@friggframework/devtools 2.0.0--canary.428.a3d2e56.0 → 2.0.0--canary.428.95f8e10.0

package/infrastructure/aws-discovery.js

@@ -1,10 +1,10 @@
-let EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeRouteTablesCommand, DescribeNatGatewaysCommand, DescribeAddressesCommand;
+let EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeRouteTablesCommand, DescribeNatGatewaysCommand, DescribeAddressesCommand, DescribeInternetGatewaysCommand;
 let KMSClient, ListKeysCommand, DescribeKeyCommand;
 let STSClient, GetCallerIdentityCommand;
 
 function loadEC2() {
     if (!EC2Client) {
-        ({ EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeRouteTablesCommand, DescribeNatGatewaysCommand, DescribeAddressesCommand } = require('@aws-sdk/client-ec2'));
+        ({ EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeRouteTablesCommand, DescribeNatGatewaysCommand, DescribeAddressesCommand, DescribeInternetGatewaysCommand } = require('@aws-sdk/client-ec2'));
     }
 }
 
@@ -289,9 +289,9 @@ class AWSDiscovery {
                     }
                 ]
             });
-            
+
             const response = await this.ec2Client.send(command);
-            
+
             if (!response.Subnets || response.Subnets.length === 0) {
                 throw new Error(`No subnets found in VPC ${vpcId}`);
             }
@@ -308,10 +308,15 @@ class AWSDiscovery {
             }
 
             if (publicSubnets.length === 0) {
-                throw new Error(`No public subnets found in VPC ${vpcId} for NAT Gateway placement`);
+                // If no public subnets found, we need to create one or inform the user
+                console.warn(`WARNING: No public subnets found in VPC ${vpcId}`);
+                console.warn('A public subnet with Internet Gateway route is required for NAT Gateway placement');
+                console.warn('Please create a public subnet or use VPC endpoints instead');
+                return null; // Return null instead of throwing to allow graceful handling
             }
 
