@friggframework/devtools 2.0.0-next.23 → 2.0.0-next.25

package/infrastructure/serverless-template.js

@@ -7,7 +7,7 @@ const findNodeModulesPath = () => {
         // Method 1: Try to find node_modules by traversing up from current directory
         let currentDir = process.cwd();
         let nodeModulesPath = null;
-        
+
         // Traverse up to 5 levels to find node_modules
         for (let i = 0; i < 5; i++) {
             const potentialPath = path.join(currentDir, 'node_modules');
@@ -24,7 +24,7 @@ const findNodeModulesPath = () => {
             }
             currentDir = parentDir;
         }
-        
+
         // Method 2: If method 1 fails, try using npm root command
         if (!nodeModulesPath) {
             try {
@@ -39,7 +39,7 @@ const findNodeModulesPath = () => {
                 console.error('Error executing npm root:', npmError);
             }
         }
-        
+
         // Method 3: If all else fails, check for a package.json and assume node_modules is adjacent
         if (!nodeModulesPath) {
             currentDir = process.cwd();
@@ -62,11 +62,11 @@ const findNodeModulesPath = () => {
                 currentDir = parentDir;
             }
         }
-        
+
         if (nodeModulesPath) {
             return nodeModulesPath;
         }
-        
+
         console.warn('Could not find node_modules path, falling back to default');
         return path.resolve(process.cwd(), '../node_modules');
     } catch (error) {
@@ -80,7 +80,7 @@ const modifyHandlerPaths = (functions) => {
     // Check if we're running in offline mode
     const isOffline = process.argv.includes('offline');
     console.log('isOffline', isOffline);
-    
+
     if (!isOffline) {
         console.log('Not in offline mode, skipping handler path modification');
         return functions;
@@ -88,7 +88,7 @@ const modifyHandlerPaths = (functions) => {
 
     const nodeModulesPath = findNodeModulesPath();
     const modifiedFunctions = { ...functions };
-    
+
     for (const functionName of Object.keys(modifiedFunctions)) {
         console.log('functionName', functionName);
         const functionDef = modifiedFunctions[functionName];
@@ -98,10 +98,313 @@ const modifyHandlerPaths = (functions) => {
             console.log(`Updated handler for ${functionName}: ${functionDef.handler}`);
         }
     }
-    
+
     return modifiedFunctions;
 };
 
