Cross account support #553
Conversation
Codecov Report
@@ Coverage Diff @@
## multi-region #553 +/- ##
================================================
- Coverage 87.36% 87.24% -0.12%
================================================
Files 95 95
Lines 6167 6180 +13
================================================
+ Hits 5388 5392 +4
- Misses 779 788 +9
Continue to review full report at Codecov.
|
06bb096 to
6aa2395
Compare
docs/config.rst
Outdated
| @@ -359,6 +359,10 @@ A stack has the following keys: | |||
| **region**: | |||
| (optional): If provided, specifies the name of the region that the | |||
| CloudFormation stack should reside in. | |||
| **profile**: | |||
There was a problem hiding this comment.
What happens if this is provided, and region is provided? Pretty sure you can provide a region as part of a profile, so curious which wins out (and it should probably be documented)
There was a problem hiding this comment.
I'll add this to the docs. If both profile and region are provided, the region that's used in the config overrides the region in the profile.
stacker/session_cache.py
Outdated
| ui.unlock() | ||
|
|
||
|
|
||
| def get_session(region, profile=None): |
| if region is not None: | ||
| session.set_config_variable('region', region) | ||
| c = session.get_component('credential_provider') | ||
| session = boto3.Session(region_name=region, profile_name=profile) |
There was a problem hiding this comment.
I think the reason we had to use botocore originally was because boto3 didn't have this ability at the time. Do we need to update our dependency for boto3 to a specific minimum version for this?
There was a problem hiding this comment.
We lock on "boto3>=1.3.1", which has support for both of these params, so we should be ok.
stacker/session_cache.py
Outdated
|
|
||
|
|
||
| def get_session(region): | ||
| def getpass(*args): |
There was a problem hiding this comment.
Worth moving into the ui library, since we might need this elsewhere?
We already talked about this offline, but just adding here: Special consideration will need to be taken when using multi-account and uploading templates to s3. Wherever the stacker bucket is provisioned, it'll need a bucket policy that allows any external accounts access to read templates from the bucket. My plan is to update the docs before a 1.3 release with a guide on how to setup a multi-account config. The easiest way to use this for now is to set
Same answer as #551 (comment). Hooks will use the default AWS config for now. |
Cross account support
Depends on #551
This is based on the RFC in https://github.com/remind101/stacker/wiki/RFC:-Profiles
Closes #263
Fixes #277
With this change, you can specify a boto3 profile to use for a given stack. This can be used for cross account provisioning and linking of stacks. For example, say you wanted to provision a hot and cold version of an application in multiple regions and multiple accounts, you could do something like this:
$ AWS_CONFIG_FILE=.aws/config.prod stacker build stacker.yamlTODO