESS_KEY,
+          secretAccessKey: DUMMY_SECRET_KEY,
+          sessionToken: DUMMY_SESSION_TOKEN,
+        });
 
         expect(uploadConfig).to.be.calledOnce;
 
@@ -377,7 +396,7 @@ describe('DownloadCenter config', function () {
           tutorial_link: 'test',
         });
 
-        expect(uploadAsset).to.be.calledOnce;
+        expect(uploadAsset).to.be.calledTwice;
         const [assetKey, uploadedAsset] = uploadAsset.lastCall.args;
         expect(assetKey).to.equal('compass/mongosh.json');
         const jsonFeedData = JSON.parse(uploadedAsset);
@@ -431,6 +450,9 @@ describe('DownloadCenter config', function () {
           packageInformation('2.0.0'),
           DUMMY_ACCESS_KEY,
           DUMMY_SECRET_KEY,
+          DUMMY_ACCESS_KEY,
+          DUMMY_SECRET_KEY,
+          DUMMY_SESSION_TOKEN,
           path.resolve(
             __dirname,
             '..',
@@ -455,6 +477,12 @@ describe('DownloadCenter config', function () {
           accessKeyId: DUMMY_ACCESS_KEY,
           secretAccessKey: DUMMY_SECRET_KEY,
         });
+        expect(dlCenter).to.have.been.calledWith({
+          bucket: 'cdn-origin-compass',
+          accessKeyId: DUMMY_ACCESS_KEY,
+          secretAccessKey: DUMMY_SECRET_KEY,
+          sessionToken: DUMMY_SESSION_TOKEN,
+        });
 
         expect(uploadConfig).to.be.calledOnce;
 
@@ -486,7 +514,7 @@ describe('DownloadCenter config', function () {
           tutorial_link: 'test',
         });
 
-        expect(uploadAsset).to.be.calledOnce;
+        expect(uploadAsset).to.be.calledTwice;
         const [assetKey, uploadedAsset] = uploadAsset.lastCall.args;
         expect(assetKey).to.equal('compass/mongosh.json');
         const jsonFeedData = JSON.parse(uploadedAsset);
@@ -593,6 +621,9 @@ describe('DownloadCenter config', function () {
           config,
           DUMMY_ACCESS_KEY,
           DUMMY_SECRET_KEY,
+          DUMMY_ACCESS_KEY,
+          DUMMY_SECRET_KEY,
+          DUMMY_SESSION_TOKEN,
           dryRun,
           dlCenter as any
         );
@@ -630,6 +661,9 @@ describe('DownloadCenter config', function () {
         config,
         DUMMY_ACCESS_KEY,
         DUMMY_SECRET_KEY,
+        DUMMY_ACCESS_KEY,
+        DUMMY_SECRET_KEY,
+        DUMMY_SESSION_TOKEN,
         false,
         dlCenter as any
       );
@@ -655,6 +689,9 @@ describe('DownloadCenter config', function () {
         ctas,
         DUMMY_ACCESS_KEY,
         DUMMY_SECRET_KEY,
+        DUMMY_ACCESS_KEY,
+        DUMMY_SECRET_KEY,
+        DUMMY_SESSION_TOKEN,
         false,
         dlCenter as any
       );
@@ -677,6 +714,9 @@ describe('DownloadCenter config', function () {
         config,
         DUMMY_ACCESS_KEY,
         DUMMY_SECRET_KEY,
+        DUMMY_ACCESS_KEY,
+        DUMMY_SECRET_KEY,
+        DUMMY_SESSION_TOKEN,
         false,
         dlCenter as any
       );
@@ -699,6 +739,9 @@ describe('DownloadCenter config', function () {
         config,
         DUMMY_ACCESS_KEY,
         DUMMY_SECRET_KEY,
+        DUMMY_ACCESS_KEY,
+        DUMMY_SECRET_KEY,
+        DUMMY_SESSION_TOKEN,
         false,
         dlCenter as any
       );
@@ -721,6 +764,9 @@ describe('DownloadCenter config', function () {
         config,
         DUMMY_ACCESS_KEY,
         DUMMY_SECRET_KEY,
+        DUMMY_ACCESS_KEY,
+        DUMMY_SECRET_KEY,
+        DUMMY_SESSION_TOKEN,
         false,
         dlCenter as any
       );
@@ -750,6 +796,9 @@ describe('DownloadCenter config', function () {
         config,
         DUMMY_ACCESS_KEY,
         DUMMY_SECRET_KEY,
+        DUMMY_ACCESS_KEY,
+        DUMMY_SECRET_KEY,
+        DUMMY_SESSION_TOKEN,
         false,
         dlCenter as any
       );
@@ -779,6 +828,9 @@ describe('DownloadCenter config', function () {
         config,
         DUMMY_ACCESS_KEY,
         DUMMY_SECRET_KEY,
+        DUMMY_ACCESS_KEY,
+        DUMMY_SECRET_KEY,
+        DUMMY_SESSION_TOKEN,
         false,
         dlCenter as any
       );