@friggframework/devtools 2.0.0--canary.397.155fecd.0 → 2.0.0--canary.398.c9e5d61.0

package/infrastructure/aws-discovery.js

@@ -0,0 +1,416 @@
+let EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeRouteTablesCommand;
+let KMSClient, ListKeysCommand, DescribeKeyCommand;
+let STSClient, GetCallerIdentityCommand;
+
+function loadEC2() {
+    if (!EC2Client) {
+        ({ EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeRouteTablesCommand } = require('@aws-sdk/client-ec2'));
+    }
+}
+
+function loadKMS() {
+    if (!KMSClient) {
+        ({ KMSClient, ListKeysCommand, DescribeKeyCommand } = require('@aws-sdk/client-kms'));
+    }
+}
+
+function loadSTS() {
+    if (!STSClient) {
+        ({ STSClient, GetCallerIdentityCommand } = require('@aws-sdk/client-sts'));
+    }
+}
+
+/**
+ * AWS Resource Discovery utilities for Frigg applications
+ * These functions use AWS credentials to discover default resources during build time
+ */
+class AWSDiscovery {
+    /**
+     * Creates an instance of AWSDiscovery
+     * @param {string} [region='us-east-1'] - AWS region to use for discovery
+     */
+    constructor(region = 'us-east-1') {
+        this.region = region;
+        loadEC2();
+        loadKMS();
+        loadSTS();
+        this.ec2Client = new EC2Client({ region });
+        this.kmsClient = new KMSClient({ region });
+        this.stsClient = new STSClient({ region });
+    }
+
+    /**
+     * Get AWS account ID
+     * @returns {Promise<string>} The AWS account ID
+     * @throws {Error} If unable to retrieve account ID
+     */
+    async getAccountId() {
+        try {
+            const command = new GetCallerIdentityCommand({});
+            const response = await this.stsClient.send(command);
+            return response.Account;
+        } catch (error) {
+            console.error('Error getting AWS account ID:', error);
+            throw error;
+        }
+    }
+
+    /**
+     * Find the default VPC for the account
+     * @returns {Promise<Object>} VPC object containing VpcId and other properties
+     * @throws {Error} If no VPC is found in the account
+     */
+    async findDefaultVpc() {
+        try {
+            const command = new DescribeVpcsCommand({
+                Filters: [
+                    {
+                        Name: 'is-default',
+                        Values: ['true']
+                    }
+                ]
+            });
+            
+            const response = await this.ec2Client.send(command);
+            
+            if (response.Vpcs && response.Vpcs.length > 0) {
+                return response.Vpcs[0];
+            }
+            
+            // If no default VPC, get the first available VPC
+            const allVpcsCommand = new DescribeVpcsCommand({});
+            const allVpcsResponse = await this.ec2Client.send(allVpcsCommand);
+            
+            if (allVpcsResponse.Vpcs && allVpcsResponse.Vpcs.length > 0) {
+                console.log('No default VPC found, using first available VPC');
+                return allVpcsResponse.Vpcs[0];
+            }
+            
+            throw new Error('No VPC found in the account');
+        } catch (error) {
+            console.error('Error finding default VPC:', error);
+            throw error;
+        }
+    }
+
+    /**
+     * Find private subnets for the given VPC
+     * @param {string} vpcId - The VPC ID to search within
+     * @returns {Promise<Array>} Array of subnet objects (at least 2 for high availability)
+     * @throws {Error} If no subnets are found in the VPC
+     */
+    async findPrivateSubnets(vpcId) {
+        try {
+            const command = new DescribeSubnetsCommand({
+                Filters: [
+                    {
+                        Name: 'vpc-id',
+                        Values: [vpcId]
+                    }
+                ]
+            });
+            
+            const response = await this.ec2Client.send(command);
+            
+            if (!response.Subnets || response.Subnets.length === 0) {
+                throw new Error(`No subnets found in VPC ${vpcId}`);
+            }
+
+            // Prefer private subnets (no direct route to IGW)
+            const privateSubnets = [];
+            const publicSubnets = [];
+
+            for (const subnet of response.Subnets) {
+                // Check route tables to determine if subnet is private
+                const isPrivate = await this.isSubnetPrivate(subnet.SubnetId);
+                if (isPrivate) {
+                    privateSubnets.push(subnet);
+                } else {
+                    publicSubnets.push(subnet);
+                }
+            }
+
+            // Return at least 2 subnets for high availability
+            const selectedSubnets = privateSubnets.length >= 2 ? 
