@digitraffic/common 2023.1.18-1 → 2023.1.23-1

package/src/aws/infra/canaries/url-checker.ts

@@ -1,7 +1,7 @@
 import { IncomingMessage, RequestOptions } from "http";
 import { Asserter } from "../../../test/asserter";
 
-// eslint-disable-next-line @typescript-eslint/no-var-requires
+// eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-var-requires
 const synthetics = require("Synthetics");
 import zlib = require("zlib");
 import { MediaType } from "../../types/mediatypes";
@@ -19,12 +19,12 @@ const baseHeaders = {
     Accept: "*/*",
 } as Record<string, string>;
 
-type CheckerFunction = (Res: IncomingMessage) => void;
+type CheckerFunction = (Res: IncomingMessage) => Promise<void>;
 type JsonCheckerFunction<T> = (
     json: T,
     body: string,
     message: IncomingMessage
-) => void;
+) => Promise<void>;
 
 export class UrlChecker {
     private readonly requestOptions: RequestOptions;
@@ -43,8 +43,10 @@ export class UrlChecker {
             headers,
         };
 
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call
         synthetics.getConfiguration().disableRequestMetrics();
 
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call
         synthetics
             .getConfiguration()
             .withIncludeRequestBody(false)
@@ -79,6 +81,7 @@ export class UrlChecker {
             },
         };
 
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-return
         return synthetics.executeHttpStep(
             `Verify ${statusCode} for ${url.replace(/auth=.*/, "")}`,
             requestOptions,
@@ -109,6 +112,7 @@ export class UrlChecker {
             },
         };
 
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-return
         return synthetics.executeHttpStep(
             `Verify 404 for ${url}`,
             requestOptions,
@@ -124,6 +128,7 @@ export class UrlChecker {
             },
         };
 
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-return
         return synthetics.executeHttpStep(
             `Verify 400 for ${url}`,
             requestOptions,
@@ -133,6 +138,7 @@ export class UrlChecker {
 
     expect403WithoutApiKey(url: string, mediaType?: MediaType): Promise<void> {
         if (
+            // eslint-disable-next-line @typescript-eslint/prefer-optional-chain
             !this.requestOptions.headers ||
             !this.requestOptions.headers[API_KEY_HEADER]
         ) {
@@ -147,6 +153,7 @@ export class UrlChecker {
             },
         };
 
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-return
         return synthetics.executeHttpStep(
             `Verify 403 for ${url}`,
             requestOptions,
@@ -202,12 +209,14 @@ function validateStatusCodeAndContentType(
     return (res: IncomingMessage) => {
         return new Promise((resolve) => {
             if (res.statusCode !== statusCode) {
-                throw new Error(`${res.statusCode} ${res.statusMessage}`);
+                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                throw new Error(`${res.statusCode!} ${res.statusMessage!}`);
             }
 
             if (res.headers["content-type"] !== contentType) {
                 throw new Error(
-                    "Wrong content-type " + res.headers["content-type"]
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    `Wrong content-type ${res.headers["content-type"]!}`
                 );
             }
 
@@ -251,7 +260,7 @@ export class ResponseChecker {
         fn: (json: T, body: string, res: IncomingMessage) => void
     ): CheckerFunction {
         return this.responseChecker((body: string, res: IncomingMessage) => {
-            fn(JSON.parse(body), body, res);
+            fn(JSON.parse(body) as unknown as T, body, res);
         });
     }
 
@@ -264,7 +273,8 @@ export class ResponseChecker {
             }
 
             if (res.statusCode < 200 || res.statusCode > 299) {
-                throw new Error(`${res.statusCode} ${res.statusMessage}`);
+                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                throw new Error(`${res.statusCode} ${res.statusMessage!}`);
             }
 
             if (this.checkCors && !res.headers["access-control-allow-origin"]) {
@@ -273,7 +283,8 @@ export class ResponseChecker {
 
             if (res.headers["content-type"] !== this.contentType) {
                 throw new Error(
-                    "Wrong content-type " + res.headers["content-type"]
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    `Wrong content-type ${res.headers["content-type"]!}`
                 );
             }
 
