@factiii/stack 0.1.33 → 0.1.35
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +441 -441
- package/bin/stack +46 -0
- package/dist/cli/fix.d.ts.map +1 -1
- package/dist/cli/fix.js +17 -11
- package/dist/cli/fix.js.map +1 -1
- package/dist/cli/init.d.ts.map +1 -1
- package/dist/cli/init.js +20 -7
- package/dist/cli/init.js.map +1 -1
- package/dist/cli/scan.d.ts.map +1 -1
- package/dist/cli/scan.js +14 -22
- package/dist/cli/scan.js.map +1 -1
- package/dist/generators/generate-stack-yml.d.ts +1 -1
- package/dist/generators/generate-stack-yml.d.ts.map +1 -1
- package/dist/generators/generate-stack-yml.js +96 -69
- package/dist/generators/generate-stack-yml.js.map +1 -1
- package/dist/plugins/addons/openclaw/index.d.ts +45 -0
- package/dist/plugins/addons/openclaw/index.d.ts.map +1 -0
- package/dist/plugins/addons/openclaw/index.js +107 -0
- package/dist/plugins/addons/openclaw/index.js.map +1 -0
- package/dist/plugins/addons/openclaw/scanfix/setup.d.ts +19 -0
- package/dist/plugins/addons/openclaw/scanfix/setup.d.ts.map +1 -0
- package/dist/plugins/addons/openclaw/scanfix/setup.js +441 -0
- package/dist/plugins/addons/openclaw/scanfix/setup.js.map +1 -0
- package/dist/plugins/frameworks/expo/index.d.ts +45 -0
- package/dist/plugins/frameworks/expo/index.d.ts.map +1 -0
- package/dist/plugins/frameworks/expo/index.js +549 -0
- package/dist/plugins/frameworks/expo/index.js.map +1 -0
- package/dist/plugins/frameworks/prisma-trpc/index.js +8 -8
- package/dist/plugins/frameworks/prisma-trpc/index.js.map +1 -1
- package/dist/plugins/index.d.ts.map +1 -1
- package/dist/plugins/index.js +16 -0
- package/dist/plugins/index.js.map +1 -1
- package/dist/plugins/pipelines/aws/index.js +15 -15
- package/dist/plugins/pipelines/aws/prod.js +7 -7
- package/dist/plugins/pipelines/aws/scanfix/aws-cli.d.ts +3 -1
- package/dist/plugins/pipelines/aws/scanfix/aws-cli.d.ts.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/aws-cli.js +17 -7
- package/dist/plugins/pipelines/aws/scanfix/aws-cli.js.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/config.js +4 -4
- package/dist/plugins/pipelines/aws/scanfix/config.js.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/credentials.d.ts +1 -1
- package/dist/plugins/pipelines/aws/scanfix/credentials.d.ts.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/credentials.js +30 -76
- package/dist/plugins/pipelines/aws/scanfix/credentials.js.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/db-replication.d.ts +1 -4
- package/dist/plugins/pipelines/aws/scanfix/db-replication.d.ts.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/db-replication.js +11 -41
- package/dist/plugins/pipelines/aws/scanfix/db-replication.js.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/ec2.d.ts +1 -0
- package/dist/plugins/pipelines/aws/scanfix/ec2.d.ts.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/ec2.js +64 -113
- package/dist/plugins/pipelines/aws/scanfix/ec2.js.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/ecr.d.ts +1 -0
- package/dist/plugins/pipelines/aws/scanfix/ecr.d.ts.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/ecr.js +27 -36
- package/dist/plugins/pipelines/aws/scanfix/ecr.js.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/iam.d.ts +1 -0
- package/dist/plugins/pipelines/aws/scanfix/iam.d.ts.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/iam.js +37 -46
- package/dist/plugins/pipelines/aws/scanfix/iam.js.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/rds.d.ts +1 -0
- package/dist/plugins/pipelines/aws/scanfix/rds.d.ts.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/rds.js +43 -108
- package/dist/plugins/pipelines/aws/scanfix/rds.js.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/s3.d.ts +1 -0
- package/dist/plugins/pipelines/aws/scanfix/s3.d.ts.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/s3.js +46 -55
- package/dist/plugins/pipelines/aws/scanfix/s3.js.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/security-groups.d.ts +1 -0
- package/dist/plugins/pipelines/aws/scanfix/security-groups.d.ts.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/security-groups.js +83 -82
- package/dist/plugins/pipelines/aws/scanfix/security-groups.js.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/ses.d.ts +1 -0
- package/dist/plugins/pipelines/aws/scanfix/ses.d.ts.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/ses.js +31 -53
- package/dist/plugins/pipelines/aws/scanfix/ses.js.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/ssh-bridge.d.ts +17 -0
- package/dist/plugins/pipelines/aws/scanfix/ssh-bridge.d.ts.map +1 -0
- package/dist/plugins/pipelines/aws/scanfix/ssh-bridge.js +180 -0
- package/dist/plugins/pipelines/aws/scanfix/ssh-bridge.js.map +1 -0
- package/dist/plugins/pipelines/aws/scanfix/vpc.d.ts +1 -0
