hecks 3.5.0 → 3.6.0

data/lib/hecks/projections/deploy/fargate/containers/routing.rb

@@ -0,0 +1,93 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        module Containers
+          # Reads the routes and the default container, and checks that the load balancer can reach
+          # every container with a port. Included into `Reading`, which supplies the structs.
+          module Routing
+            private
+
+            def default_name(settings, layout)
+              name = settings.fetch(:default_container, layout.domain.name).to_s
+              target = layout.all.find { |container| container.name == name }
+              unless target
+                raise ArgumentError,
+                      "default_container #{name.inspect} is not a container; have #{layout.all.map(&:name).join(", ")}"
+              end
+              return name if target.port
+
+              raise ArgumentError, "default_container #{name.inspect} has no port, so the listener cannot forward to it"
+            end
+
+            def routes(entries, layout)
+              counts = Hash.new(0)
+              Check.hashes!(entries, "routes", allowed: ROUTE_KEYS, required: [:container, :paths, :priority]).map do |entry|
+                container = entry.fetch(:container).to_s
+                counts[container] += 1
+                route(entry, container, counts[container], layout)
+              end
+            end
+
+            def route(entry, container, nth, layout)
+              target = layout.balanced.find { |candidate| candidate.name == container }
+              unless target
+                raise ArgumentError, "routes name container #{container.inspect}, which is not a container with a port"
+              end
+
+              suffix = nth == 1 ? "" : nth.to_s
+              Route.new(
+                id: Check.logical_id!(entry.fetch(:id, "ListenerRule#{Yaml.camel(container)}#{suffix}"), "routes id"),
+                container: container, priority: Check.integer!(entry.fetch(:priority), "routes priority", range: 1..50_000),
+                paths: route_paths(entry.fetch(:paths), container)
+              )
+            end
+
+            def route_paths(value, container)
+              paths = Check.strings!(value, "routes[#{container}] paths", min: 1, max: 5)
+              bad = paths.reject { |path| path.start_with?("/", "*") }
+              raise ArgumentError, "routes[#{container}] paths must start with / or *, got #{bad.join(", ")}" unless bad.empty?
+
+              paths
+            end
+
+            def check_unique!(layout)
+              naming_table(layout).merge(placement_table(layout)).each do |what, values|
+                repeated = values.tally.select { |_value, count| count > 1 }.keys
+                raise ArgumentError, "#{what} must be unique; repeated: #{repeated.join(", ")}" unless repeated.empty?
+              end
+            end
+
+            def naming_table(layout)
+              {
+                "container names"      => layout.all.map(&:name),
+                "repository names"     => layout.all.map(&:repository_name),
+                "image tag parameters" => layout.all.map(&:tag_parameter),
+                "repository ids"       => layout.all.map(&:repository_id)
+              }
+            end
+
+            def placement_table(layout)
+              {
+                "target group ids" => layout.balanced.map(&:target_group_id),
+                "container ports"  => layout.balanced.map(&:port),
+                "route ids"        => layout.routes.map(&:id),
+                "route priorities" => layout.routes.map(&:priority)
+              }
+            end
+
+            def check_reachable!(layout)
+              routed = layout.routes.map(&:container) + [layout.default_container]
+              stranded = layout.balanced.map(&:name) - routed
+              return if stranded.empty?
+
+              raise ArgumentError, "container(s) #{stranded.join(", ")} have a port but no route and are not the " \
+                                   "default_container, so the load balancer never reaches them; " \
+                                   "add a routes entry or drop the port"
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/containers.rb

@@ -1,5 +1,8 @@
 require_relative "check"
 require_relative "yaml"
+require_relative "containers/reading"
+require_relative "containers/rendering"
+require_relative "containers/definition_lines"
 
