@guardian/cdk 48.0.1 → 48.2.0-beta.1

package/lib/aspects/cfn-include-reporter.d.ts

@@ -0,0 +1,9 @@
+import type { IAspect } from "aws-cdk-lib";
+import type { IConstruct } from "constructs";
+/**
+ * An Aspect to remind users to check for stateful resources when migrating a YAML/JSON template.
+ */
+export declare class CfnIncludeReporter implements IAspect {
+    visit(node: IConstruct): void;
+}
+//# sourceMappingURL=cfn-include-reporter.d.ts.map

package/lib/aspects/cfn-include-reporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cfn-include-reporter.d.ts","sourceRoot":"","sources":["../../src/aspects/cfn-include-reporter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C;;GAEG;AACH,qBAAa,kBAAmB,YAAW,OAAO;IACzC,KAAK,CAAC,IAAI,EAAE,UAAU;CAO9B"}

package/lib/aspects/cfn-include-reporter.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CfnIncludeReporter = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const cloudformation_include_1 = require("aws-cdk-lib/cloudformation-include");
+const constants_1 = require("../constants");
+/**
+ * An Aspect to remind users to check for stateful resources when migrating a YAML/JSON template.
+ */
+class CfnIncludeReporter {
+    visit(node) {
+        if (node instanceof cloudformation_include_1.CfnInclude) {
+            aws_cdk_lib_1.Annotations.of(node).addWarning(`As you're migrating a YAML/JSON template to ${constants_1.LibraryInfo.NAME}, be sure to check for any stateful resources! See https://github.com/guardian/cdk/blob/main/docs/stateful-resources.md.`);
+        }
+    }
+}
+exports.CfnIncludeReporter = CfnIncludeReporter;
+//# sourceMappingURL=cfn-include-reporter.js.map

package/lib/aspects/cfn-include-reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cfn-include-reporter.js","sourceRoot":"","sources":["../../src/aspects/cfn-include-reporter.ts"],"names":[],"mappings":";;;AACA,6CAA0C;AAC1C,+EAAgE;AAEhE,4CAA2C;AAE3C;;GAEG;AACH,MAAa,kBAAkB;IACtB,KAAK,CAAC,IAAgB;QAC3B,IAAI,IAAI,YAAY,mCAAU,EAAE;YAC9B,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAC7B,+CAA+C,uBAAW,CAAC,IAAI,0HAA0H,CAC1L,CAAC;SACH;IACH,CAAC;CACF;AARD,gDAQC","sourcesContent":["import type { IAspect } from \"aws-cdk-lib\";\nimport { Annotations } from \"aws-cdk-lib\";\nimport { CfnInclude } from \"aws-cdk-lib/cloudformation-include\";\nimport type { IConstruct } from \"constructs\";\nimport { LibraryInfo } from \"../constants\";\n\n/**\n * An Aspect to remind users to check for stateful resources when migrating a YAML/JSON template.\n */\nexport class CfnIncludeReporter implements IAspect {\n  public visit(node: IConstruct) {\n    if (node instanceof CfnInclude) {\n      Annotations.of(node).addWarning(\n        `As you're migrating a YAML/JSON template to ${LibraryInfo.NAME}, be sure to check for any stateful resources! See https://github.com/guardian/cdk/blob/main/docs/stateful-resources.md.`\n      );\n    }\n  }\n}\n"]}

package/lib/bin/commands/new-project/utils/init.js

@@ -99,6 +99,7 @@ function createPackageJson(outputDirectory) {
         scripts: {
             build: "tsc",
             test: "jest",
+            "test-update": "jest -u",
             format: 'prettier --write "{lib,bin}/**/*.ts"',
             lint: "eslint lib/** bin/** --ext .ts --no-error-on-unmatched-pattern",
             synth: "cdk synth --path-metadata false --version-reporting false",

package/lib/bin/commands/new-project/utils/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../../../src/bin/commands/new-project/utils/init.ts"],"names":[],"mappings":";;;AAAA,2BAAgG;AAChG,+BAA4B;AAC5B,qDAAsE;AAMtE,8BAA8B;AAC9B,MAAa,cAAc;IAWzB,YAAY,MAAkB;QAV9B,gBAAW,GAAG,GAAG,SAAS,cAAc,CAAC;QAWvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,cAAc;QACZ,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE3C,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACjD,IAAA,cAAS,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;SAClC;QAED,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEzC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,8DAA8D;QAC9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAExD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAED,SAAS,CAAC,UAAkB,EAAE,UAAkB;QAC9C,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAW,EAAC,UAAU,CAAC,EAAE;YAC1C,MAAM,IAAI,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAEpC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;gBAC5B,SAAS;aACV;iBAAM,IAAI,IAAA,cAAS,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;gBACxC,MAAM,gBAAgB,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAChD,IAAI,CAAC,IAAA,eAAU,EAAC,gBAAgB,CAAC,EAAE;oBACjC,IAAA,cAAS,EAAC,gBAAgB,CAAC,CAAC;iBAC7B;gBACD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;aACxC;iBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;gBACrC,IAAA,iBAAY,EAAC,IAAI,EAAE,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;aACrE;iBAAM;gBACL,IAAA,iBAAY,EAAC,IAAI,EAAE,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;aAC5C;SACF;IACH,CAAC;;AAnDH,wCAoDC;AAhDQ,6BAAc,GAAG,CAAC,MAAkB,EAAQ,EAAE;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;IAC9B,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,IAAI,IAAA,gBAAW,EAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;QACpD,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,eAAe,CAAC,CAAC;KACnD;AACH,CAAC,CAAC;AA6CG,MAAM,cAAc,GAAG,CAAC,MAAkB,EAAQ,EAAE;IACzD,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,CAAC,cAAc,EAAE,CAAC;AAC3B,CAAC,CAAC;AAHW,QAAA,cAAc,kBAGzB;AAEF,SAAS,iBAAiB,CAAC,eAAuB;IAChD,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAG,QAAQ,EAAE,WAAW,EAAE,KAAK,MAAM,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;IAElF,MAAM,QAAQ,GAA2B;QACvC,oCAAoC;QACpC,aAAa;QACb,aAAa;QACb,QAAQ;QACR,MAAM;QACN,UAAU;QACV,SAAS;QACT,SAAS;QACT,YAAY;QACZ,kIAAkI;KACnI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAEpF,MAAM,OAAO,GAA2B;QACtC;;;;;aAKK;QACL,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,eAAe,EAAE,uBAAW,CAAC,OAAO,EAAE,CAAC;QAExD,SAAS,EAAE,uBAAW,CAAC,eAAe;QACtC,aAAa,EAAE,uBAAW,CAAC,eAAe;QAC1C,UAAU,EAAE,uBAAW,CAAC,kBAAkB;KAC3C,CAAC;IAEF,MAAM,UAAU,GAAG;QACjB,oBAAoB,EAAE,SAAS;QAC/B,oBAAoB,EAAE,OAAO;KAC9B,CAAC;IAEF,MAAM,OAAO,GAA2B,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC;IAEnF,MAAM,eAAe,GAA2B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;SACjE,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,sCAAsC;YAC9C,IAAI,EAAE,gEAAgE;YACtE,KAAK,EAAE,2DAA2D;YAClE,IAAI,EAAE,0DAA0D;SACjE;QACD,eAAe;QAEf,QAAQ,EAAE,oBAAoB;QAE9B,IAAI,EAAE;YACJ,SAAS,EAAE,CAAC,4BAA4B,CAAC;YACzC,SAAS,EAAE;gBACT,aAAa,EAAE,SAAS;aACzB;YACD,kBAAkB,EAAE,CAAC,iBAAiB,CAAC;SACxC;QAED,YAAY,EAAE;YACZ,IAAI,EAAE,IAAI;YACV,GAAG,EAAE;gBACH,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,IAAI;aACX;YACD,OAAO,EAAE,CAAC,oCAAoC,CAAC;YAC/C,aAAa,EAAE;gBACb,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,QAAQ;aACrB;YACD,OAAO,EAAE,CAAC,oBAAoB,CAAC;YAC/B,KAAK,EAAE;gBACL,wCAAwC,EAAE,CAAC;gBAC3C,qBAAqB,EAAE,CAAC;aACzB;YACD,cAAc,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,CAAC;SACzF;KACF,CAAC;IACF,IAAA,kBAAa,EAAC,GAAG,eAAe,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC","sourcesContent":["import { copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, writeFileSync } from \"fs\";\nimport { join } from \"path\";\nimport { getDevDependency, LibraryInfo } from \"../../../../constants\";\n\nexport interface InitConfig {\n  outputDir: string;\n}\n\n// TODO: Add project name flag\nexport class ProjectBuilder {\n  templateDir = `${__dirname}/../template`;\n  config: InitConfig;\n\n  static validateConfig = (config: InitConfig): void => {\n    const path = config.outputDir;\n    if (existsSync(path) && readdirSync(path).length > 0) {\n      throw new Error(`Directory ${path} is not empty`);\n    }\n  };\n\n  constructor(config: InitConfig) {\n    this.config = config;\n  }\n\n  buildDirectory(): void {\n    ProjectBuilder.validateConfig(this.config);\n\n    if (!existsSync(this.config.outputDir)) {\n      console.log(`Creating ${this.config.outputDir}`);\n      mkdirSync(this.config.outputDir);\n    }\n\n    console.log(\"Creating package.json\");\n    createPackageJson(this.config.outputDir);\n\n    console.log(\"Copying template files\");\n    // TODO: Replace any params in files with .template extensions\n    this.copyFiles(this.templateDir, this.config.outputDir);\n\n    console.log(\"Success!\");\n  }\n\n  copyFiles(sourcePath: string, targetPath: string): void {\n    for (const file of readdirSync(sourcePath)) {\n      const path = join(sourcePath, file);\n\n      if (path.endsWith(\".ignore\")) {\n        continue;\n      } else if (lstatSync(path).isDirectory()) {\n        const nestedTargetPath = join(targetPath, file);\n        if (!existsSync(nestedTargetPath)) {\n          mkdirSync(nestedTargetPath);\n        }\n        this.copyFiles(path, nestedTargetPath);\n      } else if (path.endsWith(\".template\")) {\n        copyFileSync(path, join(targetPath, file.replace(\".template\", \"\")));\n      } else {\n        copyFileSync(path, join(targetPath, file));\n      }\n    }\n  }\n}\n\nexport const buildDirectory = (config: InitConfig): void => {\n  const builder = new ProjectBuilder(config);\n  builder.buildDirectory();\n};\n\nfunction createPackageJson(outputDirectory: string): void {\n  const { NODE_ENV, CI } = process.env;\n  const isTest = NODE_ENV?.toUpperCase() === \"TEST\" || CI?.toUpperCase() === \"TRUE\";\n\n  const coreDeps: Record<string, string> = [\n    \"@guardian/eslint-config-typescript\",\n    \"@types/jest\",\n    \"@types/node\",\n    \"eslint\",\n    \"jest\",\n    \"prettier\",\n    \"ts-jest\",\n    \"ts-node\",\n    \"typescript\",\n    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- deps come from `package.json`, so shouldn't be `undefined`\n  ].reduce((acc, depName) => ({ ...acc, [depName]: getDevDependency(depName)! }), {});\n\n  const cdkDeps: Record<string, string> = {\n    /*\n      Do not add `@guardian/cdk` to the generated `package.json` file when in TEST as we'll `npm link` it instead.\n      See https://docs.npmjs.com/cli/v8/commands/npm-link#caveat\n\n      TODO remove this once the `new` command allows opting out of automatic dependency installation\n       */\n    ...(!isTest && { \"@guardian/cdk\": LibraryInfo.VERSION }),\n\n    \"aws-cdk\": LibraryInfo.AWS_CDK_VERSION,\n    \"aws-cdk-lib\": LibraryInfo.AWS_CDK_VERSION,\n    constructs: LibraryInfo.CONSTRUCTS_VERSION,\n  };\n\n  const customDeps = {\n    \"source-map-support\": \"^0.5.20\",\n    \"@guardian/prettier\": \"1.0.0\",\n  };\n\n  const allDeps: Record<string, string> = { ...coreDeps, ...cdkDeps, ...customDeps };\n\n  const devDependencies: Record<string, string> = Object.keys(allDeps)\n    .sort()\n    .reduce((acc, depName) => ({ ...acc, [depName]: allDeps[depName] }), {});\n\n  const contents = {\n    name: \"cdk\",\n    version: \"0.0.0\",\n    private: true,\n    scripts: {\n      build: \"tsc\",\n      test: \"jest\",\n      format: 'prettier --write \"{lib,bin}/**/*.ts\"',\n      lint: \"eslint lib/** bin/** --ext .ts --no-error-on-unmatched-pattern\",\n      synth: \"cdk synth --path-metadata false --version-reporting false\",\n      diff: \"cdk diff --path-metadata false --version-reporting false\",\n    },\n    devDependencies,\n\n    prettier: \"@guardian/prettier\",\n\n    jest: {\n      testMatch: [\"<rootDir>/lib/**/*.test.ts\"],\n      transform: {\n        \"^.+\\\\.tsx?$\": \"ts-jest\",\n      },\n      setupFilesAfterEnv: [\"./jest.setup.js\"],\n    },\n\n    eslintConfig: {\n      root: true,\n      env: {\n        node: true,\n        jest: true,\n      },\n      extends: [\"@guardian/eslint-config-typescript\"],\n      parserOptions: {\n        ecmaVersion: 2020,\n        sourceType: \"module\",\n      },\n      plugins: [\"@typescript-eslint\"],\n      rules: {\n        \"@typescript-eslint/no-inferrable-types\": 0,\n        \"import/no-namespace\": 2,\n      },\n      ignorePatterns: [\"**/*.js\", \"node_modules\", \"cdk.out\", \".eslintrc.js\", \"jest.config.js\"],\n    },\n  };\n  writeFileSync(`${outputDirectory}/package.json`, JSON.stringify(contents, null, 2));\n}\n"]}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../../../src/bin/commands/new-project/utils/init.ts"],"names":[],"mappings":";;;AAAA,2BAAgG;AAChG,+BAA4B;AAC5B,qDAAsE;AAMtE,8BAA8B;AAC9B,MAAa,cAAc;IAWzB,YAAY,MAAkB;QAV9B,gBAAW,GAAG,GAAG,SAAS,cAAc,CAAC;QAWvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,cAAc;QACZ,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE3C,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACjD,IAAA,cAAS,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;SAClC;QAED,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEzC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,8DAA8D;QAC9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAExD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAED,SAAS,CAAC,UAAkB,EAAE,UAAkB;QAC9C,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAW,EAAC,UAAU,CAAC,EAAE;YAC1C,MAAM,IAAI,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAEpC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;gBAC5B,SAAS;aACV;iBAAM,IAAI,IAAA,cAAS,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;gBACxC,MAAM,gBAAgB,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAChD,IAAI,CAAC,IAAA,eAAU,EAAC,gBAAgB,CAAC,EAAE;oBACjC,IAAA,cAAS,EAAC,gBAAgB,CAAC,CAAC;iBAC7B;gBACD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;aACxC;iBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;gBACrC,IAAA,iBAAY,EAAC,IAAI,EAAE,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;aACrE;iBAAM;gBACL,IAAA,iBAAY,EAAC,IAAI,EAAE,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;aAC5C;SACF;IACH,CAAC;;AAnDH,wCAoDC;AAhDQ,6BAAc,GAAG,CAAC,MAAkB,EAAQ,EAAE;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;IAC9B,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,IAAI,IAAA,gBAAW,EAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;QACpD,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,eAAe,CAAC,CAAC;KACnD;AACH,CAAC,CAAC;AA6CG,MAAM,cAAc,GAAG,CAAC,MAAkB,EAAQ,EAAE;IACzD,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,CAAC,cAAc,EAAE,CAAC;AAC3B,CAAC,CAAC;AAHW,QAAA,cAAc,kBAGzB;AAEF,SAAS,iBAAiB,CAAC,eAAuB;IAChD,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAG,QAAQ,EAAE,WAAW,EAAE,KAAK,MAAM,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;IAElF,MAAM,QAAQ,GAA2B;QACvC,oCAAoC;QACpC,aAAa;QACb,aAAa;QACb,QAAQ;QACR,MAAM;QACN,UAAU;QACV,SAAS;QACT,SAAS;QACT,YAAY;QACZ,kIAAkI;KACnI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAEpF,MAAM,OAAO,GAA2B;QACtC;;;;;aAKK;QACL,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,eAAe,EAAE,uBAAW,CAAC,OAAO,EAAE,CAAC;QAExD,SAAS,EAAE,uBAAW,CAAC,eAAe;QACtC,aAAa,EAAE,uBAAW,CAAC,eAAe;QAC1C,UAAU,EAAE,uBAAW,CAAC,kBAAkB;KAC3C,CAAC;IAEF,MAAM,UAAU,GAAG;QACjB,oBAAoB,EAAE,SAAS;QAC/B,oBAAoB,EAAE,OAAO;KAC9B,CAAC;IAEF,MAAM,OAAO,GAA2B,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC;IAEnF,MAAM,eAAe,GAA2B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;SACjE,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,MAAM;YACZ,aAAa,EAAE,SAAS;YACxB,MAAM,EAAE,sCAAsC;YAC9C,IAAI,EAAE,gEAAgE;YACtE,KAAK,EAAE,2DAA2D;YAClE,IAAI,EAAE,0DAA0D;SACjE;QACD,eAAe;QAEf,QAAQ,EAAE,oBAAoB;QAE9B,IAAI,EAAE;YACJ,SAAS,EAAE,CAAC,4BAA4B,CAAC;YACzC,SAAS,EAAE;gBACT,aAAa,EAAE,SAAS;aACzB;YACD,kBAAkB,EAAE,CAAC,iBAAiB,CAAC;SACxC;QAED,YAAY,EAAE;YACZ,IAAI,EAAE,IAAI;YACV,GAAG,EAAE;gBACH,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,IAAI;aACX;YACD,OAAO,EAAE,CAAC,oCAAoC,CAAC;YAC/C,aAAa,EAAE;gBACb,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,QAAQ;aACrB;YACD,OAAO,EAAE,CAAC,oBAAoB,CAAC;YAC/B,KAAK,EAAE;gBACL,wCAAwC,EAAE,CAAC;gBAC3C,qBAAqB,EAAE,CAAC;aACzB;YACD,cAAc,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,CAAC;SACzF;KACF,CAAC;IACF,IAAA,kBAAa,EAAC,GAAG,eAAe,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC","sourcesContent":["import { copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, writeFileSync } from \"fs\";\nimport { join } from \"path\";\nimport { getDevDependency, LibraryInfo } from \"../../../../constants\";\n\nexport interface InitConfig {\n  outputDir: string;\n}\n\n// TODO: Add project name flag\nexport class ProjectBuilder {\n  templateDir = `${__dirname}/../template`;\n  config: InitConfig;\n\n  static validateConfig = (config: InitConfig): void => {\n    const path = config.outputDir;\n    if (existsSync(path) && readdirSync(path).length > 0) {\n      throw new Error(`Directory ${path} is not empty`);\n    }\n  };\n\n  constructor(config: InitConfig) {\n    this.config = config;\n  }\n\n  buildDirectory(): void {\n    ProjectBuilder.validateConfig(this.config);\n\n    if (!existsSync(this.config.outputDir)) {\n      console.log(`Creating ${this.config.outputDir}`);\n      mkdirSync(this.config.outputDir);\n    }\n\n    console.log(\"Creating package.json\");\n    createPackageJson(this.config.outputDir);\n\n    console.log(\"Copying template files\");\n    // TODO: Replace any params in files with .template extensions\n    this.copyFiles(this.templateDir, this.config.outputDir);\n\n    console.log(\"Success!\");\n  }\n\n  copyFiles(sourcePath: string, targetPath: string): void {\n    for (const file of readdirSync(sourcePath)) {\n      const path = join(sourcePath, file);\n\n      if (path.endsWith(\".ignore\")) {\n        continue;\n      } else if (lstatSync(path).isDirectory()) {\n        const nestedTargetPath = join(targetPath, file);\n        if (!existsSync(nestedTargetPath)) {\n          mkdirSync(nestedTargetPath);\n        }\n        this.copyFiles(path, nestedTargetPath);\n      } else if (path.endsWith(\".template\")) {\n        copyFileSync(path, join(targetPath, file.replace(\".template\", \"\")));\n      } else {\n        copyFileSync(path, join(targetPath, file));\n      }\n    }\n  }\n}\n\nexport const buildDirectory = (config: InitConfig): void => {\n  const builder = new ProjectBuilder(config);\n  builder.buildDirectory();\n};\n\nfunction createPackageJson(outputDirectory: string): void {\n  const { NODE_ENV, CI } = process.env;\n  const isTest = NODE_ENV?.toUpperCase() === \"TEST\" || CI?.toUpperCase() === \"TRUE\";\n\n  const coreDeps: Record<string, string> = [\n    \"@guardian/eslint-config-typescript\",\n    \"@types/jest\",\n    \"@types/node\",\n    \"eslint\",\n    \"jest\",\n    \"prettier\",\n    \"ts-jest\",\n    \"ts-node\",\n    \"typescript\",\n    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- deps come from `package.json`, so shouldn't be `undefined`\n  ].reduce((acc, depName) => ({ ...acc, [depName]: getDevDependency(depName)! }), {});\n\n  const cdkDeps: Record<string, string> = {\n    /*\n      Do not add `@guardian/cdk` to the generated `package.json` file when in TEST as we'll `npm link` it instead.\n      See https://docs.npmjs.com/cli/v8/commands/npm-link#caveat\n\n      TODO remove this once the `new` command allows opting out of automatic dependency installation\n       */\n    ...(!isTest && { \"@guardian/cdk\": LibraryInfo.VERSION }),\n\n    \"aws-cdk\": LibraryInfo.AWS_CDK_VERSION,\n    \"aws-cdk-lib\": LibraryInfo.AWS_CDK_VERSION,\n    constructs: LibraryInfo.CONSTRUCTS_VERSION,\n  };\n\n  const customDeps = {\n    \"source-map-support\": \"^0.5.20\",\n    \"@guardian/prettier\": \"1.0.0\",\n  };\n\n  const allDeps: Record<string, string> = { ...coreDeps, ...cdkDeps, ...customDeps };\n\n  const devDependencies: Record<string, string> = Object.keys(allDeps)\n    .sort()\n    .reduce((acc, depName) => ({ ...acc, [depName]: allDeps[depName] }), {});\n\n  const contents = {\n    name: \"cdk\",\n    version: \"0.0.0\",\n    private: true,\n    scripts: {\n      build: \"tsc\",\n      test: \"jest\",\n      \"test-update\": \"jest -u\",\n      format: 'prettier --write \"{lib,bin}/**/*.ts\"',\n      lint: \"eslint lib/** bin/** --ext .ts --no-error-on-unmatched-pattern\",\n      synth: \"cdk synth --path-metadata false --version-reporting false\",\n      diff: \"cdk diff --path-metadata false --version-reporting false\",\n    },\n    devDependencies,\n\n    prettier: \"@guardian/prettier\",\n\n    jest: {\n      testMatch: [\"<rootDir>/lib/**/*.test.ts\"],\n      transform: {\n        \"^.+\\\\.tsx?$\": \"ts-jest\",\n      },\n      setupFilesAfterEnv: [\"./jest.setup.js\"],\n    },\n\n    eslintConfig: {\n      root: true,\n      env: {\n        node: true,\n        jest: true,\n      },\n      extends: [\"@guardian/eslint-config-typescript\"],\n      parserOptions: {\n        ecmaVersion: 2020,\n        sourceType: \"module\",\n      },\n      plugins: [\"@typescript-eslint\"],\n      rules: {\n        \"@typescript-eslint/no-inferrable-types\": 0,\n        \"import/no-namespace\": 2,\n      },\n      ignorePatterns: [\"**/*.js\", \"node_modules\", \"cdk.out\", \".eslintrc.js\", \"jest.config.js\"],\n    },\n  };\n  writeFileSync(`${outputDirectory}/package.json`, JSON.stringify(contents, null, 2));\n}\n"]}

