Amplify-cli: What is the recommended .gitignore

[arelaxend]

Dear Contributors,

Following https://github.com/aws-amplify/amplify-cli/issues/1032#issuecomment-472708396, the recommended way to setup a .gitignore is:

amplify/\#current-cloud-backend
amplify/.config/local-*
amplify/backend/amplify-meta.json
amplify/backend/awscloudformation
build/
dist/
node_modules/
aws-exports.js
awsconfiguration.json

Which Category is your question related to?

Security

Amplify CLI Version
Not related to an amplify version

What AWS Services are you utilizing?
Amplify for React

Provide additional details e.g. code snippets

1. When publishing a react app, one must provide amplify/team-provider-info.json.
   But this file may contain provider Credentials (Google ...) which are secrets and should not be shared.

1. Amplify allows to sync with a Github repository, so one must publish amplify/team-provider-info.json to a Github repository which may compromise security. There is a famous story about Uber team that were hack because they put secret keys in a private Repository.

Do you provide an alternative?

Best, A.

[yuth]

@arelaxend it is recommended to add amplify/team-provider-info.json to .gitignore in a public repository as documented here.

[arelaxend]

Ok, so, if I understand correctly, say one has a git repository connected to an amplify project, one should only commit using the following commands:

amplify pull --appId xxx --envName dev
? Do you want to use an AWS profile? Yes
? Please choose the profile you want to use default
Amplify AppID found: xxx. Amplify App name is: xxx
Backend environment dev found in Amplify Console app: xxx
? Choose your default editor: Atom Editor
? Choose the type of app that you're building javascript
Please tell us about your project
? What javascript framework are you using react
? Source Directory Path:  src
? Distribution Directory Path: build
? Build Command:  npm run-script build
? Start Command: npm run-script start

? Do you plan on modifying this backend? No

The command ? Do you plan on modifying this backend? No only exports aws-exports.js
Then one may amplify publish on github this frontend (with aws-exports.js only).

And one should save securely and not publicly all other files (the one that uses ? Do you plan on modifying this backend? Yes)

[yuth]

@arelaxend this would work. If you are working on the same folder as where the project was initialized, you don't need run amplify pull command.

If the project is used by an some one who does not work in your team or does not have access to the cloud resources, they can run amplify configure project and get their environment setup.

The command ? Do you plan on modifying this backend? No only exports aws-exports.js
Then one may amplify publish on github this frontend (with aws-exports.js only).

The intended use case for this is when you have multiple frontends that are using the same backed. You would want to keep the backend changes in one place and by anwering yes you wont be able to push the changes to the cloud. Also note that aws-exports.js is in .gitignore and would not be comited to git.

[arelaxend]

@yuth

Using .gitignore

amplify/\#current-cloud-backend
amplify/.config/local-*
amplify/backend/amplify-meta.json
amplify/backend/awscloudformation
build/
dist/
node_modules/
aws-exports.js
awsconfiguration.json

amplify init then amplify hosting add

? Choose a type Continuous deployment (Git-based deployments)
? Continuous deployment is configured in the Amplify Console.

remove the amplify folder

run amplify pull and import the current amplify project using the following commands

? Do you want to use an AWS profile? Yes
? Please choose the profile you want to use default
? Which app are you working on? xxx
Backend environment 'prod' found. Initializing...
? Choose your default editor: Atom Editor
? Choose the type of app that you're building javascript
Please tell us about your project
? What javascript framework are you using react
? Source Directory Path:  src
? Distribution Directory Path: build
? Build Command:  npm run-script build
? Start Command: npm run-script start

? Do you plan on modifying this backend? No

Git commit changes, one gets:
Cannot find module: 'src/aws-exports'. Make sure this package is installed. You can install this package by running: yarn add src/aws-exports.

Changing .gitignore to:

amplify/\#current-cloud-backend
amplify/.config/local-*
amplify/backend/amplify-meta.json
amplify/backend/awscloudformation
build/
dist/
node_modules/
awsconfiguration.json

makes it works without having to commit the amplify folder.

The problem is that you must commit aws_appsync_apiKey which is a secret!

One thinks we must create a PR to remove aws_appsync_apiKey from aws-export.js
What does one thinks ?

[yuth]

The CLI should work with aws-exports.js in .gitigonre. I could not reproduce this with Amplify CLI 4.22.0. What version of Amplify CLI are you using to run this command.