 module Hecks
   module Projections
@@ -8,8 +11,6 @@ module Hecks
         # The containers of one Fargate task and how the load balancer reaches them.
         # The domain container (`rust/host`) is always present; more are added via `containers`.
         module Containers
-          module_function
-
           Container = Struct.new(
             :name, :repository_id, :repository_name, :tag_parameter, :port, :health_path,
             :env, :secrets, :cpu, :memory, :essential, :target_group_id,
@@ -37,299 +38,22 @@ module Hecks
           ].freeze
           ROUTE_KEYS = [:container, :paths, :priority, :id].freeze
 
+          extend Reading
+          extend Rendering
+          extend DefinitionLines
+
+          module_function
+
           # Reads the container-related settings into a `Layout`.
           def normalize(settings, infra_name:, port:, ids:)
             domain = domain_container(settings[:domain_container], infra_name: infra_name, port: port, ids: ids)
-            extras = Check.hashes!(settings.fetch(:containers, []), "containers", allowed:  CONTAINER_KEYS,
-                                                                                  required: [:name, :repository])
-                          .map do |entry|
-              extra_container(entry)
-            end
-            layout = Layout.new(domain: domain, extras: extras, routes: [], default_container: domain.name)
+            layout = Layout.new(domain: domain, extras: extra_containers(settings), routes: [], default_container: domain.name)
             layout.default_container = default_name(settings, layout)
             layout.routes = routes(settings.fetch(:routes, []), layout)
             check_unique!(layout)
             check_reachable!(layout)
             layout
           end
-
-          # Renders the ECR repository of every added container.
-          def repositories_yaml(layout)
-            layout.extras.map do |container|
-              <<~REPOSITORY.rstrip
-                #{container.repository_id}:
-                  Type: AWS::ECR::Repository
-                  Properties:
-                    RepositoryName: #{container.repository_name}
-                    ImageScanningConfiguration:
-                      ScanOnPush: true
-              REPOSITORY
-            end.join("\n\n")
-          end
-
-          # Renders the image-tag parameter of every added container.
-          def parameters_yaml(layout)
-            layout.extras.map do |container|
-              <<~PARAMETER
-                #{container.tag_parameter}:
-                  Type: String
-                  Default: latest
-                  Description: ECR image tag the #{container.name} container pulls.
-              PARAMETER
-            end.join
-          end
-
-          # Renders the added containers as `ContainerDefinitions` list entries.
-          def definitions_yaml(layout, log_group_id)
-            layout.extras.map { |container| definition_yaml(container, log_group_id) }.join("\n\n")
-          end
-
-          # Renders the target group of every added container.
-          def target_groups_yaml(layout, vpc_ref, deregistration_delay)
-            layout.extras.select(&:port).map do |container|
-              [
-                "#{container.target_group_id}:",
-                "  Type: AWS::ElasticLoadBalancingV2::TargetGroup",
-                "  Properties:",
-                "    TargetType: ip",
-                "    Port: #{container.port}",
-                "    Protocol: HTTP",
-                "    VpcId: #{vpc_ref}",
-                "    HealthCheckPath: #{container.health_path}",
-                "    HealthCheckPort: \"#{container.port}\"",
-                target_group_attributes_yaml(deregistration_delay).gsub(/^/, "    ")
-              ].join("\n").rstrip
-            end.join("\n\n")
-          end
-
-          # Renders the `TargetGroupAttributes` property for a drain delay.
-          def target_group_attributes_yaml(deregistration_delay)
-            return "" unless deregistration_delay
-
-            <<~ATTRIBUTES
-              TargetGroupAttributes:
-                - Key: deregistration_delay.timeout_seconds
-                  Value: "#{deregistration_delay}"
-            ATTRIBUTES
-          end
-
-          # Renders one listener rule per route.
-          def listener_rules_yaml(layout, listener_id)
-            layout.routes.map do |route|
-              target = layout.all.find { |container| container.name == route.container }
-              <<~RULE.rstrip
-                #{route.id}:
-                  Type: AWS::ElasticLoadBalancingV2::ListenerRule
-                  Properties:
-                    ListenerArn: !Ref #{listener_id}
-                    Priority: #{route.priority}
-                    Conditions:
-                      - Field: path-pattern
-                        Values: #{Yaml.flow_list(route.paths)}
-                    Actions:
-                      - Type: forward
-                        TargetGroupArn: !Ref #{target.target_group_id}
-              RULE
-            end.join("\n\n")
-          end
-
-          # Renders the service's `LoadBalancers` entries for the added containers.