package/lib/constructs/core/stack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stack.d.ts","sourceRoot":"","sources":["../../../src/constructs/core/stack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,GAAG,EAAW,YAAY,EAA0B,KAAK,EAAQ,MAAM,aAAa,CAAC;AAC3G,OAAO,KAAK,EAAc,UAAU,EAAE,MAAM,aAAa,CAAC;AAG1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAK7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,WAAW,YAAa,SAAQ,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;IACjE;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,OAAQ,SAAQ,KAAM,YAAW,kBAAkB;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,IAAI,KAAK,IAAI,MAAM,CAElB;IAED;;;;;;;;;OASG;IACH,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,GAAE,OAAc,GAAG,IAAI;IAM5F;;;;OAIG;IACH,IAAI,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAK7C;gBAGW,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;IAgDrD;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACI,iBAAiB,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,iBAAiB,GAAG,IAAI;CAQhG;AAED;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,OAAO;gBAEzC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;IAI3C,IAAI,OAAO,IAAI,MAAM,CAEpB;CACF"}
+{"version":3,"file":"stack.d.ts","sourceRoot":"","sources":["../../../src/constructs/core/stack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,GAAG,EAAW,YAAY,EAA0B,KAAK,EAAQ,MAAM,aAAa,CAAC;AAC3G,OAAO,KAAK,EAAc,UAAU,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAM7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,WAAW,YAAa,SAAQ,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;IACjE;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,OAAQ,SAAQ,KAAM,YAAW,kBAAkB;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,IAAI,KAAK,IAAI,MAAM,CAElB;IAED;;;;;;;;;OASG;IACH,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,GAAE,OAAc,GAAG,IAAI;IAM5F;;;;OAIG;IACH,IAAI,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAK7C;gBAGW,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;IA+BrD;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACI,iBAAiB,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,iBAAiB,GAAG,IAAI;CAQhG;AAED;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,OAAO;gBAEzC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;IAI3C,IAAI,OAAO,IAAI,MAAM,CAEpB;CACF"}

package/lib/constructs/core/stack.js

@@ -6,8 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.GuStackForStackSetInstance = exports.GuStack = void 0;
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const assertions_1 = require("aws-cdk-lib/assertions");
-const cloudformation_include_1 = require("aws-cdk-lib/cloudformation-include");
 const git_url_parse_1 = __importDefault(require("git-url-parse"));
+const cfn_include_reporter_1 = require("../../aspects/cfn-include-reporter");
 const metadata_1 = require("../../aspects/metadata");
 const constants_1 = require("../../constants");
 const git_1 = require("../../utils/git");
@@ -60,19 +60,7 @@ class GuStack extends aws_cdk_lib_1.Stack {
         if (!props.withoutMetadata) {
             aws_cdk_lib_1.Aspects.of(this).add(new metadata_1.Metadata(this));
         }
-        const { node } = this;
-        node.addValidation({
-            validate() {
-                const NO_ERRORS = [];
-                node
-                    .findAll()
-                    .filter((construct) => construct instanceof cloudformation_include_1.CfnInclude)
-                    .map((cfnInclude) => {
-                    aws_cdk_lib_1.Annotations.of(cfnInclude).addWarning(`As you're migrating a YAML/JSON template to ${constants_1.LibraryInfo.NAME}, be sure to check for any stateful resources! See https://github.com/guardian/cdk/blob/main/docs/stateful-resources.md.`);
-                });
-                return NO_ERRORS;
-            },
-        });
+        aws_cdk_lib_1.Aspects.of(this).add(new cfn_include_reporter_1.CfnIncludeReporter());
     }
     get stage() {
         return this._stage;

