v2.1.0

[PoeppingT]

Hello curious reader! 🚀 This release marks the official v2.1.0 release of SaaS Boost, now with support for AWS China regions. This release contains those improvements along with various bugfixes and security imprvements over the previous release.

A reminder that you can view our project roadmap by viewing the "Projects" page on our GitHub repository page. Please upvote and comment on issues you'd like to see, and don't be afraid to open discussions to ask questions.

Lastly, a very special thanks to @goodbyedavid and @hanrobyn for helping get this release out.

A full changelist is below. Thanks for reading!

What's Changed

• Don't hardcode AWS partition and URL suffix by @brtrvn in Don't hardcode AWS partition and URL suffix #303
• Replace the built-in API Gateway Cognito authorizer with a Lambda Authorizer by @brtrvn in Replace the built-in API Gateway Cognito authorizer with a Lambda Authorizer #368
• Splitting the system identity provider resources from the admin web app by @brtrvn in Splitting the system identity provider resources from the admin web app #370
• Make version more detailed, move git plugin to parent by @PoeppingT in Make version more detailed, move git plugin to parent #369
• Use CodeBuild to build and deploy the admin web app instead of the installer by @brtrvn in Use CodeBuild to build and deploy the admin web app instead of the installer #371
• Fix isPublic default in AppConfig UI by @PoeppingT in Fix isPublic default in AppConfig UI #375
• Split OnboardingServiceComputeProvisionPolicy to avoid quota limits by @PoeppingT in Split OnboardingServiceComputeProvisionPolicy to avoid quota limits #373
• Fix Joda time deserialization bug by @brtrvn in Fix Joda time deserialization bug #378
• Add explicit SNS Publish permission to onboarding service for core-stack-listener. by @PoeppingT in Add explicit SNS Publish permission to onboarding service for core-stack-listener. #382
• Replace Amplify with oidc-react in UI, customize Cognito Hosted UI. by @PoeppingT in Replace Amplify with oidc-react in UI, customize Cognito Hosted UI. #376
• Support for Keycloak as a system IdP by @brtrvn in Support for Keycloak as a system IdP #377
• Bump jackson-databind from 2.13.3 to 2.13.4.1 in /layers/utils by @dependabot in Bump jackson-databind from 2.13.3 to 2.13.4.1 in /layers/utils #379
• Bump jackson-databind from 2.13.3 to 2.13.4.1 in /functions/authorizer by @dependabot in Bump jackson-databind from 2.13.3 to 2.13.4.1 in /functions/authorizer #380
• Bump jackson-databind from 2.13.3 to 2.13.4.1 in /installer by @dependabot in Bump jackson-databind from 2.13.3 to 2.13.4.1 in /installer #381
• change service quotas check logic in GCR as QuotaService is not avail… by @hanrobyn in change service quotas check logic in GCR as QuotaService is not avail… #386
• change for CloudFront do not support managed policies in GCR by @hanrobyn in change for CloudFront do not support managed policies in GCR #387
• Fix installer final printout of admin console on install by @PoeppingT in Fix installer final printout of admin console on install #389
• Support Keycloak through the Admin UI. by @PoeppingT in Support Keycloak through the Admin UI. #391
• Apply a new service quota calculation method when using Fargate in ECS by @muylucir in Apply a new service quota calculation method when using Fargate in ECS #390
• Rds bootstrap batching by @brtrvn in Rds bootstrap batching #395
• Fix for Issue private api /GET/settings/*/secret does not return value for BILLING_API_KEY #393 by @raman231 in Fix for Issue #393 #397
• Fix quotas check for RDS. by @PoeppingT in Fix quotas check for RDS. #402
• Attach private services to a single service discovery namespace. by @PoeppingT in Attach private services to a single service discovery namespace. #405
• Instruct users to install jq in cloud9 doc by @PoeppingT in Instruct users to install jq in cloud9 doc #410
• System User Service Updates by @brtrvn in System User Service Updates #383
• Fix for issue Metrics data not reaching redshift #403 and HostedZone not getting stored correctly in parameter store #404 by @raman231 in Fix for issue #403 and #404 #407
• Bugfixes for IAM certificates in China by @PoeppingT in Bugfixes for IAM certificates in China #412
• User pool output typo by @brtrvn in User pool output typo #414
• Fix artifact bucket policy partition when in non-standard regions. by @PoeppingT in Fix artifact bucket policy partition when in non-standard regions. #416
• Fix invalid_scope, ensure UserPoolDomain is unique and active. by @PoeppingT in Fix invalid_scope, ensure UserPoolDomain is unique and active. #417
• Modify template url for china region access by @hanrobyn in Modify template url for china region access #418
• Fix Onboarding Service NPE with no private services by @brtrvn in Fix Onboarding Service NPE with no private services #421
• Change ApiGatewayUrl for web in China region by @hanrobyn in Change ApiGatewayUrl for web in China region #423
• Change npm registry in China Region by @hanrobyn in Change npm registry in China Region #424
• Fix client-side uploading of tenant zipfile configuration. by @PoeppingT in Fix client-side uploading of tenant zipfile configuration. #426
• Switch from SSE-KMS to SSE-SQS for SQS encryption at rest by @brtrvn in Switch from SSE-KMS to SSE-SQS for SQS encryption at rest #427
• Remove keycloak-metrics-spi.jar when build keycloak by @hanrobyn in Remove keycloak-metrics-spi.jar when build keycloak #422
• Implement update, enable, and disable for Keycloak System User Service. by @PoeppingT in Implement update, enable, and disable for Keycloak System User Service. #428
• Getting started gcr by @goodbyedavid in Getting started gcr #429
• Fix tenant onboarding status stucked after stack created by @hanrobyn in Fix tenant onboarding status stucked after stack created #433
• Remove Yarn and Node prechecks from install.ps1. by @PoeppingT in Remove Yarn and Node prechecks from install.ps1. #440
• Bump postgresql from 42.4.1 to 42.4.3 in /samples/java by @dependabot in Bump postgresql from 42.4.1 to 42.4.3 in /samples/java #435
• Bump postgresql from 42.4.1 to 42.4.3 in /resources/custom-resources/rds-bootstrap by @dependabot in Bump postgresql from 42.4.1 to 42.4.3 in /resources/custom-resources/rds-bootstrap #434
• Fix signout in admin web app. by @PoeppingT in Fix signout in admin web app. #439

