Amplify CLIを試す
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
ゴール
CircleCI上でamplify publish
してstaging環境がデプロイできるようになる
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
get started
yarn add -D @aws-amplify/cli
amplify configure
amplify init
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
amplify init
してみる
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
npx amplify init
すると下記のエラーになる問題
(node:98501) UnhandledPromiseRejectionWarning: TypeError: Cannot read property 'value' of undefined
どうやらnpm install -g @aws-amplify/cli
せいとのこと
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
npm install -g @aws-amplify/cli
して
amplify init
を実行
{}
で括ってるのは任意の値
❯ amplify init
Initializing new Amplify CLI version...
Done initializing new version.
Scanning for plugins...
Plugin scan successful
Note: It is recommended to run this command from the root of your app directory
? Enter a name for the project {プロジェクト名}
? Enter a name for the environment dev
? Choose your default editor: Visual Studio Code
? Choose the type of app that you're building javascript
Please tell us about your project
? What javascript framework are you using react
? Source Directory Path: src
? Distribution Directory Path: .next
? Build Command: yarn build:stg
? Start Command: yarn start:stg
Using default provider awscloudformation
? Do you want to use an AWS profile? Yes
? Please choose the profile you want to use {プロファイル名}
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
Select the environment setup
でprdにするとcloudfrontも作ってくれる感じ?
amplify add hosting
? Select the plugin module to execute Amazon CloudFront and S3
? Select the environment setup: DEV (S3 only with HTTP)
? hosting bucket name {生成するバケット名}
? index doc for the website index.html
? error doc for the website index.html
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
amplify remove hosting
でローカルの設定ファイルは消える
s3バケットとかは消えてない
上記を実行した後に
amplify push
すると消えると思ったけど消えないな
This removes the hosting resources locally from the backend. On your next
amplify push
the provisioned hosting resources will get removed from the cloud.
amplify pushしたら消えるよって書いてある気がするんだけど
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
初回の設定だと403になった
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
amplify init
の設定を変えたいのでamplify configure project
してみる
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
Next.js側がs3にデプロイする設定ではなかった
next export
を追加
"build:stg": "env-cmd -e staging next build && next export"
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
AccessDeniedは解消されず
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
amplify remove hosting
からのamplify push
でcloud frontは削除されるけど
s3のバケットがいくつか残ったまま
cloudformation関連のファイルが入ったバケットは
amplify delete
で消える
いくつかamplify publish
で作られたバケットが残った状態
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
amplify cliからデプロイ(amplify publish
)を手動でやる場合
Hosting with Amplify Console
を選ぶ
amplify add hosting
? Select the plugin module to execute (Use arrow keys)
❯ Hosting with Amplify Console (Managed hosting with custom domains, Continuous deployment)
Amazon CloudFront and S3
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
s3にデプロイしたときはcloudfrontとlambda@egeでいろいろ設定が必要っぽい
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
amplify add hostingの時にHosting with Amplify Console
を選ぶとうまく動いてくれてそう(要検証)
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
amplify env
試す
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
amplify env list
で現状のlistを確認できるし、現状のenvも確認できる
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
amplify env add
で環境追加
❯ amplify env add
Note: It is recommended to run this command from the root of your app directory
? Do you want to use an existing environment? No
? Enter a name for the environment stg
Using default provider awscloudformation
For more information on AWS Profiles, see:
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html
? Do you want to use an AWS profile? No
? accessKeyId: ********************
? secretAccessKey: ****************************************
? region: ap-northeast-1
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
amplify env checkout {env名}
で環境の切り替え
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
circleci上でamplify publish
を行う
stepsで
npm install -g @aws-amplify/cli
amplify env checkout {env名}
amplify publish
でいける?
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
permission denied
で落ちた
#!/bin/bash -eo pipefail
npm install -g @aws-amplify/cli
npm WARN deprecated graphql-import@0.7.1: GraphQL Import has been deprecated and merged into GraphQL Tools, so it will no longer get updates. Use GraphQL Tools instead to stay up-to-date! Check out https://www.graphql-tools.com/docs/migration-from-import for migration and https://the-guild.dev/blog/graphql-tools-v6 for new changes.
npm WARN deprecated @graphql-toolkit/common@0.9.7: GraphQL Toolkit is deprecated and merged into GraphQL Tools, so it will no longer get updates. Use GraphQL Tools instead to stay up-to-date! Check out https://www.graphql-tools.com/docs/migration-from-toolkit for migration and https://the-guild.dev/blog/graphql-tools-v6 for new changes.
