Try and get CR deployed even if it doesn't work yet

.github/workflows/main.yaml

@@ -17,6 +17,11 @@ jobs:
       - name: Setup job workspace
         uses: ServerlessOpsIO/gha-setup-workspace@v1
 
+      - name: Setup Python environment
+        uses: ServerlessOpsIO/gha-setup-python@v1
+        with:
+          python_version: 3.12
+
       - name: Assume AWS Credentials
         uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
         with:
@@ -32,6 +37,30 @@ jobs:
       - name: Validate StackSets SAM template (DNS Zone)
         run: sam validate --lint -t stacksets/dns-zone/stackset.yaml
 
+      - name: Validate StackSets SAM template (CFN CR)
+        run: sam validate --lint -t stacksets/cfn-cr/stackset.yaml
+
+      # Stacksets can't use CFN transforms so we need to handle the SAM transform ourselves.
+      - name: SAM build (CFN CR)
+        id: sam-build-cfn-cr
+        shell: bash
+        run: sam build -t stacksets/cfn-cr/stackset.yaml
+
+      - name: Package SAM artifact (CFN CR)
+        id: package-sam-cfn-cr
+        uses: ServerlessOpsIO/gha-package-aws-sam@v1
+        with:
+          packaged_template_file: stacksets/cfn-cr/packaged-stackset.yaml
+
+      - name: Transform SAM template (CFN CR)
+        id: transform-sam-template
+        shell: bash
+        run: |
+          wget https://raw.githubusercontent.com/aws/serverless-application-model/refs/heads/develop/bin/sam-translate.py
+          pipenv run python sam-translate.py \
+            --template-file stacksets/cfn-cr/packaged-stackset.yaml \
+            --output-template stacksets/cfn-cr/translated-stackset.json
+
       - name: Synethsize StackSet templates
         run: |
           for _f in $(find . -type f -name 'template.yaml'); do
@@ -42,14 +71,10 @@ jobs:
               $_f;
           done
 
-      - name: Package SAM artifact (Stacksets Template)
-        id: package-sam-stacksets
-        uses: ServerlessOpsIO/gha-package-aws-sam@v1
-        with:
-          packaged_template_file: packaged-template.yaml
-
       - name: Store Artifacts
         uses: ServerlessOpsIO/gha-store-artifacts@v1
+        with:
+          use_aws_sam: true
 
 
   deploy_stacksets:
@@ -66,6 +91,11 @@ jobs:
         with:
           checkout_artifact: true
 
+      - name: Setup Python environment
+        uses: ServerlessOpsIO/gha-setup-python@v1
+        with:
+          python_version: 3.12
+
       - name: Assume AWS Credentials
         uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
         with:

Pipfile

@@ -0,0 +1,33 @@
+[[source]]
+name = "pypi"
+url = "https://pypi.org/simple"
+verify_ssl = true
+
+[requires]
+python_version = "3.12"
+
+[packages]
+aws-lambda-powertools = "*"
+boto3-stubs = { extras = ["route53","sts"], version = "*"}
+crhelper = "*"
+
+[dev-packages]
+cfn-lint = "*"
+flake8 = "*"
+moto = {extras = ["route53","sts"], version = "*"}
+mypy = "*"
+pylint = "*"
+pytest = "*"
+pytest-cov = "*"
+pytest-mock = "*"
+pytest-pylint = "*"
+tox = "*"
+genson = "*"
+
+[scripts]
+#install-lambda-functions = "pipenv install -r src/requirements.txt"
+test = "pytest -vv --cov src --cov-report term-missing --cov-fail-under 95 tests"
+test-unit = "pytest -vv --cov src --cov-report term-missing --cov-fail-under 95 tests/unit"
+test-int = "pytest -vv --cov src --cov-report term-missing --cov-fail-under 95 tests/integration"
+flake8 = "flake8"
+lint = "pylint"

cfn-parameters.json

@@ -1,6 +1,5 @@
 {
     "RootDomainName": "serverlessops.io",
-    "DnsManagementAccountId": "$secrets.DNS_ROOT_ZONE_ACCOUNT_ID",
     "TargetOuIds": $secrets.AWS_ORG_ROOT_ID,
     "TargetAccountIds": $secrets.DEPLOYMENT_ACCOUNT_ID,
     "TargetRegions": "us-east-1"

data/src/handlers/RegisterDnsZone/data.json

@@ -0,0 +1,9 @@
+{
+  "ZoneName" : "test.example.com",
+  "NameServers": [
+    "ns1.example.com",
+    "ns2.example.com",
+    "ns3.example.com",
+    "ns4.example.com"
+  ]
+}

