@digitraffic/common 2024.1.24-3 → 2024.3.11-1

package/src/aws/infra/scheduler.mts

@@ -1,59 +0,0 @@
-import { Rule, Schedule } from "aws-cdk-lib/aws-events";
-import { Duration } from "aws-cdk-lib";
-import { LambdaFunction } from "aws-cdk-lib/aws-events-targets";
-import { Function as AWSFunction } from "aws-cdk-lib/aws-lambda";
-import { Construct } from "constructs";
-
-export class Scheduler extends Rule {
-    constructor(
-        stack: Construct,
-        ruleName: string,
-        schedule: Schedule,
-        lambda?: AWSFunction
-    ) {
-        super(stack, ruleName, { ruleName, schedule });
-
-        if (lambda) {
-            this.addTarget(new LambdaFunction(lambda));
-        }
-    }
-
-    static everyMinute(
-        stack: Construct,
-        ruleName: string,
-        lambda?: AWSFunction
-    ) {
-        return Scheduler.every(stack, ruleName, Duration.minutes(1), lambda);
-    }
-
-    static everyMinutes(
-        stack: Construct,
-        ruleName: string,
-        minutes: number,
-        lambda?: AWSFunction
-    ) {
-        return Scheduler.every(
-            stack,
-            ruleName,
-            Duration.minutes(minutes),
-            lambda
-        );
-    }
-
-    static everyHour(stack: Construct, ruleName: string, lambda?: AWSFunction) {
-        return Scheduler.every(stack, ruleName, Duration.hours(1), lambda);
-    }
-
-    static everyDay(stack: Construct, ruleName: string, lambda?: AWSFunction) {
-        return Scheduler.every(stack, ruleName, Duration.days(1), lambda);
-    }
-
-    static every(
-        stack: Construct,
-        ruleName: string,
-        duration: Duration,
-        lambda?: AWSFunction
-    ) {
-        return new Scheduler(stack, ruleName, Schedule.rate(duration), lambda);
-    }
-}

package/src/aws/infra/security-rule.mts

@@ -1,38 +0,0 @@
-import {Construct} from "constructs";
-import {Rule} from "aws-cdk-lib/aws-events";
-import {ITopic} from "aws-cdk-lib/aws-sns";
-import {SnsTopic} from "aws-cdk-lib/aws-events-targets";
-
-/**
- * Automatic rule for Security Hub.  Send notification to given topic if the following conditions apply:
- * * There is a finding with a status of NEW
- * * It has severity of HIGH or CRITICAL
- * * It is in a FAILED state
- */
-export class DigitrafficSecurityRule extends Rule {
-    constructor(scope: Construct, topic: ITopic) {
-        const ruleName = 'SecurityHubRule';
-        super(scope, ruleName, {
-            ruleName,
-            eventPattern: {
-                source: ['aws.securityhub'],
-                detailType: ["Security Hub Findings - Imported"],
-                detail: {
-                    findings: {
-                        "Compliance": {
-                            "Status": ["FAILED"],
-                        },
-                        "Workflow": {
-                            "Status": ["NEW"],
-                        },
-                        "Severity": {
-                            "Label": ["HIGH", "CRITICAL"],
-                        },
-                    },
-                },
-            },
-        });
-
-        this.addTarget(new SnsTopic(topic));
-    }
-}