-          def load_balancers_yaml(layout)
-            layout.extras.select(&:port).map do |container|
-              <<~ENTRY
-                - ContainerName: #{container.name}
-                  ContainerPort: #{container.port}
-                  TargetGroupArn: !Ref #{container.target_group_id}
-              ENTRY
-            end.join
-          end
-
-          # Writes the `DependsOn` value that holds the service until the listener and its
-          # rules exist.
-          def depends_on(layout, listener_id)
-            return listener_id if layout.routes.empty?
-
-            Yaml.flow_list([listener_id, *layout.routes.map(&:id)])
-          end
-
-          # Finds the first and last container port the load balancer must reach.
-          def port_range(layout)
-            ports = layout.balanced.map(&:port)
-            ports.min..ports.max
-          end
-
-          def domain_container(setting, infra_name:, port:, ids:)
-            given = setting ? Check.hash!(setting, "domain_container", allowed: DOMAIN_KEYS) : {}
-            name = Check.resource_name!(given.fetch(:name, infra_name), "domain_container name")
-            repository = Check.resource_name!(given.fetch(:repository, infra_name), "domain_container repository")
-            Container.new(
-              name: name, repository_id: ids.fetch(:ecr_repository), repository_name: repository,
-              tag_parameter: Check.logical_id!(given.fetch(:image_tag_parameter, "ImageTag"),
-                                               "domain_container image_tag_parameter"),
-              port: port, health_path: health_path(given, "domain_container"), env: {}, secrets: {},
-              essential: given.key?(:essential) ? Check.boolean!(given[:essential], "domain_container essential") : nil,
-              target_group_id: ids.fetch(:target_group)
-            )
-          end
-          private_class_method :domain_container
-
-          def extra_container(entry)
-            name = Check.resource_name!(entry.fetch(:name), "containers name")
-            where = "containers[#{name}]"
-            base = Yaml.camel(name)
-            Container.new(
-              name: name, repository_name: Check.resource_name!(entry.fetch(:repository), "#{where} repository"),
-              repository_id: Check.logical_id!(entry.fetch(:repository_id, "#{base}Repository"), "#{where} repository_id"),
-              target_group_id: Check.logical_id!(entry.fetch(:target_group_id, "#{base}TargetGroup"), "#{where} target_group_id"),
-              tag_parameter: Check.logical_id!(entry.fetch(:image_tag_parameter, "#{base}ImageTag"),
-                                               "#{where} image_tag_parameter"),
-              port: optional_port(entry, where), health_path: health_path(entry, where),
-              env: Check.map!(entry.fetch(:env, {}), "#{where} env"),
-              secrets: Check.map!(entry.fetch(:secrets, {}), "#{where} secrets"),
-              cpu: optional_size(entry, :cpu, where), memory: optional_size(entry, :memory, where),
-              essential: Check.boolean!(entry.fetch(:essential, true), "#{where} essential")
-            )
-          end
-          private_class_method :extra_container
-
-          def optional_port(entry, where)
-            entry.key?(:port) ? Check.integer!(entry[:port], "#{where} port", range: 1..65_535) : nil
-          end
-          private_class_method :optional_port
-
-          def optional_size(entry, key, where)
-            entry.key?(key) ? Check.integer!(entry[key], "#{where} #{key}", range: 1..1_000_000) : nil
-          end
-          private_class_method :optional_size
-
-          def health_path(entry, where)
-            path = entry.fetch(:health_path, "/").to_s
-            raise ArgumentError, "#{where} health_path must start with /, got #{path.inspect}" unless path.start_with?("/")
-
-            path
-          end
-          private_class_method :health_path
-
-          def default_name(settings, layout)
-            name = settings.fetch(:default_container, layout.domain.name).to_s
-            target = layout.all.find { |container| container.name == name }
-            unless target
-              raise ArgumentError,
-                    "default_container #{name.inspect} is not a container; have #{layout.all.map(&:name).join(', ')}"
-            end
-            unless target.port
-              raise ArgumentError,
-                    "default_container #{name.inspect} has no port, so the listener cannot forward to it"