- package/dist/plugins/pipelines/aws/scanfix/vpc.d.ts.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/vpc.js +97 -98
- package/dist/plugins/pipelines/aws/scanfix/vpc.js.map +1 -1
- package/dist/plugins/pipelines/aws/utils/aws-helpers.d.ts +101 -28
- package/dist/plugins/pipelines/aws/utils/aws-helpers.d.ts.map +1 -1
- package/dist/plugins/pipelines/aws/utils/aws-helpers.js +428 -76
- package/dist/plugins/pipelines/aws/utils/aws-helpers.js.map +1 -1
- package/dist/plugins/pipelines/factiii/index.d.ts +11 -1
- package/dist/plugins/pipelines/factiii/index.d.ts.map +1 -1
- package/dist/plugins/pipelines/factiii/index.js +183 -33
- package/dist/plugins/pipelines/factiii/index.js.map +1 -1
- package/dist/plugins/pipelines/factiii/scanfix/ansible.js +1 -1
- package/dist/plugins/pipelines/factiii/scanfix/ansible.js.map +1 -1
- package/dist/plugins/pipelines/factiii/scanfix/bootstrap.js +6 -6
- package/dist/plugins/pipelines/factiii/scanfix/bootstrap.js.map +1 -1
- package/dist/plugins/pipelines/factiii/scanfix/config.d.ts +1 -1
- package/dist/plugins/pipelines/factiii/scanfix/config.js +4 -4
- package/dist/plugins/pipelines/factiii/scanfix/config.js.map +1 -1
- package/dist/plugins/pipelines/factiii/scanfix/env-files.js +7 -7
- package/dist/plugins/pipelines/factiii/scanfix/env-files.js.map +1 -1
- package/dist/plugins/pipelines/factiii/scanfix/github-cli.js +1 -1
- package/dist/plugins/pipelines/factiii/scanfix/github-cli.js.map +1 -1
- package/dist/plugins/pipelines/factiii/scanfix/secrets.d.ts.map +1 -1
- package/dist/plugins/pipelines/factiii/scanfix/secrets.js +73 -13
- package/dist/plugins/pipelines/factiii/scanfix/secrets.js.map +1 -1
- package/dist/plugins/pipelines/factiii/scanfix/workflows.d.ts.map +1 -1
- package/dist/plugins/pipelines/factiii/scanfix/workflows.js +52 -4
- package/dist/plugins/pipelines/factiii/scanfix/workflows.js.map +1 -1
- package/dist/plugins/servers/mac/index.js +13 -13
- package/dist/plugins/servers/mac/scanfix/config.js +5 -5
- package/dist/plugins/servers/mac/scanfix/config.js.map +1 -1
- package/dist/plugins/servers/mac/scanfix/containers.js +1 -1
- package/dist/plugins/servers/mac/scanfix/containers.js.map +1 -1
- package/dist/plugins/servers/mac/scanfix/system.js +6 -6
- package/dist/plugins/servers/mac/scanfix/system.js.map +1 -1
- package/dist/plugins/servers/mac/staging.js +4 -4
- package/dist/plugins/servers/windows/index.js +2 -2
- package/dist/plugins/servers/windows/index.js.map +1 -1
- package/dist/scanfix/fixes/certbot.js +1 -1
- package/dist/scripts/validate-example-values.d.ts +1 -1
- package/dist/scripts/validate-example-values.js +6 -6
- package/dist/utils/config-helpers.d.ts +3 -0
- package/dist/utils/config-helpers.d.ts.map +1 -1
- package/dist/utils/config-helpers.js.map +1 -1
- package/dist/utils/secret-prompts.d.ts +5 -2
- package/dist/utils/secret-prompts.d.ts.map +1 -1
- package/dist/utils/secret-prompts.js +55 -32
- package/dist/utils/secret-prompts.js.map +1 -1
- package/dist/utils/template-generator.js +71 -71
- package/package.json +8 -1
|
@@ -4,84 +4,46 @@
|
|
|
4
4
|
*
|
|
5
5
|
* Provisions VPC, subnets, and internet gateway for AWS infrastructure.
|
|
6
6
|
* All resources are tagged with factiii:project={name} for identification.
|
|
7
|
+
* Uses AWS SDK v3 instead of CLI.
|
|
7
8
|
*/
|
|
8
9
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
9
10
|
exports.vpcFixes = void 0;
|
|
10
11
|
const aws_helpers_js_1 = require("../utils/aws-helpers.js");
|
|
11
|
-
/**
|
|
12
|
-
* Find VPC by factiii:project tag
|
|
13
|
-
*/
|
|
14
|
-
function findVpc(projectName, region) {
|
|
15
|
-
const result = (0, aws_helpers_js_1.awsExecSafe)('aws ec2 describe-vpcs --filters "Name=tag:factiii:project,Values=' + projectName + '" --query "Vpcs[0].VpcId" --output text', region);
|
|
16
|
-
if (!result || result === 'None' || result === 'null')
|
|
17
|
-
return null;
|
|
18
|
-
return result.replace(/"/g, '');
|
|
19
|
-
}
|
|
20
|
-
/**
|
|
21
|
-
* Find subnet by tag and type
|
|
22
|
-
*/
|
|
23
|
-
function findSubnet(projectName, region, type) {
|
|
24
|
-
const result = (0, aws_helpers_js_1.awsExecSafe)('aws ec2 describe-subnets --filters "Name=tag:factiii:project,Values=' + projectName + '" "Name=tag:factiii:subnet-type,Values=' + type + '" --query "Subnets[0].SubnetId" --output text', region);
|
|
25
|
-
if (!result || result === 'None' || result === 'null')
|
|
26
|
-
return null;
|
|
27
|
-
return result.replace(/"/g, '');
|
|
28
|
-
}
|
|
29
|
-
/**
|
|
30
|
-
* Find all private subnets
|
|
31
|
-
*/
|
|
32
|
-
function findPrivateSubnets(projectName, region) {
|
|
33
|
-
const result = (0, aws_helpers_js_1.awsExecSafe)('aws ec2 describe-subnets --filters "Name=tag:factiii:project,Values=' + projectName + '" "Name=tag:factiii:subnet-type,Values=private" --query "Subnets[*].SubnetId" --output text', region);