package/src/aws/infra/sqs-integration.mts

@@ -1,106 +0,0 @@
-import { Aws } from "aws-cdk-lib";
-import {
-    AwsIntegration,
-    PassthroughBehavior,
-    RequestValidator,
-    Resource,
-  IModel
-} from "aws-cdk-lib/aws-apigateway";
-import { Queue } from "aws-cdk-lib/aws-sqs";
-import { PolicyStatement, Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
-import { Construct } from "constructs";
-
-export function attachQueueToApiGatewayResource(
-    stack: Construct,
-    queue: Queue,
-    resource: Resource,
-    requestValidator: RequestValidator,
-    resourceName: string,
-    apiKeyRequired: boolean,
-    requestModels?: Record<string, IModel>
-) {
-    // role for API Gateway
-    const apiGwRole = new Role(stack, `${resourceName}APIGatewayToSQSRole`, {
-        assumedBy: new ServicePrincipal("apigateway.amazonaws.com"),
-    });
-    // grants API Gateway the right to send SQS messages
-    apiGwRole.addToPolicy(
-        new PolicyStatement({
-            resources: [queue.queueArn],
-            actions: ["sqs:SendMessage"],
-        })
-    );
-    // grants API Gateway the right write CloudWatch Logs
-    apiGwRole.addToPolicy(
-        new PolicyStatement({
-            resources: ["*"],
-            actions: [
-                "logs:CreateLogGroup",
-                "logs:CreateLogStream",
-                "logs:DescribeLogGroups",
-                "logs:DescribeLogStreams",
-                "logs:PutLogEvents",
-                "logs:GetLogEvents",
-                "logs:FilterLogEvents",
-            ],
-        })
-    );
-    // create an integration between API Gateway and an SQS queue
-    const fifoMessageGroupId = queue.fifo
-        ? "&MessageGroupId=AlwaysSameFifoGroup"
-        : "";
-    const sqsIntegration = new AwsIntegration({
-        service: "sqs",
-        integrationHttpMethod: "POST",
-        options: {
-            passthroughBehavior: PassthroughBehavior.NEVER,
-            credentialsRole: apiGwRole,
-            requestParameters: {
-                // SQS requires the Content-Type of the HTTP request to be application/x-www-form-urlencoded
-                "integration.request.header.Content-Type":
-                    "'application/x-www-form-urlencoded'",
-            },
-            requestTemplates: {
-                // map the JSON request to a form parameter, FIFO needs also MessageGroupId
-                // https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SendMessage.html
-                "application/json": `Action=SendMessage${fifoMessageGroupId}&MessageBody=$util.urlEncode($input.body)`,
-            },
-            // these are required by SQS
-            integrationResponses: [
-                {
-                    statusCode: "200",
-                    responseTemplates: {
-                        "text/html": "Success",
-                    },
-                },
-                {
-                    statusCode: "500",
-                    responseTemplates: {
-                        "text/html": "Error",
-                    },
-                    selectionPattern: "500",
-                },
-            ],
-        },
-        path: `${Aws.ACCOUNT_ID}/${queue.queueName}`,
-    });
-    resource.addMethod("POST", sqsIntegration, {
-        requestValidator,
-        apiKeyRequired,
-        requestModels: requestModels ?? {},
-        methodResponses: [
-            {
-                statusCode: "200",
-                responseParameters: {
-                    "method.response.header.Content-Type": true,
-                },
-            },
-            {
-                statusCode: "500",
-                responseParameters: {
-                    "method.response.header.Content-Type": true,
-                },
-            },
-        ],
-    });
-}

