fix generated invalid trigger role or policy names (#109)

* fix generated invalid trigger role or policy names * update package version
alibaba · Dec 17, 2018 · 240977c · 240977c
1 parent a3f3bc8
commit 240977c
Show file tree

Hide file tree

Showing 6 changed files with 249 additions and 66 deletions.
diff --git a/lib/deploy/deploy-by-tpl.js b/lib/deploy/deploy-by-tpl.js
@@ -33,7 +33,8 @@ let {
 let {
   makeRole,
   attachPolicyToRole,
-  makeAndAttachPolicy
+  makeAndAttachPolicy,
+  normalizeRoleOrPoliceName
 } = require('../ram');
 
 function extractFcRole(role) {
@@ -42,10 +43,6 @@ function extractFcRole(role) {
   return roleName;
 }
 
-function nomalizeRoleOrPoliceName(roleName) {
-  return roleName.replace(/_/g, '-');
-}
-
 async function deployFunction(baseDir, serviceName, functionName, functionDefinition) {
   const properties = functionDefinition.Properties || {};
 
@@ -107,12 +104,11 @@ async function deployPolicy(serviceName, roleName, policy, curCount) {
 
   const profile = await getProfile();
 
-  const policyName = nomalizeRoleOrPoliceName(`AliyunFcGeneratedServicePolicy-${profile.defaultRegion}-${serviceName}${curCount}`);
+  const policyName = normalizeRoleOrPoliceName(`AliyunFcGeneratedServicePolicy-${profile.defaultRegion}-${serviceName}${curCount}`);
 
   await makeAndAttachPolicy(policyName, policy, roleName);
 
   return curCount + 1;
-
 }
 
 async function deployPolicies(serviceName, roleName, policies) {
@@ -150,7 +146,7 @@ async function deployFcService(baseDir, serviceName, serviceDefinition) {
     createRoleIfNotExist = false;
   } else {
     roleName = `aliyunfcgeneratedrole-${profile.defaultRegion}-${serviceName}`;
-    roleName = nomalizeRoleOrPoliceName(roleName);
+    roleName = normalizeRoleOrPoliceName(roleName);
     createRoleIfNotExist = true;
   }
 
@@ -166,7 +162,7 @@ async function deployFcService(baseDir, serviceName, serviceDefinition) {
 
   if (logConfig.Logstore && logConfig.Project) {
     if (!roleArn) {
-      const logPolicyName = nomalizeRoleOrPoliceName(`AliyunFcGeneratedLogPolicy-${profile.defaultRegion}-${serviceName}`);
+      const logPolicyName = normalizeRoleOrPoliceName(`AliyunFcGeneratedLogPolicy-${profile.defaultRegion}-${serviceName}`);
       await makeAndAttachPolicy(logPolicyName, {
         'Version': '1',
         'Statement': [{

diff --git a/lib/deploy/deploy-support.js b/lib/deploy/deploy-support.js
@@ -22,11 +22,7 @@ const promiseRetry = require('../retry');
 
 const funignore = require('../package/ignore');
 
-let {
-    makeRole,
-    attachPolicyToRole,
-    makePolicy
-} = require('../ram');
+const ram = require('../ram');
 
 const readFile = util.promisify(fs.readFile);
 
@@ -505,9 +501,10 @@ function getTriggerConfig(triggerType, triggerProperties) {
 
 async function makeInvocationRole(serviceName, functionName, triggerType) {
     if (triggerType === 'Log') {
-        const invocationRoleName = `AliyunFcGeneratedInvocationRole-${serviceName}-${functionName}`;
 
-        const invocationRole = await makeRole(invocationRoleName, true, 'Used for fc invocation', {
+        const invocationRoleName = ram.normalizeRoleOrPoliceName(`AliyunFcGeneratedInvocationRole-${serviceName}-${functionName}`);
+
+        const invocationRole = await ram.makeRole(invocationRoleName, true, 'Used for fc invocation', {
             'Statement': [{
                 'Action': 'sts:AssumeRole',
                 'Effect': 'Allow',
@@ -520,48 +517,49 @@ async function makeInvocationRole(serviceName, functionName, triggerType) {
             'Version': '1'
         });
 