|
|
34
|
-
if (!result || result === 'None' || result === 'null')
|
|
35
|
-
return [];
|
|
36
|
-
return result.split(/\s+/).filter(Boolean);
|
|
37
|
-
}
|
|
38
|
-
/**
|
|
39
|
-
* Find internet gateway attached to VPC
|
|
40
|
-
*/
|
|
41
|
-
function findIgw(vpcId, region) {
|
|
42
|
-
const result = (0, aws_helpers_js_1.awsExecSafe)('aws ec2 describe-internet-gateways --filters "Name=attachment.vpc-id,Values=' + vpcId + '" --query "InternetGateways[0].InternetGatewayId" --output text', region);
|
|
43
|
-
if (!result || result === 'None' || result === 'null')
|
|
44
|
-
return null;
|
|
45
|
-
return result.replace(/"/g, '');
|
|
46
|
-
}
|
|
47
|
-
/**
|
|
48
|
-
* Check if AWS is configured for this project (skip fixes if not)
|
|
49
|
-
*/
|
|
50
|
-
function isAwsConfigured(config) {
|
|
51
|
-
if ((0, aws_helpers_js_1.isOnServer)())
|
|
52
|
-
return false;
|
|
53
|
-
if (config.aws)
|
|
54
|
-
return true;
|
|
55
|
-
// eslint-disable-next-line @typescript-eslint/no-require-imports
|
|
56
|
-
const { extractEnvironments } = require('../../../../utils/config-helpers.js');
|
|
57
|
-
const environments = extractEnvironments(config);
|
|
58
|
-
return Object.values(environments).some((e) => e.pipeline === 'aws');
|
|
59
|
-
}
|
|
60
12
|
exports.vpcFixes = [
|
|
61
13
|
{
|
|
62
14
|
id: 'aws-vpc-missing',
|
|
63
15
|
stage: 'prod',
|
|
64
16
|
severity: 'critical',
|
|
65
|
-
description: 'AWS VPC not created for this project',
|
|
17
|
+
description: '🌐 AWS VPC not created for this project',
|
|
66
18
|
scan: async (config) => {
|
|
67
|
-
if (!isAwsConfigured(config))
|
|
19
|
+
if (!(0, aws_helpers_js_1.isAwsConfigured)(config))
|
|
68
20
|
return false;
|
|
69
21
|
const { region } = (0, aws_helpers_js_1.getAwsConfig)(config);
|
|
70
22
|
const projectName = (0, aws_helpers_js_1.getProjectName)(config);
|
|
71
|
-
return !findVpc(projectName, region);
|
|
23
|
+
return !(await (0, aws_helpers_js_1.findVpc)(projectName, region));
|
|
72
24
|
},
|
|
73
25
|
fix: async (config) => {
|
|
74
26
|
const { region } = (0, aws_helpers_js_1.getAwsConfig)(config);
|
|
75
27
|
const projectName = (0, aws_helpers_js_1.getProjectName)(config);
|
|
76
28
|
try {
|
|
29
|
+
const ec2 = (0, aws_helpers_js_1.getEC2Client)(region);
|
|
77
30
|
// Create VPC
|
|
78
|
-
const vpcResult =
|
|
79
|
-
|
|
31
|
+
const vpcResult = await ec2.send(new aws_helpers_js_1.CreateVpcCommand({
|
|
32
|
+
CidrBlock: '10.0.0.0/16',
|
|
33
|
+
TagSpecifications: [(0, aws_helpers_js_1.tagSpec)('vpc', projectName)],
|
|
34
|
+
}));
|
|
35
|
+
const vpcId = vpcResult.Vpc?.VpcId;
|
|
80
36
|
console.log(' Created VPC: ' + vpcId);
|
|
81
37
|
// Enable DNS hostnames
|
|
82
|
-
(
|
|
38
|
+
await ec2.send(new aws_helpers_js_1.ModifyVpcAttributeCommand({
|
|
39
|
+
VpcId: vpcId,
|
|
40
|
+
EnableDnsHostnames: { Value: true },
|
|
41
|
+
}));
|
|
83
42
|
// Enable DNS support
|
|
84
|
-
(
|
|
43
|
+
await ec2.send(new aws_helpers_js_1.ModifyVpcAttributeCommand({
|
|
44
|
+
VpcId: vpcId,
|
|
45
|
+
EnableDnsSupport: { Value: true },
|
|
46
|
+
}));
|
|
85
47
|
console.log(' Enabled DNS hostnames and support');
|
|
86
48
|
return true;
|
|
87
49
|
}
|
|
@@ -96,34 +58,46 @@ exports.vpcFixes = [
|
|
|
96
58
|
id: 'aws-subnet-public-missing',
|
|
97
59
|
stage: 'prod',
|
|
98
60
|
severity: 'critical',
|
|
99
|
-
description: 'Public subnet not created (for EC2)',
|
|
61
|
+
description: '🌐 Public subnet not created (for EC2)',
|
|
100
62
|
scan: async (config) => {
|
|
101
|
-
if (!isAwsConfigured(config))
|
|
63
|
+
if (!(0, aws_helpers_js_1.isAwsConfigured)(config))
|
|
102
64
|
return false;
|
|
103
65
|
const { region } = (0, aws_helpers_js_1.getAwsConfig)(config);
|
|
104
66
|
const projectName = (0, aws_helpers_js_1.getProjectName)(config);
|
|
105
|
-
if (!findVpc(projectName, region))
|
|
106
|
-
return false;
|
|
107
|
-
return !findSubnet(projectName, region, 'public');
|
|
67
|
+
if (!(await (0, aws_helpers_js_1.findVpc)(projectName, region)))
|
|
68
|
+
return false;
|
|
69
|
+
return !(await (0, aws_helpers_js_1.findSubnet)(projectName, region, 'public'));
|
|
108
70
|
},
|
|
109
71
|
fix: async (config) => {
|
|
110
72
|
const { region } = (0, aws_helpers_js_1.getAwsConfig)(config);
|
|
111
73
|
const projectName = (0, aws_helpers_js_1.getProjectName)(config);
|
|
112
|
-
const vpcId = findVpc(projectName, region);
|
|
74
|
+
const vpcId = await (0, aws_helpers_js_1.findVpc)(projectName, region);
|
|
113
75
|
if (!vpcId) {
|
|
114
76
|
console.log(' VPC must be created first');
|
|
115
77
|
return false;
|
|
116
78
|
}
|
|
117
79
|
try {
|
|
80
|
+
const ec2 = (0, aws_helpers_js_1.getEC2Client)(region);
|
|
118
81
|
// Get first AZ
|
|
119
|
-
const azResult = (
|
|
120
|
-
const az = azResult.
