@guardian/cdk 49.3.0 → 49.4.1

package/lib/constructs/autoscaling/asg.d.ts

@@ -1,7 +1,7 @@
 import { AutoScalingGroup } from "aws-cdk-lib/aws-autoscaling";
 import type { AutoScalingGroupProps } from "aws-cdk-lib/aws-autoscaling";
 import { UserData } from "aws-cdk-lib/aws-ec2";
-import type { ISecurityGroup } from "aws-cdk-lib/aws-ec2";
+import type { InstanceType, ISecurityGroup } from "aws-cdk-lib/aws-ec2";
 import type { ApplicationTargetGroup } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import type { GuAsgCapacity } from "../../types";
 import type { AmigoProps } from "../../types/amigo";
@@ -10,6 +10,7 @@ import type { AppIdentity, GuStack } from "../core";
 export interface GuAutoScalingGroupProps extends Omit<AutoScalingGroupProps, "imageId" | "osType" | "machineImage" | "userData" | "minCapacity" | "maxCapacity" | "desiredCapacity" | "requireImdsv2" | "securityGroup">, AppIdentity, GuAsgCapacity {
     imageId?: GuAmiParameter;
     imageRecipe?: string | AmigoProps;
+    instanceType: InstanceType;
     userData: UserData | string;
     additionalSecurityGroups?: ISecurityGroup[];
     targetGroup?: ApplicationTargetGroup;

package/lib/constructs/autoscaling/asg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asg.d.ts","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAuB,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAsB,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQpD,MAAM,WAAW,uBACf,SAAQ,IAAI,CACR,qBAAqB,EACnB,SAAS,GACT,QAAQ,GACR,cAAc,GACd,UAAU,GACV,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,eAAe,GACf,eAAe,CAClB,EACD,WAAW,EACX,aAAa;IACf,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC5B,wBAAwB,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;;;;;;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kBAAmB,SAAQ,uBAAqC;IAC3E,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,cAAc,CAAC;IAC7C,SAAgB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;gBAEtC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CA4DvE"}
+{"version":3,"file":"asg.d.ts","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAuC,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAsB,MAAM,qBAAqB,CAAC;AAC5F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQpD,MAAM,WAAW,uBACf,SAAQ,IAAI,CACR,qBAAqB,EACnB,SAAS,GACT,QAAQ,GACR,cAAc,GACd,UAAU,GACV,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,eAAe,GACf,eAAe,CAClB,EACD,WAAW,EACX,aAAa;IACf,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC5B,wBAAwB,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;;;;;;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kBAAmB,SAAQ,uBAAqC;IAC3E,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,cAAc,CAAC;IAC7C,SAAgB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;gBAEtC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAoFvE"}

package/lib/constructs/autoscaling/asg.js

@@ -30,18 +30,17 @@ const iam_1 = require("../iam");
  */
 class GuAutoScalingGroup extends (0, app_aware_construct_1.GuAppAwareConstruct)(aws_autoscaling_1.AutoScalingGroup) {
     constructor(scope, id, props) {
-        const { app, additionalSecurityGroups = [], imageId = new core_1.GuAmiParameter(scope, { app }), imageRecipe, minimumInstances, maximumInstances, role = new iam_1.GuInstanceRole(scope, { app }), targetGroup, userData: userDataLike, vpc, withoutImdsv2 = false, } = props;
+        const { app, additionalSecurityGroups = [], blockDevices, imageId = new core_1.GuAmiParameter(scope, { app }), imageRecipe, instanceType, minimumInstances, maximumInstances, role = new iam_1.GuInstanceRole(scope, { app }), targetGroup, userData: userDataLike, vpc, withoutImdsv2 = false, } = props;
         // Ensure min and max are defined in the same way. Throwing an `Error` when necessary. For example when min is defined via a Mapping, but max is not.
         if (aws_cdk_lib_1.Token.isUnresolved(minimumInstances) && !aws_cdk_lib_1.Token.isUnresolved(maximumInstances)) {
             throw new Error("minimumInstances is defined via a Mapping, but maximumInstances is not. Create maximumInstances via a Mapping too.");
         }
         const userData = userDataLike instanceof aws_ec2_1.UserData ? userDataLike : aws_ec2_1.UserData.custom(userDataLike);
-        const mergedProps = {
-            ...props,
-            minCapacity: minimumInstances,
-            maxCapacity: maximumInstances ?? minimumInstances * 2,
-            role,
-            requireImdsv2: !withoutImdsv2,
+        // Generate an ID unique to this app
+        const launchTemplateId = `${scope.stack}-${scope.stage}-${app}`;
+        const launchTemplate = new aws_ec2_1.LaunchTemplate(scope, launchTemplateId, {
+            blockDevices,
+            instanceType,
             machineImage: {
                 getImage: () => {
                     return {
@@ -51,17 +50,34 @@ class GuAutoScalingGroup extends (0, app_aware_construct_1.GuAppAwareConstruct)(
                     };
                 },
             },
-            userData,
             // Do not use the default AWS security group which allows egress on any port.
             // Favour HTTPS only egress rules by default.
             securityGroup: ec2_1.GuHttpsEgressSecurityGroup.forVpc(scope, { app, vpc }),
+            requireImdsv2: !withoutImdsv2,
+            userData,
+            role,
+        });
+        // Add Wazuh & additional consumer specified Security Groups
+        // Note: Launch templates via CDK allow specifying only one SG, so use connections
+        // https://github.com/aws/aws-cdk/issues/18712
+        [ec2_1.GuWazuhAccess.getInstance(scope, vpc), ...additionalSecurityGroups].forEach((sg) => launchTemplate.connections.addSecurityGroup(sg));
+        const asgProps = {
+            ...props,
+            launchTemplate,
+            maxCapacity: maximumInstances ?? minimumInstances * 2,
+            minCapacity: minimumInstances,
+            // Omit userData, instanceType, blockDevices & role from asgProps
+            // As this are specified by the LaunchTemplate and must not be duplicated
+            blockDevices: undefined,
+            instanceType: undefined,
+            role: undefined,
+            userData: undefined,
         };
-        super(scope, id, mergedProps);
+        super(scope, id, asgProps);
         this.app = app;
         this.amiParameter = imageId;
         this.imageRecipe = imageRecipe;
         targetGroup && this.attachToApplicationTargetGroup(targetGroup);
-        [ec2_1.GuWazuhAccess.getInstance(scope, vpc), ...additionalSecurityGroups].forEach((sg) => this.addSecurityGroup(sg));
         const cfnAsg = this.node.defaultChild;
         // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group
         // leaves it to the default value, which is actually false.

