@guardian/cdk 49.0.1 → 49.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/constructs/iam/policies/index.d.ts +0 -1
- package/lib/constructs/iam/policies/index.d.ts.map +1 -1
- package/lib/constructs/iam/policies/index.js +0 -1
- package/lib/constructs/iam/policies/index.js.map +1 -1
- package/lib/constructs/iam/roles/instance-role.d.ts.map +1 -1
- package/lib/constructs/iam/roles/instance-role.js +2 -1
- package/lib/constructs/iam/roles/instance-role.js.map +1 -1
- package/package.json +7 -7
- package/lib/constructs/iam/policies/ssm.d.ts +0 -8
- package/lib/constructs/iam/policies/ssm.d.ts.map +0 -1
- package/lib/constructs/iam/policies/ssm.js +0 -37
- package/lib/constructs/iam/policies/ssm.js.map +0 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/policies/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,OAAO,CAAC
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/policies/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,OAAO,CAAC"}
|
|
@@ -25,5 +25,4 @@ __exportStar(require("./parameter-store-read"), exports);
|
|
|
25
25
|
__exportStar(require("./s3-get-object"), exports);
|
|
26
26
|
__exportStar(require("./s3-put-object"), exports);
|
|
27
27
|
__exportStar(require("./ses"), exports);
|
|
28
|
-
__exportStar(require("./ssm"), exports);
|
|
29
28
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/constructs/iam/policies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,gDAA8B;AAC9B,gDAA8B;AAC9B,+CAA6B;AAC7B,iDAA+B;AAC/B,6CAA2B;AAC3B,iDAA+B;AAC/B,yDAAuC;AACvC,kDAAgC;AAChC,kDAAgC;AAChC,wCAAsB
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/constructs/iam/policies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,gDAA8B;AAC9B,gDAA8B;AAC9B,+CAA6B;AAC7B,iDAA+B;AAC/B,6CAA2B;AAC3B,iDAA+B;AAC/B,yDAAuC;AACvC,kDAAgC;AAChC,kDAAgC;AAChC,wCAAsB","sourcesContent":["export * from \"./anghammarad\";\nexport * from \"./assume-role\";\nexport * from \"./base-policy\";\nexport * from \"./cloudwatch\";\nexport * from \"./describe-ec2\";\nexport * from \"./dynamodb\";\nexport * from \"./log-shipping\";\nexport * from \"./parameter-store-read\";\nexport * from \"./s3-get-object\";\nexport * from \"./s3-put-object\";\nexport * from \"./ses\";\n"]}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"instance-role.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/instance-role.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"instance-role.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/instance-role.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAOvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC;CACjC;AAED,MAAM,MAAM,0BAA0B,GAAG,mBAAmB,GAAG,WAAW,CAAC;;;;;;AAE3E;;;;;;;;;;;;;;GAcG;AACH,qBAAa,cAAe,SAAQ,mBAA2B;gBACjD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,0BAA0B;CAwB9D"}
|
|
@@ -28,7 +28,6 @@ class GuInstanceRole extends (0, app_aware_construct_1.GuAppAwareConstruct)(role
|
|
|
28
28
|
...props,
|
|
29
29
|
});
|
|
30
30
|
const sharedPolicies = [
|
|
31
|
-
policies_1.GuSSMRunCommandPolicy.getInstance(scope),
|
|
32
31
|
policies_1.GuDescribeEC2Policy.getInstance(scope),
|
|
33
32
|
...(props.withoutLogShipping ? [] : [policies_1.GuLogShippingPolicy.getInstance(scope)]),
|
|
34
33
|
];
|
|
@@ -38,7 +37,9 @@ class GuInstanceRole extends (0, app_aware_construct_1.GuAppAwareConstruct)(role
|
|
|
38
37
|
new policies_1.GuParameterStoreReadPolicy(scope, props),
|
|
39
38
|
...(props.additionalPolicies ? props.additionalPolicies : []),
|
|
40
39
|
];
|
|
40
|
+
const managedPolicies = [aws_iam_1.ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore")];
|
|
41
41
|
policies.forEach((p) => p.attachToRole(this));
|
|
42
|
+
managedPolicies.forEach((p) => this.addManagedPolicy(p));
|
|
42
43
|
}
|
|
43
44
|
}
|
|
44
45
|
exports.GuInstanceRole = GuInstanceRole;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"instance-role.js","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/instance-role.ts"],"names":[],"mappings":";;;AAAA,