@@ -291,7 +302,7 @@ export class ContentChecker {
         return async (res: IncomingMessage): Promise<void> => {
             const body = await getResponseBody(res);
 
-            fn(JSON.parse(body), body, res);
+            fn(JSON.parse(body) as unknown as T, body, res);
         };
     }
 
@@ -314,7 +325,8 @@ export class ContentTypeChecker {
             }
 
             if (res.statusCode < 200 || res.statusCode > 299) {
-                throw new Error(`${res.statusCode} ${res.statusMessage}`);
+                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                throw new Error(`${res.statusCode} ${res.statusMessage!}`);
             }
 
             if (!res.headers["access-control-allow-origin"]) {
@@ -323,7 +335,8 @@ export class ContentTypeChecker {
 
             if (res.headers["content-type"] !== contentType) {
                 throw new Error(
-                    "Wrong content-type " + res.headers["content-type"]
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    `Wrong content-type ${res.headers["content-type"]!}`
                 );
             }
         };
@@ -353,6 +366,8 @@ export class HeaderChecker {
             if (!res.headers[headerName]) {
                 throw new Error("Missing header: " + headerName);
             }
+
+            return Promise.resolve();
         };
     }
 
@@ -361,6 +376,8 @@ export class HeaderChecker {
             if (res.headers[headerName]) {
                 throw new Error("Header should not exist: " + headerName);
             }
+
+            return Promise.resolve();
         };
     }
 }

package/src/aws/infra/sqs-integration.ts

@@ -1,9 +1,14 @@
-import {Aws} from "aws-cdk-lib";
-import {AwsIntegration, PassthroughBehavior, RequestValidator, Resource} from "aws-cdk-lib/aws-apigateway";
-import {Queue} from "aws-cdk-lib/aws-sqs";
-import {PolicyStatement, Role, ServicePrincipal} from "aws-cdk-lib/aws-iam";
-import {IModel} from "aws-cdk-lib/aws-apigateway/lib/model";
-import {Construct} from "constructs";
+import { Aws } from "aws-cdk-lib";
+import {
+    AwsIntegration,
+    PassthroughBehavior,
+    RequestValidator,
+    Resource,
+} from "aws-cdk-lib/aws-apigateway";
+import { Queue } from "aws-cdk-lib/aws-sqs";
+import { PolicyStatement, Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { IModel } from "aws-cdk-lib/aws-apigateway/lib/model";
+import { Construct } from "constructs";
 