|
|
82
|
+
const azResult = await ec2.send(new aws_helpers_js_1.DescribeAvailabilityZonesCommand({}));
|
|
83
|
+
const az = azResult.AvailabilityZones?.[0]?.ZoneName;
|
|
84
|
+
if (!az) {
|
|
85
|
+
console.log(' No availability zones found');
|
|
86
|
+
return false;
|
|
87
|
+
}
|
|
121
88
|
// Create public subnet
|
|
122
|
-
const subnetResult = (
|
|
123
|
-
|
|
124
|
-
|
|
89
|
+
const subnetResult = await ec2.send(new aws_helpers_js_1.CreateSubnetCommand({
|
|
90
|
+
VpcId: vpcId,
|
|
91
|
+
CidrBlock: '10.0.1.0/24',
|
|
92
|
+
AvailabilityZone: az,
|
|
93
|
+
TagSpecifications: [(0, aws_helpers_js_1.tagSpec)('subnet', projectName, { 'factiii:subnet-type': 'public' })],
|
|
94
|
+
}));
|
|
95
|
+
const subnetId = subnetResult.Subnet?.SubnetId;
|
|
125
96
|
// Enable auto-assign public IP
|
|
126
|
-
(
|
|
97
|
+
await ec2.send(new aws_helpers_js_1.ModifySubnetAttributeCommand({
|
|
98
|
+
SubnetId: subnetId,
|
|
99
|
+
MapPublicIpOnLaunch: { Value: true },
|
|
100
|
+
}));
|
|
127
101
|
console.log(' Created public subnet: ' + subnetId + ' in ' + az);
|
|
128
102
|
return true;
|
|
129
103
|
}
|
|
@@ -138,42 +112,51 @@ exports.vpcFixes = [
|
|
|
138
112
|
id: 'aws-subnet-private-missing',
|
|
139
113
|
stage: 'prod',
|
|
140
114
|
severity: 'critical',
|
|
141
|
-
description: 'Private subnets not created (for RDS)',
|
|
115
|
+
description: '🌐 Private subnets not created (for RDS)',
|
|
142
116
|
scan: async (config) => {
|
|
143
|
-
if (!isAwsConfigured(config))
|
|
117
|
+
if (!(0, aws_helpers_js_1.isAwsConfigured)(config))
|
|
144
118
|
return false;
|
|
145
119
|
const { region } = (0, aws_helpers_js_1.getAwsConfig)(config);
|
|
146
120
|
const projectName = (0, aws_helpers_js_1.getProjectName)(config);
|
|
147
|
-
if (!findVpc(projectName, region))
|
|
121
|
+
if (!(await (0, aws_helpers_js_1.findVpc)(projectName, region)))
|
|
148
122
|
return false;
|
|
149
|
-
const privateSubnets = findPrivateSubnets(projectName, region);
|
|
150
|
-
return privateSubnets.length < 2;
|
|
123
|
+
const privateSubnets = await (0, aws_helpers_js_1.findPrivateSubnets)(projectName, region);
|
|
124
|
+
return privateSubnets.length < 2;
|
|
151
125
|
},
|
|
152
126
|
fix: async (config) => {
|
|
153
127
|
const { region } = (0, aws_helpers_js_1.getAwsConfig)(config);
|
|
154
128
|
const projectName = (0, aws_helpers_js_1.getProjectName)(config);
|
|
155
|
-
const vpcId = findVpc(projectName, region);
|
|
129
|
+
const vpcId = await (0, aws_helpers_js_1.findVpc)(projectName, region);
|
|
156
130
|
if (!vpcId) {
|
|
157
131
|
console.log(' VPC must be created first');
|
|
158
132
|
return false;
|
|
159
133
|
}
|
|
160
134
|
try {
|
|
135
|
+
const ec2 = (0, aws_helpers_js_1.getEC2Client)(region);
|
|
161
136
|
// Get first two AZs
|
|
162
|
-
const azResult = (
|
|
163
|
-
const azs = azResult.
|
|
137
|
+
const azResult = await ec2.send(new aws_helpers_js_1.DescribeAvailabilityZonesCommand({}));
|
|
138
|
+
const azs = (azResult.AvailabilityZones ?? []).map(az => az.ZoneName).filter(Boolean);
|
|
164
139
|
if (azs.length < 2) {
|
|
165
140
|
console.log(' Need at least 2 availability zones');
|
|
166
141
|
return false;
|
|
167
142
|
}
|
|
168
|
-
// Create private subnet 1
|
|
169
|
-
const sub1Result = (
|
|
170
|
-
|
|
171
|
-
|
|
143
|
+
// Create private subnet 1
|
|
144
|
+
const sub1Result = await ec2.send(new aws_helpers_js_1.CreateSubnetCommand({
|
|
145
|
+
VpcId: vpcId,
|
|
146
|
+
CidrBlock: '10.0.2.0/24',
|
|
147
|
+
AvailabilityZone: azs[0],
|
|
148
|
+
TagSpecifications: [(0, aws_helpers_js_1.tagSpec)('subnet', projectName, { 'factiii:subnet-type': 'private' })],
|
|
149
|
+
}));
|
|
150
|
+
const sub1Id = sub1Result.Subnet?.SubnetId;
|
|
172
151
|
console.log(' Created private subnet 1: ' + sub1Id + ' in ' + azs[0]);
|
|
173
|
-
// Create private subnet 2
|
|
174
|
-
const sub2Result = (
|
|
175
|
-
|
|
176
|
-
|
|
152
|
+
// Create private subnet 2
|
|
153
|
+
const sub2Result = await ec2.send(new aws_helpers_js_1.CreateSubnetCommand({
|
|
154
|
+
VpcId: vpcId,
|
|
155
|
+
CidrBlock: '10.0.3.0/24',
|
|
156
|
+
AvailabilityZone: azs[1],
|
|
157
|
+
TagSpecifications: [(0, aws_helpers_js_1.tagSpec)('subnet', projectName, { 'factiii:subnet-type': 'private' })],
|
|
158
|
+
}));
|
|
159
|
+
const sub2Id = sub2Result.Subnet?.SubnetId;
|
|
177
160
|
console.log(' Created private subnet 2: ' + sub2Id + ' in ' + azs[1]);
|
|
178
161
|
return true;
|
|
179
162
|
}
|
|
@@ -188,42 +171,58 @@ exports.vpcFixes = [
|
|
|
188
171
|
id: 'aws-igw-missing',
|
|
189
172
|
stage: 'prod',
|
|
190
173
|
severity: 'critical',
|
|
191
|
-
description: 'Internet Gateway not attached to VPC',
|
|
174
|
+
description: '🌐 Internet Gateway not attached to VPC',
|
|
192
175
|
scan: async (config) => {
|
|
193
|
-
if (!isAwsConfigured(config))
|
|
176
|
+
if (!(0, aws_helpers_js_1.isAwsConfigured)(config))
|
|
194
177
|
return false;
|
|
195
178
|
const { region } = (0, aws_helpers_js_1.getAwsConfig)(config);
|
|
196
179
|
const projectName = (0, aws_helpers_js_1.getProjectName)(config);
|
|
197
|
-
const vpcId = findVpc(projectName, region);
|
|
180
|
+
const vpcId = await (0, aws_helpers_js_1.findVpc)(projectName, region);
|
|
198
181
|
if (!vpcId)
|
|
199
182
|
return false;
|
|
200
|
-
return !findIgw(vpcId, region);
|
|
183
|
