@fishawack/lab-env 5.6.1-beta.1 → 5.7.0-beta.1

package/commands/create/services/aws/rds.js

@@ -0,0 +1,246 @@
+const {
+    RDSClient,
+    CreateDBInstanceCommand,
+    DeleteDBInstanceCommand,
+    DescribeDBInstancesCommand,
+    DescribeDBSnapshotsCommand,
+    RestoreDBInstanceFromDBSnapshotCommand,
+    ModifyDBInstanceCommand,
+    DescribeDBParameterGroupsCommand,
+    CreateDBParameterGroupCommand,
+    ModifyDBParameterGroupCommand,
+} = require("@aws-sdk/client-rds");
+const { Spinner, poll } = require("../../libs/utilities");
+
+module.exports.createRDSInstance = async (
+    name,
+    tags = [],
+    password,
+    securityGroupId,
+) => {
+    const client = new RDSClient({});
+
+    let res = await Spinner.prototype.simple(
+        `Creating RDS instance ${name}`,
+        () => {
+            return client.send(
+                new CreateDBInstanceCommand({
+                    DBInstanceIdentifier: name,
+                    DBInstanceClass: "db.t3.small",
+                    Engine: "mysql",
+                    EngineVersion: "8.0.43",
+                    MasterUsername: "ebroot",
+                    MasterUserPassword: password,
+                    AllocatedStorage: 5,
+                    StorageEncrypted: true,
+                    PubliclyAccessible: false,
+                    BackupRetentionPeriod: 7,
+                    DBName: "ebdb",
+                    DBParameterGroupName: "lab-env-mysql80-ssl-required",
+                    VpcSecurityGroupIds: [securityGroupId],
+                    Tags: [
+                        { Key: "client", Value: process.env.AWS_PROFILE },
+                    ].concat(tags),
+                }),
+            );
+        },
+    );
+
+    return res;
+};
+
+module.exports.waitForRDSInstance = async (name) => {
+    const client = new RDSClient({});
+
+    const res = await Spinner.prototype.simple(
+        `Waiting for RDS instance to become available`,
+        () => {
+            return poll(
+                async () =>
+                    (
+                        await client.send(
+                            new DescribeDBInstancesCommand({
+                                DBInstanceIdentifier: name,
+                            }),
+                        )
+                    ).DBInstances[0],
+                ({ DBInstanceStatus }) => DBInstanceStatus !== "available",
+            );
+        },
+    );
+
+    return res;
+};
+
+module.exports.describeRDSInstance = async (name) => {
+    const client = new RDSClient({});
+
+    let res = await Spinner.prototype.simple(
+        `Describing RDS instance ${name}`,
+        () => {
+            return client.send(
+                new DescribeDBInstancesCommand({
+                    DBInstanceIdentifier: name,
+                }),
+            );
+        },
+    );
+
+    return res.DBInstances[0];
+};
+
+module.exports.deleteRDSInstance = async (name) => {
+    const client = new RDSClient({});
+
+    await Spinner.prototype.simple(`Deleting RDS instance ${name}`, () => {
+        return client.send(
+            new DeleteDBInstanceCommand({
+                DBInstanceIdentifier: name,
+                SkipFinalSnapshot: true,
+            }),
+        );
+    });
+};
+
+module.exports.waitForRDSDeletion = async (name) => {
+    const client = new RDSClient({});
+
+    await Spinner.prototype.simple(
+        `Waiting for RDS instance to be deleted`,
+        () => {
+            return poll(
+                async () => {
+                    try {
+                        const res = await client.send(
+                            new DescribeDBInstancesCommand({
+                                DBInstanceIdentifier: name,
+                            }),
+                        );
+                        return res.DBInstances[0];
+                    } catch (e) {
+                        if (e.name === "DBInstanceNotFoundFault") {