 export function attachQueueToApiGatewayResource(
     stack: Construct,
@@ -12,89 +17,88 @@ export function attachQueueToApiGatewayResource(
     requestValidator: RequestValidator,
     resourceName: string,
     apiKeyRequired: boolean,
-    requestModels?: {[param: string]: IModel},
+    requestModels?: Record<string, IModel>
 ) {
     // role for API Gateway
     const apiGwRole = new Role(stack, `${resourceName}APIGatewayToSQSRole`, {
-        assumedBy: new ServicePrincipal('apigateway.amazonaws.com'),
+        assumedBy: new ServicePrincipal("apigateway.amazonaws.com"),
     });
     // grants API Gateway the right to send SQS messages
-    apiGwRole.addToPolicy(new PolicyStatement({
-        resources: [
-            queue.queueArn,
-        ],
-        actions: [
-            'sqs:SendMessage',
-        ],
-    }));
+    apiGwRole.addToPolicy(
+        new PolicyStatement({
+            resources: [queue.queueArn],
+            actions: ["sqs:SendMessage"],
+        })
+    );
     // grants API Gateway the right write CloudWatch Logs
-    apiGwRole.addToPolicy(new PolicyStatement({
-        resources: [
-            '*',
-        ],
-        actions: [
-            'logs:CreateLogGroup',
-            'logs:CreateLogStream',
-            'logs:DescribeLogGroups',
-            'logs:DescribeLogStreams',
-            'logs:PutLogEvents',
-            'logs:GetLogEvents',
-            'logs:FilterLogEvents',
-        ],
-    }));
+    apiGwRole.addToPolicy(
+        new PolicyStatement({
+            resources: ["*"],
+            actions: [
+                "logs:CreateLogGroup",
+                "logs:CreateLogStream",
+                "logs:DescribeLogGroups",
+                "logs:DescribeLogStreams",
+                "logs:PutLogEvents",
+                "logs:GetLogEvents",
+                "logs:FilterLogEvents",
+            ],
+        })
+    );
     // create an integration between API Gateway and an SQS queue
-    const fifoMessageGroupId = queue.fifo ? '&MessageGroupId=AlwaysSameFifoGroup' : '';
+    const fifoMessageGroupId = queue.fifo
+        ? "&MessageGroupId=AlwaysSameFifoGroup"
+        : "";
     const sqsIntegration = new AwsIntegration({
-        service: 'sqs',
-        integrationHttpMethod: 'POST',
+        service: "sqs",
+        integrationHttpMethod: "POST",
         options: {
             passthroughBehavior: PassthroughBehavior.NEVER,
             credentialsRole: apiGwRole,
             requestParameters: {
                 // SQS requires the Content-Type of the HTTP request to be application/x-www-form-urlencoded
-                'integration.request.header.Content-Type': "'application/x-www-form-urlencoded'",
+                "integration.request.header.Content-Type":
+                    "'application/x-www-form-urlencoded'",
             },
             requestTemplates: {
                 // map the JSON request to a form parameter, FIFO needs also MessageGroupId
                 // https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SendMessage.html
-                'application/json': `Action=SendMessage${fifoMessageGroupId}&MessageBody=$util.urlEncode($input.body)`,
+                "application/json": `Action=SendMessage${fifoMessageGroupId}&MessageBody=$util.urlEncode($input.body)`,
             },
             // these are required by SQS
             integrationResponses: [
                 {
-                    statusCode: '200',
+                    statusCode: "200",
                     responseTemplates: {
-                        'text/html': 'Success',
+                        "text/html": "Success",
                     },
                 },
                 {
-                    statusCode: '500',
+                    statusCode: "500",
                     responseTemplates: {
-                        'text/html': 'Error',
+                        "text/html": "Error",
                     },
-                    selectionPattern: '500',
+                    selectionPattern: "500",
                 },
-
             ],
-
         },
         path: `${Aws.ACCOUNT_ID}/${queue.queueName}`,
     });
-    resource.addMethod('POST', sqsIntegration, {
+    resource.addMethod("POST", sqsIntegration, {
         requestValidator,
         apiKeyRequired,
         requestModels: requestModels ?? {},
         methodResponses: [
             {
-                statusCode: '200',
+                statusCode: "200",
                 responseParameters: {
-                    'method.response.header.Content-Type': true,
+                    "method.response.header.Content-Type": true,
                 },
             },
             {
-                statusCode: '500',
+                statusCode: "500",
                 responseParameters: {
-                    'method.response.header.Content-Type': true,
+                    "method.response.header.Content-Type": true,
                 },
             },
         ],

package/src/aws/infra/sqs-queue.ts

@@ -1,18 +1,20 @@
-import {Queue, QueueEncryption, QueueProps} from "aws-cdk-lib/aws-sqs";
-import {Duration} from "aws-cdk-lib";
-import {BlockPublicAccess, Bucket} from "aws-cdk-lib/aws-s3";
-import {PolicyStatement} from "aws-cdk-lib/aws-iam";
-import {InlineCode, Runtime} from "aws-cdk-lib/aws-lambda";
-import {RetentionDays} from "aws-cdk-lib/aws-logs";
-import {SqsEventSource} from "aws-cdk-lib/aws-lambda-event-sources";
-import {ComparisonOperator, TreatMissingData} from "aws-cdk-lib/aws-cloudwatch";
-import {SnsAction} from "aws-cdk-lib/aws-cloudwatch-actions";
-import {ManagedUpload} from "aws-sdk/clients/s3";
-import {S3} from "aws-sdk";
-import {SQSEvent, SQSHandler, SQSRecord} from "aws-lambda";
-import {Construct} from "constructs";
-import {DigitrafficStack} from "./stack/stack";
-import {MonitoredFunction} from "./stack/monitoredfunction";
+import { Queue, QueueEncryption, QueueProps } from "aws-cdk-lib/aws-sqs";
+import { Duration } from "aws-cdk-lib";
+import { BlockPublicAccess, Bucket } from "aws-cdk-lib/aws-s3";
+import { PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { InlineCode, Runtime } from "aws-cdk-lib/aws-lambda";
+import { RetentionDays } from "aws-cdk-lib/aws-logs";
+import { SqsEventSource } from "aws-cdk-lib/aws-lambda-event-sources";
+import {
+    ComparisonOperator,
+    TreatMissingData,
+} from "aws-cdk-lib/aws-cloudwatch";
+import { SnsAction } from "aws-cdk-lib/aws-cloudwatch-actions";
+import { ManagedUpload } from "aws-sdk/clients/s3";
+import { S3 } from "aws-sdk";
+import { SQSEvent, SQSHandler, SQSRecord } from "aws-lambda";
+import { DigitrafficStack } from "./stack/stack";
+import { MonitoredFunction } from "./stack/monitoredfunction";
 