+
return !(await (0, aws_helpers_js_1.findIgw)(vpcId, region));
|
|
201
184
|
},
|
|
202
185
|
fix: async (config) => {
|
|
203
186
|
const { region } = (0, aws_helpers_js_1.getAwsConfig)(config);
|
|
204
187
|
const projectName = (0, aws_helpers_js_1.getProjectName)(config);
|
|
205
|
-
const vpcId = findVpc(projectName, region);
|
|
188
|
+
const vpcId = await (0, aws_helpers_js_1.findVpc)(projectName, region);
|
|
206
189
|
if (!vpcId) {
|
|
207
190
|
console.log(' VPC must be created first');
|
|
208
191
|
return false;
|
|
209
192
|
}
|
|
210
193
|
try {
|
|
194
|
+
const ec2 = (0, aws_helpers_js_1.getEC2Client)(region);
|
|
211
195
|
// Create IGW
|
|
212
|
-
const igwResult =
|
|
213
|
-
|
|
196
|
+
const igwResult = await ec2.send(new aws_helpers_js_1.CreateInternetGatewayCommand({
|
|
197
|
+
TagSpecifications: [(0, aws_helpers_js_1.tagSpec)('internet-gateway', projectName)],
|
|
198
|
+
}));
|
|
199
|
+
const igwId = igwResult.InternetGateway?.InternetGatewayId;
|
|
214
200
|
console.log(' Created Internet Gateway: ' + igwId);
|
|
215
201
|
// Attach to VPC
|
|
216
|
-
(
|
|
202
|
+
await ec2.send(new aws_helpers_js_1.AttachInternetGatewayCommand({
|
|
203
|
+
InternetGatewayId: igwId,
|
|
204
|
+
VpcId: vpcId,
|
|
205
|
+
}));
|
|
217
206
|
console.log(' Attached to VPC');
|
|
218
|
-
// Create route table
|
|
219
|
-
const rtResult =
|
|
220
|
-
|
|
207
|
+
// Create route table
|
|
208
|
+
const rtResult = await ec2.send(new aws_helpers_js_1.CreateRouteTableCommand({
|
|
209
|
+
VpcId: vpcId,
|
|
210
|
+
TagSpecifications: [(0, aws_helpers_js_1.tagSpec)('route-table', projectName)],
|
|
211
|
+
}));
|
|
212
|
+
const rtId = rtResult.RouteTable?.RouteTableId;
|
|
221
213
|
// Add route: 0.0.0.0/0 -> IGW
|
|
222
|
-
(
|
|
214
|
+
await ec2.send(new aws_helpers_js_1.CreateRouteCommand({
|
|
215
|
+
RouteTableId: rtId,
|
|
216
|
+
DestinationCidrBlock: '0.0.0.0/0',
|
|
217
|
+
GatewayId: igwId,
|
|
218
|
+
}));
|
|
223
219
|
// Associate route table with public subnet
|
|
224
|
-
const publicSubnetId = findSubnet(projectName, region, 'public');
|
|
220
|
+
const publicSubnetId = await (0, aws_helpers_js_1.findSubnet)(projectName, region, 'public');
|
|
225
221
|
if (publicSubnetId) {
|
|
226
|
-
(
|
|
222
|
+
await ec2.send(new aws_helpers_js_1.AssociateRouteTableCommand({
|
|
223
|
+
RouteTableId: rtId,
|
|
224
|
+
SubnetId: publicSubnetId,
|
|
225
|
+
}));
|
|
227
226
|
console.log(' Associated route table with public subnet');
|
|
228
227
|
}
|
|
229
228
|
return true;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vpc.js","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/vpc.ts"],"names":[],"mappings":";AAAA
|
|
1
|
+
{"version":3,"file":"vpc.js","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/vpc.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAGH,4DAoBiC;AAEpB,QAAA,QAAQ,GAAU;IAC7B;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,yCAAyC;QACtD,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAoB,EAAE;YACtD,IAAI,CAAC,IAAA,gCAAe,EAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,IAAA,+BAAc,EAAC,MAAM,CAAC,CAAC;YAC3C,OAAO,CAAC,CAAC,MAAM,IAAA,wBAAO,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,MAAqB,EAAoB,EAAE;YACrD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,IAAA,+BAAc,EAAC,MAAM,CAAC,CAAC;YAE3C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;gBAEjC,aAAa;gBACb,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,iCAAgB,CAAC;oBACpD,SAAS,EAAE,aAAa;oBACxB,iBAAiB,EAAE,CAAC,IAAA,wBAAO,EAAC,KAAK,EAAE,WAAW,CAAC,CAAC;iBACjD,CAAC,CAAC,CAAC;gBACJ,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,KAAK,CAAC,CAAC;gBAExC,uBAAuB;gBACvB,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,0CAAyB,CAAC;oBAC3C,KAAK,EAAE,KAAK;oBACZ,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACpC,CAAC,CAAC,CAAC;gBAEJ,qBAAqB;gBACrB,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,0CAAyB,CAAC;oBAC3C,KAAK,EAAE,KAAK;oBACZ,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBAClC,CAAC,CAAC,CAAC;gBAEJ,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;gBACpD,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,SAAS,EAAE,yDAAyD;KACrE;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,wCAAwC;QACrD,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAoB,EAAE;YACtD,IAAI,CAAC,IAAA,gCAAe,EAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,IAAA,+BAAc,EAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,MAAM,IAAA,wBAAO,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACxD,OAAO,CAAC,CAAC,MAAM,IAAA,2BAAU,EAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,MAAqB,EAAoB,EAAE;YACrD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,IAAA,+BAAc,EAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,MAAM,IAAA,wBAAO,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;gBAEjC,eAAe;gBACf,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,iDAAgC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1E,MAAM,EAAE,GAAG,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;gBACrD,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;oBAC9C,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,uBAAuB;gBACvB,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,oCAAmB,CAAC;oBAC1D,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,aAAa;oBACxB