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated core-js@2.6.12: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.
npm WARN deprecated @graphql-toolkit/common@0.6.6: GraphQL Toolkit is deprecated and merged into GraphQL Tools, so it will no longer get updates. Use GraphQL Tools instead to stay up-to-date! Check out https://www.graphql-tools.com/docs/migration-from-toolkit for migration and https://the-guild.dev/blog/graphql-tools-v6 for new changes.
npm WARN deprecated event-to-promise@0.8.0: Use promise-toolbox/fromEvent instead
npm WARN checkPermissions Missing write access to /usr/local/lib/node_modules
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@~2.3.1 (node_modules/@aws-amplify/cli/node_modules/chokidar/node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@2.3.2: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
npm ERR! code EACCES
npm ERR! syscall access
npm ERR! path /usr/local/lib/node_modules
npm ERR! errno -13
npm ERR! Error: EACCES: permission denied, access '/usr/local/lib/node_modules'
npm ERR! [Error: EACCES: permission denied, access '/usr/local/lib/node_modules'] {
npm ERR! errno: -13,
npm ERR! code: 'EACCES',
npm ERR! syscall: 'access',
npm ERR! path: '/usr/local/lib/node_modules'
npm ERR! }
npm ERR!
npm ERR! The operation was rejected by your operating system.
npm ERR! It is likely you do not have the permissions to access this file as the current user
npm ERR!
npm ERR! If you believe this might be a permissions issue, please double-check the
npm ERR! permissions of the file and its containing directories, or try running
npm ERR! the command again as root/Administrator.
npm ERR! A complete log of this run can be found in:
npm ERR! /home/circleci/.npm/_logs/2021-02-10T04_44_02_438Z-debug.log
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
amplifyのインストールこっちでしてみる
curl -sL https://aws-amplify.github.io/amplify-cli/install | bash && $SHELL
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
path通ってないよって怒られる
#!/bin/bash -eo pipefail
amplify env checkout dev
/bin/bash: amplify: command not found
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
path通す
- run:
name: update path
command: echo 'export PATH="$HOME/.amplify/bin:$PATH"' >> $BASH_ENV
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
initせえよって怒られる
#!/bin/bash -eo pipefail
amplify env checkout dev
Current environment cannot be determined
Use 'amplify init' in the root of your app directory to initialize your project with Amplify
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
Headless mode for CI/CD
の書き方でinitの定義をしてみる
#!/bin/sh
set -e
IFS='|'
REACTCONFIG="{\
\"SourceDir\":\"src\",\
\"DistributionDir\":\"out\",\
\"BuildCommand\":\"yarn build:stg\",\
\"StartCommand\":\"yarn start:stg\"\
}"
AWSCLOUDFORMATIONCONFIG="{\
\"configLevel\":\"project\",\
\"useProfile\":false,\
\"profileName\":\"default\",\
\"accessKeyId\":\"{アクセスキー}\",\
\"secretAccessKey\":\"{シークレットキー}\",\
\"region\":\"ap-northeast-1\"\
}"
AMPLIFY="{\
\"projectName\":\"testhadathor\",\
\"envName\":\"dev\",\
\"defaultEditor\":\"code\"\
}"
FRONTEND="{\
\"frontend\":\"javascript\",\
\"framework\":\"react\",\
\"config\":$REACTCONFIG\
}"
PROVIDERS="{\
\"awscloudformation\":$AWSCLOUDFORMATIONCONFIG\
}"
amplify init \
--amplify $AMPLIFY \
--frontend $FRONTEND \
--providers $PROVIDERS \
--yes
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
stepはこんな感じ
steps:
- checkout
- attach_workspace:
at: .
