@fishawack/lab-env 5.6.1 → 5.7.0-beta.2

package/commands/create/services/aws/opensearch.js

@@ -0,0 +1,147 @@
+const {
+    OpenSearchClient,
+    CreateDomainCommand,
+    DeleteDomainCommand,
+    DescribeDomainCommand,
+} = require("@aws-sdk/client-opensearch");
+const { Spinner, poll } = require("../../libs/utilities");
+
+module.exports.createOpenSearchDomain = async (
+    name,
+    securityGroupId,
+    privateSubnetIds,
+    instanceProfileRole,
+) => {
+    const client = new OpenSearchClient({});
+
+    const accountId = instanceProfileRole.split(":")[4] || "*";
+    const region = process.env.AWS_REGION;
+
+    const res = await Spinner.prototype.simple(
+        `Creating OpenSearch domain ${name}`,
+        () => {
+            return client.send(
+                new CreateDomainCommand({
+                    DomainName: name,
+                    EngineVersion: "OpenSearch_2.19",
+                    ClusterConfig: {
+                        InstanceType: "t3.small.search",
+                        InstanceCount: 2,
+                        ZoneAwarenessEnabled: true,
+                        ZoneAwarenessConfig: {
+                            AvailabilityZoneCount: 2,
+                        },
+                    },
+                    EBSOptions: {
+                        EBSEnabled: true,
+                        VolumeType: "gp3",
+                        VolumeSize: 20,
+                    },
+                    VPCOptions: {
+                        SubnetIds: privateSubnetIds,
+                        SecurityGroupIds: [securityGroupId],
+                    },
+                    EncryptionAtRestOptions: {
+                        Enabled: true,
+                    },
+                    NodeToNodeEncryptionOptions: {
+                        Enabled: true,
+                    },
+                    DomainEndpointOptions: {
+                        EnforceHTTPS: true,
+                        TLSSecurityPolicy: "Policy-Min-TLS-1-2-2019-07",
+                    },
+                    AdvancedSecurityOptions: {
+                        Enabled: false,
+                        InternalUserDatabaseEnabled: false,
+                    },
+                    AccessPolicies: JSON.stringify({
+                        Version: "2012-10-17",
+                        Statement: [
+                            {
+                                Effect: "Allow",
+                                Principal: {
+                                    AWS: instanceProfileRole,
+                                },
+                                Action: "es:ESHttp*",
+                                Resource: `arn:aws:es:${region}:${accountId}:domain/${name}/*`,
+                            },
+                        ],
+                    }),
+                }),
+            );
+        },
+    );
+
+    return res;
+};
+
+module.exports.waitForOpenSearchDomain = async (name) => {
+    const client = new OpenSearchClient({});
+
+    const res = await Spinner.prototype.simple(
+        `Waiting for OpenSearch domain to become available (this may take 15-20 minutes)`,
+        () => {
+            return poll(
+                async () => {
+                    const { DomainStatus } = await client.send(
+                        new DescribeDomainCommand({ DomainName: name }),
+                    );
+                    return DomainStatus;
+                },
+                (status) =>
+                    status.Processing ||
+                    (!status.Endpoint && !status.Endpoints),
+            );
+        },
+    );
+
+    return res;
+};
+
+module.exports.describeOpenSearchDomain = async (name) => {
+    const client = new OpenSearchClient({});
+
+    const res = await Spinner.prototype.simple(
+        `Describing OpenSearch domain ${name}`,
+        () => {
+            return client.send(new DescribeDomainCommand({ DomainName: name }));
+        },
+    );
+
+    return res.DomainStatus;
+};
+
+module.exports.deleteOpenSearchDomain = async (name) => {
+    const client = new OpenSearchClient({});
+
+    await Spinner.prototype.simple(`Deleting OpenSearch domain ${name}`, () => {
+        return client.send(new DeleteDomainCommand({ DomainName: name }));
+    });
+};
+
+module.exports.waitForOpenSearchDeletion = async (name) => {
+    const client = new OpenSearchClient({});
+
+    await Spinner.prototype.simple(
+        `Waiting for OpenSearch domain to be deleted`,
+        () => {
+            return poll(
+                async () => {
+                    try {
+                        const { DomainStatus } = await client.send(
+                            new DescribeDomainCommand({ DomainName: name }),
+                        );
+                        return DomainStatus;
+                    } catch (e) {
+                        if (e.name === "ResourceNotFoundException") {
+                            return { deleted: true };
+                        }
+                        throw e;
+                    }
+                },
+                (status) => !status.deleted,
+            );
+        },
+    );
+};