-            end
-
-            name
-          end
-          private_class_method :default_name
-
-          def routes(entries, layout)
-            counts = Hash.new(0)
-            Check.hashes!(entries, "routes", allowed: ROUTE_KEYS, required: [:container, :paths, :priority]).map do |entry|
-              container = entry.fetch(:container).to_s
-              counts[container] += 1
-              route(entry, container, counts[container], layout)
-            end
-          end
-          private_class_method :routes
-
-          def route(entry, container, nth, layout)
-            target = layout.balanced.find { |candidate| candidate.name == container }
-            raise ArgumentError, "routes name container #{container.inspect}, which is not a container with a port" unless target
-
-            suffix = nth == 1 ? "" : nth.to_s
-            Route.new(
-              id: Check.logical_id!(entry.fetch(:id, "ListenerRule#{Yaml.camel(container)}#{suffix}"), "routes id"),
-              container: container, priority: Check.integer!(entry.fetch(:priority), "routes priority", range: 1..50_000),
-              paths: route_paths(entry.fetch(:paths), container)
-            )
-          end
-          private_class_method :route
-
-          def route_paths(value, container)
-            paths = Check.strings!(value, "routes[#{container}] paths", min: 1, max: 5)
-            bad = paths.reject { |path| path.start_with?("/", "*") }
-            raise ArgumentError, "routes[#{container}] paths must start with / or *, got #{bad.join(', ')}" unless bad.empty?
-
-            paths
-          end
-          private_class_method :route_paths
-
-          def check_unique!(layout)
-            {
-              "container names"      => layout.all.map(&:name),
-              "repository names"     => layout.all.map(&:repository_name),
-              "image tag parameters" => layout.all.map(&:tag_parameter),
-              "repository ids"       => layout.all.map(&:repository_id),
-              "target group ids"     => layout.balanced.map(&:target_group_id),
-              "container ports"      => layout.balanced.map(&:port),
-              "route ids"            => layout.routes.map(&:id),
-              "route priorities"     => layout.routes.map(&:priority)
-            }.each do |what, values|
-              repeated = values.tally.select { |_value, count| count > 1 }.keys
-              raise ArgumentError, "#{what} must be unique; repeated: #{repeated.join(', ')}" unless repeated.empty?
-            end
-          end
-          private_class_method :check_unique!
-
-          def check_reachable!(layout)
-            routed = layout.routes.map(&:container) + [layout.default_container]
-            stranded = layout.balanced.map(&:name) - routed
-            return if stranded.empty?
-
-            raise ArgumentError, "container(s) #{stranded.join(', ')} have a port but no route and are not the " \
-                                 "default_container, so the load balancer never reaches them; add a routes entry or drop the port"
-          end
-          private_class_method :check_reachable!
-
-          # Renders one added container as a `ContainerDefinitions` entry.
-          def definition_yaml(container, log_group_id)
-            lines = [
-              "- Name: #{container.name}",
-              "  Image: !Sub \"${#{container.repository_id}.RepositoryUri}:${#{container.tag_parameter}}\"",
-              "  Essential: #{container.essential}"
-            ]
-            lines << "  Cpu: #{container.cpu}" if container.cpu
-            lines << "  Memory: #{container.memory}" if container.memory
-            lines.concat(port_lines(container), log_lines(container, log_group_id), env_lines(container), secret_lines(container))
-            lines.join("\n")
-          end
-          private_class_method :definition_yaml
-
-          def port_lines(container)
-            container.port ? ["  PortMappings:", "    - ContainerPort: #{container.port}"] : []
-          end
-          private_class_method :port_lines
-
-          def log_lines(container, log_group_id)
-            [
-              "  LogConfiguration:", "    LogDriver: awslogs", "    Options:",
-              "      awslogs-group: !Ref #{log_group_id}", "      awslogs-region: !Ref AWS::Region",
-              "      awslogs-stream-prefix: #{container.name}"
-            ]
-          end
-          private_class_method :log_lines
-
-          def env_lines(container)
-            return [] if container.env.empty?
