#!/bin/bash set -o pipefail # # pre-install: # aws-cli, jq # # Usage # ./init-m-account.sh mAccountProfile dev "" # mAccountProfile=$1 env=$2 bucketSuffix=$3 region=us-west-2 # get account id mAccountId=$(aws sts get-caller-identity --query "Account" --profile=$mAccountProfile --output text --no-cli-pager) echo "mAccountId=$mAccountId" # create oidc provider function createOidcProvider() { local url=$1 local audience=$2 local oidcProviderArn="arn:aws:iam::$mAccountId:oidc-provider/$url" local oidcProviderList=$(aws iam list-open-id-connect-providers \ --query "OpenIDConnectProviderList[?Arn=='$oidcProviderArn']" \ --region=$region --profile=$mAccountProfile --no-cli-pager ) if test $? -ne 0; then echo "failed to list oidc provider" exit 1 fi local hasCreated=$(echo "$oidcProviderList" | jq "length") if [[ $hasCreated == "0" ]]; then aws iam create-open-id-connect-provider --url="https://$url" --client-id-list=$audience \ --region=$region --profile=$mAccountProfile --no-cli-pager > /dev/null if test $? -ne 0; then echo "failed to create oidc provider" exit 1 fi echo "created oidc provider $GITHUB_TOKEN_URL" else local clientList=$(aws iam get-open-id-connect-provider \ --open-id-connect-provider-arn=$oidcProviderArn --query="ClientIDList" \ --region=$region --profile=$mAccountProfile --no-cli-pager) if test $? -ne 0; then echo "failed to get oidc provider" exit 1 fi local hasAdded=$(echo "$clientList" | jq ".[] | select(. == \"$audience\") | length") if [[ $hasAdded == "0" || $hasAdded == "" ]]; then aws iam add-client-id-to-open-id-connect-provider \ --open-id-connect-provider-arn=$oidcProviderArn --client-id=$audience \ --region=$region --profile=$mAccountProfile --no-cli-pager if test $? -ne 0; then echo "failed to add audience to oidc provider $url" exit 1 else echo "added audience to oidc privider $url" fi else echo "oidc privider $url has already created" fi fi } AUDIENCE="auto-deploy-cli" GITHUB_URL="token.actions.githubusercontent.com" createOidcProvider $GITHUB_URL $AUDIENCE # create roles function createRole() { local roleName=$1 local duration=$2 local trustPolicy=$3 local policy=$4 local roleList=$(aws iam list-roles \ --query="Roles[?RoleName=='$roleName']" \ --region=$region --profile=$mAccountProfile --no-cli-pager) if test $? -ne 0; then echo "failed to list roles" exit 1 fi local hasCreated=$(echo "$roleList" | jq "length") if [[ $hasCreated == "0" ]]; then aws iam create-role --role-name=$roleName \ --max-session-duration=$duration --assume-role-policy-document="$trustPolicy" \ --region=$region --profile=$mAccountProfile --no-cli-pager > /dev/null if test $? -ne 0; then echo "failed to create role $roleName" exit 1 fi echo "created iam role $roleName" else echo "iam role $roleName has already created" fi aws iam put-role-policy --role-name=$roleName \ --policy-name="$roleName-policy" --policy-document "$policy" \ --region=$region --profile=$mAccountProfile --no-cli-pager if test $? -ne 0; then echo "failed to set role policy $roleName" exit 1 fi echo "update iam role policy $roleName" } trustPolicy=$(cat <&1) if test $? -ne 0; then if [[ $stderr == *"An error occurred (NoSuchBucket) when calling the ListObjectsV2 operation"* ]]; then aws s3 mb "s3://$bucketName" --region=$region --profile=$mAccountProfile --no-cli-pager if test $? -ne 0; then echo "failed to create bucket $bucketName" fi elif [[ $stderr == *"An error occurred (AccessDenied) when calling the ListObjectsV2 operation"* ]]; then echo "bucket $bucketName has created by other account" exit 1 else echo "failed to list bucket $bucketName" exit 1 fi else echo "bucket $bucketName has already created" fi } createBucket "$env-auto-deploy${bucketSuffix}" createBucket "$env-auto-deploy-tf-state${bucketSuffix}"