-        const policyName = `AliyunFcGeneratedInvocationPolicy-${serviceName}-${functionName}`;
+        const policyName = ram.normalizeRoleOrPoliceName(`AliyunFcGeneratedInvocationPolicy-${serviceName}-${functionName}`);
 
-        await makePolicy(policyName, {
+        await ram.makePolicy(policyName, {
             'Version': '1',
             'Statement': [{
-                    'Action': [
-                        'fc:InvokeFunction'
-                    ],
-                    'Resource': `acs:fc:*:*:services/${serviceName}/functions/*`,
-                    'Effect': 'Allow'
-                },
-                {
-                    'Action': [
-                        'log:Get*',
-                        'log:List*',
-                        'log:PostLogStoreLogs',
-                        'log:CreateConsumerGroup',
-                        'log:UpdateConsumerGroup',
-                        'log:DeleteConsumerGroup',
-                        'log:ListConsumerGroup',
-                        'log:ConsumerGroupUpdateCheckPoint',
-                        'log:ConsumerGroupHeartBeat',
-                        'log:GetConsumerGroupCheckPoint'
-                    ],
-                    'Resource': '*',
-                    'Effect': 'Allow'
-                }
+                'Action': [
+                    'fc:InvokeFunction'
+                ],
+                'Resource': `acs:fc:*:*:services/${serviceName}/functions/*`,
+                'Effect': 'Allow'
+            },
+            {
+                'Action': [
+                    'log:Get*',
+                    'log:List*',
+                    'log:PostLogStoreLogs',
+                    'log:CreateConsumerGroup',
+                    'log:UpdateConsumerGroup',
+                    'log:DeleteConsumerGroup',
+                    'log:ListConsumerGroup',
+                    'log:ConsumerGroupUpdateCheckPoint',
+                    'log:ConsumerGroupHeartBeat',
+                    'log:GetConsumerGroupCheckPoint'
+                ],
+                'Resource': '*',
+                'Effect': 'Allow'
+            }
             ]
         });
 
-        await attachPolicyToRole(policyName, invocationRoleName, 'Custom');
+        await ram.attachPolicyToRole(policyName, invocationRoleName, 'Custom');
         return invocationRole.Role;
 
     } else if (triggerType === 'RDS' || triggerType === 'MNSTopic') {
-        const invocationRoleName = `FunCreateRole-${serviceName}-${functionName}`;
+
+        const invocationRoleName = ram.normalizeRoleOrPoliceName(`FunCreateRole-${serviceName}-${functionName}`);
         var tMap = {
             'RDS': 'rds',
             'MNSTopic': 'mns'
         };
         var principalService = util.format('%s.aliyuncs.com', tMap[triggerType]);
 
-        const invocationRole = await makeRole(invocationRoleName, true, 'Used for fc invocation', {
+        const invocationRole = await ram.makeRole(invocationRoleName, true, 'Used for fc invocation', {
             'Statement': [{
                 'Action': 'sts:AssumeRole',
                 'Effect': 'Allow',
@@ -574,9 +572,9 @@ async function makeInvocationRole(serviceName, functionName, triggerType) {
             'Version': '1'
         });
 
-        const policyName = `FunCreatePolicy-${serviceName}-${functionName}`;
+        const policyName = ram.normalizeRoleOrPoliceName(`FunCreatePolicy-${serviceName}-${functionName}`);
 
-        await makePolicy(policyName, {
+        await ram.makePolicy(policyName, {
             'Version': '1',
             'Statement': [{
                 'Action': [
@@ -587,14 +585,14 @@ async function makeInvocationRole(serviceName, functionName, triggerType) {
             }]
         });
 
-        await attachPolicyToRole(policyName, invocationRoleName, 'Custom');
+        await ram.attachPolicyToRole(policyName, invocationRoleName, 'Custom');
 
         return invocationRole.Role;
 