package/lib/constructs/core/stack.js.map

@@ -1 +1 @@
-{"version":3,"file":"stack.js","sourceRoot":"","sources":["../../../src/constructs/core/stack.ts"],"names":[],"mappings":";;;;;;AAAA,6CAA2G;AAE3G,uDAAkD;AAClD,+EAAgE;AAEhE,kEAAwC;AACxC,qDAAkD;AAClD,+CAAsF;AACtF,yCAAqD;AAgCrD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAa,OAAQ,SAAQ,mBAAK;IAwChC,8GAA8G;IAC9G,YAAY,GAAQ,EAAE,EAAU,EAAE,KAAmB;QACnD,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;QAErG,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE;YACb,GAAG,KAAK;YACR,SAAS,EAAE,uBAAuB;YAElC,gEAAgE;YAChE,8FAA8F;YAC9F,WAAW,EAAE,IAAI,oCAAsB,EAAE;SAC1C,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAElC,IAAI,CAAC,WAAW,EAAE;YAChB,IAAI,CAAC,MAAM,CAAC,uBAAW,CAAC,GAAG,EAAE,uBAAW,CAAC,KAAK,CAAC,CAAC;YAEhD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAEjC,IAAI,CAAC,mBAAmB,EAAE,CAAC;SAC5B;QAED,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE;YAC1B,qBAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,mBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;SAC1C;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtB,IAAI,CAAC,aAAa,CAAC;YACjB,QAAQ;gBACN,MAAM,SAAS,GAAa,EAAE,CAAC;gBAE/B,IAAI;qBACD,OAAO,EAAE;qBACT,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,YAAY,mCAAU,CAAC;qBACtD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;oBAClB,yBAAW,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,UAAU,CACnC,+CAA+C,uBAAW,CAAC,IAAI,0HAA0H,CAC1L,CAAC;gBACJ,CAAC,CAAC,CAAC;gBAEL,OAAO,SAAS,CAAC;YACnB,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAnFD,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;;;;;OASG;IACO,MAAM,CAAC,GAAW,EAAE,KAAa,EAAE,2BAAoC,IAAI;QACnF,4CAA4C;QAC5C,wGAAwG;QACxG,kBAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED;;;;OAIG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI;aACb,OAAO,EAAE;aACT,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,YAAY,0BAAY,CAAC;aACxD,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAqB,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IAmDD;;;;;;;OAOG;IACK,mBAAmB;QACzB,IAAI;YACF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,uBAAW,CAAC,cAAc,CAAuB,CAAC;YACjG,MAAM,aAAa,GAAW,cAAc,IAAI,IAAA,wBAAkB,GAAE,CAAC;YACrE,MAAM,cAAc,GAAG,IAAA,uBAAW,EAAC,aAAa,CAAC,CAAC,SAAS,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,wBAAY,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;SAC3D;QAAC,MAAM;YACN,OAAO,CAAC,IAAI,CACV,+CAA+C,uBAAW,CAAC,cAAc,0CAA0C,CACpH,CAAC;SACH;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACI,iBAAiB,CAAC,SAAqB,EAAE,EAAE,SAAS,EAAE,MAAM,EAAqB;QACtF,MAAM,EACJ,IAAI,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,GAC3B,GAAG,SAAS,CAAC;QAEb,YAA2B,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,yBAAW,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,0BAA0B,EAAE,OAAO,SAAS,aAAa,MAAM,EAAE,CAAC,CAAC;IACvG,CAAC;CACF;AA5KD,0BA4KC;AAED;;;;GAIG;AACH,MAAa,0BAA2B,SAAQ,OAAO;IACrD,4GAA4G;IAC5G,YAAY,EAAU,EAAE,KAAmB;QACzC,KAAK,CAAC,IAAI,iBAAG,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC,qBAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;CACF;AATD,gEASC","sourcesContent":["import { Annotations, App, Aspects, CfnParameter, LegacyStackSynthesizer, Stack, Tags } from \"aws-cdk-lib\";\nimport type { CfnElement, StackProps } from \"aws-cdk-lib\";\nimport { Template } from \"aws-cdk-lib/assertions\";\nimport { CfnInclude } from \"aws-cdk-lib/cloudformation-include\";\nimport type { IConstruct } from \"constructs\";\nimport gitUrlParse from \"git-url-parse\";\nimport { Metadata } from \"../../aspects/metadata\";\nimport { ContextKeys, LibraryInfo, MetadataKeys, TrackingTag } from \"../../constants\";\nimport { gitRemoteOriginUrl } from \"../../utils/git\";\nimport type { StackStageIdentity } from \"./identity\";\nimport type { GuStaticLogicalId } from \"./migrating\";\n\nexport interface GuStackProps extends Omit<StackProps, \"stackName\"> {\n  /**\n   * The Guardian stack being used (as defined in your riff-raff.yaml).\n   * This will be applied as a tag to all of your resources.\n   */\n  stack: string;\n\n  stage: string;\n\n  /**\n   * The AWS CloudFormation stack name (as shown in the AWS CloudFormation UI).\n   * @defaultValue the `GU_CFN_STACK_NAME` environment variable\n   */\n  cloudFormationStackName?: string;\n  /**\n   * Set this to true to stop the GuStack from tagging all of your AWS resources.\n   * This should only be turned on as part of an initial migration from CloudFormation.\n   */\n  withoutTags?: boolean;\n\n  /**\n   * Set to disable CDK metadata. Only for internal use (for disabling for some\n   * snapshot tests). We rely on tracking data to prioritise future work so\n   * please do not override this.\n   */\n  withoutMetadata?: boolean;\n}\n\n/**\n * GuStack provides the `stack` and `stage` parameters to a template.\n * It also takes the `app` in the constructor.\n *\n * GuStack will add the Stack, Stage and App tags to all resources.\n *\n * GuStack also adds the tag `X-Gu-CDK-Version`.\n * This tag allows us to measure adoption of this library.\n * It's value is the version of guardian/cdk being used, as defined in `package.json`.\n * As a result, the change sets between version numbers will be fairly noisy,\n * as all resources receive a tag update.\n * It is recommended to upgrade the version of @guardian/cdk being used in two steps:\n *   1. Bump the library, apply the tag updates\n *   2. Make any other stack changes\n *\n * Typical usage is to extend GuStack:\n *\n * ```typescript\n * class MyStack extends GuStack {\n *   constructor(scope: App, id: string, props: GuStackProps) {\n *     super(scope, id, props)\n *   }\n *\n *   // add resources here\n * }\n * ```\n */\nexport class GuStack extends Stack implements StackStageIdentity {\n  private readonly _stack: string;\n  private readonly _stage: string;\n\n  get stage(): string {\n    return this._stage;\n  }\n\n  get stack(): string {\n    return this._stack;\n  }\n\n  /**\n   * A helper function to add a tag to all resources in a stack.\n   *\n   * Note: tags will be listed in alphabetical order during synthesis.\n   *\n   * @param key the tag name\n   * @param value the value of the tag\n   * @param applyToLaunchedInstances whether or not to apply the tag to instances launched in an ASG.\n   * @protected\n   */\n  protected addTag(key: string, value: string, applyToLaunchedInstances: boolean = true): void {\n    // TODO add validation for `key` and `value`\n    //  see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html\n    Tags.of(this).add(key, value, { applyToLaunchedInstances });\n  }\n\n  /**\n   * Returns all the parameters on this stack.\n   *\n   * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html\n   */\n  get parameters(): Record<string, CfnParameter> {\n    return this.node\n      .findAll()\n      .filter((construct) => construct instanceof CfnParameter)\n      .reduce((acc, param) => ({ ...acc, [param.node.id]: param as CfnParameter }), {});\n  }\n\n  // eslint-disable-next-line custom-rules/valid-constructors -- GuStack is the exception as it must take an App\n  constructor(app: App, id: string, props: GuStackProps) {\n    const { cloudFormationStackName = process.env.GU_CFN_STACK_NAME, stack, stage, withoutTags } = props;\n\n    super(app, id, {\n      ...props,\n      stackName: cloudFormationStackName,\n\n      // TODO Use `DefaultStackSynthesizer` or create own synthesizer?\n      //  see https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping.html#bootstrapping-custom-synth\n      synthesizer: new LegacyStackSynthesizer(),\n    });\n\n    this._stack = stack;\n    this._stage = stage.toUpperCase();\n\n    if (!withoutTags) {\n      this.addTag(TrackingTag.Key, TrackingTag.Value);\n\n      this.addTag(\"Stack\", this.stack);\n      this.addTag(\"Stage\", this.stage);\n\n      this.tryAddRepositoryTag();\n    }\n\n    if (!props.withoutMetadata) {\n      Aspects.of(this).add(new Metadata(this));\n    }\n\n    const { node } = this;\n\n    node.addValidation({\n      validate(): string[] {\n        const NO_ERRORS: string[] = [];\n\n        node\n          .findAll()\n          .filter((construct) => construct instanceof CfnInclude)\n          .map((cfnInclude) => {\n            Annotations.of(cfnInclude).addWarning(\n              `As you're migrating a YAML/JSON template to ${LibraryInfo.NAME}, be sure to check for any stateful resources! See https://github.com/guardian/cdk/blob/main/docs/stateful-resources.md.`\n            );\n          });\n\n        return NO_ERRORS;\n      },\n    });\n  }\n\n  /**\n   * Adds a tag to resources in the stack for the repository name.\n   * The value is retrieved in the following order:\n   *   1. From the context\n   *   2. From git config\n   *\n   * @private\n   */\n  private tryAddRepositoryTag(): void {\n    try {\n      const urlFromContext = this.node.tryGetContext(ContextKeys.REPOSITORY_URL) as string | undefined;\n      const repositoryUrl: string = urlFromContext ?? gitRemoteOriginUrl();\n      const repositoryName = gitUrlParse(repositoryUrl).full_name;\n      this.addTag(MetadataKeys.REPOSITORY_NAME, repositoryName);\n    } catch {\n      console.info(\n        `Unable to find git repository name. Set the ${ContextKeys.REPOSITORY_URL} context value or configure a git remote`\n      );\n    }\n  }\n\n  /**\n   * Override the auto-generated logical ID for a resource, in the generated CloudFormation template, with a static one.\n   *\n   * Of particular use when migrating a JSON/YAML CloudFormation template into GuCDK.\n   * It's generally advised to retain the logical ID for stateful resources, such as databases or buckets.\n   *\n   * Let's say we have a YAML template:\n   *\n   * ```yaml\n   * AWSTemplateFormatVersion: '2010-09-09'\n   * Resources:\n   *   UsesTable:\n   *     Type: AWS::DynamoDB::Table\n   *     Properties:\n   *       TableName: !Sub 'users-${stage}'\n   * ```\n   *\n   * When moving to GuCDK we'll have this:\n   *\n   * class MyStack extends GuStack {\n   *   constructor(app: App, id: string, props: GuStackProps) {\n   *     super(app, id, props);\n   *\n   *     const { stage } = this;\n   *\n   *     new Table(this, \"UsersTable\", {\n   *       name: `users-${stage}`\n   *     });\n   *   }\n   * }\n   *\n   * During synthesis, CDK auto-generates logical IDs, so we'll have a stack with a DynamoDB table named 'UsersTable<SOME GUID>', NOT `UsersTable`.\n   * That is, the `UsersTable` table will be deleted.\n   *\n   * In order to retain the original ID from the YAML template, we will do:\n   *\n   * class MyStack extends GuStack {\n   *   constructor(app: App, id: string, props: GuStackProps) {\n   *     super(app, id, props);\n   *\n   *     const { stage } = this;\n   *\n   *     const table = new Table(this, \"UsersTable\", {\n   *       name: `users-${stage}`\n   *     });\n   *\n   *     this.overrideLogicalId(table, { logicalId: \"UsersTable\", reason: \"Retaining a stateful resource from the YAML template\" });\n   *   }\n   * }\n   *\n   * @param construct The (stateful) resource to retain the logical ID of.\n   * @param logicalId The logical ID of the resource (as defined in the JSON/YAML template.\n   * @param reason A small explanation to keep the logical ID. Mainly used to help future developers.\n   */\n  public overrideLogicalId(construct: IConstruct, { logicalId, reason }: GuStaticLogicalId): void {\n    const {\n      node: { id, defaultChild },\n    } = construct;\n\n    (defaultChild as CfnElement).overrideLogicalId(logicalId);\n    Annotations.of(construct).addInfo(`Setting logical ID for ${id} to ${logicalId}. Reason: ${reason}`);\n  }\n}\n\n/**\n * A GuStack but designed for Stack Set instances.\n *\n * In a stack set application, `GuStackForStackSetInstance` is used to represent the infrastructure to provision in target AWS accounts.\n */\nexport class GuStackForStackSetInstance extends GuStack {\n  // eslint-disable-next-line custom-rules/valid-constructors -- GuStackForStackSet should have a unique `App`\n  constructor(id: string, props: GuStackProps) {\n    super(new App(), id, props);\n  }\n\n  get cfnJson(): string {\n    return JSON.stringify(Template.fromStack(this).toJSON(), null, 2);\n  }\n}\n"]}
+{"version":3,"file":"stack.js","sourceRoot":"","sources":["../../../src/constructs/core/stack.ts"],"names":[],"mappings":";;;;;;AAAA,6CAA2G;AAE3G,uDAAkD;AAElD,kEAAwC;AACxC,6EAAwE;AACxE,qDAAkD;AAClD,+CAAyE;AACzE,yCAAqD;AAgCrD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAa,OAAQ,SAAQ,mBAAK;IAwChC,8GAA8G;IAC9G,YAAY,GAAQ,EAAE,EAAU,EAAE,KAAmB;QACnD,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;QAErG,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE;YACb,GAAG,KAAK;YACR,SAAS,EAAE,uBAAuB;YAElC,gEAAgE;YAChE,8FAA8F;YAC9F,WAAW,EAAE,IAAI,oCAAsB,EAAE;SAC1C,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAElC,IAAI,CAAC,WAAW,EAAE;YAChB,IAAI,CAAC,MAAM,CAAC,uBAAW,CAAC,GAAG,EAAE,uBAAW,CAAC,KAAK,CAAC,CAAC;YAEhD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAEjC,IAAI,CAAC,mBAAmB,EAAE,CAAC;SAC5B;QAED,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE;YAC1B,qBAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,mBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;SAC1C;QAED,qBAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,yCAAkB,EAAE,CAAC,CAAC;IACjD,CAAC;IAlED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;;;;;OASG;IACO,MAAM,CAAC,GAAW,EAAE,KAAa,EAAE,2BAAoC,IAAI;QACnF,4CAA4C;QAC5C,wGAAwG;QACxG,kBAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED;;;;OAIG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI;aACb,OAAO,EAAE;aACT,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,YAAY,0BAAY,CAAC;aACxD,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAqB,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IAkCD;;;;;;;OAOG;IACK,mBAAmB;QACzB,IAAI;YACF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,uBAAW,CAAC,cAAc,CAAuB,CAAC;YACjG,MAAM,aAAa,GAAW,cAAc,IAAI,IAAA,wBAAkB,GAAE,CAAC;YACrE,MAAM,cAAc,GAAG,IAAA,uBAAW,EAAC,aAAa,CAAC,CAAC,SAAS,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,wBAAY,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;SAC3D;QAAC,MAAM;YACN,OAAO,CAAC,IAAI,CACV,+CAA+C,uBAAW,CAAC,cAAc,0CAA0C,CACpH,CAAC;SACH;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IACI,iBAAiB,CAAC,SAAqB,EAAE,EAAE,SAAS,EAAE,MAAM,EAAqB;QACtF,MAAM,EACJ,IAAI,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,GAC3B,GAAG,SAAS,CAAC;QAEb,YAA2B,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,yBAAW,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,0BAA0B,EAAE,OAAO,SAAS,aAAa,MAAM,EAAE,CAAC,CAAC;IACvG,CAAC;CACF;AA3JD,0BA2JC;AAED;;;;GAIG;AACH,MAAa,0BAA2B,SAAQ,OAAO;IACrD,4GAA4G;IAC5G,YAAY,EAAU,EAAE,KAAmB;QACzC,KAAK,CAAC,IAAI,iBAAG,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC,qBAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;CACF;AATD,gEASC","sourcesContent":["import { Annotations, App, Aspects, CfnParameter, LegacyStackSynthesizer, Stack, Tags } from \"aws-cdk-lib\";\nimport type { CfnElement, StackProps } from \"aws-cdk-lib\";\nimport { Template } from \"aws-cdk-lib/assertions\";\nimport type { IConstruct } from \"constructs\";\nimport gitUrlParse from \"git-url-parse\";\nimport { CfnIncludeReporter } from \"../../aspects/cfn-include-reporter\";\nimport { Metadata } from \"../../aspects/metadata\";\nimport { ContextKeys, MetadataKeys, TrackingTag } from \"../../constants\";\nimport { gitRemoteOriginUrl } from \"../../utils/git\";\nimport type { StackStageIdentity } from \"./identity\";\nimport type { GuStaticLogicalId } from \"./migrating\";\n\nexport interface GuStackProps extends Omit<StackProps, \"stackName\"> {\n  /**\n   * The Guardian stack being used (as defined in your riff-raff.yaml).\n   * This will be applied as a tag to all of your resources.\n   */\n  stack: string;\n\n  stage: string;\n\n  /**\n   * The AWS CloudFormation stack name (as shown in the AWS CloudFormation UI).\n   * @defaultValue the `GU_CFN_STACK_NAME` environment variable\n   */\n  cloudFormationStackName?: string;\n  /**\n   * Set this to true to stop the GuStack from tagging all of your AWS resources.\n   * This should only be turned on as part of an initial migration from CloudFormation.\n   */\n  withoutTags?: boolean;\n\n  /**\n   * Set to disable CDK metadata. Only for internal use (for disabling for some\n   * snapshot tests). We rely on tracking data to prioritise future work so\n   * please do not override this.\n   */\n  withoutMetadata?: boolean;\n}\n\n/**\n * GuStack provides the `stack` and `stage` parameters to a template.\n * It also takes the `app` in the constructor.\n *\n * GuStack will add the Stack, Stage and App tags to all resources.\n *\n * GuStack also adds the tag `X-Gu-CDK-Version`.\n * This tag allows us to measure adoption of this library.\n * It's value is the version of guardian/cdk being used, as defined in `package.json`.\n * As a result, the change sets between version numbers will be fairly noisy,\n * as all resources receive a tag update.\n * It is recommended to upgrade the version of @guardian/cdk being used in two steps:\n *   1. Bump the library, apply the tag updates\n *   2. Make any other stack changes\n *\n * Typical usage is to extend GuStack:\n *\n * ```typescript\n * class MyStack extends GuStack {\n *   constructor(scope: App, id: string, props: GuStackProps) {\n *     super(scope, id, props)\n *   }\n *\n *   // add resources here\n * }\n * ```\n */\nexport class GuStack extends Stack implements StackStageIdentity {\n  private readonly _stack: string;\n  private readonly _stage: string;\n\n  get stage(): string {\n    return this._stage;\n  }\n\n  get stack(): string {\n    return this._stack;\n  }\n\n  /**\n   * A helper function to add a tag to all resources in a stack.\n   *\n   * Note: tags will be listed in alphabetical order during synthesis.\n   *\n   * @param key the tag name\n   * @param value the value of the tag\n   * @param applyToLaunchedInstances whether or not to apply the tag to instances launched in an ASG.\n   * @protected\n   */\n  protected addTag(key: string, value: string, applyToLaunchedInstances: boolean = true): void {\n    // TODO add validation for `key` and `value`\n    //  see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html\n    Tags.of(this).add(key, value, { applyToLaunchedInstances });\n  }\n\n  /**\n   * Returns all the parameters on this stack.\n   *\n   * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html\n   */\n  get parameters(): Record<string, CfnParameter> {\n    return this.node\n      .findAll()\n      .filter((construct) => construct instanceof CfnParameter)\n      .reduce((acc, param) => ({ ...acc, [param.node.id]: param as CfnParameter }), {});\n  }\n\n  // eslint-disable-next-line custom-rules/valid-constructors -- GuStack is the exception as it must take an App\n  constructor(app: App, id: string, props: GuStackProps) {\n    const { cloudFormationStackName = process.env.GU_CFN_STACK_NAME, stack, stage, withoutTags } = props;\n\n    super(app, id, {\n      ...props,\n      stackName: cloudFormationStackName,\n\n      // TODO Use `DefaultStackSynthesizer` or create own synthesizer?\n      //  see https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping.html#bootstrapping-custom-synth\n      synthesizer: new LegacyStackSynthesizer(),\n    });\n\n    this._stack = stack;\n    this._stage = stage.toUpperCase();\n\n    if (!withoutTags) {\n      this.addTag(TrackingTag.Key, TrackingTag.Value);\n\n      this.addTag(\"Stack\", this.stack);\n      this.addTag(\"Stage\", this.stage);\n\n      this.tryAddRepositoryTag();\n    }\n\n    if (!props.withoutMetadata) {\n      Aspects.of(this).add(new Metadata(this));\n    }\n\n    Aspects.of(this).add(new CfnIncludeReporter());\n  }\n\n  /**\n   * Adds a tag to resources in the stack for the repository name.\n   * The value is retrieved in the following order:\n   *   1. From the context\n   *   2. From git config\n   *\n   * @private\n   */\n  private tryAddRepositoryTag(): void {\n    try {\n      const urlFromContext = this.node.tryGetContext(ContextKeys.REPOSITORY_URL) as string | undefined;\n      const repositoryUrl: string = urlFromContext ?? gitRemoteOriginUrl();\n      const repositoryName = gitUrlParse(repositoryUrl).full_name;\n      this.addTag(MetadataKeys.REPOSITORY_NAME, repositoryName);\n    } catch {\n      console.info(\n        `Unable to find git repository name. Set the ${ContextKeys.REPOSITORY_URL} context value or configure a git remote`\n      );\n    }\n  }\n\n  /**\n   * Override the auto-generated logical ID for a resource, in the generated CloudFormation template, with a static one.\n   *\n   * Of particular use when migrating a JSON/YAML CloudFormation template into GuCDK.\n   * It's generally advised to retain the logical ID for stateful resources, such as databases or buckets.\n   *\n   * Let's say we have a YAML template:\n   *\n   * ```yaml\n   * AWSTemplateFormatVersion: '2010-09-09'\n   * Resources:\n   *   UsesTable:\n   *     Type: AWS::DynamoDB::Table\n   *     Properties:\n   *       TableName: !Sub 'users-${stage}'\n   * ```\n   *\n   * When moving to GuCDK we'll have this:\n   *\n   * class MyStack extends GuStack {\n   *   constructor(app: App, id: string, props: GuStackProps) {\n   *     super(app, id, props);\n   *\n   *     const { stage } = this;\n   *\n   *     new Table(this, \"UsersTable\", {\n   *       name: `users-${stage}`\n   *     });\n   *   }\n   * }\n   *\n   * During synthesis, CDK auto-generates logical IDs, so we'll have a stack with a DynamoDB table named 'UsersTable<SOME GUID>', NOT `UsersTable`.\n   * That is, the `UsersTable` table will be deleted.\n   *\n   * In order to retain the original ID from the YAML template, we will do:\n   *\n   * class MyStack extends GuStack {\n   *   constructor(app: App, id: string, props: GuStackProps) {\n   *     super(app, id, props);\n   *\n   *     const { stage } = this;\n   *\n   *     const table = new Table(this, \"UsersTable\", {\n   *       name: `users-${stage}`\n   *     });\n   *\n   *     this.overrideLogicalId(table, { logicalId: \"UsersTable\", reason: \"Retaining a stateful resource from the YAML template\" });\n   *   }\n   * }\n   *\n   * @param construct The (stateful) resource to retain the logical ID of.\n   * @param logicalId The logical ID of the resource (as defined in the JSON/YAML template.\n   * @param reason A small explanation to keep the logical ID. Mainly used to help future developers.\n   */\n  public overrideLogicalId(construct: IConstruct, { logicalId, reason }: GuStaticLogicalId): void {\n    const {\n      node: { id, defaultChild },\n    } = construct;\n\n    (defaultChild as CfnElement).overrideLogicalId(logicalId);\n    Annotations.of(construct).addInfo(`Setting logical ID for ${id} to ${logicalId}. Reason: ${reason}`);\n  }\n}\n\n/**\n * A GuStack but designed for Stack Set instances.\n *\n * In a stack set application, `GuStackForStackSetInstance` is used to represent the infrastructure to provision in target AWS accounts.\n */\nexport class GuStackForStackSetInstance extends GuStack {\n  // eslint-disable-next-line custom-rules/valid-constructors -- GuStackForStackSet should have a unique `App`\n  constructor(id: string, props: GuStackProps) {\n    super(new App(), id, props);\n  }\n\n  get cfnJson(): string {\n    return JSON.stringify(Template.fromStack(this).toJSON(), null, 2);\n  }\n}\n"]}

