@gradientedge/cdk-utils 10.7.0 → 10.8.0

package/src/lib/azure/services/api-management/types.ts

@@ -1,12 +1,23 @@
 import {
   ApiArgs,
+  ApiDiagnosticArgs,
   ApiManagementServiceArgs,
   ApiOperationArgs,
+  ApiOperationPolicyArgs,
+  ApiPolicyArgs,
   BackendArgs,
+  CacheArgs,
   GetApiManagementServiceOutputArgs,
+  LoggerArgs,
+  NamedValueArgs,
+  SubscriptionArgs,
 } from '@pulumi/azure-native/apimanagement/index.js'
 
-export interface ApiManagementProps extends ApiManagementServiceArgs {}
+export interface ApiManagementProps extends ApiManagementServiceArgs {
+  certificateKeyVaultId?: string
+  apiStackName?: string
+  useExistingApiManagement?: boolean
+}
 
 export interface ApiManagementBackendProps extends BackendArgs {
   backendUrlPath?: string
@@ -14,6 +25,16 @@ export interface ApiManagementBackendProps extends BackendArgs {
   circuitBreaker?: any
 }
 
+export interface ApiDiagnosticProps extends ApiDiagnosticArgs {}
+
+export interface LoggerProps extends LoggerArgs {}
+
+export interface NamedValueProps extends NamedValueArgs {}
+
+export interface ApiSubscriptionProps extends SubscriptionArgs {}
+
+export interface CacheProps extends CacheArgs {}
+
 export interface ApiManagementCustomDomainProps {
   apiManagementId: string
   gateway?: Array<{
@@ -35,6 +56,8 @@ export interface ApiManagementApiProps extends ApiArgs {
   operations: ApiManagementApiOperationProps[]
   commonInboundPolicyXml?: string
   commonOutboundPolicyXml?: string
+  cacheSetInboundPolicy?: string
+  cacheSetOutboundPolicy?: string
   rateLimit?: ApiManagementApiRateLimit
 }
 
@@ -62,3 +85,9 @@ export interface ApiManagementRedisCacheProps {
 }
 
 export interface ResolveApiManagementProps extends GetApiManagementServiceOutputArgs {}
+
+export interface ApiOperationProps extends ApiOperationArgs {}
+
+export interface ApiOperationPolicyProps extends ApiOperationPolicyArgs {}
+
+export interface ApiPolicyProps extends ApiPolicyArgs {}

package/src/lib/azure/services/app-configuration/main.ts

@@ -1,4 +1,5 @@
 import { ConfigurationStore, IdentityType } from '@pulumi/azure-native/appconfiguration/index.js'
+import { ResourceOptions } from '@pulumi/pulumi'
 import { CommonAzureConstruct } from '../../common/index.js'
 import { AppConfigurationProps } from './types.js'
 
@@ -25,9 +26,15 @@ export class AzureAppConfigurationManager {
    * @param id scoped id of the resource
    * @param scope scope in which this resource is defined
    * @param props app configuration properties
+   * @param resourceOptions Optional settings to control resource behaviour
    * @see [Pulumi Azure Native App Configuration]{@link https://www.pulumi.com/registry/packages/azure-native/api-docs/appconfiguration/configurationstore/}
    */
-  public createConfigurationStore(id: string, scope: CommonAzureConstruct, props: AppConfigurationProps) {
+  public createConfigurationStore(
+    id: string,
+    scope: CommonAzureConstruct,
+    props: AppConfigurationProps,
+    resourceOptions?: ResourceOptions
+  ) {
     if (!props) throw `Props undefined for ${id}`
 
