@guardian/cdk 0.0.0-canary-20260805130549

package/lib/constants/tracking-tag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracking-tag.js","sourceRoot":"","sources":["../../src/constants/tracking-tag.ts"],"names":[],"mappings":";;;AAAA,iDAA6C;AAC7C,mDAA+C;AAElC,QAAA,WAAW,GAAG;IACzB,GAAG,EAAE,4BAAY,CAAC,OAAO;IACzB,KAAK,EAAE,0BAAW,CAAC,OAAO;CAC3B,CAAC","sourcesContent":["import { LibraryInfo } from \"./library-info\";\nimport { MetadataKeys } from \"./metadata-keys\";\n\nexport const TrackingTag = {\n  Key: MetadataKeys.VERSION,\n  Value: LibraryInfo.VERSION,\n};\n"]}

package/lib/constructs/acm/certificate.d.ts

@@ -0,0 +1,24 @@
+import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
+import type { GuDomainName } from "../../types";
+import { AppIdentity } from "../core";
+import type { GuStack } from "../core";
+export type GuCertificatePropsWithApp = GuDomainName & AppIdentity;
+declare const GuCertificate_base: {
+    new (...args: any[]): {
+        readonly idWithApp: string;
+    };
+} & typeof Certificate;
+/**
+ * Construct which creates a DNS-validated ACM Certificate.
+ *
+ * If your DNS is managed via Route 53, then supplying `hostedZoneId` props will allow AWS to automatically
+ * validate your certificate.
+ *
+ * If your DNS is not managed via Route 53, or you omit the `hostedZoneId` props, then the CloudFormation
+ * operation which adds this construct will pause until the relevant DNS record has been added manually.
+ */
+export declare class GuCertificate extends GuCertificate_base {
+    constructor(scope: GuStack, props: GuCertificatePropsWithApp);
+}
+export {};
+//# sourceMappingURL=certificate.d.ts.map

package/lib/constructs/acm/certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../../../src/constructs/acm/certificate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAyB,MAAM,oCAAoC,CAAC;AAGxF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,MAAM,yBAAyB,GAAG,YAAY,GAAG,WAAW,CAAC;;;;;;AAEnE;;;;;;;;GAQG;AACH,qBAAa,aAAc,SAAQ,kBAAgC;gBACrD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,yBAAyB;CAe7D"}

package/lib/constructs/acm/certificate.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuCertificate = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_certificatemanager_1 = require("aws-cdk-lib/aws-certificatemanager");
+const aws_route53_1 = require("aws-cdk-lib/aws-route53");
+const app_aware_construct_1 = require("../../utils/mixin/app-aware-construct");
+const core_1 = require("../core");
+/**
+ * Construct which creates a DNS-validated ACM Certificate.
+ *
+ * If your DNS is managed via Route 53, then supplying `hostedZoneId` props will allow AWS to automatically
+ * validate your certificate.
+ *
+ * If your DNS is not managed via Route 53, or you omit the `hostedZoneId` props, then the CloudFormation
+ * operation which adds this construct will pause until the relevant DNS record has been added manually.
+ */
+class GuCertificate extends (0, app_aware_construct_1.GuAppAwareConstruct)(aws_certificatemanager_1.Certificate) {
+    constructor(scope, props) {
+        const { app, domainName, hostedZoneId } = props;
+        const maybeHostedZone = hostedZoneId
+            ? aws_route53_1.HostedZone.fromHostedZoneId(scope, core_1.AppIdentity.suffixText({ app }, "HostedZone"), hostedZoneId)
+            : undefined;
+        const awsCertificateProps = {
+            domainName,
+            validation: aws_certificatemanager_1.CertificateValidation.fromDns(maybeHostedZone),
+            app,
+        };
+        super(scope, "Certificate", awsCertificateProps);
+        this.applyRemovalPolicy(aws_cdk_lib_1.RemovalPolicy.RETAIN);
+    }
+}
+exports.GuCertificate = GuCertificate;
+//# sourceMappingURL=certificate.js.map

package/lib/constructs/acm/certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.js","sourceRoot":"","sources":["../../../src/constructs/acm/certificate.ts"],"names":[],"mappings":";;;AAAA,6CAA4C;AAC5C,+EAAwF;AAExF,yDAAqD;AAErD,+EAA4E;AAC5E,kCAAsC;AAKtC;;;;;;;;GAQG;AACH,MAAa,aAAc,SAAQ,IAAA,yCAAmB,EAAC,oCAAW,CAAC;IACjE,YAAY,KAAc,EAAE,KAAgC;QAC1D,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;QAEhD,MAAM,eAAe,GAAG,YAAY;YAClC,CAAC,CAAC,wBAAU,CAAC,gBAAgB,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC;YACjG,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,mBAAmB,GAAmC;YAC1D,UAAU;YACV,UAAU,EAAE,8CAAqB,CAAC,OAAO,CAAC,eAAe,CAAC;YAC1D,GAAG;SACJ,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;QACjD,IAAI,CAAC,kBAAkB,CAAC,2BAAa,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;CACF;AAhBD,sCAgBC","sourcesContent":["import { RemovalPolicy } from \"aws-cdk-lib\";\nimport { Certificate, CertificateValidation } from \"aws-cdk-lib/aws-certificatemanager\";\nimport type { CertificateProps } from \"aws-cdk-lib/aws-certificatemanager/lib/certificate\";\nimport { HostedZone } from \"aws-cdk-lib/aws-route53\";\nimport type { GuDomainName } from \"../../types\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport { AppIdentity } from \"../core\";\nimport type { GuStack } from \"../core\";\n\nexport type GuCertificatePropsWithApp = GuDomainName & AppIdentity;\n\n/**\n * Construct which creates a DNS-validated ACM Certificate.\n *\n * If your DNS is managed via Route 53, then supplying `hostedZoneId` props will allow AWS to automatically\n * validate your certificate.\n *\n * If your DNS is not managed via Route 53, or you omit the `hostedZoneId` props, then the CloudFormation\n * operation which adds this construct will pause until the relevant DNS record has been added manually.\n */\nexport class GuCertificate extends GuAppAwareConstruct(Certificate) {\n  constructor(scope: GuStack, props: GuCertificatePropsWithApp) {\n    const { app, domainName, hostedZoneId } = props;\n\n    const maybeHostedZone = hostedZoneId\n      ? HostedZone.fromHostedZoneId(scope, AppIdentity.suffixText({ app }, \"HostedZone\"), hostedZoneId)\n      : undefined;\n\n    const awsCertificateProps: CertificateProps & AppIdentity = {\n      domainName,\n      validation: CertificateValidation.fromDns(maybeHostedZone),\n      app,\n    };\n    super(scope, \"Certificate\", awsCertificateProps);\n    this.applyRemovalPolicy(RemovalPolicy.RETAIN);\n  }\n}\n"]}

