@fishawack/lab-env 5.7.0-beta.1 → 5.7.0-beta.2

package/commands/create/services/aws/opensearch.js

@@ -0,0 +1,147 @@
+const {
+    OpenSearchClient,
+    CreateDomainCommand,
+    DeleteDomainCommand,
+    DescribeDomainCommand,
+} = require("@aws-sdk/client-opensearch");
+const { Spinner, poll } = require("../../libs/utilities");
+
+module.exports.createOpenSearchDomain = async (
+    name,
+    securityGroupId,
+    privateSubnetIds,
+    instanceProfileRole,
+) => {
+    const client = new OpenSearchClient({});
+
+    const accountId = instanceProfileRole.split(":")[4] || "*";
+    const region = process.env.AWS_REGION;
+
+    const res = await Spinner.prototype.simple(
+        `Creating OpenSearch domain ${name}`,
+        () => {
+            return client.send(
+                new CreateDomainCommand({
+                    DomainName: name,
+                    EngineVersion: "OpenSearch_2.19",
+                    ClusterConfig: {
+                        InstanceType: "t3.small.search",
+                        InstanceCount: 2,
+                        ZoneAwarenessEnabled: true,
+                        ZoneAwarenessConfig: {
+                            AvailabilityZoneCount: 2,
+                        },
+                    },
+                    EBSOptions: {
+                        EBSEnabled: true,
+                        VolumeType: "gp3",
+                        VolumeSize: 20,
+                    },
+                    VPCOptions: {
+                        SubnetIds: privateSubnetIds,
+                        SecurityGroupIds: [securityGroupId],
+                    },
+                    EncryptionAtRestOptions: {
+                        Enabled: true,
+                    },
+                    NodeToNodeEncryptionOptions: {
+                        Enabled: true,
+                    },
+                    DomainEndpointOptions: {
+                        EnforceHTTPS: true,
+                        TLSSecurityPolicy: "Policy-Min-TLS-1-2-2019-07",
+                    },
+                    AdvancedSecurityOptions: {
+                        Enabled: false,
+                        InternalUserDatabaseEnabled: false,
+                    },
+                    AccessPolicies: JSON.stringify({
+                        Version: "2012-10-17",
+                        Statement: [
+                            {
+                                Effect: "Allow",
+                                Principal: {
+                                    AWS: instanceProfileRole,
+                                },
+                                Action: "es:ESHttp*",
+                                Resource: `arn:aws:es:${region}:${accountId}:domain/${name}/*`,
+                            },
+                        ],
+                    }),
+                }),
+            );
+        },
+    );
+
+    return res;
+};
+
+module.exports.waitForOpenSearchDomain = async (name) => {
+    const client = new OpenSearchClient({});
+
+    const res = await Spinner.prototype.simple(
+        `Waiting for OpenSearch domain to become available (this may take 15-20 minutes)`,
+        () => {
+            return poll(
+                async () => {
+                    const { DomainStatus } = await client.send(
+                        new DescribeDomainCommand({ DomainName: name }),
+                    );
+                    return DomainStatus;
+                },
+                (status) =>
+                    status.Processing ||
+                    (!status.Endpoint && !status.Endpoints),
+            );
+        },
+    );
+
+    return res;
+};
+
+module.exports.describeOpenSearchDomain = async (name) => {
+    const client = new OpenSearchClient({});
+
+    const res = await Spinner.prototype.simple(
+        `Describing OpenSearch domain ${name}`,
+        () => {
+            return client.send(new DescribeDomainCommand({ DomainName: name }));
+        },
+    );
+
+    return res.DomainStatus;
+};
+
+module.exports.deleteOpenSearchDomain = async (name) => {
+    const client = new OpenSearchClient({});
+
+    await Spinner.prototype.simple(`Deleting OpenSearch domain ${name}`, () => {
+        return client.send(new DeleteDomainCommand({ DomainName: name }));
+    });
+};
+
+module.exports.waitForOpenSearchDeletion = async (name) => {
+    const client = new OpenSearchClient({});
+
+    await Spinner.prototype.simple(
+        `Waiting for OpenSearch domain to be deleted`,
+        () => {
+            return poll(
+                async () => {
+                    try {
+                        const { DomainStatus } = await client.send(
+                            new DescribeDomainCommand({ DomainName: name }),
+                        );
+                        return DomainStatus;
+                    } catch (e) {
+                        if (e.name === "ResourceNotFoundException") {
+                            return { deleted: true };
+                        }
+                        throw e;
+                    }
+                },
+                (status) => !status.deleted,
+            );
+        },
+    );
+};