New Contributors

• @hanrobyn made their first contribution in change service quotas check logic in GCR as QuotaService is not avail… #386
• @raman231 made their first contribution in Fix for Issue #393 #397
• @goodbyedavid made their first contribution in Getting started gcr #429

Full Changelog: v2.0.1...v2.1.0

---

This discussion was created from the release v2.1.0.

[tomg-formpak]

Hi Team @PoeppingT @brtrvn

It seems v2.1.0 is stuck at the stage of uploading lambda functions to S3 (28th one).

We were using v2.0.1, we tried updating SaaS Boost selecting option 3 to update the Web application, which ended with no result or error. Then we continued with option 4 to update existing AWS SaaS Boost deployment and it failed with the below error.

2022-12-31 02:26:45.419  INFO  SaaSBoostInstall - Timed out waiting for tenant 357cfc92-bb85-41a8-9987-44669d06b9fe to reach deleted state. Please check CloudFormation in your AWS Console for more details.
2022-12-31 02:26:45.422  INFO  SaaSBoostInstall - ===========================================================
2022-12-31 02:26:45.423  INFO  SaaSBoostInstall - Installation Error: Delete failed.
2022-12-31 02:26:45.423  INFO  SaaSBoostInstall - Please see detailed log file saas-boost-install.log
2022-12-31 02:26:45.483  ERROR SaaSBoostInstall - java.lang.RuntimeException: Delete failed.
	at com.amazon.aws.partners.saasfactory.saasboost.SaaSBoostInstall.deleteProvisionedTenant(SaaSBoostInstall.java:1168)
	at com.amazon.aws.partners.saasfactory.saasboost.SaaSBoostInstall.deleteSaasBoostInstallation(SaaSBoostInstall.java:716)
	at com.amazon.aws.partners.saasfactory.saasboost.SaaSBoostInstall.start(SaaSBoostInstall.java:255)
	at com.amazon.aws.partners.saasfactory.saasboost.SaaSBoostInstall.main(SaaSBoostInstall.java:180)

Then we delete all resources from AWS manually ( Cloudfromation stacks, S3 buckets, and SSM). Started with a fresh installation for v2.1.0, but it stuck at uploading lambda. Please see the below screenshot.

1. Please support solving this issue on installation v2.1.0. (custom domain for System identity provider and SaaS Boost admin web console are marked N/A)
2. Also, please provide us with the exact flow of updating existing saas boost deployment. How does it affect failure and retry update resume from the last stage or will it affect the existing deployment or tenant services?
3. What are the measures to take before an update or fresh installation, to make sure existing configuration and tenant resources (DB and S3 are not affected)?