package/src/aws/infra/sqs-queue.mts

@@ -1,162 +0,0 @@
-import { Queue, QueueEncryption, QueueProps } from "aws-cdk-lib/aws-sqs";
-import { Duration } from "aws-cdk-lib";
-import { BlockPublicAccess, Bucket } from "aws-cdk-lib/aws-s3";
-import { PolicyStatement } from "aws-cdk-lib/aws-iam";
-import { InlineCode, Runtime } from "aws-cdk-lib/aws-lambda";
-import { RetentionDays } from "aws-cdk-lib/aws-logs";
-import { SqsEventSource } from "aws-cdk-lib/aws-lambda-event-sources";
-import { ComparisonOperator, TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
-import { SnsAction } from "aws-cdk-lib/aws-cloudwatch-actions";
-import { S3, S3Client } from "@aws-sdk/client-s3";
-import { Upload } from "@aws-sdk/lib-storage";
-import { SQSEvent, SQSHandler, SQSRecord } from "aws-lambda";
-import { DigitrafficStack } from "./stack/stack.mjs";
-import { MonitoredFunction } from "./stack/monitoredfunction.mjs";
-
-/**
- * Construct for creating SQS-queues.
- *
- * If you don't config your own deadLetterQueue, this will create a dlq for you, also a lambda function, a s3 bucket
- * and an alarm for the queue.  Anything that goes to the dlq will be written into the bucket and the alarm is activated.
- */
-export class DigitrafficSqsQueue extends Queue {
-    static create(stack: DigitrafficStack, name: string, props: QueueProps): DigitrafficSqsQueue {
-        const queueName = `${stack.configuration.shortName}-${name}-Queue`;
-        const queueProps = {
-            ...props,
-            ...{
-                encryption: QueueEncryption.KMS_MANAGED,
-                queueName,
-                deadLetterQueue: props.deadLetterQueue ?? {
-                    maxReceiveCount: 2,
-                    queue: DigitrafficDLQueue.create(stack, name),
-                },
-            },
-        };
-
-        return new DigitrafficSqsQueue(stack, queueName, queueProps);
-    }
-}
-
-export class DigitrafficDLQueue {
-    static create(stack: DigitrafficStack, name: string): DigitrafficSqsQueue {
-        const dlqName = `${stack.configuration.shortName}-${name}-DLQ`;
-
-        const dlq = new DigitrafficSqsQueue(stack, dlqName, {
-            queueName: dlqName,
-            visibilityTimeout: Duration.seconds(60),
-            encryption: QueueEncryption.KMS_MANAGED,
-        });
-
-        const dlqBucket = new Bucket(stack, `${dlqName}-Bucket`, {
-            blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
-        });
-
-        const dlqFunctionName = `${dlqName}-Function`;
-        const lambda = MonitoredFunction.create(stack, dlqFunctionName, {
-            runtime: Runtime.NODEJS_20_X,
-            logRetention: RetentionDays.ONE_YEAR,
-            functionName: dlqFunctionName,
-            code: getDlqCode(dlqBucket.bucketName),
-            timeout: Duration.seconds(10),
-            handler: "index.handler",
-            memorySize: 128,
-            reservedConcurrentExecutions: 1,
-        });
-
-        const statement = new PolicyStatement();
-        statement.addActions("s3:PutObject");
-        statement.addActions("s3:PutObjectAcl");
-        statement.addResources(dlqBucket.bucketArn + "/*");
-
-        lambda.addToRolePolicy(statement);
-        lambda.addEventSource(new SqsEventSource(dlq));
-
-        addDLQAlarm(stack, dlqName, dlq);
-
-        return dlq;
-    }
-}
-
-function addDLQAlarm(stack: DigitrafficStack, dlqName: string, dlq: Queue) {
-    const alarmName = `${dlqName}-Alarm`;
-    dlq.metricNumberOfMessagesReceived({
-        period: Duration.minutes(5),
-    })
-        .createAlarm(stack, alarmName, {
-            alarmName,
-            threshold: 0,
-            evaluationPeriods: 1,
-            treatMissingData: TreatMissingData.NOT_BREACHING,
-            comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
-        })
-        .addAlarmAction(new SnsAction(stack.warningTopic));
-}
-
-function getDlqCode(Bucket: string): InlineCode {
-    const functionBody = DLQ_LAMBDA_CODE.replace("__bucketName__", Bucket)
-        .replace("__upload__", uploadToS3.toString())
-        .replace("__doUpload__", doUpload.toString())
-        .replace("__handler__", createHandler().toString().substring(23)); // remove function handler() from signature
-
-    return new InlineCode(functionBody);
-}
-
-async function uploadToS3(s3: S3 | S3Client, Bucket: string, Body: string, Key: string): Promise<void> {
-    try {
-        console.info("writing %s to %s", Key, Bucket);
-        await doUpload(s3, Bucket, Body, Key);
-    } catch (error) {
-        console.warn(error);
-        console.warn("method=uploadToS3 retrying upload to bucket %s", Bucket);
-        try {
-            await doUpload(s3, Bucket, Body, Key);
-        } catch (e2) {
-            console.error("method=uploadToS3 failed retrying upload to bucket %s", Bucket);
-        }
-    }
-}
-
-async function doUpload(s3: S3 | S3Client, Bucket: string, Body: string, Key: string) {
-    try {
-        const upload = new Upload({
-            client: s3,
-            params: { Bucket, Key, Body },
-        });
-
-        await upload.done();
-    } catch (error) {
-        console.error(error);
-    }
-}
-
-// bucketName is unused, will be overridden in the actual lambda code below
-const bucketName = "";
-
-function createHandler(): SQSHandler {
-    return async function handler(event: SQSEvent): Promise<void> {
-
-        const millis = new Date().getTime();
-        await Promise.all(
-            event.Records.map((e: SQSRecord, idx: number) =>
-                uploadToS3(
-                    new S3(),
-                    bucketName,
-                    e.body,
-                    `dlq-${millis}-${idx}.json`
-                )
-            )
-        );
-    };
-}
-
-const DLQ_LAMBDA_CODE = `
-import { S3, S3Client } from "@aws-sdk/client-s3";
-import { Upload } from "@aws-sdk/lib-storage";
-const bucketName = "__bucketName__";
-
-__upload__
-__doUpload__
-
-exports.handler = async (event) => __handler__
-`;

