putpaws 0.0.9 → 0.1.3

data/lib/putpaws/provision/resources/codebuild_project.rb

@@ -0,0 +1,107 @@
+require 'putpaws/provision/util'
+require 'putpaws/provision/resources/base'
+
+module Putpaws
+  module Provision
+    module Resources
+      class CodebuildProject < Base
+        # Derived from cpu_architecture; devops.environment_type / environment_image
+        # override the derivation (useful for staged arch migration).
+        ENVIRONMENT_TYPES = {
+          'ARM64' => 'ARM_CONTAINER',
+          'X86_64' => 'LINUX_CONTAINER',
+        }
+        DEFAULT_IMAGES = {
+          'ARM64' => 'aws/codebuild/amazonlinux-aarch64-standard:3.0',
+          'X86_64' => 'aws/codebuild/standard:7.0',
+        }
+
+        def name
+          config.build_project_name
+        end
+
+        def devops
+          config.devops_settings
+        end
+
+        def environment_type
+          devops[:environment_type] || ENVIRONMENT_TYPES.fetch(config.cpu_architecture)
+        end
+
+        def environment_image
+          devops[:environment_image] ||
+            (devops[:environment_images] || {})[config.cpu_architecture.to_sym] ||
+            DEFAULT_IMAGES.fetch(config.cpu_architecture)
+        end
+
+        def security_group_ids
+          ids = state.resources[:security_group_ids]
+          raise "security_group_ids not found in state. Run the service step first." if ids.nil? || ids.empty?
+          ids
+        end
+
+        def desired_params
+          {
+            name: name,
+            description: "Managed by putpaws for #{config.service_name}",
+            source: {
+              type: devops[:source_type] || 'GITHUB',
+              location: devops[:source_repository],
+              buildspec: devops[:buildspec] || 'buildspec.yml',
+            },
+            artifacts: {type: 'NO_ARTIFACTS'},
+            environment: {
+              type: environment_type,
+              image: environment_image,
+              compute_type: devops[:compute_type] || 'BUILD_GENERAL1_SMALL',
+              privileged_mode: devops.fetch(:privileged_mode, true),
+            },
+            service_role: config.roles[:codebuild_role_arn],
+            logs_config: {
+              cloud_watch_logs: {status: 'ENABLED', group_name: config.build_log_group}
+            },
+            # CI needs VPC access (Ex: db:migrate against RDS). Reuse the
+            # service security group so the build reaches whatever the app can.
+            vpc_config: {
+              vpc_id: config.base[:vpc_id],
+              subnets: config.base[:subnets],
+              security_group_ids: security_group_ids,
+            },
+            tags: [MANAGED_TAG],
+          }
+        end
+
+        def current
+          res = clients.codebuild.batch_get_projects(names: [name])
+          res.projects.first
+        end
+
+        def changed?(current)
+          current.source&.type != desired_params[:source][:type] ||
+            current.source&.location != desired_params[:source][:location] ||
+            current.source&.buildspec != desired_params[:source][:buildspec] ||
+            current.service_role != desired_params[:service_role] ||
+            current.environment&.type != desired_params[:environment][:type] ||
+            current.environment&.image != desired_params[:environment][:image] ||
+            current.environment&.compute_type != desired_params[:environment][:compute_type] ||
+            current.vpc_config&.subnets.to_a.sort != desired_params[:vpc_config][:subnets].sort ||
+            current.vpc_config&.security_group_ids.to_a.sort != desired_params[:vpc_config][:security_group_ids].sort
+        end
+
+        def create!
+          res = clients.codebuild.create_project(**desired_params)
+          {codebuild_project: res.project.name}
+        end
+
+        def update!(_current)
+          res = clients.codebuild.update_project(**desired_params)
+          {codebuild_project: res.project.name}
+        end
+
+        def outputs(current)
+          {codebuild_project: current.name}
+        end
+      end
+    end
+  end
+end