package/commands/create/services/aws/rds.js

@@ -0,0 +1,284 @@
+const {
+    RDSClient,
+    CreateDBInstanceCommand,
+    CreateDBSubnetGroupCommand,
+    DeleteDBInstanceCommand,
+    DescribeDBInstancesCommand,
+    DescribeDBSnapshotsCommand,
+    DescribeDBSubnetGroupsCommand,
+    RestoreDBInstanceFromDBSnapshotCommand,
+    ModifyDBInstanceCommand,
+    DescribeDBParameterGroupsCommand,
+    CreateDBParameterGroupCommand,
+    ModifyDBParameterGroupCommand,
+} = require("@aws-sdk/client-rds");
+const { Spinner, poll } = require("../../libs/utilities");
+
+module.exports.ensureDBSubnetGroup = async (privateSubnetIds) => {
+    const client = new RDSClient({});
+    const name = "fw-auto-private-db-subnet-group";
+
+    try {
+        await client.send(
+            new DescribeDBSubnetGroupsCommand({
+                DBSubnetGroupName: name,
+            }),
+        );
+
+        return name;
+    } catch (e) {
+        if (e.name !== "DBSubnetGroupNotFoundFault") {
+            throw e;
+        }
+    }
+
+    await Spinner.prototype.simple(`Creating DB subnet group ${name}`, () => {
+        return client.send(
+            new CreateDBSubnetGroupCommand({
+                DBSubnetGroupName: name,
+                DBSubnetGroupDescription:
+                    "Private subnets for lab-env RDS instances",
+                SubnetIds: privateSubnetIds,
+            }),
+        );
+    });
+
+    return name;
+};
+
+module.exports.createRDSInstance = async (
+    name,
+    tags = [],
+    password,
+    securityGroupId,
+    subnetGroupName,
+) => {
+    const client = new RDSClient({});
+
+    let res = await Spinner.prototype.simple(
+        `Creating RDS instance ${name}`,
+        () => {
+            return client.send(
+                new CreateDBInstanceCommand({
+                    DBInstanceIdentifier: name,
+                    DBInstanceClass: "db.t3.small",
+                    Engine: "mysql",
+                    EngineVersion: "8.0.43",
+                    MasterUsername: "ebroot",
+                    MasterUserPassword: password,
+                    AllocatedStorage: 5,
+                    StorageEncrypted: true,
+                    PubliclyAccessible: false,
+                    BackupRetentionPeriod: 7,
+                    DBName: "ebdb",
+                    DBParameterGroupName: "lab-env-mysql80-ssl-required",
+                    DBSubnetGroupName: subnetGroupName,
+                    VpcSecurityGroupIds: [securityGroupId],
+                    Tags: [
+                        { Key: "client", Value: process.env.AWS_PROFILE },
+                    ].concat(tags),
+                }),
+            );
+        },
+    );
+
+    return res;
+};
+
+module.exports.waitForRDSInstance = async (name) => {
+    const client = new RDSClient({});
+
+    const res = await Spinner.prototype.simple(
+        `Waiting for RDS instance to become available`,
+        () => {
+            return poll(
+                async () =>
+                    (
+                        await client.send(
+                            new DescribeDBInstancesCommand({
+                                DBInstanceIdentifier: name,
+                            }),
+                        )
+                    ).DBInstances[0],
+                ({ DBInstanceStatus }) => DBInstanceStatus !== "available",
+            );
+        },
+    );
+
+    return res;
+};
+
+module.exports.describeRDSInstance = async (name) => {
+    const client = new RDSClient({});
+
+    let res = await Spinner.prototype.simple(
+        `Describing RDS instance ${name}`,
+        () => {
+            return client.send(
+                new DescribeDBInstancesCommand({
+                    DBInstanceIdentifier: name,
+                }),
+            );
+        },
+    );
+
+    return res.DBInstances[0];
+};
+
+module.exports.deleteRDSInstance = async (name) => {
+    const client = new RDSClient({});
+
+    await Spinner.prototype.simple(`Deleting RDS instance ${name}`, () => {
+        return client.send(
+            new DeleteDBInstanceCommand({
+                DBInstanceIdentifier: name,
+                SkipFinalSnapshot: true,
+            }),
+        );
+    });
+};
+
+module.exports.waitForRDSDeletion = async (name) => {
+    const client = new RDSClient({});
+
+    await Spinner.prototype.simple(
+        `Waiting for RDS instance to be deleted`,
+        () => {
+            return poll(
+                async () => {