package/lib/experimental/constructs/error-budget-alarm.d.ts

@@ -0,0 +1,12 @@
+import type { IMetric } from "aws-cdk-lib/aws-cloudwatch";
+import type { GuStack } from "../../constructs/core";
+export interface ErrorBudgetAlarmProps {
+    snsTopicNameForAlerts: string;
+    sloTarget: number;
+    badEvents: IMetric;
+    validEvents: IMetric;
+}
+export declare class ErrorBudgetAlarmExperimental {
+    constructor(scope: GuStack, props: ErrorBudgetAlarmProps);
+}
+//# sourceMappingURL=error-budget-alarm.d.ts.map

package/lib/experimental/constructs/error-budget-alarm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-budget-alarm.d.ts","sourceRoot":"","sources":["../../../src/experimental/constructs/error-budget-alarm.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,OAAO,EAAC,MAAM,4BAA4B,CAAC;AAW7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,MAAM,WAAW,qBAAqB;IACpC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;CAEtB;AAwCD,qBAAa,4BAA4B;gBAE3B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB;CAqEzD"}

package/lib/experimental/constructs/error-budget-alarm.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ErrorBudgetAlarmExperimental = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_cloudwatch_1 = require("aws-cdk-lib/aws-cloudwatch");
+const aws_cloudwatch_actions_1 = require("aws-cdk-lib/aws-cloudwatch-actions");
+const aws_sns_1 = require("aws-cdk-lib/aws-sns");
+function applySuppression(alarmToSuppress, suppressingAlarm, shortWindow) {
+    const cfnAlarm = alarmToSuppress.node.defaultChild;
+    cfnAlarm.actionsSuppressor = suppressingAlarm.alarmArn;
+    cfnAlarm.actionsSuppressorWaitPeriod = 120;
+    cfnAlarm.actionsSuppressorExtensionPeriod = shortWindow.toSeconds();
+}
+// Do we need to extend construct here?
+class ErrorBudgetAlarmExperimental {
+    constructor(scope, props) {
+        const errorBudget = 1 - props.sloTarget;
+        const snsTopic = aws_sns_1.Topic.fromTopicArn(scope, 'SnsSloAlarms', `arn:aws:sns:${scope.region}:${scope.account}:${props.snsTopicNameForAlerts}`);
+        const fastBurnRate = {
+            speed: 'Fast',
+            burnRate: 15,
+            longWindow: aws_cdk_lib_1.Duration.hours(1),
+            shortWindow: aws_cdk_lib_1.Duration.minutes(5),
+        };
+        const fastBurnAlarm = new CompositeBurnRateAlarm(scope, {
+            badEvents: props.badEvents,
+            burnRate: fastBurnRate,
+            errorBudget,
+            snsTopic,
+            validEvents: props.validEvents,
+        });
+        const moderateBurnRate = {
+            speed: 'Moderate',
+            burnRate: 6,
+            longWindow: aws_cdk_lib_1.Duration.hours(6),
+            shortWindow: aws_cdk_lib_1.Duration.minutes(30),
+        };
+        const moderateBurnAlarm = new CompositeBurnRateAlarm(scope, {
+            badEvents: props.badEvents,
+            burnRate: moderateBurnRate,
+            errorBudget,
+            snsTopic,
+            validEvents: props.validEvents,
+        });
+        applySuppression(moderateBurnAlarm, fastBurnAlarm, moderateBurnRate.shortWindow);
+        const slowBurnRate = {
+            speed: 'Slow',
+            burnRate: 3,
+            longWindow: aws_cdk_lib_1.Duration.days(1),
+            shortWindow: aws_cdk_lib_1.Duration.hours(2),
+        };
+        const slowBurnAlarm = new CompositeBurnRateAlarm(scope, {
+            badEvents: props.badEvents,
+            burnRate: moderateBurnRate,
+            errorBudget,
+            snsTopic,
+            validEvents: props.validEvents,
+        });
+        applySuppression(slowBurnAlarm, moderateBurnAlarm, slowBurnRate.shortWindow);
+    }
+}
+exports.ErrorBudgetAlarmExperimental = ErrorBudgetAlarmExperimental;
+class IndividualBurnRateAlarm extends aws_cloudwatch_1.Alarm {
+    constructor(scope, props) {
+        const undesirableErrorBudgetConsumption = props.errorBudget * props.burnRateSpeed.burnRate;
+        super(scope, `${props.burnRateSpeed.speed}BurnOver${props.window.toHumanString()}`, {
+            metric: new aws_cloudwatch_1.MathExpression({
+                expression: `badEvents/validEvents`,
+                label: 'Observed failure rate',
+                usingMetrics: {
+                    badEvents: props.badEvents,
+                    validEvents: props.validEvents,
+                },
+                period: props.window,
+            }),
+            evaluationPeriods: 1,
+            threshold: undesirableErrorBudgetConsumption,
+            comparisonOperator: aws_cloudwatch_1.ComparisonOperator.GREATER_THAN_THRESHOLD,
+            treatMissingData: aws_cloudwatch_1.TreatMissingData.NOT_BREACHING,
+        });
+    }
+}
+class CompositeBurnRateAlarm extends aws_cloudwatch_1.CompositeAlarm {
+    constructor(scope, props) {
+        const sharedIndividualAlarmProps = {
+            badEvents: props.badEvents,
+            burnRateSpeed: {
+                speed: props.burnRate.speed,
+                burnRate: props.burnRate.burnRate,
+            },
+            errorBudget: props.errorBudget,
+            validEvents: props.validEvents
+        };
+        super(scope, `${props.burnRate.speed}BurnCompositeAlarm`, {
+            alarmRule: aws_cloudwatch_1.AlarmRule.allOf(aws_cloudwatch_1.AlarmRule.fromAlarm(new IndividualBurnRateAlarm(scope, {
+                ...sharedIndividualAlarmProps,
+                window: props.burnRate.longWindow,
+            }), aws_cloudwatch_1.AlarmState.ALARM), aws_cloudwatch_1.AlarmRule.fromAlarm(new IndividualBurnRateAlarm(scope, {
+                ...sharedIndividualAlarmProps,
+                window: props.burnRate.shortWindow,
+            }), aws_cloudwatch_1.AlarmState.ALARM)),
+        });
+        this.addAlarmAction(new aws_cloudwatch_actions_1.SnsAction(props.snsTopic));
+    }
+}
+//# sourceMappingURL=error-budget-alarm.js.map