package/lib/constructs/autoscaling/asg.js.map

@@ -1 +1 @@
-{"version":3,"file":"asg.js","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":";;;AAAA,6CAAoC;AACpC,iEAA+D;AAE/D,iDAAoE;AAKpE,+EAA4E;AAC5E,kCAAyC;AAEzC,gCAAmE;AACnE,gCAAwC;AA6BxC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,kCAAgB,CAAC;IAK3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,MAAM,EACJ,GAAG,EACH,wBAAwB,GAAG,EAAE,EAC7B,OAAO,GAAG,IAAI,qBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAC5C,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,IAAI,GAAG,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EACzC,WAAW,EACX,QAAQ,EAAE,YAAY,EACtB,GAAG,EACH,aAAa,GAAG,KAAK,GACtB,GAAG,KAAK,CAAC;QAEV,qJAAqJ;QACrJ,IAAI,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE;YACjF,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;SACH;QAED,MAAM,QAAQ,GAAG,YAAY,YAAY,kBAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAEjG,MAAM,WAAW,GAA0B;YACzC,GAAG,KAAK;YACR,WAAW,EAAE,gBAAgB;YAC7B,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,GAAG,CAAC;YACrD,IAAI;YACJ,aAAa,EAAE,CAAC,aAAa;YAC7B,YAAY,EAAE;gBACZ,QAAQ,EAAE,GAAuB,EAAE;oBACjC,OAAO;wBACL,MAAM,EAAE,6BAAmB,CAAC,KAAK;wBACjC,QAAQ;wBACR,OAAO,EAAE,OAAO,CAAC,aAAa;qBAC/B,CAAC;gBACJ,CAAC;aACF;YACD,QAAQ;YACR,6EAA6E;YAC7E,6CAA6C;YAC7C,aAAa,EAAE,gCAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SACtE,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAE/B,WAAW,IAAI,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;QAEhE,CAAC,mBAAa,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,wBAAwB,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QAEhH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAmC,CAAC;QAC7D,yFAAyF;QACzF,2DAA2D;QAC3D,+FAA+F;QAC/F,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC;CACF;AAjED,gDAiEC","sourcesContent":["import { Token } from \"aws-cdk-lib\";\nimport { AutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { AutoScalingGroupProps, CfnAutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport { OperatingSystemType, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { ISecurityGroup, MachineImageConfig } from \"aws-cdk-lib/aws-ec2\";\nimport type { ApplicationTargetGroup } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuAsgCapacity } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport { GuAmiParameter } from \"../core\";\nimport type { AppIdentity, GuStack } from \"../core\";\nimport { GuHttpsEgressSecurityGroup, GuWazuhAccess } from \"../ec2\";\nimport { GuInstanceRole } from \"../iam\";\n\n// Since we want to override the types of what gets passed in for the below props,\n// we need to use Omit<T, U> to remove them from the interface this extends\n// https://www.typescriptlang.org/docs/handbook/utility-types.html#omittype-keys\n// TODO avoid prop nesting to improve discoverability. See https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#flat.\nexport interface GuAutoScalingGroupProps\n  extends Omit<\n      AutoScalingGroupProps,\n      | \"imageId\"\n      | \"osType\"\n      | \"machineImage\"\n      | \"userData\"\n      | \"minCapacity\"\n      | \"maxCapacity\"\n      | \"desiredCapacity\"\n      | \"requireImdsv2\"\n      | \"securityGroup\"\n    >,\n    AppIdentity,\n    GuAsgCapacity {\n  imageId?: GuAmiParameter;\n  imageRecipe?: string | AmigoProps;\n  userData: UserData | string;\n  additionalSecurityGroups?: ISecurityGroup[];\n  targetGroup?: ApplicationTargetGroup;\n  withoutImdsv2?: boolean;\n}\n\n/**\n * Construct which creates an Auto Scaling group.\n *\n * By default, all EC2 instances in this group will use [[`GuInstanceRole`]],\n * which provides common permissions (e.g. the ability to download an artifact and write logs to the account's logging Kinesis stream).\n *\n * If additional IAM permissions are required, a custom role can be provided via the `role` prop.\n * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions\n * to be passed in.\n *\n * All EC2 instances in this group will be automatically associated with two security groups:\n * 1. [[`GuHttpsEgressSecurityGroup`]], which allows outbound traffic over HTTPS.\n * 2. [[`GuWazuhAccess`]], which allows instances to communicate with Wazuh (for security monitoring).\n *\n * If additional ingress or egress rules are required, define custom security groups and pass them in via the\n * `additionalSecurityGroups` prop.\n *\n * All EC2 instances provisioned via this construct will use\n * [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html).\n */\nexport class GuAutoScalingGroup extends GuAppAwareConstruct(AutoScalingGroup) {\n  public readonly app: string;\n  public readonly amiParameter: GuAmiParameter;\n  public readonly imageRecipe?: string | AmigoProps;\n\n  constructor(scope: GuStack, id: string, props: GuAutoScalingGroupProps) {\n    const {\n      app,\n      additionalSecurityGroups = [],\n      imageId = new GuAmiParameter(scope, { app }),\n      imageRecipe,\n      minimumInstances,\n      maximumInstances,\n      role = new GuInstanceRole(scope, { app }),\n      targetGroup,\n      userData: userDataLike,\n      vpc,\n      withoutImdsv2 = false,\n    } = props;\n\n    // Ensure min and max are defined in the same way. Throwing an `Error` when necessary. For example when min is defined via a Mapping, but max is not.\n    if (Token.isUnresolved(minimumInstances) && !Token.isUnresolved(maximumInstances)) {\n      throw new Error(\n        \"minimumInstances is defined via a Mapping, but maximumInstances is not. Create maximumInstances via a Mapping too.\"\n      );\n    }\n\n    const userData = userDataLike instanceof UserData ? userDataLike : UserData.custom(userDataLike);\n\n    const mergedProps: AutoScalingGroupProps = {\n      ...props,\n      minCapacity: minimumInstances,\n      maxCapacity: maximumInstances ?? minimumInstances * 2,\n      role,\n      requireImdsv2: !withoutImdsv2,\n      machineImage: {\n        getImage: (): MachineImageConfig => {\n          return {\n            osType: OperatingSystemType.LINUX,\n            userData,\n            imageId: imageId.valueAsString,\n          };\n        },\n      },\n      userData,\n      // Do not use the default AWS security group which allows egress on any port.\n      // Favour HTTPS only egress rules by default.\n      securityGroup: GuHttpsEgressSecurityGroup.forVpc(scope, { app, vpc }),\n    };\n\n    super(scope, id, mergedProps);\n    this.app = app;\n    this.amiParameter = imageId;\n    this.imageRecipe = imageRecipe;\n\n    targetGroup && this.attachToApplicationTargetGroup(targetGroup);\n\n    [GuWazuhAccess.getInstance(scope, vpc), ...additionalSecurityGroups].forEach((sg) => this.addSecurityGroup(sg));\n\n    const cfnAsg = this.node.defaultChild as CfnAutoScalingGroup;\n    // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group\n    // leaves it to the default value, which is actually false.\n    // { UpdatePolicy: { autoScalingScheduledAction: { IgnoreUnmodifiedGroupSizeProperties: true }}\n    cfnAsg.addDeletionOverride(\"UpdatePolicy\");\n  }\n}\n"]}
