Skip to content

Commit 42f0cf4

Browse files
am29dam29d
authored
chore(layers): add workflows for govcloud layers (#3747)
1 parent 8dcaa21 commit 42f0cf4

File tree

3 files changed

+280
-1
lines changed

3 files changed

+280
-1
lines changed

‎.github/workflows/layer_govcloud_verify.yml

+81
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# GovCloud Layer Verification
2+
# ---
3+
# This workflow queries the GovCloud layer info in production only
4+
5+
on:
6+
workflow_dispatch:
7+
inputs:
8+
version:
9+
description: Layer version to verify information
10+
type: string
11+
required: true
12+
workflow_call:
13+
inputs:
14+
version:
15+
description: Layer version to verify information
16+
type: string
17+
required: true
18+
19+
name: Layer Verification (GovCloud)
20+
run-name: Layer Verification (GovCloud) - version ${{ inputs.version }}
21+
22+
permissions: {}
23+
24+
jobs:
25+
commercial:
26+
runs-on: ubuntu-latest
27+
permissions:
28+
id-token: write
29+
contents: read
30+
environment: Prod (Readonly)
31+
steps:
32+
- name: Configure AWS Credentials
33+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
34+
with:
35+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
36+
aws-region: us-east-1
37+
mask-aws-account-id: true
38+
- name: Output AWSLambdaPowertoolsTypeScriptV2
39+
# fetch the specific layer version information from the us-east-1 commercial region
40+
run: |
41+
aws --region us-east-1 lambda get-layer-version-by-arn --arn 'arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.version }}' | jq -r '{"Layer Version Arn": .LayerVersionArn, "Version": .Version, "Description": .Description, "Compatible Runtimes": .CompatibleRuntimes[0], "Compatible Architectures": .CompatibleArchitectures[0], "SHA": .Content.CodeSha256} | keys[] as $k | [$k, .[$k]] | @tsv' | column -t -s $'\t'
42+
43+
gov_east:
44+
name: Verify (East)
45+
needs: commercial
46+
runs-on: ubuntu-latest
47+
permissions:
48+
id-token: write
49+
contents: read
50+
environment: GovCloud Prod (East)
51+
steps:
52+
- name: Configure AWS Credentials
53+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
54+
with:
55+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
56+
aws-region: us-gov-east-1
57+
mask-aws-account-id: true
58+
- name: Verify Layer AWSLambdaPowertoolsTypeScriptV2
59+
id: verify-layer
60+
run: |
61+
aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.version }}' | jq -r '{"Layer Version Arn": .LayerVersionArn, "Version": .Version, "Description": .Description, "Compatible Runtimes": .CompatibleRuntimes[0], "Compatible Architectures": .CompatibleArchitectures[0], "SHA": .Content.CodeSha256} | keys[] as $k | [$k, .[$k]] | @tsv' | column -t -s $'\t'
62+
63+
gov_west:
64+
name: Verify (West)
65+
needs: commercial
66+
runs-on: ubuntu-latest
67+
permissions:
68+
id-token: write
69+
contents: read
70+
environment: GovCloud Prod (West)
71+
steps:
72+
- name: Configure AWS Credentials
73+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
74+
with:
75+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
76+
aws-region: us-gov-east-1
77+
mask-aws-account-id: true
78+
- name: Verify Layer AWSLambdaPowertoolsTypeScriptV2
79+
id: verify-layer
80+
run: |
81+
aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.version }}' | jq -r '{"Layer Version Arn": .LayerVersionArn, "Version": .Version, "Description": .Description, "Compatible Runtimes": .CompatibleRuntimes[0], "Compatible Architectures": .CompatibleArchitectures[0], "SHA": .Content.CodeSha256} | keys[] as $k | [$k, .[$k]] | @tsv' | column -t -s $'\t'