+// Helper function to create VPC infrastructure resources
+const createVPCInfrastructure = (AppDefinition) => {
+    const vpcResources = {
+        // VPC
+        FriggVPC: {
+            Type: 'AWS::EC2::VPC',
+            Properties: {
+                CidrBlock: AppDefinition.vpc.cidrBlock || '10.0.0.0/16',
+                EnableDnsHostnames: true,
+                EnableDnsSupport: true,
+                Tags: [
+                    { Key: 'Name', Value: '${self:service}-${self:provider.stage}-vpc' }
+                ]
+            }
+        },
+
+        // Internet Gateway
+        FriggInternetGateway: {
+            Type: 'AWS::EC2::InternetGateway',
+            Properties: {
+                Tags: [
+                    { Key: 'Name', Value: '${self:service}-${self:provider.stage}-igw' }
+                ]
+            }
+        },
+
+        // Attach Internet Gateway to VPC
+        FriggVPCGatewayAttachment: {
+            Type: 'AWS::EC2::VPCGatewayAttachment',
+            Properties: {
+                VpcId: { Ref: 'FriggVPC' },
+                InternetGatewayId: { Ref: 'FriggInternetGateway' }
+            }
+        },
+
+        // Public Subnet for NAT Gateway
+        FriggPublicSubnet: {
+            Type: 'AWS::EC2::Subnet',
+            Properties: {
+                VpcId: { Ref: 'FriggVPC' },
+                CidrBlock: '10.0.1.0/24',
+                AvailabilityZone: { 'Fn::Select': [0, { 'Fn::GetAZs': '' }] },
+                MapPublicIpOnLaunch: true,
+                Tags: [
+                    { Key: 'Name', Value: '${self:service}-${self:provider.stage}-public-subnet' }
+                ]
+            }
+        },
+
+        // Private Subnet 1 for Lambda
+        FriggPrivateSubnet1: {
+            Type: 'AWS::EC2::Subnet',
+            Properties: {
+                VpcId: { Ref: 'FriggVPC' },
+                CidrBlock: '10.0.2.0/24',
+                AvailabilityZone: { 'Fn::Select': [0, { 'Fn::GetAZs': '' }] },
+                Tags: [
+                    { Key: 'Name', Value: '${self:service}-${self:provider.stage}-private-subnet-1' }
+                ]
+            }
+        },
+
+        // Private Subnet 2 for Lambda (different AZ for redundancy)
+        FriggPrivateSubnet2: {
+            Type: 'AWS::EC2::Subnet',
+            Properties: {
+                VpcId: { Ref: 'FriggVPC' },
+                CidrBlock: '10.0.3.0/24',
+                AvailabilityZone: { 'Fn::Select': [1, { 'Fn::GetAZs': '' }] },
+                Tags: [
+                    { Key: 'Name', Value: '${self:service}-${self:provider.stage}-private-subnet-2' }
+                ]
+            }
+        },
+
+        // Elastic IP for NAT Gateway
+        FriggNATGatewayEIP: {
+            Type: 'AWS::EC2::EIP',
+            Properties: {
+                Domain: 'vpc',
+                Tags: [
+                    { Key: 'Name', Value: '${self:service}-${self:provider.stage}-nat-eip' }
+                ]
+            },
+            DependsOn: 'FriggVPCGatewayAttachment'
+        },
+
+        // NAT Gateway for private subnet internet access
+        FriggNATGateway: {
+            Type: 'AWS::EC2::NatGateway',
+            Properties: {
+                AllocationId: { 'Fn::GetAtt': ['FriggNATGatewayEIP', 'AllocationId'] },
+                SubnetId: { Ref: 'FriggPublicSubnet' },
+                Tags: [
+                    { Key: 'Name', Value: '${self:service}-${self:provider.stage}-nat-gateway' }
+                ]
+            }
+        },
+
+        // Public Route Table
+        FriggPublicRouteTable: {
+            Type: 'AWS::EC2::RouteTable',
+            Properties: {
+                VpcId: { Ref: 'FriggVPC' },
+                Tags: [
+                    { Key: 'Name', Value: '${self:service}-${self:provider.stage}-public-rt' }
+                ]
+            }
+        },
+
+        // Public Route to Internet Gateway
+        FriggPublicRoute: {
+            Type: 'AWS::EC2::Route',
+            Properties: {
+                RouteTableId: { Ref: 'FriggPublicRouteTable' },
+                DestinationCidrBlock: '0.0.0.0/0',
+                GatewayId: { Ref: 'FriggInternetGateway' }
+            },
+            DependsOn: 'FriggVPCGatewayAttachment'
+        },
+
+        // Associate Public Subnet with Public Route Table
+        FriggPublicSubnetRouteTableAssociation: {
+            Type: 'AWS::EC2::SubnetRouteTableAssociation',
+            Properties: {
+                SubnetId: { Ref: 'FriggPublicSubnet' },
+                RouteTableId: { Ref: 'FriggPublicRouteTable' }
+            }
+        },
+
+        // Private Route Table
+        FriggPrivateRouteTable: {
+            Type: 'AWS::EC2::RouteTable',
+            Properties: {
+                VpcId: { Ref: 'FriggVPC' },
+                Tags: [
+                    { Key: 'Name', Value: '${self:service}-${self:provider.stage}-private-rt' }
+                ]
+            }
+        },
+
+        // Private Route to NAT Gateway
+        FriggPrivateRoute: {
+            Type: 'AWS::EC2::Route',
+            Properties: {
+                RouteTableId: { Ref: 'FriggPrivateRouteTable' },
+                DestinationCidrBlock: '0.0.0.0/0',
+                NatGatewayId: { Ref: 'FriggNATGateway' }
+            }
+        },
+
+        // Associate Private Subnet 1 with Private Route Table
+        FriggPrivateSubnet1RouteTableAssociation: {
+            Type: 'AWS::EC2::SubnetRouteTableAssociation',
+            Properties: {
+                SubnetId: { Ref: 'FriggPrivateSubnet1' },
+                RouteTableId: { Ref: 'FriggPrivateRouteTable' }
+            }
+        },
+
+        // Associate Private Subnet 2 with Private Route Table
+        FriggPrivateSubnet2RouteTableAssociation: {
+            Type: 'AWS::EC2::SubnetRouteTableAssociation',
+            Properties: {
+                SubnetId: { Ref: 'FriggPrivateSubnet2' },
+                RouteTableId: { Ref: 'FriggPrivateRouteTable' }
+            }
+        },
+
+        // Security Group for Lambda functions
+        FriggLambdaSecurityGroup: {
+            Type: 'AWS::EC2::SecurityGroup',
+            Properties: {
+                GroupDescription: 'Security group for Frigg Lambda functions',
+                VpcId: { Ref: 'FriggVPC' },
+                SecurityGroupEgress: [
+                    {
+                        IpProtocol: 'tcp',
+                        FromPort: 443,
+                        ToPort: 443,
+                        CidrIp: '0.0.0.0/0',
+                        Description: 'HTTPS outbound'
+                    },
+                    {
+                        IpProtocol: 'tcp',
+                        FromPort: 80,
+                        ToPort: 80,
+                        CidrIp: '0.0.0.0/0',
+                        Description: 'HTTP outbound'
+                    },
+                    {
+                        IpProtocol: 'tcp',
+                        FromPort: 53,
+                        ToPort: 53,
+                        CidrIp: '0.0.0.0/0',
+                        Description: 'DNS TCP'
+                    },
+                    {
+                        IpProtocol: 'udp',
+                        FromPort: 53,
+                        ToPort: 53,
+                        CidrIp: '0.0.0.0/0',
+                        Description: 'DNS UDP'
+                    }
+                ],
+                Tags: [
+                    { Key: 'Name', Value: '${self:service}-${self:provider.stage}-lambda-sg' }
+                ]
+            }
+        }
+    };
+
+    // Add VPC Endpoints for cost optimization
+    if (AppDefinition.vpc.enableVPCEndpoints !== false) {
+        // S3 Gateway Endpoint (free)
+        vpcResources.FriggS3VPCEndpoint = {
+            Type: 'AWS::EC2::VPCEndpoint',
+            Properties: {
+                VpcId: { Ref: 'FriggVPC' },
+                ServiceName: 'com.amazonaws.${self:provider.region}.s3',
+                VpcEndpointType: 'Gateway',
+                RouteTableIds: [
+                    { Ref: 'FriggPrivateRouteTable' }
+                ]
+            }
+        };
+
+        // DynamoDB Gateway Endpoint (free)
+        vpcResources.FriggDynamoDBVPCEndpoint = {
+            Type: 'AWS::EC2::VPCEndpoint',
+            Properties: {
+                VpcId: { Ref: 'FriggVPC' },
+                ServiceName: 'com.amazonaws.${self:provider.region}.dynamodb',
+                VpcEndpointType: 'Gateway',
+                RouteTableIds: [
+                    { Ref: 'FriggPrivateRouteTable' }
+                ]
+            }
+        };
+
+        // KMS Interface Endpoint (paid, but useful if using KMS)
+        if (AppDefinition.encryption?.useDefaultKMSForFieldLevelEncryption === true) {
+            vpcResources.FriggKMSVPCEndpoint = {
+                Type: 'AWS::EC2::VPCEndpoint',
+                Properties: {
+                    VpcId: { Ref: 'FriggVPC' },
+                    ServiceName: 'com.amazonaws.${self:provider.region}.kms',
+                    VpcEndpointType: 'Interface',
+                    SubnetIds: [
+                        { Ref: 'FriggPrivateSubnet1' },
+                        { Ref: 'FriggPrivateSubnet2' }
+                    ],
+                    SecurityGroupIds: [
+                        { Ref: 'FriggVPCEndpointSecurityGroup' }
+                    ],
+                    PrivateDnsEnabled: true
+                }
+            };
+        }
+
+        // Secrets Manager Interface Endpoint (paid, but useful for secrets)
+        vpcResources.FriggSecretsManagerVPCEndpoint = {
+            Type: 'AWS::EC2::VPCEndpoint',
+            Properties: {
+                VpcId: { Ref: 'FriggVPC' },
+                ServiceName: 'com.amazonaws.${self:provider.region}.secretsmanager',
+                VpcEndpointType: 'Interface',
+                SubnetIds: [
+                    { Ref: 'FriggPrivateSubnet1' },
+                    { Ref: 'FriggPrivateSubnet2' }
+                ],
+                SecurityGroupIds: [
+                    { Ref: 'FriggVPCEndpointSecurityGroup' }
+                ],
+                PrivateDnsEnabled: true
+            }
+        };
+
+        // Security Group for VPC Endpoints
+        vpcResources.FriggVPCEndpointSecurityGroup = {
+            Type: 'AWS::EC2::SecurityGroup',
+            Properties: {
+                GroupDescription: 'Security group for Frigg VPC Endpoints',
+                VpcId: { Ref: 'FriggVPC' },
+                SecurityGroupIngress: [
+                    {
+                        IpProtocol: 'tcp',
+                        FromPort: 443,
+                        ToPort: 443,
+                        SourceSecurityGroupId: { Ref: 'FriggLambdaSecurityGroup' },
+                        Description: 'HTTPS from Lambda'
+                    }
+                ],
+                Tags: [
+                    { Key: 'Name', Value: '${self:service}-${self:provider.stage}-vpc-endpoint-sg' }
+                ]
+            }
+        };
+    }
+
+    return vpcResources;
+};
+
 const composeServerlessDefinition = (AppDefinition) => {
     const definition = {
         frameworkVersion: '>=3.17.0',
@@ -329,6 +632,75 @@ const composeServerlessDefinition = (AppDefinition) => {
         },
     };
 