             // Return first public subnet for NAT Gateway
+            console.log(`Found ${publicSubnets.length} public subnets, using ${publicSubnets[0].SubnetId} for NAT Gateway`);
             return publicSubnets[0];
         } catch (error) {
             console.error('Error finding public subnets:', error);
@@ -383,27 +388,44 @@ class AWSDiscovery {
                     }
                 ]
             });
-            
+
             const response = await this.ec2Client.send(command);
-            
+
             if (response.NatGateways && response.NatGateways.length > 0) {
-                // Find a NAT Gateway tagged for Frigg first
-                const friggNatGateway = response.NatGateways.find(nat => 
-                    nat.Tags && nat.Tags.some(tag => 
+                // Check each NAT Gateway to ensure it's in a public subnet
+                for (const natGateway of response.NatGateways) {
+                    const subnetId = natGateway.SubnetId;
+                    const isPrivate = await this.isSubnetPrivate(subnetId);
+
+                    if (isPrivate) {
+                        console.warn(`WARNING: NAT Gateway ${natGateway.NatGatewayId} is in private subnet ${subnetId} - this will not work!`);
+                        console.warn('NAT Gateways MUST be placed in public subnets with Internet Gateway routes');
+                        console.warn('Skipping this misconfigured NAT Gateway...');
+                        continue; // Skip this NAT Gateway
+                    }
+
+                    // Check if it's a Frigg-tagged NAT Gateway
+                    const isFriggNat = natGateway.Tags && natGateway.Tags.some(tag =>
                         tag.Key === 'Name' && tag.Value.includes('frigg')
-                    )
-                );
-                
-                if (friggNatGateway) {
-                    console.log(`Found existing Frigg NAT Gateway: ${friggNatGateway.NatGatewayId}`);
-                    return friggNatGateway;
+                    );
+
+                    if (isFriggNat) {
+                        console.log(`Found existing Frigg NAT Gateway in public subnet: ${natGateway.NatGatewayId}`);
+                        return natGateway;
+                    }
+
+                    // Keep track of first valid NAT Gateway as fallback
+                    console.log(`Found existing NAT Gateway in public subnet: ${natGateway.NatGatewayId}`);
+                    return natGateway; // Return first NAT Gateway that's in a public subnet
                 }
-                
-                // Return first available NAT Gateway if no Frigg-specific one found
-                console.log(`Found existing NAT Gateway: ${response.NatGateways[0].NatGatewayId}`);
-                return response.NatGateways[0];
+
+                // All NAT Gateways are in private subnets - don't use any of them
+                console.error(`ERROR: Found ${response.NatGateways.length} NAT Gateway(s) but all are in private subnets!`);
+                console.error('These NAT Gateways will not provide internet connectivity');
+                console.error('A new NAT Gateway will be created in a public subnet');
+                return null; // Return null to trigger creation of new NAT Gateway
             }
-            
+
             return null;
         } catch (error) {
             console.warn('Error finding existing NAT Gateway:', error.message);
@@ -554,7 +576,7 @@ class AWSDiscovery {
                 defaultSecurityGroupId: securityGroup.GroupId,
                 privateSubnetId1: privateSubnets[0]?.SubnetId,
                 privateSubnetId2: privateSubnets[1]?.SubnetId || privateSubnets[0]?.SubnetId,
-                publicSubnetId: publicSubnet.SubnetId,
+                publicSubnetId: publicSubnet?.SubnetId || null, // May be null if no public subnet exists
                 privateRouteTableId: routeTable.RouteTableId,
                 defaultKmsKeyId: kmsKeyArn,
                 existingNatGatewayId: natGatewayId,
@@ -565,6 +587,40 @@ class AWSDiscovery {
             throw error;
         }
     }
+
+    /**
+     * Find an existing Internet Gateway attached to the VPC
+     * @param {string} vpcId - VPC ID to search in
+     * @returns {Promise<Object|null>} Internet Gateway object or null if none found
+     */
+    async findInternetGateway(vpcId) {
+        try {
+            const command = new DescribeInternetGatewaysCommand({
+                Filters: [
+                    {
+                        Name: 'attachment.vpc-id',
+                        Values: [vpcId]
+                    },
+                    {
+                        Name: 'attachment.state',
+                        Values: ['available']
+                    }
+                ]
+            });
+
+            const response = await this.ec2Client.send(command);
+
+            if (response.InternetGateways && response.InternetGateways.length > 0) {
+                console.log(`Found existing Internet Gateway: ${response.InternetGateways[0].InternetGatewayId}`);
+                return response.InternetGateways[0];
+            }
+
+            return null;
+        } catch (error) {
+            console.warn('Error finding Internet Gateway:', error.message);
+            return null;
+        }
+    }
 }
 
 module.exports = { AWSDiscovery };

package/infrastructure/serverless-template.js

@@ -1103,6 +1103,89 @@ const composeServerlessDefinition = async (AppDefinition) => {
                         };
                     }
 