|
|
1
|
+
{"version":3,"file":"instance-role.js","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/instance-role.ts"],"names":[],"mappings":";;;AAAA,iDAAsE;AACtE,kFAA+E;AAE/E,0CAKqB;AAErB,mCAAiC;AAgBjC;;;;;;;;;;;;;;GAcG;AACH,MAAa,cAAe,SAAQ,IAAA,yCAAmB,EAAC,cAAM,CAAC;IAC7D,YAAY,KAAc,EAAE,KAAiC;QAC3D,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE;YAC3B,IAAI,EAAE,GAAG;YACT,SAAS,EAAE,IAAI,0BAAgB,CAAC,mBAAmB,CAAC;YACpD,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG;YACrB,8BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;SAC9E,CAAC;QAEF,MAAM,QAAQ,GAAG;YACf,GAAG,cAAc;YACjB,IAAI,mCAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;YAC1C,IAAI,qCAA0B,CAAC,KAAK,EAAE,KAAK,CAAC;YAC5C,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QAEF,MAAM,eAAe,GAAG,CAAC,uBAAa,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAEjG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;CACF;AAzBD,wCAyBC","sourcesContent":["import { ManagedPolicy, ServicePrincipal } from \"aws-cdk-lib/aws-iam\";\nimport { GuAppAwareConstruct } from \"../../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../../core\";\nimport {\n GuDescribeEC2Policy,\n GuGetDistributablePolicy,\n GuLogShippingPolicy,\n GuParameterStoreReadPolicy,\n} from \"../policies\";\nimport type { GuPolicy } from \"../policies\";\nimport { GuRole } from \"./roles\";\n\nexport interface GuInstanceRoleProps {\n /**\n * By default, instances are given permissions to write to Kinesis. Set to\n * 'true' to prevent this. Note, disabling will prevent not just application\n * logs being shipped but also anything else - for example, automatic log\n * shipping of Cloud Init and other logs by the cdk-base role in your AMI.\n */\n withoutLogShipping?: boolean;\n\n additionalPolicies?: GuPolicy[];\n}\n\nexport type GuInstanceRolePropsWithApp = GuInstanceRoleProps & AppIdentity;\n\n/**\n * Creates an IAM role with common policies that are needed by most Guardian applications.\n *\n * More specifically:\n * 1. Allows for `ssh` access to an EC2 instance via [ssm-scala](https://github.com/guardian/ssm-scala) (instead of standard `ssh`).\n * 2. Allows EC2 instances to communicate with Wazuh, for security monitoring.\n * 3. Allows EC2 instances to download an artifact from AWS S3, for application deployment.\n * 4. Allows EC2 instances to download private configuration from AWS Parameter Store. See [[`GuParameterStoreReadPolicy`]]\n * for specific details.\n * 5. Allows EC2 instances to write logs into our central ELK stack via Kinesis.\n *\n * If additional IAM permissions are required, create custom policies and pass them in via the `additionalPolicies` prop.\n *\n * If log shipping is not required, opt out by setting the `withoutLogShipping` prop to `true`.\n */\nexport class GuInstanceRole extends GuAppAwareConstruct(GuRole) {\n constructor(scope: GuStack, props: GuInstanceRolePropsWithApp) {\n super(scope, \"InstanceRole\", {\n path: \"/\",\n assumedBy: new ServicePrincipal(\"ec2.amazonaws.com\"),\n ...props,\n });\n\n const sharedPolicies = [\n GuDescribeEC2Policy.getInstance(scope),\n ...(props.withoutLogShipping ? [] : [GuLogShippingPolicy.getInstance(scope)]),\n ];\n\n const policies = [\n ...sharedPolicies,\n new GuGetDistributablePolicy(scope, props),\n new GuParameterStoreReadPolicy(scope, props),\n ...(props.additionalPolicies ? props.additionalPolicies : []),\n ];\n\n const managedPolicies = [ManagedPolicy.fromAwsManagedPolicyName(\"AmazonSSMManagedInstanceCore\")];\n\n policies.forEach((p) => p.attachToRole(this));\n managedPolicies.forEach((p) => this.addManagedPolicy(p));\n }\n}\n"]}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@guardian/cdk",
|
|
3
3
|
"description": "Generic Guardian flavoured AWS CDK components",
|
|
4
|
-
"version": "49.0.