     // Get resource group name
@@ -57,7 +64,27 @@ export class AzureAppConfigurationManager {
           environment: scope.props.stage,
         },
       },
-      { parent: scope }
+      { parent: scope, ...resourceOptions }
+    )
+  }
+
+  /**
+   * @summary Determine if the config object has cosmosdb dependencies
+   * @param obj the config object value
+   */
+  static hasCosmosDependencies = (obj: any): boolean => {
+    if (!obj || typeof obj !== 'object') return false
+    if ('databaseName' in obj || 'tableName' in obj) return true
+    return Object.values(obj).some(val => this.hasCosmosDependencies(val))
+  }
+
+  /**
+   * @summary Determine if the config object has eventgrid target dependencies
+   * @param obj the config object value
+   */
+  static hasEventGridTargets(obj: any): boolean {
+    return (
+      obj && typeof obj === 'object' && ('eventGridTargets' in obj || Object.values(obj).some(this.hasEventGridTargets))
     )
   }
 }

package/src/lib/azure/services/app-service/main.ts

@@ -4,6 +4,7 @@ import {
   SupportedTlsVersions,
   WebApp,
 } from '@pulumi/azure-native/web/index.js'
+import { ResourceOptions } from '@pulumi/pulumi'
 import { CommonAzureConstruct } from '../../common/index.js'
 import { LinuxWebAppProps, ServicePlanProps } from './types.js'
 
@@ -30,9 +31,15 @@ export class AzureAppServiceManager {
    * @param id scoped id of the resource
    * @param scope scope in which this resource is defined
    * @param props app service plan properties
+   * @param resourceOptions Optional settings to control resource behaviour
    * @see [Pulumi Azure Native App Service Plan]{@link https://www.pulumi.com/registry/packages/azure-native/api-docs/web/appserviceplan/}
    */
-  public createAppServicePlan(id: string, scope: CommonAzureConstruct, props: ServicePlanProps) {
+  public createAppServicePlan(
+    id: string,
+    scope: CommonAzureConstruct,
+    props: ServicePlanProps,
+    resourceOptions?: ResourceOptions
+  ) {
     if (!props) throw `Props undefined for ${id}`
 
     // Get resource group name
@@ -52,11 +59,17 @@ export class AzureAppServiceManager {
         ),
         resourceGroupName: resourceGroupName,
         location: props.location ?? scope.props.location,
+        sku: props.sku ?? {
+          name: 'FC1',
+          tier: 'FlexConsumption',
+        },
+        reserved: props.reserved ?? true,
+        zoneRedundant: props.zoneRedundant ?? true,
         tags: props.tags ?? {
           environment: scope.props.stage,
         },
       },
-      { parent: scope }
+      { parent: scope, ...resourceOptions }
     )
   }
 
@@ -65,9 +78,15 @@ export class AzureAppServiceManager {
    * @param id scoped id of the resource
    * @param scope scope in which this resource is defined
    * @param props web app properties
+   * @param resourceOptions Optional settings to control resource behaviour
    * @see [Pulumi Azure Native Web App]{@link https://www.pulumi.com/registry/packages/azure-native/api-docs/web/webapp/}
    */
-  public createLinuxWebApp(id: string, scope: CommonAzureConstruct, props: LinuxWebAppProps) {
+  public createLinuxWebApp(
+    id: string,
+    scope: CommonAzureConstruct,
+    props: LinuxWebAppProps,
+    resourceOptions?: ResourceOptions
+  ) {
     if (!props) throw `Props undefined for ${id}`
 
     // Get resource group name
@@ -98,7 +117,7 @@ export class AzureAppServiceManager {
           environment: scope.props.stage,
         },
       },
-      { parent: scope }
+      { parent: scope, ...resourceOptions }
     )
   }
 }

package/src/lib/azure/services/application-insights/main.ts

@@ -1,6 +1,11 @@
-import { ApplicationType, Component } from '@pulumi/azure-native/applicationinsights/index.js'
+import {
+  ApplicationType,
+  Component,
+  ComponentCurrentBillingFeature,
+} from '@pulumi/azure-native/applicationinsights/index.js'
+import { ResourceOptions } from '@pulumi/pulumi'
 import { CommonAzureConstruct } from '../../common/index.js'
-import { ApplicationInsightsProps } from './types.js'
+import { ApplicationInsightsProps, ComponentCurrentBillingFeatureProps } from './types.js'
 