data/lib/putpaws/provision/resources/iam_role.rb

@@ -0,0 +1,89 @@
+require 'json'
+require 'digest'
+require 'putpaws/provision/resources/base'
+
+module Putpaws
+  module Provision
+    module Resources
+      # Registers an IAM role from a reviewed draft file under policies/.
+      # This runs only after the user approved the drafts explicitly
+      # (roles.approve_drafts in provision.json). The draft content is applied
+      # as-is, including any edits the user made.
+      class IamRole < Base
+        attr_reader :roles_key, :draft_file
+        def initialize(roles_key:, draft_file:, **args)
+          super(**args)
+          @roles_key = roles_key
+          @draft_file = draft_file
+        end
+
+        def draft
+          @draft ||= begin
+            path = config.policies_dir.join(draft_file)
+            raise "Role draft not found: #{path}. Please run `putpaws ready` first." unless path.exist?
+            JSON.parse(File.read(path), symbolize_names: true)
+          end
+        end
+
+        def name
+          draft[:SuggestedRoleName]
+        end
+
+        def policy_name
+          draft[:SuggestedPolicyName]
+        end
+
+        def digest
+          Digest::SHA256.hexdigest(JSON.generate(draft))
+        end
+
+        def digest_key
+          :"iam_#{roles_key}_digest"
+        end
+
+        def current
+          clients.iam.get_role(role_name: name).role
+        rescue Aws::IAM::Errors::NoSuchEntity, Aws::IAM::Errors::NoSuchEntityException
+          nil
+        end
+
+        # Re-applied only when the draft content changed since the last apply,
+        # so that manual changes on the AWS side are left alone otherwise.
+        def changed?(_current)
+          state.resources[digest_key] != digest
+        end
+
+        def create!
+          res = clients.iam.create_role(
+            role_name: name,
+            assume_role_policy_document: JSON.generate(draft[:AssumeRolePolicyDocument]),
+            tags: [MANAGED_TAG]
+          )
+          put_policy!
+          {roles_key => res.role.arn, digest_key => digest}
+        end
+
+        def update!(current)
+          clients.iam.update_assume_role_policy(
+            role_name: name,
+            policy_document: JSON.generate(draft[:AssumeRolePolicyDocument])
+          )
+          put_policy!
+          {roles_key => current.arn, digest_key => digest}
+        end
+
+        def outputs(current)
+          {roles_key => current.arn, digest_key => digest}
+        end
+
+        def put_policy!
+          clients.iam.put_role_policy(
+            role_name: name,
+            policy_name: policy_name,
+            policy_document: JSON.generate(draft[:PolicyDocument])
+          )
+        end
+      end
+    end
+  end
+end

data/lib/putpaws/provision/resources/log_group.rb

@@ -0,0 +1,50 @@
+require 'putpaws/provision/resources/base'
+
+module Putpaws
+  module Provision
+    module Resources
+      class LogGroup < Base
+        def initialize(log_group_name:, output_key:, **args)
+          super(**args)
+          @log_group_name = log_group_name
+          @output_key = output_key
+        end
+
+        def name
+          @log_group_name
+        end
+
+        def retention_in_days
+          (config.settings[:log_retention_days] || 30).to_i
+        end
+
+        def current
+          res = clients.logs.describe_log_groups(log_group_name_prefix: name)
+          res.log_groups.detect{|g| g.log_group_name == name}
+        end
+
+        def changed?(current)
+          current.retention_in_days != retention_in_days
+        end
+
+        def create!
+          clients.logs.create_log_group(
+            log_group_name: name,
+            tags: {MANAGED_TAG[:key] => MANAGED_TAG[:value]}
+          )
+          clients.logs.put_retention_policy(log_group_name: name, retention_in_days: retention_in_days)
+          {@output_key => name}
+        end
+
+        def update!(_current)
+          clients.logs.put_retention_policy(log_group_name: name, retention_in_days: retention_in_days)
+          {@output_key => name}
+        end
+
+        def outputs(_current)
+          {@output_key => name}
+        end
+      end
+    end
+  end
+end

