Infisical Provider resource creation failing on sst deploy in github workflow

[aanish-tahir]

sst deploy fails while creating infisical aws secret sync resource in github workflow on ubuntu host. It works fine when running sst deploy locally.

Error log:
Error: 12 UNIMPLEMENTED: unknown method RegisterPackage for service pulumirpc.ResourceMonitor
    at callErrorFromStatus (/home/runner/actions-runner/_work/nectar-backend/nectar-backend/.sst/platform/node_modules/@grpc/grpc-js/src/call.ts:82:17)
    at Object.onReceiveStatus (/home/runner/actions-runner/_work/nectar-backend/nectar-backend/.sst/platform/node_modules/@grpc/grpc-js/src/client.ts:360:55)
    at Object.onReceiveStatus (/home/runner/actions-runner/_work/nectar-backend/nectar-backend/.sst/platform/node_modules/@grpc/grpc-js/src/client-interceptors.ts:458:34)
    at Object.onReceiveStatus (/home/runner/actions-runner/_work/nectar-backend/nectar-backend/.sst/platform/node_modules/@grpc/grpc-js/src/client-interceptors.ts:419:48)
    at /home/runner/actions-runner/_work/nectar-backend/nectar-backend/.sst/platform/node_modules/@grpc/grpc-js/src/resolving-call.ts:132:24
    at processTicksAndRejections (node:internal/process/task_queues:77:11)
for call at
    at ServiceClientImpl.makeUnaryRequest (/home/runner/actions-runner/_work/nectar-backend/nectar-backend/.sst/platform/node_modules/@grpc/grpc-js/src/client.ts:325:42)
    at ServiceClientImpl.registerPackage (/home/runner/actions-runner/_work/nectar-backend/nectar-backend/.sst/platform/node_modules/@grpc/grpc-js/src/make-client.ts:189:15)
    at resp (/home/runner/actions-runner/_work/nectar-backend/nectar-backend/.sst/platform/node_modules/@sst-provider/infisical/utilities.ts:121:14)
    at new Promise (<anonymous>)
    at Object.<anonymous> (/home/runner/actions-runner/_work/nectar-backend/nectar-backend/.sst/platform/node_modules/@sst-provider/infisical/utilities.ts:120:29)
    at Generator.next (<anonymous>)
    at fulfilled (/home/runner/actions-runner/_work/nectar-backend/nectar-backend/.sst/platform/node_modules/@sst-provider/infisical/bin/utilities.js:7:58)
    at processTicksAndRejections (node:internal/process/task_queues:95:5) {
  code: 12,
  details: 'unknown method RegisterPackage for service pulumirpc.ResourceMonitor',
  metadata: Metadata {
    internalRepr: Map(1) { 'content-type' => [Array] },
    options: {}
  },
  promise: Promise { <rejected> [Circular *1] }
}

[jayair]

Can you share your sst config?

[aanish-tahir]

Can you share your sst config?

Relevant parts of the config:

sst-config.ts:

export default $config({
  app() {
    return {
      name: 'nectar-backend',
      removal: 'retain',
      home: 'aws',
      providers: {
        docker: true,
        datadog: '4.46.0',
        infisical: {
          version: '0.15.11',
          auth: {
            universal: {
              clientId: process.env.INFISICAL_UNIVERSAL_CLIENT_ID,
              clientSecret: process.env.INFISICAL_UNIVERSAL_CLIENT_SECRET,
            },
          },
        },
        cloudflare: '5.37.1',
      },
      region: 'us-east-2',
    }
  },
  async run() {
    // ...

    const { getEnvironmentFromStage } = await import(
      './apps/shareable/utils/helpers'
    )
    const environment = getEnvironmentFromStage($app.stage)

    const { setupInfisical } = await import('./infra/infisical')    
    await setupInfisical(environment)

    // ...
  }
})

infra/infisical/index.ts

import {
  createAwsAppConnection,
  createAwsSecretSync,
  createInfisicalRole,
} from './helpers'

import { Environment } from '../../apps/shareable/utils/constants'

import { requireEnvVar } from '@/shareable/utils/env-vars'

const MapStageToEnvironment = {
  [Environment.DEV]: 'dev',
  [Environment.STAGING]: 'staging',
  [Environment.LOCAL_PROD]: 'dev',
  [Environment.PROD]: 'prod',
} as const

export async function setupInfisical(environment: Environment) {
  const projectId = '<REDACTED>'

  const projectEnvironment = MapStageToEnvironment[environment]

  const infisicalRole = createInfisicalRole(
    `${environment}-infisical-parameter-store`,
  )

  const awsAccountId = requireEnvVar('AWS_ACCOUNT')

  if (!awsAccountId) {
    throw new Error('AWS_ACCOUNT is not set')
  }

  const infisicalRoleArn = (await new Promise((resolve) => {
    infisicalRole.arn.apply(async (roleArn) => {
      resolve(roleArn)
    })
  })) as string

  const connectionName = `aws-${awsAccountId}`.toLowerCase()