+                    try {
+                        const res = await client.send(
+                            new DescribeDBInstancesCommand({
+                                DBInstanceIdentifier: name,
+                            }),
+                        );
+                        return res.DBInstances[0];
+                    } catch (e) {
+                        if (e.name === "DBInstanceNotFoundFault") {
+                            return { DBInstanceStatus: "deleted" };
+                        }
+                        throw e;
+                    }
+                },
+                ({ DBInstanceStatus }) => DBInstanceStatus !== "deleted",
+            );
+        },
+    );
+};
+
+module.exports.listManualSnapshots = async () => {
+    const client = new RDSClient({});
+
+    const res = await Spinner.prototype.simple(
+        `Fetching manual RDS snapshots`,
+        () => {
+            return client.send(
+                new DescribeDBSnapshotsCommand({
+                    SnapshotType: "manual",
+                }),
+            );
+        },
+    );
+
+    return (res.DBSnapshots || [])
+        .filter((s) => s.Status === "available")
+        .sort(
+            (a, b) =>
+                new Date(b.SnapshotCreateTime) - new Date(a.SnapshotCreateTime),
+        );
+};
+
+module.exports.restoreRDSInstanceFromSnapshot = async (
+    name,
+    snapshotId,
+    securityGroupId,
+    tags = [],
+    subnetGroupName,
+) => {
+    const client = new RDSClient({});
+
+    let res = await Spinner.prototype.simple(
+        `Restoring RDS instance ${name} from snapshot ${snapshotId}`,
+        () => {
+            return client.send(
+                new RestoreDBInstanceFromDBSnapshotCommand({
+                    DBInstanceIdentifier: name,
+                    DBSnapshotIdentifier: snapshotId,
+                    DBInstanceClass: "db.t3.small",
+                    PubliclyAccessible: false,
+                    DBParameterGroupName: "lab-env-mysql80-ssl-required",
+                    DBSubnetGroupName: subnetGroupName,
+                    VpcSecurityGroupIds: [securityGroupId],
+                    Tags: [
+                        { Key: "client", Value: process.env.AWS_PROFILE },
+                    ].concat(tags),
+                }),
+            );
+        },
+    );
+
+    return res;
+};
+
+module.exports.modifyRDSPassword = async (name, password) => {
+    const client = new RDSClient({});
+
+    await Spinner.prototype.simple(
+        `Updating master password for RDS instance ${name}`,
+        () => {
+            return client.send(
+                new ModifyDBInstanceCommand({
+                    DBInstanceIdentifier: name,
+                    MasterUserPassword: password,
+                    ApplyImmediately: true,
+                }),
+            );
+        },
+    );
+};
+
+const SSL_PARAMETER_GROUP = "lab-env-mysql80-ssl-required";
+
+module.exports.ensureSSLParameterGroup = async () => {
+    const client = new RDSClient({});
+
+    try {
+        await client.send(
+            new DescribeDBParameterGroupsCommand({
+                DBParameterGroupName: SSL_PARAMETER_GROUP,
+            }),
+        );
+    } catch {
+        await Spinner.prototype.simple(
+            `Creating parameter group ${SSL_PARAMETER_GROUP}`,
+            () => {
+                return client.send(
+                    new CreateDBParameterGroupCommand({
+                        DBParameterGroupName: SSL_PARAMETER_GROUP,
+                        DBParameterGroupFamily: "mysql8.0",
+                        Description:
+                            "lab-env managed parameter group requiring SSL connections",
+                    }),
+                );
+            },
+        );
+
+        await Spinner.prototype.simple(
+            `Enabling require_secure_transport on ${SSL_PARAMETER_GROUP}`,
+            () => {
+                return client.send(
+                    new ModifyDBParameterGroupCommand({
+                        DBParameterGroupName: SSL_PARAMETER_GROUP,
+                        Parameters: [
+                            {
+                                ParameterName: "require_secure_transport",
+                                ParameterValue: "1",
+                                ApplyMethod: "immediate",
+                            },
+                        ],
+                    }),
+                );
+            },
+        );
+    }
+};

