@fishawack/lab-env 5.7.0-beta.1 → 5.7.0-beta.3

package/commands/create/services/aws/opensearch.js

@@ -0,0 +1,155 @@
+const {
+    OpenSearchClient,
+    CreateDomainCommand,
+    DeleteDomainCommand,
+    DescribeDomainCommand,
+} = require("@aws-sdk/client-opensearch");
+const { Spinner, poll } = require("../../libs/utilities");
+const { awsClientConfig } = require("../../libs/vars");
+
+const getClient = () => new OpenSearchClient(awsClientConfig);
+
+module.exports.createOpenSearchDomain = async (
+    name,
+    securityGroupId,
+    privateSubnetIds,
+    instanceProfileRole,
+    tags = [],
+) => {
+    const accountId = instanceProfileRole.split(":")[4] || "*";
+    const region = process.env.AWS_REGION;
+
+    const res = await Spinner.prototype.simple(
+        `Creating OpenSearch domain ${name}`,
+        () => {
+            return getClient().send(
+                new CreateDomainCommand({
+                    DomainName: name,
+                    EngineVersion: "OpenSearch_2.19",
+                    ClusterConfig: {
+                        InstanceType: "t3.small.search",
+                        InstanceCount: 2,
+                        ZoneAwarenessEnabled: true,
+                        ZoneAwarenessConfig: {
+                            AvailabilityZoneCount: 2,
+                        },
+                    },
+                    EBSOptions: {
+                        EBSEnabled: true,
+                        VolumeType: "gp3",
+                        VolumeSize: 20,
+                    },
+                    VPCOptions: {
+                        SubnetIds: privateSubnetIds,
+                        SecurityGroupIds: [securityGroupId],
+                    },
+                    EncryptionAtRestOptions: {
+                        Enabled: true,
+                    },
+                    NodeToNodeEncryptionOptions: {
+                        Enabled: true,
+                    },
+                    DomainEndpointOptions: {
+                        EnforceHTTPS: true,
+                        TLSSecurityPolicy: "Policy-Min-TLS-1-2-2019-07",
+                    },
+                    AdvancedSecurityOptions: {
+                        Enabled: false,
+                        InternalUserDatabaseEnabled: false,
+                    },
+                    AccessPolicies: JSON.stringify({
+                        Version: "2012-10-17",
+                        Statement: [
+                            {
+                                Effect: "Allow",
+                                Principal: {
+                                    AWS: instanceProfileRole,
+                                },
+                                Action: "es:ESHttp*",
+                                Resource: `arn:aws:es:${region}:${accountId}:domain/${name}/*`,
+                            },
+                        ],
+                    }),
+                    TagList: [
+                        { Key: "client", Value: process.env.AWS_PROFILE },
+                    ].concat(
+                        tags.map((t) => ({
+                            Key: t.Key,
+                            Value: String(t.Value),
+                        })),
+                    ),
+                }),
+            );
+        },
+    );
+
+    return res;
+};
+
+module.exports.waitForOpenSearchDomain = async (name) => {
+    const res = await Spinner.prototype.simple(
+        `Waiting for OpenSearch domain to become available (this may take 15-20 minutes)`,
+        (spinner) => {
+            return poll(
+                async () => {
+                    const { DomainStatus } = await getClient().send(
+                        new DescribeDomainCommand({ DomainName: name }),
+                    );
+                    return DomainStatus;
+                },
+                (status) =>
+                    status.Processing ||
+                    (!status.Endpoint && !status.Endpoints),
+                undefined,
+                spinner,
+            );
+        },
+    );
+
+    return res;
+};
+
+module.exports.describeOpenSearchDomain = async (name) => {
+    const res = await Spinner.prototype.simple(
+        `Describing OpenSearch domain ${name}`,
+        () => {
+            return getClient().send(
+                new DescribeDomainCommand({ DomainName: name }),
+            );
+        },
+    );
+
+    return res.DomainStatus;
+};
+
+module.exports.deleteOpenSearchDomain = async (name) => {
+    await Spinner.prototype.simple(`Deleting OpenSearch domain ${name}`, () => {
+        return getClient().send(new DeleteDomainCommand({ DomainName: name }));
+    });
+};
+
+module.exports.waitForOpenSearchDeletion = async (name) => {
+    await Spinner.prototype.simple(
+        `Waiting for OpenSearch domain to be deleted`,
+        (spinner) => {
+            return poll(
+                async () => {
+                    try {
+                        const { DomainStatus } = await getClient().send(
+                            new DescribeDomainCommand({ DomainName: name }),
+                        );
+                        return DomainStatus;
+                    } catch (e) {
+                        if (e.name === "ResourceNotFoundException") {
+                            return { deleted: true };
+                        }
+                        throw e;
+                    }
+                },
+                (status) => !status.deleted,
+                undefined,
+                spinner,
+            );
+        },
+    );
+};