- run:
name: install amplify cli
command: curl -sL https://aws-amplify.github.io/amplify-cli/install | bash && $SHELL
- run:
name: update path
command: echo 'export PATH="$HOME/.amplify/bin:$PATH"' >> $BASH_ENV
- run: sh scripts/amplify_init/main.sh
- run: amplify env checkout dev
- run:
name: deploy
command: amplify publish --yes
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
deployが終わらないのでsshしてcircleciのコンテナ入るとnextのbuildコマンドでこけた
$ env-cmd -e staging next build && next export
> Build error occurred
Error: Cannot find module 'sharp'
Require stack:
- /home/circleci/src/node_modules/next/dist/build/index.js
- /home/circleci/src/node_modules/next/dist/cli/next-build.js
- /home/circleci/src/node_modules/next/dist/bin/next
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:880:15)
at Function.resolve (internal/modules/cjs/helpers.js:94:19)
at /home/circleci/src/node_modules/next/dist/build/index.js:11:1029
at /home/circleci/src/node_modules/next/dist/build/tracer.js:1:1331
at NoopTracer.withSpan (/home/circleci/src/node_modules/@opentelemetry/api/build/src/trace/NoopTracer.js:47:16)
at ProxyTracer.withSpan (/home/circleci/src/node_modules/@opentelemetry/api/build/src/trace/ProxyTracer.js:36:34)
at traceFn (/home/circleci/src/node_modules/next/dist/build/tracer.js:1:1301)
at /home/circleci/src/node_modules/next/dist/build/index.js:11:365
at async /home/circleci/src/node_modules/next/dist/build/tracer.js:1:1441 {
code: 'MODULE_NOT_FOUND',
requireStack: [
'/home/circleci/src/node_modules/next/dist/build/index.js',
'/home/circleci/src/node_modules/next/dist/cli/next-build.js',
'/home/circleci/src/node_modules/next/dist/bin/next'
]
}
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
sudo apt-get update
sudo apt-get install libvips
したけど変わらず
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
yarn add sharp
したらbuildできた
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
うちのIAMは基本的にAdministratorAccessを許容してないので
amplifyになんの権限が必要なのか探す旅
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
AdministratorAccess-Amplifyがいい感じ
が諸事情でグループにポリシー紐づけろとのこと
さらに管理ポリシーはグループには10個までらしく、全て埋まってたので
インラインポリシーで定義する
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
AdministratorAccess-Amplifyのインラインをコピペ
他で設定されてるポリシーとかぶる部分ありそうだけども
そこは精査せずゆく
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CLICloudformationPolicy",
"Effect": "Allow",
"Action": [
"cloudformation:CreateChangeSet",
"cloudformation:CreateStack",
"cloudformation:DeleteStack",
"cloudformation:DescribeChangeSet",
"cloudformation:DescribeStackEvents",
"cloudformation:DescribeStackResource",
"cloudformation:DescribeStackResources",
"cloudformation:DescribeStacks",
"cloudformation:ExecuteChangeSet",
"cloudformation:GetTemplate",
"cloudformation:UpdateStack"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/amplify-*"
]
},
{
"Sid": "CLIManageviaCFNPolicy",
"Effect": "Allow",
"Action": [
"iam:CreateRole",
"iam:ListRoleTags",
"iam:TagRole",
"iam:AttachRolePolicy",
"iam:CreatePolicy",
"iam:DeletePolicy",
"iam:DeleteRole",
"iam:DeleteRolePolicy",
"iam:DetachRolePolicy",
"iam:PutRolePolicy",
"iam:UpdateRole",
"iam:GetRole",
"iam:GetPolicy",
"iam:GetRolePolicy",
"iam:PassRole",
"iam:ListPolicyVersions",
"appsync:CreateApiKey",
"appsync:CreateDataSource",
"appsync:CreateFunction",
"appsync:CreateResolver",