+    // KMS Configuration based on App Definition
+    if (AppDefinition.encryption?.useDefaultKMSForFieldLevelEncryption === true) {
+        // Add KMS IAM permissions
+        definition.provider.iamRoleStatements.push({
+            Effect: 'Allow',
+            Action: [
+                'kms:GenerateDataKey',
+                'kms:Decrypt'
+            ],
+            Resource: ['${self:custom.kmsGrants.kmsKeyId}']
+        });
+
+        // Add KMS_KEY_ARN environment variable for Frigg Encrypt module
+        definition.provider.environment.KMS_KEY_ARN = '${self:custom.kmsGrants.kmsKeyId}';
+
+        // Add serverless-kms-grants plugin
+        definition.plugins.push('serverless-kms-grants');
+
+        // Configure KMS grants with default key
+        definition.custom.kmsGrants = {
+            kmsKeyId: '*'
+        };
+    }
+
+    // VPC Configuration based on App Definition
+    if (AppDefinition.vpc?.enable === true) {
+        // Create VPC config from App Definition or use auto-created resources
+        const vpcConfig = {};
+
+        if (AppDefinition.vpc.securityGroupIds) {
+            // User provided custom security groups
+            vpcConfig.securityGroupIds = AppDefinition.vpc.securityGroupIds;
+        } else {
+            // Use auto-created security group
+            vpcConfig.securityGroupIds = [{ Ref: 'FriggLambdaSecurityGroup' }];
+        }
+
+        if (AppDefinition.vpc.subnetIds) {
+            // User provided custom subnets
+            vpcConfig.subnetIds = AppDefinition.vpc.subnetIds;
+        } else {
+            // Use auto-created private subnets
+            vpcConfig.subnetIds = [
+                { Ref: 'FriggPrivateSubnet1' },
+                { Ref: 'FriggPrivateSubnet2' }
+            ];
+        }
+
+        // Set VPC config for Lambda functions
+        definition.provider.vpc = vpcConfig;
+
+        // Add VPC-related IAM permissions
+        definition.provider.iamRoleStatements.push({
+            Effect: 'Allow',
+            Action: [
+                'ec2:CreateNetworkInterface',
+                'ec2:DescribeNetworkInterfaces',
+                'ec2:DeleteNetworkInterface',
+                'ec2:AttachNetworkInterface',
+                'ec2:DetachNetworkInterface'
+            ],
+            Resource: '*'
+        });
+
+        // Add VPC infrastructure resources to CloudFormation
+        const vpcResources = createVPCInfrastructure(AppDefinition);
+        Object.assign(definition.resources.Resources, vpcResources);
+    }
+
     // Add integration-specific functions and resources
     for (const integration of AppDefinition.integrations) {
         const integrationName = integration.Definition.name;
@@ -348,9 +720,8 @@ const composeServerlessDefinition = (AppDefinition) => {
         };
 