 /**
  * Construct for creating SQS-queues.
@@ -21,20 +23,23 @@ import {MonitoredFunction} from "./stack/monitoredfunction";
  * and an alarm for the queue.  Anything that goes to the dlq will be written into the bucket and the alarm is activated.
  */
 export class DigitrafficSqsQueue extends Queue {
-    constructor(scope: Construct, name: string, props: QueueProps) {
-        super(scope, name, props);
-    }
-
-    static create(stack: DigitrafficStack, name: string, props: QueueProps): DigitrafficSqsQueue {
+    static create(
+        stack: DigitrafficStack,
+        name: string,
+        props: QueueProps
+    ): DigitrafficSqsQueue {
         const queueName = `${stack.configuration.shortName}-${name}-Queue`;
-        const queueProps = {...props, ...{
-            encryption: QueueEncryption.KMS_MANAGED,
-            queueName,
-            deadLetterQueue: props.deadLetterQueue || {
-                maxReceiveCount: 2,
-                queue: DigitrafficDLQueue.create(stack, name),
+        const queueProps = {
+            ...props,
+            ...{
+                encryption: QueueEncryption.KMS_MANAGED,
+                queueName,
+                deadLetterQueue: props.deadLetterQueue ?? {
+                    maxReceiveCount: 2,
+                    queue: DigitrafficDLQueue.create(stack, name),
+                },
             },
-        }};
+        };
 
         return new DigitrafficSqsQueue(stack, queueName, queueProps);
     }
@@ -61,15 +66,15 @@ export class DigitrafficDLQueue {
             functionName: dlqFunctionName,
             code: getDlqCode(dlqBucket.bucketName),
             timeout: Duration.seconds(10),
-            handler: 'index.handler',
+            handler: "index.handler",
             memorySize: 128,
             reservedConcurrentExecutions: 1,
         });
 
         const statement = new PolicyStatement();
-        statement.addActions('s3:PutObject');
-        statement.addActions('s3:PutObjectAcl');
-        statement.addResources(dlqBucket.bucketArn + '/*');
+        statement.addActions("s3:PutObject");
+        statement.addActions("s3:PutObjectAcl");
+        statement.addResources(dlqBucket.bucketArn + "/*");
 
         lambda.addToRolePolicy(statement);
         lambda.addEventSource(new SqsEventSource(dlq));
@@ -84,18 +89,19 @@ function addDLQAlarm(stack: DigitrafficStack, dlqName: string, dlq: Queue) {
     const alarmName = `${dlqName}-Alarm`;
     dlq.metricNumberOfMessagesReceived({
         period: Duration.minutes(5),
-    }).createAlarm(stack, alarmName, {
-        alarmName,
-        threshold: 0,
-        evaluationPeriods: 1,
-        treatMissingData: TreatMissingData.NOT_BREACHING,
-        comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
-    }).addAlarmAction(new SnsAction(stack.warningTopic));
+    })
+        .createAlarm(stack, alarmName, {
+            alarmName,
+            threshold: 0,
+            evaluationPeriods: 1,
+            treatMissingData: TreatMissingData.NOT_BREACHING,
+            comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
+        })
+        .addAlarmAction(new SnsAction(stack.warningTopic));
 }
 
 function getDlqCode(bName: string): InlineCode {
-    const functionBody = DLQ_LAMBDA_CODE
-        .replace("__bucketName__", bName)
+    const functionBody = DLQ_LAMBDA_CODE.replace("__bucketName__", bName)
         .replace("__upload__", uploadToS3.toString())
         .replace("__doUpload__", doUpload.toString())
         .replace("__handler__", createHandler().toString().substring(23)); // remove function handler() from signature
@@ -103,38 +109,64 @@ function getDlqCode(bName: string): InlineCode {
     return new InlineCode(functionBody);
 }
 
