Skip to content

Commit 2e51c19

Browse files
leandrodamascenaleandrodamascena
authored
chore(layers): balance Python 3.13 layers in GovCloud partition (#5579)
Balancing layers Python 3.13 in GovCloud
1 parent f3c3b8e commit 2e51c19

File tree

1 file changed

+205
-0
lines changed

1 file changed

+205
-0
lines changed

‎.github/workflows/layer_govcloud_python313.yml

+205
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
# GovCloud Layer Publish
2+
# ---
3+
# This workflow publishes a specific layer version in an AWS account based on the environment input.
4+
#
5+
# Using a matrix, we pull each architecture and python version of the layer and store them as artifacts
6+
# we upload them to each of the GovCloud AWS accounts.
7+
#
8+
# A number of safety checks are performed to ensure safety.
9+
10+
on:
11+
workflow_dispatch:
12+
inputs:
13+
environment:
14+
description: Deployment environment
15+
type: choice
16+
options:
17+
- Gamma
18+
- Prod
19+
required: true
20+
version:
21+
description: Layer version to duplicate
22+
type: string
23+
required: true
24+
workflow_call:
25+
inputs:
26+
environment:
27+
description: Deployment environment
28+
type: string
29+
required: true
30+
version:
31+
description: Layer version to duplicate
32+
type: string
33+
required: true
34+
35+
name: Layer Deployment (GovCloud) - Temporary for Python 3.13
36+
run-name: Layer Deployment (GovCloud) - ${{ inputs.environment }}
37+
38+
jobs:
39+
download:
40+
runs-on: ubuntu-latest
41+
permissions:
42+
id-token: write
43+
contents: read
44+
strategy:
45+
matrix:
46+
layer:
47+
- AWSLambdaPowertoolsPythonV3-python313
48+
arch:
49+
- arm64
50+
- x86_64
51+
environment: Prod (Readonly)
52+
steps:
53+
- name: Configure AWS Credentials
54+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
55+
with:
56+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
57+
aws-region: us-east-1
58+
mask-aws-account-id: true
59+
- name: Grab Zip
60+
run: |
61+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} --query 'Content.Location' | xargs curl -L -o ${{ matrix.layer }}_${{ matrix.arch }}.zip
62+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} > ${{ matrix.layer }}_${{ matrix.arch }}.json
63+
- name: Store Zip
64+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
65+
with:
66+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
67+
path: ${{ matrix.layer }}_${{ matrix.arch }}.zip
68+
retention-days: 1
69+
if-no-files-found: error
70+
- name: Store Metadata
71+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
72+
with:
73+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
74+
path: ${{ matrix.layer }}_${{ matrix.arch }}.json
75+
retention-days: 1
76+
if-no-files-found: error
77+
78+
copy_east:
79+
name: Copy (East)
80+
needs: download
81+
runs-on: ubuntu-latest
82+
permissions:
83+
id-token: write
84+
contents: read
85+
strategy:
86+
matrix:
87+
layer:
88+
- AWSLambdaPowertoolsPythonV3-python313
89+
arch:
90+
- arm64
91+
- x86_64
92+
environment: GovCloud ${{ inputs.environment }} (East)
93+
steps:
94+
- name: Download Zip
95+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
96+
with:
97+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
98+
- name: Download Metadata
99+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
100+
with:
101+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
102+
- name: Verify Layer Signature
103+
run: |
104+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
105+
test "$(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
106+
- name: Configure AWS Credentials
107+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
108+
with:
109+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
110+
aws-region: us-gov-east-1
111+
mask-aws-account-id: true
112+
- name: Create Layer
113+
id: create-layer
114+
run: |
115+
LAYER_VERSION=$(aws --region us-gov-east-1 lambda publish-layer-version \
116+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
117+
--zip-file fileb://./${{ matrix.layer }}_${{ matrix.arch }}.zip \
118+
--compatible-runtimes "$(jq -r '.CompatibleRuntimes[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
119+
--compatible-architectures "$(jq -r '.CompatibleArchitectures[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
120+
--license-info "MIT-0" \
121+
--description "$(jq -r '.Description' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
122+
--query 'Version' \
123+
--output text)
124+
125+
echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"
126+
127+
aws --region us-gov-east-1 lambda add-layer-version-permission \
128+
--layer-name '${{ matrix.layer }}-${{ matrix.arch }}' \
129+
--statement-id 'PublicLayer' \
130+
--action lambda:GetLayerVersion \
131+
--principal '*' \
132+
--version-number "$LAYER_VERSION"
133+
- name: Verify Layer
134+
env:
135+
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
136+
run: |
137+
REMOTE_SHA=$(aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --query 'Content.CodeSha256' --output text)
138+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
139+
test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
140+
aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --output table
141+
142+
copy_west:
143+
name: Copy (West)
144+
needs: download
145+
runs-on: ubuntu-latest
146+
permissions:
147+
id-token: write
148+
contents: read
149+
strategy:
150+
matrix:
151+
layer:
152+
- AWSLambdaPowertoolsPythonV3-python313
153+
arch:
154+
- arm64
155+
- x86_64
156+
environment:
157+
name: GovCloud ${{ inputs.environment }} (West)
158+
steps:
159+
- name: Download Zip
160+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
161+
with:
162+
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
163+
- name: Download Metadata
164+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
165+
with:
166+
name: ${{ matrix.layer }}_${{ matrix.arch }}.json
167+
- name: Verify Layer Signature
168+
run: |
169+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
170+
test "$(openssl dgst -sha256 -binary ${{ matrix.layer }}_${{ matrix.arch }}.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
171+
- name: Configure AWS Credentials
172+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
173+
with:
174+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
175+
aws-region: us-gov-west-1
176+
mask-aws-account-id: true
177+
- name: Create Layer
178+
id: create-layer
179+
run: |
180+
LAYER_VERSION=$(aws --region us-gov-west-1 lambda publish-layer-version \
181+
--layer-name ${{ matrix.layer }}-${{ matrix.arch }} \
182+
--zip-file fileb://./${{ matrix.layer }}_${{ matrix.arch }}.zip \
183+
--compatible-runtimes "$(jq -r '.CompatibleRuntimes[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
184+
--compatible-architectures "$(jq -r '.CompatibleArchitectures[0]' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
185+
--license-info "MIT-0" \
186+
--description "$(jq -r '.Description' '${{ matrix.layer }}_${{ matrix.arch }}.json')" \
187+
--query 'Version' \
188+
--output text)
189+
190+
echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"
191+
192+
aws --region us-gov-west-1 lambda add-layer-version-permission \
193+
--layer-name '${{ matrix.layer }}-${{ matrix.arch }}' \
194+
--statement-id 'PublicLayer' \
195+
--action lambda:GetLayerVersion \
196+
--principal '*' \
197+
--version-number "$LAYER_VERSION"
198+
- name: Verify Layer
199+
env:
200+
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
201+
run: |
202+
REMOTE_SHA=$(aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --query 'Content.CodeSha256' --output text)
203+
SHA=$(jq -r '.Content.CodeSha256' '${{ matrix.layer }}_${{ matrix.arch }}.json')
204+
test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
205+
aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ env.LAYER_VERSION }}' --output table

0 commit comments

Comments
 (0)