package/lib/constructs/acm/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./certificate";
+//# sourceMappingURL=index.d.ts.map

package/lib/constructs/acm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constructs/acm/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC"}

package/lib/constructs/acm/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./certificate"), exports);
+//# sourceMappingURL=index.js.map

package/lib/constructs/acm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constructs/acm/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B","sourcesContent":["export * from \"./certificate\";\n"]}

package/lib/constructs/autoscaling/asg.d.ts

@@ -0,0 +1,75 @@
+import type { Duration } from "aws-cdk-lib";
+import { AutoScalingGroup } from "aws-cdk-lib/aws-autoscaling";
+import type { AutoScalingGroupProps } from "aws-cdk-lib/aws-autoscaling";
+import { LaunchTemplate } from "aws-cdk-lib/aws-ec2";
+import type { InstanceType, ISecurityGroup, UserData } from "aws-cdk-lib/aws-ec2";
+import type { ApplicationTargetGroup } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import type { GuAsgCapacity } from "../../types";
+import type { AmigoProps } from "../../types/amigo";
+import { GuAmiParameter } from "../core";
+import type { AppIdentity, GuStack } from "../core";
+export type InstanceMetricGranularity = "1Minute" | "5Minute";
+export interface GuAutoScalingGroupProps extends Omit<AutoScalingGroupProps, "imageId" | "osType" | "machineImage" | "userData" | "minCapacity" | "maxCapacity" | "desiredCapacity" | "requireImdsv2" | "securityGroup">, AppIdentity, GuAsgCapacity {
+    /**
+     * @deprecated
+     * It shouldn't be necessary to specify a value here.
+     * GuCDK will create an AMI parameter by default. Riff-Raff can use this parameter to inject the latest AMI ID for
+     * your AMIgo recipe.
+     */
+    imageId?: GuAmiParameter;
+    /**
+     * If you are using GuCDK to generate your riff-raff.yaml file, specify AMIgo props here.
+     * If you are using a hardcoded riff-raff.yaml file (usually found in project root) then providing a value here has no
+     * effect.
+     */
+    imageRecipe?: string | AmigoProps;
+    instanceType: InstanceType;
+    userData: UserData;
+    /**
+     * How often to send EC2 metrics, such as CPU usage.
+     * By default, AWS will produce `5Minute` granular metrics.
+     *
+     * It is recommended to produce `1Minute` granular metrics in production,
+     * especially when using ASG metrics to trigger horizontal scaling as it allows for earlier scaling.
+     *
+     * @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html
+     */
+    instanceMetricGranularity: InstanceMetricGranularity;
+    additionalSecurityGroups?: ISecurityGroup[];
+    targetGroup?: ApplicationTargetGroup;
+    httpPutResponseHopLimit?: number;
+    defaultInstanceWarmup?: Duration;
+}
+declare const GuAutoScalingGroup_base: {
+    new (...args: any[]): {
+        readonly idWithApp: string;
+    };
+} & typeof AutoScalingGroup;
+/**
+ * Construct which creates an Auto Scaling group.
+ *
+ * By default, all EC2 instances in this group will use [[`GuInstanceRole`]],
+ * which provides common permissions (e.g. the ability to download an artifact and write logs to the account's logging Kinesis stream).
+ *
+ * If additional IAM permissions are required, a custom role can be provided via the `role` prop.
+ * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions
+ * to be passed in.
+ *
+ * All EC2 instances in this group will be automatically associated with the [[`GuHttpsEgressSecurityGroup`]] security groups,
+ * which allows outbound traffic over HTTPS.
+ *
+ * If additional ingress or egress rules are required, define custom security groups and pass them in via the
+ * `additionalSecurityGroups` prop.
+ *
+ * All EC2 instances provisioned via this construct will use
+ * [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html).
+ */
+export declare class GuAutoScalingGroup extends GuAutoScalingGroup_base {
+    readonly app: string;
+    readonly amiParameter: GuAmiParameter;
+    readonly imageRecipe?: string | AmigoProps;
+    readonly instanceLaunchTemplate: LaunchTemplate;
+    constructor(scope: GuStack, id: string, props: GuAutoScalingGroupProps);
+}
+export {};
+//# sourceMappingURL=asg.d.ts.map

package/lib/constructs/autoscaling/asg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asg.d.ts","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAgB,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAuB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAsB,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIpD,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,SAAS,CAAC;AAM9D,MAAM,WAAW,uBACf,SACE,IAAI,CACF,qBAAqB,EACnB,SAAS,GACT,QAAQ,GACR,cAAc,GACd,UAAU,GACV,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,eAAe,GACf,eAAe,CAClB,EACD,WAAW,EACX,aAAa;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IAEnB;;;;;;;;OAQG;IACH,yBAAyB,EAAE,yBAAyB,CAAC;IAErD,wBAAwB,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,QAAQ,CAAC;CAClC;;;;;;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,kBAAmB,SAAQ,uBAAqC;IAC3E,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,cAAc,CAAC;IAC7C,SAAgB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAGlD,SAAgB,sBAAsB,EAAE,cAAc,CAAC;gBAE3C,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAwGvE"}

