Amplify-cli: Security related to committing aws-exports.js

[cmoel]

* Which Category is your question related to? *
Auth and Amplify Console Deploy

* What AWS Services are you utilizing? *
AWS Amplify Console Deploy and AWS Cognito

* Provide additional details e.g. code snippets *
Hi folks,

I recently generated a new Amplify project using the latest beta version (0.2.1-multienv.35) of Amplify CLI to try out Amplify Console Deploy. After setting up Cognito Auth using the Amplify CLI and connecting my GitHub repo to Amplify Console and pushing to GitHub, Amplify Console Deploy started a build. The build failed with an error because it couldn't find ./src/aws-exports.js. I noticed amplify init adds aws-exports.js to my project's .gitignore file. How sensitive is this file? If it is sensitive, what's the best way to use AWS Amplify Console Deploy without committing it? Is that possible?

Thanks!

[kaustavghosh06]

@cmoel Are you deploying your backend via the Amplify console as well?

[swaminator]

Hi @cmoel: If you connect your backend to the CD process, the Amplify Console automatically generates the exports file at build time. I suspect there is an issue with your build settings - in the console can you goto App settings > Build settings and share your YML script?

[undefobj]

@cmoel in answer to your question around sensitivity this is fine for an SPA as the items are used for constructing HTTP requests to the appropriate endpoints in your account. See https://github.com/aws-amplify/amplify-js/issues/2495#issuecomment-453282477 for a similar question in the past.

[cmoel]

@kaustavghosh06 I don't think I have access to the beta on my account, though I would prefer to deploy the backend via the Amplify Console.

[swaminator]

@cmoel the beta is publicly available. You should have access. Can you share your build settings from the Amplify Console please?

[cmoel]

@swaminator Thanks for getting back to me.

I started with the default build configuration:

version: 1.0
env:
  variables:
    key: value
frontend:
  phases:
    preBuild:
      commands:
        - yarn install
    build:
      commands:
        - yarn run build
  artifacts:
    baseDirectory: build
    files:
      - '**/*'
  cache:
    paths:
      - node_modules/**/*

This failed until I added src/aws-exports.js to git (which was generated locally using amplify push). Then it worked great.

I then tried updating the build config in Amplify Console to deploy a backend as well using the config from https://docs.aws.amazon.com/amplify/latest/userguide/deploy-backend.html. The Amplify Console didn't detect that I provisioned this application with the Amplify CLI:

version: 1.0
env:
  variables:
    key: value
frontend:
  phases:
    preBuild:
      commands:
        - yarn install
    build:
      commands:
        - yarn run build
  artifacts:
    baseDirectory: build
    files:
      - '**/*'
  cache:
    paths:
      - node_modules/**/*
backend:
  phases:
    build:
      - export STACKINFO="$(envCache --get stackInfo)"
      - amplifyPush --environment $AWS_BRANCH
      - envCache --set stackInfo "$(amplify env get --json --name $AWS_BRANCH)"

Building this failed with this message in the Backend (beta) phase (the Frontend phase wasn't reached):

# Starting phase: build
2019-01-24T00:43:15.593Z [WARNING]: /codebuild/output/src392580584/src/private-lessons/amplify.sh: line 18: unexpected EOF while looking for matching `"'
/codebuild/output/src392580584/src/private-lessons/amplify.sh: line 19: syntax error: unexpected end of file
2019-01-24T00:43:15.594Z [ERROR]: !!! Build failed
2019-01-24T00:43:15.732Z [ERROR]: !!! Non-Zero Exit Code detected
2019-01-24T00:43:15.732Z [INFO]: # Starting Environment Caching...
2019-01-24T00:43:15.732Z [INFO]: # Environment Caching completed
Terminating logging...

Regarding the Amplify Console not detecting the Amplify CLI provisioning: Could this be related to my .gitignore? The Amplify specific part is:

#amplify
amplify/\#current-cloud-backend
amplify/.config/local-*
amplify/backend/amplify-meta.json
aws-exports.js
awsconfiguration.json

Is there something I'm doing wrong in my backend configuration? Is there a document I can read that explains how to configure this correctly?

Thanks again for your help!

[swaminator]

@cmoel try below. You can update the amplifyPush --environment $AWS_BRANCH to the name of your current environment for the console to pick it up.

version: 0.1
backend:
  phases:
    build:
      commands:
        - '# Get Amplify CLI Cloud-Formation stack info from environment cache'
        - export STACKINFO="$(envCache --get stackInfo)"
        - '# Execute Amplify CLI with the helper script'
        - amplifyPush --environment $AWS_BRANCH
        - '# Store Amplify CLI Cloud-Formation stack info in environment cache'
        - >-
          envCache --set stackInfo "$(amplify env get --json --name
          $AWS_BRANCH)"
frontend:
  phases:
    preBuild:
      commands:
        - yarn install
    build:
      commands:
        - yarn run build
  artifacts:
    baseDirectory: build
    files:
      - '**/*'
  cache:
    paths:
      - node_modules/**/*

[cmoel]

Great, thanks! It looks like that's getting me closer but still not quite there for provisioning the backend. I received this error for the Backend (beta) phase of the build:

