@continuous-excellence/ze-great-dashboard-aws 0.13.8 → 0.14.1

package/README.md

@@ -1,7 +1,17 @@
 # Ze Great Dashboard on AWS
 
-`@continuous-excellence/ze-great-dashboard-aws` packages a board as a private AWS Lambda. It
-includes the Lambda runtime, matching browser client, deployment CLI, and CloudFormation templates.
+`@continuous-excellence/ze-great-dashboard-aws` packages a board for a private AWS Lambda or ECS
+deployment. It includes the Lambda runtime, matching browser client, deployment CLI, and
+CloudFormation templates.
+
+Deployment mode is persisted in `dashboard-bootstrap.json` and generated application parameters
+as `ComputeMode`. Existing files without that field mean `lambda`. Choose `--mode ecs` during
+bootstrap initialization; routine packaging and diagnostics then select the matching template.
+An explicit mode fails if it disagrees with persisted configuration, so changing mode requires
+regenerating the reviewed bootstrap and parameter artifacts.
+
+Consumer ECS deployments use the long-lived service template and provide their own subnets and
+security groups.
 
 This deployment path is intended for teams that already operate AWS and have a protected gateway
 such as API Gateway or an ALB. It deliberately does not create a public endpoint, choose an

package/bootstrap/core-ecs-v1.yml

@@ -0,0 +1,86 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: Ze Great Dashboard ECS bootstrap core v1. Administrator-managed; do not grant this authority to CI.
+
+Parameters:
+  ComputeMode: { Type: String, Default: ecs, AllowedValues: [ecs] }
+  ArtifactBucketName: { Type: String, Description: Compatibility artifact bucket; ECS packages use the published image }
+  ApplicationStackName: { Type: String }
+  DashboardFunctionName: { Type: String, Description: Compatibility name retained by the bootstrap manifest }
+  RuntimeSecretArn: { Type: String, Default: '' }
+  ArtifactKmsKeyArn: { Type: String, Default: '' }
+
+Conditions:
+  HasRuntimeSecret: !Not [!Equals [!Ref RuntimeSecretArn, '']]
+
+Resources:
+  ArtifactBucket:
+    Type: AWS::S3::Bucket
+    DeletionPolicy: Retain
+    UpdateReplacePolicy: Retain
+    Properties:
+      BucketName: !Ref ArtifactBucketName
+      OwnershipControls: { Rules: [{ ObjectOwnership: BucketOwnerEnforced }] }
+      PublicAccessBlockConfiguration: { BlockPublicAcls: true, BlockPublicPolicy: true, IgnorePublicAcls: true, RestrictPublicBuckets: true }
+  CloudFormationExecutionRole:
+    Type: AWS::IAM::Role
+    DeletionPolicy: Retain
+    UpdateReplacePolicy: Retain
+    Properties:
+      RoleName: !Sub '${ApplicationStackName}-execution'
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement: [{ Effect: Allow, Principal: { Service: cloudformation.amazonaws.com }, Action: sts:AssumeRole }]
+      Policies:
+        - PolicyName: DashboardEcsApplicationResources
+          PolicyDocument:
+            Version: '2012-10-17'
+            Statement:
+              - Sid: DashboardEcs
+                Effect: Allow
+                Action: [ecs:CreateCluster, ecs:DescribeClusters, ecs:UpdateCluster, ecs:DeleteCluster, ecs:CreateService, ecs:DescribeServices, ecs:UpdateService, ecs:DeleteService, ecs:RegisterTaskDefinition, ecs:DeregisterTaskDefinition, ecs:DescribeTaskDefinition, ecs:TagResource, ecs:UntagResource]
+                Resource: '*'
+              - Sid: DashboardEcsLogs
+                Effect: Allow
+                Action: [logs:CreateLogGroup, logs:DeleteLogGroup, logs:DescribeLogGroups, logs:PutRetentionPolicy, logs:TagResource, logs:UntagResource]
+                Resource: !Sub 'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/ecs/${ApplicationStackName}:*'
+              - Sid: ManageEcsRuntimeRoles
+                Effect: Allow
+                Action: [iam:CreateRole, iam:GetRole, iam:DeleteRole, iam:UpdateAssumeRolePolicy, iam:PutRolePolicy, iam:GetRolePolicy, iam:DeleteRolePolicy, iam:TagRole, iam:UntagRole]
+                Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${ApplicationStackName}-*'
+              - Sid: PassRuntimeRolesToEcsOnly
+                Effect: Allow
+                Action: iam:PassRole
+                Resource: !Sub 'arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${ApplicationStackName}-*'
+                Condition: { StringEquals: { 'iam:PassedToService': ecs-tasks.amazonaws.com } }
+              - !If
+                - HasRuntimeSecret
+                - Sid: ReadConfiguredRuntimeCredentials
+                  Effect: Allow
+                  Action: [secretsmanager:DescribeSecret, secretsmanager:GetSecretValue]
+                  Resource: !Ref RuntimeSecretArn
+                - !Ref AWS::NoValue
+              - !If
+                - HasRuntimeSecret
+                - Sid: ReadConfiguredRuntimeParameter
+                  Effect: Allow
+                  Action: ssm:GetParameter
+                  Resource: !Ref RuntimeSecretArn
+                - !Ref AWS::NoValue
+              - !If
+                - HasRuntimeSecret
+                - Sid: DecryptConfiguredRuntimeParameter
+                  Effect: Allow
+                  Action: kms:Decrypt
+                  Resource: '*'
+                  Condition:
+                    StringEquals:
+                      'kms:ViaService': !Sub 'ssm.${AWS::Region}.amazonaws.com'
+                      'kms:EncryptionContext:PARAMETER_ARN': !Ref RuntimeSecretArn
+                - !Ref AWS::NoValue
+Outputs:
+  BootstrapContractVersion: { Value: '1' }
+  BootstrapTemplateRevision: { Value: '1.0-ecs' }
+  ArtifactBucketName: { Value: !Ref ArtifactBucket }
+  ArtifactBucketArn: { Value: !GetAtt ArtifactBucket.Arn }
+  CloudFormationExecutionRoleArn: { Value: !GetAtt CloudFormationExecutionRole.Arn }
+  ApplicationStackName: { Value: !Ref ApplicationStackName }