 /**
  * @classdesc Provides operations on Azure Application Insights using Pulumi
@@ -21,13 +26,19 @@ import { ApplicationInsightsProps } from './types.js'
  */
 export class AzureApplicationInsightsManager {
   /**
-   * @summary Method to create a new application insights
+   * @summary Method to create a new application insights component
    * @param id scoped id of the resource
    * @param scope scope in which this resource is defined
-   * @param props application insights properties
+   * @param props application insights component properties
+   * @param resourceOptions Optional settings to control resource behaviour
    * @see [Pulumi Azure Native Application Insights Component]{@link https://www.pulumi.com/registry/packages/azure-native/api-docs/insights/component/}
    */
-  public createComponent(id: string, scope: CommonAzureConstruct, props: ApplicationInsightsProps) {
+  public createComponent(
+    id: string,
+    scope: CommonAzureConstruct,
+    props: ApplicationInsightsProps,
+    resourceOptions?: ResourceOptions
+  ) {
     if (!props) throw `Props undefined for ${id}`
 
     // Get resource group name
@@ -37,7 +48,7 @@ export class AzureApplicationInsightsManager {
 
     if (!resourceGroupName) throw `Resource group name undefined for ${id}`
 
-    return new Component(
+    const component = new Component(
       `${id}-ai`,
       {
         ...props,
@@ -52,7 +63,35 @@ export class AzureApplicationInsightsManager {
           environment: scope.props.stage,
         },
       },
-      { parent: scope }
+      { parent: scope, ...resourceOptions }
     )
+
+    if (props.billingFeatures) {
+      this.createComponentCurrentBillingFeature(`${id}-billing`, scope, props.billingFeatures, {
+        parent: scope,
+        ...resourceOptions,
+      })
+    }
+
+    return component
+  }
+
+  /**
+   * @summary Method to create a new application insights component billing feature
+   * @param id scoped id of the resource
+   * @param scope scope in which this resource is defined
+   * @param props application insights properties component billing featureø
+   * @param resourceOptions Optional settings to control resource behaviour
+   * @see [Pulumi Azure Native Application Insights Billing Feature]{@link https://www.pulumi.com/registry/packages/azure-native/api-docs/insights/componentcurrentbillingfeature/}
+   */
+  public createComponentCurrentBillingFeature(
+    id: string,
+    scope: CommonAzureConstruct,
+    props: ComponentCurrentBillingFeatureProps,
+    resourceOptions?: ResourceOptions
+  ) {
+    if (!props) throw `Props undefined for ${id}`
+
+    return new ComponentCurrentBillingFeature(`${id}`, props, { parent: scope, ...resourceOptions })
   }
 }

package/src/lib/azure/services/application-insights/types.ts

@@ -1,3 +1,7 @@
-import { ComponentArgs } from '@pulumi/azure-native/applicationinsights/index.js'
+import { ComponentArgs, ComponentCurrentBillingFeatureArgs } from '@pulumi/azure-native/applicationinsights/index.js'
 
-export interface ApplicationInsightsProps extends ComponentArgs {}
+export interface ComponentCurrentBillingFeatureProps extends ComponentCurrentBillingFeatureArgs {}
+
+export interface ApplicationInsightsProps extends ComponentArgs {
+  billingFeatures?: ComponentCurrentBillingFeatureProps
+}

package/src/lib/azure/services/authorisation/constants.ts

@@ -0,0 +1,13 @@
+/**
+ * @summary Enumerations for publicly available built in RBAC roles
+ * @see https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
+ */
+export enum RoleDefinitionId {
+  APP_CONFIGURATION_DATA_READER = '/providers/Microsoft.Authorization/roleDefinitions/516239f1-63e1-4d78-a4de-a74fb236a071',
+  APP_CONFIGURATION_DATA_OWNER = '/providers/Microsoft.Authorization/roleDefinitions/5ae67dd6-50cb-40e7-96ff-dc2bfa4b606b',
+  EVENTGRID_DATA_SENDER = '/providers/Microsoft.Authorization/roleDefinitions/d5a91429-5739-47e2-a06b-3470a27159e7',
+  KEY_VAULT_CERTIFICATE_USER = '/providers/Microsoft.Authorization/roleDefinitions/db79e9a7-68ee-4b58-9aeb-b90e7c24fcba',
+  KEY_VAULT_SECRETS_USER = '/providers/Microsoft.Authorization/roleDefinitions/4633458b-17de-408a-b874-0445c86b69e6',
+  STORAGE_BLOB_DATA_CONTRIBUTOR = '/providers/Microsoft.Authorization/roleDefinitions/ba92f5b4-2d11-453d-a403-e96b0029c9fe',
+  STORAGE_TABLE_DATA_CONTRIBUTOR = '/providers/Microsoft.Authorization/roleDefinitions/0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3',
+}

