Merge branch 'develop' into fix-8477

Author: vicheey

pyproject.toml

@@ -68,9 +68,9 @@ pre-dev = [
 dev = [
     "aws-sam-cli[pre-dev]",
     "coverage==7.13.4",
-    "pytest-cov==7.0.0",
+    "pytest-cov==7.1.0",
     "mypy==1.19.1",
-    "types-pywin32==311.0.0.20260316",
+    "types-pywin32==311.0.0.20260323",
     "types-PyYAML==6.0.12.20250915",
     "types-chevron==0.14.2.20250103",
     "types-psutil==7.2.2.20260130",

samcli/__init__.py

@@ -2,4 +2,4 @@
 SAM CLI version
 """
 
-__version__ = "1.156.0"
+__version__ = "1.157.1"

samcli/commands/_utils/custom_options/hook_name_option.py

@@ -90,6 +90,7 @@ def _call_prepare_hook(self, iac_hook_wrapper, opts, ctx):
             skip_prepare_infra = _read_parameter_value("skip_prepare_infra", opts, ctx, False)
             plan_file = _read_parameter_value("terraform_plan_file", opts, ctx)
             project_root_dir = _read_parameter_value("terraform_project_root_path", opts, ctx)
+            mount_symlinks = _read_parameter_value("mount_symlinks", opts, ctx, False)
 
             metadata_file = iac_hook_wrapper.prepare(
                 output_dir_path,
@@ -100,6 +101,7 @@ def _call_prepare_hook(self, iac_hook_wrapper, opts, ctx):
                 skip_prepare_infra,
                 plan_file,
                 project_root_dir,
+                mount_symlinks,
             )
 
             LOG.info("Prepare hook completed and metadata file generated at: %s", metadata_file)

samcli/commands/local/cli_common/invoke_context.py

@@ -563,7 +563,9 @@ def function_identifier(self) -> str:
     @property
     def lambda_runtime(self) -> LambdaRuntime:
         if not self._lambda_runtimes:
-            layer_downloader = LayerDownloader(self._layer_cache_basedir, self.get_cwd(), self._stacks)
+            layer_downloader = LayerDownloader(
+                self._layer_cache_basedir, self.get_cwd(), self._stacks, mount_symlinks=self._mount_symlinks
+            )
             image_builder = LambdaImage(
                 layer_downloader, self._skip_pull_image, self._force_image_build, invoke_images=self._invoke_images
             )

samcli/hook_packages/terraform/copy_terraform_built_artifacts.py

@@ -218,7 +218,7 @@ def cli_exit():
     sys.exit(1)
 
 
-def find_and_copy_assets(directory_path, expression, data_object):
+def find_and_copy_assets(directory_path, expression, data_object, mount_symlinks=False):
     """
     Takes in an expression, directory_path and a json input from the standard input,
     tries to find the appropriate element within the json based on the element. It then takes action to
@@ -264,7 +264,7 @@ def find_and_copy_assets(directory_path, expression, data_object):
 
     try:
         if zipfile.is_zipfile(abs_attribute_path):
-            unzip(abs_attribute_path, directory_path)
+            unzip(abs_attribute_path, directory_path, mount_symlinks=mount_symlinks)
         else:
             copytree(abs_attribute_path, directory_path)
     except OSError as ex:
@@ -342,12 +342,19 @@ def validate_environment_variables():
         required=False,
         help="Terraform output json body. This option is not to be used with --target.",
     )
+    argparser.add_argument(
+        "--mount-symlinks",
+        action="store_true",
+        default=False,
+        help="Allow symlinks pointing outside the extraction directory when unzipping artifacts.",
+    )
 
     arguments = argparser.parse_args()
     directory_path = os.path.abspath(arguments.directory)
     expression = arguments.expression
     target = arguments.target
     json_str = arguments.json
+    mount_symlinks = arguments.mount_symlinks
 
     # validate environment variables do not contain blocked arguments
     validate_environment_variables()
@@ -384,4 +391,4 @@ def validate_environment_variables():
         cli_exit()
 
     LOG.info("Find and copy built assets")
-    find_and_copy_assets(directory_path, expression, data_object)
+    find_and_copy_assets(directory_path, expression, data_object, mount_symlinks=mount_symlinks)

samcli/hook_packages/terraform/hooks/prepare/enrich.py

@@ -52,6 +52,7 @@ def enrich_resources_and_generate_makefile(
     terraform_application_dir: str,
     lambda_resources_to_code_map: Dict,
     project_root_dir: str,
+    mount_symlinks: bool = False,
 ) -> None:
     """
     Use the sam metadata resources to enrich the mapped resources and to create a Makefile with a rule for
@@ -111,7 +112,12 @@ def enrich_resources_and_generate_makefile(
 