package/lib/experimental/constructs/error-budget-alarm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-budget-alarm.js","sourceRoot":"","sources":["../../../src/experimental/constructs/error-budget-alarm.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AAGvC,+DAMoC;AACpC,+EAA+D;AAE/D,iDAA4C;AAqC5C,SAAS,gBAAgB,CACvB,eAA+B,EAC/B,gBAAgC,EAChC,WAAqB;IAErB,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,YAAiC,CAAC;IACxE,QAAQ,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,QAAQ,CAAC;IACvD,QAAQ,CAAC,2BAA2B,GAAG,GAAG,CAAC;IAC3C,QAAQ,CAAC,gCAAgC,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;AACtE,CAAC;AAED,uCAAuC;AACvC,MAAa,4BAA4B;IAEvC,YAAY,KAAc,EAAE,KAA4B;QAEtD,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;QAExC,MAAM,QAAQ,GAAW,eAAK,CAAC,YAAY,CACzC,KAAK,EACL,cAAc,EACd,eAAe,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAC9E,CAAC;QAEF,MAAM,YAAY,GAAa;YAC7B,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7B,WAAW,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;SACjC,CAAC;QAEF,MAAM,aAAa,GAAG,IAAI,sBAAsB,CAAC,KAAK,EAAE;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,YAAY;YACtB,WAAW;YACX,QAAQ;YACR,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAa;YACjC,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7B,WAAW,EAAE,sBAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;SAClC,CAAC;QAEF,MAAM,iBAAiB,GAAG,IAAI,sBAAsB,CAAC,KAAK,EAAE;YAC1D,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,gBAAgB;YAC1B,WAAW;YACX,QAAQ;YACR,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEH,gBAAgB,CACd,iBAAiB,EACjB,aAAa,EACb,gBAAgB,CAAC,WAAW,CAC7B,CAAC;QAEF,MAAM,YAAY,GAAa;YAC7B,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5B,WAAW,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;SAC/B,CAAC;QAEF,MAAM,aAAa,GAAG,IAAI,sBAAsB,CAAC,KAAK,EAAE;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,gBAAgB;YAC1B,WAAW;YACX,QAAQ;YACR,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEH,gBAAgB,CACd,aAAa,EACb,iBAAiB,EACjB,YAAY,CAAC,WAAW,CACzB,CAAC;IAEJ,CAAC;CAEF;AAvED,oEAuEC;AAED,MAAM,uBAAwB,SAAQ,sBAAK;IACzC,YAAY,KAAc,EAAE,KAAmC;QAC7D,MAAM,iCAAiC,GAAG,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC;QAC3F,KAAK,CACH,KAAK,EACL,GAAG,KAAK,CAAC,aAAa,CAAC,KAAK,WAAW,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,EACrE;YACE,MAAM,EAAE,IAAI,+BAAc,CAAC;gBACzB,UAAU,EAAE,uBAAuB;gBACnC,KAAK,EAAE,uBAAuB;gBAC9B,YAAY,EAAE;oBACZ,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B;gBACD,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;YACF,iBAAiB,EAAE,CAAC;YACpB,SAAS,EAAE,iCAAiC;YAC5C,kBAAkB,EAAE,mCAAkB,CAAC,sBAAsB;YAC7D,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;SACjD,CACF,CAAC;IACJ,CAAC;CACF;AAED,MAAM,sBAAuB,SAAQ,+BAAc;IACjD,YAAY,KAAc,EAAE,KAAkC;QAC5D,MAAM,0BAA0B,GAAG;YACjC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE;gBACb,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;gBAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;aAClC;YACD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;QACF,KAAK,CAAC,KAAK,EACT,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,oBAAoB,EAC3C;YACE,SAAS,EAAE,0BAAS,CAAC,KAAK,CACxB,0BAAS,CAAC,SAAS,CACjB,IAAI,uBAAuB,CAAC,KAAK,EAAE;gBACjC,GAAG,0BAA0B;gBAC7B,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;aAClC,CAAC,EACF,2BAAU,CAAC,KAAK,CACjB,EACD,0BAAS,CAAC,SAAS,CACjB,IAAI,uBAAuB,CAAC,KAAK,EAAE;gBACjC,GAAG,0BAA0B;gBAC7B,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;aACnC,CAAC,EACF,2BAAU,CAAC,KAAK,CACjB,CACF;SACF,CACF,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,IAAI,kCAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,CAAC;CACF","sourcesContent":["import { Duration } from \"aws-cdk-lib\";\nimport type { CfnCompositeAlarm,\n  IMetric} from \"aws-cdk-lib/aws-cloudwatch\";\nimport {\n  Alarm, AlarmRule, AlarmState,\n  ComparisonOperator,\n  CompositeAlarm,\n  MathExpression,\n  TreatMissingData\n} from \"aws-cdk-lib/aws-cloudwatch\";\nimport { SnsAction } from \"aws-cdk-lib/aws-cloudwatch-actions\";\nimport type { ITopic} from \"aws-cdk-lib/aws-sns\";\nimport { Topic } from \"aws-cdk-lib/aws-sns\";\nimport type { GuStack } from \"../../constructs/core\";\n\nexport interface ErrorBudgetAlarmProps {\n  snsTopicNameForAlerts: string;\n  sloTarget: number;\n  badEvents: IMetric; // Should this be IMetric[]?\n  validEvents: IMetric; // Should this be IMetric[]?\n  // Could accept a MathExpression for more complicated cases?\n}\n\ninterface BurnRateSpeed {\n  speed: 'Fast' | 'Moderate' | 'Slow';\n  burnRate: number;\n}\n\ninterface BurnRate extends BurnRateSpeed {\n  longWindow: Duration;\n  shortWindow: Duration;\n}\n\ninterface IndividualBurnRateAlarmProps {\n  burnRateSpeed: BurnRateSpeed;\n  window: Duration;\n  errorBudget: number;\n  badEvents: IMetric;\n  validEvents: IMetric;\n}\n\ninterface CompositeBurnRateAlarmProps {\n  burnRate: BurnRate;\n  errorBudget: number;\n  badEvents: IMetric;\n  validEvents: IMetric;\n  snsTopic: ITopic;\n}\n\nfunction applySuppression(\n  alarmToSuppress: CompositeAlarm,\n  suppressingAlarm: CompositeAlarm,\n  shortWindow: Duration,\n) {\n  const cfnAlarm = alarmToSuppress.node.defaultChild as CfnCompositeAlarm;\n  cfnAlarm.actionsSuppressor = suppressingAlarm.alarmArn;\n  cfnAlarm.actionsSuppressorWaitPeriod = 120;\n  cfnAlarm.actionsSuppressorExtensionPeriod = shortWindow.toSeconds();\n}\n\n// Do we need to extend construct here?\nexport class ErrorBudgetAlarmExperimental {\n\n  constructor(scope: GuStack, props: ErrorBudgetAlarmProps) {\n\n    const errorBudget = 1 - props.sloTarget;\n\n    const snsTopic: ITopic = Topic.fromTopicArn(\n      scope,\n      'SnsSloAlarms',\n      `arn:aws:sns:${scope.region}:${scope.account}:${props.snsTopicNameForAlerts}`,\n    );\n\n    const fastBurnRate: BurnRate = {\n      speed: 'Fast',\n      burnRate: 15,\n      longWindow: Duration.hours(1),\n      shortWindow: Duration.minutes(5),\n    };\n\n    const fastBurnAlarm = new CompositeBurnRateAlarm(scope, {\n      badEvents: props.badEvents,\n      burnRate: fastBurnRate,\n      errorBudget,\n      snsTopic,\n      validEvents: props.validEvents,\n    });\n\n    const moderateBurnRate: BurnRate = {\n      speed: 'Moderate',\n      burnRate: 6,\n      longWindow: Duration.hours(6),\n      shortWindow: Duration.minutes(30),\n    };\n\n    const moderateBurnAlarm = new CompositeBurnRateAlarm(scope, {\n      badEvents: props.badEvents,\n      burnRate: moderateBurnRate,\n      errorBudget,\n      snsTopic,\n      validEvents: props.validEvents,\n    });\n\n    applySuppression(\n      moderateBurnAlarm,\n      fastBurnAlarm,\n      moderateBurnRate.shortWindow,\n    );\n\n    const slowBurnRate: BurnRate = {\n      speed: 'Slow',\n      burnRate: 3,\n      longWindow: Duration.days(1),\n      shortWindow: Duration.hours(2),\n    };\n\n    const slowBurnAlarm = new CompositeBurnRateAlarm(scope, {\n      badEvents: props.badEvents,\n      burnRate: moderateBurnRate,\n      errorBudget,\n      snsTopic, // TODO - use a different topic for tickets or figure out how to route notifications vs tickets using a single topic\n      validEvents: props.validEvents,\n    });\n\n    applySuppression(\n      slowBurnAlarm,\n      moderateBurnAlarm,\n      slowBurnRate.shortWindow,\n    );\n\n  }\n\n}\n\nclass IndividualBurnRateAlarm extends Alarm {\n  constructor(scope: GuStack, props: IndividualBurnRateAlarmProps) {\n    const undesirableErrorBudgetConsumption = props.errorBudget * props.burnRateSpeed.burnRate;\n    super(\n      scope,\n      `${props.burnRateSpeed.speed}BurnOver${props.window.toHumanString()}`,\n      {\n        metric: new MathExpression({\n          expression: `badEvents/validEvents`,\n          label: 'Observed failure rate',\n          usingMetrics: {\n            badEvents: props.badEvents,\n            validEvents: props.validEvents,\n          },\n          period: props.window,\n        }),\n        evaluationPeriods: 1,\n        threshold: undesirableErrorBudgetConsumption,\n        comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,\n        treatMissingData: TreatMissingData.NOT_BREACHING,\n      },\n    );\n  }\n}\n\nclass CompositeBurnRateAlarm extends CompositeAlarm {\n  constructor(scope: GuStack, props: CompositeBurnRateAlarmProps) {\n    const sharedIndividualAlarmProps = {\n      badEvents: props.badEvents,\n      burnRateSpeed: {\n        speed: props.burnRate.speed,\n        burnRate: props.burnRate.burnRate,\n      },\n      errorBudget: props.errorBudget,\n      validEvents: props.validEvents\n    };\n    super(scope,\n      `${props.burnRate.speed}BurnCompositeAlarm`,\n      {\n        alarmRule: AlarmRule.allOf(\n          AlarmRule.fromAlarm(\n            new IndividualBurnRateAlarm(scope, {\n              ...sharedIndividualAlarmProps,\n              window: props.burnRate.longWindow,\n            }),\n            AlarmState.ALARM,\n          ),\n          AlarmRule.fromAlarm(\n            new IndividualBurnRateAlarm(scope, {\n              ...sharedIndividualAlarmProps,\n              window: props.burnRate.shortWindow,\n            }),\n            AlarmState.ALARM,\n          ),\n        ),\n      },\n    );\n    this.addAlarmAction(new SnsAction(props.snsTopic));\n  }\n}\n"]}