+                privateSubnets.slice(0, 2) : 
+                response.Subnets.slice(0, 2);
+
+            return selectedSubnets;
+        } catch (error) {
+            console.error('Error finding private subnets:', error);
+            throw error;
+        }
+    }
+
+    /**
+     * Check if a subnet is private (no direct route to Internet Gateway)
+     * @param {string} subnetId - The subnet ID to check
+     * @returns {Promise<boolean>} True if subnet is private, false if public
+     */
+    async isSubnetPrivate(subnetId) {
+        try {
+            const command = new DescribeRouteTablesCommand({
+                Filters: [
+                    {
+                        Name: 'association.subnet-id',
+                        Values: [subnetId]
+                    }
+                ]
+            });
+            
+            const response = await this.ec2Client.send(command);
+            
+            for (const routeTable of response.RouteTables || []) {
+                for (const route of routeTable.Routes || []) {
+                    // If there's a route to an Internet Gateway, it's a public subnet
+                    if (route.GatewayId && route.GatewayId.startsWith('igw-')) {
+                        return false;
+                    }
+                }
+            }
+            
+            return true; // No IGW route found, assume private
+        } catch (error) {
+            console.warn(`Could not determine if subnet ${subnetId} is private:`, error);
+            return true; // Default to private for safety
+        }
+    }
+
+    /**
+     * Find or create a default security group for Lambda functions
+     * @param {string} vpcId - The VPC ID to search within
+     * @returns {Promise<Object>} Security group object containing GroupId and other properties
+     * @throws {Error} If no security group is found for the VPC
+     */
+    async findDefaultSecurityGroup(vpcId) {
+        try {
+            // First try to find existing Frigg security group
+            const friggSgCommand = new DescribeSecurityGroupsCommand({
+                Filters: [
+                    {
+                        Name: 'vpc-id',
+                        Values: [vpcId]
+                    },
+                    {
+                        Name: 'group-name',
+                        Values: ['frigg-lambda-sg']
+                    }
+                ]
+            });
+            
+            const friggResponse = await this.ec2Client.send(friggSgCommand);
+            if (friggResponse.SecurityGroups && friggResponse.SecurityGroups.length > 0) {
+                return friggResponse.SecurityGroups[0];
+            }
+
+            // Fall back to default security group
+            const defaultSgCommand = new DescribeSecurityGroupsCommand({
+                Filters: [
+                    {
+                        Name: 'vpc-id',
+                        Values: [vpcId]
+                    },
+                    {
+                        Name: 'group-name',
+                        Values: ['default']
+                    }
+                ]
+            });
+            
+            const defaultResponse = await this.ec2Client.send(defaultSgCommand);
+            if (defaultResponse.SecurityGroups && defaultResponse.SecurityGroups.length > 0) {
+                return defaultResponse.SecurityGroups[0];
+            }
+            
+            throw new Error(`No security group found for VPC ${vpcId}`);
+        } catch (error) {
+            console.error('Error finding default security group:', error);
+            throw error;
+        }
+    }
+
+    /**
+     * Find public subnets for NAT Gateway placement
+     * @param {string} vpcId - The VPC ID to search within
+     * @returns {Promise<Object>} First public subnet object for NAT Gateway placement
+     * @throws {Error} If no public subnets are found in the VPC
+     */
+    async findPublicSubnets(vpcId) {
+        try {
+            const command = new DescribeSubnetsCommand({
+                Filters: [
+                    {
+                        Name: 'vpc-id',
+                        Values: [vpcId]
+                    }
+                ]
+            });
+            
+            const response = await this.ec2Client.send(command);
+            
+            if (!response.Subnets || response.Subnets.length === 0) {
+                throw new Error(`No subnets found in VPC ${vpcId}`);
+            }
+
+            // Find public subnets (have direct route to IGW)
+            const publicSubnets = [];
+
+            for (const subnet of response.Subnets) {
+                // Check route tables to determine if subnet is public
+                const isPrivate = await this.isSubnetPrivate(subnet.SubnetId);
+                if (!isPrivate) {
+                    publicSubnets.push(subnet);
+                }
+            }
+
+            if (publicSubnets.length === 0) {
+                throw new Error(`No public subnets found in VPC ${vpcId} for NAT Gateway placement`);
+            }
+
+            // Return first public subnet for NAT Gateway
+            return publicSubnets[0];
+        } catch (error) {
+            console.error('Error finding public subnets:', error);
+            throw error;
+        }
+    }
+
+    /**
+     * Find private route table for VPC endpoints
+     * @param {string} vpcId - The VPC ID to search within
+     * @returns {Promise<Object>} Route table object containing RouteTableId and other properties
+     * @throws {Error} If no route tables are found for the VPC
+     */
+    async findPrivateRouteTable(vpcId) {
+        try {