-
-            ["  Environment:"] + container.env.flat_map do |name, value|
-              ["    - Name: #{name}", "      Value: #{Yaml.string(value)}"]
-            end
-          end
-          private_class_method :env_lines
-
-          def secret_lines(container)
-            return [] if container.secrets.empty?
-
-            ["  Secrets:"] + container.secrets.flat_map do |name, value|
-              ["    - Name: #{name}", "      ValueFrom: #{Yaml.string(value)}"]
-            end
-          end
-          private_class_method :secret_lines
         end
       end
     end

data/lib/hecks/projections/deploy/fargate/extras/reading.rb

@@ -0,0 +1,90 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        module Extras
+          # Reads and checks the resource-declaring settings of a world. Extended onto `Extras`,
+          # which supplies the key lists.
+          module Reading
+            private
+
+            def buckets(entries)
+              Check.hashes!(entries, "buckets", allowed: BUCKET_KEYS, required: [:id, :name_prefix]).map do |entry|
+                {
+                  id:           Check.logical_id!(entry[:id], "buckets id"),
+                  name_prefix:  Check.resource_name!(entry[:name_prefix], "buckets name_prefix").downcase,
+                  public_read:  Check.boolean!(entry.fetch(:public_read, false), "buckets public_read"),
+                  cors_origins: Check.strings!(entry.fetch(:cors_origins, []), "buckets cors_origins")
+                }
+              end
+            end
+
+            def secrets(entries)
+              Check.hashes!(entries, "generated_secrets", allowed: SECRET_KEYS, required: [:id, :name]).map do |entry|
+                {
+                  id:          Check.logical_id!(entry[:id], "generated_secrets id"),
+                  name:        Check.resource_name!(entry[:name], "generated_secrets name"),
+                  description: entry[:description]&.to_s,
+                  key:         Check.resource_name!(entry.fetch(:key, "secret"), "generated_secrets key"),
+                  length:      Check.integer!(entry.fetch(:length, 64), "generated_secrets length", range: 8..512)
+                }
+              end
+            end
+
+            def session_secret(value)
+              return {} if value.nil?
+
+              given = Check.hash!(value, "session_secret", allowed: [:name, :description])
+              { name:        given[:name] && Check.resource_name!(given[:name], "session_secret name"),
+                description: given[:description]&.to_s }.compact
+            end
+
+            def policies(entries, where)
+              Check.hashes!(entries, where, allowed: POLICY_KEYS, required: [:name, :statements]).map do |entry|
+                statements = Check.hashes!(entry[:statements], "#{where}[#{entry[:name]}] statements",
+                                           allowed: STATEMENT_KEYS, required: [:actions, :resources])
+                { name:       Check.logical_id!(entry[:name], "#{where} name"),
+                  statements: statements.map { |statement| policy_statement(statement, where) } }
+              end
+            end
+
+            def policy_statement(statement, where)
+              {
+                effect:    Check.one_of!(statement.fetch(:effect, "Allow"), "#{where} effect", %w[Allow Deny]),
+                actions:   Check.strings!(statement[:actions], "#{where} actions", min: 1),
+                resources: Check.strings!(statement[:resources], "#{where} resources", min: 1)
+              }
+            end
+
+            def parameters(map)
+              raise ArgumentError, "parameters must be a hash of name to settings, got #{map.inspect}" unless map.is_a?(Hash)
+
+              map.to_h do |name, entry|
+                key = Check.logical_id!(name, "parameters name")
+                given = Check.hash!(entry, "parameters.#{key}", allowed: PARAMETER_KEYS, required: [:type])
+                check_parameter_type!(key, given)
+                [key, given.merge(type: given[:type].to_s, no_echo: given[:no_echo] ? true : false)]
+              end
+            end
+
+            def check_parameter_type!(key, given)
+              return if PARAMETER_TYPE.match?(given[:type].to_s)
+
+              raise ArgumentError, "parameters.#{key} type #{given[:type].inspect} is not a CloudFormation parameter type"
+            end
+
+            def outputs(map)
+              raise ArgumentError, "outputs must be a hash of name to value, got #{map.inspect}" unless map.is_a?(Hash)
+
+              map.to_h do |name, value|
+                raise ArgumentError, "outputs.#{name} needs a value" if value.nil?