package/lib/constructs/autoscaling/asg.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuAutoScalingGroup = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_autoscaling_1 = require("aws-cdk-lib/aws-autoscaling");
+const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
+const app_aware_construct_1 = require("../../utils/mixin/app-aware-construct");
+const core_1 = require("../core");
+const ec2_1 = require("../ec2");
+const iam_1 = require("../iam");
+/**
+ * Construct which creates an Auto Scaling group.
+ *
+ * By default, all EC2 instances in this group will use [[`GuInstanceRole`]],
+ * which provides common permissions (e.g. the ability to download an artifact and write logs to the account's logging Kinesis stream).
+ *
+ * If additional IAM permissions are required, a custom role can be provided via the `role` prop.
+ * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions
+ * to be passed in.
+ *
+ * All EC2 instances in this group will be automatically associated with the [[`GuHttpsEgressSecurityGroup`]] security groups,
+ * which allows outbound traffic over HTTPS.
+ *
+ * If additional ingress or egress rules are required, define custom security groups and pass them in via the
+ * `additionalSecurityGroups` prop.
+ *
+ * All EC2 instances provisioned via this construct will use
+ * [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html).
+ */
+class GuAutoScalingGroup extends (0, app_aware_construct_1.GuAppAwareConstruct)(aws_autoscaling_1.AutoScalingGroup) {
+    constructor(scope, id, props) {
+        const { app, additionalSecurityGroups = [], blockDevices, imageId = new core_1.GuAmiParameter(scope, { app }), imageRecipe, instanceType, groupMetrics = [aws_autoscaling_1.GroupMetrics.all()], minimumInstances, maximumInstances, role = new iam_1.GuInstanceRole(scope, { app }), targetGroup, userData, vpc, httpPutResponseHopLimit, updatePolicy, defaultInstanceWarmup, instanceMetricGranularity, } = props;
+        // Ensure min and max are defined in the same way. Throwing an `Error` when necessary. For example when min is defined via a Mapping, but max is not.
+        if (aws_cdk_lib_1.Token.isUnresolved(minimumInstances) && !aws_cdk_lib_1.Token.isUnresolved(maximumInstances)) {
+            throw new Error("minimumInstances is defined via a Mapping, but maximumInstances is not. Create maximumInstances via a Mapping too.");
+        }
+        const detailedMonitoring = instanceMetricGranularity === "1Minute";
+        // Generate an ID unique to this app
+        const launchTemplateId = `${scope.stack}-${scope.stage}-${app}`;
+        const launchTemplate = new aws_ec2_1.LaunchTemplate(scope, launchTemplateId, {
+            blockDevices,
+            detailedMonitoring,
+            instanceType,
+            machineImage: {
+                getImage: () => {
+                    return {
+                        osType: aws_ec2_1.OperatingSystemType.LINUX,
+                        userData,
+                        imageId: imageId.valueAsString,
+                    };
+                },
+            },
+            // Do not use the default AWS security group which allows egress on any port.
+            // Favour HTTPS only egress rules by default.
+            securityGroup: ec2_1.GuHttpsEgressSecurityGroup.forVpc(scope, { app, vpc }),
+            /*
+            Ensure we satisfy FSBP EC2.8 control. If needed, an escape hatch can override this.
+            See https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-8.
+             */
+            requireImdsv2: true,
+            instanceMetadataTags: true,
+            userData,
+            role,
+            httpPutResponseHopLimit,
+        });
+        // Add additional consumer specified Security Groups
+        // Note: Launch templates via CDK allow specifying only one SG, so use connections
+        // https://github.com/aws/aws-cdk/issues/18712
+        additionalSecurityGroups.forEach((sg) => launchTemplate.connections.addSecurityGroup(sg));
+        const asgProps = {
+            ...props,
+            launchTemplate,
+            maxCapacity: maximumInstances ?? minimumInstances * 2,
+            minCapacity: minimumInstances,
+            groupMetrics: groupMetrics,
+            // Omit userData, instanceType, blockDevices & role from asgProps
+            // As this are specified by the LaunchTemplate and must not be duplicated
+            blockDevices: undefined,
+            instanceType: undefined,
+            role: undefined,
+            userData: undefined,
+            defaultInstanceWarmup,
+        };
+        super(scope, id, asgProps);
+        this.app = app;
+        this.amiParameter = imageId;
+        this.imageRecipe = imageRecipe;
+        this.instanceLaunchTemplate = launchTemplate;
+        if (targetGroup) {
+            this.attachToApplicationTargetGroup(targetGroup);
+        }
+        const cfnAsg = this.node.defaultChild;
+        // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group
+        // leaves it to the default value, which is actually false.
+        // { UpdatePolicy: { autoScalingScheduledAction: { IgnoreUnmodifiedGroupSizeProperties: true }}
+        if (!updatePolicy) {
+            cfnAsg.addDeletionOverride("UpdatePolicy");
+        }
+        aws_cdk_lib_1.Tags.of(launchTemplate).add("App", app);
+    }
+}
+exports.GuAutoScalingGroup = GuAutoScalingGroup;
+//# sourceMappingURL=asg.js.map

