Merge pull request #64 from aws-samples/fix

Fix role and update deploy configuration

.travis.yml

@@ -20,6 +20,8 @@ script:
 # Tag and Publish
 before_deploy:
   # - npm run pre-deploy-test
+  - mkdir -p ~/.aws
+  - cat >> ~/.aws/config <<<"[profile publisher]"$'\n'"credential_source=Environment"$'\n'"role_arn=${ROLE_ARN}"$'\n'"duration_seconds=900"
   - export VERSION=${TRAVIS_TAG:-$(npm run echo-version --silent)}
   - if [ -z "$TRAVIS_TAG" ]; then npm run tag; fi
   - npm run zip
@@ -35,7 +37,7 @@ deploy:
       condition: type != pull_request
   - provider: script
     skip_cleanup: true
-    script: npm run deploy
+    script: npm run deploy >/dev/null 2>&1
     on:
       tags: true
 

package.json

@@ -19,7 +19,7 @@
     "cfn-lambdas-dist-setup": "if [ ! -d './backend/functions/setup/' ]; then mkdir -p backend/functions/setup/; fi",
     "cfn-test": "yamllint -d '{extends: default, rules: {line-length: disable}}' src/cfn/template.yaml && cfn-lint src/cfn/template.yaml",
     "cfn-test-local": "npm run lambda-build && npm run cfn-build && aws cloudformation package --template-file templates/template.yaml --output-template-file templates/packaged.yaml --s3-bucket $TEST_BUCKET && aws cloudformation deploy --template-file templates/packaged.yaml --stack-name amazon-transcribe-news-media-analysis --capabilities CAPABILITY_IAM",
-    "deploy": "npm run zip && aws s3 cp ./`npm run echo-version --silent`.zip s3://$CFN_BUCKET/$npm_package_name/`npm run echo-version --silent`/$npm_package_name.zip",
+    "deploy": "npm run zip && aws --profile publisher s3 cp ./`npm run echo-version --silent`.zip s3://$CFN_BUCKET/$npm_package_name/`npm run echo-version --silent`/$npm_package_name.zip",
     "echo-version": "echo v`node -e \"console.log(require('node-yaml').readSync('templates/template.yaml').Globals.Function.Environment.Variables.VERSION)\"`",
     "lambda-build": "npm run lambda-build-layers && npm run lambda-build-orchestrator && npm run lambda-build-setup",
     "lambda-build-layers": "cd src/backend/functions/layers && npm run build",

src/cfn/template.yaml

@@ -13,7 +13,7 @@ Globals:
     Runtime: nodejs10.x
     Environment:
       Variables:
-        VERSION: '1.2'
+        VERSION: '1.3'
 
 Parameters:
 
@@ -629,8 +629,12 @@ Resources:
             Principal:
               Federated:
                 - cognito-identity.amazonaws.com
-            Action:
-              - sts:AssumeRoleWithWebIdentity
+            Action: sts:AssumeRoleWithWebIdentity
+            Condition:
+              StringEquals:
+                "cognito-identity.amazonaws.com:aud": !Ref CognitoIdentityPool
+              ForAnyValue:StringLike:
+                "cognito-identity.amazonaws.com:amr": "unauthenticated"
 
   CognitoIdentityPool:
     Type: AWS::Cognito::IdentityPool