package/bootstrap/core-v1.yml

@@ -2,6 +2,11 @@ AWSTemplateFormatVersion: '2010-09-09'
 Description: Ze Great Dashboard bootstrap core v1. Administrator-managed; do not grant this authority to CI.
 
 Parameters:
+  ComputeMode:
+    Type: String
+    Default: lambda
+    AllowedValues: [lambda]
+    Description: Persistent application compute mode for this bootstrap
   ArtifactBucketName:
     Type: String
     Description: Globally unique bucket for private Lambda artifacts
@@ -123,7 +128,7 @@ Resources:
 
 Outputs:
   BootstrapContractVersion: { Value: '1' }
-  BootstrapTemplateRevision: { Value: '1.2' }
+  BootstrapTemplateRevision: { Value: '1.3' }
   ArtifactBucketName: { Value: !Ref ArtifactBucket }
   ArtifactBucketArn: { Value: !GetAtt ArtifactBucket.Arn }
   CloudFormationExecutionRoleArn: { Value: !GetAtt CloudFormationExecutionRole.Arn }

package/bootstrap/dashboard-bootstrap.example.json

@@ -1,4 +1,5 @@
 {
+  "mode": "lambda",
   "region": "us-east-1",
   "core": {
     "stackName": "team-dashboard-bootstrap",

