Bearse Release 12.17.0

April 23, 2020

version: 2.17.0-b92

Update Summary

bug fix for the CloudFormation deployment reporter function to solve stacks deleted and recreated with the same name.
update Guardian to version 0.2.2
new IAM roles for use with ciinabox 2

New IAM Roles

The new IAM roles for removes the old ciinabox 2 with full admin privilege and replaces it with 2 new roles. The new roles allow for a higher level of account security and as well as MFA or custom ciinabox 2 IAM roles support.

A new role for resource stop-start ciinabox-stop-start-resources with only the required permissions to stop and start the resources supported by the stop-start tool.

The ciinabox-v2 role replaces the ciinabox role in your Jenkins pipeline. It has limited permissions to allow cloudformation deployments and queries utilising a CloudFromation service role to offload the permissions. The ciinabox-cloudformation-deployer is the cloudformation service role with full admin permissions and can only be assumed by the CloudFormation service in the AWS account.

To enable the new roles, one of the following Bearse parameters are required:

CiinaboxRoles - a comma delimited string of IAM role ARN’s utilised by your ciinabox
CiinaboxMFAUsers - a comma delimited string of IAM users that have been setup in your ciinabox for MFA If both parameters are set the MFA user arns are used.

To utilise the new role in the pipeline see the snippets bellow:

cloudformation

cloudformation(
  action: 'update',
  region: 'ap-southeast-2',
  accountId: '12345678912',
  role: 'path/ciinabox-v2', // role for cross account access
  stackName: 'my-stack',
  templateUrl: env.TEMPLATE_URL,
  roleArn: 'arn:aws:iam:12345678901::role/path/ciinabox-cloudformation-deployer' // role to pass to the ciinabox service
)

changesets

createChangeSet(
  description: env.GIT_COMMIT,
  region: 'ap-southeast-2',
  accountId: '12345678912',
  role: 'path/ciinabox-v2', // role for cross account access
  stackName: 'my-stack',
  templateUrl: env.TEMPLATE_URL,
  roleArn: 'arn:aws:iam:12345678901::role/path/ciinabox-cloudformation-deployer' // full role arn to pass to the ciinabox service
)

executeChangeSet(
  region: 'ap-southeast-2',
  stackName: 'my-stack',
  awsAccountId: '12345678912',
  role: 'ciinabox-v2'
)