Skip to content

Releases: aws-cloudformation/rain

v1.20.2

17 Dec 22:21
494b890
Compare
Choose a tag to compare

This release adds unit tests to make sure the build command will work for all types.

What's Changed

Full Changelog: v1.20.1...v1.20.2

v1.20.1

16 Dec 22:44
2f95fc3
Compare
Choose a tag to compare

What's Changed

Full Changelog: v1.20.0...v1.20.1

v1.20.0

16 Dec 19:56
a3e5ece
Compare
Choose a tag to compare

What's Changed

New Contributors

Full Changelog: v1.19.0...v1.20.0

v1.19.0

31 Oct 18:11
efb944c
Compare
Choose a tag to compare

What's Changed

Full Changelog: v1.18.0...v1.19.0

v1.18.0

29 Oct 23:25
4c72bec
Compare
Choose a tag to compare

This release addresses a security issue that would allow an attacker to predict the name of the rain asset bucket and create it before a user issues a rain pkg command, which uploads assets such as Lambda function code to the bucket. This would give the attacker full access to the contents uploaded by Rain, since they own the bucket. This release adds the ExpectedBucketOwner argument to S3 calls, which causes an Access Denied error if the bucket does not belong to the same account. Additionally, this release adds the s3-bucket argument to the rain bootstrap command, which allows users to create an asset bucket with a user-supplied name, which will be stored in SSM Parameter Store with the key rain-bucket for reference by future Rain commands. We recommend that users upgrade to v1.18.0, and verify that the expected rain asset bucket exists within their own account. Users who do not use the pkg or deploy commands are not affected by this issue. Users who supply the optional s3-bucket argument to those commands are not affected if the bucket they specify is in their account.

What's Changed

  • When merging templates with Outputs, replace Imports that reference Exported Names by @ericzbeard in #565
  • Add expected bucket owner checks to s3 operations by @ericzbeard in #566

Full Changelog: v1.17.0...v1.18.0

v1.17.0

21 Oct 23:33
c400275
Compare
Choose a tag to compare

What's Changed

Full Changelog: v1.16.1...v1.17.0

v1.16.1

03 Oct 18:14
1a98cc4
Compare
Choose a tag to compare

This release features a set of new S3 Bucket Metadata commands that can be used to run scripts, upload content, and invalidate CloudFront distributions. The S3 directive also gets a new Run property that allows you to run build scripts for your lambda functions before uploading them. There is a fully functional serverless web application sample in test/webapp that demonstrates these new features.

What's Changed

Dependabot

  • Bump actions/download-artifact from 2 to 4.1.7 in /.github/workflows by @dependabot in #514

New Contributors

Full Changelog: v1.15.0...v1.16.0

v1.16.0

03 Oct 18:05
359521d
Compare
Choose a tag to compare

This release features a set of new S3 Bucket Metadata commands that can be used to run scripts, upload content, and invalidate CloudFront distributions. The S3 directive also gets a new Run property that allows you to run build scripts for your lambda functions before uploading them. There is a fully functional serverless web application sample in test/webapp that demonstrates these new features.

What's Changed

Dependabot

  • Bump actions/download-artifact from 2 to 4.1.7 in /.github/workflows by @dependabot in #514

New Contributors

Full Changelog: v1.15.0...v1.16.0

v1.15.0

21 Aug 21:32
b5685eb
Compare
Choose a tag to compare

What's Changed

Full Changelog: v1.14.0...v1.15.0

v1.14.0

07 Aug 16:16
47b261d
Compare
Choose a tag to compare

What's Changed

Full Changelog: v1.13.1...v1.14.0