‎.github/workflows/layers_govcloud.yml

+187
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
name: Layer Deployment (GovCloud)
2+
3+
# GovCloud Layer Publish
4+
# ---
5+
# This workflow publishes a specific layer version in an AWS account based on the environment input.
6+
#
7+
# We pull each the version of the layer and store them as artifacts, the we upload them to each of the GovCloud AWS accounts.
8+
#
9+
# A number of safety checks are performed to ensure safety.
10+
11+
on:
12+
workflow_dispatch:
13+
inputs:
14+
environment:
15+
description: Deployment environment
16+
type: choice
17+
options:
18+
- Gamma
19+
- Prod
20+
required: true
21+
version:
22+
description: Layer version to duplicate
23+
type: string
24+
required: true
25+
workflow_call:
26+
inputs:
27+
environment:
28+
description: Deployment environment
29+
type: string
30+
required: true
31+
version:
32+
description: Layer version to duplicate
33+
type: string
34+
required: true
35+
36+
run-name: Layer Deployment (GovCloud) - ${{ inputs.environment }} - version - ${{ inputs.version }}
37+
38+
permissions:
39+
contents: read
40+
41+
jobs:
42+
download:
43+
runs-on: ubuntu-latest
44+
permissions:
45+
id-token: write
46+
contents: read
47+
environment: Prod (Readonly)
48+
steps:
49+
- name: Configure AWS Credentials
50+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
51+
with:
52+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
53+
aws-region: us-east-1
54+
mask-aws-account-id: true
55+
- name: Grab Zip
56+
run: |
57+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.version }} --query 'Content.Location' | xargs curl -L -o AWSLambdaPowertoolsTypeScriptV2.zip
58+
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:${{ inputs.version }} > AWSLambdaPowertoolsTypeScriptV2.json
59+
- name: Store Zip
60+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
61+
with:
62+
name: AWSLambdaPowertoolsTypeScriptV2.zip
63+
path: AWSLambdaPowertoolsTypeScriptV2.zip
64+
retention-days: 1
65+
if-no-files-found: error
66+
- name: Store Metadata
67+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
68+
with:
69+
name: AWSLambdaPowertoolsTypeScriptV2.json
70+
path: AWSLambdaPowertoolsTypeScriptV2.json
71+
retention-days: 1
72+
if-no-files-found: error
73+
74+
copy_east:
75+
name: Copy (East)
76+
needs: download
77+
runs-on: ubuntu-latest
78+
permissions:
79+
id-token: write
80+
contents: read
81+
environment: GovCloud ${{ inputs.environment }} (East)
82+
steps:
83+
- name: Download Zip
84+
uses: actions/download-artifact@b14cf4c92620c250e1c074ab0a5800e37df86765 # v4.2.0
85+
with:
86+
name: AWSLambdaPowertoolsTypeScriptV2.zip
87+
- name: Download Metadata
88+
uses: actions/download-artifact@b14cf4c92620c250e1c074ab0a5800e37df86765 # v4.2.0
89+
with:
90+
name: AWSLambdaPowertoolsTypeScriptV2.json
91+
- name: Verify Layer Signature
92+
run: |
93+
SHA=$(jq -r '.Content.CodeSha256' 'AWSLambdaPowertoolsTypeScriptV2.json')
94+
test "$(openssl dgst -sha256 -binary AWSLambdaPowertoolsTypeScriptV2.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
95+
- name: Configure AWS Credentials
96+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
97+
with:
98+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
99+
aws-region: us-gov-east-1
100+
mask-aws-account-id: true
101+
- name: Create Layer
102+
id: create-layer
103+
run: |
104+
LAYER_VERSION=$(aws --region us-gov-east-1 lambda publish-layer-version \
105+
--layer-name AWSLambdaPowertoolsTypeScriptV2 \
106+
--zip-file fileb://./AWSLambdaPowertoolsTypeScriptV2.zip \
107+
--compatible-runtimes "$(jq -r '.CompatibleRuntimes[0]' 'AWSLambdaPowertoolsTypeScriptV2.json')" \
108+
--compatible-architectures "$(jq -r '.CompatibleArchitectures[0]' 'AWSLambdaPowertoolsTypeScriptV2.json')" \
109+
--license-info "MIT-0" \
110+
--description "$(jq -r '.Description' 'AWSLambdaPowertoolsTypeScriptV2.json')" \
111+
--query 'Version' \
112+
--output text)
113+
114+
echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"
115+
116+
aws --region us-gov-east-1 lambda add-layer-version-permission \
117+
--layer-name 'AWSLambdaPowertoolsTypeScriptV2' \
118+
--statement-id 'PublicLayer' \
119+
--action lambda:GetLayerVersion \
120+
--principal '*' \
121+
--version-number "$LAYER_VERSION"
122+
- name: Verify Layer
123+
env:
124+
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
125+
run: |
126+
REMOTE_SHA=$(aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:AWSLambdaPowertoolsTypeScriptV2:${{ env.LAYER_VERSION }}' --query 'Content.CodeSha256' --output text)
127+
SHA=$(jq -r '.Content.CodeSha256' 'AWSLambdaPowertoolsTypeScriptV2.json')
128+
test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
129+
aws --region us-gov-east-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-east-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:AWSLambdaPowertoolsTypeScriptV2:${{ env.LAYER_VERSION }}' --output table
130+
131+
copy_west:
132+
name: Copy (West)
133+
needs: download
134+
runs-on: ubuntu-latest
135+
permissions:
136+
id-token: write
137+
contents: read
138+
environment:
139+
name: GovCloud ${{ inputs.environment }} (West)
140+
steps:
141+
- name: Download Zip
142+
uses: actions/download-artifact@b14cf4c92620c250e1c074ab0a5800e37df86765 # v4.2.0
143+
with:
144+
name: AWSLambdaPowertoolsTypeScriptV2.zip
145+
- name: Download Metadata
146+
uses: actions/download-artifact@b14cf4c92620c250e1c074ab0a5800e37df86765 # v4.2.0
147+
with:
148+
name: AWSLambdaPowertoolsTypeScriptV2.json
149+
- name: Verify Layer Signature
150+
run: |
151+
SHA=$(jq -r '.Content.CodeSha256' 'AWSLambdaPowertoolsTypeScriptV2.json')
152+
test "$(openssl dgst -sha256 -binary AWSLambdaPowertoolsTypeScriptV2.zip | openssl enc -base64)" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
153+
- name: Configure AWS Credentials
154+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
155+
with:
156+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
157+
aws-region: us-gov-west-1
158+
mask-aws-account-id: true
159+
- name: Create Layer
160+
id: create-layer
161+
run: |
162+
LAYER_VERSION=$(aws --region us-gov-west-1 lambda publish-layer-version \
163+
--layer-name AWSLambdaPowertoolsTypeScriptV2 \
164+
--zip-file fileb://./AWSLambdaPowertoolsTypeScriptV2.zip \
165+
--compatible-runtimes "$(jq -r '.CompatibleRuntimes[0]' 'AWSLambdaPowertoolsTypeScriptV2.json')" \
166+
--compatible-architectures "$(jq -r '.CompatibleArchitectures[0]' 'AWSLambdaPowertoolsTypeScriptV2.json')" \
167+
--license-info "MIT-0" \
168+
--description "$(jq -r '.Description' 'AWSLambdaPowertoolsTypeScriptV2.json')" \
169+
--query 'Version' \
170+
--output text)
171+
172+
echo "LAYER_VERSION=$LAYER_VERSION" >> "$GITHUB_OUTPUT"
173+
174+
aws --region us-gov-west-1 lambda add-layer-version-permission \
175+
--layer-name 'AWSLambdaPowertoolsTypeScriptV2' \
176+
--statement-id 'PublicLayer' \
177+
--action lambda:GetLayerVersion \
178+
--principal '*' \
179+
--version-number "$LAYER_VERSION"
180+
- name: Verify Layer
181+
env:
182+
LAYER_VERSION: ${{ steps.create-layer.outputs.LAYER_VERSION }}
183+
run: |
184+
REMOTE_SHA=$(aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:AWSLambdaPowertoolsTypeScriptV2:${{ env.LAYER_VERSION }}' --query 'Content.CodeSha256' --output text)
185+
SHA=$(jq -r '.Content.CodeSha256' 'AWSLambdaPowertoolsTypeScriptV2.json')
186+
test "$REMOTE_SHA" == "$SHA" && echo "SHA OK: ${SHA}" || exit 1
187+
aws --region us-gov-west-1 lambda get-layer-version-by-arn --arn 'arn:aws-us-gov:lambda:us-gov-west-1:${{ secrets.AWS_ACCOUNT_ID }}:layer:AWSLambdaPowertoolsTypeScriptV2:${{ env.LAYER_VERSION }}' --output table