package/src/lib/azure/services/authorisation/index.ts

@@ -0,0 +1,3 @@
+export * from './constants.js'
+export * from './main.js'
+export * from './types.js'

package/src/lib/azure/services/authorisation/main.ts

@@ -0,0 +1,202 @@
+import { RoleAssignment } from '@pulumi/azure-native/authorization/index.js'
+import { Input, ResourceOptions } from '@pulumi/pulumi'
+import { CommonAzureConstruct } from '../../common/index.js'
+import { RoleDefinitionId } from './constants.js'
+import { RoleAssignmentProps } from './types.js'
+
+/**
+ * @classdesc Provides operations on Azure Authorisation using Pulumi
+ * - A new instance of this class is injected into {@link CommonAzureConstruct} constructor.
+ * - If a custom construct extends {@link CommonAzureConstruct}, an instance is available within the context.
+ * @example
+ * ```typescript
+ * import { CommonAzureConstruct, CommonAzureStackProps } from '@gradientedge/cdk-utils'
+ *
+ * class CustomConstruct extends CommonAzureConstruct {
+ *   constructor(name: string, props: CommonAzureStackProps) {
+ *     super(name, props)
+ *     this.props = props
+ *     this.authorisationManager.createRoleAssignment('MyRoleAssignment', this, props)
+ *   }
+ * }
+ * ```
+ */
+export class AzureAuthorisationManager {
+  /**
+   * @summary Method to create a new role assignment
+   * @param id scoped id of the resource
+   * @param scope scope in which this resource is defined
+   * @param props Role assignment properties
+   * @param resourceOptions Optional settings to control resource behaviour
+   * @see [Pulumi Azure Native Role Assignment]{@link https://www.pulumi.com/registry/packages/azure-native/api-docs/authorization/roleassignment/}
+   */
+  public createRoleAssignment(
+    id: string,
+    scope: CommonAzureConstruct,
+    props: RoleAssignmentProps,
+    resourceOptions?: ResourceOptions
+  ) {
+    if (!props) throw `Props undefined for ${id}`
+
+    return new RoleAssignment(`${id}`, props, { parent: scope, ...resourceOptions })
+  }
+
+  /**
+   * @summary Method to grant a role assignment to key vault
+   * @param id scoped id of the resource
+   * @param scope scope in which this resource is defined
+   * @param vaultName the key vault name
+   * @param resourceGroupName the resource group name
+   * @param principalId the principal id to which the role is assigned to
+   * @param roleDefinitionId the role definition id
+   * @param resourceOptions Optional settings to control resource behaviour
+   */
+  public grantRoleAssignmentToKeyVault(
+    id: string,
+    scope: CommonAzureConstruct,
+    vaultName: string,
+    resourceGroupName: string,
+    principalId: Input<string>,
+    roleDefinitionId: RoleDefinitionId,
+    resourceOptions?: ResourceOptions
+  ) {
+    const keyVault = scope.keyVaultManager.resolveKeyVault(scope, vaultName, resourceGroupName, resourceOptions)
+    return this.createRoleAssignment(
+      `${id}-kv-role-${vaultName}`,
+      scope,
+      {
+        principalId,
+        roleDefinitionId,
+        scope: keyVault.id,
+      },
+      resourceOptions
+    )
+  }
+
+  /**
+   * @summary Method to grant a role assignment to event grid topic
+   * @param id scoped id of the resource
+   * @param scope scope in which this resource is defined
+   * @param topicName the topic name
+   * @param resourceGroupName the resource group name
+   * @param principalId the principal id to which the role is assigned to
+   * @param roleDefinitionId the role definition id
+   * @param resourceOptions Optional settings to control resource behaviour
+   */
+  public grantRoleAssignmentToEventgridTopic(
+    id: string,
+    scope: CommonAzureConstruct,
+    topicName: string,
+    resourceGroupName: string,
+    principalId: Input<string>,
+    roleDefinitionId: RoleDefinitionId,
+    resourceOptions?: ResourceOptions
