@fishawack/lab-env 5.6.1-beta.1 → 5.7.0-beta.1

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 ## Changelog
 
+### 5.7.0-beta.1 (2026-06-08)
+
+#### Features
+
+* added a sync secrets command ([c98c66d](https://bitbucket.org/fishawackdigital/lab-env/commits/c98c66dc0d92bdac9dd79ae544362e60bae4ac88))
+* added the ability to restore from snapshot ([c0f3c6c](https://bitbucket.org/fishawackdigital/lab-env/commits/c0f3c6c5ee841121e78bc38047e40336c5880ef0))
+* elasticbeanstlak now fully utilizes secrets manager and has options to persist after delete ([bbb252c](https://bitbucket.org/fishawackdigital/lab-env/commits/bbb252cf5e2f07551c63df6fcebd574c1a84d9ab))
+* elb instance profile and managed update profile now include reading secretmanager permissions ([9059b01](https://bitbucket.org/fishawackdigital/lab-env/commits/9059b010ce781e07f3630aba5bb0b88556bed929))
+* encryption in transit for db connections by default for laravel applications and enforcement ([cac6590](https://bitbucket.org/fishawackdigital/lab-env/commits/cac659083dfef46eb047b943451be854d4daf94f))
+* rds and s3 no fully decoupled from fullstack and can be reattached to recreated elb instances ([72d3361](https://bitbucket.org/fishawackdigital/lab-env/commits/72d3361441e37d70f8b78dc98850828a92ea48a1))
+* setvars now utilizes secret manager secrets instead of plain text ([462ef90](https://bitbucket.org/fishawackdigital/lab-env/commits/462ef9077dad31b420355038c3264abf471164b9))
+
+#### Bug Fixes
+
+* added secret manager permission to fullstack deploy permissions ([6432d2d](https://bitbucket.org/fishawackdigital/lab-env/commits/6432d2d756e19e96c62d8c29dd79828811ecf1ac))
+* disable public access to RDS instances ([d4759e8](https://bitbucket.org/fishawackdigital/lab-env/commits/d4759e8ac11ecfbb22b0c3c80c96d5781ae8bda9))
+* session driver now uses database by default ([d745615](https://bitbucket.org/fishawackdigital/lab-env/commits/d7456154920ab380e2c01424e065c9aca6edf750))
+* use correct spinner class for logging ([592d7d5](https://bitbucket.org/fishawackdigital/lab-env/commits/592d7d56cf83ebfd62ce9d025450a8717222e8e0))
+
+### 5.6.1 (2026-06-03)
+
+#### Bug Fixes
+
+* trigger release ([fe4907d](https://bitbucket.org/fishawackdigital/lab-env/commits/fe4907daabd6c670e9b970f475f1b6b032871ea5))
+
 ### 5.6.1-beta.1 (2026-06-03)
 
 #### Bug Fixes

package/cli.js

@@ -171,6 +171,7 @@ const args = hideBin(process.argv);
                 "key",
                 "dekey",
                 "prune",
+                "sync-secrets",
             ].forEach((d) =>
                 cli.command(...require(`./commands/create/cmds/${d}.js`)),
             );

package/commands/create/cmds/deprovision.js

@@ -78,11 +78,35 @@ module.exports = [
         // Set AWS client defaults before any AWS operations
         setAWSClientDefaults(answers.client, answers.region);
 
-        await aws[`${answers.stack}Terminate`](
-            slug,
-            _.repoSafe,
-            branch,
-            answers.id,
-        );
+        if (answers.stack === "fullstack") {
+            const resourceAnswers = await inquirer.prompt([
+                {
+                    type: "confirm",
+                    name: "deleteStorage",
+                    message: "Delete the S3 storage bucket?",
+                    default: false,
+                },
+                {
+                    type: "confirm",
+                    name: "deleteDatabase",
+                    message: "Delete the RDS database?",
+                    default: false,
+                },
+                {
+                    type: "confirm",
+                    name: "deleteAppSecret",
+                    message: "Delete the app secret (APP_KEY, salts, etc.)?",
+                    default: false,
+                },
+            ]);
+
+            await aws.fullstackTerminate(slug, _.repoSafe, branch, {
+                deleteStorage: resourceAnswers.deleteStorage,
+                deleteDatabase: resourceAnswers.deleteDatabase,
+                deleteAppSecret: resourceAnswers.deleteAppSecret,
+            });
+        } else {
+            await aws.staticTerminate(slug, _.repoSafe, branch, answers.id);
+        }
     },
 ];

package/commands/create/cmds/provision.js

@@ -213,13 +213,19 @@ module.exports = [
                         message: "What availability is required?",
                         choices: ["low", "high"],
                     },
+                    region,
                     {
                         type: "confirm",
                         name: "database",
                         message: "Does this site need a database?",
                         default: true,
                     },
-                    region,
+                    {
+                        type: "confirm",
+                        name: "storage",
+                        message: "Does this site need S3 storage?",
+                        default: true,
+                    },
                 ])),
             };
         }
@@ -290,6 +296,112 @@ module.exports = [
         // Set AWS client defaults before any AWS operations
         setAWSClientDefaults(answers.client, answers.region);
 