package/lib/constructs/autoscaling/asg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asg.js","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":";;;AACA,6CAA0C;AAC1C,iEAA6E;AAE7E,iDAA0E;AAK1E,+EAA4E;AAC5E,kCAAyC;AAEzC,gCAAoD;AACpD,gCAAwC;AAyDxC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,kCAAgB,CAAC;IAQ3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,MAAM,EACJ,GAAG,EACH,wBAAwB,GAAG,EAAE,EAC7B,YAAY,EACZ,OAAO,GAAG,IAAI,qBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAC5C,WAAW,EACX,YAAY,EACZ,YAAY,GAAG,CAAC,8BAAY,CAAC,GAAG,EAAE,CAAC,EACnC,gBAAgB,EAChB,gBAAgB,EAChB,IAAI,GAAG,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EACzC,WAAW,EACX,QAAQ,EACR,GAAG,EACH,uBAAuB,EACvB,YAAY,EACZ,qBAAqB,EACrB,yBAAyB,GAC1B,GAAG,KAAK,CAAC;QAEV,qJAAqJ;QACrJ,IAAI,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,yBAAyB,KAAK,SAAS,CAAC;QAEnE,oCAAoC;QACpC,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,wBAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE;YACjE,YAAY;YACZ,kBAAkB;YAClB,YAAY;YACZ,YAAY,EAAE;gBACZ,QAAQ,EAAE,GAAuB,EAAE;oBACjC,OAAO;wBACL,MAAM,EAAE,6BAAmB,CAAC,KAAK;wBACjC,QAAQ;wBACR,OAAO,EAAE,OAAO,CAAC,aAAa;qBAC/B,CAAC;gBACJ,CAAC;aACF;YACD,6EAA6E;YAC7E,6CAA6C;YAC7C,aAAa,EAAE,gCAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YAErE;;;eAGG;YACH,aAAa,EAAE,IAAI;YAEnB,oBAAoB,EAAE,IAAI;YAC1B,QAAQ;YACR,IAAI;YACJ,uBAAuB;SACxB,CAAC,CAAC;QAEH,oDAAoD;QACpD,kFAAkF;QAClF,8CAA8C;QAC9C,wBAAwB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QAE1F,MAAM,QAAQ,GAA0B;YACtC,GAAG,KAAK;YACR,cAAc;YACd,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,GAAG,CAAC;YACrD,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,YAAY;YAE1B,iEAAiE;YACjE,yEAAyE;YACzE,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,SAAS;YACvB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,SAAS;YACnB,qBAAqB;SACtB,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,sBAAsB,GAAG,cAAc,CAAC;QAE7C,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAmC,CAAC;QAE7D,yFAAyF;QACzF,2DAA2D;QAC3D,+FAA+F;QAC/F,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;QAC7C,CAAC;QAED,kBAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;CACF;AAhHD,gDAgHC","sourcesContent":["import type { Duration } from \"aws-cdk-lib\";\nimport { Tags, Token } from \"aws-cdk-lib\";\nimport { AutoScalingGroup, GroupMetrics } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { AutoScalingGroupProps, CfnAutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport { LaunchTemplate, OperatingSystemType } from \"aws-cdk-lib/aws-ec2\";\nimport type { InstanceType, ISecurityGroup, MachineImageConfig, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { ApplicationTargetGroup } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuAsgCapacity } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport { GuAmiParameter } from \"../core\";\nimport type { AppIdentity, GuStack } from \"../core\";\nimport { GuHttpsEgressSecurityGroup } from \"../ec2\";\nimport { GuInstanceRole } from \"../iam\";\n\nexport type InstanceMetricGranularity = \"1Minute\" | \"5Minute\";\n\n// Since we want to override the types of what gets passed in for the below props,\n// we need to use Omit<T, U> to remove them from the interface this extends\n// https://www.typescriptlang.org/docs/handbook/utility-types.html#omittype-keys\n// TODO avoid prop nesting to improve discoverability. See https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#flat.\nexport interface GuAutoScalingGroupProps\n  extends\n    Omit<\n      AutoScalingGroupProps,\n      | \"imageId\"\n      | \"osType\"\n      | \"machineImage\"\n      | \"userData\"\n      | \"minCapacity\"\n      | \"maxCapacity\"\n      | \"desiredCapacity\"\n      | \"requireImdsv2\"\n      | \"securityGroup\"\n    >,\n    AppIdentity,\n    GuAsgCapacity {\n  /**\n   * @deprecated\n   * It shouldn't be necessary to specify a value here.\n   * GuCDK will create an AMI parameter by default. Riff-Raff can use this parameter to inject the latest AMI ID for\n   * your AMIgo recipe.\n   */\n  imageId?: GuAmiParameter;\n  /**\n   * If you are using GuCDK to generate your riff-raff.yaml file, specify AMIgo props here.\n   * If you are using a hardcoded riff-raff.yaml file (usually found in project root) then providing a value here has no\n   * effect.\n   */\n  imageRecipe?: string | AmigoProps;\n  instanceType: InstanceType;\n  userData: UserData;\n\n  /**\n   * How often to send EC2 metrics, such as CPU usage.\n   * By default, AWS will produce `5Minute` granular metrics.\n   *\n   * It is recommended to produce `1Minute` granular metrics in production,\n   * especially when using ASG metrics to trigger horizontal scaling as it allows for earlier scaling.\n   *\n   * @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html\n   */\n  instanceMetricGranularity: InstanceMetricGranularity;\n\n  additionalSecurityGroups?: ISecurityGroup[];\n  targetGroup?: ApplicationTargetGroup;\n  httpPutResponseHopLimit?: number;\n  defaultInstanceWarmup?: Duration;\n}\n\n/**\n * Construct which creates an Auto Scaling group.\n *\n * By default, all EC2 instances in this group will use [[`GuInstanceRole`]],\n * which provides common permissions (e.g. the ability to download an artifact and write logs to the account's logging Kinesis stream).\n *\n * If additional IAM permissions are required, a custom role can be provided via the `role` prop.\n * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions\n * to be passed in.\n *\n * All EC2 instances in this group will be automatically associated with the [[`GuHttpsEgressSecurityGroup`]] security groups,\n * which allows outbound traffic over HTTPS.\n *\n * If additional ingress or egress rules are required, define custom security groups and pass them in via the\n * `additionalSecurityGroups` prop.\n *\n * All EC2 instances provisioned via this construct will use\n * [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html).\n */\nexport class GuAutoScalingGroup extends GuAppAwareConstruct(AutoScalingGroup) {\n  public readonly app: string;\n  public readonly amiParameter: GuAmiParameter;\n  public readonly imageRecipe?: string | AmigoProps;\n\n  // Sadly this cannot be named `launchTemplate` as it would clash with a private property on the `AutoScalingGroup` class\n  public readonly instanceLaunchTemplate: LaunchTemplate;\n\n  constructor(scope: GuStack, id: string, props: GuAutoScalingGroupProps) {\n    const {\n      app,\n      additionalSecurityGroups = [],\n      blockDevices,\n      imageId = new GuAmiParameter(scope, { app }),\n      imageRecipe,\n      instanceType,\n      groupMetrics = [GroupMetrics.all()],\n      minimumInstances,\n      maximumInstances,\n      role = new GuInstanceRole(scope, { app }),\n      targetGroup,\n      userData,\n      vpc,\n      httpPutResponseHopLimit,\n      updatePolicy,\n      defaultInstanceWarmup,\n      instanceMetricGranularity,\n    } = props;\n\n    // Ensure min and max are defined in the same way. Throwing an `Error` when necessary. For example when min is defined via a Mapping, but max is not.\n    if (Token.isUnresolved(minimumInstances) && !Token.isUnresolved(maximumInstances)) {\n      throw new Error(\n        \"minimumInstances is defined via a Mapping, but maximumInstances is not. Create maximumInstances via a Mapping too.\",\n      );\n    }\n\n    const detailedMonitoring = instanceMetricGranularity === \"1Minute\";\n\n    // Generate an ID unique to this app\n    const launchTemplateId = `${scope.stack}-${scope.stage}-${app}`;\n    const launchTemplate = new LaunchTemplate(scope, launchTemplateId, {\n      blockDevices,\n      detailedMonitoring,\n      instanceType,\n      machineImage: {\n        getImage: (): MachineImageConfig => {\n          return {\n            osType: OperatingSystemType.LINUX,\n            userData,\n            imageId: imageId.valueAsString,\n          };\n        },\n      },\n      // Do not use the default AWS security group which allows egress on any port.\n      // Favour HTTPS only egress rules by default.\n      securityGroup: GuHttpsEgressSecurityGroup.forVpc(scope, { app, vpc }),\n\n      /*\n      Ensure we satisfy FSBP EC2.8 control. If needed, an escape hatch can override this.\n      See https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-8.\n       */\n      requireImdsv2: true,\n\n      instanceMetadataTags: true,\n      userData,\n      role,\n      httpPutResponseHopLimit,\n    });\n\n    // Add additional consumer specified Security Groups\n    // Note: Launch templates via CDK allow specifying only one SG, so use connections\n    // https://github.com/aws/aws-cdk/issues/18712\n    additionalSecurityGroups.forEach((sg) => launchTemplate.connections.addSecurityGroup(sg));\n\n    const asgProps: AutoScalingGroupProps = {\n      ...props,\n      launchTemplate,\n      maxCapacity: maximumInstances ?? minimumInstances * 2,\n      minCapacity: minimumInstances,\n      groupMetrics: groupMetrics,\n\n      // Omit userData, instanceType, blockDevices & role from asgProps\n      // As this are specified by the LaunchTemplate and must not be duplicated\n      blockDevices: undefined,\n      instanceType: undefined,\n      role: undefined,\n      userData: undefined,\n      defaultInstanceWarmup,\n    };\n\n    super(scope, id, asgProps);\n\n    this.app = app;\n    this.amiParameter = imageId;\n    this.imageRecipe = imageRecipe;\n    this.instanceLaunchTemplate = launchTemplate;\n\n    if (targetGroup) {\n      this.attachToApplicationTargetGroup(targetGroup);\n    }\n\n    const cfnAsg = this.node.defaultChild as CfnAutoScalingGroup;\n\n    // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group\n    // leaves it to the default value, which is actually false.\n    // { UpdatePolicy: { autoScalingScheduledAction: { IgnoreUnmodifiedGroupSizeProperties: true }}\n    if (!updatePolicy) {\n      cfnAsg.addDeletionOverride(\"UpdatePolicy\");\n    }\n\n    Tags.of(launchTemplate).add(\"App\", app);\n  }\n}\n"]}