+{"version":3,"file":"asg.js","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":";;;AAAA,6CAAoC;AACpC,iEAA+D;AAE/D,iDAAoF;AAKpF,+EAA4E;AAC5E,kCAAyC;AAEzC,gCAAmE;AACnE,gCAAwC;AA8BxC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,kCAAgB,CAAC;IAK3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,MAAM,EACJ,GAAG,EACH,wBAAwB,GAAG,EAAE,EAC7B,YAAY,EACZ,OAAO,GAAG,IAAI,qBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAC5C,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,IAAI,GAAG,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EACzC,WAAW,EACX,QAAQ,EAAE,YAAY,EACtB,GAAG,EACH,aAAa,GAAG,KAAK,GACtB,GAAG,KAAK,CAAC;QAEV,qJAAqJ;QACrJ,IAAI,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE;YACjF,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;SACH;QAED,MAAM,QAAQ,GAAG,YAAY,YAAY,kBAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAEjG,oCAAoC;QACpC,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,wBAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE;YACjE,YAAY;YACZ,YAAY;YACZ,YAAY,EAAE;gBACZ,QAAQ,EAAE,GAAuB,EAAE;oBACjC,OAAO;wBACL,MAAM,EAAE,6BAAmB,CAAC,KAAK;wBACjC,QAAQ;wBACR,OAAO,EAAE,OAAO,CAAC,aAAa;qBAC/B,CAAC;gBACJ,CAAC;aACF;YACD,6EAA6E;YAC7E,6CAA6C;YAC7C,aAAa,EAAE,gCAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YACrE,aAAa,EAAE,CAAC,aAAa;YAC7B,QAAQ;YACR,IAAI;SACL,CAAC,CAAC;QAEH,4DAA4D;QAC5D,kFAAkF;QAClF,8CAA8C;QAC9C,CAAC,mBAAa,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,wBAAwB,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAClF,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAChD,CAAC;QAEF,MAAM,QAAQ,GAAG;YACf,GAAG,KAAK;YACR,cAAc;YACd,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,GAAG,CAAC;YACrD,WAAW,EAAE,gBAAgB;YAE7B,iEAAiE;YACjE,yEAAyE;YACzE,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,SAAS;YACvB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,SAAS;SACpB,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAE/B,WAAW,IAAI,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;QAEhE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAmC,CAAC;QAE7D,yFAAyF;QACzF,2DAA2D;QAC3D,+FAA+F;QAC/F,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC;CACF;AAzFD,gDAyFC","sourcesContent":["import { Token } from \"aws-cdk-lib\";\nimport { AutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { AutoScalingGroupProps, CfnAutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport { LaunchTemplate, OperatingSystemType, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { InstanceType, ISecurityGroup, MachineImageConfig } from \"aws-cdk-lib/aws-ec2\";\nimport type { ApplicationTargetGroup } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuAsgCapacity } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport { GuAmiParameter } from \"../core\";\nimport type { AppIdentity, GuStack } from \"../core\";\nimport { GuHttpsEgressSecurityGroup, GuWazuhAccess } from \"../ec2\";\nimport { GuInstanceRole } from \"../iam\";\n\n// Since we want to override the types of what gets passed in for the below props,\n// we need to use Omit<T, U> to remove them from the interface this extends\n// https://www.typescriptlang.org/docs/handbook/utility-types.html#omittype-keys\n// TODO avoid prop nesting to improve discoverability. See https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#flat.\nexport interface GuAutoScalingGroupProps\n  extends Omit<\n      AutoScalingGroupProps,\n      | \"imageId\"\n      | \"osType\"\n      | \"machineImage\"\n      | \"userData\"\n      | \"minCapacity\"\n      | \"maxCapacity\"\n      | \"desiredCapacity\"\n      | \"requireImdsv2\"\n      | \"securityGroup\"\n    >,\n    AppIdentity,\n    GuAsgCapacity {\n  imageId?: GuAmiParameter;\n  imageRecipe?: string | AmigoProps;\n  instanceType: InstanceType;\n  userData: UserData | string;\n  additionalSecurityGroups?: ISecurityGroup[];\n  targetGroup?: ApplicationTargetGroup;\n  withoutImdsv2?: boolean;\n}\n\n/**\n * Construct which creates an Auto Scaling group.\n *\n * By default, all EC2 instances in this group will use [[`GuInstanceRole`]],\n * which provides common permissions (e.g. the ability to download an artifact and write logs to the account's logging Kinesis stream).\n *\n * If additional IAM permissions are required, a custom role can be provided via the `role` prop.\n * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions\n * to be passed in.\n *\n * All EC2 instances in this group will be automatically associated with two security groups:\n * 1. [[`GuHttpsEgressSecurityGroup`]], which allows outbound traffic over HTTPS.\n * 2. [[`GuWazuhAccess`]], which allows instances to communicate with Wazuh (for security monitoring).\n *\n * If additional ingress or egress rules are required, define custom security groups and pass them in via the\n * `additionalSecurityGroups` prop.\n *\n * All EC2 instances provisioned via this construct will use\n * [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html).\n */\nexport class GuAutoScalingGroup extends GuAppAwareConstruct(AutoScalingGroup) {\n  public readonly app: string;\n  public readonly amiParameter: GuAmiParameter;\n  public readonly imageRecipe?: string | AmigoProps;\n\n  constructor(scope: GuStack, id: string, props: GuAutoScalingGroupProps) {\n    const {\n      app,\n      additionalSecurityGroups = [],\n      blockDevices,\n      imageId = new GuAmiParameter(scope, { app }),\n      imageRecipe,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      role = new GuInstanceRole(scope, { app }),\n      targetGroup,\n      userData: userDataLike,\n      vpc,\n      withoutImdsv2 = false,\n    } = props;\n\n    // Ensure min and max are defined in the same way. Throwing an `Error` when necessary. For example when min is defined via a Mapping, but max is not.\n    if (Token.isUnresolved(minimumInstances) && !Token.isUnresolved(maximumInstances)) {\n      throw new Error(\n        \"minimumInstances is defined via a Mapping, but maximumInstances is not. Create maximumInstances via a Mapping too.\"\n      );\n    }\n\n    const userData = userDataLike instanceof UserData ? userDataLike : UserData.custom(userDataLike);\n\n    // Generate an ID unique to this app\n    const launchTemplateId = `${scope.stack}-${scope.stage}-${app}`;\n    const launchTemplate = new LaunchTemplate(scope, launchTemplateId, {\n      blockDevices,\n      instanceType,\n      machineImage: {\n        getImage: (): MachineImageConfig => {\n          return {\n            osType: OperatingSystemType.LINUX,\n            userData,\n            imageId: imageId.valueAsString,\n          };\n        },\n      },\n      // Do not use the default AWS security group which allows egress on any port.\n      // Favour HTTPS only egress rules by default.\n      securityGroup: GuHttpsEgressSecurityGroup.forVpc(scope, { app, vpc }),\n      requireImdsv2: !withoutImdsv2,\n      userData,\n      role,\n    });\n\n    // Add Wazuh & additional consumer specified Security Groups\n    // Note: Launch templates via CDK allow specifying only one SG, so use connections\n    // https://github.com/aws/aws-cdk/issues/18712\n    [GuWazuhAccess.getInstance(scope, vpc), ...additionalSecurityGroups].forEach((sg) =>\n      launchTemplate.connections.addSecurityGroup(sg)\n    );\n\n    const asgProps = {\n      ...props,\n      launchTemplate,\n      maxCapacity: maximumInstances ?? minimumInstances * 2,\n      minCapacity: minimumInstances,\n\n      // Omit userData, instanceType, blockDevices & role from asgProps\n      // As this are specified by the LaunchTemplate and must not be duplicated\n      blockDevices: undefined,\n      instanceType: undefined,\n      role: undefined,\n      userData: undefined,\n    };\n\n    super(scope, id, asgProps);\n\n    this.app = app;\n    this.amiParameter = imageId;\n    this.imageRecipe = imageRecipe;\n\n    targetGroup && this.attachToApplicationTargetGroup(targetGroup);\n\n    const cfnAsg = this.node.defaultChild as CfnAutoScalingGroup;\n\n    // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group\n    // leaves it to the default value, which is actually false.\n    // { UpdatePolicy: { autoScalingScheduledAction: { IgnoreUnmodifiedGroupSizeProperties: true }}\n    cfnAsg.addDeletionOverride(\"UpdatePolicy\");\n  }\n}\n"]}