"appsync:CreateType",
"appsync:DeleteApiKey",
"appsync:DeleteDataSource",
"appsync:DeleteFunction",
"appsync:DeleteResolver",
"appsync:DeleteType",
"appsync:GetDataSource",
"appsync:GetFunction",
"appsync:GetIntrospectionSchema",
"appsync:GetResolver",
"appsync:GetSchemaCreationStatus",
"appsync:GetType",
"appsync:GraphQL",
"appsync:ListApiKeys",
"appsync:ListDataSources",
"appsync:ListFunctions",
"appsync:ListGraphqlApis",
"appsync:ListResolvers",
"appsync:ListResolversByFunction",
"appsync:ListTypes",
"appsync:StartSchemaCreation",
"appsync:UpdateApiKey",
"appsync:UpdateDataSource",
"appsync:UpdateFunction",
"appsync:UpdateResolver",
"appsync:UpdateType",
"appsync:TagResource",
"appsync:CreateGraphqlApi",
"appsync:DeleteGraphqlApi",
"appsync:GetGraphqlApi",
"appsync:ListTagsForResource",
"appsync:UpdateGraphqlApi",
"apigateway:DELETE",
"apigateway:GET",
"apigateway:PATCH",
"apigateway:POST",
"apigateway:PUT",
"cognito-idp:CreateUserPool",
"cognito-identity:CreateIdentityPool",
"cognito-identity:DeleteIdentityPool",
"cognito-identity:DescribeIdentity",
"cognito-identity:DescribeIdentityPool",
"cognito-identity:SetIdentityPoolRoles",
"cognito-identity:GetIdentityPoolRoles",
"cognito-identity:UpdateIdentityPool",
"cognito-idp:CreateUserPoolClient",
"cognito-idp:DeleteGroup",
"cognito-idp:DeleteUserPool",
"cognito-idp:DeleteUserPoolClient",
"cognito-idp:DescribeUserPool",
"cognito-idp:DescribeUserPoolClient",
"cognito-idp:ListTagsForResource",
"cognito-idp:ListUserPoolClients",
"cognito-idp:UpdateUserPoolClient",
"cognito-idp:CreateGroup",
"cognito-idp:DeleteGroup",
"cognito-identity:TagResource",
"cognito-idp:TagResource",
"cognito-idp:UpdateUserPool",
"lambda:AddPermission",
"lambda:CreateFunction",
"lambda:DeleteFunction",
"lambda:GetFunction",
"lambda:GetFunctionConfiguration",
"lambda:InvokeAsync",
"lambda:InvokeFunction",
"lambda:RemovePermission",
"lambda:UpdateFunctionCode",
"lambda:UpdateFunctionConfiguration",
"lambda:ListTags",
"lambda:TagResource",
"lambda:UntagResource",
"lambda:DeleteFunction",
"lambda:AddLayerVersionPermission",
"lambda:CreateEventSourceMapping",
"lambda:DeleteEventSourceMapping",
"lambda:DeleteLayerVersion",
"lambda:GetEventSourceMapping",
"lambda:GetLayerVersion",
"lambda:ListEventSourceMappings",
"lambda:ListLayerVersions",
"lambda:PublishLayerVersion",
"lambda:RemoveLayerVersionPermission",
"dynamodb:CreateTable",
"dynamodb:DeleteItem",
"dynamodb:DeleteTable",
"dynamodb:DescribeContinuousBackups",
"dynamodb:DescribeTable",
"dynamodb:DescribeTimeToLive",
"dynamodb:ListStreams",
"dynamodb:PutItem",
"dynamodb:TagResource",
"dynamodb:ListTagsOfResource",
"dynamodb:UpdateContinuousBackups",
"dynamodb:UpdateItem",
"dynamodb:UpdateTable",
"dynamodb:UpdateTimeToLive",
"s3:CreateBucket",
"s3:ListBucket",
"s3:PutBucketAcl",
"s3:PutBucketCORS",
"s3:PutBucketNotification",
"s3:PutBucketPolicy",
"s3:PutBucketWebsite",
"s3:PutObjectAcl",
"cloudfront:CreateCloudFrontOriginAccessIdentity",
"cloudfront:CreateDistribution",
"cloudfront:DeleteCloudFrontOriginAccessIdentity",
"cloudfront:DeleteDistribution",
"cloudfront:GetCloudFrontOriginAccessIdentity",
"cloudfront:GetCloudFrontOriginAccessIdentityConfig",
"cloudfront:GetDistribution",
"cloudfront:GetDistributionConfig",
"cloudfront:TagResource",