package/commands/create/services/aws/rds.js

@@ -1,9 +1,11 @@
 const {
     RDSClient,
     CreateDBInstanceCommand,
+    CreateDBSubnetGroupCommand,
     DeleteDBInstanceCommand,
     DescribeDBInstancesCommand,
     DescribeDBSnapshotsCommand,
+    DescribeDBSubnetGroupsCommand,
     RestoreDBInstanceFromDBSnapshotCommand,
     ModifyDBInstanceCommand,
     DescribeDBParameterGroupsCommand,
@@ -11,19 +13,52 @@ const {
     ModifyDBParameterGroupCommand,
 } = require("@aws-sdk/client-rds");
 const { Spinner, poll } = require("../../libs/utilities");
+const { awsClientConfig } = require("../../libs/vars");
+
+const getClient = () => new RDSClient(awsClientConfig);
+
+module.exports.ensureDBSubnetGroup = async (privateSubnetIds) => {
+    const name = "fw-auto-private-db-subnet-group";
+
+    try {
+        await getClient().send(
+            new DescribeDBSubnetGroupsCommand({
+                DBSubnetGroupName: name,
+            }),
+        );
+
+        return name;
+    } catch (e) {
+        if (e.name !== "DBSubnetGroupNotFoundFault") {
+            throw e;
+        }
+    }
+
+    await Spinner.prototype.simple(`Creating DB subnet group ${name}`, () => {
+        return getClient().send(
+            new CreateDBSubnetGroupCommand({
+                DBSubnetGroupName: name,
+                DBSubnetGroupDescription:
+                    "Private subnets for lab-env RDS instances",
+                SubnetIds: privateSubnetIds,
+            }),
+        );
+    });
+
+    return name;
+};
 
 module.exports.createRDSInstance = async (
     name,
     tags = [],
     password,
     securityGroupId,
+    subnetGroupName,
 ) => {
-    const client = new RDSClient({});
-
     let res = await Spinner.prototype.simple(
         `Creating RDS instance ${name}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new CreateDBInstanceCommand({
                     DBInstanceIdentifier: name,
                     DBInstanceClass: "db.t3.small",
@@ -37,6 +72,7 @@ module.exports.createRDSInstance = async (
                     BackupRetentionPeriod: 7,
                     DBName: "ebdb",
                     DBParameterGroupName: "lab-env-mysql80-ssl-required",
+                    DBSubnetGroupName: subnetGroupName,
                     VpcSecurityGroupIds: [securityGroupId],
                     Tags: [
                         { Key: "client", Value: process.env.AWS_PROFILE },
@@ -50,21 +86,21 @@ module.exports.createRDSInstance = async (
 };
 
 module.exports.waitForRDSInstance = async (name) => {
-    const client = new RDSClient({});
-
     const res = await Spinner.prototype.simple(
         `Waiting for RDS instance to become available`,
-        () => {
+        (spinner) => {
             return poll(
                 async () =>
                     (
-                        await client.send(
+                        await getClient().send(
                             new DescribeDBInstancesCommand({
                                 DBInstanceIdentifier: name,
                             }),
                         )
                     ).DBInstances[0],
                 ({ DBInstanceStatus }) => DBInstanceStatus !== "available",
+                undefined,
+                spinner,
             );
         },
     );
@@ -73,12 +109,10 @@ module.exports.waitForRDSInstance = async (name) => {
 };
 
 module.exports.describeRDSInstance = async (name) => {
-    const client = new RDSClient({});
-
     let res = await Spinner.prototype.simple(
         `Describing RDS instance ${name}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new DescribeDBInstancesCommand({
                     DBInstanceIdentifier: name,
                 }),
@@ -90,10 +124,8 @@ module.exports.describeRDSInstance = async (name) => {
 };
 
