@composurecdk/ec2 0.6.0 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +121 -0
- package/dist/commonjs/index.d.ts +14 -0
- package/dist/commonjs/index.d.ts.map +1 -0
- package/dist/commonjs/index.js +22 -0
- package/dist/commonjs/index.js.map +1 -0
- package/dist/commonjs/instance-alarm-config.d.ts.map +1 -0
- package/dist/commonjs/instance-alarm-config.js +3 -0
- package/dist/commonjs/instance-alarm-config.js.map +1 -0
- package/dist/commonjs/instance-alarm-defaults.d.ts.map +1 -0
- package/dist/commonjs/instance-alarm-defaults.js +65 -0
- package/dist/commonjs/instance-alarm-defaults.js.map +1 -0
- package/dist/commonjs/instance-alarms.d.ts.map +1 -0
- package/dist/commonjs/instance-alarms.js +132 -0
- package/dist/commonjs/instance-alarms.js.map +1 -0
- package/dist/{instance-builder.d.ts → commonjs/instance-builder.d.ts} +44 -6
- package/dist/commonjs/instance-builder.d.ts.map +1 -0
- package/dist/commonjs/instance-builder.js +135 -0
- package/dist/commonjs/instance-builder.js.map +1 -0
- package/dist/commonjs/instance-defaults.d.ts.map +1 -0
- package/dist/commonjs/instance-defaults.js +62 -0
- package/dist/commonjs/instance-defaults.js.map +1 -0
- package/dist/commonjs/instance-volume-attachment-config.d.ts +34 -0
- package/dist/commonjs/instance-volume-attachment-config.d.ts.map +1 -0
- package/dist/commonjs/instance-volume-attachment-config.js +3 -0
- package/dist/commonjs/instance-volume-attachment-config.js.map +1 -0
- package/dist/commonjs/instance-volume-attachment-defaults.d.ts +14 -0
- package/dist/commonjs/instance-volume-attachment-defaults.d.ts.map +1 -0
- package/dist/commonjs/instance-volume-attachment-defaults.js +27 -0
- package/dist/commonjs/instance-volume-attachment-defaults.js.map +1 -0
- package/dist/commonjs/instance-volume-attachments.d.ts +59 -0
- package/dist/commonjs/instance-volume-attachments.d.ts.map +1 -0
- package/dist/commonjs/instance-volume-attachments.js +107 -0
- package/dist/commonjs/instance-volume-attachments.js.map +1 -0
- package/dist/commonjs/package.json +3 -0
- package/dist/commonjs/volume-alarm-config.d.ts +35 -0
- package/dist/commonjs/volume-alarm-config.d.ts.map +1 -0
- package/dist/commonjs/volume-alarm-config.js +3 -0
- package/dist/commonjs/volume-alarm-config.js.map +1 -0
- package/dist/commonjs/volume-alarm-defaults.d.ts +17 -0
- package/dist/commonjs/volume-alarm-defaults.d.ts.map +1 -0
- package/dist/commonjs/volume-alarm-defaults.js +30 -0
- package/dist/commonjs/volume-alarm-defaults.js.map +1 -0
- package/dist/commonjs/volume-alarms.d.ts +29 -0
- package/dist/commonjs/volume-alarms.d.ts.map +1 -0
- package/dist/commonjs/volume-alarms.js +92 -0
- package/dist/commonjs/volume-alarms.js.map +1 -0
- package/dist/commonjs/volume-builder.d.ts +171 -0
- package/dist/commonjs/volume-builder.d.ts.map +1 -0
- package/dist/commonjs/volume-builder.js +98 -0
- package/dist/commonjs/volume-builder.js.map +1 -0
- package/dist/commonjs/volume-defaults.d.ts +15 -0
- package/dist/commonjs/volume-defaults.d.ts.map +1 -0
- package/dist/commonjs/volume-defaults.js +50 -0
- package/dist/commonjs/volume-defaults.js.map +1 -0
- package/dist/{vpc-builder.d.ts → commonjs/vpc-builder.d.ts} +3 -2
- package/dist/commonjs/vpc-builder.d.ts.map +1 -0
- package/dist/commonjs/vpc-builder.js +82 -0
- package/dist/commonjs/vpc-builder.js.map +1 -0
- package/dist/commonjs/vpc-defaults.d.ts.map +1 -0
- package/dist/commonjs/vpc-defaults.js +58 -0
- package/dist/commonjs/vpc-defaults.js.map +1 -0
- package/dist/esm/index.d.ts +14 -0
- package/dist/esm/index.d.ts.map +1 -0
- package/dist/esm/index.js +10 -0
- package/dist/esm/index.js.map +1 -0
- package/dist/esm/instance-alarm-config.d.ts +62 -0
- package/dist/esm/instance-alarm-config.d.ts.map +1 -0
- package/dist/esm/instance-alarm-config.js.map +1 -0
- package/dist/esm/instance-alarm-defaults.d.ts +20 -0
- package/dist/esm/instance-alarm-defaults.d.ts.map +1 -0
- package/dist/esm/instance-alarm-defaults.js.map +1 -0
- package/dist/esm/instance-alarms.d.ts +28 -0
- package/dist/esm/instance-alarms.d.ts.map +1 -0
- package/dist/esm/instance-alarms.js.map +1 -0
- package/dist/esm/instance-builder.d.ts +223 -0
- package/dist/esm/instance-builder.d.ts.map +1 -0
- package/dist/{instance-builder.js → esm/instance-builder.js} +49 -4
- package/dist/esm/instance-builder.js.map +1 -0
- package/dist/esm/instance-defaults.d.ts +14 -0
- package/dist/esm/instance-defaults.d.ts.map +1 -0
- package/dist/esm/instance-defaults.js.map +1 -0
- package/dist/esm/instance-volume-attachment-config.d.ts +34 -0
- package/dist/esm/instance-volume-attachment-config.d.ts.map +1 -0
- package/dist/esm/instance-volume-attachment-config.js +2 -0
- package/dist/esm/instance-volume-attachment-config.js.map +1 -0
- package/dist/esm/instance-volume-attachment-defaults.d.ts +14 -0
- package/dist/esm/instance-volume-attachment-defaults.d.ts.map +1 -0
- package/dist/esm/instance-volume-attachment-defaults.js +24 -0
- package/dist/esm/instance-volume-attachment-defaults.js.map +1 -0
- package/dist/esm/instance-volume-attachments.d.ts +59 -0
- package/dist/esm/instance-volume-attachments.d.ts.map +1 -0
- package/dist/esm/instance-volume-attachments.js +104 -0
- package/dist/esm/instance-volume-attachments.js.map +1 -0
- package/dist/esm/package.json +3 -0
- package/dist/esm/volume-alarm-config.d.ts +35 -0
- package/dist/esm/volume-alarm-config.d.ts.map +1 -0
- package/dist/esm/volume-alarm-config.js +2 -0