package/lib/constructs/loadbalancing/alb/application-listener.d.ts

@@ -28,7 +28,7 @@ export declare class GuApplicationListener extends GuApplicationListener_base {
 }
 export interface GuHttpsApplicationListenerProps extends Omit<GuApplicationListenerProps, "defaultAction" | "certificates">, AppIdentity {
     targetGroup: GuApplicationTargetGroup;
-    certificate: GuCertificate;
+    certificate?: GuCertificate;
 }
 declare const GuHttpsApplicationListener_base: {
     new (...args: any[]): {

package/lib/constructs/loadbalancing/alb/application-listener.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-listener.d.ts","sourceRoot":"","sources":["../../../../src/constructs/loadbalancing/alb/application-listener.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAuC,MAAM,wCAAwC,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,WAAW,0BAA2B,SAAQ,wBAAwB,EAAE,WAAW;CAAG;;;;;;AAE5F;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAsB,SAAQ,0BAAwC;gBACrE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B;CAG1E;AAED,MAAM,WAAW,+BACf,SAAQ,IAAI,CAAC,0BAA0B,EAAE,eAAe,GAAG,cAAc,CAAC,EACxE,WAAW;IACb,WAAW,EAAE,wBAAwB,CAAC;IACtC,WAAW,EAAE,aAAa,CAAC;CAC5B;;;;;;AAED;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,+BAAwC;gBAC1E,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,+BAA+B;CAiB/E"}
+{"version":3,"file":"application-listener.d.ts","sourceRoot":"","sources":["../../../../src/constructs/loadbalancing/alb/application-listener.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAuC,MAAM,wCAAwC,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,WAAW,0BAA2B,SAAQ,wBAAwB,EAAE,WAAW;CAAG;;;;;;AAE5F;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAsB,SAAQ,0BAAwC;gBACrE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B;CAG1E;AAED,MAAM,WAAW,+BACf,SAAQ,IAAI,CAAC,0BAA0B,EAAE,eAAe,GAAG,cAAc,CAAC,EACxE,WAAW;IACb,WAAW,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;;;;;;AAED;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,+BAAwC;gBAC1E,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,+BAA+B;CAmB/E"}

package/lib/constructs/loadbalancing/alb/application-listener.js

@@ -33,14 +33,16 @@ class GuHttpsApplicationListener extends (0, app_aware_construct_1.GuAppAwareCon
     constructor(scope, id, props) {
         const { certificate, targetGroup } = props;
         const mergedProps = {
-            port: 443,
-            protocol: aws_elasticloadbalancingv2_1.ApplicationProtocol.HTTPS,
+            port: certificate ? 443 : 8080,
+            protocol: certificate ? aws_elasticloadbalancingv2_1.ApplicationProtocol.HTTPS : aws_elasticloadbalancingv2_1.ApplicationProtocol.HTTP,
             ...props,
-            certificates: [
-                {
-                    certificateArn: certificate.certificateArn,
-                },
-            ],
+            certificates: certificate
+                ? [
+                    {
+                        certificateArn: certificate.certificateArn,
+                    },
+                ]
+                : [],
             defaultAction: aws_elasticloadbalancingv2_1.ListenerAction.forward([targetGroup]),
         };
         super(scope, id, mergedProps);