 module.exports.deleteRDSInstance = async (name) => {
-    const client = new RDSClient({});
-
     await Spinner.prototype.simple(`Deleting RDS instance ${name}`, () => {
-        return client.send(
+        return getClient().send(
             new DeleteDBInstanceCommand({
                 DBInstanceIdentifier: name,
                 SkipFinalSnapshot: true,
@@ -103,15 +135,13 @@ module.exports.deleteRDSInstance = async (name) => {
 };
 
 module.exports.waitForRDSDeletion = async (name) => {
-    const client = new RDSClient({});
-
     await Spinner.prototype.simple(
         `Waiting for RDS instance to be deleted`,
-        () => {
+        (spinner) => {
             return poll(
                 async () => {
                     try {
-                        const res = await client.send(
+                        const res = await getClient().send(
                             new DescribeDBInstancesCommand({
                                 DBInstanceIdentifier: name,
                             }),
@@ -125,18 +155,18 @@ module.exports.waitForRDSDeletion = async (name) => {
                     }
                 },
                 ({ DBInstanceStatus }) => DBInstanceStatus !== "deleted",
+                undefined,
+                spinner,
             );
         },
     );
 };
 
 module.exports.listManualSnapshots = async () => {
-    const client = new RDSClient({});
-
     const res = await Spinner.prototype.simple(
         `Fetching manual RDS snapshots`,
         () => {
-            return client.send(
+            return getClient().send(
                 new DescribeDBSnapshotsCommand({
                     SnapshotType: "manual",
                 }),
@@ -157,19 +187,19 @@ module.exports.restoreRDSInstanceFromSnapshot = async (
     snapshotId,
     securityGroupId,
     tags = [],
+    subnetGroupName,
 ) => {
-    const client = new RDSClient({});
-
     let res = await Spinner.prototype.simple(
         `Restoring RDS instance ${name} from snapshot ${snapshotId}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new RestoreDBInstanceFromDBSnapshotCommand({
                     DBInstanceIdentifier: name,
                     DBSnapshotIdentifier: snapshotId,
                     DBInstanceClass: "db.t3.small",
                     PubliclyAccessible: false,
                     DBParameterGroupName: "lab-env-mysql80-ssl-required",
+                    DBSubnetGroupName: subnetGroupName,
                     VpcSecurityGroupIds: [securityGroupId],
                     Tags: [
                         { Key: "client", Value: process.env.AWS_PROFILE },
@@ -183,12 +213,10 @@ module.exports.restoreRDSInstanceFromSnapshot = async (
 };
 
 module.exports.modifyRDSPassword = async (name, password) => {
-    const client = new RDSClient({});
-
     await Spinner.prototype.simple(
         `Updating master password for RDS instance ${name}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new ModifyDBInstanceCommand({
                     DBInstanceIdentifier: name,
                     MasterUserPassword: password,
@@ -202,10 +230,8 @@ module.exports.modifyRDSPassword = async (name, password) => {
 const SSL_PARAMETER_GROUP = "lab-env-mysql80-ssl-required";
 
 module.exports.ensureSSLParameterGroup = async () => {
-    const client = new RDSClient({});
-
     try {
-        await client.send(
+        await getClient().send(
             new DescribeDBParameterGroupsCommand({
                 DBParameterGroupName: SSL_PARAMETER_GROUP,
             }),
@@ -214,7 +240,7 @@ module.exports.ensureSSLParameterGroup = async () => {
         await Spinner.prototype.simple(
             `Creating parameter group ${SSL_PARAMETER_GROUP}`,
             () => {
-                return client.send(
+                return getClient().send(
                     new CreateDBParameterGroupCommand({
                         DBParameterGroupName: SSL_PARAMETER_GROUP,
                         DBParameterGroupFamily: "mysql8.0",
@@ -228,7 +254,7 @@ module.exports.ensureSSLParameterGroup = async () => {
         await Spinner.prototype.simple(
             `Enabling require_secure_transport on ${SSL_PARAMETER_GROUP}`,
             () => {
-                return client.send(
+                return getClient().send(
                     new ModifyDBParameterGroupCommand({
                         DBParameterGroupName: SSL_PARAMETER_GROUP,
                         Parameters: [