+                            return { DBInstanceStatus: "deleted" };
+                        }
+                        throw e;
+                    }
+                },
+                ({ DBInstanceStatus }) => DBInstanceStatus !== "deleted",
+            );
+        },
+    );
+};
+
+module.exports.listManualSnapshots = async () => {
+    const client = new RDSClient({});
+
+    const res = await Spinner.prototype.simple(
+        `Fetching manual RDS snapshots`,
+        () => {
+            return client.send(
+                new DescribeDBSnapshotsCommand({
+                    SnapshotType: "manual",
+                }),
+            );
+        },
+    );
+
+    return (res.DBSnapshots || [])
+        .filter((s) => s.Status === "available")
+        .sort(
+            (a, b) =>
+                new Date(b.SnapshotCreateTime) - new Date(a.SnapshotCreateTime),
+        );
+};
+
+module.exports.restoreRDSInstanceFromSnapshot = async (
+    name,
+    snapshotId,
+    securityGroupId,
+    tags = [],
+) => {
+    const client = new RDSClient({});
+
+    let res = await Spinner.prototype.simple(
+        `Restoring RDS instance ${name} from snapshot ${snapshotId}`,
+        () => {
+            return client.send(
+                new RestoreDBInstanceFromDBSnapshotCommand({
+                    DBInstanceIdentifier: name,
+                    DBSnapshotIdentifier: snapshotId,
+                    DBInstanceClass: "db.t3.small",
+                    PubliclyAccessible: false,
+                    DBParameterGroupName: "lab-env-mysql80-ssl-required",
+                    VpcSecurityGroupIds: [securityGroupId],
+                    Tags: [
+                        { Key: "client", Value: process.env.AWS_PROFILE },
+                    ].concat(tags),
+                }),
+            );
+        },
+    );
+
+    return res;
+};
+
+module.exports.modifyRDSPassword = async (name, password) => {
+    const client = new RDSClient({});
+
+    await Spinner.prototype.simple(
+        `Updating master password for RDS instance ${name}`,
+        () => {
+            return client.send(
+                new ModifyDBInstanceCommand({
+                    DBInstanceIdentifier: name,
+                    MasterUserPassword: password,
+                    ApplyImmediately: true,
+                }),
+            );
+        },
+    );
+};
+
+const SSL_PARAMETER_GROUP = "lab-env-mysql80-ssl-required";
+
+module.exports.ensureSSLParameterGroup = async () => {
+    const client = new RDSClient({});
+
+    try {
+        await client.send(
+            new DescribeDBParameterGroupsCommand({
+                DBParameterGroupName: SSL_PARAMETER_GROUP,
+            }),
+        );
+    } catch {
+        await Spinner.prototype.simple(
+            `Creating parameter group ${SSL_PARAMETER_GROUP}`,
+            () => {
+                return client.send(
+                    new CreateDBParameterGroupCommand({
+                        DBParameterGroupName: SSL_PARAMETER_GROUP,
+                        DBParameterGroupFamily: "mysql8.0",
+                        Description:
+                            "lab-env managed parameter group requiring SSL connections",
+                    }),
+                );
+            },
+        );
+
+        await Spinner.prototype.simple(
+            `Enabling require_secure_transport on ${SSL_PARAMETER_GROUP}`,
+            () => {
+                return client.send(
+                    new ModifyDBParameterGroupCommand({
+                        DBParameterGroupName: SSL_PARAMETER_GROUP,
+                        Parameters: [
+                            {
+                                ParameterName: "require_secure_transport",
+                                ParameterValue: "1",
+                                ApplyMethod: "immediate",
+                            },
+                        ],
+                    }),
+                );
+            },
+        );
+    }
+};