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,CAAC,IAAA,wBAAO,EAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC,CAAC;iBACzF,CAAC,CAAC,CAAC;gBACJ,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAE/C,+BAA+B;gBAC/B,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,6CAA4B,CAAC;oBAC9C,QAAQ,EAAE,QAAQ;oBAClB,mBAAmB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACrC,CAAC,CAAC,CAAC;gBAEJ,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,QAAQ,GAAG,MAAM,GAAG,EAAE,CAAC,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,qCAAqC,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClG,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,SAAS,EAAE,wDAAwD;KACpE;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,0CAA0C;QACvD,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAoB,EAAE;YACtD,IAAI,CAAC,IAAA,gCAAe,EAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,IAAA,+BAAc,EAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,MAAM,IAAA,wBAAO,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACxD,MAAM,cAAc,GAAG,MAAM,IAAA,mCAAkB,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACrE,OAAO,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,MAAqB,EAAoB,EAAE;YACrD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,IAAA,+BAAc,EAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,MAAM,IAAA,wBAAO,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;gBAEjC,oBAAoB;gBACpB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,iDAAgC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1E,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,QAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvF,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACnB,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;oBACrD,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,0BAA0B;gBAC1B,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,oCAAmB,CAAC;oBACxD,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,aAAa;oBACxB,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC;oBACxB,iBAAiB,EAAE,CAAC,IAAA,wBAAO,EAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC;iBAC1F,CAAC,CAAC,CAAC;gBACJ,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAC3C,OAAO,CAAC,GAAG,CAAC,+BAA+B,GAAG,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAExE,0BAA0B;gBAC1B,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,oCAAmB,CAAC;oBACxD,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,aAAa;oBACxB,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC;oBACxB,iBAAiB,EAAE,CAAC,IAAA,wBAAO,EAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC;iBAC1F,CAAC,CAAC,CAAC;gBACJ,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAC3C,OAAO,CAAC,GAAG,CAAC,+BAA+B,GAAG,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAExE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,uCAAuC,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpG,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,SAAS,EAAE,gEAAgE;KAC5E;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,yCAAyC;QACtD,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAoB,EAAE;YACtD,IAAI,CAAC,IAAA,gCAAe,EAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,IAAA,+BAAc,EAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,MAAM,IAAA,wBAAO,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,OAAO,CAAC,CAAC,MAAM,IAAA,wBAAO,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,MAAqB,EAAoB,EAAE;YACrD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,IAAA,+BAAc,EAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,MAAM,IAAA,wBAAO,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;gBAEjC,aAAa;gBACb,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,6CAA4B,CAAC;oBAChE,iBAAiB,EAAE,CAAC,IAAA,wBAAO,EAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;iBAC9D,CAAC,CAAC,CAAC;gBACJ,MAAM,KAAK,GAAG,SAAS,CAAC,eAAe,EAAE,iBAAiB,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,+BAA+B,GAAG,KAAK,CAAC,CAAC;gBAErD,gBAAgB;gBAChB,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,6CAA4B,CAAC;oBAC9C,iBAAiB,EAAE,KAAK;oBACxB,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC,CAAC;gBACJ,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBAElC,qBAAqB;gBACrB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,wCAAuB,CAAC;oBAC1D,KAAK,EAAE,KAAK;oBACZ,iBAAiB,EAAE,CAAC,IAAA,wBAAO,EAAC,aAAa,EAAE,WAAW,CAAC,CAAC;iBACzD,CAAC,CAAC,CAAC;gBACJ,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;gBAE/C,8BAA8B;gBAC9B,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,mCAAkB,CAAC;oBACpC,YAAY,EAAE,IAAI;oBAClB,oBAAoB,EAAE,WAAW;oBACjC,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC,CAAC;gBAEJ,2CAA2C;gBAC3C,MAAM,cAAc,GAAG,MAAM,IAAA,2BAAU,EAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACvE,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,2CAA0B,CAAC;wBAC5C,YAAY,EAAE,IAAI;wBAClB,QAAQ,EAAE,cAAc;qBACzB,CAAC,CAAC,CAAC;oBACJ,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,CAAC;gBAED,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,SAAS,EAAE,4EAA4E;KACxF;CACF,CAAC"}
|
|
@@ -1,34 +1,38 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* AWS Helper Utilities
|
|
3
3
|
*
|
|
4
|
-
* Shared functions for AWS
|
|
5
|
-
*
|
|
4
|
+
* Shared functions for AWS SDK operations used across all AWS scanfix files.
|
|
5
|
+
* Uses AWS SDK v3 clients instead of AWS CLI.