package/bootstrap/github-oidc-ecs-v1.yml

@@ -0,0 +1,39 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: Ze Great Dashboard GitHub OIDC adapter for ECS deployments.
+Parameters:
+  ComputeMode: { Type: String, Default: ecs, AllowedValues: [ecs] }
+  GitHubOidcProviderArn: { Type: String }
+  GitHubRepository: { Type: String }
+  GitHubOwnerId: { Type: String }
+  GitHubRepositoryId: { Type: String }
+  GitHubEnvironment: { Type: String }
+  CoreBootstrapStackName: { Type: String }
+  ApplicationStackName: { Type: String }
+  ArtifactBucketName: { Type: String }
+  CloudFormationExecutionRoleArn: { Type: String }
+Resources:
+  GitHubDeployRole:
+    Type: AWS::IAM::Role
+    Properties:
+      RoleName: !Sub '${ApplicationStackName}-github-deploy'
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement: [{ Effect: Allow, Principal: { Federated: !Ref GitHubOidcProviderArn }, Action: sts:AssumeRoleWithWebIdentity }]
+      Policies:
+        - PolicyName: DeployOneEcsApplication
+          PolicyDocument:
+            Version: '2012-10-17'
+            Statement:
+              - Sid: OperateOneApplicationStack
+                Effect: Allow
+                Action: [cloudformation:CreateChangeSet, cloudformation:DescribeChangeSet, cloudformation:ExecuteChangeSet, cloudformation:DeleteChangeSet, cloudformation:DescribeStacks, cloudformation:GetTemplate, cloudformation:GetTemplateSummary]
+                Resource: !Sub 'arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${ApplicationStackName}/*'
+              - Sid: PassCoreExecutionRole
+                Effect: Allow
+                Action: iam:PassRole
+                Resource: !Ref CloudFormationExecutionRoleArn
+                Condition: { StringEquals: { 'iam:PassedToService': cloudformation.amazonaws.com } }
+Outputs:
+  BootstrapContractVersion: { Value: '1' }
+  BootstrapTemplateRevision: { Value: '1.0-ecs' }
+  GitHubDeployRoleArn: { Value: !GetAtt GitHubDeployRole.Arn }

package/bootstrap/github-oidc-v2.yml

@@ -2,6 +2,11 @@ AWSTemplateFormatVersion: '2010-09-09'
 Description: Ze Great Dashboard GitHub OIDC adapter v2. Administrator-managed; requires a central OIDC provider.
 
 Parameters:
+  ComputeMode:
+    Type: String
+    Default: lambda
+    AllowedValues: [lambda]
+    Description: Persistent application compute mode for this bootstrap
   GitHubOidcProviderArn: { Type: String }
   GitHubRepository: { Type: String, Description: owner/repository }
   GitHubOwnerId: { Type: String, Description: Immutable numeric GitHub owner id }
@@ -97,5 +102,5 @@ Resources:
 
 Outputs:
   BootstrapContractVersion: { Value: '2' }
-  BootstrapTemplateRevision: { Value: '2.2' }
+  BootstrapTemplateRevision: { Value: '2.3' }
   GitHubDeployRoleArn: { Value: !GetAtt GitHubDeployRole.Arn }

package/dist/bootstrap.d.ts

@@ -1,3 +1,5 @@
+import { type ComputeMode } from './compute-mode.js';
+export { type ComputeMode, computeMode, resolveComputeMode } from './compute-mode.js';
 export type BootstrapKind = 'core' | 'github-oidc';
 export type CloudFormationParameterValue = {
     ParameterKey: string;
@@ -15,6 +17,8 @@ export type DeployedBootstrapStack = {
     }[];
 };
 export type BootstrapConfig = {
+    /** Omitted in older manifests; Lambda is the compatibility default. */
+    mode?: ComputeMode;
     region?: string;
     core?: {
         stackName?: string;
@@ -56,8 +60,9 @@ export type BootstrapConsistency = {
     ok: boolean;
     mismatches: string[];
 };
-export declare function bootstrapTemplatePath(kind: BootstrapKind): Promise<string>;
-export declare function bootstrapTemplate(kind: BootstrapKind): Promise<string>;
+export declare function requireComputeMode(persisted: Pick<BootstrapConfig, 'mode'>, explicit?: string): ComputeMode;
+export declare function bootstrapTemplatePath(kind: BootstrapKind, mode?: ComputeMode): Promise<string>;
+export declare function bootstrapTemplate(kind: BootstrapKind, mode?: ComputeMode): Promise<string>;
 export declare function bootstrapContractVersion(template: string): string;
 export declare function bootstrapTemplateRevision(template: string): string;
 /** Returns installed templates and a reviewable, non-secret plan without external calls. */