data/src/handlers/RegisterDnsZone/event.json

@@ -0,0 +1,21 @@
+{
+  "Records": [
+    {
+      "EventSource": "aws:sns",
+      "EventVersion": "1.0",
+      "EventSubscriptionArn": "arn:aws:sns:us-east-1::ExampleTopic",
+      "Sns": {
+        "Type": "Notification",
+        "MessageId": "95df01b4-ee98-5cb9-9903-4c221d41eb5e",
+        "TopicArn": "arn:aws:sns:us-east-1:123456789012:ExampleTopic",
+        "Subject": "example subject",
+        "Message": "example message",
+        "Timestamp": "1970-01-01T00:00:00.000Z",
+        "SignatureVersion": "1",
+        "Signature": "EXAMPLE",
+        "SigningCertUrl": "EXAMPLE",
+        "UnsubscribeUrl": "EXAMPLE"
+      }
+    }
+  ]
+}

data/src/handlers/RegisterDnsZone/event.schema.json

@@ -0,0 +1,106 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "$ref": "#/definitions/SNSEvent",
+  "definitions": {
+    "SNSEntity": {
+      "required": [
+        "Signature",
+        "MessageId",
+        "Type",
+        "TopicArn",
+        "MessageAttributes",
+        "SignatureVersion",
+        "Timestamp",
+        "SigningCertUrl",
+        "Message",
+        "UnsubscribeUrl",
+        "Subject"
+      ],
+      "properties": {
+        "Message": {
+          "type": "string"
+        },
+        "MessageAttributes": {
+          "patternProperties": {
+            ".*": {
+              "additionalProperties": true,
+              "type": "object"
+            }
+          },
+          "type": "object"
+        },
+        "MessageId": {
+          "type": "string"
+        },
+        "Signature": {
+          "type": "string"
+        },
+        "SignatureVersion": {
+          "type": "string"
+        },
+        "SigningCertUrl": {
+          "type": "string"
+        },
+        "Subject": {
+          "type": "string"
+        },
+        "Timestamp": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "TopicArn": {
+          "type": "string"
+        },
+        "Type": {
+          "type": "string"
+        },
+        "UnsubscribeUrl": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "SNSEvent": {
+      "required": [
+        "Records"
+      ],
+      "properties": {
+        "Records": {
+          "items": {
+            "$schema": "http://json-schema.org/draft-04/schema#",
+            "$ref": "#/definitions/SNSEventRecord"
+          },
+          "type": "array"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "SNSEventRecord": {
+      "required": [
+        "EventVersion",
+        "EventSubscriptionArn",
+        "EventSource",
+        "Sns"
+      ],
+      "properties": {
+        "EventSource": {
+          "type": "string"
+        },
+        "EventSubscriptionArn": {
+          "type": "string"
+        },
+        "EventVersion": {
+          "type": "string"
+        },
+        "Sns": {
+          "$schema": "http://json-schema.org/draft-04/schema#",
+          "$ref": "#/definitions/SNSEntity"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    }
+  }
+}

data/src/handlers/RegisterDnsZone/message.json

@@ -0,0 +1,9 @@
+{
+  "RequestType" : "Create",
+  "ResponseURL" : "http://pre-signed-S3-url-for-response",
+  "StackId" : "arn:aws:cloudformation:us-west-2:123456789012:stack/mystack/5b918d10-cd98-11ea-90d5-0a9cd3354c10",
+  "RequestId" : "unique id for this create request",
+  "ResourceType" : "Custom::TestResource",
+  "LogicalResourceId" : "MyTestResource",
+  "ResourceProperties" : {}
+}

data/src/handlers/RegisterDnsZone/output.json

@@ -0,0 +1,7 @@
+{
+  "Status" : "SUCCESS",
+  "StackId" : "arn:aws:cloudformation:us-east-1:123456789012:stack/mystack/5b918d10-cd98-11ea-90d5-0a9cd3354c10",
+  "RequestId" : "uniqueid for this update request",
+  "LogicalResourceId" : "RegisterDnsZoneFunction",
+  "PhysicalResourceId" : "stack-RegisterDnsZoneFunction-main"
+}

data/src/handlers/RegisterDnsZone/output.schema.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "Status": {
+      "type": "string"
+    },
+    "StackId": {
+      "type": "string"
+    },
+    "RequestId": {
+      "type": "string"
+    },
+    "LogicalResourceId": {
+      "type": "string"
+    },
+    "PhysicalResourceId": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "LogicalResourceId",
+    "PhysicalResourceId",
+    "RequestId",
+    "StackId",
+    "Status"
+  ]
+}

pytest.ini

@@ -0,0 +1,2 @@
+[pytest]
+testpaths = tests

samconfig.toml

@@ -14,7 +14,7 @@ parallel = true
 lint = true
 
 [default.deploy.parameters]
-capabilities = "CAPABILITY_AUTO_EXPAND"
+capabilities = "CAPABILITY_IAM CAPABILITY_AUTO_EXPAND"
 confirm_changeset = false
 #resolve_s3 = true