From 6acb3610d5a11ae12b6dbc67f9f54c22510e74c0 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Thu, 14 May 2026 07:31:05 -0400
Subject: [PATCH] fix(integrations): remove fragile heredoc from AWS auditor
 setup script
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The AWS Auditor CloudShell script used `cat <<EOF ... EOF` to build the
trust policy. If copy/paste mangled the EOF marker (whitespace added,
line concatenated, or content truncated), bash kept reading lines
looking for EOF, hit end-of-file, and failed with:

  here-document at line 71 delimited by end-of-file (wanted 'EOF')
  command substitution: line 105: unexpected EOF while looking for matching ')'

Replaced the heredoc with inline single-quoted JSON, matching the
Remediation script's existing pattern. Same IAM role, same policies,
same trust relationship — byte-identical commands sent to AWS, just
delivered via a more robust bash syntax.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../src/manifests/aws/credentials.ts          | 87 ++++++++-----------
 1 file changed, 35 insertions(+), 52 deletions(-)

diff --git a/packages/integration-platform/src/manifests/aws/credentials.ts b/packages/integration-platform/src/manifests/aws/credentials.ts
index da2537afe..efe999b5b 100644
--- a/packages/integration-platform/src/manifests/aws/credentials.ts
+++ b/packages/integration-platform/src/manifests/aws/credentials.ts
@@ -173,58 +173,41 @@ export function getAwsCloudShellScript(environment: AwsEnvironment = 'aws'): str
     'job-function/ViewOnlyAccess',
   );
 
-  return [
-  '#!/bin/bash',
-  '(',
-  'set -euo pipefail',
-  '',
-  'ROLE_NAME="CompAI-Auditor"',
-  'EXTERNAL_ID="YOUR_EXTERNAL_ID"',
-  '',
-  'echo "Creating IAM role $ROLE_NAME..."',
-  '',
-  'TRUST_POLICY=$(cat <<EOF',
-  '{',
-  '  "Version": "2012-10-17",',
-  '  "Statement": [{',
-  '    "Effect": "Allow",',
-  `    "Principal": { "AWS": "${roleAssumerArn}" },`,
-  '    "Action": "sts:AssumeRole",',
-  '    "Condition": { "StringEquals": { "sts:ExternalId": "$EXTERNAL_ID" } }',
-  '  }]',
-  '}',
-  'EOF',
-  ')',
-  '',
-  'ROLE_ARN=$(aws iam create-role \\',
-  '  --role-name "$ROLE_NAME" \\',
-  '  --max-session-duration 43200 \\',
-  '  --assume-role-policy-document "$TRUST_POLICY" \\',
-  '  --query "Role.Arn" --output text)',
-  '',
-  'aws iam attach-role-policy --role-name "$ROLE_NAME" \\',
-  `  --policy-arn ${securityAuditPolicyArn}`,
-  '',
-  'aws iam attach-role-policy --role-name "$ROLE_NAME" \\',
-  `  --policy-arn ${viewOnlyPolicyArn}`,
-  '',
-  'aws iam put-role-policy --role-name "$ROLE_NAME" \\',
-  '  --policy-name CompAI-CostExplorer \\',
-  '  --policy-document \'{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"ce:GetCostAndUsage","Resource":"*"}]}\'',
-  '',
-  'aws iam put-role-policy --role-name "$ROLE_NAME" \\',
-  '  --policy-name CompAI-ExtraReadAccess \\',
-  '  --policy-document \'{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ssm:GetDocument","ssm:DescribeDocument","ssm:ListDocuments"],"Resource":"*"}]}\'',
-  '',
-  'echo ""',
-  'echo "============================================"',
-  'echo "  Role ARN:    $ROLE_ARN"',
-  'echo "  External ID: $EXTERNAL_ID"',
-  'echo "============================================"',
-  'echo ""',
-  'echo "Paste these values into your Comp AI connection form."',
-  ')',
-  ].join('\n');
+  return `# Create Auditor Role for Comp AI
+# Run this in AWS CloudShell to create the read-only IAM role.
+
+(
+set -euo pipefail
+
+EXTERNAL_ID="YOUR_EXTERNAL_ID"
+ROLE_NAME="CompAI-Auditor"
+
+echo "Creating IAM role $ROLE_NAME..."
+
+ROLE_ARN=$(aws iam create-role --role-name "$ROLE_NAME" --max-session-duration 43200 \\
+  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"${roleAssumerArn}"},"Action":"sts:AssumeRole","Condition":{"StringEquals":{"sts:ExternalId":"'$EXTERNAL_ID'"}}}]}' \\
+  --query 'Role.Arn' --output text)
+
+aws iam attach-role-policy --role-name "$ROLE_NAME" \\
+  --policy-arn ${securityAuditPolicyArn}
+
+aws iam attach-role-policy --role-name "$ROLE_NAME" \\
+  --policy-arn ${viewOnlyPolicyArn}
+
+aws iam put-role-policy --role-name "$ROLE_NAME" --policy-name CompAI-CostExplorer \\
+  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"ce:GetCostAndUsage","Resource":"*"}]}'
+
+aws iam put-role-policy --role-name "$ROLE_NAME" --policy-name CompAI-ExtraReadAccess \\
+  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ssm:GetDocument","ssm:DescribeDocument","ssm:ListDocuments"],"Resource":"*"}]}'
+
+echo ""
+echo "============================================"
+echo "  Role ARN (paste this below):"
+echo ""
+echo "  $ROLE_ARN"
+echo ""
+echo "============================================"
+)`;
 }
 
 export const awsCloudShellScript = getAwsCloudShellScript();