package/commands/create/services/aws/s3.js

@@ -30,18 +30,23 @@ module.exports.createS3Bucket = async (
         },
     );
 
+    const publicAccessConfig =
+        typeof blockAccess === "object"
+            ? blockAccess
+            : {
+                  BlockPublicAcls: blockAccess,
+                  BlockPublicPolicy: blockAccess,
+                  IgnorePublicAcls: blockAccess,
+                  RestrictPublicBuckets: blockAccess,
+              };
+
     await Spinner.prototype.simple(
-        `${blockAccess ? "Blocking" : "Allowing"} all public access to s3 bucket`,
+        `Configuring public access settings for s3 bucket`,
         () => {
             return client.send(
                 new PutPublicAccessBlockCommand({
                     Bucket: bucket,
-                    PublicAccessBlockConfiguration: {
-                        BlockPublicAcls: blockAccess,
-                        BlockPublicPolicy: blockAccess,
-                        IgnorePublicAcls: blockAccess,
-                        RestrictPublicBuckets: blockAccess,
-                    },
+                    PublicAccessBlockConfiguration: publicAccessConfig,
                 }),
             );
         },
@@ -116,6 +121,35 @@ module.exports.setS3BucketPolicy = async (bucket, OAI) => {
     return res;
 };
 
+module.exports.setPublicReadPolicy = async (bucket, prefix) => {
+    const client = new S3Client({});
+
+    let res = await Spinner.prototype.simple(
+        `Setting public read policy for ${prefix}`,
+        () => {
+            return client.send(
+                new PutBucketPolicyCommand({
+                    Bucket: bucket,
+                    Policy: JSON.stringify({
+                        Version: "2012-10-17",
+                        Statement: [
+                            {
+                                Sid: "PublicReadPrefix",
+                                Effect: "Allow",
+                                Principal: "*",
+                                Action: "s3:GetObject",
+                                Resource: `arn:aws:s3:::${bucket}/${prefix}`,
+                            },
+                        ],
+                    }),
+                }),
+            );
+        },
+    );
+
+    return res;
+};
+
 module.exports.addFileToS3Bucket = async (bucket, filepath, file) => {
     const client = new S3Client({});
 

