@fishawack/lab-env 5.7.0-beta.1 → 5.7.0-beta.2

package/commands/create/services/aws/index.js

@@ -10,9 +10,13 @@ const {
     SecretsManagerClient,
     DescribeSecretCommand,
 } = require("@aws-sdk/client-secrets-manager");
+const {
+    OpenSearchClient,
+    DescribeDomainCommand,
+} = require("@aws-sdk/client-opensearch");
 
 const { nameSafe, Spinner } = require("../../libs/utilities.js");
-const { eb } = require("../../libs/vars.js");
+const { eb, secretGroups } = require("../../libs/vars.js");
 
 module.exports.s3 = require("./s3.js");
 module.exports.cloudfront = require("./cloudfront.js");
@@ -20,7 +24,9 @@ module.exports.iam = require("./iam.js");
 module.exports.elasticbeanstalk = require("./elasticbeanstalk.js");
 module.exports.ec2 = require("./ec2.js");
 module.exports.rds = require("./rds.js");
+module.exports.opensearch = require("./opensearch.js");
 module.exports.secretsmanager = require("./secretsmanager.js");
+module.exports.acm = require("./acm.js");
 
 module.exports.slug = (repo, client, branch, service = "s3") =>
     nameSafe(`${branch}-${repo}-${client}`, service);
@@ -29,13 +35,14 @@ module.exports.fullstackPreflight = async (
     name,
     repo,
     branch,
-    { storage = false, database = false } = {},
+    { storage = false, database = false, opensearch = false } = {},
 ) => {
-    const conflicts = [];
     const existing = {
+        environment: false,
         storage: false,
         database: false,
-        secrets: { app: null, storage: null, database: null },
+        opensearch: false,
+        secrets: { app: null, storage: null, database: null, opensearch: null },
     };
 
     const spinner = new Spinner("Running pre-flight checks", true);
@@ -50,9 +57,7 @@ module.exports.fullstackPreflight = async (
                 (e) => e.Status !== "Terminated",
             );
             if (active.length) {
-                conflicts.push(
-                    `Elastic Beanstalk environment "${name}" already exists (status: ${active[0].Status})`,
-                );
+                existing.environment = active[0];
             }
         } catch {
             /* does not exist */
@@ -105,8 +110,29 @@ module.exports.fullstackPreflight = async (
             }
         }
 
+        // Check OpenSearch
+        if (opensearch) {
+            const osSlug = module.exports.slug(
+                repo,
+                process.env.AWS_PROFILE,
+                branch,
+                "os",
+            );
+
+            spinner.ora.text = "Checking for existing OpenSearch domain";
+            try {
+                const { DomainStatus } = await new OpenSearchClient({}).send(
+                    new DescribeDomainCommand({ DomainName: osSlug }),
+                );
+                if (DomainStatus && !DomainStatus.Deleted) {
+                    existing.opensearch = true;
+                }
+            } catch {
+                /* does not exist */
+            }
+        }
+
         // Check for existing secrets
-        const secretGroups = ["app", "storage", "database"];
         for (const group of secretGroups) {
             spinner.ora.text = `Checking for existing ${group} secret`;
             try {
@@ -125,7 +151,7 @@ module.exports.fullstackPreflight = async (
         throw e;
     }
 
-    return { conflicts, existing };
+    return { existing };
 };
 
 module.exports.clients = [
@@ -282,49 +308,104 @@ module.exports.fullstack = async (
     availability,
     database = false,
     storage = false,
-    existingSecrets = { app: null, storage: null, database: null },
+    opensearch = false,
+    existingSecrets = {
+        app: null,
+        storage: null,
+        database: null,
+        opensearch: null,
+    },
     snapshot = null,
+    elbScheme = "public",
+    existingEnvironment = false,
+    existingResources = {
+        storage: false,
+        database: false,
+        opensearch: false,
+    },
+    appName,
+    appDomain,
+    certArn,
 ) => {
     const { platform, language } = eb.configurations[framework];
+    const isLaravel = framework === "laravel";
+
+    // Always compute s3Slug if storage is requested or pre-exists
+    // (needed for instance profile S3 access even when bucket creation is skipped)
+    const s3Slug =
+        storage || existingSecrets.storage
+            ? module.exports.slug(repo, process.env.AWS_PROFILE, branch, "s3")
+            : undefined;
+
+    // Always compute osSlug if opensearch is requested or pre-exists
+    const osSlug =
+        opensearch || existingSecrets.opensearch
+            ? module.exports.slug(repo, process.env.AWS_PROFILE, branch, "os")
+            : undefined;
 