+
+                [Check.logical_id!(name, "outputs name"), value]
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/deploy/fargate/extras/rendering.rb

@@ -0,0 +1,81 @@
+module Hecks
+  module Projections
+    module Deploy
+      module Fargate
+        module Extras
+          # Renders the buckets, generated secrets and IAM policies of a world. Extended onto
+          # `Extras`.
+          module Rendering
+            private
+
+            def bucket_blocks(bucket)
+              blocks = [bucket_yaml(bucket)]
+              blocks << bucket_policy_yaml(bucket).rstrip if bucket[:public_read]
+              blocks
+            end
+
+            def bucket_yaml(bucket)
+              lines = ["#{bucket[:id]}:", "  Type: AWS::S3::Bucket", "  Properties:",
+                       "    BucketName: !Sub \"#{bucket[:name_prefix]}-${AWS::AccountId}\""]
+              lines.concat(public_access_lines) if bucket[:public_read]
+              lines.concat(cors_lines(bucket[:cors_origins])) unless bucket[:cors_origins].empty?
+              lines.join("\n")
+            end
+
+            def public_access_lines
+              ["    PublicAccessBlockConfiguration:", "      BlockPublicAcls: false", "      BlockPublicPolicy: false",
+               "      IgnorePublicAcls: false", "      RestrictPublicBuckets: false"]
+            end
+
+            def cors_lines(origins)
+              ["    CorsConfiguration:", "      CorsRules:", "        - AllowedOrigins: #{Yaml.flow_list(origins)}",
+               "          AllowedMethods: [GET]", "          AllowedHeaders: [\"*\"]"]
+            end
+
+            def bucket_policy_yaml(bucket)
+              <<~POLICY
+                #{bucket[:id]}Policy:
+                  Type: AWS::S3::BucketPolicy
+                  Properties:
+                    Bucket: !Ref #{bucket[:id]}
+                    PolicyDocument:
+                      Version: "2012-10-17"
+                      Statement:
+                        - Effect: Allow
+                          Principal: "*"
+                          Action: s3:GetObject
+                          Resource: !Sub "${#{bucket[:id]}.Arn}/*"
+              POLICY
+            end
+
+            def secret_yaml(secret)
+              lines = ["#{secret[:id]}:", "  Type: AWS::SecretsManager::Secret", "  Properties:", "    Name: #{secret[:name]}"]
+              lines << "    Description: #{Yaml.string(secret[:description])}" if secret[:description]
+              lines.push("    GenerateSecretString:", "      SecretStringTemplate: '{}'",
+                         "      GenerateStringKey: #{secret[:key]}", "      PasswordLength: #{secret[:length]}",
+                         "      ExcludePunctuation: true")
+              lines.join("\n")
+            end
+
+            def policy_yaml(policy)
+              lines = ["- PolicyName: #{policy[:name]}", "  PolicyDocument:", "    Version: '2012-10-17'", "    Statement:"]
+              policy[:statements].each do |statement|
+                lines << "      - Effect: #{statement[:effect]}"
+                lines.concat(statement_list("Action", statement[:actions]))
+                lines.concat(statement_list("Resource", statement[:resources].map { |resource| Yaml.string(resource) }))
+              end
+              "#{lines.join("\n")}\n"
+            end
+
+            # One entry is written as a scalar, the form IAM policies usually take; more are a list.
+            def statement_list(key, values)
+              return ["        #{key}: #{values.first}"] if values.one?
+
+              ["        #{key}:"] + values.map { |value| "          - #{value}" }
+            end
+          end
+        end
+      end
+    end
+  end
+end