     } else if (triggerType === 'TableStore') {
-        const invocationRoleName = `FunCreateRole-${serviceName}-${functionName}`;
+        const invocationRoleName = ram.normalizeRoleOrPoliceName(`FunCreateRole-${serviceName}-${functionName}`);
 
-        const invocationRole = await makeRole(invocationRoleName, true, 'Used for fc invocation', {
+        const invocationRole = await ram.makeRole(invocationRoleName, true, 'Used for fc invocation', {
             'Statement': [{
                 'Action': 'sts:AssumeRole',
                 'Effect': 'Allow',
@@ -607,9 +605,9 @@ async function makeInvocationRole(serviceName, functionName, triggerType) {
             'Version': '1'
         });
 
-        const invkPolicyName = `FunCreateInvkPolicy-${serviceName}-${functionName}`;
+        const invkPolicyName = ram.normalizeRoleOrPoliceName(`FunCreateInvkPolicy-${serviceName}-${functionName}`);
 
-        await makePolicy(invkPolicyName, {
+        await ram.makePolicy(invkPolicyName, {
             'Version': '1',
             'Statement': [{
                 'Action': [
@@ -620,11 +618,11 @@ async function makeInvocationRole(serviceName, functionName, triggerType) {
             }]
         });
 
-        await attachPolicyToRole(invkPolicyName, invocationRoleName, 'Custom');
+        await ram.attachPolicyToRole(invkPolicyName, invocationRoleName, 'Custom');
 
-        const otsReadPolicyName = `FunCreateOtsReadPolicy-${serviceName}-${functionName}`;
+        const otsReadPolicyName = ram.normalizeRoleOrPoliceName(`FunCreateOtsReadPolicy-${serviceName}-${functionName}`);
 
-        await makePolicy(otsReadPolicyName, {
+        await ram.makePolicy(otsReadPolicyName, {
             'Version': '1',
             'Statement': [{
                 'Action': [
@@ -638,7 +636,7 @@ async function makeInvocationRole(serviceName, functionName, triggerType) {
             }]
         });
 
-        await attachPolicyToRole(otsReadPolicyName, invocationRoleName, 'Custom');
+        await ram.attachPolicyToRole(otsReadPolicyName, invocationRoleName, 'Custom');
 
         return invocationRole.Role;
     }
@@ -971,7 +969,7 @@ async function makeApiTrigger({
     restApiId
 }) {
     if (!restApiId) {
-        const role = await makeRole('apigatewayAccessFC');
+        const role = await ram.makeRole('apigatewayAccessFC');
         debug('%j', role);
 
         const apiGroup = await makeGroup({
@@ -1018,8 +1016,8 @@ async function makeOtsInstance(instanceName, clusterType, description) {
                 ClusterType: clusterType,
                 Description: description
             }, {
-                method: 'POST'
-            });
+                    method: 'POST'
+                });
         } catch (ex) {
             if (ex.code === 'InvalidParameter' || ex.code === 'QuotaExhausted') {
                 console.error(red(ex.message));
@@ -1092,5 +1090,6 @@ module.exports = {
     makeLogstore,
     makeLogstoreIndex,
     makeCustomDomain,
-    makeMnsTopic
+    makeMnsTopic,
+    makeInvocationRole
 };
diff --git a/lib/ram.js b/lib/ram.js
@@ -19,6 +19,9 @@ const getRamClient = async () => {
   });
 };
 
+function normalizeRoleOrPoliceName(roleName) {
+  return roleName.replace(/_/g, '-');
+}
 
 async function deletePolicyNotDefaultVersion(ram, policyName) {
   const listResponse = await ram.listPolicyVersions({
@@ -180,5 +183,7 @@ async function makeAndAttachPolicy(policyName, policyDocument, roleName) {
 }
 
 module.exports = {
-  makeRole, makePolicy, attachPolicyToRole, makeAndAttachPolicy
+  makeRole, makePolicy, 
+  attachPolicyToRole, makeAndAttachPolicy,
+  normalizeRoleOrPoliceName
 };
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@alicloud/fun",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "(have)Fun with Serverless",
   "engines": {
     "node": ">=8.0.0"