-    let s3Slug;
     let s3Data = {};
 
-    if (storage) {
-        s3Slug = module.exports.slug(
-            repo,
-            process.env.AWS_PROFILE,
-            branch,
-            "s3",
-        );
+    if (storage && !existingResources.storage) {
+        if (isLaravel) {
+            await module.exports.s3.createS3Bucket(s3Slug, tags, {
+                BlockPublicAcls: true,
+                IgnorePublicAcls: true,
+                BlockPublicPolicy: false,
+                RestrictPublicBuckets: false,
+            });
 
-        await module.exports.iam.createIAMUser(s3Slug, tags);
-        await module.exports.iam.attachIAMPolicy(
-            s3Slug,
-            "arn:aws:iam::aws:policy/AmazonS3FullAccess",
-        );
-        const {
-            AccessKey: { AccessKeyId },
-            AccessKey: { SecretAccessKey },
-        } = await module.exports.iam.createAccessKey(s3Slug);
+            await module.exports.s3.setPublicReadPolicy(s3Slug, "public/*");
+        } else {
+            await module.exports.iam.createIAMUser(s3Slug, tags);
+            await module.exports.iam.attachIAMPolicy(
+                s3Slug,
+                "arn:aws:iam::aws:policy/AmazonS3FullAccess",
+            );
+            const {
+                AccessKey: { AccessKeyId },
+                AccessKey: { SecretAccessKey },
+            } = await module.exports.iam.createAccessKey(s3Slug);
 
-        await module.exports.s3.createS3Bucket(
-            s3Slug,
-            tags,
-            false,
-            "BucketOwnerPreferred",
-        );
+            await module.exports.s3.createS3Bucket(
+                s3Slug,
+                tags,
+                false,
+                "BucketOwnerPreferred",
+            );
+
+            s3Data = { s3Slug, AccessKeyId, SecretAccessKey };
+        }
+    }
+
+    if (storage && !s3Data.s3Slug) {
+        s3Data = { s3Slug };
+    }
 
-        s3Data = { s3Slug, AccessKeyId, SecretAccessKey };
+    let instanceProfileName;
+    let opensearchDomainArn;
+
+    if (osSlug) {
+        opensearchDomainArn = `arn:aws:es:${process.env.AWS_REGION}:*:domain/${osSlug}`;
+    }
+
+    if (isLaravel) {
+        instanceProfileName =
+            await module.exports.iam.ensureEnvironmentInstanceProfile(
+                name,
+                s3Slug,
+                opensearchDomainArn,
+            );
+    } else {
+        await module.exports.iam.ensureEBInstanceProfileExists();
     }
 
-    await module.exports.iam.ensureEBInstanceProfileExists();
     await module.exports.iam.ensureEBManagedUpdateProfileExists();
+    const vpcData = await module.exports.ec2.ensurePrivateSubnets();
 
     // Create decoupled RDS instance if database is required
     let rdsData = {};
 
-    if (database) {
+    if (database && !existingResources.database) {
         const rdsSlug = module.exports.slug(
             repo,
             process.env.AWS_PROFILE,
@@ -342,12 +423,17 @@ module.exports.fullstack = async (
         const rdsSecurityGroupId =
             await module.exports.ec2.createRDSSecurityGroup(rdsSlug, tags);
 
+        const dbSubnetGroupName = await module.exports.rds.ensureDBSubnetGroup(
+            vpcData.privateSubnetIds,
+        );
+
         if (snapshot) {
             await module.exports.rds.restoreRDSInstanceFromSnapshot(
                 rdsSlug,
                 snapshot,
                 rdsSecurityGroupId,
                 tags,
+                dbSubnetGroupName,
             );
 
             await module.exports.rds.waitForRDSInstance(rdsSlug);
@@ -359,6 +445,7 @@ module.exports.fullstack = async (
                 tags,
                 dbPassword,
                 rdsSecurityGroupId,
+                dbSubnetGroupName,
             );
         }
 