- package/dist/esm/volume-alarm-config.js.map +1 -0
- package/dist/esm/volume-alarm-defaults.d.ts +17 -0
- package/dist/esm/volume-alarm-defaults.d.ts.map +1 -0
- package/dist/esm/volume-alarm-defaults.js +27 -0
- package/dist/esm/volume-alarm-defaults.js.map +1 -0
- package/dist/esm/volume-alarms.d.ts +29 -0
- package/dist/esm/volume-alarms.d.ts.map +1 -0
- package/dist/esm/volume-alarms.js +88 -0
- package/dist/esm/volume-alarms.js.map +1 -0
- package/dist/esm/volume-builder.d.ts +171 -0
- package/dist/esm/volume-builder.d.ts.map +1 -0
- package/dist/esm/volume-builder.js +95 -0
- package/dist/esm/volume-builder.js.map +1 -0
- package/dist/esm/volume-defaults.d.ts +15 -0
- package/dist/esm/volume-defaults.d.ts.map +1 -0
- package/dist/esm/volume-defaults.js +47 -0
- package/dist/esm/volume-defaults.js.map +1 -0
- package/dist/esm/vpc-builder.d.ts +110 -0
- package/dist/esm/vpc-builder.d.ts.map +1 -0
- package/dist/{vpc-builder.js → esm/vpc-builder.js} +2 -2
- package/dist/esm/vpc-builder.js.map +1 -0
- package/dist/esm/vpc-defaults.d.ts +15 -0
- package/dist/esm/vpc-defaults.d.ts.map +1 -0
- package/dist/esm/vpc-defaults.js.map +1 -0
- package/package.json +36 -17
- package/dist/index.d.ts +0 -7
- package/dist/index.d.ts.map +0 -1
- package/dist/index.js +0 -6
- package/dist/index.js.map +0 -1
- package/dist/instance-alarm-config.d.ts.map +0 -1
- package/dist/instance-alarm-config.js.map +0 -1
- package/dist/instance-alarm-defaults.d.ts.map +0 -1
- package/dist/instance-alarm-defaults.js.map +0 -1
- package/dist/instance-alarms.d.ts.map +0 -1
- package/dist/instance-alarms.js.map +0 -1
- package/dist/instance-builder.d.ts.map +0 -1
- package/dist/instance-builder.js.map +0 -1
- package/dist/instance-defaults.d.ts.map +0 -1
- package/dist/instance-defaults.js.map +0 -1
- package/dist/vpc-builder.d.ts.map +0 -1
- package/dist/vpc-builder.js.map +0 -1
- package/dist/vpc-defaults.d.ts.map +0 -1
- package/dist/vpc-defaults.js.map +0 -1
- /package/dist/{instance-alarm-config.d.ts → commonjs/instance-alarm-config.d.ts} +0 -0
- /package/dist/{instance-alarm-defaults.d.ts → commonjs/instance-alarm-defaults.d.ts} +0 -0
- /package/dist/{instance-alarms.d.ts → commonjs/instance-alarms.d.ts} +0 -0
- /package/dist/{instance-defaults.d.ts → commonjs/instance-defaults.d.ts} +0 -0
- /package/dist/{vpc-defaults.d.ts → commonjs/vpc-defaults.d.ts} +0 -0
- /package/dist/{instance-alarm-config.js → esm/instance-alarm-config.js} +0 -0
- /package/dist/{instance-alarm-defaults.js → esm/instance-alarm-defaults.js} +0 -0
- /package/dist/{instance-alarms.js → esm/instance-alarms.js} +0 -0
- /package/dist/{instance-defaults.js → esm/instance-defaults.js} +0 -0
- /package/dist/{vpc-defaults.js → esm/vpc-defaults.js} +0 -0
|
@@ -0,0 +1,171 @@
|
|
|
1
|
+
import { type Alarm } from "aws-cdk-lib/aws-cloudwatch";
|
|
2
|
+
import { Volume, type VolumeProps } from "aws-cdk-lib/aws-ec2";
|
|
3
|
+
import { type IKey } from "aws-cdk-lib/aws-kms";
|
|
4
|
+
import { type IConstruct } from "constructs";
|
|
5
|
+
import { COPY_STATE, type Lifecycle, type Resolvable } from "@composurecdk/core";
|
|
6
|
+
import { type ITaggedBuilder } from "@composurecdk/cloudformation";
|
|
7
|
+
import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
|
|
8
|
+
import type { VolumeAlarmConfig } from "./volume-alarm-config.js";
|
|
9
|
+
/**
|
|
10
|
+
* Configuration properties for the EBS volume builder.
|
|
11
|
+
*
|
|
12
|
+
* Extends the CDK {@link VolumeProps} but lifts the cross-component-wiring
|
|
13
|
+
* props to {@link Resolvable} so they can be supplied as either concrete
|
|
14
|
+
* values or {@link Ref}s to sibling components in a {@link compose}d system:
|
|
15
|
+
*
|
|
16
|
+
* - `availabilityZone` is supplied via the dedicated
|
|
17
|
+
* {@link IVolumeBuilder.availabilityZone | .availabilityZone()} method
|
|
18
|
+
* so it can be wired from a sibling `VpcBuilder`.
|
|
19
|
+
* - `encryptionKey` is exposed on the builder as a `Resolvable<IKey>`
|
|
20
|
+
* setter so a sibling KMS key builder can supply a CMK.
|
|
21
|
+
*
|
|
22
|
+
* Other props (`size`, `volumeType`, `iops`, `throughput`, `enableMultiAttach`,
|
|
23
|
+
* `autoEnableIo`, `removalPolicy`, etc.) are passed through with their CDK
|
|
24
|
+
* types unchanged because they are almost always constructed inline rather
|
|
25
|
+
* than referenced from another component.
|
|
26
|
+
*/
|
|
27
|
+
export interface VolumeBuilderProps extends Omit<VolumeProps, "availabilityZone" | "encryptionKey"> {
|
|
28
|
+
/**
|
|
29
|
+
* Customer-managed KMS key (CMK) used to encrypt the volume.
|
|
30
|
+
*
|
|
31
|
+
* Accepts a concrete {@link IKey} or a {@link Ref} that resolves to one
|
|
32
|
+
* at build time (e.g. a sibling key builder in the same composed system).
|
|
33
|
+
*
|
|
34
|
+
* @default - the account's default EBS KMS key, applied because
|
|
35
|
+
* `encrypted: true` is set in {@link VOLUME_DEFAULTS}.
|
|
36
|
+
*
|
|
37
|
+
* @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_protect_data_rest_encrypt.html
|
|
38
|
+
*/
|
|
39
|
+
encryptionKey?: Resolvable<IKey>;
|
|
40
|
+
/**
|
|
41
|
+
* Configuration for AWS-recommended CloudWatch alarms.
|
|
42
|
+
*
|
|
43
|
+
* By default, the builder creates recommended alarms with sensible
|
|
44
|
+
* thresholds for every applicable metric. Individual alarms can be
|
|
45
|
+
* customized or disabled. Set to `false` to disable all alarms.