package/lib/constructs/loadbalancing/alb/application-listener.js.map

@@ -1 +1 @@
-{"version":3,"file":"application-listener.js","sourceRoot":"","sources":["../../../../src/constructs/loadbalancing/alb/application-listener.ts"],"names":[],"mappings":";;;AAAA,uFAAkH;AAElH,kFAA+E;AAO/E;;;;;;;;;;;;GAYG;AACH,MAAa,qBAAsB,SAAQ,IAAA,yCAAmB,EAAC,gDAAmB,CAAC;IACjF,YAAY,KAAc,EAAE,EAAU,EAAE,KAAiC;QACvE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,gDAAmB,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;CACF;AAJD,sDAIC;AASD;;;;;;GAMG;AACH,MAAa,0BAA2B,SAAQ,IAAA,yCAAmB,EAAC,gDAAmB,CAAC;IACtF,YAAY,KAAc,EAAE,EAAU,EAAE,KAAsC;QAC5E,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;QAE3C,MAAM,WAAW,GAA+B;YAC9C,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,gDAAmB,CAAC,KAAK;YACnC,GAAG,KAAK;YACR,YAAY,EAAE;gBACZ;oBACE,cAAc,EAAE,WAAW,CAAC,cAAc;iBAC3C;aACF;YACD,aAAa,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;SACrD,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAChC,CAAC;CACF;AAlBD,gEAkBC","sourcesContent":["import { ApplicationListener, ApplicationProtocol, ListenerAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { ApplicationListenerProps } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { GuAppAwareConstruct } from \"../../../utils/mixin/app-aware-construct\";\nimport type { GuCertificate } from \"../../acm\";\nimport type { AppIdentity, GuStack } from \"../../core\";\nimport type { GuApplicationTargetGroup } from \"./application-target-group\";\n\nexport interface GuApplicationListenerProps extends ApplicationListenerProps, AppIdentity {}\n\n/**\n * Construct which creates a Listener.\n *\n * This construct should be used in conjunction with [[`GuApplicationLoadBalancer`]] and [[`GuApplicationTargetGroup`]]\n * to route traffic to your application. For more details on these three components, see the\n * [AWS documentation](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html#application-load-balancer-components).\n *\n * If you are running an application which only accepts traffic over HTTPS, consider using [[`GuHttpsApplicationListener`]]\n * to reduce the amount of boilerplate needed when configuring your Listener.\n *\n * This resource is stateful.\n * @see https://github.com/guardian/cdk/blob/main/docs/stateful-resources.md\n */\nexport class GuApplicationListener extends GuAppAwareConstruct(ApplicationListener) {\n  constructor(scope: GuStack, id: string, props: GuApplicationListenerProps) {\n    super(scope, id, { port: 443, protocol: ApplicationProtocol.HTTPS, ...props });\n  }\n}\n\nexport interface GuHttpsApplicationListenerProps\n  extends Omit<GuApplicationListenerProps, \"defaultAction\" | \"certificates\">,\n    AppIdentity {\n  targetGroup: GuApplicationTargetGroup;\n  certificate: GuCertificate;\n}\n\n/**\n * Construct which creates a Listener which accepts HTTPS traffic.\n *\n * You must pass a [[`GuCertificate`]] to this Listener via the `certificate` prop.\n *\n * For general details about Listeners, see [[`GuApplicationListener`]].\n */\nexport class GuHttpsApplicationListener extends GuAppAwareConstruct(ApplicationListener) {\n  constructor(scope: GuStack, id: string, props: GuHttpsApplicationListenerProps) {\n    const { certificate, targetGroup } = props;\n\n    const mergedProps: GuApplicationListenerProps = {\n      port: 443,\n      protocol: ApplicationProtocol.HTTPS,\n      ...props,\n      certificates: [\n        {\n          certificateArn: certificate.certificateArn,\n        },\n      ],\n      defaultAction: ListenerAction.forward([targetGroup]),\n    };\n\n    super(scope, id, mergedProps);\n  }\n}\n"]}
+{"version":3,"file":"application-listener.js","sourceRoot":"","sources":["../../../../src/constructs/loadbalancing/alb/application-listener.ts"],"names":[],"mappings":";;;AAAA,uFAAkH;AAElH,kFAA+E;AAO/E;;;;;;;;;;;;GAYG;AACH,MAAa,qBAAsB,SAAQ,IAAA,yCAAmB,EAAC,gDAAmB,CAAC;IACjF,YAAY,KAAc,EAAE,EAAU,EAAE,KAAiC;QACvE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,gDAAmB,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;CACF;AAJD,sDAIC;AASD;;;;;;GAMG;AACH,MAAa,0BAA2B,SAAQ,IAAA,yCAAmB,EAAC,gDAAmB,CAAC;IACtF,YAAY,KAAc,EAAE,EAAU,EAAE,KAAsC;QAC5E,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;QAE3C,MAAM,WAAW,GAA+B;YAC9C,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YAC9B,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,gDAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,gDAAmB,CAAC,IAAI;YAC5E,GAAG,KAAK;YACR,YAAY,EAAE,WAAW;gBACvB,CAAC,CAAC;oBACE;wBACE,cAAc,EAAE,WAAW,CAAC,cAAc;qBAC3C;iBACF;gBACH,CAAC,CAAC,EAAE;YACN,aAAa,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;SACrD,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAChC,CAAC;CACF;AApBD,gEAoBC","sourcesContent":["import { ApplicationListener, ApplicationProtocol, ListenerAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { ApplicationListenerProps } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { GuAppAwareConstruct } from \"../../../utils/mixin/app-aware-construct\";\nimport type { GuCertificate } from \"../../acm\";\nimport type { AppIdentity, GuStack } from \"../../core\";\nimport type { GuApplicationTargetGroup } from \"./application-target-group\";\n\nexport interface GuApplicationListenerProps extends ApplicationListenerProps, AppIdentity {}\n\n/**\n * Construct which creates a Listener.\n *\n * This construct should be used in conjunction with [[`GuApplicationLoadBalancer`]] and [[`GuApplicationTargetGroup`]]\n * to route traffic to your application. For more details on these three components, see the\n * [AWS documentation](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html#application-load-balancer-components).\n *\n * If you are running an application which only accepts traffic over HTTPS, consider using [[`GuHttpsApplicationListener`]]\n * to reduce the amount of boilerplate needed when configuring your Listener.\n *\n * This resource is stateful.\n * @see https://github.com/guardian/cdk/blob/main/docs/stateful-resources.md\n */\nexport class GuApplicationListener extends GuAppAwareConstruct(ApplicationListener) {\n  constructor(scope: GuStack, id: string, props: GuApplicationListenerProps) {\n    super(scope, id, { port: 443, protocol: ApplicationProtocol.HTTPS, ...props });\n  }\n}\n\nexport interface GuHttpsApplicationListenerProps\n  extends Omit<GuApplicationListenerProps, \"defaultAction\" | \"certificates\">,\n    AppIdentity {\n  targetGroup: GuApplicationTargetGroup;\n  certificate?: GuCertificate;\n}\n\n/**\n * Construct which creates a Listener which accepts HTTPS traffic.\n *\n * You must pass a [[`GuCertificate`]] to this Listener via the `certificate` prop.\n *\n * For general details about Listeners, see [[`GuApplicationListener`]].\n */\nexport class GuHttpsApplicationListener extends GuAppAwareConstruct(ApplicationListener) {\n  constructor(scope: GuStack, id: string, props: GuHttpsApplicationListenerProps) {\n    const { certificate, targetGroup } = props;\n\n    const mergedProps: GuApplicationListenerProps = {\n      port: certificate ? 443 : 8080,\n      protocol: certificate ? ApplicationProtocol.HTTPS : ApplicationProtocol.HTTP,\n      ...props,\n      certificates: certificate\n        ? [\n            {\n              certificateArn: certificate.certificateArn,\n            },\n          ]\n        : [],\n      defaultAction: ListenerAction.forward([targetGroup]),\n    };\n\n    super(scope, id, mergedProps);\n  }\n}\n"]}