@@ -370,6 +457,92 @@ module.exports.fullstack = async (
             RDS_PORT: String(rdsInstance.Endpoint.Port),
             RDS_PASSWORD: dbPassword,
         };
+    } else if (
+        database &&
+        existingResources.database &&
+        !existingSecrets.database
+    ) {
+        // Recovery: RDS exists but secret was lost — reset password and populate data
+        const rdsSlug = module.exports.slug(
+            repo,
+            process.env.AWS_PROFILE,
+            branch,
+            "rds",
+        );
+
+        const dbPassword = generator.generate({
+            length: 10,
+            numbers: true,
+        });
+
+        await module.exports.rds.modifyRDSPassword(rdsSlug, dbPassword);
+        const rdsInstance =
+            await module.exports.rds.waitForRDSInstance(rdsSlug);
+
+        rdsData = {
+            RDS_HOSTNAME: rdsInstance.Endpoint.Address,
+            RDS_PORT: String(rdsInstance.Endpoint.Port),
+            RDS_PASSWORD: dbPassword,
+        };
+    } else if (
+        database &&
+        existingResources.database &&
+        existingSecrets.database
+    ) {
+        // Existing RDS + secret — read secret values for template interpolation
+        const secretValue = await module.exports.secretsmanager.getSecretValue(
+            `${name}-database`,
+        );
+        rdsData = {
+            RDS_HOSTNAME: secretValue.RDS_HOSTNAME,
+            RDS_PORT: secretValue.RDS_PORT,
+            RDS_PASSWORD: secretValue.RDS_PASSWORD,
+        };
+    }
+
+    // Create decoupled OpenSearch domain if requested
+    let osData = {};
+
+    if (opensearch && !existingResources.opensearch) {
+        await module.exports.iam.ensureOpenSearchServiceRole();
+
+        const roleArn = instanceProfileName
+            ? (await module.exports.iam.getRole(instanceProfileName)).Role.Arn
+            : undefined;
+
+        const osSecurityGroupId =
+            await module.exports.ec2.createOpenSearchSecurityGroup(
+                osSlug,
+                tags,
+            );
+
+        await module.exports.opensearch.createOpenSearchDomain(
+            osSlug,
+            osSecurityGroupId,
+            vpcData.privateSubnetIds,
+            roleArn,
+        );
+
+        const osDomain =
+            await module.exports.opensearch.waitForOpenSearchDomain(osSlug);
+
+        const osEndpoint =
+            osDomain.Endpoint || (osDomain.Endpoints && osDomain.Endpoints.vpc);
+
+        osData = {
+            SEARCH_HOST: `https://${osEndpoint}`,
+        };
+    } else if (opensearch && existingResources.opensearch) {
+        // Existing domain — describe to populate osData for secret payloads
+        const osDomain =
+            await module.exports.opensearch.describeOpenSearchDomain(osSlug);
+
+        const osEndpoint =
+            osDomain.Endpoint || (osDomain.Endpoints && osDomain.Endpoints.vpc);
+
+        osData = {
+            SEARCH_HOST: `https://${osEndpoint}`,
+        };
     }
 
     try {
@@ -395,15 +568,51 @@ module.exports.fullstack = async (
 
     // Build secret payloads and create/reuse secrets
     const payloads = eb.buildSecretPayloads(
-        { framework, availability, platform, language, database, storage },
-        { ...s3Data, ...rdsData },
+        {
+            framework,
+            availability,
+            platform,
+            language,
+            database,
+            storage,
+            opensearch,
+        },
+        {
+            ...s3Data,
+            ...rdsData,
+            ...osData,
+            APP_NAME: appName,
+            APP_DOMAIN: appDomain,
+        },
     );
 
     const secretArns = {};
 
-    for (const group of ["app", "storage", "database"]) {
+    for (const group of secretGroups) {
         if (existingSecrets[group]) {
             secretArns[`${group}SecretArn`] = existingSecrets[group];
+
+            // Merge new keys into existing secret if payload has additions
+            if (Object.keys(payloads[group]).length) {
+                const currentValue =
+                    await module.exports.secretsmanager.getSecretValue(
+                        `${name}-${group}`,
+                    );
+                const newKeys = Object.keys(payloads[group]).filter(
+                    (k) => !(k in currentValue),
+                );
+
+                if (newKeys.length) {
+                    const merged = { ...currentValue };
+                    for (const k of newKeys) {
+                        merged[k] = payloads[group][k];
+                    }
+                    await module.exports.secretsmanager.updateSecretValue(
+                        `${name}-${group}`,
+                        merged,
+                    );
+                }
+            }
         } else if (Object.keys(payloads[group]).length) {
             const res = await module.exports.secretsmanager.createSecret(
                 `${name}-${group}`,
@@ -417,7 +626,7 @@ module.exports.fullstack = async (
     // Auto-generate environmentsecrets entries from secret keys + ARNs
     const secretSettings = [];
 