package/lib/patterns/ec2-app/base.d.ts

@@ -128,6 +128,7 @@ export interface GuEc2AppProps extends AppIdentity {
     imageRecipe?: string;
     vpc?: IVpc;
     privateSubnets?: ISubnet[];
+    publicSubnets?: ISubnet[];
 }
 /**
  * Pattern which creates the resources needed to run an application on EC2 instances.
@@ -264,9 +265,16 @@ export interface GuEc2AppProps extends AppIdentity {
  * ```
  *
  * If you _must_ support a non-standard VPC setup, it's possible to override the VPC and subnet selection into which
- * instances will be started. This is done by setting the `vpc` and `privateSubnets` props.
- * You won't need to do this under normal circumstances, these will be set for you based on your account's defaults
- * which are suitable for most cases.
+ * instances will be started. You need to set the three props below in order for this to work:
+ *  vpc: this must be an IVpc instance indicating the VPC to deploy into (usually obtained from `Vpc.fromVpcAttributes`)
+ *  privateSubnets: a list of ISubnet indicating the subnets for the autoscaling group to deploy instances into (usually
+ *    obtained from `GuVpc.subnets`)
+ *  publicSubnets: a list of ISubnet indicating the subnets for the loadbalancer to use, if the loadbalancer
+ *    is intended for public access (usually obtained from `GuVpc.subnets`)
+ *    On the other hand, if the access is private, then an "internal" loadbalancer is used in the `privateSubnets` list.
+ * Please note that no checking is applied to the subnet lists to ensure that they correspond to the vpc given; as
+ * an advanced feature it is assumed that the caller ensures this.  If the subnets are mismatched then the resulting
+ * Cloudformation will fail to deploy.
  *
  * ### Customising the infrastructure generated by this pattern
  *

package/lib/patterns/ec2-app/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,KAAK,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAI9E,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAc,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEnF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAmD,MAAM,uBAAuB,CAAC;AAErG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,MAAM;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACxC,uBAAuB,EAAE,OAAO,CAAC;IACjC,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD,QAAQ,EAAE,eAAe,GAAG,MAAM,CAAC;IACnC,MAAM,EAAE,SAAS,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,uBAAuB,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAC7C,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,OAAO,EAAE,aAAa,CAAC;IACvB,gBAAgB,EAAE,YAAY,CAAC;IAC/B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;CAC5B;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoKG;AACH,qBAAa,QAAS,SAAQ,SAAS;IASrC,SAAgB,GAAG,EAAE,IAAI,CAAC;IAC1B,SAAgB,WAAW,EAAE,aAAa,CAAC;IAC3C,SAAgB,YAAY,EAAE,yBAAyB,CAAC;IACxD,SAAgB,gBAAgB,EAAE,kBAAkB,CAAC;IACrD,SAAgB,QAAQ,EAAE,0BAA0B,CAAC;IACrD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;gBAE1C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa;CA8KjD"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,KAAK,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAI9E,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAc,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEnF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAmD,MAAM,uBAAuB,CAAC;AAErG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,MAAM;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACxC,uBAAuB,EAAE,OAAO,CAAC;IACjC,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD,QAAQ,EAAE,eAAe,GAAG,MAAM,CAAC;IACnC,MAAM,EAAE,SAAS,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,uBAAuB,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAC7C,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,OAAO,EAAE,aAAa,CAAC;IACvB,gBAAgB,EAAE,YAAY,CAAC;IAC/B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;CAC3B;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2KG;AACH,qBAAa,QAAS,SAAQ,SAAS;IASrC,SAAgB,GAAG,EAAE,IAAI,CAAC;IAC1B,SAAgB,WAAW,EAAE,aAAa,CAAC;IAC3C,SAAgB,YAAY,EAAE,yBAAyB,CAAC;IACxD,SAAgB,gBAAgB,EAAE,kBAAkB,CAAC;IACrD,SAAgB,QAAQ,EAAE,0BAA0B,CAAC;IACrD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;gBAE1C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa;CA4KjD"}

package/lib/patterns/ec2-app/base.js

@@ -158,9 +158,16 @@ function restrictedCidrRanges(ranges) {
  * ```
  *
  * If you _must_ support a non-standard VPC setup, it's possible to override the VPC and subnet selection into which
- * instances will be started. This is done by setting the `vpc` and `privateSubnets` props.
- * You won't need to do this under normal circumstances, these will be set for you based on your account's defaults
- * which are suitable for most cases.
+ * instances will be started. You need to set the three props below in order for this to work:
+ *  vpc: this must be an IVpc instance indicating the VPC to deploy into (usually obtained from `Vpc.fromVpcAttributes`)
+ *  privateSubnets: a list of ISubnet indicating the subnets for the autoscaling group to deploy instances into (usually
+ *    obtained from `GuVpc.subnets`)
+ *  publicSubnets: a list of ISubnet indicating the subnets for the loadbalancer to use, if the loadbalancer
+ *    is intended for public access (usually obtained from `GuVpc.subnets`)
+ *    On the other hand, if the access is private, then an "internal" loadbalancer is used in the `privateSubnets` list.
+ * Please note that no checking is applied to the subnet lists to ensure that they correspond to the vpc given; as
+ * an advanced feature it is assumed that the caller ensures this.  If the subnets are mismatched then the resulting
+ * Cloudformation will fail to deploy.
  *
  * ### Customising the infrastructure generated by this pattern
  *
@@ -192,7 +199,7 @@ class GuEc2App extends constructs_1.Construct {
     constructor(scope, props) {
         const { access, accessLogging = { enabled: false }, app, 
         // We should update this default once a significant number of apps have migrated to devx-logs
-        applicationLogging = { enabled: false }, applicationPort, blockDevices, certificateProps: { domainName, hostedZoneId }, instanceType, monitoringConfiguration, roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] }, scaling: { minimumInstances, maximumInstances = minimumInstances * 2 }, userData, withoutImdsv2, imageRecipe, vpc = ec2_1.GuVpc.fromIdParameter(scope, core_1.AppIdentity.suffixText({ app }, "VPC")), privateSubnets = ec2_1.GuVpc.subnetsFromParameter(scope, { type: ec2_1.SubnetType.PRIVATE, app }), } = props;
+        applicationLogging = { enabled: false }, applicationPort, blockDevices, certificateProps: { domainName, hostedZoneId }, instanceType, monitoringConfiguration, roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] }, scaling: { minimumInstances, maximumInstances = minimumInstances * 2 }, userData, withoutImdsv2, imageRecipe, vpc = ec2_1.GuVpc.fromIdParameter(scope, core_1.AppIdentity.suffixText({ app }, "VPC")), privateSubnets = ec2_1.GuVpc.subnetsFromParameter(scope, { type: ec2_1.SubnetType.PRIVATE, app }), publicSubnets = ec2_1.GuVpc.subnetsFromParameter(scope, { type: ec2_1.SubnetType.PUBLIC, app }), } = props;
         super(scope, app); // The assumption is `app` is unique
         // We should really prevent users from doing this via the type system,
         // but that requires a breaking change to the API
@@ -246,9 +253,7 @@ class GuEc2App extends constructs_1.Construct {
             // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.
             internetFacing: access.scope !== constants_1.AccessScope.INTERNAL,
             vpcSubnets: {
-                subnets: access.scope === constants_1.AccessScope.INTERNAL
-                    ? privateSubnets
-                    : ec2_1.GuVpc.subnetsFromParameter(scope, { type: ec2_1.SubnetType.PUBLIC, app }),
+                subnets: access.scope === constants_1.AccessScope.INTERNAL ? privateSubnets : publicSubnets,
             },
         });
         if (accessLogging.enabled) {