|
|
46
|
+
*
|
|
47
|
+
* No alarm actions are configured by default since notification methods
|
|
48
|
+
* are user-specific. Access alarms from the build result or use an
|
|
49
|
+
* `afterBuild` hook to apply actions.
|
|
50
|
+
*
|
|
51
|
+
* Contextual alarms (`burstBalance`) are only created when the
|
|
52
|
+
* corresponding volume configuration is present — e.g., a burstable
|
|
53
|
+
* `gp2`/`st1`/`sc1` volume type.
|
|
54
|
+
*
|
|
55
|
+
* @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#EBS
|
|
56
|
+
*/
|
|
57
|
+
recommendedAlarms?: VolumeAlarmConfig | false;
|
|
58
|
+
}
|
|
59
|
+
/**
|
|
60
|
+
* The build output of a {@link IVolumeBuilder}. Contains the CDK constructs
|
|
61
|
+
* created during {@link Lifecycle.build}, keyed by role.
|
|
62
|
+
*/
|
|
63
|
+
export interface VolumeBuilderResult {
|
|
64
|
+
volume: Volume;
|
|
65
|
+
/**
|
|
66
|
+
* CloudWatch alarms created for the volume, keyed by alarm name.
|
|
67
|
+
*
|
|
68
|
+
* Includes both AWS-recommended alarms and any custom alarms added
|
|
69
|
+
* via {@link IVolumeBuilder.addAlarm}. Access individual alarms by
|
|
70
|
+
* key (e.g., `result.alarms.burstBalance`).
|
|
71
|
+
*
|
|
72
|
+
* No alarm actions are configured — apply them via the result or an
|
|
73
|
+
* `afterBuild` hook.
|
|
74
|
+
*
|
|
75
|
+
* @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#EBS
|
|
76
|
+
*/
|
|
77
|
+
alarms: Record<string, Alarm>;
|
|
78
|
+
}
|
|
79
|
+
/**
|
|
80
|
+
* A fluent builder for configuring and creating an AWS EBS volume.
|
|
81
|
+
*
|
|
82
|
+
* Each configuration property from the CDK {@link VolumeProps} is exposed
|
|
83
|
+
* as an overloaded method: call with a value to set it (returns the builder
|
|
84
|
+
* for chaining), or call with no arguments to read the current value.
|
|
85
|
+
*
|
|
86
|
+
* The `availabilityZone` is set via the dedicated
|
|
87
|
+
* {@link IVolumeBuilder.availabilityZone | .availabilityZone()} method that
|
|
88
|
+
* accepts a {@link Resolvable} value for cross-component wiring (e.g., to
|
|
89
|
+
* a sibling {@link IVpcBuilder}). The `encryptionKey` setter likewise
|
|
90
|
+
* accepts a {@link Resolvable} value so a sibling KMS-key builder's output
|
|
91
|
+
* can be supplied via {@link ref}.
|
|
92
|
+
*
|
|
93
|
+
* The builder implements {@link Lifecycle}, so it can be used directly as a
|
|
94
|
+
* component in a {@link compose | composed system}. When built, it creates
|
|
95
|
+
* an EBS volume with the configured properties and returns a
|
|
96
|
+
* {@link VolumeBuilderResult}.
|
|
97
|
+
*
|
|
98
|
+
* AWS-recommended CloudWatch alarms are created by default. Alarms can be
|
|
99
|
+
* customized or disabled via the `recommendedAlarms` property. Custom
|
|
100
|
+
* alarms can be added via the {@link addAlarm} method.
|
|
101
|
+
*
|
|
102
|
+
* @see https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Volume.html
|
|
103
|
+
*
|
|
104
|
+
* @example
|
|
105
|
+
* ```ts
|
|
106
|
+
* const data = createVolumeBuilder()
|
|
107
|
+
* .availabilityZone(ref<VpcBuilderResult>("network").map(r => r.vpc.availabilityZones[0]))
|
|
108
|
+
* .size(Size.gibibytes(50));
|
|
109
|
+
* ```
|
|
110
|
+
*/
|
|
111
|
+
export type IVolumeBuilder = ITaggedBuilder<VolumeBuilderProps, VolumeBuilder>;
|
|
112
|
+
declare class VolumeBuilder implements Lifecycle<VolumeBuilderResult> {
|
|
113
|
+
#private;
|
|
114
|
+
props: Partial<VolumeBuilderProps>;
|
|
115
|
+
/**
|
|
116
|
+
* Sets the Availability Zone the volume will be created in.
|
|
117
|
+
*
|
|
118
|
+
* Accepts a concrete AZ string or a {@link Ref} that resolves to one at
|
|
119
|
+
* build time. This is how cross-component wiring works — e.g., to a
|
|
120
|
+
* sibling {@link IVpcBuilder} via
|
|
121
|
+
* `ref<VpcBuilderResult>("network").map(r => r.vpc.availabilityZones[0])`.
|
|
122
|
+
*
|
|
123
|
+
* @param availabilityZone - The AZ string or a Ref to one.
|
|
124
|
+
* @returns This builder for chaining.
|
|
125
|
+
*/
|
|
126
|
+
availabilityZone(availabilityZone: Resolvable<string>): this;
|
|
127
|
+
/**
|
|
128
|
+
* Adds a custom CloudWatch alarm to be created alongside the recommended
|
|
129
|
+
* alarms. The provided callback receives an {@link AlarmDefinitionBuilder}
|
|
130
|
+
* scoped to the built {@link Volume}; configure it fluently and return it.
|
|
131
|
+
*
|
|
132
|
+
* @param key - A unique key for the alarm (used to generate the alarm id).
|
|
133
|
+
* @param configure - Callback that configures the alarm definition.
|
|
134
|
+
* @returns This builder for chaining.
|
|
135
|
+
*/
|
|
136
|
+
addAlarm(key: string, configure: (alarm: AlarmDefinitionBuilder<Volume>) => AlarmDefinitionBuilder<Volume>): this;
|
|
137
|
+
/** @internal — see ADR-0005. */
|
|
138
|
+
[COPY_STATE](target: VolumeBuilder): void;
|
|
139
|
+
build(scope: IConstruct, id: string, context?: Record<string, object>): VolumeBuilderResult;
|
|
140
|
+
}
|
|
141
|
+
/**
|
|
142
|
+
* Creates a new {@link IVolumeBuilder} for configuring an AWS EBS volume.
|
|
143
|
+
*
|
|
144
|
+
* This is the entry point for defining an EBS volume component. The
|
|
145
|
+
* returned builder exposes every {@link VolumeBuilderProps} property as a
|
|
146
|
+
* fluent setter/getter, plus
|
|
147
|
+
* {@link IVolumeBuilder.availabilityZone | .availabilityZone()} for
|
|
148
|
+
* cross-component AZ wiring with Ref support. It implements
|
|
149
|
+
* {@link Lifecycle} for use with {@link compose}.
|
|
150
|
+
*
|
|
151
|
+
* @returns A fluent builder for an AWS EBS volume.