data/lib/putpaws/provision/resources/security_group.rb

@@ -0,0 +1,72 @@
+require 'putpaws/provision/util'
+require 'putpaws/provision/resources/base'
+
+module Putpaws
+  module Provision
+    module Resources
+      # When base.security_group_ids is set, the existing security groups are
+      # used as-is (putpaws never touches their rules). Otherwise a new one is
+      # created with no ingress rules (egress open by default).
+      # Ingress for ALB etc. is out of scope: add manually or by another command.
+      class SecurityGroup < Base
+        def specified_ids
+          ids = Array(config.base[:security_group_ids])
+          # backward compatible with the singular key
+          ids = [config.base[:security_group_id]] if ids.empty?
+          ids.reject{|x| Util.blank?(x)}
+        end
+
+        def specified?
+          specified_ids.any?
+        end
+
+        def name
+          specified? ? "#{specified_ids.join(', ')} (existing)" : config.sg_name
+        end
+
+        def current
+          return current_specified if specified?
+          res = clients.ec2.describe_security_groups(filters: [
+            {name: 'group-name', values: [name]},
+            {name: 'vpc-id', values: [config.base[:vpc_id]]},
+          ])
+          res.security_groups.first
+        end
+
+        def current_specified
+          res = begin
+            clients.ec2.describe_security_groups(group_ids: specified_ids)
+          rescue Aws::EC2::Errors::InvalidGroupNotFound
+            raise "Specified security group not found: #{specified_ids.join(', ')}"
+          end
+          found = res.security_groups
+          missing = specified_ids - found.map(&:group_id)
+          raise "Specified security group not found: #{missing.join(', ')}" if missing.any?
+          wrong = found.reject{|sg| sg.vpc_id == config.base[:vpc_id]}
+          if wrong.any?
+            sg = wrong.first
+            raise "Security group #{sg.group_id} belongs to #{sg.vpc_id}, not #{config.base[:vpc_id]}"
+          end
+          found
+        end
+
+        def create!
+          res = clients.ec2.create_security_group(
+            group_name: name,
+            description: "Managed by putpaws for #{config.service_name}",
+            vpc_id: config.base[:vpc_id],
+            tag_specifications: [
+              {resource_type: 'security-group', tags: [MANAGED_TAG]}
+            ]
+          )
+          {security_group_ids: [res.group_id]}
+        end
+
+        def outputs(current)
+          ids = current.is_a?(Array) ? current.map(&:group_id) : [current.group_id]
+          {security_group_ids: ids}
+        end
+      end
+    end
+  end
+end

data/lib/putpaws/provision/resources/service.rb

@@ -0,0 +1,74 @@
+require 'putpaws/provision/resources/base'
+
+module Putpaws
+  module Provision
+    module Resources
+      class Service < Base
+        def name
+          config.service_name
+        end
+
+        def desired_count
+          (config.settings[:desired_count] || 1).to_i
+        end
+
+        def task_definition_family
+          config.service_task_definition_family
+        end
+
+        def security_group_ids
+          ids = state.resources[:security_group_ids]
+          raise "security_group_ids not found in state. Run the security group step first." if ids.nil? || ids.empty?
+          ids
+        end
+
+        def current
+          res = clients.ecs.describe_services(cluster: config.cluster_name, services: [name])
+          res.services.detect{|s| s.status == 'ACTIVE'}
+        rescue Aws::ECS::Errors::ClusterNotFoundException
+          # cluster not created yet (Ex: `ahead` on a fresh setup) -> no service either
+          nil
+        end
+
+        def changed?(current)
+          current_family = current.task_definition.to_s.split('/').last.to_s.split(':').first
+          current_family != task_definition_family || current.desired_count != desired_count
+        end
+
+        def create!
+          res = clients.ecs.create_service(
+            cluster: config.cluster_name,
+            service_name: name,
+            task_definition: task_definition_family,
+            desired_count: desired_count,
+            launch_type: 'FARGATE',
+            enable_execute_command: true,
+            network_configuration: {
+              awsvpc_configuration: {
+                subnets: config.base[:subnets],
+                security_groups: security_group_ids,
+                assign_public_ip: config.settings[:assign_public_ip] || 'DISABLED',
+              }
+            },
+            tags: [MANAGED_TAG]
+          )
+          {service_arn: res.service.service_arn, service_name: name}
+        end
+
+        def update!(_current)
+          res = clients.ecs.update_service(
+            cluster: config.cluster_name,
+            service: name,
+            task_definition: task_definition_family,
+            desired_count: desired_count
+          )
+          {service_arn: res.service.service_arn, service_name: name}
+        end
+
+        def outputs(current)
+          {service_arn: current.service_arn, service_name: name}
+        end
+      end
+    end
+  end
+end