+            const command = new DescribeRouteTablesCommand({
+                Filters: [
+                    {
+                        Name: 'vpc-id',
+                        Values: [vpcId]
+                    }
+                ]
+            });
+            
+            const response = await this.ec2Client.send(command);
+            
+            if (!response.RouteTables || response.RouteTables.length === 0) {
+                throw new Error(`No route tables found for VPC ${vpcId}`);
+            }
+
+            // Find a route table that doesn't have direct IGW route (private)
+            for (const routeTable of response.RouteTables) {
+                let hasIgwRoute = false;
+                for (const route of routeTable.Routes || []) {
+                    if (route.GatewayId && route.GatewayId.startsWith('igw-')) {
+                        hasIgwRoute = true;
+                        break;
+                    }
+                }
+                if (!hasIgwRoute) {
+                    return routeTable;
+                }
+            }
+
+            // If no private route table found, return the first one
+            return response.RouteTables[0];
+        } catch (error) {
+            console.error('Error finding private route table:', error);
+            throw error;
+        }
+    }
+
+    /**
+     * Find the default KMS key for the account
+     * @returns {Promise<string>} KMS key ARN or wildcard pattern as fallback
+     */
+    async findDefaultKmsKey() {
+        try {
+            // First try to find a key with alias/aws/lambda
+            const command = new ListKeysCommand({});
+            const response = await this.kmsClient.send(command);
+            
+            if (!response.Keys || response.Keys.length === 0) {
+                // Return AWS managed key ARN pattern as fallback
+                const accountId = await this.getAccountId();
+                return `arn:aws:kms:${this.region}:${accountId}:key/*`;
+            }
+
+            // Look for customer managed keys first
+            for (const key of response.Keys) {
+                try {
+                    const describeCommand = new DescribeKeyCommand({ KeyId: key.KeyId });
+                    const keyDetails = await this.kmsClient.send(describeCommand);
+                    
+                    if (keyDetails.KeyMetadata && 
+                        keyDetails.KeyMetadata.KeyManager === 'CUSTOMER' &&
+                        keyDetails.KeyMetadata.KeyState === 'Enabled') {
+                        return keyDetails.KeyMetadata.Arn;
+                    }
+                } catch (error) {
+                    // Continue to next key if we can't describe this one
+                    continue;
+                }
+            }
+
+            // Fallback to wildcard pattern for AWS managed keys
+            const accountId = await this.getAccountId();
+            return `arn:aws:kms:${this.region}:${accountId}:key/*`;
+        } catch (error) {
+            console.error('Error finding default KMS key:', error);
+            // Return wildcard pattern as ultimate fallback
+            return '*';
+        }
+    }
+
+    /**
+     * Discover all AWS resources needed for Frigg deployment
+     * @returns {Promise<Object>} Object containing discovered resource IDs:
+     * @returns {string} return.defaultVpcId - The default VPC ID
+     * @returns {string} return.defaultSecurityGroupId - The default security group ID
+     * @returns {string} return.privateSubnetId1 - First private subnet ID
+     * @returns {string} return.privateSubnetId2 - Second private subnet ID
+     * @returns {string} return.publicSubnetId - Public subnet ID for NAT Gateway
+     * @returns {string} return.privateRouteTableId - Private route table ID
+     * @returns {string} return.defaultKmsKeyId - Default KMS key ARN
+     * @throws {Error} If resource discovery fails
+     */
+    async discoverResources() {
+        try {
+            console.log('Discovering AWS resources for Frigg deployment...');
+            
+            const vpc = await this.findDefaultVpc();
+            console.log(`Found VPC: ${vpc.VpcId}`);
+            
+            const privateSubnets = await this.findPrivateSubnets(vpc.VpcId);
+            console.log(`Found ${privateSubnets.length} private subnets: ${privateSubnets.map(s => s.SubnetId).join(', ')}`);
+            
+            const publicSubnet = await this.findPublicSubnets(vpc.VpcId);
+            console.log(`Found public subnet for NAT Gateway: ${publicSubnet.SubnetId}`);
+            
+            const securityGroup = await this.findDefaultSecurityGroup(vpc.VpcId);
+            console.log(`Found security group: ${securityGroup.GroupId}`);
+            
+            const routeTable = await this.findPrivateRouteTable(vpc.VpcId);
+            console.log(`Found route table: ${routeTable.RouteTableId}`);
+            
+            const kmsKeyArn = await this.findDefaultKmsKey();
+            console.log(`Found KMS key: ${kmsKeyArn}`);
+
+            return {
+                defaultVpcId: vpc.VpcId,
+                defaultSecurityGroupId: securityGroup.GroupId,
+                privateSubnetId1: privateSubnets[0]?.SubnetId,
+                privateSubnetId2: privateSubnets[1]?.SubnetId || privateSubnets[0]?.SubnetId,
+                publicSubnetId: publicSubnet.SubnetId,
+                privateRouteTableId: routeTable.RouteTableId,
+                defaultKmsKeyId: kmsKeyArn
+            };
+        } catch (error) {
+            console.error('Error discovering AWS resources:', error);
+            throw error;
+        }
+    }
+}
+
+module.exports = { AWSDiscovery };