package/lib/patterns/ec2-app/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;AAAA,6CAA6C;AAE7C,iEAA0D;AAE1D,iDAA2C;AAC3C,uFAA6E;AAC7E,+CAA4C;AAC5C,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAAiG;AAEjG,gDAAqG;AACrG,8CAA0E;AAE1E,8CAAgF;AAChF,kEAIwC;AACxC,uCAAwC;AA6HxC,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoKG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,aAAa,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAClC,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,EAC9C,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EACR,aAAa,EACb,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GACtF,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GAAG,IAAI,mBAAa,CAAC,KAAK,EAAE;YAC3C,GAAG;YACH,UAAU;YACV,YAAY;SACb,CAAC,CAAC;QAEH,MAAM,wBAAwB,GAC5B,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa;YACpD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,aAAa;YACb,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YACpE,WAAW,EAAE,6BAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACxG,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;SACZ,CAAC,CAAC;QAEH,mGAAmG;QACnG,6HAA6H;QAC7H,wDAAwD;QACxD,sFAAsF;QACtF,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,wBAAY,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EACL,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;oBACnC,CAAC,CAAC,cAAc;oBAChB,CAAC,CAAC,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;aAC1E;SACF,CAAC,CAAC;QAEH,IAAI,aAAa,CAAC,OAAO,EAAE;YACzB,MAAM,mBAAmB,GAAG,IAAI,wBAAiB,CAAC,KAAK,EAAE,qBAAqB,EAAE;gBAC9E,WAAW,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,WAAW;gBACtE,OAAO,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,IAAI;gBAC3D,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,YAAY,CAAC,aAAa,CACxB,eAAM,CAAC,cAAc,CACnB,KAAK,EACL,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,qBAAqB,CAAC,EACpD,mBAAmB,CAAC,aAAa,CAClC,EACD,aAAa,CAAC,MAAM,CACrB,CAAC;SACH;QAED,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM;SAC1C,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAExF,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AA9LD,4BA8LC","sourcesContent":["import { Duration, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice } from \"aws-cdk-lib/aws-autoscaling\";\nimport { HealthCheck } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port } from \"aws-cdk-lib/aws-ec2\";\nimport { ApplicationProtocol } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport { GuAlb5xxPercentageAlarm, GuUnhealthyInstancesAlarm } from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuLoggingStreamNameParameter, GuStringParameter } from \"../../constructs/core\";\nimport { GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport {\n  GuApplicationLoadBalancer,\n  GuApplicationTargetGroup,\n  GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\n\nexport interface AccessLoggingProps {\n  enabled: boolean;\n  prefix?: string;\n}\n\n/**\n * To ship your application logs to ELK automatically, you must:\n *\n * 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n *\n * Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n */\nexport interface ApplicationLoggingProps {\n  enabled: boolean;\n  /**\n   * Defaults to app name. That is, if your app runs as `<app>.service`\n   * (e.g. `janus.service`), this will 'just work'.\n   *\n   * If it runs with a non-standard name, you will need to override the default\n   * behavour. I.e. if your app is running as `some-different-name.service`, then\n   * this prop should be set to `some-different-name`.\n   */\n  systemdUnitName?: string;\n}\n\nexport interface Alarms {\n  snsTopicName: string;\n  http5xxAlarm: false | Http5xxAlarmProps;\n  unhealthyInstancesAlarm: boolean;\n  noMonitoring?: false;\n}\n\n/**\n * Configuration options for the [[`GuEc2App`]] pattern.\n *\n * To grant EC2 instances additional IAM permissions, use the `roleConfiguration` prop. For example,\n * to allow your app to write to DynamoDB:\n *\n * ```typescript\n * // other props\n * roleConfiguration: {\n *   additionalPolicies: [new GuDynamoDBWritePolicy(stack, \"DynamoTable\", { tableName: \"my-dynamo-table\" })],\n * }\n * ```\n *\n * To create alarms (recommended), use:\n * ```typescript\n * // other props\n * monitoringConfiguration: {\n *   snsTopicName: \"alerts-topic-for-my-team\",\n *   http5xxAlarm: {\n *     tolerated5xxPercentage: 1,\n *   },\n *   unhealthyInstancesAlarm: true,\n * }\n * ```\n *\n * To opt out of creating alarms, use:\n *```typescript\n * // other props\n * monitoringConfiguration: { noMonitoring: true }\n * ```\n *\n * To automatically ship application logs from `stdout` to ELK, use:\n *\n * ```typescript\n * {\n *   // other props\n *   applicationLogging: { enabled: true }\n * }\n * ```\n *\n * For more details on the requirements for application log shipping, see [[`ApplicationLoggingProps`]].\n *\n * To enable access logging for your load balancer, you can specify the prefix to write the logs to.\n * The S3 bucket used to hold these access logs must be specified in SSM at `/account/services/access-logging/bucket`\n * You must specify a region in your stack declaration if you are to use this prop, as specified here:\n * https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html#logwbraccesswbrlogsbucket-prefix\n * For example:\n * ```typescript\n * {\n *   // other props\n *   accessLogging: {\n *     enabled: true,\n *     prefix: \"my-application-logs\"\n *   }\n * }\n *\n * If you would like to enable access logging at the root of the S3 bucket (ie without a prefix), you can omit the prefix\n * For example:\n * ```typescript\n * {\n *   // other props\n *   accessLogging: {\n *     enabled: true,\n *   }\n * }\n * ```\n */\nexport interface GuEc2AppProps extends AppIdentity {\n  userData: GuUserDataProps | string;\n  access: AppAccess;\n  applicationPort: number;\n  roleConfiguration?: GuInstanceRoleProps;\n  monitoringConfiguration: Alarms | NoMonitoring;\n  instanceType: InstanceType;\n  applicationLogging?: ApplicationLoggingProps;\n  accessLogging?: AccessLoggingProps;\n  blockDevices?: BlockDevice[];\n  scaling: GuAsgCapacity;\n  certificateProps: GuDomainName;\n  withoutImdsv2?: boolean;\n  imageRecipe?: string;\n  vpc?: IVpc;\n  privateSubnets?: ISubnet[];\n}\n\nfunction restrictedCidrRanges(ranges: IPeer[]) {\n  return ranges.map((range) => ({\n    range,\n    port: Port.tcp(443),\n    description: `Allow access on port 443 from ${range.uniqueId}`,\n  }));\n}\n\n/**\n * Pattern which creates the resources needed to run an application on EC2 instances.\n * For convenience, you may wish to use [[`GuPlayApp`]] or [[`GuNodeApp`]], which extend this class.\n *\n * This pattern will grant your EC2 instances a number of commonly needed IAM permissions. For more information on\n * this, see [[`GuInstanceRole`]]. To add additional permissions to your EC2 instances, see [[`GuEc2AppProps`]].\n *\n * This pattern will automatically create security groups/rules which allow for:\n * 1. Incoming traffic over HTTPS (from the whole internet or from the specified CIDR ranges, depending on the\n * [[`AppAccess`]] specified).\n * 2. Communication between the load balancer and the EC2 instances over HTTP, via the specified application port.\n * 3. Outbound traffic from your EC2 instances over HTTPS (to enable communication with third-party APIs).\n *\n * Example usage for a public facing app (open to the internet):\n * ```typescript\n * new GuEc2App(stack, {\n *   applicationPort: 1234,\n *   app: \"app-name\",\n *   access: { scope: AccessScope.PUBLIC },\n *   instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),\n *   certificateProps:{\n *     domainName: \"prod-guardian.com\",\n *   },\n *   monitoringConfiguration: {\n *     snsTopicName: \"alerts-topic-for-my-team\",\n *     http5xxAlarm: {\n *       tolerated5xxPercentage: 1,\n *     },\n *     unhealthyInstancesAlarm: true,\n *   },\n *   userData: {\n *     distributable: {\n *       fileName: \"app-name.deb\",\n *       executionStatement: `dpkg -i /app-name/app-name.deb`,\n *     }\n *   },\n * });\n * ```\n *\n * Example usage for an app which is restricted to specific CIDR ranges:\n * ```typescript\n * new GuEc2App(stack, {\n *   applicationPort: 1234,\n *   app: \"app-name\",\n *   access: {\n *     scope: AccessScope.RESTRICTED,\n *     cidrRanges: [Peer.ipv4(\"192.168.1.1/32\"), Peer.ipv4(\"8.8.8.8/32\")],\n *   },\n *   instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),\n *   certificateProps:{\n *     domainName: \"prod-guardian.com\",\n *   },\n *   monitoringConfiguration: {\n *     snsTopicName: \"alerts-topic-for-my-team\",\n *     http5xxAlarm: {\n *       tolerated5xxPercentage: 1,\n *     },\n *     unhealthyInstancesAlarm: true,\n *   }\n *   userData: {\n *     distributable: {\n *       fileName: \"app-name.deb\",\n *       executionStatement: `dpkg -i /app-name/app-name.deb`,\n *     }\n *   },\n * });\n * ```\n *\n * ### Varying values by stage\n *\n * There are times when you want a resource's configuration to be stage aware,\n * for example the number of instances in an ASG.\n *\n * To do this, we can use a simple ternary:\n * ```typescript\n * new GuEc2App(this, {\n *   // other required properties\n *   scaling: this.stage === \"PROD\" ? { minimumInstances: 6 } : { minimumInstances: 1 }\n * });\n * ```\n *\n * If multiple properties need to be stage aware, consider encoding this into the `props` of the calling class:\n *\n * ```typescript\n * export interface MyAppProps extends GuStackProps {\n *   domainName: string;\n *   scaling: GuAsgCapacity;\n *   monitoringConfiguration: Alarms | NoMonitoring;\n * }\n *\n * export class MyApp extends GuStack {\n *   private static app = \"cdk-playground\";\n *\n *   constructor(scope: App, id: string, props: MyAppProps) {\n *     const { stage, domainName, scaling, monitoringConfiguration } = props;\n *\n *     super(scope, id, props);\n *\n *     new GuPlayApp(this, {\n *       app: \"my-app\",\n *       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MICRO),\n *       access: { scope: AccessScope.PUBLIC },\n *       userData: {\n *         distributable: {\n *           fileName: `my-app.deb`,\n *           executionStatement: `dpkg -i /my-app/my-app.deb`,\n *         },\n *       },\n *       certificateProps: {\n *         domainName,\n *       },\n *       monitoringConfiguration,\n *       scaling,\n *     });\n *   }\n * }\n *\n * new MyApp(app, \"MyApp-CODE\", {\n *   stage: \"CODE\",\n *   domainName: \"my-app.code.dev-gutools.co.uk\",\n *   scaling: { minimumInstances: 1 },\n *   monitoringConfiguration: { noMonitoring: true },\n * });\n *\n * new MyApp(app, \"MyApp-PROD\", {\n *   stage: \"PROD\",\n *   domainName: \"my-app.prod.gutools.co.uk\",\n *   scaling: { minimumInstances: 6 },\n *   monitoringConfiguration: {\n *     // config to enable alarms in PROD\n *   },\n * });\n * ```\n *\n * If you _must_ support a non-standard VPC setup, it's possible to override the VPC and subnet selection into which\n * instances will be started. This is done by setting the `vpc` and `privateSubnets` props.\n * You won't need to do this under normal circumstances, these will be set for you based on your account's defaults\n * which are suitable for most cases.\n *\n * ### Customising the infrastructure generated by this pattern\n *\n * Although we allow users to customise many aspects of their infrastructure via [[`GuEc2AppProps`]], it's possible\n * that there are less common use-cases which are currently unsupported via the API. In these circumstances escape\n * hatches can be used to override specific resources in the stack.\n *\n * In order to do this:\n *\n * 1. Create desired resource using Guardian or AWS constructs, for example:\n * ```typescript\n * const sg = new GuSecurityGroup(\n *   // custom parameters\n * );\n * ```\n * 2. Access the CloudFormation version of the resource that you wish to customise, for example:\n * ```typescript\n * const pattern = new GuEc2App(\n *   // all parameters\n * )\n * const cfnLb = pattern.loadBalancer.node.defaultChild as CfnLoadBalancer;\n * ```\n * 3. Replace the resource generated by the pattern with your bespoke resource, for example:\n * ```typescript\n * cfnLb.securityGroups = [sg.securityGroupId];\n * ```\n */\nexport class GuEc2App extends Construct {\n  /*\n   * These are public for now, as this allows users to\n   * modify these constructs as desired to fit their\n   * specific needs.\n   * In the future, we might build functionality to better enable users\n   * to access in-pattern constructs, but this would allow teams to be unblocked\n   * in the short term.\n   * */\n  public readonly vpc: IVpc;\n  public readonly certificate: GuCertificate;\n  public readonly loadBalancer: GuApplicationLoadBalancer;\n  public readonly autoScalingGroup: GuAutoScalingGroup;\n  public readonly listener: GuHttpsApplicationListener;\n  public readonly targetGroup: GuApplicationTargetGroup;\n\n  constructor(scope: GuStack, props: GuEc2AppProps) {\n    const {\n      access,\n      accessLogging = { enabled: false },\n      app,\n      // We should update this default once a significant number of apps have migrated to devx-logs\n      applicationLogging = { enabled: false },\n      applicationPort,\n      blockDevices,\n      certificateProps: { domainName, hostedZoneId },\n      instanceType,\n      monitoringConfiguration,\n      roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n      scaling: { minimumInstances, maximumInstances = minimumInstances * 2 },\n      userData,\n      withoutImdsv2,\n      imageRecipe,\n      vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n      privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n    } = props;\n\n    super(scope, app); // The assumption is `app` is unique\n\n    // We should really prevent users from doing this via the type system,\n    // but that requires a breaking change to the API\n    if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n      throw new Error(\n        \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n          \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\"\n      );\n    }\n\n    AppAccess.validate(access);\n\n    const certificate = new GuCertificate(scope, {\n      app,\n      domainName,\n      hostedZoneId,\n    });\n\n    const maybePrivateConfigPolicy =\n      typeof userData !== \"string\" && userData.configuration\n        ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n        : [];\n\n    const mergedRoleConfiguration: GuInstanceRoleProps = {\n      withoutLogShipping: roleConfiguration.withoutLogShipping,\n      additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n    };\n\n    const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n      app,\n      vpc,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      withoutImdsv2,\n      role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n      healthCheck: HealthCheck.elb({ grace: Duration.minutes(2) }), // should this be defaulted at pattern or construct level?\n      userData: typeof userData !== \"string\" ? new GuUserData(scope, { app, ...userData }).userData : userData,\n      vpcSubnets: { subnets: privateSubnets },\n      ...(blockDevices && { blockDevices }),\n      imageRecipe,\n    });\n\n    // We are selectively tagging the ASG so that we can expose the number of stacks using this pattern\n    //  based on which autoscaling groups possess this tag. It may become useful or necessary to tag all resources in the future,\n    //  but we have decided that this is sufficient for now.\n    // TODO: Do we need to tag all resources with this value? What would the use-cases be?\n    Tags.of(autoScalingGroup).add(MetadataKeys.PATTERN_NAME, this.constructor.name, { applyToLaunchedInstances: true });\n\n    // This allows automatic shipping of instance Cloud Init logs when using the\n    // `cdk-base` Amigo role on your AMI.\n    Tags.of(autoScalingGroup).add(\n      MetadataKeys.LOG_KINESIS_STREAM_NAME,\n      GuLoggingStreamNameParameter.getInstance(scope).valueAsString\n    );\n\n    if (applicationLogging.enabled) {\n      // This allows automatic shipping of application logs when using the\n      // `cdk-base` Amigo role on your AMI.\n      Tags.of(autoScalingGroup).add(\n        MetadataKeys.SYSTEMD_UNIT,\n        applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`\n      );\n    }\n\n    const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n      app,\n      vpc,\n      // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n      internetFacing: access.scope !== AccessScope.INTERNAL,\n      vpcSubnets: {\n        subnets:\n          access.scope === AccessScope.INTERNAL\n            ? privateSubnets\n            : GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n      },\n    });\n\n    if (accessLogging.enabled) {\n      const accessLoggingBucket = new GuStringParameter(scope, \"AccessLoggingBucket\", {\n        description: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.description,\n        default: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.path,\n        fromSSM: true,\n      });\n\n      loadBalancer.logAccessLogs(\n        Bucket.fromBucketName(\n          scope,\n          AppIdentity.suffixText(props, \"AccessLoggingBucket\"),\n          accessLoggingBucket.valueAsString\n        ),\n        accessLogging.prefix\n      );\n    }\n\n    const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n      app,\n      vpc,\n      protocol: ApplicationProtocol.HTTP,\n      targets: [autoScalingGroup],\n      port: applicationPort,\n    });\n\n    const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n      app,\n      loadBalancer,\n      certificate,\n      targetGroup,\n      // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n      open: access.scope === AccessScope.PUBLIC,\n    });\n\n    // Since AWS won't create a security group automatically when open=false, we need to add our own\n    if (access.scope !