@fishawack/lab-env 5.6.1-beta.1 → 5.7.0-beta.1

package/commands/create/services/aws/iam.js

@@ -147,6 +147,11 @@ module.exports.syncFWIAMPolicies = async (
             UserName,
             "arn:aws:iam::aws:policy/AmazonElastiCacheFullAccess",
         );
+
+        await module.exports.attachIAMPolicy(
+            UserName,
+            "arn:aws:iam::aws:policy/SecretsManagerReadWrite",
+        );
     }
 
     if (permissions.includes("manage-users")) {
@@ -393,6 +398,10 @@ module.exports.ensureEBInstanceProfileExists = async () => {
         role,
         "arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker",
     );
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSSecretsManagerClientReadOnlyAccess",
+    );
     await module.exports.attachInlineRolePolicy(
         role,
         "lab-env-elasticbeanstalk-describe-env",
@@ -465,6 +474,11 @@ module.exports.ensureEBManagedUpdateProfileExists = async () => {
         "arn:aws:iam::aws:policy/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy",
     );
 
+    await module.exports.attachRolePolicy(
+        role,
+        "arn:aws:iam::aws:policy/AWSSecretsManagerClientReadOnlyAccess",
+    );
+
     await module.exports.attachInlineRolePolicy(
         role,
         "lab-env-elasticbeanstalk-custom-managed-updates-permissions",

package/commands/create/services/aws/index.js

@@ -1,7 +1,17 @@
 const md5 = require("apache-md5");
 const fs = require("fs-extra");
-
-const { nameSafe } = require("../../libs/utilities.js");
+const generator = require("generate-password");
+const { S3Client, ListBucketsCommand } = require("@aws-sdk/client-s3");
+const {
+    RDSClient,
+    DescribeDBInstancesCommand,
+} = require("@aws-sdk/client-rds");
+const {
+    SecretsManagerClient,
+    DescribeSecretCommand,
+} = require("@aws-sdk/client-secrets-manager");
+
+const { nameSafe, Spinner } = require("../../libs/utilities.js");
 const { eb } = require("../../libs/vars.js");
 
 module.exports.s3 = require("./s3.js");
@@ -9,10 +19,115 @@ module.exports.cloudfront = require("./cloudfront.js");
 module.exports.iam = require("./iam.js");
 module.exports.elasticbeanstalk = require("./elasticbeanstalk.js");
 module.exports.ec2 = require("./ec2.js");
+module.exports.rds = require("./rds.js");
+module.exports.secretsmanager = require("./secretsmanager.js");
 
 module.exports.slug = (repo, client, branch, service = "s3") =>
     nameSafe(`${branch}-${repo}-${client}`, service);
 