|
|
152
|
+
*
|
|
153
|
+
* @example
|
|
154
|
+
* ```ts
|
|
155
|
+
* const data = createVolumeBuilder()
|
|
156
|
+
* .availabilityZone(ref<VpcBuilderResult>("network").map(r => r.vpc.availabilityZones[0]))
|
|
157
|
+
* .size(Size.gibibytes(50));
|
|
158
|
+
*
|
|
159
|
+
* // Use standalone:
|
|
160
|
+
* const result = data.build(stack, "Data", { network });
|
|
161
|
+
*
|
|
162
|
+
* // Or compose into a system:
|
|
163
|
+
* const system = compose(
|
|
164
|
+
* { network: createVpcBuilder(), data },
|
|
165
|
+
* { network: [], data: ["network"] },
|
|
166
|
+
* );
|
|
167
|
+
* ```
|
|
168
|
+
*/
|
|
169
|
+
export declare function createVolumeBuilder(): IVolumeBuilder;
|
|
170
|
+
export {};
|
|
171
|
+
//# sourceMappingURL=volume-builder.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"volume-builder.d.ts","sourceRoot":"","sources":["../../src/volume-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAC9C,WAAW,EACX,kBAAkB,GAAG,eAAe,CACrC;IACC;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IAEjC;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC;CAC/C;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,MAAM,cAAc,GAAG,cAAc,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;AAE/E,cAAM,aAAc,YAAW,SAAS,CAAC,mBAAmB,CAAC;;IAC3D,KAAK,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAM;IAIxC;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,gBAAgB,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI;IAK5D;;;;;;;;OAQG;IACH,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CAAC,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,KAAK,sBAAsB,CAAC,MAAM,CAAC,GACnF,IAAI;IAKP,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAKzC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,mBAAmB;CAkC5F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,CAEpD"}
|
|
@@ -0,0 +1,98 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.createVolumeBuilder = createVolumeBuilder;
|
|
4
|
+
const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
|
|
5
|
+
const core_1 = require("@composurecdk/core");
|
|
6
|
+
const cloudformation_1 = require("@composurecdk/cloudformation");
|
|
7
|
+
const cloudwatch_1 = require("@composurecdk/cloudwatch");
|
|
8
|
+
const volume_alarms_js_1 = require("./volume-alarms.js");
|
|
9
|
+
const volume_defaults_js_1 = require("./volume-defaults.js");
|
|
10
|
+
class VolumeBuilder {
|
|
11
|
+
props = {};
|
|
12
|
+
#customAlarms = [];
|
|
13
|
+
#availabilityZone;
|
|
14
|
+
/**
|
|
15
|
+
* Sets the Availability Zone the volume will be created in.
|
|
16
|
+
*
|
|
17
|
+
* Accepts a concrete AZ string or a {@link Ref} that resolves to one at
|
|
18
|
+
* build time. This is how cross-component wiring works — e.g., to a
|
|
19
|
+
* sibling {@link IVpcBuilder} via
|
|
20
|
+
* `ref<VpcBuilderResult>("network").map(r => r.vpc.availabilityZones[0])`.
|
|
21
|
+
*
|
|
22
|
+
* @param availabilityZone - The AZ string or a Ref to one.
|
|
23
|
+
* @returns This builder for chaining.
|
|
24
|
+
*/
|
|
25
|
+
availabilityZone(availabilityZone) {
|
|
26
|
+
this.#availabilityZone = availabilityZone;
|
|
27
|
+
return this;
|
|
28
|
+
}
|
|
29
|
+
/**
|
|
30
|
+
* Adds a custom CloudWatch alarm to be created alongside the recommended
|
|
31
|
+
* alarms. The provided callback receives an {@link AlarmDefinitionBuilder}
|
|
32
|
+
* scoped to the built {@link Volume}; configure it fluently and return it.
|
|
33
|
+
*
|
|
34
|
+
* @param key - A unique key for the alarm (used to generate the alarm id).
|
|
35
|
+
* @param configure - Callback that configures the alarm definition.
|
|
36
|
+
* @returns This builder for chaining.
|
|
37
|
+
*/
|
|
38
|
+
addAlarm(key, configure) {
|
|
39
|
+
this.#customAlarms.push(configure(new cloudwatch_1.AlarmDefinitionBuilder(key)));
|
|
40
|
+
return this;
|
|
41
|
+
}
|
|
42
|
+
/** @internal — see ADR-0005. */
|
|
43
|
+
[core_1.COPY_STATE](target) {
|
|
44
|
+
target.#availabilityZone = this.#availabilityZone;
|
|
45
|
+
target.#customAlarms.push(...this.#customAlarms);
|
|
46
|
+
}
|
|
47
|
+
build(scope, id, context) {
|
|
48
|
+
const resolvedAz = this.#availabilityZone
|
|
49
|
+
? (0, core_1.resolve)(this.#availabilityZone, context)
|
|
50
|
+
: undefined;
|
|
51
|
+
if (resolvedAz === undefined) {
|
|
52
|
+
throw new Error(`VolumeBuilder "${id}" requires an availability zone. ` +
|
|
53
|
+
`Call .availabilityZone() with a string or a Ref to one.`);
|
|
54
|
+
}
|
|
55
|
+
const { recommendedAlarms: alarmConfig, encryptionKey, ...volumeProps } = this.props;
|
|
56
|
+
const mergedProps = {
|
|
57
|
+
...volume_defaults_js_1.VOLUME_DEFAULTS,
|
|
58
|
+
...volumeProps,
|
|
59
|
+
availabilityZone: resolvedAz,
|
|
60
|
+
...(encryptionKey !== undefined ? { encryptionKey: (0, core_1.resolve)(encryptionKey, context) } : {}),
|
|
61
|
+
};
|
|
62
|
+
const volume = new aws_ec2_1.Volume(scope, id, mergedProps);
|
|
63
|
+
const alarms = (0, volume_alarms_js_1.createVolumeAlarms)(scope, id, volume, alarmConfig, mergedProps.volumeType, this.#customAlarms);
|
|
64
|
+
return { volume, alarms };
|
|
65
|
+
}
|
|
66
|
+
}
|
|
67
|
+
/**
|
|
68
|
+
* Creates a new {@link IVolumeBuilder} for configuring an AWS EBS volume.
|
|
69
|
+
*
|
|
70
|
+
* This is the entry point for defining an EBS volume component. The
|
|
71
|
+
* returned builder exposes every {@link VolumeBuilderProps} property as a
|
|
72
|
+
* fluent setter/getter, plus
|
|
73
|
+
* {@link IVolumeBuilder.availabilityZone | .availabilityZone()} for
|
|
74
|
+
* cross-component AZ wiring with Ref support. It implements
|
|
75
|
+
* {@link Lifecycle} for use with {@link compose}.
|
|
76
|
+
*
|
|
77
|
+
* @returns A fluent builder for an AWS EBS volume.