package/src/aws/infra/stack/lambda-configs.mts

@@ -1,135 +0,0 @@
-import {
-    Architecture,
-    AssetCode,
-    Code,
-    FunctionProps,
-    Runtime,
-} from "aws-cdk-lib/aws-lambda";
-import { Duration } from "aws-cdk-lib";
-import { IVpc, SubnetSelection } from "aws-cdk-lib/aws-ec2";
-import { RetentionDays } from "aws-cdk-lib/aws-logs";
-import { Role } from "aws-cdk-lib/aws-iam";
-import { DigitrafficStack } from "./stack.mjs";
-import { MonitoredFunctionAlarmProps } from "./monitoredfunction.mjs";
-
-export type LambdaEnvironment = Record<string, string>;
-
-export type DBLambdaEnvironment = LambdaEnvironment & {
-    SECRET_ID?: string;
-    DB_APPLICATION: string;
-};
-
-export function databaseFunctionProps(
-    stack: DigitrafficStack,
-    environment: LambdaEnvironment,
-    lambdaName: string,
-    simpleLambdaName: string,
-    config?: Partial<FunctionParameters>,
-): FunctionProps {
-    const vpcSubnets = stack.vpc
-        ? {
-              subnets: stack.vpc.privateSubnets,
-          }
-        : undefined;
-
-    return {
-        ...lambdaFunctionProps(
-            stack,
-            environment,
-            lambdaName,
-            simpleLambdaName,
-            config,
-        ),
-        ...{
-            vpc: stack.vpc ?? undefined,
-            vpcSubnets,
-            securityGroup: stack.lambdaDbSg ?? undefined,
-        },
-    };
-}
-
-export function lambdaFunctionProps(
-    stack: DigitrafficStack,
-    environment: LambdaEnvironment,
-    lambdaName: string,
-    simpleLambdaName: string,
-    config?: Partial<FunctionParameters>,
-): FunctionProps {
-    return {
-        runtime: config?.runtime ?? Runtime.NODEJS_20_X,
-        architecture: config?.architecture ?? Architecture.ARM_64,
-        memorySize: config?.memorySize ?? 128,
-        functionName: lambdaName,
-        role: config?.role,
-        timeout: Duration.seconds(config?.timeout ?? 60),
-        logRetention: RetentionDays.ONE_YEAR,
-        reservedConcurrentExecutions: config?.reservedConcurrentExecutions ?? 2,
-        code: getAssetCode(simpleLambdaName, config?.singleLambda ?? false),
-        handler: `${simpleLambdaName}.handler`,
-        environment,
-    };
-}
-
-function getAssetCode(
-    simpleLambdaName: string,
-    isSingleLambda: boolean,
-): AssetCode {
-    const lambdaPath = isSingleLambda
-        ? `dist/lambda/`
-        : `dist/lambda/${simpleLambdaName}`;
-
-    return new AssetCode(lambdaPath);
-}
-
-export function defaultLambdaConfiguration(
-    config: FunctionParameters,
-): FunctionProps {
-    const props: FunctionProps = {
-        runtime: Runtime.NODEJS_20_X,
-        memorySize: config.memorySize ?? 128,
-        functionName: config.functionName,
-        handler: config.handler,
-        environment: config.environment ?? {},
-        logRetention: RetentionDays.ONE_YEAR,
-        reservedConcurrentExecutions: config.reservedConcurrentExecutions,
-        code: config.code,
-        role: config.role,
-        timeout: Duration.seconds(config.timeout ?? 10),
-    };
-    if (config.vpc) {
-        return {
-            ...props,
-            ...{
-                vpc: config.vpc,
-                vpcSubnets: {
-                    subnets: config.vpc.privateSubnets,
-                },
-            },
-        };
-    }
-    return props;
-}
-
-export interface FunctionParameters {
-    memorySize?: number;
-    timeout?: number;
-    functionName?: string;
-    code: Code;
-    handler: string;
-    readOnly?: boolean;
-    environment?: Record<string, string>;
-    reservedConcurrentExecutions?: number;
-    role?: Role;
-    vpc?: IVpc;
-    vpcSubnets?: SubnetSelection;
-    runtime?: Runtime;
-    architecture?: Architecture;
-    singleLambda?: boolean;
-}
-
-export type MonitoredFunctionParameters = FunctionParameters & {
-    readonly durationAlarmProps?: MonitoredFunctionAlarmProps;
-    readonly durationWarningProps?: MonitoredFunctionAlarmProps;
-    readonly errorAlarmProps?: MonitoredFunctionAlarmProps;
-    readonly throttleAlarmProps?: MonitoredFunctionAlarmProps;
-};