@gradientedge/cdk-utils 8.71.0 → 8.72.0

package/dist/src/lib/construct/site-with-ecs-backend/main.js

@@ -232,7 +232,9 @@ class SiteWithEcsBackend extends common_1.CommonConstruct {
             enableECSManagedTags: true,
             serviceName: `${this.id}-${this.props.stage}`,
             cpu: this.props.siteTask.cpu,
-            loadBalancerName: `${this.id}-${this.props.stage}`,
+            loadBalancerName: this.props.siteTask.loadBalancerName
+                ? `${this.props.siteTask.loadBalancerName}-${this.props.stage}`
+                : `${this.id}-${this.props.stage}`,
             certificate: this.siteRegionalCertificate,
             domainName: this.siteInternalDomainName,
             domainZone: this.siteHostedZone,
@@ -310,6 +312,8 @@ class SiteWithEcsBackend extends common_1.CommonConstruct {
             /* allow access to/from EFS from Fargate ECS service */
             this.siteFileSystem.connections.allowDefaultPortFrom(this.siteEcsService.connections);
             this.siteFileSystem.connections.allowDefaultPortTo(this.siteEcsService.connections);
+            /* add EFS permissions to ECS Role */
+            this.siteEcsRole.addToPolicy(new iam.PolicyStatement(this.iamManager.statementForWriteEfs([this.siteFileSystem.fileSystemArn])));
             /* add the efs volume to ecs task definition */
             this.siteEcsTaskDefinition.addVolume({
                 name: `${this.id}-fs`,

package/dist/src/lib/manager/aws/iam-manager.d.ts

@@ -100,6 +100,12 @@ export declare class IamManager {
      * @param {string[]} resourceArns list of ARNs to allow access to
      */
     statementForCloudfrontInvalidation(resourceArns?: string[]): cdk.aws_iam.PolicyStatement;
+    /**
+     * @summary Method to create iam statement to access efs
+     * @param {common.CommonConstruct} scope scope in which this resource is defined
+     * @param {string[]} resourceArns list of ARNs to allow access to
+     */
+    statementForWriteEfs(resourceArns?: string[]): cdk.aws_iam.PolicyStatement;
     /**
      * @summary Method to create iam policy to invalidate cloudfront cache
      * @param {string[]} resourceArns list of ARNs to allow access to

package/dist/src/lib/manager/aws/iam-manager.js

@@ -214,6 +214,18 @@ class IamManager {
             resources: resourceArns ?? ['*'],
         });
     }
+    /**
+     * @summary Method to create iam statement to access efs
+     * @param {common.CommonConstruct} scope scope in which this resource is defined
+     * @param {string[]} resourceArns list of ARNs to allow access to
+     */
+    statementForWriteEfs(resourceArns) {
+        return new iam.PolicyStatement({
+            effect: iam.Effect.ALLOW,
+            actions: ['elasticfilesystem:*'],
+            resources: resourceArns ?? ['*'],
+        });
+    }
     /**
      * @summary Method to create iam policy to invalidate cloudfront cache
      * @param {string[]} resourceArns list of ARNs to allow access to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gradientedge/cdk-utils",
-  "version": "8.71.0",
+  "version": "8.72.0",
   "description": "Utilities for AWS CDK provisioning",
   "main": "dist/index.js",
   "engines": {

package/src/lib/construct/site-with-ecs-backend/main.ts

@@ -261,7 +261,9 @@ export class SiteWithEcsBackend extends CommonConstruct {
       enableECSManagedTags: true,
       serviceName: `${this.id}-${this.props.stage}`,
       cpu: this.props.siteTask.cpu,
-      loadBalancerName: `${this.id}-${this.props.stage}`,
+      loadBalancerName: this.props.siteTask.loadBalancerName
+        ? `${this.props.siteTask.loadBalancerName}-${this.props.stage}`
+        : `${this.id}-${this.props.stage}`,
       certificate: this.siteRegionalCertificate,
       domainName: this.siteInternalDomainName,
       domainZone: this.siteHostedZone,
@@ -356,6 +358,11 @@ export class SiteWithEcsBackend extends CommonConstruct {
       this.siteFileSystem.connections.allowDefaultPortFrom(this.siteEcsService.connections)
       this.siteFileSystem.connections.allowDefaultPortTo(this.siteEcsService.connections)
 
+      /* add EFS permissions to ECS Role */
+      this.siteEcsRole.addToPolicy(
+        new iam.PolicyStatement(this.iamManager.statementForWriteEfs([this.siteFileSystem.fileSystemArn]))
+      )
+
       /* add the efs volume to ecs task definition */
       this.siteEcsTaskDefinition.addVolume({
         name: `${this.id}-fs`,

package/src/lib/manager/aws/iam-manager.ts

@@ -208,6 +208,19 @@ export class IamManager {
     })
   }
 
+  /**
+   * @summary Method to create iam statement to access efs
+   * @param {common.CommonConstruct} scope scope in which this resource is defined
+   * @param {string[]} resourceArns list of ARNs to allow access to
+   */
+  public statementForWriteEfs(resourceArns?: string[]) {
+    return new iam.PolicyStatement({
+      effect: iam.Effect.ALLOW,
+      actions: ['elasticfilesystem:*'],
+      resources: resourceArns ?? ['*'],
+    })
+  }
+
   /**
    * @summary Method to create iam policy to invalidate cloudfront cache
    * @param {string[]} resourceArns list of ARNs to allow access to