             # get makefile rule for resource
             makefile_rule = generate_makefile_rule_for_lambda_resource(
-                sam_metadata_resource, logical_id, terraform_application_dir, python_command_name, output_directory_path
+                sam_metadata_resource,
+                logical_id,
+                terraform_application_dir,
+                python_command_name,
+                output_directory_path,
+                mount_symlinks=mount_symlinks,
             )
             makefile_rules.append(makefile_rule)
 

samcli/hook_packages/terraform/hooks/prepare/hook.py

@@ -94,6 +94,7 @@ def prepare(params: dict) -> dict:
         LOG.debug("The normalized OutputDirPath value is %s", output_dir_path)
 
     skip_prepare_infra = params.get("SkipPrepareInfra", False)
+    mount_symlinks = params.get("MountSymlinks", False)
     metadata_file_path = os.path.join(output_dir_path, TERRAFORM_METADATA_FILE)
 
     plan_file = params.get("PlanFile")
@@ -112,7 +113,9 @@ def prepare(params: dict) -> dict:
 
             # convert terraform to cloudformation
             LOG.info("Generating metadata file")
-            cfn_dict = translate_to_cfn(tf_json, output_dir_path, terraform_application_dir, project_root_dir)
+            cfn_dict = translate_to_cfn(
+                tf_json, output_dir_path, terraform_application_dir, project_root_dir, mount_symlinks=mount_symlinks
+            )
 
             if cfn_dict.get("Resources"):
                 _update_resources_paths(cfn_dict.get("Resources"), terraform_application_dir)  # type: ignore

samcli/hook_packages/terraform/hooks/prepare/makefile_generator.py

@@ -29,6 +29,7 @@ def generate_makefile_rule_for_lambda_resource(
     terraform_application_dir: str,
     python_command_name: str,
     output_dir: str,
+    mount_symlinks: bool = False,
 ) -> str:
     """
     Generates and returns a makefile rule for the lambda resource associated with the given sam metadata resource.
@@ -56,7 +57,12 @@ def generate_makefile_rule_for_lambda_resource(
     resource_address = sam_metadata_resource.resource.get("address", "")
     python_command_recipe = _format_makefile_recipe(
         _build_makerule_python_command(
-            python_command_name, output_dir, resource_address, sam_metadata_resource, terraform_application_dir
+            python_command_name,
+            output_dir,
+            resource_address,
+            sam_metadata_resource,
+            terraform_application_dir,
+            mount_symlinks=mount_symlinks,
         )
     )
     return f"{target}{python_command_recipe}"
@@ -124,6 +130,7 @@ def _build_makerule_python_command(
     resource_address: str,
     sam_metadata_resource: SamMetadataResource,
     terraform_application_dir: str,
+    mount_symlinks: bool = False,
 ) -> str:
     """
     Build the Python command recipe to be used inside of the Makefile rule
@@ -155,12 +162,15 @@ def _build_makerule_python_command(
     terraform_built_artifacts_script_path = convert_path_to_unix_path(
         str(Path(output_dir, TERRAFORM_BUILD_SCRIPT).relative_to(terraform_application_dir))
     )
-    return show_command_template.format(
+    command = show_command_template.format(
         python_command_name=python_command_name,
         terraform_built_artifacts_script_path=terraform_built_artifacts_script_path,
         jpath_string=jpath_string.replace('"', '\\"'),
         resource_address=resource_address.replace('"', '\\"'),
     )
+    if mount_symlinks:
+        command += " --mount-symlinks"
+    return command
 
 
 def _get_makefile_build_target(logical_id: str) -> str:

samcli/hook_packages/terraform/hooks/prepare/translate.py

@@ -152,7 +152,11 @@ def _check_unresolvable_values(root_module: dict, root_tf_module: TFModule) -> N
 
 
 def translate_to_cfn(
-    tf_json: dict, output_directory_path: str, terraform_application_dir: str, project_root_dir: str
+    tf_json: dict,
+    output_directory_path: str,
+    terraform_application_dir: str,
+    project_root_dir: str,
+    mount_symlinks: bool = False,
 ) -> dict:
     """
     Translates the json output of a terraform show into CloudFormation
@@ -339,6 +343,7 @@ def translate_to_cfn(
             terraform_application_dir,
             lambda_resources_to_code_map,
             project_root_dir,
+            mount_symlinks=mount_symlinks,
         )
     else:
         LOG.debug("There is no sam metadata resources, no enrichment or Makefile is required")

samcli/lib/hook/hook_wrapper.py

@@ -54,6 +54,7 @@ def prepare(
         skip_prepare_infra: bool = False,
         plan_file: Optional[str] = None,
         project_root_dir: Optional[str] = None,
+        mount_symlinks: bool = False,
     ) -> str:
         """
         Run the prepare hook to generate the IaC Metadata file.
@@ -96,6 +97,8 @@ def prepare(
             params["PlanFile"] = plan_file
         if project_root_dir:
             params["ProjectRootDir"] = project_root_dir
+        if mount_symlinks:
+            params["MountSymlinks"] = mount_symlinks
 
         output = self._execute("prepare", params)