package/lib/patterns/ec2-app/base.d.ts

@@ -124,7 +124,7 @@ export interface GuEc2AppProps extends AppIdentity {
     accessLogging?: AccessLoggingProps;
     blockDevices?: BlockDevice[];
     scaling: GuAsgCapacity;
-    certificateProps: GuDomainName;
+    certificateProps?: GuDomainName;
     withoutImdsv2?: boolean;
     imageRecipe?: string | AmigoProps;
     vpc?: IVpc;
@@ -152,7 +152,7 @@ export interface GuEc2AppProps extends AppIdentity {
  *   access: { scope: AccessScope.PUBLIC },
  *   instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
  *   certificateProps:{
- *     domainName: "prod-guardian.com",
+ *     domainName: "domain-name-for-your-application.example",
  *   },
  *   monitoringConfiguration: {
  *     snsTopicName: "alerts-topic-for-my-team",
@@ -181,7 +181,7 @@ export interface GuEc2AppProps extends AppIdentity {
  *   },
  *   instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
  *   certificateProps:{
- *     domainName: "prod-guardian.com",
+ *     domainName: "domain-name-for-your-application.example",
  *   },
  *   monitoringConfiguration: {
  *     snsTopicName: "alerts-topic-for-my-team",
@@ -305,7 +305,7 @@ export interface GuEc2AppProps extends AppIdentity {
  */
 export declare class GuEc2App extends Construct {
     readonly vpc: IVpc;
-    readonly certificate: GuCertificate;
+    readonly certificate?: GuCertificate;
     readonly loadBalancer: GuApplicationLoadBalancer;
     readonly autoScalingGroup: GuAutoScalingGroup;
     readonly listener: GuHttpsApplicationListener;

package/lib/patterns/ec2-app/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,KAAK,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAI9E,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAc,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEnF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAmD,MAAM,uBAAuB,CAAC;AAErG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,MAAM;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACxC,uBAAuB,EAAE,OAAO,CAAC;IACjC,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD,QAAQ,EAAE,eAAe,GAAG,MAAM,CAAC;IACnC,MAAM,EAAE,SAAS,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,uBAAuB,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAC7C,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,OAAO,EAAE,aAAa,CAAC;IACvB,gBAAgB,EAAE,YAAY,CAAC;IAC/B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;CAC3B;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2KG;AACH,qBAAa,QAAS,SAAQ,SAAS;IASrC,SAAgB,GAAG,EAAE,IAAI,CAAC;IAC1B,SAAgB,WAAW,EAAE,aAAa,CAAC;IAC3C,SAAgB,YAAY,EAAE,yBAAyB,CAAC;IACxD,SAAgB,gBAAgB,EAAE,kBAAkB,CAAC;IACrD,SAAgB,QAAQ,EAAE,0BAA0B,CAAC;IACrD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;gBAE1C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa;CAsKjD"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,KAAK,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAI9E,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAc,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEnF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAmD,MAAM,uBAAuB,CAAC;AAErG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,MAAM;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACxC,uBAAuB,EAAE,OAAO,CAAC;IACjC,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD,QAAQ,EAAE,eAAe,GAAG,MAAM,CAAC;IACnC,MAAM,EAAE,SAAS,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,uBAAuB,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAC7C,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,OAAO,EAAE,aAAa,CAAC;IACvB,gBAAgB,CAAC,EAAE,YAAY,CAAC;IAChC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;CAC3B;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2KG;AACH,qBAAa,QAAS,SAAQ,SAAS;IASrC,SAAgB,GAAG,EAAE,IAAI,CAAC;IAC1B,SAAgB,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5C,SAAgB,YAAY,EAAE,yBAAyB,CAAC;IACxD,SAAgB,gBAAgB,EAAE,kBAAkB,CAAC;IACrD,SAAgB,QAAQ,EAAE,0BAA0B,CAAC;IACrD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;gBAE1C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa;CAyKjD"}