[arelaxend]

@yuth for Amplify CLI 4.22.0, with the following .gitignore

amplify
amplify/\#current-cloud-backend
amplify/.config/local-*
amplify/mock-data
amplify/backend/amplify-meta.json
amplify/backend/awscloudformation
build/
dist/
node_modules/
aws-exports.js
awsconfiguration.json
amplifyconfiguration.json
amplify-build-config.json
amplify-gradle-config.json
amplifytools.xcconfig

On a xxx.tsx file, add import awsexports from 'src/aws-exports'

Using tsconfig.json:

{
  "compilerOptions": {
    "allowJs": true,
    "allowSyntheticDefaultImports": true,
    "baseUrl": ".",
    "esModuleInterop": true,
    "forceConsistentCasingInFileNames": true,
    "isolatedModules": true,
    "jsx": "react",
    "lib": ["dom", "dom.iterable", "esnext", "es6", "dom"],
    "noImplicitAny": true,
    "noImplicitThis": true,
    "strictNullChecks": true,
    "module": "esnext",
    "moduleResolution": "node",
    "noEmit": true,
    "resolveJsonModule": true,
    "skipLibCheck": true,
    "strict": true,
    "target": "es5"
  },
  "include": ["src"]
}

Then commit to git, the Console error is:

./src/xxx.tsx
Cannot find module: 'src/aws-exports'. Make sure this package is installed.
You can install this package by running: yarn add src/aws-exports.

[UnleashedMind]

Is the amplify folder itself in the .gitignore?
From your last comment:

---

for Amplify CLI 4.22.0, with the following .gitignore

amplify
amplify/\#current-cloud-backend
amplify/.config/local-*
amplify/mock-data
amplify/backend/amplify-meta.json
amplify/backend/awscloudformation
build/
dist/
node_modules/
aws-exports.js
awsconfiguration.json
amplifyconfiguration.json
amplify-build-config.json
amplify-gradle-config.json
amplifytools.xcconfig

---

You need to put a # in front of the amplify line.
The src/aws-exports.js file is generated by the Amplify Console build script when it connects your git repo.

[arelaxend]

@UnleashedMind I don't understand because the following .gitignore works:

amplify
amplify/\#current-cloud-backend
amplify/.config/local-*
amplify/mock-data
amplify/backend/amplify-meta.json
amplify/backend/awscloudformation
build/
dist/
node_modules/
!aws-exports.js
awsconfiguration.json
amplifyconfiguration.json
amplify-build-config.json
amplify-gradle-config.json
amplifytools.xcconfig

(comment !aws-exports.js)

Our goal is to avoid commiting files that contains secrets such as "aws_appsync_apiKey" in aws-exports.js

Still, if we add the amplify folder, therefore we commit team-provider-info.json which contains provider secrets. Does one agree?

I found this in the documentation:

This workflow can be used to share complete Amplify projects with people outside of your organization as well by committing the project into a Git repository. If you are doing this remove (or add to the .gitignore) the team-provider-info.json which is located in the amplify directory. You can learn more about this file here.

So, the correct way of doing one should follow @UnleashedMind answer and add team-provider-info.json (as mentionned https://github.com/aws-amplify/amplify-cli/issues/4700#issuecomment-651275291) to the .gitignore file and then commit to git.

!amplify
amplify/team-provider-info.json
amplify/\#current-cloud-backend
amplify/.config/local-*
amplify/mock-data
amplify/backend/amplify-meta.json
amplify/backend/awscloudformation
build/
dist/
node_modules/
aws-exports.js
awsconfiguration.json
amplifyconfiguration.json
amplify-build-config.json
amplify-gradle-config.json
amplifytools.xcconfig

But I got the following result:

Cannot find module: 'src/aws-exports'. Make sure this package is installed.
                                 You can install this package by running: yarn add src/aws-exports.

[arelaxend]

Hm.. maybe what is wrong is the way one imports import awsexports from 'src/aws-exports ?

I use the following tsconfig.json

{
  "compilerOptions": {
    "allowJs": true,
    "allowSyntheticDefaultImports": true,
    "baseUrl": ".",
    "esModuleInterop": true,
    "forceConsistentCasingInFileNames": true,
    "isolatedModules": true,
    "jsx": "react",
    "lib": ["dom", "dom.iterable", "esnext", "es6", "dom"],
    "noImplicitAny": true,
    "noImplicitThis": true,
    "strictNullChecks": true,
    "module": "esnext",
    "moduleResolution": "node",
    "noEmit": true,
    "resolveJsonModule": true,
    "skipLibCheck": true,
    "strict": true,
    "target": "es5"
  },
  "include": ["src"]
}

We are a bit lost...

[SwaySway]

Hello @arelaxend
The aws-exports.js should not be excluded from the .gitignore as this file is generated by the CLI. The first bit of amplify at the top serves as a comment. In this scenario it seems the only additional file to be added is the team-provider-info.json file? As for the exports not being recognized, it did work for me when I changed tsconfig to allowJS. Another method used would be to create a declaration file as mentioned here https://github.com/aws-amplify/amplify-js/issues/222

[stale[bot]]

This issue has been automatically closed because of inactivity. Please open a new issue if you are still encountering problems.