#!/bin/bash set -oe pipefail # # pre-install: # aws-cli, jq, python3 # python3 packages: boto3 # # Usage # ./init-byoc-account-customer.sh mAccountId # mAccountId=$1 shift 1 region=us-west-2 accountId=$(aws sts get-caller-identity --query "Account" --output text --no-cli-pager) function createPolicy() { local policyName=$1 local policyDocument=$2 local policyList=$(aws iam list-policies \ --query="Policies[?PolicyName=='$policyName']" \ --region=$region --no-cli-pager) if test $? -ne 0; then echo "failed to list policies" exit 1 fi local hasCreated=$(echo "$policyList" | jq "length") if [[ $hasCreated == "0" ]]; then aws iam create-policy --policy-name=$policyName \ --policy-document="$policyDocument" \ --region=$region --no-cli-pager > /dev/null if test $? -ne 0; then echo "failed to create policy $policyName" exit 1 fi echo "created iam policy $policyName" else echo "iam policy $policyName has already created" policyArn=$(echo "$policyList" | jq -r '.[0].Arn') aws iam create-policy-version --policy-arn=$policyArn \ --policy-document="$policyDocument" \ --region=$region --no-cli-pager --set-as-default > /dev/null if test $? -ne 0; then echo "failed to update iam policy $policyName" exit 1 fi echo "update iam policy $policyName" # delete old policy version oldVersionId=$(echo "$policyList" | jq -r '.[0].DefaultVersionId') aws iam delete-policy-version --policy-arn=$policyArn \ --version-id="$oldVersionId" \ --region=$region --no-cli-pager > /dev/null if test $? -ne 0; then echo "warn: failed to delete iam policy version $policyName($oldVersionId)" fi fi } function createRole() { local roleName=$1 local trustPolicy=$2 local policyArns=$3 local roleList=$(aws iam list-roles \ --query="Roles[?RoleName=='$roleName']" \ --region=$region --no-cli-pager) if test $? -ne 0; then echo "failed to list roles" exit 1 fi local hasCreated=$(echo "$roleList" | jq "length") if [[ $hasCreated == "0" ]]; then aws iam create-role --role-name=$roleName \ --assume-role-policy-document="$trustPolicy" \ --region=$region --no-cli-pager > /dev/null if test $? -ne 0; then echo "failed to create role $roleName" exit 1 fi echo "created iam role $roleName" aws iam attach-role-policy --role-name=$roleName \ --policy-arn="$policyArns" \ --region=$region if test $? -ne 0; then echo "failed to set role policy $roleName" exit 1 fi echo "added iam role policy $roleName" else echo "iam role $roleName has already created" fi } function createRoleWithPolicy() { local roleName=$1 local trustPolicy=$2 local policy=$3 local roleList=$(aws iam list-roles \ --query="Roles[?RoleName=='$roleName']" \ --region=$region --no-cli-pager) if test $? -ne 0; then echo "failed to list roles" exit 1 fi local hasCreated=$(echo "$roleList" | jq "length") if [[ $hasCreated == "0" ]]; then aws iam create-role --role-name=$roleName \ --assume-role-policy-document="$trustPolicy" \ --region=$region --no-cli-pager > /dev/null if test $? -ne 0; then echo "failed to create role $roleName" exit 1 fi echo "created iam role $roleName" else echo "iam role $roleName has already created" fi aws iam put-role-policy --role-name=$roleName \ --policy-name="$roleName-policy" --policy-document "$policy" \ --region=$region --no-cli-pager if test $? -ne 0; then echo "failed to set role policy $roleName" exit 1 fi echo "update iam role policy $roleName" } # create auto-deploy-cli role trustPolicy=$(cat <