== AccessScope.PUBLIC) {\n      loadBalancer.addSecurityGroup(\n        new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n          app,\n          vpc,\n          description: \"Allow restricted ingress from CIDR ranges\",\n          allowAllOutbound: false,\n          ingresses: restrictedCidrRanges(access.cidrRanges),\n        })\n      );\n    }\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const { http5xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n      if (http5xxAlarm) {\n        new GuAlb5xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http5xxAlarm,\n        });\n      }\n      if (unhealthyInstancesAlarm) {\n        new GuUnhealthyInstancesAlarm(scope, {\n          app,\n          targetGroup,\n          snsTopicName,\n        });\n      }\n    }\n\n    this.vpc = vpc;\n    this.certificate = certificate;\n    this.loadBalancer = loadBalancer;\n    this.autoScalingGroup = autoScalingGroup;\n    this.listener = listener;\n    this.targetGroup = targetGroup;\n  }\n}\n"]}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;AAAA,6CAA6C;AAE7C,iEAA0D;AAE1D,iDAA2C;AAC3C,uFAA6E;AAC7E,+CAA4C;AAC5C,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAAiG;AAEjG,gDAAqG;AACrG,8CAA0E;AAE1E,8CAAgF;AAChF,kEAIwC;AACxC,uCAAwC;AA8HxC,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2KG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,aAAa,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAClC,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,EAC9C,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EACR,aAAa,EACb,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GACpF,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GAAG,IAAI,mBAAa,CAAC,KAAK,EAAE;YAC3C,GAAG;YACH,UAAU;YACV,YAAY;SACb,CAAC,CAAC;QAEH,MAAM,wBAAwB,GAC5B,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa;YACpD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,aAAa;YACb,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YACpE,WAAW,EAAE,6BAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACxG,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;SACZ,CAAC,CAAC;QAEH,mGAAmG;QACnG,6HAA6H;QAC7H,wDAAwD;QACxD,sFAAsF;QACtF,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,wBAAY,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;SACF,CAAC,CAAC;QAEH,IAAI,aAAa,CAAC,OAAO,EAAE;YACzB,MAAM,mBAAmB,GAAG,IAAI,wBAAiB,CAAC,KAAK,EAAE,qBAAqB,EAAE;gBAC9E,WAAW,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,WAAW;gBACtE,OAAO,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,IAAI;gBAC3D,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,YAAY,CAAC,aAAa,CACxB,eAAM,CAAC,cAAc,CACnB,KAAK,EACL,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,qBAAqB,CAAC,EACpD,mBAAmB,CAAC,aAAa,CAClC,EACD,aAAa,CAAC,MAAM,CACrB,CAAC;SACH;QAED,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM;SAC1C,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAExF,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AA5LD,4BA4LC","sourcesContent":["import { Duration, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice } from \"aws-cdk-lib/aws-autoscaling\";\nimport { HealthCheck } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port } from \"aws-cdk-lib/aws-ec2\";\nimport { ApplicationProtocol } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport { GuAlb5xxPercentageAlarm, GuUnhealthyInstancesAlarm } from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuLoggingStreamNameParameter, GuStringParameter } from \"../../constructs/core\";\nimport { GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport {\n  GuApplicationLoadBalancer,\n  GuApplicationTargetGroup,\n  GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\n\nexport interface AccessLoggingProps {\n  enabled: boolean;\n  prefix?: string;\n}\n\n/**\n * To ship your application logs to ELK automatically, you must:\n *\n * 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n *\n * Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n */\nexport interface ApplicationLoggingProps {\n  enabled: boolean;\n  /**\n   * Defaults to app name. That is, if your app runs as `<app>.service`\n   * (e.g. `janus.service`), this will 'just work'.\n   *\n   * If it runs with a non-standard name, you will need to override the default\n   * behavour. I.e. if your app is running as `some-different-name.service`, then\n   * this prop should be set to `some-different-name`.\n   */\n  systemdUnitName?: string;\n}\n\nexport interface Alarms {\n  snsTopicName: string;\n  http5xxAlarm: false | Http5xxAlarmProps;\n  unhealthyInstancesAlarm: boolean;\n  noMonitoring?: false;\n}\n\n/**\n * Configuration options for the [[`GuEc2App`]] pattern.\n *\n * To grant EC2 instances additional IAM permissions, use the `roleConfiguration` prop. For example,\n * to allow your app to write to DynamoDB:\n *\n * ```typescript\n * // other props\n * roleConfiguration: {\n *   additionalPolicies: [new GuDynamoDBWritePolicy(stack, \"DynamoTable\", { tableName: \"my-dynamo-table\" })],\n * }\n * ```\n *\n * To create alarms (recommended), use:\n * ```typescript\n * // other props\n * monitoringConfiguration: {\n *   snsTopicName: \"alerts-topic-for-my-team\",\n *   http5xxAlarm: {\n *     tolerated5xxPercentage: 1,\n *   },\n *   unhealthyInstancesAlarm: true,\n * }\n * ```\n *\n * To opt out of creating alarms, use:\n *```typescript\n * // other props\n * monitoringConfiguration: { noMonitoring: true }\n * ```\n *\n * To automatically ship application logs from `stdout` to ELK, use:\n *\n * ```typescript\n * {\n *   // other props\n *   applicationLogging: { enabled: true }\n * }\n * ```\n *\n * For more details on the requirements for application log shipping, see [[`ApplicationLoggingProps`]].\n *\n * To enable access logging for your load balancer, you can specify the prefix to write the logs to.\n * The S3 bucket used to hold these access logs must be specified in SSM at `/account/services/access-logging/bucket`\n * You must specify a region in your stack declaration if you are to use this prop, as specified here:\n * https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html#logwbraccesswbrlogsbucket-prefix\n * For example:\n * ```typescript\n * {\n *   // other props\n *   accessLogging: {\n *     enabled: true,\n *     prefix: \"my-application-logs\"\n *   }\n * }\n *\n * If you would like to enable access logging at the root of the S3 bucket (ie without a prefix), you can omit the prefix\n * For example:\n * ```typescript\n * {\n *   // other props\n *   accessLogging: {\n *     enabled: true,\n *   }\n * }\n * ```\n */\nexport interface GuEc2AppProps extends AppIdentity {\n  userData: GuUserDataProps | string;\n  access: AppAccess;\n  applicationPort: number;\n  roleConfiguration?: GuInstanceRoleProps;\n  monitoringConfiguration: Alarms | NoMonitoring;\n  instanceType: InstanceType;\n  applicationLogging?: ApplicationLoggingProps;\n  accessLogging?: AccessLoggingProps;\n  blockDevices?: BlockDevice[];\n  scaling: GuAsgCapacity;\n  certificateProps: GuDomainName;\n  withoutImdsv2?: boolean;\n  imageRecipe?: string;\n  vpc?: IVpc;\n  privateSubnets?: ISubnet[];\n  publicSubnets?: ISubnet[];\n}\n\nfunction restrictedCidrRanges(ranges: IPeer[]) {\n  return ranges.map((range) => ({\n    range,\n    port: Port.tcp(443),\n    description: `Allow access on port 443 from ${range.uniqueId}`,\n  }));\n}\n\n/**\n * Pattern which creates the resources needed to run an application on EC2 instances.\n * For convenience, you may wish to use [[`GuPlayApp`]] or [[`GuNodeApp`]], which extend this class.\n *\n * This pattern will grant your EC2 instances a number of commonly needed IAM permissions. For more information on\n * this, see [[`GuInstanceRole`]]. To add additional permissions to your EC2 instances, see [[`GuEc2AppProps`]].\n *\n * This pattern will automatically create security groups/rules which allow for:\n * 1. Incoming traffic over HTTPS (from the whole internet or from the specified CIDR ranges, depending on the\n * [[`AppAccess`]] specified).\n * 2. Communication between the load balancer and the EC2 instances over HTTP, via the specified application port.\n * 3. Outbound traffic from your EC2 instances over HTTPS (to enable communication with third-party APIs).\n *\n * Example usage for a public facing app (open to the internet):\n * ```typescript\n * new GuEc2App(stack, {\n *   applicationPort: 1234,\n *   app: \"app-name\",\n *   access: { scope: AccessScope.PUBLIC },\n *   instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),\n *   certificateProps:{\n *     domainName: \"prod-guardian.com\",\n *   },\n *   monitoringConfiguration: {\n *     snsTopicName: \"alerts-topic-for-my-team\",\n *     http5xxAlarm: {\n *       tolerated5xxPercentage: 1,\n *     },\n *     unhealthyInstancesAlarm: true,\n *   },\n *   userData: {\n *     distributable: {\n *       fileName: \"app-name.deb\",\n *       executionStatement: `dpkg -i /app-name/app-name.deb`,\n *     }\n *   },\n * });\n * ```\n *\n * Example usage for an app which is restricted to specific CIDR ranges:\n * ```typescript\n * new GuEc2App(stack, {\n *   applicationPort: 1234,\n *   app: \"app-name\",\n *   access: {\n *     scope: AccessScope.RESTRICTED,\n *     cidrRanges: [Peer.ipv4(\"192.168.1.1/32\"), Peer.ipv4(\"8.8.8.8/32\")],\n *   },\n *   instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),\n *   certificateProps:{\n *     domainName: \"prod-guardian.com\",\n *   },\n *   monitoringConfiguration: {\n *     snsTopicName: \"alerts-topic-for-my-team\",\n *     http5xxAlarm: {\n *       tolerated5xxPercentage: 1,\n *     },\n *     unhealthyInstancesAlarm: true,\n *   }\n *   userData: {\n *     distributable: {\n *       fileName: \"app-name.deb\",\n *       executionStatement: `dpkg -i /app-name/app-name.deb`,\n *     }\n *   },\n * });\n * ```\n *\n * ### Varying values by stage\n *\n * There are times when you want a resource's configuration to be stage aware,\n * for example the number of instances in an ASG.\n *\n * To do this, we can use a simple ternary:\n * ```typescript\n * new GuEc2App(this, {\n *   // other required properties\n *   scaling: this.stage === \"PROD\" ? { minimumInstances: 6 } : { minimumInstances: 1 }\n * });\n * ```\n *\n * If multiple properties need to be stage aware, consider encoding this into the `props` of the calling class:\n *\n * ```typescript\n * export interface MyAppProps extends GuStackProps {\n *   domainName: string;\n *   scaling: GuAsgCapacity;\n *   monitoringConfiguration: Alarms | NoMonitoring;\n * }\n *\n * export class MyApp extends GuStack {\n *   private static app = \"cdk-playground\";\n *\n *   constructor(scope: App, id: string, props: MyAppProps) {\n *     const { stage, domainName, scaling, monitoringConfiguration } = props;\n *\n *     super(scope, id, props);\n *\n *     new GuPlayApp(this, {\n *       app: \"my-app\",\n *       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MICRO),\n *       access: { scope: AccessScope.PUBLIC },\n *       userData: {\n *         distributable: {\n *           fileName: `my-app.deb`,\n *           executionStatement: `dpkg -i /my-app/my-app.deb`,\n *         },\n *       },\n *       certificateProps: {\n *         domainName,\n *       },\n *       monitoringConfiguration,\n *       scaling,\n *     });\n *   }\n * }\n *\n * new MyApp(app, \"MyApp-CODE\", {\n *   stage: \"CODE\",\n *   domainName: \"my-app.code.dev-gutools.co.uk\",\n *   scaling: { minimumInstances: 1 },\n *   monitoringConfiguration: { noMonitoring: true },\n * });\n *\n * new MyApp(app, \"MyApp-PROD\", {\n *   stage: \"PROD\",\n *   domainName: \"my-app.prod.gutools.co.uk\",\n *   scaling: { minimumInstances: 6 },\n *   monitoringConfiguration: {\n *     // config to enable alarms in PROD\n *   },\n * });\n * ```\n *\n * If you _must_ support a non-standard VPC setup, it's possible to override the VPC and subnet selection into which\n * instances will be started. You need to set the three props below in order for this to work:\n *  vpc: this must be an IVpc instance indicating the VPC to deploy into (usually obtained from `Vpc.fromVpcAttributes`)\n *  privateSubnets: a list of ISubnet indicating the subnets for the autoscaling group to deploy instances into (usually\n *    obtained from `GuVpc.subnets`)\n *  publicSubnets: a list of ISubnet indicating the subnets for the loadbalancer to use, if the loadbalancer\n *    is intended for public access (usually obtained from `GuVpc.subnets`)\n *    On the other hand, if the access is private, then an \"internal\" loadbalancer is used in the `privateSubnets` list.\n * Please note that no checking is applied to the subnet lists to ensure that they correspond to the vpc given; as\n * an advanced feature it is assumed that the caller ensures this.  If the subnets are mismatched then the resulting\n * Cloudformation will fail to deploy.\n *\n * ### Customising the infrastructure generated by this pattern\n *\n * Although we allow users to customise many aspects of their infrastructure via [[`GuEc2AppProps`]], it's possible\n * that there are less common use-cases which are currently unsupported via the API. In these circumstances escape\n * hatches can be used to override specific resources in the stack.\n *\n * In order to do this:\n *\n * 1. Create desired resource using Guardian or AWS constructs, for example:\n * ```typescript\n * const sg = new GuSecurityGroup(\n *   // custom parameters\n * );\n * ```\n * 2. Access the CloudFormation version of the resource that you wish to customise, for example:\n * ```typescript\n * const pattern = new GuEc2App(\n *   // all parameters\n * )\n * const cfnLb = pattern.loadBalancer.node.defaultChild as CfnLoadBalancer;\n * ```\n * 3. Replace the resource generated by the pattern with your bespoke resource, for example:\n * ```typescript\n * cfnLb.securityGroups = [sg.securityGroupId];\n * ```\n */\nexport class GuEc2App extends Construct {\n  /*\n   * These are public for now, as this allows users to\n   * modify these constructs as desired to fit their\n   * specific needs.\n   * In the future, we might build functionality to better enable users\n   * to access in-pattern constructs, but this would allow teams to be unblocked\n   * in the short term.\n   * */\n  public readonly vpc: IVpc;\n  public readonly certificate: GuCertificate;\n  public readonly loadBalancer: GuApplicationLoadBalancer;\n  public readonly autoScalingGroup: GuAutoScalingGroup;\n  public readonly listener: GuHttpsApplicationListener;\n  public readonly targetGroup: GuApplicationTargetGroup;\n\n  constructor(scope: GuStack, props: GuEc2AppProps) {\n    const {\n      access,\n      accessLogging = { enabled: false },\n      app,\n      // We should update this default once a significant number of apps have migrated to devx-logs\n      applicationLogging = { enabled: false },\n      applicationPort,\n      blockDevices,\n      certificateProps: { domainName, hostedZoneId },\n      instanceType,\n      monitoringConfiguration,\n      roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n      scaling: { minimumInstances, maximumInstances = minimumInstances * 2 },\n      userData,\n      withoutImdsv2,\n      imageRecipe,\n      vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n      privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n      publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n    } = props;\n\n    super(scope, app); // The assumption is `app` is unique\n\n    // We should really prevent users from doing this via the type system,\n    // but that requires a breaking change to the API\n    if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n      throw new Error(\n        \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n          \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\"\n      );\n    }\n\n    AppAccess.validate(access);\n\n    const certificate = new GuCertificate(scope, {\n      app,\n      domainName,\n      hostedZoneId,\n    });\n\n    const maybePrivateConfigPolicy =\n      typeof userData !== \"string\" && userData.configuration\n        ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n        : [];\n\n    const mergedRoleConfiguration: GuInstanceRoleProps = {\n      withoutLogShipping: roleConfiguration.withoutLogShipping,\n      additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n    };\n\n    const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n      app,\n      vpc,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      withoutImdsv2,\n      role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n      healthCheck: HealthCheck.elb({ grace: Duration.minutes(2) }), // should this be defaulted at pattern or construct level?\n      userData: typeof userData !== \"string\" ? new GuUserData(scope, { app, ...userData }).userData : userData,\n      vpcSubnets: { subnets: privateSubnets },\n      ...(blockDevices && { blockDevices }),\n      imageRecipe,\n    });\n\n    // We are selectively tagging the ASG so that we can expose the number of stacks using this pattern\n    //  based on which autoscaling groups possess this tag. It may become useful or necessary to tag all resources in the future,\n    //  but we have decided that this is sufficient for now.\n    // TODO: Do we need to tag all resources with this value? What would the use-cases be?\n    Tags.of(autoScalingGroup).add(MetadataKeys.PATTERN_NAME, this.constructor.name, { applyToLaunchedInstances: true });\n\n    // This allows automatic shipping of instance Cloud Init logs when using the\n    // `cdk-base` Amigo role on your AMI.\n    Tags.of(autoScalingGroup).add(\n      MetadataKeys.LOG_KINESIS_STREAM_NAME,\n      GuLoggingStreamNameParameter.getInstance(scope).valueAsString\n    );\n\n    if (applicationLogging.enabled) {\n      // This allows automatic shipping of application logs when using the\n      // `cdk-base` Amigo role on your AMI.\n      Tags.of(autoScalingGroup).add(\n        MetadataKeys.SYSTEMD_UNIT,\n        applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`\n      );\n    }\n\n    const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n      app,\n      vpc,\n      // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n      internetFacing: access.scope !== AccessScope.INTERNAL,\n      vpcSubnets: {\n        subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n      },\n    });\n\n    if (accessLogging.enabled) {\n      const accessLoggingBucket = new GuStringParameter(scope, \"AccessLoggingBucket\", {\n        description: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.description,\n        default: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.path,\n        fromSSM: true,\n      });\n\n      loadBalancer.logAccessLogs(\n        Bucket.fromBucketName(\n          scope,\n          AppIdentity.suffixText(props, \"AccessLoggingBucket\"),\n          accessLoggingBucket.valueAsString\n        ),\n        accessLogging.prefix\n      );\n    }\n\n    const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n      app,\n      vpc,\n      protocol: ApplicationProtocol.HTTP,\n      targets: [autoScalingGroup],\n      port: applicationPort,\n    });\n\n    const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n      app,\n      loadBalancer,\n      certificate,\n      targetGroup,\n      // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n      open: access.scope === AccessScope.PUBLIC,\n    });\n\n    // Since AWS won't create a security group automatically when open=false, we need to add our own\n    if (access.scope !== AccessScope.PUBLIC) {\n      loadBalancer.addSecurityGroup(\n        new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n          app,\n          vpc,\n          description: \"Allow restricted ingress from CIDR ranges\",\n          allowAllOutbound: false,\n          ingresses: restrictedCidrRanges(access.cidrRanges),\n        })\n      );\n    }\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const { http5xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n      if (http5xxAlarm) {\n        new GuAlb5xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http5xxAlarm,\n        });\n      }\n      if (unhealthyInstancesAlarm) {\n        new GuUnhealthyInstancesAlarm(scope, {\n          app,\n          targetGroup,\n          snsTopicName,\n        });\n      }\n    }\n\n    this.vpc = vpc;\n    this.certificate = certificate;\n    this.loadBalancer = loadBalancer;\n    this.autoScalingGroup = autoScalingGroup;\n    this.listener = listener;\n    this.targetGroup = targetGroup;\n  }\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@guardian/cdk",
   "description": "Generic Guardian flavoured AWS CDK components",
-  "version": "48.0.1",
+  "version": "48.2.0-beta.1",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [
@@ -30,31 +30,31 @@
   "devDependencies": {
     "@guardian/eslint-config-typescript": "1.0.11",
     "@types/git-url-parse": "^9.0.1",
-    "@types/jest": "^29.1.1",
+    "@types/jest": "^29.2.0",
     "@types/js-yaml": "^4.0.5",
     "@types/lodash.camelcase": "^4.3.7",
     "@types/lodash.kebabcase": "^4.1.7",
     "@types/lodash.upperfirst": "^4.3.7",
-    "@types/node": "18.8.2",
+    "@types/node": "18.11.2",
     "@types/yargs": "^17.0.13",
     "aws-cdk": "2.45.0",
     "cz-conventional-changelog": "^3.3.0",
-    "eslint": "^8.24.0",
+    "eslint": "^8.25.0",
     "eslint-plugin-custom-rules": "file:tools/eslint",
     "gh-pages": "^4.0.0",
-    "jest": "^29.1.2",
+    "jest": "^29.2.1",
     "prettier": "^2.7.1",
     "semantic-release": "^19.0.5",
     "serve": "^14.0.1",
     "ts-jest": "^29.0.3",
     "ts-node": "^10.9.1",
-    "typedoc": "^0.23.15",
+    "typedoc": "^0.23.17",
     "typescript": "~4.8.4"
   },
   "dependencies": {
-    "@oclif/core": "1.16.4",
+    "@oclif/core": "1.16.5",
     "aws-cdk-lib": "2.45.0",
-    "aws-sdk": "^2.1229.0",
+    "aws-sdk": "^2.1235.0",
     "chalk": "^4.1.2",
     "codemaker": "^1.69.0",
     "constructs": "10.1.127",