package/lib/patterns/ec2-app/base.js

@@ -44,7 +44,7 @@ function restrictedCidrRanges(ranges) {
  *   access: { scope: AccessScope.PUBLIC },
  *   instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
  *   certificateProps:{
- *     domainName: "prod-guardian.com",
+ *     domainName: "domain-name-for-your-application.example",
  *   },
  *   monitoringConfiguration: {
  *     snsTopicName: "alerts-topic-for-my-team",
@@ -73,7 +73,7 @@ function restrictedCidrRanges(ranges) {
  *   },
  *   instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
  *   certificateProps:{
- *     domainName: "prod-guardian.com",
+ *     domainName: "domain-name-for-your-application.example",
  *   },
  *   monitoringConfiguration: {
  *     snsTopicName: "alerts-topic-for-my-team",
@@ -199,7 +199,7 @@ class GuEc2App extends constructs_1.Construct {
     constructor(scope, props) {
         const { access, accessLogging = { enabled: false }, app, 
         // We should update this default once a significant number of apps have migrated to devx-logs
-        applicationLogging = { enabled: false }, applicationPort, blockDevices, certificateProps: { domainName, hostedZoneId }, instanceType, monitoringConfiguration, roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] }, scaling: { minimumInstances, maximumInstances = minimumInstances * 2 }, userData, withoutImdsv2, imageRecipe, vpc = ec2_1.GuVpc.fromIdParameter(scope, core_1.AppIdentity.suffixText({ app }, "VPC")), privateSubnets = ec2_1.GuVpc.subnetsFromParameter(scope, { type: ec2_1.SubnetType.PRIVATE, app }), publicSubnets = ec2_1.GuVpc.subnetsFromParameter(scope, { type: ec2_1.SubnetType.PUBLIC, app }), } = props;
+        applicationLogging = { enabled: false }, applicationPort, blockDevices, certificateProps, instanceType, monitoringConfiguration, roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] }, scaling: { minimumInstances, maximumInstances = minimumInstances * 2 }, userData, withoutImdsv2, imageRecipe, vpc = ec2_1.GuVpc.fromIdParameter(scope, core_1.AppIdentity.suffixText({ app }, "VPC")), privateSubnets = ec2_1.GuVpc.subnetsFromParameter(scope, { type: ec2_1.SubnetType.PRIVATE, app }), publicSubnets = ec2_1.GuVpc.subnetsFromParameter(scope, { type: ec2_1.SubnetType.PUBLIC, app }), } = props;
         super(scope, app); // The assumption is `app` is unique
         // We should really prevent users from doing this via the type system,
         // but that requires a breaking change to the API
@@ -208,11 +208,13 @@ class GuEc2App extends constructs_1.Construct {
                 "`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`");
         }
         types_1.AppAccess.validate(access);
-        const certificate = new acm_1.GuCertificate(scope, {
-            app,
-            domainName,
-            hostedZoneId,
-        });
+        const certificate = typeof certificateProps !== "undefined"
+            ? new acm_1.GuCertificate(scope, {
+                app,
+                domainName: certificateProps.domainName,
+                hostedZoneId: certificateProps.hostedZoneId,
+            })
+            : undefined;
         const maybePrivateConfigPolicy = typeof userData !== "string" && userData.configuration
             ? [new iam_1.GuGetPrivateConfigPolicy(scope, "GetPrivateConfigFromS3Policy", userData.configuration)]
             : [];
@@ -272,7 +274,7 @@ class GuEc2App extends constructs_1.Construct {
             certificate,
             targetGroup,
             // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS
-            open: access.scope === constants_1.AccessScope.PUBLIC,
+            open: access.scope === constants_1.AccessScope.PUBLIC && typeof certificate !== "undefined",
         });
         // Since AWS won't create a security group automatically when open=false, we need to add our own
         if (access.scope !== constants_1.AccessScope.PUBLIC) {