package/lib/constructs/autoscaling/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./asg";
+export * from "./user-data";
+//# sourceMappingURL=index.d.ts.map

package/lib/constructs/autoscaling/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constructs/autoscaling/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,aAAa,CAAC"}

package/lib/constructs/autoscaling/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./asg"), exports);
+__exportStar(require("./user-data"), exports);
+//# sourceMappingURL=index.js.map

package/lib/constructs/autoscaling/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constructs/autoscaling/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wCAAsB;AACtB,8CAA4B","sourcesContent":["export * from \"./asg\";\nexport * from \"./user-data\";\n"]}

package/lib/constructs/autoscaling/user-data.d.ts

@@ -0,0 +1,28 @@
+import { UserData } from "aws-cdk-lib/aws-ec2";
+import type { S3DownloadOptions } from "aws-cdk-lib/aws-ec2";
+import type { GuDistributableForEc2 } from "../../types";
+import type { GuPrivateS3ConfigurationProps } from "../../utils/ec2";
+import type { AppIdentity, GuStack } from "../core";
+export type GuUserDataPropsWithApp = GuUserDataProps & AppIdentity;
+export interface GuUserDataProps {
+    distributable: GuDistributableForEc2;
+    configuration?: GuPrivateS3ConfigurationProps;
+}
+/**
+ * An abstraction over UserData to simplify its creation.
+ * Especially useful for simple user data where we:
+ *   - (optional) download config
+ *   - download distributable
+ *   - execute distributable
+ */
+export declare class GuUserData {
+    private readonly _userData;
+    readonly configuration?: GuPrivateS3ConfigurationProps;
+    get userData(): UserData;
+    private downloadDistributable;
+    private downloadConfiguration;
+    constructor(scope: GuStack, props: GuUserDataPropsWithApp);
+    addCommands(...commands: string[]): GuUserData;
+    addS3DownloadCommand(params: S3DownloadOptions): GuUserData;
+}
+//# sourceMappingURL=user-data.d.ts.map

package/lib/constructs/autoscaling/user-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-data.d.ts","sourceRoot":"","sources":["../../../src/constructs/autoscaling/user-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC;AAErE,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEpD,MAAM,MAAM,sBAAsB,GAAG,eAAe,GAAG,WAAW,CAAC;AACnE,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,qBAAqB,CAAC;IACrC,aAAa,CAAC,EAAE,6BAA6B,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAW;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,6BAA6B,CAAC;IAEvD,IAAI,QAAQ,IAAI,QAAQ,CAEvB;IAED,OAAO,CAAC,qBAAqB;IAc7B,OAAO,CAAC,qBAAqB;gBAqBjB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB;IAYzD,WAAW,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,UAAU;IAK9C,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,UAAU;CAI5D"}

package/lib/constructs/autoscaling/user-data.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuUserData = void 0;
+const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
+const aws_s3_1 = require("aws-cdk-lib/aws-s3");
+const types_1 = require("../../types");
+const core_1 = require("../core");
+/**
+ * An abstraction over UserData to simplify its creation.
+ * Especially useful for simple user data where we:
+ *   - (optional) download config
+ *   - download distributable
+ *   - execute distributable
+ */
+class GuUserData {
+    get userData() {
+        return this._userData;
+    }
+    downloadDistributable(scope, app, props) {
+        const bucketKey = types_1.GuDistributable.getObjectKey(scope, app, props);
+        const bucket = aws_s3_1.Bucket.fromBucketAttributes(scope, `DistributionBucket-${app.app}`, {
+            bucketName: core_1.GuDistributionBucketParameter.getInstance(scope).valueAsString,
+        });
+        this.addS3DownloadCommand({
+            bucket,
+            bucketKey,
+            localFile: `/${app.app}/${props.fileName}`,
+        });
+    }
+    downloadConfiguration(scope, app, props) {
+        const bucket = aws_s3_1.Bucket.fromBucketAttributes(scope, `${app}ConfigurationBucket`, {
+            bucketName: props.bucket.valueAsString,
+        });
+        props.files.forEach((bucketKey) => {
+            const fileName = bucketKey.split("/").slice(-1)[0];
+            // `fileName` is typed as `string | undefined`. Throw if `fileName` is falsy.
+            if (!fileName) {
+                throw new Error("Failed to create configuration section in UserData");
+            }
+            this.addS3DownloadCommand({
+                bucket,
+                bucketKey,
+                localFile: `/etc/${app}/${fileName}`,
+            });
+        });
+    }
+    constructor(scope, props) {
+        this._userData = aws_ec2_1.UserData.forLinux();
+        this.configuration = props.configuration;
+        if (props.configuration) {
+            this.downloadConfiguration(scope, props.app, props.configuration);
+        }
+        this.downloadDistributable(scope, props, props.distributable);
+        this.addCommands(props.distributable.executionStatement);
+    }
+    addCommands(...commands) {
+        this._userData.addCommands(...commands);
+        return this;
+    }
+    addS3DownloadCommand(params) {
+        this._userData.addS3DownloadCommand(params);
+        return this;
+    }
+}
+exports.GuUserData = GuUserData;
+//# sourceMappingURL=user-data.js.map