|
|
78
|
+
*
|
|
79
|
+
* @example
|
|
80
|
+
* ```ts
|
|
81
|
+
* const data = createVolumeBuilder()
|
|
82
|
+
* .availabilityZone(ref<VpcBuilderResult>("network").map(r => r.vpc.availabilityZones[0]))
|
|
83
|
+
* .size(Size.gibibytes(50));
|
|
84
|
+
*
|
|
85
|
+
* // Use standalone:
|
|
86
|
+
* const result = data.build(stack, "Data", { network });
|
|
87
|
+
*
|
|
88
|
+
* // Or compose into a system:
|
|
89
|
+
* const system = compose(
|
|
90
|
+
* { network: createVpcBuilder(), data },
|
|
91
|
+
* { network: [], data: ["network"] },
|
|
92
|
+
* );
|
|
93
|
+
* ```
|
|
94
|
+
*/
|
|
95
|
+
function createVolumeBuilder() {
|
|
96
|
+
return (0, cloudformation_1.taggedBuilder)(VolumeBuilder);
|
|
97
|
+
}
|
|
98
|
+
//# sourceMappingURL=volume-builder.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"volume-builder.js","sourceRoot":"","sources":["../../src/volume-builder.ts"],"names":[],"mappings":";;AAsOA,kDAEC;AAvOD,iDAA+D;AAG/D,6CAA0F;AAC1F,iEAAkF;AAClF,yDAAkE;AAElE,yDAAwD;AACxD,6DAAuD;AAiHvD,MAAM,aAAa;IACjB,KAAK,GAAgC,EAAE,CAAC;IAC/B,aAAa,GAAqC,EAAE,CAAC;IAC9D,iBAAiB,CAAsB;IAEvC;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,gBAAoC;QACnD,IAAI,CAAC,iBAAiB,GAAG,gBAAgB,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,QAAQ,CACN,GAAW,EACX,SAAoF;QAEpF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,mCAAsB,CAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,CAAC,iBAAU,CAAC,CAAC,MAAqB;QAChC,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAClD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,KAAiB,EAAE,EAAU,EAAE,OAAgC;QACnE,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB;YACvC,CAAC,CAAC,IAAA,cAAO,EAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC;YAC1C,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,kBAAkB,EAAE,mCAAmC;gBACrD,yDAAyD,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAErF,MAAM,WAAW,GAAG;YAClB,GAAG,oCAAe;YAClB,GAAG,WAAW;YACd,gBAAgB,EAAE,UAAU;YAC5B,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAA,cAAO,EAAC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5E,CAAC;QAEjB,MAAM,MAAM,GAAG,IAAI,gBAAM,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAElD,MAAM,MAAM,GAAG,IAAA,qCAAkB,EAC/B,KAAK,EACL,EAAE,EACF,MAAM,EACN,WAAW,EACX,WAAW,CAAC,UAAU,EACtB,IAAI,CAAC,aAAa,CACnB,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAgB,mBAAmB;IACjC,OAAO,IAAA,8BAAa,EAAoC,aAAa,CAAC,CAAC;AACzE,CAAC"}
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
import { type VolumeProps } from "aws-cdk-lib/aws-ec2";
|
|
2
|
+
/**
|
|
3
|
+
* Secure, AWS-recommended defaults applied to every EBS volume built with
|
|
4
|
+
* {@link createVolumeBuilder}. Each property can be individually overridden
|
|
5
|
+
* via the builder's fluent API.
|
|
6
|
+
*
|
|
7
|
+
* Three properties intentionally have no default — they are application-
|
|
8
|
+
* specific and must be supplied explicitly:
|
|
9
|
+
* - `availabilityZone` (via the builder's `.availabilityZone()` method)
|
|
10
|
+
* - `size`
|
|
11
|
+
* - `iops` / `throughput` (only when opting into a volume type that
|
|
12
|
+
* requires them, e.g. `io1`/`io2`)
|
|
13
|
+
*/
|
|
14
|
+
export declare const VOLUME_DEFAULTS: Partial<VolumeProps>;
|
|
15
|
+
//# sourceMappingURL=volume-defaults.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"volume-defaults.d.ts","sourceRoot":"","sources":["../../src/volume-defaults.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAE5E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,EAAE,OAAO,CAAC,WAAW,CAkChD,CAAC"}
|
|
@@ -0,0 +1,50 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.VOLUME_DEFAULTS = void 0;
|
|
4
|
+
const aws_cdk_lib_1 = require("aws-cdk-lib");
|
|
5
|
+
const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
|
|
6
|
+
/**
|
|
7
|
+
* Secure, AWS-recommended defaults applied to every EBS volume built with
|
|
8
|
+
* {@link createVolumeBuilder}. Each property can be individually overridden
|
|
9
|
+
* via the builder's fluent API.
|
|
10
|
+
*
|
|
11
|
+
* Three properties intentionally have no default — they are application-
|
|
12
|
+
* specific and must be supplied explicitly:
|
|
13
|
+
* - `availabilityZone` (via the builder's `.availabilityZone()` method)
|
|
14
|
+
* - `size`
|
|
15
|
+
* - `iops` / `throughput` (only when opting into a volume type that
|
|
16
|
+
* requires them, e.g. `io1`/`io2`)
|
|
17
|
+
*/
|
|
18
|
+
exports.VOLUME_DEFAULTS = {
|
|
19
|
+
/**
|
|
20
|
+
* GP3 is the current-generation general-purpose SSD — cheaper and faster
|
|
21
|
+
* than GP2 at equivalent sizes, and matches the root-volume choice in
|
|
22
|
+
* {@link INSTANCE_DEFAULTS}.
|
|
23
|
+
* @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/general-purpose.html
|
|
24
|
+
*/
|
|
25
|
+
volumeType: aws_ec2_1.EbsDeviceVolumeType.GP3,
|
|
26
|
+
/**
|
|
27
|
+
* Encrypt the volume at rest. Defaults to the account's default EBS KMS
|
|
28
|
+
* key; pass an `encryptionKey` to use a customer-managed key (CMK) for
|
|
29
|
+
* sensitive workloads per SEC08-BP02.
|
|
30
|
+
* @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_protect_data_rest_encrypt.html
|
|
31
|
+
* @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html
|
|
32
|
+
*/
|
|
33
|
+
encrypted: true,
|
|
34
|
+
/**
|
|
35
|
+
* When EBS detects inconsistent data on boot it disables I/O until the
|
|
36
|
+
* operator acknowledges. For a persistent data volume the safer default
|
|
37
|
+
* is to let I/O resume so the instance can come up unattended; override
|
|
38
|
+
* to `false` for workloads that prefer to block on potential corruption.
|
|
39
|
+
* @see https://docs.aws.amazon.com/ebs/latest/userguide/monitoring-volume-events.html
|
|
40
|
+
*/
|
|
41
|
+
autoEnableIo: true,
|
|
42
|
+
/**
|
|
43
|
+
* Mirrors `BUCKET_DEFAULTS.removalPolicy`. A destroyed volume is
|
|
44
|
+
* unrecoverable; an orphaned volume is a $/month nuisance. Err on the
|
|
45
|
+
* side of retention — flip to `DESTROY` explicitly for ephemeral data.