data/lib/putpaws/provision/resources/task_definition.rb

@@ -0,0 +1,121 @@
+require 'erb'
+require 'json'
+require 'digest'
+require 'putpaws/provision/util'
+require 'putpaws/provision/resources/base'
+
+module Putpaws
+  module Provision
+    module Resources
+      class TaskDefinition < Base
+        # Variables exposed to taskdef ERB templates.
+        class TemplateContext
+          attr_reader :service_name, :region, :account_id,
+            :cpu, :memory, :container_port, :cpu_architecture,
+            :image, :nginx_image,
+            :log_group, :execution_role_arn, :task_role_arn,
+            :env_json, :secrets_json
+
+          def initialize(config)
+            settings = config.settings
+            @service_name = config.service_name
+            @region = config.region
+            @account_id = config.account_id
+            @cpu = settings[:cpu].to_s
+            @memory = settings[:memory].to_s
+            @container_port = (settings[:container_port] || 3000).to_i
+            @cpu_architecture = config.cpu_architecture
+            @image = config.ecr_image_uri
+            @nginx_image = settings[:nginx_image] || 'public.ecr.aws/nginx/nginx:stable'
+            @log_group = config.log_group
+            @execution_role_arn = config.roles[:task_execution_role_arn]
+            @task_role_arn = config.roles[:task_role_arn]
+            @env_json = JSON.generate(
+              (settings[:env] || {}).map{|k, v| {name: k.to_s, value: v.to_s}}
+            )
+            @secrets_json = JSON.generate(
+              config.resolved_secrets.map{|name, path|
+                {name: name, valueFrom: "arn:aws:ssm:#{config.region}:#{config.account_id}:parameter#{path}"}
+              }
+            )
+          end
+
+          def get_binding
+            binding
+          end
+        end
+
+        attr_reader :entry
+        def initialize(entry:, **args)
+          super(**args)
+          @entry = entry
+        end
+
+        def suffix
+          entry[:suffix]
+        end
+
+        def name
+          config.task_definition_family(suffix)
+        end
+
+        def desired_params
+          @desired_params ||= begin
+            template = File.read(config.preset.template_path(entry[:template]))
+            rendered = ERB.new(template, trim_mode: '-').result(TemplateContext.new(config).get_binding)
+            params = Util.deep_underscore_keys(JSON.parse(rendered))
+            params[:family] = name
+            params[:tags] = [MANAGED_TAG]
+            params
+          end
+        end
+
+        def digest
+          Digest::SHA256.hexdigest(JSON.generate(desired_params))
+        end
+
+        def digest_key
+          :"taskdef_#{suffix}_digest"
+        end
+
+        def current
+          clients.ecs.describe_task_definition(task_definition: name).task_definition
+        rescue Aws::ECS::Errors::ClientException, Aws::ECS::Errors::ClientError
+          nil
+        end
+
+        # AWS-side normalization makes a field-by-field diff noisy, so
+        # compare against the digest of the params we registered last time.
+        def changed?(_current)
+          state.resources[digest_key] != digest
+        end
+
+        def create!
+          register!
+        end
+
+        def update!(_current)
+          register!
+        end
+
+        def register!
+          res = clients.ecs.register_task_definition(**desired_params)
+          td = res.task_definition
+          {
+            :"taskdef_#{suffix}" => name,
+            :"taskdef_#{suffix}_arn" => td.task_definition_arn,
+            digest_key => digest,
+          }
+        end
+
+        def outputs(current)
+          {
+            :"taskdef_#{suffix}" => name,
+            :"taskdef_#{suffix}_arn" => current.task_definition_arn,
+            digest_key => digest,
+          }
+        end
+      end
+    end
+  end
+end