@friggframework/devtools 2.0.0--canary.428.edce2a7.0 → 2.0.0--canary.428.4dfa677.0

package/infrastructure/aws-discovery.js

@@ -1,10 +1,10 @@
-let EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeRouteTablesCommand, DescribeNatGatewaysCommand, DescribeAddressesCommand;
+let EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeRouteTablesCommand, DescribeNatGatewaysCommand, DescribeAddressesCommand, DescribeInternetGatewaysCommand;
 let KMSClient, ListKeysCommand, DescribeKeyCommand;
 let STSClient, GetCallerIdentityCommand;
 
 function loadEC2() {
     if (!EC2Client) {
-        ({ EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeRouteTablesCommand, DescribeNatGatewaysCommand, DescribeAddressesCommand } = require('@aws-sdk/client-ec2'));
+        ({ EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand, DescribeRouteTablesCommand, DescribeNatGatewaysCommand, DescribeAddressesCommand, DescribeInternetGatewaysCommand } = require('@aws-sdk/client-ec2'));
     }
 }
 
@@ -289,9 +289,9 @@ class AWSDiscovery {
                     }
                 ]
             });
-            
+
             const response = await this.ec2Client.send(command);
-            
+
             if (!response.Subnets || response.Subnets.length === 0) {
                 throw new Error(`No subnets found in VPC ${vpcId}`);
             }
@@ -308,10 +308,15 @@ class AWSDiscovery {
             }
 
             if (publicSubnets.length === 0) {
-                throw new Error(`No public subnets found in VPC ${vpcId} for NAT Gateway placement`);
+                // If no public subnets found, we need to create one or inform the user
+                console.warn(`WARNING: No public subnets found in VPC ${vpcId}`);
+                console.warn('A public subnet with Internet Gateway route is required for NAT Gateway placement');
+                console.warn('Please create a public subnet or use VPC endpoints instead');
+                return null; // Return null instead of throwing to allow graceful handling
             }
 
             // Return first public subnet for NAT Gateway
+            console.log(`Found ${publicSubnets.length} public subnets, using ${publicSubnets[0].SubnetId} for NAT Gateway`);
             return publicSubnets[0];
         } catch (error) {
             console.error('Error finding public subnets:', error);
@@ -554,7 +559,7 @@ class AWSDiscovery {
                 defaultSecurityGroupId: securityGroup.GroupId,
                 privateSubnetId1: privateSubnets[0]?.SubnetId,
                 privateSubnetId2: privateSubnets[1]?.SubnetId || privateSubnets[0]?.SubnetId,
-                publicSubnetId: publicSubnet.SubnetId,
+                publicSubnetId: publicSubnet?.SubnetId || null, // May be null if no public subnet exists
                 privateRouteTableId: routeTable.RouteTableId,
                 defaultKmsKeyId: kmsKeyArn,
                 existingNatGatewayId: natGatewayId,
@@ -565,6 +570,40 @@ class AWSDiscovery {
             throw error;
         }
     }
+
+    /**
+     * Find an existing Internet Gateway attached to the VPC
+     * @param {string} vpcId - VPC ID to search in
+     * @returns {Promise<Object|null>} Internet Gateway object or null if none found
+     */
+    async findInternetGateway(vpcId) {
+        try {
+            const command = new DescribeInternetGatewaysCommand({
+                Filters: [
+                    {
+                        Name: 'attachment.vpc-id',
+                        Values: [vpcId]
+                    },
+                    {
+                        Name: 'attachment.state',
+                        Values: ['available']
+                    }
+                ]
+            });
+
+            const response = await this.ec2Client.send(command);
+
+            if (response.InternetGateways && response.InternetGateways.length > 0) {
+                console.log(`Found existing Internet Gateway: ${response.InternetGateways[0].InternetGatewayId}`);
+                return response.InternetGateways[0];
+            }
+
+            return null;
+        } catch (error) {
+            console.warn('Error finding Internet Gateway:', error.message);
+            return null;
+        }
+    }
 }
 
 module.exports = { AWSDiscovery };

package/infrastructure/serverless-template.js

@@ -1103,6 +1103,89 @@ const composeServerlessDefinition = async (AppDefinition) => {
                         };
                     }
 