+  ) {
+    const topic = scope.eventgridManager.resolveEventgridTopic(
+      `${id}-egt-role-${topicName}`,
+      scope,
+      {
+        topicName,
+        resourceGroupName,
+      },
+      resourceOptions
+    )
+    return this.createRoleAssignment(
+      `${id}-egt-role-${topicName}`,
+      scope,
+      {
+        principalId,
+        roleDefinitionId,
+        scope: topic.id,
+      },
+      resourceOptions
+    )
+  }
+
+  /**
+   * @summary Method to grant a role assignment to application configuration
+   * @param id scoped id of the resource
+   * @param scope scope in which this resource is defined
+   * @param appConfigId the application configuration id
+   * @param principalId the principal id to which the role is assigned to
+   * @param roleDefinitionId the role definition id
+   * @param resourceOptions Optional settings to control resource behaviour
+   */
+  public grantRoleAssignmentToApplicationConfiguration(
+    id: string,
+    scope: CommonAzureConstruct,
+    appConfigId: Input<string>,
+    principalId: Input<string>,
+    roleDefinitionId: RoleDefinitionId,
+    resourceOptions?: ResourceOptions
+  ) {
+    return this.createRoleAssignment(
+      `${id}-ac-role`,
+      scope,
+      {
+        principalId,
+        roleDefinitionId,
+        scope: appConfigId,
+      },
+      resourceOptions
+    )
+  }
+
+  /**
+   * @summary Method to grant a role assignment to storage account
+   * @param id scoped id of the resource
+   * @param scope scope in which this resource is defined
+   * @param accountId the storage account id
+   * @param principalId the principal id to which the role is assigned to
+   * @param roleDefinitionId the role definition id
+   * @param resourceOptions Optional settings to control resource behaviour
+   */
+  public grantRoleAssignmentToStorageAccount(
+    id: string,
+    scope: CommonAzureConstruct,
+    accountId: Input<string>,
+    principalId: Input<string>,
+    roleDefinitionId: RoleDefinitionId,
+    resourceOptions?: ResourceOptions
+  ) {
+    return this.createRoleAssignment(
+      `${id}-sa-role`,
+      scope,
+      {
+        principalId,
+        roleDefinitionId,
+        scope: accountId,
+      },
+      resourceOptions
+    )
+  }
+
+  /**
+   * @summary Method to grant a role assignment to storage table
+   * @param id scoped id of the resource
+   * @param scope scope in which this resource is defined
+   * @param tableId the storage table id
+   * @param principalId the principal id to which the role is assigned to
+   * @param roleDefinitionId the role definition id
+   * @param resourceOptions Optional settings to control resource behaviour
+   */
+  public grantRoleAssignmentToStorageTable(
+    id: string,
+    scope: CommonAzureConstruct,
+    tableId: Input<string>,
+    principalId: Input<string>,
+    roleDefinitionId: RoleDefinitionId,
+    resourceOptions?: ResourceOptions
+  ) {
+    return this.createRoleAssignment(
+      `${id}-st-role`,
+      scope,
+      {
+        principalId,
+        roleDefinitionId,
+        scope: tableId,
+      },
+      resourceOptions
+    )
+  }
+}

package/src/lib/azure/services/authorisation/types.ts

@@ -0,0 +1,3 @@
+import { RoleAssignmentArgs } from '@pulumi/azure-native/authorization/index.js'
+
+export interface RoleAssignmentProps extends RoleAssignmentArgs {}

package/src/lib/azure/services/cosmosdb/constants.ts

@@ -0,0 +1,9 @@
+export enum CosmosRoleDefinition {
+  CONTRIBUTOR = 'CONTRIBUTOR',
+  READER = 'READER',
+}
+
+export enum CosmosRoleDefinitionId {
+  CONTRIBUTOR = '00000000-0000-0000-0000-000000000001',
+  READER = '00000000-0000-0000-0000-000000000002',
+}

package/src/lib/azure/services/cosmosdb/index.ts

@@ -1,2 +1,3 @@
+export * from './constants.js'
 export * from './main.js'
 export * from './types.js'