package/commands/create/services/aws/secretsmanager.js

@@ -0,0 +1,89 @@
+const {
+    SecretsManagerClient,
+    CreateSecretCommand,
+    DescribeSecretCommand,
+    GetSecretValueCommand,
+    PutSecretValueCommand,
+    DeleteSecretCommand,
+} = require("@aws-sdk/client-secrets-manager");
+const { Spinner } = require("../../libs/utilities");
+
+module.exports.createSecret = async (name, secretObject, tags = []) => {
+    const client = new SecretsManagerClient({});
+
+    let res = await Spinner.prototype.simple(`Creating secret ${name}`, () => {
+        return client.send(
+            new CreateSecretCommand({
+                Name: name,
+                SecretString: JSON.stringify(secretObject),
+                Tags: tags.map((t) => ({ Key: t.Key, Value: String(t.Value) })),
+            }),
+        );
+    });
+
+    return res;
+};
+
+module.exports.describeSecret = async (name) => {
+    const client = new SecretsManagerClient({});
+
+    let res = await Spinner.prototype.simple(
+        `Checking for existing secret ${name}`,
+        () => {
+            return client.send(
+                new DescribeSecretCommand({
+                    SecretId: name,
+                }),
+            );
+        },
+    );
+
+    return res;
+};
+
+module.exports.getSecretValue = async (name) => {
+    const client = new SecretsManagerClient({});
+
+    let res = await Spinner.prototype.simple(
+        `Retrieving secret ${name}`,
+        () => {
+            return client.send(
+                new GetSecretValueCommand({
+                    SecretId: name,
+                }),
+            );
+        },
+    );
+
+    return JSON.parse(res.SecretString);
+};
+
+module.exports.updateSecretValue = async (name, secretObject) => {
+    const client = new SecretsManagerClient({});
+
+    let res = await Spinner.prototype.simple(`Updating secret ${name}`, () => {
+        return client.send(
+            new PutSecretValueCommand({
+                SecretId: name,
+                SecretString: JSON.stringify(secretObject),
+            }),
+        );
+    });
+
+    return res;
+};
+
+module.exports.deleteSecret = async (name) => {
+    const client = new SecretsManagerClient({});
+
+    let res = await Spinner.prototype.simple(`Deleting secret ${name}`, () => {
+        return client.send(
+            new DeleteSecretCommand({
+                SecretId: name,
+                ForceDeleteWithoutRecovery: true,
+            }),
+        );
+    });
+
+    return res;
+};

package/commands/create/templates/elasticbeanstalk/.ebextensions/laravel/rds-ssl.config

@@ -0,0 +1,5 @@
+commands:
+  01-download-rds-cert:
+    command: |
+      mkdir -p /opt/rds-certs
+      curl -so /opt/rds-certs/global-bundle.pem https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem

package/commands/create/templates/elasticbeanstalk/.ebextensions/misc/setvars.config

@@ -5,7 +5,22 @@ option_settings:
 commands:
   setvars:
     command: |
-      /opt/elasticbeanstalk/bin/get-config environment | jq -r "to_entries | .[] | \"export \(.key)='\(.value)'\"" > /etc/profile.d/sh.local
+      ENV_NAME=$(/opt/elasticbeanstalk/bin/get-config container -k environment_name)
+      REGION=$(TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") && curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region)
+
+      > /etc/profile.d/sh.local
+      > /etc/sysconfig/env
+
+      for GROUP in app storage database; do
+        SECRET_JSON=$(aws secretsmanager get-secret-value \
+          --secret-id "${ENV_NAME}-${GROUP}" \
+          --region "$REGION" \
+          --query SecretString \
+          --output text 2>/dev/null) || continue
+
+        echo "$SECRET_JSON" | jq -r 'to_entries | .[] | "export \(.key)=\u0027\(.value)\u0027"' >> /etc/profile.d/sh.local
+        echo "$SECRET_JSON" | jq -r 'to_entries | .[] | "\(.key)=\"\(.value)\""' >> /etc/sysconfig/env
+      done
 
 packages:
   yum:

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@fishawack/lab-env",
-    "version": "5.6.1",
+    "version": "5.7.0-beta.2",
     "description": "Docker manager for FW",
     "main": "cli.js",
     "scripts": {
@@ -21,11 +21,15 @@
         "fw": "cli.js"
     },
     "dependencies": {
+        "@aws-sdk/client-acm": "^3.1067.0",
         "@aws-sdk/client-cloudfront": "^3.141.0",
         "@aws-sdk/client-ec2": "^3.399.0",
         "@aws-sdk/client-elastic-beanstalk": "^3.395.0",
         "@aws-sdk/client-iam": "^3.150.0",
+        "@aws-sdk/client-opensearch": "^3.1065.0",
+        "@aws-sdk/client-rds": "^3.395.0",
         "@aws-sdk/client-s3": "^3.141.0",
+        "@aws-sdk/client-secrets-manager": "^3.395.0",
         "@aws-sdk/credential-providers": "^3.1011.0",
         "apache-md5": "^1.1.8",
         "axios": "^0.21.4",