|
|
4
|
+
"version": "49.0.2",
|
|
5
5
|
"main": "lib/index.js",
|
|
6
6
|
"types": "lib/index.d.ts",
|
|
7
7
|
"files": [
|
|
@@ -43,20 +43,20 @@
|
|
|
43
43
|
"eslint-plugin-custom-rules": "file:tools/eslint",
|
|
44
44
|
"gh-pages": "^4.0.0",
|
|
45
45
|
"jest": "^29.3.1",
|
|
46
|
-
"prettier": "^2.8.
|
|
46
|
+
"prettier": "^2.8.3",
|
|
47
47
|
"semantic-release": "^19.0.5",
|
|
48
48
|
"serve": "^14.1.2",
|
|
49
|
-
"ts-jest": "^29.0.
|
|
49
|
+
"ts-jest": "^29.0.5",
|
|
50
50
|
"ts-node": "^10.9.1",
|
|
51
|
-
"typedoc": "^0.23.
|
|
51
|
+
"typedoc": "^0.23.24",
|
|
52
52
|
"typescript": "~4.9.4"
|
|
53
53
|
},
|
|
54
54
|
"dependencies": {
|
|
55
|
-
"@oclif/core": "1.
|
|
55
|
+
"@oclif/core": "1.24.2",
|
|
56
56
|
"aws-cdk-lib": "2.59.0",
|
|
57
|
-
"aws-sdk": "^2.
|
|
57
|
+
"aws-sdk": "^2.1296.0",
|
|
58
58
|
"chalk": "^4.1.2",
|
|
59
|
-
"codemaker": "^1.
|
|
59
|
+
"codemaker": "^1.73.0",
|
|
60
60
|
"constructs": "10.1.215",
|
|
61
61
|
"git-url-parse": "^13.1.0",
|
|
62
62
|
"js-yaml": "^4.1.0",
|
|
@@ -1,8 +0,0 @@
|
|
|
1
|
-
import type { GuStack } from "../../core";
|
|
2
|
-
import { GuAllowPolicy } from "./base-policy";
|
|
3
|
-
export declare class GuSSMRunCommandPolicy extends GuAllowPolicy {
|
|
4
|
-
private static instance;
|
|
5
|
-
private constructor();
|
|
6
|
-
static getInstance(stack: GuStack): GuSSMRunCommandPolicy;
|
|
7
|
-
}
|
|
8
|
-
//# sourceMappingURL=ssm.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"ssm.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/policies/ssm.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,qBAAa,qBAAsB,SAAQ,aAAa;IACtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAoC;IAE3D,OAAO;WAuBO,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB;CAOjE"}
|
|
@@ -1,37 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.GuSSMRunCommandPolicy = void 0;
|
|
4
|
-
const singleton_1 = require("../../../utils/singleton");
|
|
5
|
-
const base_policy_1 = require("./base-policy");
|
|
6
|
-
class GuSSMRunCommandPolicy extends base_policy_1.GuAllowPolicy {
|
|
7
|
-
constructor(scope) {
|
|
8
|
-
super(scope, "SSMRunCommandPolicy", {
|
|
9
|
-
policyName: "ssm-run-command-policy",
|
|
10
|
-
resources: ["*"],
|
|
11
|
-
actions: [
|
|
12
|
-
"ec2messages:AcknowledgeMessage",
|
|
13
|
-
"ec2messages:DeleteMessage",
|
|
14
|
-
"ec2messages:FailMessage",
|
|
15
|
-
"ec2messages:GetEndpoint",
|
|
16
|
-
"ec2messages:GetMessages",
|
|
17
|
-
"ec2messages:SendReply",
|
|
18
|
-
"ssm:UpdateInstanceInformation",
|
|
19
|
-
"ssm:ListInstanceAssociations",
|
|
20
|
-
"ssm:DescribeInstanceProperties",
|
|
21
|
-
"ssm:DescribeDocumentParameters",
|
|
22
|
-
