[nathan-inge]

Description of changes

AWS CLI v1 counterpart of #10891. Same change; only the tests are adapted to this branch.

On Windows, aws deploy install writes the on-premises instance configuration file to
C:\ProgramData\Amazon\CodeDeploy\conf.onpremises.yml. The 0o600 mode used when the file is written only applies on POSIX: on Windows,os.open and os.chmod don't set ACLs, so the file inherits its ACL from its directory.

This change creates the file on Windows with its own access control list, so its permissions don't depend on the directory:

• Add Windows.create_config_file(), which creates the file with CreateFileW(CREATE_NEW) and a security descriptor with a protected DACL (D:P(A;;FA;;;SY)(A;;FA;;;BA)), granting full control only to LocalSystem and Administrators. Nothing is inherited from the directory.

• An existing file is deleted and recreated rather than truncated, so it doesn't keep its previous ACL. This also applies when
  --config-file is the installed path; the contents are read first.

• CREATE_NEW fails if the file reappears between the delete and the create. If the file can't be replaced or created, install stops with a clear error before writing the config.

• The file is opened without sharing while it's written, and os.chmod is skipped for it on Windows.

  Linux behavior is unchanged.

  Differences from the v2 change

  • test_install.py uses this branch's import style.instead of the return code. It still checks that nothing is written and the agent isn't installed.

  Behavior changes

  • On Windows, an existing configuration file is replaced rather than truncated. If another process has it open without delete sharing, install fails and asks the user to close it.
  • With --override-config and --config-file set to the installed path, Windows now rewrites the file (same contents) instead of leaving it untouched.

Testing

• Same new unit tests and Windows ACL tests as the v2 change.
• tests/unit/customizations/codedeploy on Linux (Python 3.12): 139 passed, 3 skipped (the elevated-Windows tests).
• The source changes are identical to the v2 change, which was tested on Windows Server 2022 and 2016. The Windows tests on this branch run in the windows-latest CI job.
• No new ruff findings in the changed files.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 91.80328% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 44.61%. Comparing base (70d3b38) to head (05a5d23).
⚠️ Report is 174 commits behind head on develop.

Files with missing lines	Patch %	Lines
awscli/customizations/codedeploy/systems.py	90.90%	5 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           develop   #10892       +/-   ##
============================================
- Coverage    93.42%   44.61%   -48.82%     
============================================
  Files          211      301       +90     
  Lines        17312    36797    +19485     
============================================
+ Hits         16174    16417      +243     
- Misses        1138    20380    +19242     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.