+                    // If no public subnet exists, create one for NAT Gateway placement
+                    if (!discoveredResources.publicSubnetId) {
+                        console.log('No public subnet found, creating one for NAT Gateway placement...');
+
+                        // Check if Internet Gateway exists or create one
+                        if (!discoveredResources.internetGatewayId) {
+                            definition.resources.Resources.FriggInternetGateway = {
+                                Type: 'AWS::EC2::InternetGateway',
+                                Properties: {
+                                    Tags: [
+                                        {
+                                            Key: 'Name',
+                                            Value: '${self:service}-${self:provider.stage}-igw',
+                                        },
+                                    ],
+                                },
+                            };
+
+                            definition.resources.Resources.FriggIGWAttachment = {
+                                Type: 'AWS::EC2::VPCGatewayAttachment',
+                                Properties: {
+                                    VpcId: discoveredResources.defaultVpcId,
+                                    InternetGatewayId: { Ref: 'FriggInternetGateway' },
+                                },
+                            };
+                        }
+
+                        // Create a small public subnet for NAT Gateway
+                        definition.resources.Resources.FriggPublicSubnet = {
+                            Type: 'AWS::EC2::Subnet',
+                            Properties: {
+                                VpcId: discoveredResources.defaultVpcId,
+                                CidrBlock: '${self:custom.publicSubnetCidr, "172.31.250.0/24"}', // Small /24 subnet
+                                AvailabilityZone: '${self:provider.region}a',
+                                MapPublicIpOnLaunch: true,
+                                Tags: [
+                                    {
+                                        Key: 'Name',
+                                        Value: '${self:service}-${self:provider.stage}-public-subnet',
+                                    },
+                                    {
+                                        Key: 'Type',
+                                        Value: 'Public',
+                                    },
+                                ],
+                            },
+                        };
+
+                        // Create route table for public subnet
+                        definition.resources.Resources.FriggPublicRouteTable = {
+                            Type: 'AWS::EC2::RouteTable',
+                            Properties: {
+                                VpcId: discoveredResources.defaultVpcId,
+                                Tags: [
+                                    {
+                                        Key: 'Name',
+                                        Value: '${self:service}-${self:provider.stage}-public-rt',
+                                    },
+                                ],
+                            },
+                        };
+
+                        // Add route to Internet Gateway
+                        definition.resources.Resources.FriggPublicRoute = {
+                            Type: 'AWS::EC2::Route',
+                            DependsOn: discoveredResources.internetGatewayId ? [] : 'FriggIGWAttachment',
+                            Properties: {
+                                RouteTableId: { Ref: 'FriggPublicRouteTable' },
+                                DestinationCidrBlock: '0.0.0.0/0',
+                                GatewayId: discoveredResources.internetGatewayId || { Ref: 'FriggInternetGateway' },
+                            },
+                        };
+
+                        // Associate public subnet with public route table
+                        definition.resources.Resources.FriggPublicSubnetRouteTableAssociation = {
+                            Type: 'AWS::EC2::SubnetRouteTableAssociation',
+                            Properties: {
+                                SubnetId: { Ref: 'FriggPublicSubnet' },
+                                RouteTableId: { Ref: 'FriggPublicRouteTable' },
+                            },
+                        };
+                    }
+
                     definition.resources.Resources.FriggNATGateway = {
                         Type: 'AWS::EC2::NatGateway',
                         Properties: {
@@ -1113,9 +1196,7 @@ const composeServerlessDefinition = async (AppDefinition) => {
                                         'AllocationId',
                                     ],
                                 },
-                            SubnetId:
-                                discoveredResources.publicSubnetId ||
-                                discoveredResources.privateSubnetId1, // Use first discovered subnet if no public subnet found
+                            SubnetId: discoveredResources.publicSubnetId || { Ref: 'FriggPublicSubnet' },
                             Tags: [
                                 {
                                     Key: 'Name',
@@ -1155,12 +1236,15 @@ const composeServerlessDefinition = async (AppDefinition) => {
                 };
 