-    for (const group of ["app", "storage", "database"]) {
+    for (const group of secretGroups) {
         const arn = secretArns[`${group}SecretArn`];
         if (!arn) continue;
 
@@ -443,39 +652,129 @@ module.exports.fullstack = async (
         }
     }
 
-    const OptionSettings = eb.merge(
-        "environments",
-        {
-            framework,
-            availability,
-            platform,
-            language,
-            database,
-            storage,
-        },
-        { ...s3Data, ...rdsData },
-    );
+    let environment;
+
+    if (existingEnvironment) {
+        // Re-provision: sync secrets to existing EB environment
+        const SECRETS_NAMESPACE =
+            "aws:elasticbeanstalk:application:environmentsecrets";
+        const currentSettings =
+            await module.exports.elasticbeanstalk.describeConfigurationSettings(
+                repo,
+                name,
+            );
+        const currentSecrets = currentSettings.filter(
+            (s) => s.Namespace === SECRETS_NAMESPACE,
+        );
 
-    OptionSettings.push(...secretSettings);
+        const currentKeys = new Set(currentSecrets.map((s) => s.OptionName));
+        const expectedKeys = new Set(secretSettings.map((s) => s.OptionName));
 
-    if (hasKeyPair) {
-        OptionSettings.push({
-            OptionName: "EC2KeyName",
-            Value: "id_rsa_prev",
-            Namespace: "aws:autoscaling:launchconfiguration",
+        const toAdd = secretSettings.filter(
+            (s) => !currentKeys.has(s.OptionName),
+        );
+        const toUpdate = secretSettings.filter((s) => {
+            const current = currentSecrets.find(
+                (c) => c.OptionName === s.OptionName,
+            );
+            return current && current.Value !== s.Value;
         });
-    }
+        const toRemove = currentSecrets
+            .filter((s) => !expectedKeys.has(s.OptionName))
+            .map((s) => ({
+                OptionName: s.OptionName,
+                Namespace: SECRETS_NAMESPACE,
+            }));
+
+        const optionSettings = [...toAdd, ...toUpdate];
+
+        if (optionSettings.length || toRemove.length) {
+            await module.exports.elasticbeanstalk.updateEnvironmentSettings(
+                name,
+                optionSettings,
+                toRemove,
+            );
+        }
 
-    const environment =
-        await module.exports.elasticbeanstalk.createElasticBeanstalkEnvironment(
-            name,
-            { framework, availability, platform, language },
-            repo,
-            OptionSettings,
-            CNAMEPrefix,
-            tags,
+        environment = existingEnvironment;
+    } else {
+        const OptionSettings = eb.merge(
+            "environments",
+            {
+                framework,
+                availability,
+                platform,
+                language,
+                database,
+                storage,
+                opensearch,
+                vpcId: vpcData.vpcId,
+                privateSubnetIds: vpcData.privateSubnetIds.join(","),
+                publicSubnetIds: vpcData.publicSubnetIds.join(","),
+                elbScheme,
+                instanceProfileName,
+            },
+            {
+                ...s3Data,
+                ...rdsData,
+                ...osData,
+                APP_NAME: appName,
+                APP_DOMAIN: appDomain,
+            },
         );
 
+        // HTTPS listener via ACM cert
+        if (certArn) {
+            OptionSettings.push(
+                {
+                    OptionName: "ListenerEnabled",
+                    Value: "true",
+                    Namespace: "aws:elbv2:listener:443",
+                },
+                {
+                    OptionName: "Protocol",
+                    Value: "HTTPS",
+                    Namespace: "aws:elbv2:listener:443",
+                },
+                {
+                    OptionName: "SSLCertificateArns",
+                    Value: certArn,
+                    Namespace: "aws:elbv2:listener:443",
+                },
+                {
+                    OptionName: "SSLPolicy",
+                    Value: "ELBSecurityPolicy-FS-1-2-Res-2020-10",
+                    Namespace: "aws:elbv2:listener:443",
+                },
+                {
+                    OptionName: "DefaultProcess",
+                    Value: "default",
+                    Namespace: "aws:elbv2:listener:443",
+                },
+            );
+        }
+
+        OptionSettings.push(...secretSettings);
+
+        if (hasKeyPair) {
+            OptionSettings.push({
+                OptionName: "EC2KeyName",
+                Value: "id_rsa_prev",
+                Namespace: "aws:autoscaling:launchconfiguration",
+            });
+        }
+
+        environment =
+            await module.exports.elasticbeanstalk.createElasticBeanstalkEnvironment(
+                name,
+                { framework, availability, platform, language },
+                repo,
+                OptionSettings,
+                CNAMEPrefix,
+                tags,
+            );
+    }
+
     // Add RDS security group ingress rule from EB security group
     const rdsSlugForIngress = module.exports.slug(
         repo,
@@ -508,6 +807,33 @@ module.exports.fullstack = async (
         /* empty */
     }
 