"ssmmessages:CreateControlChannel",
|
|
23
|
-
"ssmmessages:CreateDataChannel",
|
|
24
|
-
"ssmmessages:OpenControlChannel",
|
|
25
|
-
"ssmmessages:OpenDataChannel",
|
|
26
|
-
],
|
|
27
|
-
});
|
|
28
|
-
}
|
|
29
|
-
static getInstance(stack) {
|
|
30
|
-
if (!this.instance || !(0, singleton_1.isSingletonPresentInStack)(stack, this.instance)) {
|
|
31
|
-
this.instance = new GuSSMRunCommandPolicy(stack);
|
|
32
|
-
}
|
|
33
|
-
return this.instance;
|
|
34
|
-
}
|
|
35
|
-
}
|
|
36
|
-
exports.GuSSMRunCommandPolicy = GuSSMRunCommandPolicy;
|
|
37
|
-
//# sourceMappingURL=ssm.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"ssm.js","sourceRoot":"","sources":["../../../../src/constructs/iam/policies/ssm.ts"],"names":[],"mappings":";;;AAAA,wDAAqE;AAErE,+CAA8C;AAE9C,MAAa,qBAAsB,SAAQ,2BAAa;IAGtD,YAAoB,KAAc;QAChC,KAAK,CAAC,KAAK,EAAE,qBAAqB,EAAE;YAClC,UAAU,EAAE,wBAAwB;YACpC,SAAS,EAAE,CAAC,GAAG,CAAC;YAChB,OAAO,EAAE;gBACP,gCAAgC;gBAChC,2BAA2B;gBAC3B,yBAAyB;gBACzB,yBAAyB;gBACzB,yBAAyB;gBACzB,uBAAuB;gBACvB,+BAA+B;gBAC/B,8BAA8B;gBAC9B,gCAAgC;gBAChC,gCAAgC;gBAChC,kCAAkC;gBAClC,+BAA+B;gBAC/B,gCAAgC;gBAChC,6BAA6B;aAC9B;SACF,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,WAAW,CAAC,KAAc;QACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAA,qCAAyB,EAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACtE,IAAI,CAAC,QAAQ,GAAG,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;SAClD;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF;AAjCD,sDAiCC","sourcesContent":["import { isSingletonPresentInStack } from \"../../../utils/singleton\";\nimport type { GuStack } from \"../../core\";\nimport { GuAllowPolicy } from \"./base-policy\";\n\nexport class GuSSMRunCommandPolicy extends GuAllowPolicy {\n private static instance: GuSSMRunCommandPolicy | undefined;\n\n private constructor(scope: GuStack) {\n super(scope, \"SSMRunCommandPolicy\", {\n policyName: \"ssm-run-command-policy\",\n resources: [\"*\"],\n actions: [\n \"ec2messages:AcknowledgeMessage\",\n \"ec2messages:DeleteMessage\",\n \"ec2messages:FailMessage\",\n \"ec2messages:GetEndpoint\",\n \"ec2messages:GetMessages\",\n \"ec2messages:SendReply\",\n \"ssm:UpdateInstanceInformation\",\n \"ssm:ListInstanceAssociations\",\n \"ssm:DescribeInstanceProperties\",\n \"ssm:DescribeDocumentParameters\",\n \"ssmmessages:CreateControlChannel\",\n \"ssmmessages:CreateDataChannel\",\n \"ssmmessages:OpenControlChannel\",\n \"ssmmessages:OpenDataChannel\",\n ],\n });\n }\n\n public static getInstance(stack: GuStack): GuSSMRunCommandPolicy {\n if (!this.instance || !isSingletonPresentInStack(stack, this.instance)) {\n this.instance = new GuSSMRunCommandPolicy(stack);\n }\n\n return this.instance;\n }\n}\n"]}
|