"cloudfront:UntagResource",
"cloudfront:UpdateCloudFrontOriginAccessIdentity",
"cloudfront:UpdateDistribution",
"events:DeleteRule",
"events:DescribeRule",
"events:ListRuleNamesByTarget",
"events:PutRule",
"events:PutTargets",
"events:RemoveTargets",
"mobiletargeting:GetApp",
"kinesis:AddTagsToStream",
"kinesis:CreateStream",
"kinesis:DeleteStream",
"kinesis:DescribeStream",
"kinesis:PutRecords"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "CLISDKCalls",
"Effect": "Allow",
"Action": [
"appsync:GetIntrospectionSchema",
"appsync:GraphQL",
"appsync:UpdateApiKey",
"appsync:ListApiKeys",
"s3:PutObject",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketVersions",
"s3:DeleteBucket",
"s3:DeleteBucketPolicy",
"s3:DeleteBucketWebsite",
"s3:DeleteObject",
"s3:GetBucketLocation",
"s3:ListAllMyBuckets",
"sts:AssumeRole",
"iam:PutRolePolicy",
"iam:CreatePolicy",
"iam:AttachRolePolicy",
"mobiletargeting:*",
"amplify:CreateApp",
"amplify:CreateBackendEnvironment",
"amplify:GetApp",
"amplify:GetBackendEnvironment",
"amplify:ListApps",
"amplify:ListBackendEnvironments",
"amplify:CreateBranch",
"amplify:GetBranch",
"amplify:UpdateApp",
"amplify:ListBranches",
"amplify:ListDomainAssociations",
"amplify:DeleteBranch",
"amplify:DeleteApp",
"amplify:DeleteBackendEnvironment",
"amplifybackend:*",
"cognito-idp:AdminAddUserToGroup",
"cognito-idp:AdminCreateUser",
"cognito-idp:CreateGroup",
"cognito-idp:DeleteGroup",
"cognito-idp:DeleteUser",
"cognito-idp:ListUsers",
"cognito-idp:AdminGetUser",
"cognito-idp:ListUsersInGroup",
"cognito-idp:AdminDisableUser",
"cognito-idp:AdminRemoveUserFromGroup",
"cognito-idp:AdminResetUserPassword",
"cognito-idp:AdminListGroupsForUser",
"cognito-idp:ListGroups",
"cognito-idp:AdminDeleteUser",
"cognito-idp:AdminListUserAuthEvents",
"cognito-idp:AdminDeleteUser",
"cognito-idp:AdminConfirmSignUp",
"cognito-idp:AdminEnableUser",
"cognito-idp:AdminUpdateUserAttributes",
"cognito-idp:DescribeIdentityProvider"
],
"Resource": "*"
}
]
}
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
エラーが発生しました: Maximum policy size of 5120 bytes exceeded for group {グループ名}
流石に多く設定しすぎたのかな・・
他とかぶってるポリシーを削除する
lambda, iam, s3, cloudformatin,周りを削除
これでも足りなかったのでappsync apigateway dynamodb kinesisは今回使わないので省く
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CLIManageviaCFNPolicy",
"Effect": "Allow",
"Action": [
"cognito-idp:CreateUserPool",
"cognito-identity:CreateIdentityPool",
"cognito-identity:DeleteIdentityPool",
"cognito-identity:DescribeIdentity",
"cognito-identity:DescribeIdentityPool",
"cognito-identity:SetIdentityPoolRoles",
"cognito-identity:GetIdentityPoolRoles",
"cognito-identity:UpdateIdentityPool",
"cognito-idp:CreateUserPoolClient",
"cognito-idp:DeleteGroup",
"cognito-idp:DeleteUserPool",
"cognito-idp:DeleteUserPoolClient",
"cognito-idp:DescribeUserPool",
"cognito-idp:DescribeUserPoolClient",
"cognito-idp:ListTagsForResource",
"cognito-idp:ListUserPoolClients",
"cognito-idp:UpdateUserPoolClient",
"cognito-idp:CreateGroup",
"cognito-idp:DeleteGroup",
"cognito-identity:TagResource",
"cognito-idp:TagResource",
"cognito-idp:UpdateUserPool",
"cloudfront:CreateCloudFrontOriginAccessIdentity",
"cloudfront:CreateDistribution",
"cloudfront:DeleteCloudFrontOriginAccessIdentity",
"cloudfront:DeleteDistribution",
"cloudfront:GetCloudFrontOriginAccessIdentity",