|
|
46
|
+
* @see https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/rel_planning_for_recovery_back_up_data.html
|
|
47
|
+
*/
|
|
48
|
+
removalPolicy: aws_cdk_lib_1.RemovalPolicy.RETAIN,
|
|
49
|
+
};
|
|
50
|
+
//# sourceMappingURL=volume-defaults.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"volume-defaults.js","sourceRoot":"","sources":["../../src/volume-defaults.ts"],"names":[],"mappings":";;;AAAA,6CAA4C;AAC5C,iDAA4E;AAE5E;;;;;;;;;;;GAWG;AACU,QAAA,eAAe,GAAyB;IACnD;;;;;OAKG;IACH,UAAU,EAAE,6BAAmB,CAAC,GAAG;IAEnC;;;;;;OAMG;IACH,SAAS,EAAE,IAAI;IAEf;;;;;;OAMG;IACH,YAAY,EAAE,IAAI;IAElB;;;;;OAKG;IACH,aAAa,EAAE,2BAAa,CAAC,MAAM;CACpC,CAAC"}
|
|
@@ -1,7 +1,8 @@
|
|
|
1
1
|
import { FlowLogDestination, Vpc, type VpcProps } from "aws-cdk-lib/aws-ec2";
|
|
2
2
|
import { type LogGroup } from "aws-cdk-lib/aws-logs";
|
|
3
3
|
import { type IConstruct } from "constructs";
|
|
4
|
-
import { type
|
|
4
|
+
import { type Lifecycle } from "@composurecdk/core";
|
|
5
|
+
import { type ITaggedBuilder } from "@composurecdk/cloudformation";
|
|
5
6
|
import { type ILogGroupBuilder } from "@composurecdk/logs";
|
|
6
7
|
/**
|
|
7
8
|
* Configures how VPC flow logs are handled. Pass `false` to disable flow
|
|
@@ -76,7 +77,7 @@ export interface VpcBuilderResult {
|
|
|
76
77
|
* const network = createVpcBuilder().maxAzs(3).natGateways(3);
|
|
77
78
|
* ```
|
|
78
79
|
*/
|
|
79
|
-
export type IVpcBuilder =
|
|
80
|
+
export type IVpcBuilder = ITaggedBuilder<VpcBuilderProps, VpcBuilder>;
|
|
80
81
|
declare class VpcBuilder implements Lifecycle<VpcBuilderResult> {
|
|
81
82
|
props: Partial<VpcBuilderProps>;
|
|
82
83
|
build(scope: IConstruct, id: string): VpcBuilderResult;
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"vpc-builder.d.ts","sourceRoot":"","sources":["../../src/vpc-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,GAAG,EAAE,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGlF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,GACtB,KAAK,GACL;IACE,gFAAgF;IAChF,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,gBAAgB,CAAC;CACvD,CAAC;AAEN;;;;;;GAMG;AACH,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC;IACjE,wFAAwF;IACxF,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,GAAG,CAAC;IAET;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,QAAQ,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,WAAW,GAAG,cAAc,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;AAItE,cAAM,UAAW,YAAW,SAAS,CAAC,gBAAgB,CAAC;IACrD,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,CAAM;IAErC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,gBAAgB;CAgBvD;AA2CD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAE9C"}
|
|
@@ -0,0 +1,82 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.createVpcBuilder = createVpcBuilder;
|
|
4
|
+
const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
|
|
5
|
+
const cloudformation_1 = require("@composurecdk/cloudformation");
|
|
6
|
+
const logs_1 = require("@composurecdk/logs");
|
|
7
|
+
const vpc_defaults_js_1 = require("./vpc-defaults.js");
|
|
8
|
+
const DEFAULT_FLOW_LOG_KEY = "DefaultFlowLog";
|
|
9
|
+
class VpcBuilder {
|
|
10
|
+
props = {};
|
|
11
|
+
build(scope, id) {
|
|
12
|
+
const { flowLogs: flowLogsConfig, ...vpcProps } = this.props;
|
|
13
|
+
const { flowLogsLogGroup, flowLogProps } = resolveFlowLogs(scope, id, flowLogsConfig);
|
|
14
|
+
const mergedProps = {
|
|
15
|
+
...vpc_defaults_js_1.VPC_DEFAULTS,
|
|
16
|
+
...flowLogProps,
|
|
17
|
+
...vpcProps,
|
|
18
|
+
};
|
|
19
|
+
return {
|
|
20
|
+
vpc: new aws_ec2_1.Vpc(scope, id, mergedProps),
|
|
21
|
+
flowLogsLogGroup,
|
|
22
|
+
};
|
|
23
|
+
}
|
|
24
|
+
}
|
|
25
|
+
function resolveFlowLogs(scope, id, cfg) {
|
|
26
|
+
if (cfg === false) {
|
|
27
|
+
return { flowLogProps: {} };
|
|
28
|
+
}
|
|
29
|
+
if (cfg?.destination !== undefined) {
|
|
30
|
+
if (cfg.configure !== undefined) {
|
|
31
|
+
throw new Error("flowLogs: 'configure' cannot be combined with 'destination' — " +
|
|
32
|
+
"the destination is user-managed and not built by this builder.");
|
|
33
|
+
}
|
|
34
|
+
return {
|
|
35
|
+
flowLogProps: {
|
|
36
|
+
flowLogs: { [DEFAULT_FLOW_LOG_KEY]: { destination: cfg.destination } },
|
|
37
|
+
},
|
|
38
|
+
};
|
|
39
|
+
}
|
|
40
|
+
let subBuilder = (0, logs_1.createLogGroupBuilder)();
|
|
41
|
+
if (cfg?.configure) {
|
|
42
|
+
subBuilder = cfg.configure(subBuilder);
|
|
43
|
+
}
|
|
44
|
+
const flowLogsLogGroup = subBuilder.build(scope, `${id}FlowLogsLogGroup`).logGroup;
|
|
45
|
+
return {
|
|
46
|
+
flowLogsLogGroup,
|
|
47
|
+
flowLogProps: {
|
|
48
|
+
flowLogs: {
|
|
49
|
+
[DEFAULT_FLOW_LOG_KEY]: {
|
|
50
|
+
destination: aws_ec2_1.FlowLogDestination.toCloudWatchLogs(flowLogsLogGroup),
|
|
51
|
+
},
|
|
52
|
+
},
|
|
53
|
+
},
|
|
54
|
+
};
|
|
55
|
+
}
|
|
56
|
+
/**
|
|
57
|
+
* Creates a new {@link IVpcBuilder} for configuring an AWS VPC.
|
|
58
|
+
*
|
|
59
|
+
* This is the entry point for defining a VPC component. The returned builder
|
|
60
|
+
* exposes every {@link VpcBuilderProps} property as a fluent setter/getter
|
|
61
|
+
* and implements {@link Lifecycle} for use with {@link compose}.
|
|
62
|
+
*
|
|
63
|
+
* @returns A fluent builder for an AWS VPC.