+                    // If no public subnet exists, create one for NAT Gateway placement
+                    if (!discoveredResources.publicSubnetId) {
+                        console.log('No public subnet found, creating one for NAT Gateway placement...');
+
+                        // Check if Internet Gateway exists or create one
+                        if (!discoveredResources.internetGatewayId) {
+                            definition.resources.Resources.FriggInternetGateway = {
+                                Type: 'AWS::EC2::InternetGateway',
+                                Properties: {
+                                    Tags: [
+                                        {
+                                            Key: 'Name',
+                                            Value: '${self:service}-${self:provider.stage}-igw',
+                                        },
+                                    ],
+                                },
+                            };
+
+                            definition.resources.Resources.FriggIGWAttachment = {
+                                Type: 'AWS::EC2::VPCGatewayAttachment',
+                                Properties: {
+                                    VpcId: discoveredResources.defaultVpcId,
+                                    InternetGatewayId: { Ref: 'FriggInternetGateway' },
+                                },
+                            };
+                        }
+
+                        // Create a small public subnet for NAT Gateway
+                        definition.resources.Resources.FriggPublicSubnet = {
+                            Type: 'AWS::EC2::Subnet',
+                            Properties: {
+                                VpcId: discoveredResources.defaultVpcId,
+                                CidrBlock: '${self:custom.publicSubnetCidr, "172.31.250.0/24"}', // Small /24 subnet
+                                AvailabilityZone: '${self:provider.region}a',
+                                MapPublicIpOnLaunch: true,
+                                Tags: [
+                                    {
+                                        Key: 'Name',
+                                        Value: '${self:service}-${self:provider.stage}-public-subnet',
+                                    },
+                                    {
+                                        Key: 'Type',
+                                        Value: 'Public',
+                                    },
+                                ],
+                            },
+                        };
+
+                        // Create route table for public subnet
+                        definition.resources.Resources.FriggPublicRouteTable = {
+                            Type: 'AWS::EC2::RouteTable',
+                            Properties: {
+                                VpcId: discoveredResources.defaultVpcId,
+                                Tags: [
+                                    {
+                                        Key: 'Name',
+                                        Value: '${self:service}-${self:provider.stage}-public-rt',
+                                    },
+                                ],
+                            },
+                        };
+
+                        // Add route to Internet Gateway
+                        definition.resources.Resources.FriggPublicRoute = {
+                            Type: 'AWS::EC2::Route',
+                            DependsOn: discoveredResources.internetGatewayId ? [] : 'FriggIGWAttachment',
+                            Properties: {
+                                RouteTableId: { Ref: 'FriggPublicRouteTable' },
+                                DestinationCidrBlock: '0.0.0.0/0',
+                                GatewayId: discoveredResources.internetGatewayId || { Ref: 'FriggInternetGateway' },
+                            },
+                        };
+
+                        // Associate public subnet with public route table
+                        definition.resources.Resources.FriggPublicSubnetRouteTableAssociation = {
+                            Type: 'AWS::EC2::SubnetRouteTableAssociation',
+                            Properties: {
+                                SubnetId: { Ref: 'FriggPublicSubnet' },
+                                RouteTableId: { Ref: 'FriggPublicRouteTable' },
+                            },
+                        };
+                    }
+
                     definition.resources.Resources.FriggNATGateway = {
                         Type: 'AWS::EC2::NatGateway',
                         Properties: {
@@ -1113,9 +1196,7 @@ const composeServerlessDefinition = async (AppDefinition) => {
                                         'AllocationId',
                                     ],
                                 },
-                            SubnetId:
-                                discoveredResources.publicSubnetId ||
-                                discoveredResources.privateSubnetId1, // Use first discovered subnet if no public subnet found
+                            SubnetId: discoveredResources.publicSubnetId || { Ref: 'FriggPublicSubnet' },
                             Tags: [
                                 {
                                     Key: 'Name',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.428.a3d2e56.0",
+  "version": "2.0.0--canary.428.95f8e10.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -9,8 +9,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.428.a3d2e56.0",
-    "@friggframework/test": "2.0.0--canary.428.a3d2e56.0",
+    "@friggframework/schemas": "2.0.0--canary.428.95f8e10.0",
+    "@friggframework/test": "2.0.0--canary.428.95f8e10.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -32,8 +32,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.428.a3d2e56.0",
-    "@friggframework/prettier-config": "2.0.0--canary.428.a3d2e56.0",
+    "@friggframework/eslint-config": "2.0.0--canary.428.95f8e10.0",
+    "@friggframework/prettier-config": "2.0.0--canary.428.95f8e10.0",
     "jest": "^30.1.3",
     "prettier": "^2.7.1",
     "serverless": "3.39.0",
@@ -66,5 +66,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "a3d2e56038d2324c64df71c6ed49ff8e3d57873e"
+  "gitHead": "95f8e103995bc1c11331a44e49b232dfdd2e5604"
 }