‎docs/index.md

+12-1
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,9 @@ You can use Powertools for AWS Lambda (TypeScript) by installing it with your fa
6969

7070
For the latter, make sure to replace `{region}` with your AWS region, e.g., `eu-west-1`.
7171

72-
__arn:aws:lambda:{region}:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:22__{: .copyMe}:clipboard:
72+
!!! abstract ""
73+
74+
__arn:aws:lambda:{region}:094274105915:layer:AWSLambdaPowertoolsTypeScriptV2:22__{: .copyMe}:clipboard:
7375

7476
???+ note "Code snippets for popular infrastructure as code frameworks"
7577

@@ -264,6 +266,15 @@ You can use Powertools for AWS Lambda (TypeScript) by installing it with your fa
264266
});
265267
```
266268

269+
=== "Layer in GovCloud"
270+
271+
We also provide layers in two GovCloud regions:
272+
273+
!!! abstract ""
274+
275+
* __arn:aws-us-gov:lambda:us-gov-east-1:165087284144:layer:AWSLambdaPowertoolsTypeScriptV2:22__{: .copyMe}:clipboard:
276+
* __arn:aws-us-gov:lambda:us-gov-west-1:165093116878:layer:AWSLambdaPowertoolsTypeScriptV2:22__{: .copyMe}:clipboard:
277+
267278
### Lambda Layer
268279

269280
[Lambda Layer](https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html){target="_blank"} is a `.zip` file archive that can contain additional code, pre-packaged dependencies, data, or configuration files. We compile and optimize [all dependencies](#install) to achieve an optimal build.

0 commit comments

Comments
 (0)