"cloudfront:GetCloudFrontOriginAccessIdentityConfig",
"cloudfront:GetDistribution",
"cloudfront:GetDistributionConfig",
"cloudfront:TagResource",
"cloudfront:UntagResource",
"cloudfront:UpdateCloudFrontOriginAccessIdentity",
"cloudfront:UpdateDistribution",
"events:DeleteRule",
"events:DescribeRule",
"events:ListRuleNamesByTarget",
"events:PutRule",
"events:PutTargets",
"events:RemoveTargets",
"mobiletargeting:GetApp"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": ["cloudformation.amazonaws.com"]
}
}
},
{
"Sid": "CLISDKCalls",
"Effect": "Allow",
"Action": [
"sts:AssumeRole",
"mobiletargeting:*",
"amplify:CreateApp",
"amplify:CreateBackendEnvironment",
"amplify:GetApp",
"amplify:GetBackendEnvironment",
"amplify:ListApps",
"amplify:ListBackendEnvironments",
"amplify:CreateBranch",
"amplify:GetBranch",
"amplify:UpdateApp",
"amplify:ListBranches",
"amplify:ListDomainAssociations",
"amplify:DeleteBranch",
"amplify:DeleteApp",
"amplify:DeleteBackendEnvironment",
"amplifybackend:*",
"cognito-idp:AdminAddUserToGroup",
"cognito-idp:AdminCreateUser",
"cognito-idp:CreateGroup",
"cognito-idp:DeleteGroup",
"cognito-idp:DeleteUser",
"cognito-idp:ListUsers",
"cognito-idp:AdminGetUser",
"cognito-idp:ListUsersInGroup",
"cognito-idp:AdminDisableUser",
"cognito-idp:AdminRemoveUserFromGroup",
"cognito-idp:AdminResetUserPassword",
"cognito-idp:AdminListGroupsForUser",
"cognito-idp:ListGroups",
"cognito-idp:AdminDeleteUser",
"cognito-idp:AdminListUserAuthEvents",
"cognito-idp:AdminDeleteUser",
"cognito-idp:AdminConfirmSignUp",
"cognito-idp:AdminEnableUser",
"cognito-idp:AdminUpdateUserAttributes",
"cognito-idp:DescribeIdentityProvider"
],
"Resource": "*"
}
]
}
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
amplify initがローカルで無事に実行できた
がamplify publish
するにはまだ権限が足りないようだ
✖ Deployment failed! Please report an issue on the Amplify Console GitHub issue tracker at https://github.com/aws-amplify/amplify-console/issues.
An error occurred during the publish operation: User: arn:aws:iam::{account_id}:user/circleci is not authorized to perform: amplify:ListJobs on resource: arn:aws:amplify:ap-northeast-1:{account_id}:apps/dmbkuduyblkem/branches/stg/jobs/*
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
"amplify:*",
amplifyはオールオッケのポリシーに修正
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
ローカルからamplify publishできた
![nus3](https://res.cloudinary.com/zenn/image/fetch/s---K0FxmDX--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_auto%2Cw_70/https://storage.googleapis.com/zenn-user-upload/avatar/377a196371.jpeg)
久しぶりにamplifyで環境構築したら結構忘れてたので概要を追記
CICDに組み込んだ上でamplifyをデプロイする流れ
-
amplify init
をHeadless mode(shell)で定義する -
amplify env checkout
で該当の環境にチェックアウト - configを環境のものにReplace
-
amplify publish
でデプロイ
amplify initでbuildやstartコマンド、distのdir設定などをする
configを環境のものにReplace
とはamplify/.config配下にamplify initで設定した値が保存されるが各環境ごとにbuildやstartコマンドが違う場合にこのamplify/.config/project-config.json
の値を変えたい場合にreplaceしたりする
yarn build:stage
とyarn build:prod
がある場合とか
amplify/.config/project-config.stage.json
にstaging環境用のconfig、amplify/.config/project-config.prod.json
にprod用のconfigを作り、CIでcp amplify/.config/project-config.{$APP_ENV.json,json}
みたいな感じで環境用のconfigをcp amplify/.config/project-config.json
に置き換えるようにする
CICDに組み込む前にローカルでamplify initとamplify add hosting一度しておく必要がある