+        // Snapshot restore prompt — only if database requested, before preflight
+        let snapshot = null;
+
+        if (answers.database) {
+            const { restore } = await inquirer.prompt([
+                {
+                    type: "confirm",
+                    name: "restore",
+                    message: "Restore database from an existing snapshot?",
+                    default: false,
+                },
+            ]);
+
+            if (restore) {
+                const snapshots = await aws.rds.listManualSnapshots();
+
+                if (snapshots.length) {
+                    const { selected } = await inquirer.prompt([
+                        {
+                            type: "list",
+                            name: "selected",
+                            message: "Select a snapshot to restore from",
+                            choices: snapshots.map((s) => ({
+                                name: `${s.DBSnapshotIdentifier} (source: ${s.DBInstanceIdentifier}, created: ${new Date(s.SnapshotCreateTime).toLocaleDateString()})`,
+                                value: s.DBSnapshotIdentifier,
+                            })),
+                        },
+                    ]);
+
+                    snapshot = selected;
+                } else {
+                    new utilities.Spinner(
+                        "No manual snapshots found, creating a fresh database",
+                        true,
+                    ).ora.info();
+                }
+            }
+        }
+
+        // Pre-flight check for existing resources
+        let existingSecrets = { app: null, storage: null, database: null };
+
+        if (answers.stack === "fullstack") {
+            const { conflicts, existing } = await aws.fullstackPreflight(
+                slug,
+                _.repoSafe,
+                branch,
+                {
+                    storage: answers.storage,
+                    database: answers.database,
+                },
+            );
+
+            if (conflicts.length) {
+                conflicts.forEach((c) =>
+                    console.log(utilities.colorize(`\n  ✗ ${c}`, "error")),
+                );
+                console.log(
+                    utilities.colorize(
+                        "\nProvisioning aborted due to existing resources.\n",
+                        "error",
+                    ),
+                );
+                process.exit(1);
+            }
+
+            if (existing.storage) {
+                new utilities.Spinner(
+                    "S3 bucket already exists, skipping storage creation",
+                    true,
+                ).ora.info();
+                answers.storage = false;
+            }
+
+            if (existing.database) {
+                new utilities.Spinner(
+                    "RDS instance already exists, skipping database creation",
+                    true,
+                ).ora.info();
+                answers.database = false;
+            }
+
+            existingSecrets = existing.secrets;
+
+            if (existingSecrets.app) {
+                new utilities.Spinner(
+                    "App secret already exists, reusing existing values",
+                    true,
+                ).ora.info();
+            }
+
+            if (existingSecrets.storage) {
+                new utilities.Spinner(
+                    "Storage secret already exists, reusing existing values",
+                    true,
+                ).ora.info();
+            }
+
+            if (existingSecrets.database) {
+                new utilities.Spinner(
+                    "Database secret already exists, reusing existing values",
+                    true,
+                ).ora.info();
+            }
+        }
+
         try {
             if (answers.stack === "static") {
                 infastructure = await aws.static(
@@ -319,6 +431,9 @@ module.exports = [
                     answers.framework,
                     answers.availability,
                     answers.database,
+                    answers.storage,
+                    existingSecrets,
+                    snapshot,
                 );
             }
         } catch (e) {