package/commands/create/services/aws/s3.js

@@ -12,6 +12,9 @@ const {
     DeleteObjectsCommand,
 } = require("@aws-sdk/client-s3");
 const { Spinner } = require("../../libs/utilities");
+const { awsClientConfig } = require("../../libs/vars");
+
+const getClient = () => new S3Client(awsClientConfig);
 
 module.exports.createS3Bucket = async (
     bucket,
@@ -19,36 +22,39 @@ module.exports.createS3Bucket = async (
     blockAccess = true,
     ObjectOwnership = "BucketOwnerEnforced",
 ) => {
-    const client = new S3Client({});
-
     let res = await Spinner.prototype.simple(
         `Creating s3 bucket ${bucket}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new CreateBucketCommand({ Bucket: bucket, ObjectOwnership }),
             );
         },
     );
 
+    const publicAccessConfig =
+        typeof blockAccess === "object"
+            ? blockAccess
+            : {
+                  BlockPublicAcls: blockAccess,
+                  BlockPublicPolicy: blockAccess,
+                  IgnorePublicAcls: blockAccess,
+                  RestrictPublicBuckets: blockAccess,
+              };
+
     await Spinner.prototype.simple(
-        `${blockAccess ? "Blocking" : "Allowing"} all public access to s3 bucket`,
+        `Configuring public access settings for s3 bucket`,
         () => {
-            return client.send(
+            return getClient().send(
                 new PutPublicAccessBlockCommand({
                     Bucket: bucket,
-                    PublicAccessBlockConfiguration: {
-                        BlockPublicAcls: blockAccess,
-                        BlockPublicPolicy: blockAccess,
-                        IgnorePublicAcls: blockAccess,
-                        RestrictPublicBuckets: blockAccess,
-                    },
+                    PublicAccessBlockConfiguration: publicAccessConfig,
                 }),
             );
         },
     );
 
     await Spinner.prototype.simple(`Adding tags to s3 bucket`, () => {
-        return client.send(
+        return getClient().send(
             new PutBucketTaggingCommand({
                 Bucket: bucket,
                 Tagging: {
@@ -64,30 +70,24 @@ module.exports.createS3Bucket = async (
 };
 
 module.exports.listS3Buckets = async () => {
-    const client = new S3Client({});
-
     let res = await Spinner.prototype.simple(`Listing s3 buckets`, () => {
-        return client.send(new ListBucketsCommand({}));
+        return getClient().send(new ListBucketsCommand({}));
     });
 
     return res;
 };
 
 module.exports.removeS3Bucket = async (bucket) => {
-    const client = new S3Client({});
-
     await Spinner.prototype.simple(`Removing s3 bucket ${bucket}`, () => {
-        return client.send(new DeleteBucketCommand({ Bucket: bucket }));
+        return getClient().send(new DeleteBucketCommand({ Bucket: bucket }));
     });
 };
 
 module.exports.setS3BucketPolicy = async (bucket, OAI) => {
-    const client = new S3Client({});
-
     let res = await Spinner.prototype.simple(
         `Updating s3 bucket policy`,
         () => {
-            return client.send(
+            return getClient().send(
                 new PutBucketPolicyCommand({
                     Bucket: bucket,
                     Policy: JSON.stringify({
@@ -116,11 +116,36 @@ module.exports.setS3BucketPolicy = async (bucket, OAI) => {
     return res;
 };
 
-module.exports.addFileToS3Bucket = async (bucket, filepath, file) => {
-    const client = new S3Client({});
+module.exports.setPublicReadPolicy = async (bucket, prefix) => {
+    let res = await Spinner.prototype.simple(
+        `Setting public read policy for ${prefix}`,
+        () => {
+            return getClient().send(
+                new PutBucketPolicyCommand({
+                    Bucket: bucket,
+                    Policy: JSON.stringify({
+                        Version: "2012-10-17",
+                        Statement: [
+                            {
+                                Sid: "PublicReadPrefix",
+                                Effect: "Allow",
+                                Principal: "*",
+                                Action: "s3:GetObject",
+                                Resource: `arn:aws:s3:::${bucket}/${prefix}`,
+                            },
+                        ],
+                    }),
+                }),
+            );
+        },
+    );
+
+    return res;
+};
 