+    // Add OpenSearch security group ingress rule from EB security group
+    if (osSlug) {
+        try {
+            const osSg = await module.exports.ec2.findSecurityGroupByName(
+                `${osSlug}-os`,
+            );
+            const ebSgForOs = await module.exports.ec2.findSecurityGroupByTag([
+                {
+                    Name: "tag:elasticbeanstalk:environment-name",
+                    Values: [name],
+                },
+                {
+                    Name: "tag:aws:cloudformation:logical-id",
+                    Values: ["AWSEBSecurityGroup"],
+                },
+            ]);
+            if (osSg && ebSgForOs) {
+                await module.exports.ec2.authorizeOpenSearchIngress(
+                    osSg.GroupId,
+                    ebSgForOs.GroupId,
+                );
+            }
+        } catch {
+            /* empty */
+        }
+    }
+
     const configurations = eb.merge("configurations", {
         framework,
         availability,
@@ -561,6 +887,7 @@ module.exports.fullstackTerminate = async (
     {
         deleteStorage = false,
         deleteDatabase = false,
+        deleteOpenSearch = false,
         deleteAppSecret = false,
     } = {},
 ) => {
@@ -623,6 +950,38 @@ module.exports.fullstackTerminate = async (
         /* empty */
     }
 
+    // Remove OpenSearch inbound rule referencing EB security group before terminating EB
+    const osSlug = module.exports.slug(
+        repo,
+        process.env.AWS_PROFILE,
+        branch,
+        "os",
+    );
+
+    try {
+        const osSg = await module.exports.ec2.findSecurityGroupByName(
+            `${osSlug}-os`,
+        );
+        const ebSgForOs = await module.exports.ec2.findSecurityGroupByTag([
+            {
+                Name: "tag:elasticbeanstalk:environment-name",
+                Values: [name],
+            },
+            {
+                Name: "tag:aws:cloudformation:logical-id",
+                Values: ["AWSEBSecurityGroup"],
+            },
+        ]);
+        if (osSg && ebSgForOs) {
+            await module.exports.ec2.revokeOpenSearchIngress(
+                osSg.GroupId,
+                ebSgForOs.GroupId,
+            );
+        }
+    } catch {
+        /* empty */
+    }
+
     try {
         await module.exports.elasticbeanstalk.removeElasticBeanstalkEnvironment(
             name,
@@ -639,6 +998,12 @@ module.exports.fullstackTerminate = async (
         /* empty */
     }
 
+    try {
+        await module.exports.iam.removeEnvironmentInstanceProfile(name);
+    } catch {
+        /* empty */
+    }
+
     if (deleteDatabase) {
         try {
             await module.exports.rds.deleteRDSInstance(rdsSlug);
@@ -659,6 +1024,26 @@ module.exports.fullstackTerminate = async (
         }
     }
 
+    if (deleteOpenSearch) {
+        try {
+            await module.exports.opensearch.deleteOpenSearchDomain(osSlug);
+            await module.exports.opensearch.waitForOpenSearchDeletion(osSlug);
+        } catch {
+            /* empty */
+        }
+
+        try {
+            const sg = await module.exports.ec2.findSecurityGroupByName(
+                `${osSlug}-os`,
+            );
+            if (sg) {
+                await module.exports.ec2.deleteSecurityGroup(sg.GroupId);
+            }
+        } catch {
+            /* empty */
+        }
+    }
+
     // Delete secrets
     if (deleteStorage) {
         try {
@@ -678,6 +1063,16 @@ module.exports.fullstackTerminate = async (
         }
     }
 
+    if (deleteOpenSearch) {
+        try {
+            await module.exports.secretsmanager.deleteSecret(
+                `${name}-opensearch`,
+            );
+        } catch {
+            /* empty */
+        }
+    }
+
     if (deleteAppSecret) {
         try {
             await module.exports.secretsmanager.deleteSecret(`${name}-app`);