|
|
64
|
+
*
|
|
65
|
+
* @example
|
|
66
|
+
* ```ts
|
|
67
|
+
* const network = createVpcBuilder().maxAzs(3).natGateways(3);
|
|
68
|
+
*
|
|
69
|
+
* // Use standalone:
|
|
70
|
+
* const result = network.build(stack, "Network");
|
|
71
|
+
*
|
|
72
|
+
* // Or compose into a system:
|
|
73
|
+
* const system = compose(
|
|
74
|
+
* { network, server: createInstanceBuilder() },
|
|
75
|
+
* { network: [], server: ["network"] },
|
|
76
|
+
* );
|
|
77
|
+
* ```
|
|
78
|
+
*/
|
|
79
|
+
function createVpcBuilder() {
|
|
80
|
+
return (0, cloudformation_1.taggedBuilder)(VpcBuilder);
|
|
81
|
+
}
|
|
82
|
+
//# sourceMappingURL=vpc-builder.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"vpc-builder.js","sourceRoot":"","sources":["../../src/vpc-builder.ts"],"names":[],"mappings":";;AAgLA,4CAEC;AAlLD,iDAA6E;AAI7E,iEAAkF;AAClF,6CAAkF;AAClF,uDAAiD;AAmFjD,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAE9C,MAAM,UAAU;IACd,KAAK,GAA6B,EAAE,CAAC;IAErC,KAAK,CAAC,KAAiB,EAAE,EAAU;QACjC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAE7D,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;QAEtF,MAAM,WAAW,GAAG;YAClB,GAAG,8BAAY;YACf,GAAG,YAAY;YACf,GAAG,QAAQ;SACZ,CAAC;QAEF,OAAO;YACL,GAAG,EAAE,IAAI,aAAG,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC;YACpC,gBAAgB;SACjB,CAAC;IACJ,CAAC;CACF;AAED,SAAS,eAAe,CACtB,KAAiB,EACjB,EAAU,EACV,GAA+B;IAE/B,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,GAAG,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAC9D,gEAAgE,CACnE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,YAAY,EAAE;gBACZ,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE;aACvE;SACF,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,GAAG,IAAA,4BAAqB,GAAE,CAAC;IACzC,IAAI,GAAG,EAAE,SAAS,EAAE,CAAC;QACnB,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,gBAAgB,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;IAEnF,OAAO;QACL,gBAAgB;QAChB,YAAY,EAAE;YACZ,QAAQ,EAAE;gBACR,CAAC,oBAAoB,CAAC,EAAE;oBACtB,WAAW,EAAE,4BAAkB,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;iBACnE;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAgB,gBAAgB;IAC9B,OAAO,IAAA,8BAAa,EAA8B,UAAU,CAAC,CAAC;AAChE,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"vpc-defaults.d.ts","sourceRoot":"","sources":["../../src/vpc-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,EAAE,OAAO,CAAC,QAAQ,CA6C1C,CAAC"}
|
|
@@ -0,0 +1,58 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.VPC_DEFAULTS = void 0;
|
|
4
|
+
/**
|
|
5
|
+
* Secure, cost-conscious defaults applied to every VPC built with
|
|
6
|
+
* {@link createVpcBuilder}. Each property can be individually overridden
|
|
7
|
+
* via the builder's fluent API.
|
|
8
|
+
*
|
|
9
|
+
* Subnet layout uses CDK defaults (one public + one private-with-egress
|
|
10
|
+
* subnet per AZ) — override `subnetConfiguration` for custom topologies.
|
|
11
|
+
*
|
|
12
|
+
* Flow logs are created separately by the builder (not via this defaults
|
|
13
|
+
* object) so the destination log group can be auto-managed with
|
|
14
|
+
* well-architected retention/removal policies.
|
|
15
|
+
*/
|
|
16
|
+
exports.VPC_DEFAULTS = {
|
|
17
|
+
/**
|
|
18
|
+
* Two availability zones strike a balance between high availability
|
|
19
|
+
* and cost. Override to 3+ AZs for production workloads that need
|
|
20
|
+
* stricter HA guarantees.
|
|
21
|
+
* @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html
|
|
22
|
+
*/
|
|
23
|
+
maxAzs: 2,
|
|
24
|
+
/**
|
|
25
|
+
* Single NAT gateway is a cost-conscious default. Production HA
|
|
26
|
+
* workloads should override this to match `maxAzs` so a single-AZ
|
|
27
|
+
* NAT failure does not partition private-subnet egress.
|
|
28
|
+
* @see https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html
|
|
29
|
+
*/
|
|
30
|
+
natGateways: 1,
|
|
31
|
+
/**
|
|
32
|
+
* Required for internal DNS resolution for most AWS managed services
|
|
33
|
+
* (ALB, RDS, VPC endpoints). Default-on in AWS but set explicitly for
|
|
34
|
+
* safety across CDK feature-flag configurations.
|
|
35
|
+
* @see https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html
|
|
36
|
+
*/
|
|
37
|
+
enableDnsSupport: true,
|
|
38
|
+
/**
|
|
39
|
+
* Required alongside DNS support for instances to receive public DNS
|
|
40
|
+
* hostnames. Needed for most hostname-based TLS and service discovery
|
|
41
|
+
* scenarios.
|
|
42
|
+
* @see https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html
|
|
43
|
+
*/
|
|
44
|
+
enableDnsHostnames: true,
|
|
45
|
+
/**
|
|
46
|
+
* Strip all rules from the default security group. This prevents
|
|
47
|
+
* accidentally using the default SG (which allows all intra-SG
|
|
48
|
+
* traffic and no ingress) and forces explicit SG design — a
|
|
49
|
+
* foundational well-architected security practice.
|
|
50
|
+
*
|
|
51
|
+
* Also enabled by the `@aws-cdk/aws-ec2:restrictDefaultSecurityGroup`
|
|
52
|
+
* feature flag; we set it explicitly so the guarantee holds regardless
|
|
53
|
+
* of CDK context configuration.