package/commands/create/services/aws/secretsmanager.js

@@ -0,0 +1,73 @@
+const {
+    SecretsManagerClient,
+    CreateSecretCommand,
+    DescribeSecretCommand,
+    GetSecretValueCommand,
+    DeleteSecretCommand,
+} = require("@aws-sdk/client-secrets-manager");
+const { Spinner } = require("../../libs/utilities");
+
+module.exports.createSecret = async (name, secretObject, tags = []) => {
+    const client = new SecretsManagerClient({});
+
+    let res = await Spinner.prototype.simple(`Creating secret ${name}`, () => {
+        return client.send(
+            new CreateSecretCommand({
+                Name: name,
+                SecretString: JSON.stringify(secretObject),
+                Tags: tags.map((t) => ({ Key: t.Key, Value: String(t.Value) })),
+            }),
+        );
+    });
+
+    return res;
+};
+
+module.exports.describeSecret = async (name) => {
+    const client = new SecretsManagerClient({});
+
+    let res = await Spinner.prototype.simple(
+        `Checking for existing secret ${name}`,
+        () => {
+            return client.send(
+                new DescribeSecretCommand({
+                    SecretId: name,
+                }),
+            );
+        },
+    );
+
+    return res;
+};
+
+module.exports.getSecretValue = async (name) => {
+    const client = new SecretsManagerClient({});
+
+    let res = await Spinner.prototype.simple(
+        `Retrieving secret ${name}`,
+        () => {
+            return client.send(
+                new GetSecretValueCommand({
+                    SecretId: name,
+                }),
+            );
+        },
+    );
+
+    return JSON.parse(res.SecretString);
+};
+
+module.exports.deleteSecret = async (name) => {
+    const client = new SecretsManagerClient({});
+
+    let res = await Spinner.prototype.simple(`Deleting secret ${name}`, () => {
+        return client.send(
+            new DeleteSecretCommand({
+                SecretId: name,
+                ForceDeleteWithoutRecovery: true,
+            }),
+        );
+    });
+
+    return res;
+};

package/commands/create/templates/elasticbeanstalk/.ebextensions/laravel/rds-ssl.config

@@ -0,0 +1,5 @@
+commands:
+  01-download-rds-cert:
+    command: |
+      mkdir -p /opt/rds-certs
+      curl -so /opt/rds-certs/global-bundle.pem https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem

package/commands/create/templates/elasticbeanstalk/.ebextensions/misc/setvars.config

@@ -5,7 +5,22 @@ option_settings:
 commands:
   setvars:
     command: |
-      /opt/elasticbeanstalk/bin/get-config environment | jq -r "to_entries | .[] | \"export \(.key)='\(.value)'\"" > /etc/profile.d/sh.local
+      ENV_NAME=$(/opt/elasticbeanstalk/bin/get-config container -k environment_name)
+      REGION=$(TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") && curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region)
+
+      > /etc/profile.d/sh.local
+      > /etc/sysconfig/env
+
+      for GROUP in app storage database; do
+        SECRET_JSON=$(aws secretsmanager get-secret-value \
+          --secret-id "${ENV_NAME}-${GROUP}" \
+          --region "$REGION" \
+          --query SecretString \
+          --output text 2>/dev/null) || continue
+
+        echo "$SECRET_JSON" | jq -r 'to_entries | .[] | "export \(.key)=\u0027\(.value)\u0027"' >> /etc/profile.d/sh.local
+        echo "$SECRET_JSON" | jq -r 'to_entries | .[] | "\(.key)=\"\(.value)\""' >> /etc/sysconfig/env
+      done
 
 packages:
   yum:

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@fishawack/lab-env",
-    "version": "5.6.1-beta.1",
+    "version": "5.7.0-beta.1",
     "description": "Docker manager for FW",
     "main": "cli.js",
     "scripts": {
@@ -25,7 +25,9 @@
         "@aws-sdk/client-ec2": "^3.399.0",
         "@aws-sdk/client-elastic-beanstalk": "^3.395.0",
         "@aws-sdk/client-iam": "^3.150.0",
+        "@aws-sdk/client-rds": "^3.395.0",
         "@aws-sdk/client-s3": "^3.141.0",
+        "@aws-sdk/client-secrets-manager": "^3.395.0",
         "@aws-sdk/credential-providers": "^3.1011.0",
         "apache-md5": "^1.1.8",
         "axios": "^0.21.4",