|
|
6
6
|
*/
|
|
7
|
+
import { EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeInstancesCommand, DescribeKeyPairsCommand, DescribeAddressesCommand, DescribeInternetGatewaysCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, CreateVpcCommand, ModifyVpcAttributeCommand, CreateSubnetCommand, ModifySubnetAttributeCommand, CreateInternetGatewayCommand, AttachInternetGatewayCommand, CreateRouteTableCommand, CreateRouteCommand, AssociateRouteTableCommand, CreateSecurityGroupCommand, AuthorizeSecurityGroupIngressCommand, CreateKeyPairCommand, RunInstancesCommand, AllocateAddressCommand, AssociateAddressCommand, type Tag, type TagSpecification, type Filter, waitUntilInstanceRunning } from '@aws-sdk/client-ec2';
|
|
8
|
+
import { STSClient, GetCallerIdentityCommand } from '@aws-sdk/client-sts';
|
|
9
|
+
import { IAMClient, GetUserCommand, CreateUserCommand, PutUserPolicyCommand, CreateAccessKeyCommand } from '@aws-sdk/client-iam';
|
|
10
|
+
import { RDSClient, DescribeDBSubnetGroupsCommand, CreateDBSubnetGroupCommand, DescribeDBInstancesCommand, CreateDBInstanceCommand } from '@aws-sdk/client-rds';
|
|
11
|
+
import { S3Client, HeadBucketCommand, CreateBucketCommand, PutPublicAccessBlockCommand, PutBucketEncryptionCommand, GetBucketCorsCommand, PutBucketCorsCommand } from '@aws-sdk/client-s3';
|
|
12
|
+
import { ECRClient, DescribeRepositoriesCommand, CreateRepositoryCommand, PutLifecyclePolicyCommand, GetAuthorizationTokenCommand } from '@aws-sdk/client-ecr';
|
|
13
|
+
import { SESClient, VerifyDomainIdentityCommand, GetIdentityVerificationAttributesCommand, VerifyDomainDkimCommand, GetIdentityDkimAttributesCommand, GetSendQuotaCommand } from '@aws-sdk/client-ses';
|
|
7
14
|
import type { FactiiiConfig } from '../../../../types/index.js';
|
|
15
|
+
export declare function getEC2Client(region: string): EC2Client;
|
|
16
|
+
export declare function getSTSClient(region: string): STSClient;
|
|
17
|
+
export declare function getIAMClient(region: string): IAMClient;
|
|
18
|
+
export declare function getRDSClient(region: string): RDSClient;
|
|
19
|
+
export declare function getS3Client(region: string): S3Client;
|
|
20
|
+
export declare function getECRClient(region: string): ECRClient;
|
|
21
|
+
export declare function getSESClient(region: string): SESClient;
|
|
8
22
|
/**
|
|
9
|
-
*
|
|
10
|
-
* Returns the stdout as a trimmed string
|
|
11
|
-
* Throws on failure
|
|
23
|
+
* Build standard tags array for AWS resources
|
|
12
24
|
*/
|
|
13
|
-
export declare function
|
|
25
|
+
export declare function buildTags(projectName: string, extraTags?: Record<string, string>): Tag[];
|
|
14
26
|
/**
|
|
15
|
-
*
|
|
27
|
+
* Build TagSpecification for resource creation
|
|
16
28
|
*/
|
|
17
|
-
export declare function
|
|
29
|
+
export declare function tagSpec(resourceType: string, projectName: string, extraTags?: Record<string, string>): TagSpecification;
|
|
18
30
|
/**
|
|
19
|
-
*
|
|
20
|
-
* Returns the resource data as parsed JSON, or null if not found
|
|
31
|
+
* Build a filter for factiii:project tag
|
|
21
32
|
*/
|
|
22
|
-
export declare function
|
|
23
|
-
/**
|
|
24
|
-
* Generate --tag-specifications string for AWS resource creation
|
|
25
|
-
* Tags resources with factiii:project={name} and factiii:managed=true
|
|
26
|
-
* Uses JSON format to avoid shell parsing issues with colons in tag keys
|
|
27
|
-
*/
|
|
28
|
-
export declare function tagSpec(resourceType: string, projectName: string, extraTags?: Record<string, string>): string;
|
|
33
|
+
export declare function projectFilter(projectName: string): Filter;
|
|
29
34
|
/**
|
|
30
35
|
* Extract AWS configuration from a FactiiiConfig
|
|
31
|
-
* Checks both top-level config.aws and per-environment aws settings
|
|
32
36
|
*/
|
|
33
37
|
export declare function getAwsConfig(config: FactiiiConfig): {
|
|
34
38
|
region: string;
|
|
@@ -36,22 +40,91 @@ export declare function getAwsConfig(config: FactiiiConfig): {
|
|
|
36
40
|
accessKeyId?: string;
|
|
37
41
|
};
|
|
38
42
|
/**
|
|
39
|
-
* Check if AWS provisioning
|
|
40
|
-
* AWS provisioning (VPC, EC2, RDS, etc.) only runs from the dev machine.
|
|
41
|
-
* When on the server (FACTIII_ON_SERVER=true), skip provisioning — only server-level fixes run.
|
|
43
|
+
* Check if running on server (skip AWS provisioning)
|
|
42
44
|
*/
|
|
43
45
|
export declare function isOnServer(): boolean;
|
|
44
46
|
/**
|
|
45
|
-
*
|
|
47
|
+
* Get project name for tagging
|
|
46
48
|
*/
|
|
47
|
-
export declare function
|
|
49
|
+
export declare function getProjectName(config: FactiiiConfig): string;
|
|
48
50
|
/**
|
|
49
|
-
*
|
|
50
|
-
* Returns the account ID if valid, null otherwise
|
|
51
|
+
* Get AWS account ID via STS
|
|
51
52
|
*/
|
|
52
|
-
export declare function getAwsAccountId(region
|
|
53
|
+
export declare function getAwsAccountId(region: string): Promise<string | null>;
|
|
53
54
|
/**
|
|
54
|
-
*
|
|
55
|
+
* Find VPC by factiii:project tag
|
|
55
56
|
*/
|
|
56
|
-
export declare function
|
|
57
|
+
export declare function findVpc(projectName: string, region: string): Promise<string | null>;
|
|
58
|
+
/**
|
|
59
|
+
* Find subnet by tag and type
|
|
60
|
+
*/
|
|
61
|
+
export declare function findSubnet(projectName: string, region: string, type: string): Promise<string | null>;
|
|
62
|
+
/**
|
|
63
|
+
* Find all private subnets
|
|
64
|
+
*/
|
|
65
|
+
export declare function findPrivateSubnets(projectName: string, region: string): Promise<string[]>;
|
|
66
|
+
/**
|
|
67
|
+
* Find security group by name and VPC
|
|
68
|
+
*/
|
|
69
|
+
export declare function findSecurityGroup(groupName: string, vpcId: string, region: string): Promise<string | null>;
|
|
70
|
+
/**
|
|
71
|
+
* Find EC2 key pair by name
|
|
72
|
+
*/
|
|
73
|
+
export declare function findKeyPair(keyName: string, region: string): Promise<boolean>;
|
|
74
|
+
/**
|
|
75
|
+
* Find running/stopped EC2 instance by tag
|
|
76
|
+
*/
|
|
77
|
+
export declare function findInstance(projectName: string, region: string): Promise<string | null>;
|
|
78
|
+
/**
|
|
79
|
+
* Find Elastic IP associated with an instance
|
|
80
|
+
*/
|
|
81
|
+
export declare function findElasticIp(instanceId: string, region: string): Promise<string | null>;
|
|
82
|
+
/**
|
|
83
|
+
* Find internet gateway attached to VPC
|
|
84
|
+
*/
|
|
85
|
+
export declare function findIgw(vpcId: string, region: string): Promise<string | null>;
|
|
86
|
+
/**
|
|
87
|
+
* Find DB subnet group
|
|
88
|
+
*/
|
|
89
|
+
export declare function findDbSubnetGroup(groupName: string, region: string): Promise<boolean>;
|
|
90
|
+
/**
|
|
91
|
+