+module.exports.fullstackPreflight = async (
+    name,
+    repo,
+    branch,
+    { storage = false, database = false } = {},
+) => {
+    const conflicts = [];
+    const existing = {
+        storage: false,
+        database: false,
+        secrets: { app: null, storage: null, database: null },
+    };
+
+    const spinner = new Spinner("Running pre-flight checks", true);
+
+    try {
+        // Check EB environment
+        spinner.ora.text = "Checking for existing EB environment";
+        try {
+            const { Environments } =
+                await module.exports.elasticbeanstalk.describeEnvironment(name);
+            const active = Environments.filter(
+                (e) => e.Status !== "Terminated",
+            );
+            if (active.length) {
+                conflicts.push(
+                    `Elastic Beanstalk environment "${name}" already exists (status: ${active[0].Status})`,
+                );
+            }
+        } catch {
+            /* does not exist */
+        }
+
+        // Check S3
+        if (storage) {
+            const s3Slug = module.exports.slug(
+                repo,
+                process.env.AWS_PROFILE,
+                branch,
+                "s3",
+            );
+
+            spinner.ora.text = "Checking for existing S3 bucket";
+            try {
+                const { Buckets } = await new S3Client({}).send(
+                    new ListBucketsCommand({}),
+                );
+                if (Buckets.some((b) => b.Name === s3Slug)) {
+                    existing.storage = true;
+                }
+            } catch {
+                /* empty */
+            }
+        }
+
+        // Check RDS
+        if (database) {
+            const rdsSlug = module.exports.slug(
+                repo,
+                process.env.AWS_PROFILE,
+                branch,
+                "rds",
+            );
+
+            spinner.ora.text = "Checking for existing RDS instance";
+            try {
+                const res = await new RDSClient({}).send(
+                    new DescribeDBInstancesCommand({
+                        DBInstanceIdentifier: rdsSlug,
+                    }),
+                );
+                const instance = res.DBInstances[0];
+                if (instance && instance.DBInstanceStatus !== "deleting") {
+                    existing.database = true;
+                }
+            } catch {
+                /* does not exist */
+            }
+        }
+
+        // Check for existing secrets
+        const secretGroups = ["app", "storage", "database"];
+        for (const group of secretGroups) {
+            spinner.ora.text = `Checking for existing ${group} secret`;
+            try {
+                const secret = await new SecretsManagerClient({}).send(
+                    new DescribeSecretCommand({ SecretId: `${name}-${group}` }),
+                );
+                existing.secrets[group] = secret.ARN;
+            } catch {
+                /* does not exist */
+            }
+        }
+
+        spinner.ora.succeed("Pre-flight checks complete");
+    } catch (e) {
+        spinner.ora.fail("Pre-flight checks failed");
+        throw e;
+    }
+
+    return { conflicts, existing };
+};
+
 module.exports.clients = [
     "fishawack",
     "abbvie",
@@ -166,36 +281,97 @@ module.exports.fullstack = async (
     framework,
     availability,
     database = false,
+    storage = false,
+    existingSecrets = { app: null, storage: null, database: null },
+    snapshot = null,
 ) => {
     const { platform, language } = eb.configurations[framework];
 
-    const s3Slug = module.exports.slug(
-        repo,
-        process.env.AWS_PROFILE,
-        branch,
-        "s3",
-    );
+    let s3Slug;
+    let s3Data = {};
 
-    await module.exports.iam.createIAMUser(s3Slug, tags);
-    await module.exports.iam.attachIAMPolicy(
-        s3Slug,
-        "arn:aws:iam::aws:policy/AmazonS3FullAccess",
-    );
-    const {
-        AccessKey: { AccessKeyId },
-        AccessKey: { SecretAccessKey },
-    } = await module.exports.iam.createAccessKey(s3Slug);
-
-    await module.exports.s3.createS3Bucket(
-        s3Slug,
-        tags,
-        false,
-        "BucketOwnerPreferred",
-    );
+    if (storage) {
+        s3Slug = module.exports.slug(
+            repo,
+            process.env.AWS_PROFILE,
+            branch,
+            "s3",
+        );
+
+        await module.exports.iam.createIAMUser(s3Slug, tags);
+        await module.exports.iam.attachIAMPolicy(
+            s3Slug,
+            "arn:aws:iam::aws:policy/AmazonS3FullAccess",
+        );
+        const {
+            AccessKey: { AccessKeyId },
+            AccessKey: { SecretAccessKey },
+        } = await module.exports.iam.createAccessKey(s3Slug);
+
+        await module.exports.s3.createS3Bucket(
+            s3Slug,
+            tags,
+            false,
+            "BucketOwnerPreferred",
+        );
+
+        s3Data = { s3Slug, AccessKeyId, SecretAccessKey };
+    }
 
     await module.exports.iam.ensureEBInstanceProfileExists();
     await module.exports.iam.ensureEBManagedUpdateProfileExists();
 
