[nathan-inge]

Description of changes

On Windows, aws deploy install writes the on-premises instance configuration file to C:\ProgramData\Amazon\CodeDeploy\conf.onpremises.yml. The 0o600 mode used when the file is written only applies on POSIX: on Windows,os.open and os.chmod don't set ACLs, so the file inherits its ACL from its directory.

This change creates the file on Windows with its own access control list, so its permissions don't depend on the directory:

• Add Windows.create_config_file(), which creates the file with CreateFileW(CREATE_NEW) and a security descriptor with a protected DACL (D:P(A;;FA;;;SY)(A;;FA;;;BA)), granting full control only to LocalSystem and Administrators. Nothing is inherited from the directory.
• An existing file is deleted and recreated rather than truncated, so it doesn't keep its previous ACL. This also applies when --config-file is the installed path; the contents are read first.
• CREATE_NEW fails if the file reappears between the delete and the create. If the file can't be replaced (for example, another process has it open) or created, install stops with a clear error before writing the config.
• The file is opened without sharing while it's written, and os.chmod is skipped for it, since on Windows it only toggles the read-only attribute.
• The Win32 calls go through ctypes.

Linux behavior is unchanged.

Behavior changes

• On Windows, an existing configuration file is replaced rather than truncated. If another process has it open without delete sharing,
• With --override-config and --config-file set to the installed path, Windows now rewrites the file (same contents) instead of leaving it untouched.

Testing

• New unit tests cover the replace order (clear read-only attribute, remove, create), a missing file, the file-in-use and create-failure errors, reading the source before replacing it when it is the installed path, and install stopping if the file can't be replaced.
• New Windows tests (TestInstallConfigFileWindowsAcl, run in an elevated session) read the DACL back with GetNamedSecurityInfoW and check that it is protected and only contains SYSTEM and Administrators, for a new file, an existing file with an explicit Everyone entry, and that file passed as --config-file.
• Ran tests/unit/customizations/codedeploy and scripts/ci/run-tests on Windows Server 2022, and tests/unit/customizations/codedeploy on Windows Server 2016 (Python 3.12, elevated). All passed, including the new Windows tests.
• Ran aws deploy install end to end on both versions and checked the resulting file ACL with icacls, including after the agent MSI was installed and the agent service started. The agent reads the file.
• ruff check and ruff format --check are clean on the changed files.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.