  const awsConnection = createAwsAppConnection({
    name: connectionName,
    description: `AWS connection for Nectar Backend (Account: ${awsAccountId})`,
    roleArn: infisicalRoleArn,
  })

  const appConnectionId = (await new Promise((resolve) => {
    awsConnection.id.apply(async (id) => {
      resolve(id)
    })
  })) as string

  createAwsSecretSync({
    connectionId: appConnectionId,
    name: 'aws-parameter-store',
    projectId,
    description: `AWS connection for Nectar Backend (Account: ${awsAccountId})`,
    environment: projectEnvironment,
    awsRegion: 'us-east-2',
    path: '/lambda',
    destinationPath: `/lambda/${environment}/`,
  })

  console.log('Infisical setup complete')
}

infra/infisical/helpers.ts

export function createInfisicalRole(name: string): aws.iam.Role {
  // create a role for the parameter store
  const role = new aws.iam.Role(`${name}-role`, {
    assumeRolePolicy: {
      Version: '2012-10-17',
      Statement: [
        {
          Effect: 'Allow',
          Principal: {
            Service: 'ssm.amazonaws.com',
          },
          Action: 'sts:AssumeRole',
        },
        {
          Effect: 'Allow',
          Principal: {
            AWS: 'arn:aws:iam::381492033652:root', // Allow the Infisical AWS account
          },
          Action: 'sts:AssumeRole',
        },
      ],
    },
  })
  // Attach SSM parameter store policy to the role
  new aws.iam.RolePolicy(`${name}-policy`, {
    role: role.id,
    policy: {
      Version: '2012-10-17',
      Statement: [
        {
          Sid: 'AllowSSMAccess',
          Effect: 'Allow',
          Action: [
            'ssm:PutParameter',
            'ssm:GetParameters',
            'ssm:GetParametersByPath',
            'ssm:DescribeParameters',
            'ssm:DeleteParameters',
            'ssm:ListTagsForResource',
            'ssm:AddTagsToResource',
            'ssm:RemoveTagsFromResource',
          ],
          Resource: '*',
        },
      ],
    },
  })

  return role
}

export function createAwsSecretSync(params: {
  name: string
  description?: string
  connectionId: string
  projectId: string
  environment: string
  awsRegion: string
  path: string
  destinationPath: string
}) {
  new infisical.SecretSyncAwsParameterStore(params.name, {
    projectId: params.projectId,
    environment: params.environment,
    secretPath: params.path,
    connectionId: params.connectionId,
    autoSyncEnabled: true,
    syncOptions: {
      initialSyncBehavior: 'overwrite-destination',
      syncSecretMetadataAsTags: false,
      tags: [
        {
          key: 'managed-by',
          value: 'infisical',
        },
      ],
    },
    destinationConfig: {
      awsRegion: params.awsRegion,
      path: params.destinationPath,
    },
  })
}

export function createAwsAppConnection(params: {
  name: string
  description?: string
  roleArn: string
}) {
  return new infisical.AppConnectionAws(params.name, {
    method: 'assume-role',
    credentials: {
      roleArn: params.roleArn,
    },
    name: params.name,
    description: params.description,
  })
}

export async function getSSMParamsByPath(
  path: string,
): Promise<aws.ssm.GetParametersByPathResult> {
  const params = await aws.ssm.getParametersByPath({
    path,
  })

  return params
}

Possibly relevant snippets from package.json:

  "pnpm": {
    "onlyBuiltDependencies": [
      "@prisma/engines",
      "aws-sdk",
      "unix-dgram",
      "ffmpeg-static",
      "sharp",
      "@parcel/watcher",
      "@datadog/native-appsec",
      "@datadog/native-iast-taint-tracking",
      "@datadog/native-metrics",
      "protobufjs",
      "workerd",
      "esbuild",
      "@datadog/pprof",
      "@sentry/cli",
      "prisma",
      "dd-trace",
      "@prisma/client",
      "zenstack"
    ]
  },
  "packageManager": "pnpm@10.3.0",
  "dependencies": {
    // ...
    "@pulumi/cloudflare": "^5.37.1",
    "sst": "3.14.28",
    "tslib": "^2.8.0",
    // ...
  },
  "devDependencies": {
    // ...
    "@pulumi/aws": "^6.72.0",
    "@pulumi/datadog": "^4.46.0",
    "dotenv": "^16.4.5",
    "typescript": "^5.6.3",
    // ...
  },

[bilalq]

Some useful context:

This issue only reproduces on Buildjet's hosted CI machines. It works fine when running on Github's own first-party runners. Possibly some native lib linking issue?

[Brendonovich]

I've been having this problem when using the Planetscale provider on my M1 Macbook, only needs this minimal SST config

export default $config({
	app(input) {
		return {
			name: "cap",
			removal: input?.stage === "production" ? "retain" : "remove",
			protect: ["production"].includes(input?.stage),
			home: "aws",
			providers: {
				"@sst-provider/planetscale": {},
			},
		};
	},
	async run() {},
});