package/lib/constructs/autoscaling/user-data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-data.js","sourceRoot":"","sources":["../../../src/constructs/autoscaling/user-data.ts"],"names":[],"mappings":";;;AAAA,iDAA+C;AAE/C,+CAA4C;AAC5C,uCAA8C;AAG9C,kCAAwD;AASxD;;;;;;GAMG;AACH,MAAa,UAAU;IAIrB,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,qBAAqB,CAAC,KAAc,EAAE,GAAgB,EAAE,KAA4B;QAC1F,MAAM,SAAS,GAAG,uBAAe,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,eAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,sBAAsB,GAAG,CAAC,GAAG,EAAE,EAAE;YACjF,UAAU,EAAE,oCAA6B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa;SAC3E,CAAC,CAAC;QAEH,IAAI,CAAC,oBAAoB,CAAC;YACxB,MAAM;YACN,SAAS;YACT,SAAS,EAAE,IAAI,GAAG,CAAC,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IAEO,qBAAqB,CAAC,KAAc,EAAE,GAAW,EAAE,KAAoC;QAC7F,MAAM,MAAM,GAAG,eAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,GAAG,qBAAqB,EAAE;YAC7E,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;SACvC,CAAC,CAAC;QAEH,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;YAChC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAEnD,6EAA6E;YAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,CAAC,oBAAoB,CAAC;gBACxB,MAAM;gBACN,SAAS;gBACT,SAAS,EAAE,QAAQ,GAAG,IAAI,QAAQ,EAAE;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,YAAY,KAAc,EAAE,KAA6B;QACvD,IAAI,CAAC,SAAS,GAAG,kBAAQ,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAEzC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC;IAC3D,CAAC;IAED,WAAW,CAAC,GAAG,QAAkB;QAC/B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oBAAoB,CAAC,MAAyB;QAC5C,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAhED,gCAgEC","sourcesContent":["import { UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { S3DownloadOptions } from \"aws-cdk-lib/aws-ec2\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { GuDistributable } from \"../../types\";\nimport type { GuDistributableForEc2 } from \"../../types\";\nimport type { GuPrivateS3ConfigurationProps } from \"../../utils/ec2\";\nimport { GuDistributionBucketParameter } from \"../core\";\nimport type { AppIdentity, GuStack } from \"../core\";\n\nexport type GuUserDataPropsWithApp = GuUserDataProps & AppIdentity;\nexport interface GuUserDataProps {\n  distributable: GuDistributableForEc2;\n  configuration?: GuPrivateS3ConfigurationProps;\n}\n\n/**\n * An abstraction over UserData to simplify its creation.\n * Especially useful for simple user data where we:\n *   - (optional) download config\n *   - download distributable\n *   - execute distributable\n */\nexport class GuUserData {\n  private readonly _userData: UserData;\n  readonly configuration?: GuPrivateS3ConfigurationProps;\n\n  get userData(): UserData {\n    return this._userData;\n  }\n\n  private downloadDistributable(scope: GuStack, app: AppIdentity, props: GuDistributableForEc2) {\n    const bucketKey = GuDistributable.getObjectKey(scope, app, props);\n\n    const bucket = Bucket.fromBucketAttributes(scope, `DistributionBucket-${app.app}`, {\n      bucketName: GuDistributionBucketParameter.getInstance(scope).valueAsString,\n    });\n\n    this.addS3DownloadCommand({\n      bucket,\n      bucketKey,\n      localFile: `/${app.app}/${props.fileName}`,\n    });\n  }\n\n  private downloadConfiguration(scope: GuStack, app: string, props: GuPrivateS3ConfigurationProps) {\n    const bucket = Bucket.fromBucketAttributes(scope, `${app}ConfigurationBucket`, {\n      bucketName: props.bucket.valueAsString,\n    });\n\n    props.files.forEach((bucketKey) => {\n      const fileName = bucketKey.split(\"/\").slice(-1)[0];\n\n      // `fileName` is typed as `string | undefined`. Throw if `fileName` is falsy.\n      if (!fileName) {\n        throw new Error(\"Failed to create configuration section in UserData\");\n      }\n\n      this.addS3DownloadCommand({\n        bucket,\n        bucketKey,\n        localFile: `/etc/${app}/${fileName}`,\n      });\n    });\n  }\n\n  constructor(scope: GuStack, props: GuUserDataPropsWithApp) {\n    this._userData = UserData.forLinux();\n    this.configuration = props.configuration;\n\n    if (props.configuration) {\n      this.downloadConfiguration(scope, props.app, props.configuration);\n    }\n\n    this.downloadDistributable(scope, props, props.distributable);\n    this.addCommands(props.distributable.executionStatement);\n  }\n\n  addCommands(...commands: string[]): GuUserData {\n    this._userData.addCommands(...commands);\n    return this;\n  }\n\n  addS3DownloadCommand(params: S3DownloadOptions): GuUserData {\n    this._userData.addS3DownloadCommand(params);\n    return this;\n  }\n}\n"]}

package/lib/constructs/cloudwatch/alarm.d.ts

@@ -0,0 +1,35 @@
+import { Alarm } from "aws-cdk-lib/aws-cloudwatch";
+import type { AlarmProps } from "aws-cdk-lib/aws-cloudwatch";
+import type { AppIdentity, GuStack } from "../core";
+export interface GuAlarmProps extends AlarmProps, AppIdentity {
+    snsTopicName: string;
+    okAction?: boolean;
+}
+export interface Http4xxAlarmProps extends Omit<GuAlarmProps, "snsTopicName" | "evaluationPeriods" | "metric" | "period" | "threshold" | "treatMissingData" | "app"> {
+    tolerated4xxPercentage: number;
+    numberOfMinutesAboveThresholdBeforeAlarm?: number;
+}
+export interface Http5xxAlarmProps extends Omit<GuAlarmProps, "snsTopicName" | "evaluationPeriods" | "metric" | "period" | "threshold" | "treatMissingData" | "app"> {
+    tolerated5xxPercentage: number;
+    numberOfMinutesAboveThresholdBeforeAlarm?: number;
+}
+/**
+ * Creates a CloudWatch alarm which sends notifications to the specified SNS topic.
+ *
+ * Alarm actions are enabled by default.
+ *
+ * To enable the alarm only in PROD, use the value of `Stage`:
+ * ```typescript
+ * new GuAlarm(stack, "alarm", {
+ *   // other required props
+ *   actionsEnabled: this.stage === "PROD",
+ * });
+ * ```
+ *
+ * This library provides an implementation of some commonly used alarms, which require less boilerplate than this construct,
+ * for example the [[`GuAlb5xxPercentageAlarm`]]. Prefer using these more specific implementations where possible.
+ */
+export declare class GuAlarm extends Alarm {
+    constructor(scope: GuStack, id: string, props: GuAlarmProps);
+}
+//# sourceMappingURL=alarm.d.ts.map

