Install/run Amplify as a local package

[jsepia]

Is this feature request related to a new or existing Amplify category?

New category

Is this related to another service?

No response

Describe the feature you'd like to request

I'd like to be able to install and run the Amplify CLI as a local package so that I can use npx to run it:

npm --save-dev install @aws-amplify/cli
npx amplify configure

Current experience

This scenario is clearly not supported today:

$ npm --save-dev install @aws-amplify/cli
... 
$ npx amplify configure
? Select the backend providers. (Press <space> to select, <a> to toggle all, <i>
 to invert selection)

(no list is shown, pressing space does nothing)

$ npx amplify pull

Use cases

• ~~Install amplify without sudo~~ (edit: this can be accomplished by setting a custom NPM prefix)
• Lock my version of the Amplify CLI with my project's package.json file
• Upgrade the Amplify CLI along with the rest of my project's dependencies
• Be notified of security vulnerabilities found in the Amplify CLI by npm audit
• Fix security vulnerabilities found in the Amplify CLI by running npm audit fix

Related issues, documentation, etc

#4491 (2020, closed due to inactivity) #4485 (2020, closed due to inactivity) #839 (2019, closed due to inactivity)

PR #3857 (closed due to inactivity)

For more about npx, iincluding use cases, see the npx launch blog post (2017): https://blog.npmjs.org/post/162869356040/introducing-npx-an-npm-package-runner

Describe the solution you'd like

See above

Describe alternatives you've considered

I've considered installing amplify globally. It would have to be manually updated, since my package manager would not be aware of it.

I've considered running a dockerized Amplify CLI. This would provide secure and repeatable builds but it's also more work to set up and troubleshoot.

Edit: It's possible to install Amplify globally without sudo by setting a custom npm prefix. This mitigates some of my security concerns and allows the use of npx.

Additional context

• The problem with npm install --global (2017): https://ericlathrop.com/2017/05/the-problem-with-npm-install-global/
• Avoid global npm installs for projects (2015): http://www.gjermundbjaanes.com/avoid-global-npm-installs-for-projects/

Is this something that you'd be interested in working on?

• [ ] 👋 I may be able to implement this feature request
• [ ] ⚠️ This feature might incur a breaking change

[josefaidt]

Hey @jsepia :wave: thanks for raising this! Are you currently running into issues installing globally without sudo?

I've marked this as a feature request to evaluate further 🙂

[jsepia]

Hey @jsepia wave thanks for raising this! Are you currently running into issues installing globally without sudo?

I've marked this as a feature request to evaluate further slightly_smiling_face

Thanks for triaging this issue. I just tried installing Amplify globally without sudo in a VM. It gave me an EACCESS error at first, but it worked after I set a custom npm prefix:

$ mkdir ~/.npm-global
$ npm config set prefix '~/.npm-global'
$ npm -g install @aws-amplify/cli
...
$ npx amplify configure
Follow these steps to set up access to your AWS account:
...

I will edit my original post to include this workaround.

[josefaidt]

Hey @jsepia I'm glad to hear you're up and running with npx! To clarify, did you previously have the CLI installed via curl on your machine?

[jsepia]

Hey @jsepia I'm glad to hear you're up and running with npx! To clarify, did you previously have the CLI installed via curl on your machine?

Yeah, I'm looking forward to learning Amplify. I didn't previously have the Amplify CLI installed, it was a fresh OS.

[gorbinphilip]

Would be really nice to have this as a feature. Especially at the rate at which amplify cli release cycle happen. While dealing with multiple projects with amplify, it'd be a real pain to go back and reinstall whenever you make the switch. And cli version migration isn't that an easy checkbox to tick.

Currently I'm able to work with local amplify package if at least one global cli version is installed already. Not sure of any caveats though.

[EdanKriss]

I agree with the use case, installing build tools globally is really not an acceptable practice, for obvious reasons.