+module.exports.addFileToS3Bucket = async (bucket, filepath, file) => {
     let res = await Spinner.prototype.simple(`Adding file to s3 bucket`, () => {
-        return client.send(
+        return getClient().send(
             new PutObjectCommand({
                 Bucket: bucket,
                 Body: file,
@@ -133,12 +158,10 @@ module.exports.addFileToS3Bucket = async (bucket, filepath, file) => {
 };
 
 module.exports.removeFileToS3Bucket = async (bucket, filepath) => {
-    const client = new S3Client({});
-
     let res = await Spinner.prototype.simple(
         `Removing file from s3 bucket`,
         () => {
-            return client.send(
+            return getClient().send(
                 new DeleteObjectCommand({
                     Bucket: bucket,
                     Key: filepath,
@@ -151,8 +174,6 @@ module.exports.removeFileToS3Bucket = async (bucket, filepath) => {
 };
 
 module.exports.emptyS3Bucket = async (bucket) => {
-    const client = new S3Client({});
-
     await Spinner.prototype.simple(`Emptying s3 bucket`, () => {
         // eslint-disable-next-line no-async-promise-executor
         return new Promise(async (resolve, reject) => {
@@ -160,7 +181,7 @@ module.exports.emptyS3Bucket = async (bucket) => {
                 let ContinuationToken = null;
 
                 do {
-                    let list = await client.send(
+                    let list = await getClient().send(
                         new ListObjectsV2Command({
                             Bucket: bucket,
                             ContinuationToken,
@@ -168,7 +189,7 @@ module.exports.emptyS3Bucket = async (bucket) => {
                     );
 
                     if (list.KeyCount) {
-                        let deleted = await client.send(
+                        let deleted = await getClient().send(
                             new DeleteObjectsCommand({
                                 Bucket: bucket,
                                 Delete: {

package/commands/create/services/aws/secretsmanager.js

@@ -3,15 +3,17 @@ const {
     CreateSecretCommand,
     DescribeSecretCommand,
     GetSecretValueCommand,
+    PutSecretValueCommand,
     DeleteSecretCommand,
 } = require("@aws-sdk/client-secrets-manager");
 const { Spinner } = require("../../libs/utilities");
+const { awsClientConfig } = require("../../libs/vars");
 
-module.exports.createSecret = async (name, secretObject, tags = []) => {
-    const client = new SecretsManagerClient({});
+const getClient = () => new SecretsManagerClient(awsClientConfig);
 
+module.exports.createSecret = async (name, secretObject, tags = []) => {
     let res = await Spinner.prototype.simple(`Creating secret ${name}`, () => {
-        return client.send(
+        return getClient().send(
             new CreateSecretCommand({
                 Name: name,
                 SecretString: JSON.stringify(secretObject),
@@ -24,12 +26,10 @@ module.exports.createSecret = async (name, secretObject, tags = []) => {
 };
 
 module.exports.describeSecret = async (name) => {
-    const client = new SecretsManagerClient({});
-
     let res = await Spinner.prototype.simple(
         `Checking for existing secret ${name}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new DescribeSecretCommand({
                     SecretId: name,
                 }),
@@ -41,12 +41,10 @@ module.exports.describeSecret = async (name) => {
 };
 
 module.exports.getSecretValue = async (name) => {
-    const client = new SecretsManagerClient({});
-
     let res = await Spinner.prototype.simple(
         `Retrieving secret ${name}`,
         () => {
-            return client.send(
+            return getClient().send(
                 new GetSecretValueCommand({
                     SecretId: name,
                 }),
@@ -57,11 +55,22 @@ module.exports.getSecretValue = async (name) => {
     return JSON.parse(res.SecretString);
 };
 
-module.exports.deleteSecret = async (name) => {
-    const client = new SecretsManagerClient({});
+module.exports.updateSecretValue = async (name, secretObject) => {
+    let res = await Spinner.prototype.simple(`Updating secret ${name}`, () => {
+        return getClient().send(
+            new PutSecretValueCommand({
+                SecretId: name,
+                SecretString: JSON.stringify(secretObject),
+            }),
+        );
+    });
 
+    return res;
+};
+
+module.exports.deleteSecret = async (name) => {
     let res = await Spinner.prototype.simple(`Deleting secret ${name}`, () => {
-        return client.send(
+        return getClient().send(
             new DeleteSecretCommand({
                 SecretId: name,
                 ForceDeleteWithoutRecovery: true,