package/lib/constructs/cloudwatch/alarm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alarm.d.ts","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/alarm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAI7D,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEpD,MAAM,WAAW,YAAa,SAAQ,UAAU,EAAE,WAAW;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,YAAY,EACZ,cAAc,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,kBAAkB,GAAG,KAAK,CACtG;IACC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wCAAwC,CAAC,EAAE,MAAM,CAAC;CACnD;AAED,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,YAAY,EACZ,cAAc,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,kBAAkB,GAAG,KAAK,CACtG;IACC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wCAAwC,CAAC,EAAE,MAAM,CAAC;CACnD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,OAAQ,SAAQ,KAAK;gBACpB,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;CAa5D"}

package/lib/constructs/cloudwatch/alarm.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuAlarm = void 0;
+const aws_cloudwatch_1 = require("aws-cdk-lib/aws-cloudwatch");
+const aws_cloudwatch_actions_1 = require("aws-cdk-lib/aws-cloudwatch-actions");
+const aws_sns_1 = require("aws-cdk-lib/aws-sns");
+/**
+ * Creates a CloudWatch alarm which sends notifications to the specified SNS topic.
+ *
+ * Alarm actions are enabled by default.
+ *
+ * To enable the alarm only in PROD, use the value of `Stage`:
+ * ```typescript
+ * new GuAlarm(stack, "alarm", {
+ *   // other required props
+ *   actionsEnabled: this.stage === "PROD",
+ * });
+ * ```
+ *
+ * This library provides an implementation of some commonly used alarms, which require less boilerplate than this construct,
+ * for example the [[`GuAlb5xxPercentageAlarm`]]. Prefer using these more specific implementations where possible.
+ */
+class GuAlarm extends aws_cloudwatch_1.Alarm {
+    constructor(scope, id, props) {
+        const { region, account } = scope;
+        const { snsTopicName, actionsEnabled = true, okAction } = props;
+        super(scope, id, { ...props, actionsEnabled });
+        const topicArn = `arn:aws:sns:${region}:${account}:${snsTopicName}`;
+        const snsTopic = aws_sns_1.Topic.fromTopicArn(scope, `SnsTopicFor${id}`, topicArn);
+        this.addAlarmAction(new aws_cloudwatch_actions_1.SnsAction(snsTopic));
+        if (okAction) {
+            this.addOkAction(new aws_cloudwatch_actions_1.SnsAction(snsTopic));
+        }
+    }
+}
+exports.GuAlarm = GuAlarm;
+//# sourceMappingURL=alarm.js.map

package/lib/constructs/cloudwatch/alarm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alarm.js","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/alarm.ts"],"names":[],"mappings":";;;AAAA,+DAAmD;AAEnD,+EAA+D;AAC/D,iDAA4C;AAyB5C;;;;;;;;;;;;;;;GAeG;AACH,MAAa,OAAQ,SAAQ,sBAAK;IAChC,YAAY,KAAc,EAAE,EAAU,EAAE,KAAmB;QACzD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAClC,MAAM,EAAE,YAAY,EAAE,cAAc,GAAG,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAEhE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAW,eAAe,MAAM,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;QAC5E,MAAM,QAAQ,GAAW,eAAK,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjF,IAAI,CAAC,cAAc,CAAC,IAAI,kCAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,IAAI,kCAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;CACF;AAdD,0BAcC","sourcesContent":["import { Alarm } from \"aws-cdk-lib/aws-cloudwatch\";\nimport type { AlarmProps } from \"aws-cdk-lib/aws-cloudwatch\";\nimport { SnsAction } from \"aws-cdk-lib/aws-cloudwatch-actions\";\nimport { Topic } from \"aws-cdk-lib/aws-sns\";\nimport type { ITopic } from \"aws-cdk-lib/aws-sns\";\nimport type { AppIdentity, GuStack } from \"../core\";\n\nexport interface GuAlarmProps extends AlarmProps, AppIdentity {\n  snsTopicName: string;\n  okAction?: boolean;\n}\n\nexport interface Http4xxAlarmProps extends Omit<\n  GuAlarmProps,\n  \"snsTopicName\" | \"evaluationPeriods\" | \"metric\" | \"period\" | \"threshold\" | \"treatMissingData\" | \"app\"\n> {\n  tolerated4xxPercentage: number;\n  numberOfMinutesAboveThresholdBeforeAlarm?: number;\n}\n\nexport interface Http5xxAlarmProps extends Omit<\n  GuAlarmProps,\n  \"snsTopicName\" | \"evaluationPeriods\" | \"metric\" | \"period\" | \"threshold\" | \"treatMissingData\" | \"app\"\n> {\n  tolerated5xxPercentage: number;\n  numberOfMinutesAboveThresholdBeforeAlarm?: number;\n}\n\n/**\n * Creates a CloudWatch alarm which sends notifications to the specified SNS topic.\n *\n * Alarm actions are enabled by default.\n *\n * To enable the alarm only in PROD, use the value of `Stage`:\n * ```typescript\n * new GuAlarm(stack, \"alarm\", {\n *   // other required props\n *   actionsEnabled: this.stage === \"PROD\",\n * });\n * ```\n *\n * This library provides an implementation of some commonly used alarms, which require less boilerplate than this construct,\n * for example the [[`GuAlb5xxPercentageAlarm`]]. Prefer using these more specific implementations where possible.\n */\nexport class GuAlarm extends Alarm {\n  constructor(scope: GuStack, id: string, props: GuAlarmProps) {\n    const { region, account } = scope;\n    const { snsTopicName, actionsEnabled = true, okAction } = props;\n\n    super(scope, id, { ...props, actionsEnabled });\n\n    const topicArn: string = `arn:aws:sns:${region}:${account}:${snsTopicName}`;\n    const snsTopic: ITopic = Topic.fromTopicArn(scope, `SnsTopicFor${id}`, topicArn);\n    this.addAlarmAction(new SnsAction(snsTopic));\n    if (okAction) {\n      this.addOkAction(new SnsAction(snsTopic));\n    }\n  }\n}\n"]}

package/lib/constructs/cloudwatch/api-gateway-alarms.d.ts

@@ -0,0 +1,17 @@
+import type { RestApi } from "aws-cdk-lib/aws-apigateway";
+import type { GuStack } from "../core";
+import { AppIdentity } from "../core";
+import type { GuAlarmProps, Http5xxAlarmProps } from "./alarm";
+import { GuAlarm } from "./alarm";
+interface GuApiGateway5xxPercentageAlarmProps extends Pick<GuAlarmProps, "snsTopicName">, Http5xxAlarmProps, AppIdentity {
+    apiGatewayInstance: RestApi;
+}
+/**
+ * Creates an alarm which is triggered whenever the percentage of requests with a 5xx response code exceeds
+ * the specified threshold.
+ */
+export declare class GuApiGateway5xxPercentageAlarm extends GuAlarm {
+    constructor(scope: GuStack, props: GuApiGateway5xxPercentageAlarmProps);
+}
+export {};
+//# sourceMappingURL=api-gateway-alarms.d.ts.map