+    // Create decoupled RDS instance if database is required
+    let rdsData = {};
+
+    if (database) {
+        const rdsSlug = module.exports.slug(
+            repo,
+            process.env.AWS_PROFILE,
+            branch,
+            "rds",
+        );
+
+        const dbPassword = generator.generate({
+            length: 10,
+            numbers: true,
+        });
+
+        await module.exports.rds.ensureSSLParameterGroup();
+
+        const rdsSecurityGroupId =
+            await module.exports.ec2.createRDSSecurityGroup(rdsSlug, tags);
+
+        if (snapshot) {
+            await module.exports.rds.restoreRDSInstanceFromSnapshot(
+                rdsSlug,
+                snapshot,
+                rdsSecurityGroupId,
+                tags,
+            );
+
+            await module.exports.rds.waitForRDSInstance(rdsSlug);
+
+            await module.exports.rds.modifyRDSPassword(rdsSlug, dbPassword);
+        } else {
+            await module.exports.rds.createRDSInstance(
+                rdsSlug,
+                tags,
+                dbPassword,
+                rdsSecurityGroupId,
+            );
+        }
+
+        const rdsInstance =
+            await module.exports.rds.waitForRDSInstance(rdsSlug);
+
+        rdsData = {
+            RDS_HOSTNAME: rdsInstance.Endpoint.Address,
+            RDS_PORT: String(rdsInstance.Endpoint.Port),
+            RDS_PASSWORD: dbPassword,
+        };
+    }
+
     try {
         await module.exports.elasticbeanstalk.createElasticBeanstalkApplication(
             repo,
@@ -217,12 +393,71 @@ module.exports.fullstack = async (
     const CNAMEPrefix = `fw-auto-${name.split("-")[name.split("-").length - 1]}`;
     process.env.DOMAIN_LINK = `${CNAMEPrefix}.${process.env.AWS_REGION}.elasticbeanstalk.com`;
 
+    // Build secret payloads and create/reuse secrets
+    const payloads = eb.buildSecretPayloads(
+        { framework, availability, platform, language, database, storage },
+        { ...s3Data, ...rdsData },
+    );
+
+    const secretArns = {};
+
+    for (const group of ["app", "storage", "database"]) {
+        if (existingSecrets[group]) {
+            secretArns[`${group}SecretArn`] = existingSecrets[group];
+        } else if (Object.keys(payloads[group]).length) {
+            const res = await module.exports.secretsmanager.createSecret(
+                `${name}-${group}`,
+                payloads[group],
+                tags,
+            );
+            secretArns[`${group}SecretArn`] = res.ARN;
+        }
+    }
+
+    // Auto-generate environmentsecrets entries from secret keys + ARNs
+    const secretSettings = [];
+
+    for (const group of ["app", "storage", "database"]) {
+        const arn = secretArns[`${group}SecretArn`];
+        if (!arn) continue;
+
+        let keys;
+
+        if (existingSecrets[group]) {
+            const secretValue =
+                await module.exports.secretsmanager.getSecretValue(
+                    `${name}-${group}`,
+                );
+            keys = Object.keys(secretValue);
+        } else {
+            keys = Object.keys(payloads[group]);
+        }
+
+        for (const key of keys) {
+            secretSettings.push({
+                OptionName: key,
+                Value: `${arn}:${key}`,
+                Namespace:
+                    "aws:elasticbeanstalk:application:environmentsecrets",
+            });
+        }
+    }
+
     const OptionSettings = eb.merge(
         "environments",
-        { framework, availability, platform, language, database },
-        { s3Slug, AccessKeyId, SecretAccessKey },
+        {
+            framework,
+            availability,
+            platform,
+            language,
+            database,
+            storage,
+        },
+        { ...s3Data, ...rdsData },
     );
 
+    OptionSettings.push(...secretSettings);
+
     if (hasKeyPair) {
         OptionSettings.push({
             OptionName: "EC2KeyName",
@@ -241,6 +476,38 @@ module.exports.fullstack = async (
             tags,
         );
 
+    // Add RDS security group ingress rule from EB security group
+    const rdsSlugForIngress = module.exports.slug(
+        repo,
+        process.env.AWS_PROFILE,
+        branch,
+        "rds",
+    );
+
+    try {
+        const rdsSg = await module.exports.ec2.findSecurityGroupByName(
+            `${rdsSlugForIngress}-rds`,
+        );
+        const ebSg = await module.exports.ec2.findSecurityGroupByTag([
+            {
+                Name: "tag:elasticbeanstalk:environment-name",
+                Values: [name],
+            },
+            {
+                Name: "tag:aws:cloudformation:logical-id",
+                Values: ["AWSEBSecurityGroup"],
+            },
+        ]);
+        if (rdsSg && ebSg) {
+            await module.exports.ec2.authorizeRDSIngress(
+                rdsSg.GroupId,
+                ebSg.GroupId,
+            );
+        }
+    } catch {
+        /* empty */
+    }
+
     const configurations = eb.merge("configurations", {
         framework,
         availability,
@@ -287,28 +554,71 @@ module.exports.fullstack = async (
     return config;
 };
 