                 // Associate Lambda subnets with NAT Gateway route table
+                // Note: This will only work if the subnets aren't already associated with another route table
+                // If deployment fails, manually associate the subnets with the correct route table in AWS Console
                 definition.resources.Resources.FriggSubnet1RouteAssociation = {
                     Type: 'AWS::EC2::SubnetRouteTableAssociation',
                     Properties: {
                         SubnetId: vpcConfig.subnetIds[0],
                         RouteTableId: { Ref: 'FriggLambdaRouteTable' },
                     },
+                    DependsOn: 'FriggLambdaRouteTable',
                 };
 
                 definition.resources.Resources.FriggSubnet2RouteAssociation = {
@@ -1169,6 +1253,7 @@ const composeServerlessDefinition = async (AppDefinition) => {
                         SubnetId: vpcConfig.subnetIds[1],
                         RouteTableId: { Ref: 'FriggLambdaRouteTable' },
                     },
+                    DependsOn: 'FriggLambdaRouteTable',
                 };
 
                 // Add VPC endpoints for AWS service optimization (optional but recommended)
@@ -1194,6 +1279,65 @@ const composeServerlessDefinition = async (AppDefinition) => {
                             RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }],
                         },
                     };
+
+                    // Add KMS VPC endpoint if using KMS encryption
+                    if (AppDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') {
+                        // Create security group for VPC endpoints if it doesn't exist
+                        if (!definition.resources.Resources.VPCEndpointSecurityGroup) {
+                            definition.resources.Resources.VPCEndpointSecurityGroup = {
+                                Type: 'AWS::EC2::SecurityGroup',
+                                Properties: {
+                                    GroupDescription: 'Security group for VPC endpoints',
+                                    VpcId: discoveredResources.defaultVpcId,
+                                    SecurityGroupIngress: [
+                                        {
+                                            IpProtocol: 'tcp',
+                                            FromPort: 443,
+                                            ToPort: 443,
+                                            CidrIp: '172.31.0.0/16', // VPC CIDR
+                                        },
+                                    ],
+                                    Tags: [
+                                        {
+                                            Key: 'Name',
+                                            Value: '${self:service}-${self:provider.stage}-vpc-endpoints-sg',
+                                        },
+                                    ],
+                                },
+                            };
+                        }
+
+                        definition.resources.Resources.VPCEndpointKMS = {
+                            Type: 'AWS::EC2::VPCEndpoint',
+                            Properties: {
+                                VpcId: discoveredResources.defaultVpcId,
+                                ServiceName: 'com.amazonaws.${self:provider.region}.kms',
+                                VpcEndpointType: 'Interface',
+                                SubnetIds: vpcConfig.subnetIds,
+                                SecurityGroupIds: [
+                                    { Ref: 'VPCEndpointSecurityGroup' },
+                                ],
+                                PrivateDnsEnabled: true,
+                            },
+                        };
+
+                        // Also add Secrets Manager endpoint if using Secrets Manager
+                        if (AppDefinition.secretsManager?.enable === true) {
+                            definition.resources.Resources.VPCEndpointSecretsManager = {
+                                Type: 'AWS::EC2::VPCEndpoint',
+                                Properties: {
+                                    VpcId: discoveredResources.defaultVpcId,
+                                    ServiceName: 'com.amazonaws.${self:provider.region}.secretsmanager',
+                                    VpcEndpointType: 'Interface',
+                                    SubnetIds: vpcConfig.subnetIds,
+                                    SecurityGroupIds: [
+                                        { Ref: 'VPCEndpointSecurityGroup' },
+                                    ],
+                                    PrivateDnsEnabled: true,
+                                },
+                            };
+                        }
+                    }
                 }
             }
         }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.428.edce2a7.0",
+  "version": "2.0.0--canary.428.4dfa677.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -9,8 +9,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.428.edce2a7.0",
-    "@friggframework/test": "2.0.0--canary.428.edce2a7.0",
+    "@friggframework/schemas": "2.0.0--canary.428.4dfa677.0",
+    "@friggframework/test": "2.0.0--canary.428.4dfa677.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -32,8 +32,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.428.edce2a7.0",
-    "@friggframework/prettier-config": "2.0.0--canary.428.edce2a7.0",
+    "@friggframework/eslint-config": "2.0.0--canary.428.4dfa677.0",
+    "@friggframework/prettier-config": "2.0.0--canary.428.4dfa677.0",
     "jest": "^30.1.3",
     "prettier": "^2.7.1",
     "serverless": "3.39.0",
@@ -66,5 +66,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "edce2a70ea28312c91e2f5ddff77028619d7fb71"
+  "gitHead": "4dfa6772d058ce8bb7a6ecc6313c070d57e4bc23"
 }