package/lib/constructs/cloudwatch/api-gateway-alarms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-gateway-alarms.d.ts","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/api-gateway-alarms.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,UAAU,mCACR,SAAQ,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,iBAAiB,EAAE,WAAW;IAC1E,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,OAAO;gBAC7C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,mCAAmC;CAwBvE"}

package/lib/constructs/cloudwatch/api-gateway-alarms.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuApiGateway5xxPercentageAlarm = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_cloudwatch_1 = require("aws-cdk-lib/aws-cloudwatch");
+const core_1 = require("../core");
+const alarm_1 = require("./alarm");
+/**
+ * Creates an alarm which is triggered whenever the percentage of requests with a 5xx response code exceeds
+ * the specified threshold.
+ */
+class GuApiGateway5xxPercentageAlarm extends alarm_1.GuAlarm {
+    constructor(scope, props) {
+        const mathExpression = new aws_cloudwatch_1.MathExpression({
+            expression: "100*m1/m2",
+            usingMetrics: {
+                m1: props.apiGatewayInstance.metricServerError(),
+                m2: props.apiGatewayInstance.metricCount(),
+            },
+            label: `% of 5XX responses served for ${props.app}`,
+            period: aws_cdk_lib_1.Duration.minutes(1),
+        });
+        const defaultAlarmName = `High 5XX error percentage from ${props.app} (ApiGateway) in ${scope.stage}`;
+        const defaultDescription = `${props.app} exceeded ${props.tolerated5xxPercentage}% error rate`;
+        const alarmProps = {
+            ...props,
+            metric: mathExpression,
+            treatMissingData: aws_cloudwatch_1.TreatMissingData.NOT_BREACHING,
+            threshold: props.tolerated5xxPercentage,
+            comparisonOperator: aws_cloudwatch_1.ComparisonOperator.GREATER_THAN_THRESHOLD,
+            alarmName: props.alarmName ?? defaultAlarmName,
+            alarmDescription: props.alarmDescription ?? defaultDescription,
+            evaluationPeriods: props.numberOfMinutesAboveThresholdBeforeAlarm ?? 1,
+        };
+        super(scope, core_1.AppIdentity.suffixText(props, "ApiGatewayHigh5xxPercentageAlarm"), alarmProps);
+    }
+}
+exports.GuApiGateway5xxPercentageAlarm = GuApiGateway5xxPercentageAlarm;
+//# sourceMappingURL=api-gateway-alarms.js.map

package/lib/constructs/cloudwatch/api-gateway-alarms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-gateway-alarms.js","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/api-gateway-alarms.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AAEvC,+DAAkG;AAElG,kCAAsC;AAEtC,mCAAkC;AAOlC;;;GAGG;AACH,MAAa,8BAA+B,SAAQ,eAAO;IACzD,YAAY,KAAc,EAAE,KAA0C;QACpE,MAAM,cAAc,GAAG,IAAI,+BAAc,CAAC;YACxC,UAAU,EAAE,WAAW;YACvB,YAAY,EAAE;gBACZ,EAAE,EAAE,KAAK,CAAC,kBAAkB,CAAC,iBAAiB,EAAE;gBAChD,EAAE,EAAE,KAAK,CAAC,kBAAkB,CAAC,WAAW,EAAE;aAC3C;YACD,KAAK,EAAE,iCAAiC,KAAK,CAAC,GAAG,EAAE;YACnD,MAAM,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;SAC5B,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,kCAAkC,KAAK,CAAC,GAAG,oBAAoB,KAAK,CAAC,KAAK,EAAE,CAAC;QACtG,MAAM,kBAAkB,GAAG,GAAG,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,sBAAsB,cAAc,CAAC;QAC/F,MAAM,UAAU,GAAG;YACjB,GAAG,KAAK;YACR,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,SAAS,EAAE,KAAK,CAAC,sBAAsB;YACvC,kBAAkB,EAAE,mCAAkB,CAAC,sBAAsB;YAC7D,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB;YAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,kBAAkB;YAC9D,iBAAiB,EAAE,KAAK,CAAC,wCAAwC,IAAI,CAAC;SACvE,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,kCAAkC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC9F,CAAC;CACF;AAzBD,wEAyBC","sourcesContent":["import { Duration } from \"aws-cdk-lib\";\nimport type { RestApi } from \"aws-cdk-lib/aws-apigateway\";\nimport { ComparisonOperator, MathExpression, TreatMissingData } from \"aws-cdk-lib/aws-cloudwatch\";\nimport type { GuStack } from \"../core\";\nimport { AppIdentity } from \"../core\";\nimport type { GuAlarmProps, Http5xxAlarmProps } from \"./alarm\";\nimport { GuAlarm } from \"./alarm\";\n\ninterface GuApiGateway5xxPercentageAlarmProps\n  extends Pick<GuAlarmProps, \"snsTopicName\">, Http5xxAlarmProps, AppIdentity {\n  apiGatewayInstance: RestApi;\n}\n\n/**\n * Creates an alarm which is triggered whenever the percentage of requests with a 5xx response code exceeds\n * the specified threshold.\n */\nexport class GuApiGateway5xxPercentageAlarm extends GuAlarm {\n  constructor(scope: GuStack, props: GuApiGateway5xxPercentageAlarmProps) {\n    const mathExpression = new MathExpression({\n      expression: \"100*m1/m2\",\n      usingMetrics: {\n        m1: props.apiGatewayInstance.metricServerError(),\n        m2: props.apiGatewayInstance.metricCount(),\n      },\n      label: `% of 5XX responses served for ${props.app}`,\n      period: Duration.minutes(1),\n    });\n    const defaultAlarmName = `High 5XX error percentage from ${props.app} (ApiGateway) in ${scope.stage}`;\n    const defaultDescription = `${props.app} exceeded ${props.tolerated5xxPercentage}% error rate`;\n    const alarmProps = {\n      ...props,\n      metric: mathExpression,\n      treatMissingData: TreatMissingData.NOT_BREACHING,\n      threshold: props.tolerated5xxPercentage,\n      comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,\n      alarmName: props.alarmName ?? defaultAlarmName,\n      alarmDescription: props.alarmDescription ?? defaultDescription,\n      evaluationPeriods: props.numberOfMinutesAboveThresholdBeforeAlarm ?? 1,\n    };\n    super(scope, AppIdentity.suffixText(props, \"ApiGatewayHigh5xxPercentageAlarm\"), alarmProps);\n  }\n}\n"]}