         // Add SQS Queue for the integration
-        const queueReference = `${
-            integrationName.charAt(0).toUpperCase() + integrationName.slice(1)
-        }Queue`;
+        const queueReference = `${integrationName.charAt(0).toUpperCase() + integrationName.slice(1)
+            }Queue`;
         const queueName = `\${self:service}--\${self:provider.stage}-${queueReference}`;
         definition.resources.Resources[queueReference] = {
             Type: 'AWS::SQS::Queue',
@@ -398,7 +769,7 @@ const composeServerlessDefinition = (AppDefinition) => {
 
     // Modify handler paths to point to the correct node_modules location
     definition.functions = modifyHandlerPaths(definition.functions);
-    
+
     return definition;
 };
 

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0-next.23",
+  "version": "2.0.0-next.25",
   "dependencies": {
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/test": "2.0.0-next.23",
+    "@friggframework/test": "2.0.0-next.25",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -27,12 +27,13 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0-next.23",
-    "@friggframework/prettier-config": "2.0.0-next.23",
+    "@friggframework/eslint-config": "2.0.0-next.25",
+    "@friggframework/prettier-config": "2.0.0-next.25",
     "prettier": "^2.7.1",
     "serverless": "3.39.0",
     "serverless-dotenv-plugin": "^6.0.0",
     "serverless-jetpack": "^0.11.2",
+    "serverless-kms-grants": "^1.0.0",
     "serverless-offline": "^13.8.0",
     "serverless-offline-sqs": "^8.0.0",
     "serverless-plugin-monorepo": "^0.11.0"
@@ -59,5 +60,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "73a095711956729566b4eb0cc588c886fa74087e"
+  "gitHead": "d758d225a2cfbe4038ecc2b777cd6826949312fb"
 }