-async function uploadToS3(s3: S3, bName: string, body: string, objectName: string): Promise<void> {
+async function uploadToS3(
+    s3: S3,
+    bName: string,
+    body: string,
+    objectName: string
+): Promise<void> {
     try {
-        console.info('writing %s to %s', objectName, bName);
+        console.info("writing %s to %s", objectName, bName);
         await doUpload(s3, bName, body, objectName);
     } catch (error) {
         console.warn(error);
-        console.warn('method=uploadToS3 retrying upload to bucket %s', bName);
+        console.warn("method=uploadToS3 retrying upload to bucket %s", bName);
         try {
             await doUpload(s3, bName, body, objectName);
         } catch (e2) {
-            console.error('method=uploadToS3 failed retrying upload to bucket %s', bName);
+            console.error(
+                "method=uploadToS3 failed retrying upload to bucket %s",
+                bName
+            );
         }
     }
 }
 
-function doUpload(s3: S3, bName: string, Body: string, Key: string): Promise<ManagedUpload.SendData> {
-    return s3.upload({
-        Bucket: bName, Body, Key,
-    }).promise();
+function doUpload(
+    s3: S3,
+    bName: string,
+    Body: string,
+    Key: string
+): Promise<ManagedUpload.SendData> {
+    return s3
+        .upload({
+            Bucket: bName,
+            Body,
+            Key,
+        })
+        .promise();
 }
 
 // bucketName is unused, will be overridden in the actual lambda code below
-const bucketName = '';
+const bucketName = "";
 
 function createHandler(): SQSHandler {
     return async function handler(event: SQSEvent): Promise<void> {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const AWS = require('aws-sdk');
+        // eslint-disable-next-line @typescript-eslint/no-var-requires, @typescript-eslint/no-unsafe-assignment
+        const AWS = require("aws-sdk");
 
         const millis = new Date().getTime();
-        await Promise.all(event.Records.map((e: SQSRecord, idx: number) =>
-            uploadToS3(new AWS.S3(), bucketName, e.body, `dlq-${millis}-${idx}.json`)));
+        await Promise.all(
+            event.Records.map((e: SQSRecord, idx: number) =>
+                uploadToS3(
+                    // eslint-disable-next-line @typescript-eslint/no-unsafe-argument, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-member-access
+                    new AWS.S3(),
+                    bucketName,
+                    e.body,
+                    `dlq-${millis}-${idx}.json`
+                )
+            )
+        );
     };
 }
 

package/src/aws/infra/stack/lambda-configs.ts

@@ -6,7 +6,7 @@ import {
     Runtime,
 } from "aws-cdk-lib/aws-lambda";
 import { Duration } from "aws-cdk-lib";
-import { ISecurityGroup, IVpc, SubnetSelection } from "aws-cdk-lib/aws-ec2";
+import { IVpc, SubnetSelection } from "aws-cdk-lib/aws-ec2";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
 import { Role } from "aws-cdk-lib/aws-iam";
 import { DigitrafficStack } from "./stack";
@@ -19,26 +19,6 @@ export type DBLambdaEnvironment = LambdaEnvironment & {
     DB_APPLICATION: string;
 };
 