|
|
54
|
+
* @see https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Vpc.html#restrictdefaultsecuritygroup
|
|
55
|
+
*/
|
|
56
|
+
restrictDefaultSecurityGroup: true,
|
|
57
|
+
};
|
|
58
|
+
//# sourceMappingURL=vpc-defaults.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"vpc-defaults.js","sourceRoot":"","sources":["../../src/vpc-defaults.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;GAWG;AACU,QAAA,YAAY,GAAsB;IAC7C;;;;;OAKG;IACH,MAAM,EAAE,CAAC;IAET;;;;;OAKG;IACH,WAAW,EAAE,CAAC;IAEd;;;;;OAKG;IACH,gBAAgB,EAAE,IAAI;IAEtB;;;;;OAKG;IACH,kBAAkB,EAAE,IAAI;IAExB;;;;;;;;;;OAUG;IACH,4BAA4B,EAAE,IAAI;CACnC,CAAC"}
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
export { createInstanceBuilder, type IInstanceBuilder, type InstanceBuilderProps, type InstanceBuilderResult, } from "./instance-builder.js";
|
|
2
|
+
export { INSTANCE_DEFAULTS } from "./instance-defaults.js";
|
|
3
|
+
export { type InstanceAlarmConfig } from "./instance-alarm-config.js";
|
|
4
|
+
export { INSTANCE_ALARM_DEFAULTS } from "./instance-alarm-defaults.js";
|
|
5
|
+
export { type AttachVolumeOptions } from "./instance-volume-attachments.js";
|
|
6
|
+
export { type VolumeAttachmentAlarmConfig } from "./instance-volume-attachment-config.js";
|
|
7
|
+
export { VOLUME_ATTACHMENT_ALARM_DEFAULTS } from "./instance-volume-attachment-defaults.js";
|
|
8
|
+
export { createVolumeBuilder, type IVolumeBuilder, type VolumeBuilderProps, type VolumeBuilderResult, } from "./volume-builder.js";
|
|
9
|
+
export { VOLUME_DEFAULTS } from "./volume-defaults.js";
|
|
10
|
+
export { type VolumeAlarmConfig } from "./volume-alarm-config.js";
|
|
11
|
+
export { VOLUME_ALARM_DEFAULTS } from "./volume-alarm-defaults.js";
|
|
12
|
+
export { createVpcBuilder, type FlowLogsConfig, type IVpcBuilder, type VpcBuilderProps, type VpcBuilderResult, } from "./vpc-builder.js";
|
|
13
|
+
export { VPC_DEFAULTS } from "./vpc-defaults.js";
|
|
14
|
+
//# sourceMappingURL=index.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAC1F,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAE5F,OAAO,EACL,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
export { createInstanceBuilder, } from "./instance-builder.js";
|
|
2
|
+
export { INSTANCE_DEFAULTS } from "./instance-defaults.js";
|
|
3
|
+
export { INSTANCE_ALARM_DEFAULTS } from "./instance-alarm-defaults.js";
|
|
4
|
+
export { VOLUME_ATTACHMENT_ALARM_DEFAULTS } from "./instance-volume-attachment-defaults.js";
|
|
5
|
+
export { createVolumeBuilder, } from "./volume-builder.js";
|
|
6
|
+
export { VOLUME_DEFAULTS } from "./volume-defaults.js";
|
|
7
|
+
export { VOLUME_ALARM_DEFAULTS } from "./volume-alarm-defaults.js";
|
|
8
|
+
export { createVpcBuilder, } from "./vpc-builder.js";
|
|
9
|
+
export { VPC_DEFAULTS } from "./vpc-defaults.js";
|
|
10
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,GAItB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAGvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAE5F,OAAO,EACL,mBAAmB,GAIpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,gBAAgB,GAKjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}
|
|
@@ -0,0 +1,62 @@
|
|
|
1
|
+
import type { AlarmConfig } from "@composurecdk/cloudwatch";
|
|
2
|
+
/**
|
|
3
|
+
* Controls which recommended alarms are created for an EC2 instance.
|
|
4
|
+
* All alarms are enabled by default with AWS-recommended thresholds.
|
|
5
|
+
* Set individual alarms to `false` to disable them, or provide an
|
|
6
|
+
* {@link AlarmConfig} to tune thresholds.
|
|
7
|
+
*
|
|
8
|
+
* @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#EC2
|
|
9
|
+
*/
|
|
10
|
+
export interface InstanceAlarmConfig {
|
|
11
|
+
/**
|
|
12
|
+
* Master switch: set to `false` to disable all recommended alarms.
|
|
13
|
+
* Individual alarms can also be disabled via their own entry.
|
|
14
|
+
* @default true
|
|
15
|
+
*/
|
|
16
|
+
enabled?: boolean;
|
|
17
|
+
/**
|
|
18
|
+
* Alarm when CPU utilization is sustained at a high level.
|
|
19
|
+
*
|
|
20
|
+
* Metric: `AWS/EC2 CPUUtilization`, statistic Average, period 1 minute.
|
|
21
|
+
* Default threshold: > 80% over 5 consecutive minutes.
|
|
22
|
+
*
|
|
23
|
+
* @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#EC2
|
|
24
|
+
*/
|
|
25
|
+
cpuUtilization?: AlarmConfig | false;
|
|
26
|
+
/**
|
|
27
|
+
* Alarm when the instance fails its EC2 or system status checks.
|
|
28
|
+
*
|
|
29
|
+
* Metric: `AWS/EC2 StatusCheckFailed`, statistic Sum, period 1 minute.
|
|
30
|
+
* Default threshold: > 0 failures over 2 consecutive minutes.
|
|
31
|
+
*
|
|
32
|
+
* @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#EC2
|
|
33
|
+
*/
|
|
34
|
+
statusCheckFailed?: AlarmConfig | false;
|
|
35
|
+
/**
|
|
36
|
+
* Alarm when the instance's attached EBS volumes are unreachable or
|
|
37
|
+
* unable to complete I/O — typically a host or storage-subsystem issue.
|
|
38
|
+
*
|
|
39
|
+
* Metric: `AWS/EC2 StatusCheckFailed_AttachedEBS`, statistic Maximum,
|
|
40
|
+
* period 1 minute. Default threshold: >= 1 over 10 consecutive minutes
|
|
41
|
+
* (the longer window reflects that EBS infrastructure usually self-heals
|
|
42
|
+
* within a few minutes).
|
|
43
|
+
*
|
|
44
|
+
* @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#EC2
|
|
45
|
+
*/
|
|
46
|
+
attachedEbsStatusCheckFailed?: AlarmConfig | false;
|
|
47
|
+
/**
|
|
48
|
+
* Alarm when burstable (T-family) CPU credit balance falls low,
|
|
49
|
+
* indicating the instance is about to be throttled to baseline.
|
|
50
|
+
*
|
|
51
|
+
* Only created when the `instanceType` family is one of: t2, t3, t3a, t4g.
|
|
52
|
+
* For other instance types this alarm is skipped entirely.
|
|
53
|
+
*
|
|
54
|
+
* Metric: `AWS/EC2 CPUCreditBalance`, statistic Minimum, period 5 minutes.
|
|
55
|
+
* Default threshold: < 50 credits over 3 consecutive 5-minute windows.
|
|
56
|
+
*
|
|
57
|
+
* @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#EC2
|
|
58
|
+
* @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/burstable-credits-baseline-concepts.html
|
|
59
|
+
*/
|
|
60
|
+
cpuCreditBalance?: AlarmConfig | false;
|
|
61
|
+
}
|
|
62
|
+
//# sourceMappingURL=instance-alarm-config.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"instance-alarm-config.d.ts","sourceRoot":"","sources":["../../src/instance-alarm-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAErC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAExC;;;;;;;;;;OAUG;IACH,4BAA4B,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEnD;;;;;;;;;;;;OAYG;IACH,gBAAgB,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CACxC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"instance-alarm-config.js","sourceRoot":"","sources":["../../src/instance-alarm-config.ts"],"names":[],"mappings":""}
|