package/commands/create/services/aws/rds.js

@@ -1,9 +1,11 @@
 const {
     RDSClient,
     CreateDBInstanceCommand,
+    CreateDBSubnetGroupCommand,
     DeleteDBInstanceCommand,
     DescribeDBInstancesCommand,
     DescribeDBSnapshotsCommand,
+    DescribeDBSubnetGroupsCommand,
     RestoreDBInstanceFromDBSnapshotCommand,
     ModifyDBInstanceCommand,
     DescribeDBParameterGroupsCommand,
@@ -12,11 +14,44 @@ const {
 } = require("@aws-sdk/client-rds");
 const { Spinner, poll } = require("../../libs/utilities");
 
+module.exports.ensureDBSubnetGroup = async (privateSubnetIds) => {
+    const client = new RDSClient({});
+    const name = "fw-auto-private-db-subnet-group";
+
+    try {
+        await client.send(
+            new DescribeDBSubnetGroupsCommand({
+                DBSubnetGroupName: name,
+            }),
+        );
+
+        return name;
+    } catch (e) {
+        if (e.name !== "DBSubnetGroupNotFoundFault") {
+            throw e;
+        }
+    }
+
+    await Spinner.prototype.simple(`Creating DB subnet group ${name}`, () => {
+        return client.send(
+            new CreateDBSubnetGroupCommand({
+                DBSubnetGroupName: name,
+                DBSubnetGroupDescription:
+                    "Private subnets for lab-env RDS instances",
+                SubnetIds: privateSubnetIds,
+            }),
+        );
+    });
+
+    return name;
+};
+
 module.exports.createRDSInstance = async (
     name,
     tags = [],
     password,
     securityGroupId,
+    subnetGroupName,
 ) => {
     const client = new RDSClient({});
 
@@ -37,6 +72,7 @@ module.exports.createRDSInstance = async (
                     BackupRetentionPeriod: 7,
                     DBName: "ebdb",
                     DBParameterGroupName: "lab-env-mysql80-ssl-required",
+                    DBSubnetGroupName: subnetGroupName,
                     VpcSecurityGroupIds: [securityGroupId],
                     Tags: [
                         { Key: "client", Value: process.env.AWS_PROFILE },
@@ -157,6 +193,7 @@ module.exports.restoreRDSInstanceFromSnapshot = async (
     snapshotId,
     securityGroupId,
     tags = [],
+    subnetGroupName,
 ) => {
     const client = new RDSClient({});
 
@@ -170,6 +207,7 @@ module.exports.restoreRDSInstanceFromSnapshot = async (
                     DBInstanceClass: "db.t3.small",
                     PubliclyAccessible: false,
                     DBParameterGroupName: "lab-env-mysql80-ssl-required",
+                    DBSubnetGroupName: subnetGroupName,
                     VpcSecurityGroupIds: [securityGroupId],
                     Tags: [
                         { Key: "client", Value: process.env.AWS_PROFILE },

package/commands/create/services/aws/s3.js

@@ -30,18 +30,23 @@ module.exports.createS3Bucket = async (
         },
     );
 
