Skip to content

feat(ci): GovCloud Layer Workflow #5261

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
Oct 11, 2024
141 changes: 141 additions & 0 deletions .github/workflows/layer_govcloud.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,141 @@
on:
workflow_dispatch:
inputs:
environment:
description: Deployment environment
type: choice
options:
- Gamma
- Prod
default: Gamma
required: true
version:
description: Layer version to duplicate
type: number
required: true

name: Layer Deployment (GovCloud)
run-name: Layer Deployment (GovCloud) - ${{ inputs.environment }}

jobs:
stash:
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
strategy:
matrix:
layer:
- AWSLambdaPowertoolsPythonV3-python38
- AWSLambdaPowertoolsPythonV3-python39
- AWSLambdaPowertoolsPythonV3-python310
- AWSLambdaPowertoolsPythonV3-python311
- AWSLambdaPowertoolsPythonV3-python312
arch:
- arm64
- x86
environment: Prod (Readonly)
steps:
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: us-east-1
mask-aws-account-id: true
- name: Grab Zip
run: |
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-${{ matrix.arch }}:${{ inputs.version }} --query 'Content.Location' | xargs curl -L -o ${{ matrix.layer }}_${{ matrix.arch }}.zip
- name: Store Zip
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
with:
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
path: ${{ matrix.layer }}_${{ matrix.arch }}.zip
retention-days: 1
if-no-files-found: error

copy_east:
name: Copy (East)
needs: stash
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
strategy:
matrix:
layer:
- AWSLambdaPowertoolsPythonV3-python38
- AWSLambdaPowertoolsPythonV3-python39
- AWSLambdaPowertoolsPythonV3-python310
- AWSLambdaPowertoolsPythonV3-python311
- AWSLambdaPowertoolsPythonV3-python312
arch:
- arm64
- x86
environment: GovCloud ${{ inputs.environment }} (East)
steps:
- name: Download Zip
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
with:
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: us-gov-east-1
mask-aws-account-id: true
- name: Create Layer
run: |
aws --region us-gov-east-1 lambda publish-layer-version \
--layer-name ${{ inputs.environment }}-${{ matrix.layer }}-${{ matrix.arch }} \
--zip-file fileb://./${{ matrix.layer }}_${{ matrix.arch }}.zip \
--query 'Version' | \
xargs aws --region us-gov-east-1 lambda add-layer-version-permission \
--layer-name ${{ inputs.environment }}-${{ matrix.layer }}-${{ matrix.arch }} \
--statement-id 'PublicLayer' \
--action lambda:GetLayerVersion \
--principal '*' \
--version-number

copy_west:
name: Copy (West)
needs: stash
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
strategy:
matrix:
layer:
- AWSLambdaPowertoolsPythonV3-python38
- AWSLambdaPowertoolsPythonV3-python39
- AWSLambdaPowertoolsPythonV3-python310
- AWSLambdaPowertoolsPythonV3-python311
- AWSLambdaPowertoolsPythonV3-python312
arch:
- arm64
- x86
environment:
name: GovCloud ${{ inputs.environment }} (West)
steps:
- name: Download Zip
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
with:
name: ${{ matrix.layer }}_${{ matrix.arch }}.zip
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: us-gov-west-1
mask-aws-account-id: true
- name: Create Layer
run: |
aws --region us-gov-west-1 lambda publish-layer-version \
--layer-name ${{ inputs.environment }}-${{ matrix.layer }}-${{ matrix.arch }} \
--zip-file fileb://./${{ matrix.layer }}_${{ matrix.arch }}.zip \
--query 'Version' | \
xargs aws --region us-gov-west-1 lambda add-layer-version-permission \
--layer-name ${{ inputs.environment }}-${{ matrix.layer }}-${{ matrix.arch }} \
--statement-id 'PublicLayer' \
--action lambda:GetLayerVersion \
--principal '*' \
--version-number