Thank you

[tomg-formpak]

We tried again with v2.1.0 and got the below error.

[tomg-formpak]

Now on another try pointed to main head, we are getting the below error:-

Please advise on this. @PoeppingT @brtrvn

[PoeppingT]

@tomg-formpak Can you clarify what you're trying to do for each of these errors: updating, deleting, or creating?

Your error ParameterValue for ParameterKey Version is required could be due to a failure when parsing the git information for Version. Check the saas-boost-install.log for any errors.

Your recent error about Cannot find version 5.7.mysql_aurora.2.08.3 for aurora-mysql is reproducible in eu-west-1, but not in us-west-1. We are reaching out to the RDS team to understand what's going on here, hold tight.

To address your first three points above:

1. Please support solving this issue on installation v2.1.0. (custom domain for System identity provider and SaaS Boost admin web console are marked N/A)

Based on your screenshots it looks like the installer took longer than expected to build the System User Service due to a long download time for the required Keycloak dependency. This should be a transient issue related to your connection to the Maven central repositories.

2. Also, please provide us with the exact flow of updating existing saas boost deployment. How does it affect failure and retry update resume from the last stage or will it affect the existing deployment or tenant services?

Updating an existing SaaS Boost deployment functions the following way:

1. The Installer inspects changed code paths since the previous install or update and determines which actions to take based on that. For example if the web client and two of the SaaS Boost services were updated, the installer will update each of those: for the web client zipping the source together and uploading it to S3 which kicks off a new build, and for the services repackaging and uploading the service lambda assemblies to S3 and updating the AWS Lambda function configuration. If any CloudFormation stack templates have changed, those will be uploaded as well.
2. Then the Installer updates the base SaaS Boost CloudFormation stack (this will not update tenant stacks) to apply any changes made to stack templates or service resources.

If the update fails, any retries will function the same way as the original update. If any problems were encountered with the code you tried to use to update, that would be your chance to make the alterations and rerun the update as it existed. If the update replaced some services with non-functional code, that would render those services unusable until you either a/ run another update to fix the problems or b/ run another update to roll back the version changes (by checking out an older version and running update). We view it as being cleaner and easier to understand if update runs a complete operation each time, rather than trying to pick up where it left off previously. If you can describe a situation where that feature would be useful, please do so in a feature request.

3. What are the measures to take before an update or fresh installation, to make sure existing configuration and tenant resources (DB and S3 are not affected)?

As SaaS Boost functions currently AppConfig and all Tenant Resources should always be retained during an update. On a fresh installation new resources are created, which would not touch resources attached to an older environment. If you are choosing to delete a previous environment and create a new one in its place, we advise you manually save any configurations you cannot easily recreate.

[tomg-formpak]

Hi @PoeppingT

Thank you so much for the detailed response.

We were using v2.0.1 and wanted to try v2.1.0 - since the update option from the installer didn't work, I deleted all the resources from AWS manually and started a fresh installation. On each error, I do again delete created SaaS Boost resources from the AWS account and start the installation again from the installer.

The error related to ParameterValue for ParameterKey Version is required didn't come up again. This was caused when we were doing installation using the zip file (v2.1.0).

Related to question 1, yes, it's a good thing that the update runs a complete operation each time so that we can update it on error or something given it won't affect any tenant recourses also. Just to make it clear

• Should we always start with option 3 (Update web application for existing AWS SaaS Bost deployment) and then go for option 4, right?

Related to question 2, let's say we want to delete a previous environment and create a new one in its place, then what are the things that we should backup that are specific for a tenant? Is it only the DB instance and S3 resources under that tenants?

Today, we tried for a fresh installation, pointing to the main head, but ended up with the same error [The following resource(s) failed to create: [InvokeRdsOptions]. Please see below for screenshots.

saas-boost-install

mvn-spotbug

Please let me know. Thank you.

[PoeppingT]

Hey @tomg-formpak ,

1. You do not need to run the installer option 3 "Update Web Application for existing AWS SaaS Boost deployment." before running option 4, since option 4 will update the Web Application if necessary.
2. If you want to delete a previous environment and create a new one in its place, you may want to back up data from each of your tenants so you can restore. The data that you should restore is dependent on the use case for your SaaS Boost application: if you manage data in S3, RDS, and EFS for each tenant, you should back up that data to a place not managed by SaaS Boost so you can manually restore that data once your tenants are recreated.
3. The InvokeRdsOptions issue when creating new environments has been fixed in e2fbf17