package/commands/create/cmds/sync-secrets.js

@@ -0,0 +1,197 @@
+const _ = require("../../../globals.js");
+const inquirer = require("inquirer");
+const aws = require("../services/aws/index.js");
+const { setAWSClientDefaults } = require("../services/aws/misc.js");
+const utilities = require("../libs/utilities");
+const { client, region } = require("../libs/prompts.js");
+
+const SECRETS_NAMESPACE = "aws:elasticbeanstalk:application:environmentsecrets";
+
+module.exports = [
+    ["sync-secrets", "syncs"],
+    _.config.preset === "devops"
+        ? "Sync Secrets Manager keys with EB environment secrets"
+        : false,
+    (yargs) => {
+        yargs.option("branch", {
+            alias: "b",
+            describe: "Branch to configure",
+            type: "string",
+        });
+    },
+    async (argv) => {
+        let branch = argv.branch || _.branch;
+
+        let answer = await inquirer.prompt([
+            {
+                type: "confirm",
+                name: "check",
+                message: `Syncing secrets for the ${utilities.colorize(branch, "success")} branch, is this correct?`,
+                default: "Y",
+            },
+        ]);
+
+        if (!answer.check) {
+            process.exit(1);
+        }
+
+        let answers = await inquirer.prompt([client, region]);
+
+        const slug = aws.slug(_.repoSafe, answers.client, branch, "eb");
+
+        setAWSClientDefaults(answers.client, answers.region);
+
+        // Verify EB environment exists
+        let appName;
+
+        try {
+            const { Environments } =
+                await aws.elasticbeanstalk.describeEnvironment(slug);
+            const active = Environments.filter(
+                (e) => e.Status !== "Terminated",
+            );
+            if (!active.length) {
+                console.log(
+                    utilities.colorize(
+                        `\n  ✗ No active EB environment found for "${slug}"\n`,
+                        "error",
+                    ),
+                );
+                process.exit(1);
+            }
+            appName = active[0].ApplicationName;
+        } catch {
+            console.log(
+                utilities.colorize(
+                    `\n  ✗ No EB environment found for "${slug}"\n`,
+                    "error",
+                ),
+            );
+            process.exit(1);
+        }
+
+        // Build expected environmentsecrets from Secrets Manager
+        const expectedSettings = [];
+        const groups = ["app", "storage", "database"];
+
+        for (const group of groups) {
+            const secretName = `${slug}-${group}`;
+
+            try {
+                const secret =
+                    await aws.secretsmanager.describeSecret(secretName);
+                const secretValue =
+                    await aws.secretsmanager.getSecretValue(secretName);
+                const keys = Object.keys(secretValue);
+
+                for (const key of keys) {
+                    expectedSettings.push({
+                        OptionName: key,
+                        Value: `${secret.ARN}:${key}`,
+                        Namespace: SECRETS_NAMESPACE,
+                    });
+                }
+            } catch {
+                /* secret does not exist for this group */
+            }
+        }
+
+        // Get current EB configuration
+        const currentSettings =
+            await aws.elasticbeanstalk.describeConfigurationSettings(
+                appName,
+                slug,
+            );
+
+        const currentSecrets = currentSettings.filter(
+            (s) => s.Namespace === SECRETS_NAMESPACE,
+        );
+
+        // Diff: what to add and what to remove
+        const currentKeys = new Set(currentSecrets.map((s) => s.OptionName));
+        const expectedKeys = new Set(expectedSettings.map((s) => s.OptionName));
+
+        const toAdd = expectedSettings.filter(
+            (s) => !currentKeys.has(s.OptionName),
+        );
+        const toUpdate = expectedSettings.filter((s) => {
+            const current = currentSecrets.find(
+                (c) => c.OptionName === s.OptionName,
+            );
+            return current && current.Value !== s.Value;
+        });
+        const toRemove = currentSecrets
+            .filter((s) => !expectedKeys.has(s.OptionName))
+            .map((s) => ({
+                OptionName: s.OptionName,
+                Namespace: SECRETS_NAMESPACE,
+            }));
+
+        const optionSettings = [...toAdd, ...toUpdate];
+
+        if (!optionSettings.length && !toRemove.length) {
+            new utilities.Spinner(
+                "Environment secrets are in sync",
+                true,
+            ).ora.info();
+            return;
+        }
+
+        // Log summary
+        if (toAdd.length) {
+            console.log(
+                utilities.colorize(
+                    `\n  Adding ${toAdd.length} secret(s): ${toAdd.map((s) => s.OptionName).join(", ")}`,
+                    "success",
+                ),
+            );
+        }
+
+        if (toUpdate.length) {
+            console.log(
+                utilities.colorize(
+                    `\n  Updating ${toUpdate.length} secret(s): ${toUpdate.map((s) => s.OptionName).join(", ")}`,
+                    "info",
+                ),
+            );
+        }
+
+        if (toRemove.length) {
+            console.log(
+                utilities.colorize(
+                    `\n  Removing ${toRemove.length} secret(s): ${toRemove.map((s) => s.OptionName).join(", ")}`,
+                    "warning",
+                ),
+            );
+        }
+
+        console.log("");
+
+        answer = await inquirer.prompt([
+            {
+                type: "confirm",
+                name: "proceed",
+                message: "Apply these changes?",
+                default: true,
+            },
+        ]);
+
+        if (!answer.proceed) {
+            process.exit(0);
+        }
+
+        await aws.elasticbeanstalk.updateEnvironmentSettings(
+            slug,
+            optionSettings,
+            toRemove,
+        );
+
+        console.log(
+            // eslint-disable-next-line prettier/prettier
+            utilities.colorize(
+                "\n  ✔ Environment secrets synced\n",
+                "success",
+            ),
+        );
+    },
+];