-export interface LambdaConfiguration {
-    vpcId: string;
-    allowFromIpAddresses?: string[];
-    privateSubnetIds: string[];
-    availabilityZones: string[];
-    lambdaDbSgId: string;
-    dbProps?: DbProps;
-    defaultLambdaDurationSeconds?: number;
-    logsDestinationArn: string;
-    memorySize?: number;
-    runtime?: Runtime;
-}
-
-declare interface DbProps {
-    username: string;
-    password: string;
-    uri?: string;
-    ro_uri?: string;
-}
-
 export function databaseFunctionProps(
     stack: DigitrafficStack,
     environment: LambdaEnvironment,
@@ -61,9 +41,9 @@ export function databaseFunctionProps(
             config
         ),
         ...{
-            vpc: stack.vpc || undefined,
+            vpc: stack.vpc ?? undefined,
             vpcSubnets,
-            securityGroup: stack.lambdaDbSg || undefined,
+            securityGroup: stack.lambdaDbSg ?? undefined,
         },
     };
 }
@@ -101,47 +81,6 @@ function getAssetCode(
     return new AssetCode(lambdaPath);
 }
 
-/**
- * Creates a base configuration for a Lambda that uses an RDS database
- * @param vpc "Private" Lambdas are associated with a VPC
- * @param lambdaDbSg Security Group shared by Lambda and RDS
- * @param props Database connection properties for the Lambda
- * @param config Lambda configuration
- */
-export function dbLambdaConfiguration(
-    vpc: IVpc,
-    lambdaDbSg: ISecurityGroup,
-    props: LambdaConfiguration,
-    config: FunctionParameters
-): FunctionProps {
-    return {
-        runtime: props.runtime ?? Runtime.NODEJS_16_X,
-        memorySize: props.memorySize ?? config.memorySize ?? 1024,
-        functionName: config.functionName,
-        code: config.code,
-        role: config.role,
-        handler: config.handler,
-        timeout: Duration.seconds(
-            config.timeout ?? props.defaultLambdaDurationSeconds ?? 60
-        ),
-        environment: config.environment ?? {
-            DB_USER: props.dbProps?.username ?? "",
-            DB_PASS: props.dbProps?.password ?? "",
-            DB_URI:
-                (config.readOnly
-                    ? props.dbProps?.ro_uri
-                    : props.dbProps?.uri) ?? "",
-        },
-        logRetention: RetentionDays.ONE_YEAR,
-        vpc: vpc,
-        vpcSubnets: {
-            subnets: vpc.privateSubnets,
-        },
-        securityGroups: [lambdaDbSg],
-        reservedConcurrentExecutions: config.reservedConcurrentExecutions ?? 3,
-    };
-}
-
 export function defaultLambdaConfiguration(
     config: FunctionParameters
 ): FunctionProps {
@@ -155,7 +94,7 @@ export function defaultLambdaConfiguration(
         reservedConcurrentExecutions: config.reservedConcurrentExecutions,
         code: config.code,
         role: config.role,
-        timeout: Duration.seconds(config.timeout || 10),
+        timeout: Duration.seconds(config.timeout ?? 10),
     };
     if (config.vpc) {
         return {
@@ -163,7 +102,7 @@ export function defaultLambdaConfiguration(
             ...{
                 vpc: config.vpc,
                 vpcSubnets: {
-                    subnets: config.vpc?.privateSubnets,
+                    subnets: config.vpc.privateSubnets,
                 },
             },
         };
@@ -178,9 +117,7 @@ export interface FunctionParameters {
     code: Code;
     handler: string;
     readOnly?: boolean;
-    environment?: {
-        [key: string]: string;
-    };
+    environment?: Record<string, string>;
     reservedConcurrentExecutions?: number;
     role?: Role;
     vpc?: IVpc;

package/src/aws/infra/stack/monitoredfunction.ts

@@ -82,7 +82,8 @@ export class MonitoredFunction extends Function {
             stack.configuration.production
         ) {
             throw new Error(
-                `Function ${functionProps.functionName} has DISABLE_ALARMS.  Remove before installing to production or define your own properties!`
+                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                `Function ${functionProps.functionName!} has DISABLE_ALARMS.  Remove before installing to production or define your own properties!`
             );
         }
 

package/src/aws/infra/stacks/db-stack.ts

@@ -139,7 +139,7 @@ export class DbStack extends Stack {
                 vpc,
                 securityGroups: [securityGroup],
                 vpcSubnets: {
-                    subnetType: SubnetType.PRIVATE_WITH_NAT,
+                    subnetType: SubnetType.PRIVATE_WITH_EGRESS,
                 },
                 instanceType: configuration.dbInstanceType,
                 parameterGroup,