# Starting phase: build
2019-01-24T20:19:31.454Z [INFO]: # Executing command: export STACKINFO=
2019-01-24T20:19:31.459Z [INFO]: # Executing command: amplifyPush --environment master
2019-01-24T20:19:31.463Z [INFO]: # Start initializing Amplify environment: master
# Initializing new Amplify environment: master (amplify init)
2019-01-24T20:19:34.632Z [INFO]: Note: It is recommended to run this command from the root of your app directory
2019-01-24T20:19:34.634Z [INFO]: You're initializing your project with a beta version of the CLI which supports multiple environments of your project
2019-01-24T20:19:36.397Z [INFO]: init failed
2019-01-24T20:19:36.400Z [INFO]: Error: AWS access credentials can not be found.
    at newUserCheck (/root/.nvm/versions/node/v8.12.0/lib/node_modules/@aws-amplify/cli/node_modules/amplify-provider-awscloudformation/lib/configuration-manager.js:534:15)
    at Object.init (/root/.nvm/versions/node/v8.12.0/lib/node_modules/@aws-amplify/cli/node_modules/amplify-provider-awscloudformation/lib/configuration-manager.js:25:9)
    at Object.run (/root/.nvm/versions/node/v8.12.0/lib/node_modules/@aws-amplify/cli/node_modules/amplify-provider-awscloudformation/lib/initializer.js:13:30)
    at Object.init (/root/.nvm/versions/node/v8.12.0/lib/node_modules/@aws-amplify/cli/node_modules/amplify-provider-awscloudformation/index.js:18:22)
    at initializationTasks.push (/root/.nvm/versions/node/v8.12.0/lib/node_modules/@aws-amplify/cli/src/lib/init-steps/s2-initProviders.js:14:51)
    at /root/.nvm/versions/node/v8.12.0/lib/node_modules/@aws-amplify/cli/node_modules/promise-sequential/index.js:16:18
    at <anonymous>
    at process._tickDomainCallback (internal/process/next_tick.js:229:7)
    at Function.Module.runMain (module.js:696:11)
    at startup (bootstrap_node.js:204:16)
2019-01-24T20:19:36.406Z [ERROR]: !!! Build failed
2019-01-24T20:19:36.500Z [ERROR]: !!! Non-Zero Exit Code detected
2019-01-24T20:19:36.500Z [INFO]: # Starting Environment Caching...
2019-01-24T20:19:36.500Z [INFO]: # Environment Caching completed
Terminating logging...

Do I need to include a profile or something to provide AWS access credentials? Or is there a different way I need to credentials?

[hzhenmin]

You can follow this link to add a service role to the Amplify Console.
https://docs.aws.amazon.com/amplify/latest/userguide/how-to-service-role-amplify-console.html

[cmoel]

Thanks for the link @hzhenmin.

I followed steps 1 and 2 on
https://docs.aws.amazon.com/amplify/latest/userguide/how-to-service-role-amplify-console.html but couldn't find the drop down to select the role I created back on the Amplify Console. I then attempted to redeploy using the Redeploy this version button but that failed with the same error message. In an attempt to reset the Amplify Console on this repo, I deleted the project from the Amplify Console and added it back again. Unfortunately that didn't work either, and I still see the same error message as in https://github.com/aws-amplify/amplify-cli/issues/754#issuecomment-457342531.

[swaminator]

Go into App Settings > General. You'll find the option there. We'll update our docs to include where to find it.

[cmoel]

The backend and frontend deploy are working successfully now. Thank you all so much for your patience and clear explanations! Also, thank you for seeing this through to the end when my concerns shifted from "is it safe to commit this file to git?" to "how do I deploy both a backend and a frontend using the Amplify Console?"

There are still some issues I need to iron out around using the correct Cognito Auth User Pool and Identity Pool (since the backend deployment deleted both of them) but that seems well outside the scope of this issue. I'll open another issue if I can't figure it out.

Thanks again!

[oste]

@swaminator I am facing a similar issue. I tried to add your build instructions and they seem to work.

I see the following backend build output

STACKINFO={
    "awscloudformation": {
        "AuthRoleName": "redacted",
        "UnauthRoleArn": "redacted",
        "AuthRoleArn": "redacted",
        "Region": "redacted",
        "DeploymentBucketName": "redacted",
        "UnauthRoleName": "redacted",
        "StackName": "redacted",
        "StackId": "redacted"
    },
    "categories": {
        "auth": {
            "cognito123": {}
        }
    }
}

It also seems to add it to the environment variable in the next step Executing command: envCache --set stackInfo

The issue is with my frontend build, it doesn't have access to some of the cognito variables

  65 |     if (data == null || !ClientId || !AppWebDomain || !RedirectUriSignIn || !RedirectUriSignOut) {
> 66 |       throw new Error(this.getCognitoConstants().PARAMETERERROR);
     | ^
  67 |     }

It seems the cognito variables are not available in the Backend STACKINFO builds steps either.

Thanks for any advice on getting these variables available to my frontend. This all works fine locally but it would seem I would also need to switch local/develop to use env vars instead of aws-exports.js too. Any documentation on this would also be greatly appreciated.

[oste]

It turns out I was using an unstable version of amplify @aws-amplify/cli@multienv as noted here https://github.com/dabit3/gatsby-auth-starter-aws-amplify#run-locally

[s3341458]

followed the above instructions

notice following error

this is the model that I was using, it works perfectly if I do "amplify push" locally

  @model works perfectly if I do "amplify push" locally
  @auth(rules: [
      {allow: public, operations: [read]},
      {allow: owner, operations: [create, update, delete]}
    ])
{
  id: ID!
  content: String!type Comment
  postPath: String!
  timestamp: AWSDateTime!
}

[matttt]

I am having the same issue as @s3341458 - I am getting schema errors during backend build on AWS Console.