* Find RDS instance by identifier
|
|
92
|
+
*/
|
|
93
|
+
export declare function findRdsInstance(dbInstanceId: string, region: string): Promise<{
|
|
94
|
+
status: string;
|
|
95
|
+
endpoint: string | null;
|
|
96
|
+
} | null>;
|
|
97
|
+
/**
|
|
98
|
+
* Find RDS instance endpoint
|
|
99
|
+
*/
|
|
100
|
+
export declare function findRdsEndpoint(projectName: string, region: string): Promise<string | null>;
|
|
101
|
+
/**
|
|
102
|
+
* Check if ECR repository exists
|
|
103
|
+
*/
|
|
104
|
+
export declare function findEcrRepo(repoName: string, region: string): Promise<boolean>;
|
|
105
|
+
/**
|
|
106
|
+
* Check if S3 bucket exists
|
|
107
|
+
*/
|
|
108
|
+
export declare function findBucket(bucketName: string, region: string): Promise<boolean>;
|
|
109
|
+
/**
|
|
110
|
+
* Check if IAM user exists
|
|
111
|
+
*/
|
|
112
|
+
export declare function findIamUser(userName: string, region: string): Promise<boolean>;
|
|
113
|
+
/**
|
|
114
|
+
* Check if domain is verified in SES
|
|
115
|
+
*/
|
|
116
|
+
export declare function isDomainVerified(domain: string, region: string): Promise<boolean>;
|
|
117
|
+
/**
|
|
118
|
+
* Check if DKIM is configured for domain
|
|
119
|
+
*/
|
|
120
|
+
export declare function hasDkim(domain: string, region: string): Promise<boolean>;
|
|
121
|
+
/**
|
|
122
|
+
* Check if S3 bucket has CORS configured
|
|
123
|
+
*/
|
|
124
|
+
export declare function hasCors(bucketName: string, region: string): Promise<boolean>;
|
|
125
|
+
/**
|
|
126
|
+
* Check if AWS is configured for this project (shared guard)
|
|
127
|
+
*/
|
|
128
|
+
export declare function isAwsConfigured(config: FactiiiConfig): boolean;
|
|
129
|
+
export { EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeInstancesCommand, DescribeKeyPairsCommand, DescribeAddressesCommand, DescribeInternetGatewaysCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, CreateVpcCommand, ModifyVpcAttributeCommand, CreateSubnetCommand, ModifySubnetAttributeCommand, CreateInternetGatewayCommand, AttachInternetGatewayCommand, CreateRouteTableCommand, CreateRouteCommand, AssociateRouteTableCommand, CreateSecurityGroupCommand, AuthorizeSecurityGroupIngressCommand, CreateKeyPairCommand, RunInstancesCommand, AllocateAddressCommand, AssociateAddressCommand, waitUntilInstanceRunning, STSClient, GetCallerIdentityCommand, IAMClient, GetUserCommand, CreateUserCommand, PutUserPolicyCommand, CreateAccessKeyCommand, RDSClient, DescribeDBSubnetGroupsCommand, CreateDBSubnetGroupCommand, DescribeDBInstancesCommand, CreateDBInstanceCommand, S3Client, HeadBucketCommand, CreateBucketCommand, PutPublicAccessBlockCommand, PutBucketEncryptionCommand, GetBucketCorsCommand, PutBucketCorsCommand, ECRClient, DescribeRepositoriesCommand, CreateRepositoryCommand, PutLifecyclePolicyCommand, GetAuthorizationTokenCommand, SESClient, VerifyDomainIdentityCommand, GetIdentityVerificationAttributesCommand, VerifyDomainDkimCommand, GetIdentityDkimAttributesCommand, GetSendQuotaCommand, };
|
|
57
130
|
//# sourceMappingURL=aws-helpers.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"aws-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/utils/aws-helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;
|
|
1
|
+
{"version":3,"file":"aws-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/utils/aws-helpers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,gCAAgC,EAChC,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,EACvB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC1B,oCAAoC,EACpC,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,GAAG,EACR,KAAK,gBAAgB,EACrB,KAAK,MAAM,EACX,wBAAwB,EACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EACL,SAAS,EACT,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,SAAS,EACT,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,EAC3B,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,SAAS,EACT,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,SAAS,EACT,2BAA2B,EAC3B,wCAAwC,EACxC,uBAAuB,EACvB,gCAAgC,EAChC,mBAAmB,EACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAqB,MAAM,4BAA4B,CAAC;AAgBnF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEtD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEtD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEtD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEtD;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAEpD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEtD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEtD;AAMD;;GAEG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAYxF;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,CAKvH;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEzD;AAMD;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAwBA;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAE5D;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ5E;AAMD;;GAEG;AACH,wBAAsB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUzF;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa1G;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAa/F;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAahH;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUnF;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa9F;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAU9F;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUnF;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU3F;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC,CAevI;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIjG;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUpF;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQrF;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQpF;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUvF;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU9E;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQlF;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAW9D;AAMD,OAAO,EAEL,SAAS,EACT,mBAAmB,EACnB,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,gCAAgC,EAChC,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,EACvB,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC1B,oCAAoC,EACpC,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EAExB,SAAS,EACT,wBAAwB,EAExB,SAAS,EACT,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EAEtB,SAAS,EACT,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EAEvB,QAAQ,EACR,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,EAC3B,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EAEpB,SAAS,EACT,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,EACzB,4BAA4B,EAE5B,SAAS,EACT,2BAA2B,EAC3B,wCAAwC,EACxC,uBAAuB,EACvB,gCAAgC,EAChC,mBAAmB,GACpB,CAAC"}
|