-module.exports.fullstackTerminate = async (name, repo, branch) => {
-    const s3Slug = module.exports.slug(
+module.exports.fullstackTerminate = async (
+    name,
+    repo,
+    branch,
+    {
+        deleteStorage = false,
+        deleteDatabase = false,
+        deleteAppSecret = false,
+    } = {},
+) => {
+    if (deleteStorage) {
+        const s3Slug = module.exports.slug(
+            repo,
+            process.env.AWS_PROFILE,
+            branch,
+            "s3",
+        );
+
+        try {
+            await module.exports.iam.removeIAMUser(s3Slug);
+        } catch {
+            /* empty */
+        }
+
+        try {
+            await module.exports.s3.emptyS3Bucket(s3Slug);
+        } catch {
+            /* empty */
+        }
+
+        try {
+            await module.exports.s3.removeS3Bucket(s3Slug);
+        } catch {
+            /* empty */
+        }
+    }
+
+    // Remove RDS inbound rule referencing EB security group before terminating EB
+    const rdsSlug = module.exports.slug(
         repo,
         process.env.AWS_PROFILE,
         branch,
-        "s3",
+        "rds",
     );
 
     try {
-        await module.exports.iam.removeIAMUser(s3Slug);
-    } catch {
-        /* empty */
-    }
-
-    try {
-        await module.exports.s3.emptyS3Bucket(s3Slug);
-    } catch {
-        /* empty */
-    }
-
-    try {
-        await module.exports.s3.removeS3Bucket(s3Slug);
+        const rdsSg = await module.exports.ec2.findSecurityGroupByName(
+            `${rdsSlug}-rds`,
+        );
+        const ebSg = await module.exports.ec2.findSecurityGroupByTag([
+            {
+                Name: "tag:elasticbeanstalk:environment-name",
+                Values: [name],
+            },
+            {
+                Name: "tag:aws:cloudformation:logical-id",
+                Values: ["AWSEBSecurityGroup"],
+            },
+        ]);
+        if (rdsSg && ebSg) {
+            await module.exports.ec2.revokeRDSIngress(
+                rdsSg.GroupId,
+                ebSg.GroupId,
+            );
+        }
     } catch {
         /* empty */
     }
@@ -328,4 +638,51 @@ module.exports.fullstackTerminate = async (name, repo, branch) => {
     } catch {
         /* empty */
     }
+
+    if (deleteDatabase) {
+        try {
+            await module.exports.rds.deleteRDSInstance(rdsSlug);
+            await module.exports.rds.waitForRDSDeletion(rdsSlug);
+        } catch {
+            /* empty */
+        }
+
+        try {
+            const sg = await module.exports.ec2.findSecurityGroupByName(
+                `${rdsSlug}-rds`,
+            );
+            if (sg) {
+                await module.exports.ec2.deleteSecurityGroup(sg.GroupId);
+            }
+        } catch {
+            /* empty */
+        }
+    }
+
+    // Delete secrets
+    if (deleteStorage) {
+        try {
+            await module.exports.secretsmanager.deleteSecret(`${name}-storage`);
+        } catch {
+            /* empty */
+        }
+    }
+
+    if (deleteDatabase) {
+        try {
+            await module.exports.secretsmanager.deleteSecret(
+                `${name}-database`,
+            );
+        } catch {
+            /* empty */
+        }
+    }
+
+    if (deleteAppSecret) {
+        try {
+            await module.exports.secretsmanager.deleteSecret(`${name}-app`);
+        } catch {
+            /* empty */
+        }
+    }
 };