+    const publicAccessConfig =
+        typeof blockAccess === "object"
+            ? blockAccess
+            : {
+                  BlockPublicAcls: blockAccess,
+                  BlockPublicPolicy: blockAccess,
+                  IgnorePublicAcls: blockAccess,
+                  RestrictPublicBuckets: blockAccess,
+              };
+
     await Spinner.prototype.simple(
-        `${blockAccess ? "Blocking" : "Allowing"} all public access to s3 bucket`,
+        `Configuring public access settings for s3 bucket`,
         () => {
             return client.send(
                 new PutPublicAccessBlockCommand({
                     Bucket: bucket,
-                    PublicAccessBlockConfiguration: {
-                        BlockPublicAcls: blockAccess,
-                        BlockPublicPolicy: blockAccess,
-                        IgnorePublicAcls: blockAccess,
-                        RestrictPublicBuckets: blockAccess,
-                    },
+                    PublicAccessBlockConfiguration: publicAccessConfig,
                 }),
             );
         },
@@ -116,6 +121,35 @@ module.exports.setS3BucketPolicy = async (bucket, OAI) => {
     return res;
 };
 
+module.exports.setPublicReadPolicy = async (bucket, prefix) => {
+    const client = new S3Client({});
+
+    let res = await Spinner.prototype.simple(
+        `Setting public read policy for ${prefix}`,
+        () => {
+            return client.send(
+                new PutBucketPolicyCommand({
+                    Bucket: bucket,
+                    Policy: JSON.stringify({
+                        Version: "2012-10-17",
+                        Statement: [
+                            {
+                                Sid: "PublicReadPrefix",
+                                Effect: "Allow",
+                                Principal: "*",
+                                Action: "s3:GetObject",
+                                Resource: `arn:aws:s3:::${bucket}/${prefix}`,
+                            },
+                        ],
+                    }),
+                }),
+            );
+        },
+    );
+
+    return res;
+};
+
 module.exports.addFileToS3Bucket = async (bucket, filepath, file) => {
     const client = new S3Client({});
 

package/commands/create/services/aws/secretsmanager.js

@@ -3,6 +3,7 @@ const {
     CreateSecretCommand,
     DescribeSecretCommand,
     GetSecretValueCommand,
+    PutSecretValueCommand,
     DeleteSecretCommand,
 } = require("@aws-sdk/client-secrets-manager");
 const { Spinner } = require("../../libs/utilities");
@@ -57,6 +58,21 @@ module.exports.getSecretValue = async (name) => {
     return JSON.parse(res.SecretString);
 };
 
+module.exports.updateSecretValue = async (name, secretObject) => {
+    const client = new SecretsManagerClient({});
+
+    let res = await Spinner.prototype.simple(`Updating secret ${name}`, () => {
+        return client.send(
+            new PutSecretValueCommand({
+                SecretId: name,
+                SecretString: JSON.stringify(secretObject),
+            }),
+        );
+    });
+
+    return res;
+};
+
 module.exports.deleteSecret = async (name) => {
     const client = new SecretsManagerClient({});
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@fishawack/lab-env",
-    "version": "5.7.0-beta.1",
+    "version": "5.7.0-beta.2",
     "description": "Docker manager for FW",
     "main": "cli.js",
     "scripts": {
@@ -21,10 +21,12 @@
         "fw": "cli.js"
     },
     "dependencies": {
+        "@aws-sdk/client-acm": "^3.1067.0",
         "@aws-sdk/client-cloudfront": "^3.141.0",
         "@aws-sdk/client-ec2": "^3.399.0",
         "@aws-sdk/client-elastic-beanstalk": "^3.395.0",
         "@aws-sdk/client-iam": "^3.150.0",
+        "@aws-sdk/client-opensearch": "^3.1065.0",
         "@aws-sdk/client-rds": "^3.395.0",
         "@aws-sdk/client-s3": "^3.141.0",
         "@aws-sdk/client-secrets-manager": "^3.395.0",