package/lib/patterns/ec2-app/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;AAAA,6CAA6C;AAE7C,iEAA0D;AAE1D,iDAA2C;AAC3C,uFAA6E;AAC7E,+CAA4C;AAC5C,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAAiG;AAEjG,gDAAqG;AACrG,8CAA0E;AAE1E,8CAAgF;AAChF,kEAIwC;AACxC,uCAAwC;AA+HxC,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2KG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,aAAa,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAClC,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,EAC9C,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EACR,aAAa,EACb,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GACpF,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GAAG,IAAI,mBAAa,CAAC,KAAK,EAAE;YAC3C,GAAG;YACH,UAAU;YACV,YAAY;SACb,CAAC,CAAC;QAEH,MAAM,wBAAwB,GAC5B,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa;YACpD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,aAAa;YACb,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YACpE,WAAW,EAAE,6BAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACxG,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;SACZ,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;SACF,CAAC,CAAC;QAEH,IAAI,aAAa,CAAC,OAAO,EAAE;YACzB,MAAM,mBAAmB,GAAG,IAAI,wBAAiB,CAAC,KAAK,EAAE,qBAAqB,EAAE;gBAC9E,WAAW,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,WAAW;gBACtE,OAAO,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,IAAI;gBAC3D,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,YAAY,CAAC,aAAa,CACxB,eAAM,CAAC,cAAc,CACnB,KAAK,EACL,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,qBAAqB,CAAC,EACpD,mBAAmB,CAAC,aAAa,CAClC,EACD,aAAa,CAAC,MAAM,CACrB,CAAC;SACH;QAED,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM;SAC1C,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAExF,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAtLD,4BAsLC","sourcesContent":["import { Duration, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice } from \"aws-cdk-lib/aws-autoscaling\";\nimport { HealthCheck } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port } from \"aws-cdk-lib/aws-ec2\";\nimport { ApplicationProtocol } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport { GuAlb5xxPercentageAlarm, GuUnhealthyInstancesAlarm } from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuLoggingStreamNameParameter, GuStringParameter } from \"../../constructs/core\";\nimport { GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport {\n  GuApplicationLoadBalancer,\n  GuApplicationTargetGroup,\n  GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\n\nexport interface AccessLoggingProps {\n  enabled: boolean;\n  prefix?: string;\n}\n\n/**\n * To ship your application logs to ELK automatically, you must:\n *\n * 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n *\n * Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n */\nexport interface ApplicationLoggingProps {\n  enabled: boolean;\n  /**\n   * Defaults to app name. That is, if your app runs as `<app>.service`\n   * (e.g. `janus.service`), this will 'just work'.\n   *\n   * If it runs with a non-standard name, you will need to override the default\n   * behavour. I.e. if your app is running as `some-different-name.service`, then\n   * this prop should be set to `some-different-name`.\n   */\n  systemdUnitName?: string;\n}\n\nexport interface Alarms {\n  snsTopicName: string;\n  http5xxAlarm: false | Http5xxAlarmProps;\n  unhealthyInstancesAlarm: boolean;\n  noMonitoring?: false;\n}\n\n/**\n * Configuration options for the [[`GuEc2App`]] pattern.\n *\n * To grant EC2 instances additional IAM permissions, use the `roleConfiguration` prop. For example,\n * to allow your app to write to DynamoDB:\n *\n * ```typescript\n * // other props\n * roleConfiguration: {\n *   additionalPolicies: [new GuDynamoDBWritePolicy(stack, \"DynamoTable\", { tableName: \"my-dynamo-table\" })],\n * }\n * ```\n *\n * To create alarms (recommended), use:\n * ```typescript\n * // other props\n * monitoringConfiguration: {\n *   snsTopicName: \"alerts-topic-for-my-team\",\n *   http5xxAlarm: {\n *     tolerated5xxPercentage: 1,\n *   },\n *   unhealthyInstancesAlarm: true,\n * }\n * ```\n *\n * To opt out of creating alarms, use:\n *```typescript\n * // other props\n * monitoringConfiguration: { noMonitoring: true }\n * ```\n *\n * To automatically ship application logs from `stdout` to ELK, use:\n *\n * ```typescript\n * {\n *   // other props\n *   applicationLogging: { enabled: true }\n * }\n * ```\n *\n * For more details on the requirements for application log shipping, see [[`ApplicationLoggingProps`]].\n *\n * To enable access logging for your load balancer, you can specify the prefix to write the logs to.\n * The S3 bucket used to hold these access logs must be specified in SSM at `/account/services/access-logging/bucket`\n * You must specify a region in your stack declaration if you are to use this prop, as specified here:\n * https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html#logwbraccesswbrlogsbucket-prefix\n * For example:\n * ```typescript\n * {\n *   // other props\n *   accessLogging: {\n *     enabled: true,\n *     prefix: \"my-application-logs\"\n *   }\n * }\n *\n * If you would like to enable access logging at the root of the S3 bucket (ie without a prefix), you can omit the prefix\n * For example:\n * ```typescript\n * {\n *   // other props\n *   accessLogging: {\n *     enabled: true,\n *   }\n * }\n * ```\n */\nexport interface GuEc2AppProps extends AppIdentity {\n  userData: GuUserDataProps | string;\n  access: AppAccess;\n  applicationPort: number;\n  roleConfiguration?: GuInstanceRoleProps;\n  monitoringConfiguration: Alarms | NoMonitoring;\n  instanceType: InstanceType;\n  applicationLogging?: ApplicationLoggingProps;\n  accessLogging?: AccessLoggingProps;\n  blockDevices?: BlockDevice[];\n  scaling: GuAsgCapacity;\n  certificateProps: GuDomainName;\n  withoutImdsv2?: boolean;\n  imageRecipe?: string | AmigoProps;\n  vpc?: IVpc;\n  privateSubnets?: ISubnet[];\n  publicSubnets?: ISubnet[];\n}\n\nfunction restrictedCidrRanges(ranges: IPeer[]) {\n  return ranges.map((range) => ({\n    range,\n    port: Port.tcp(443),\n    description: `Allow access on port 443 from ${range.uniqueId}`,\n  }));\n}\n\n/**\n * Pattern which creates the resources needed to run an application on EC2 instances.\n * For convenience, you may wish to use [[`GuPlayApp`]] or [[`GuNodeApp`]], which extend this class.\n *\n * This pattern will grant your EC2 instances a number of commonly needed IAM permissions. For more information on\n * this, see [[`GuInstanceRole`]]. To add additional permissions to your EC2 instances, see [[`GuEc2AppProps`]].\n *\n * This pattern will automatically create security groups/rules which allow for:\n * 1. Incoming traffic over HTTPS (from the whole internet or from the specified CIDR ranges, depending on the\n * [[`AppAccess`]] specified).\n * 2. Communication between the load balancer and the EC2 instances over HTTP, via the specified application port.\n * 3. Outbound traffic from your EC2 instances over HTTPS (to enable communication with third-party APIs).\n *\n * Example usage for a public facing app (open to the internet):\n * ```typescript\n * new GuEc2App(stack, {\n *   applicationPort: 1234,\n *   app: \"app-name\",\n *   access: { scope: AccessScope.PUBLIC },\n *   instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),\n *   certificateProps:{\n *     domainName: \"prod-guardian.com\",\n *   },\n *   monitoringConfiguration: {\n *     snsTopicName: \"alerts-topic-for-my-team\",\n *     http5xxAlarm: {\n *       tolerated5xxPercentage: 1,\n *     },\n *     unhealthyInstancesAlarm: true,\n *   },\n *   userData: {\n *     distributable: {\n *       fileName: \"app-name.deb\",\n *       executionStatement: `dpkg -i /app-name/app-name.deb`,\n *     }\n *   },\n * });\n * ```\n *\n * Example usage for an app which is restricted to specific CIDR ranges:\n * ```typescript\n * new GuEc2App(stack, {\n *   applicationPort: 1234,\n *   app: \"app-name\",\n *   access: {\n *     scope: AccessScope.RESTRICTED,\n *     cidrRanges: [Peer.ipv4(\"192.168.1.1/32\"), Peer.ipv4(\"8.8.8.8/32\")],\n *   },\n *   instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),\n *   certificateProps:{\n *     domainName: \"prod-guardian.com\",\n *   },\n *   monitoringConfiguration: {\n *     snsTopicName: \"alerts-topic-for-my-team\",\n *     http5xxAlarm: {\n *       tolerated5xxPercentage: 1,\n *     },\n *     unhealthyInstancesAlarm: true,\n *   }\n *   userData: {\n *     distributable: {\n *       fileName: \"app-name.deb\",\n *       executionStatement: `dpkg -i /app-name/app-name.deb`,\n *     }\n *   },\n * });\n * ```\n *\n * ### Varying values by stage\n *\n * There are times when you want a resource's configuration to be stage aware,\n * for example the number of instances in an ASG.\n *\n * To do this, we can use a simple ternary:\n * ```typescript\n * new GuEc2App(this, {\n *   // other required properties\n *   scaling: this.stage === \"PROD\" ? { minimumInstances: 6 } : { minimumInstances: 1 }\n * });\n * ```\n *\n * If multiple properties need to be stage aware, consider encoding this into the `props` of the calling class:\n *\n * ```typescript\n * export interface MyAppProps extends GuStackProps {\n *   domainName: string;\n *   scaling: GuAsgCapacity;\n *   monitoringConfiguration: Alarms | NoMonitoring;\n * }\n *\n * export class MyApp extends GuStack {\n *   private static app = \"cdk-playground\";\n *\n *   constructor(scope: App, id: string, props: MyAppProps) {\n *     const { stage, domainName, scaling, monitoringConfiguration } = props;\n *\n *     super(scope, id, props);\n *\n *     new GuPlayApp(this, {\n *       app: \"my-app\",\n *       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MICRO),\n *       access: { scope: AccessScope.PUBLIC },\n *       userData: {\n *         distributable: {\n *           fileName: `my-app.deb`,\n *           executionStatement: `dpkg -i /my-app/my-app.deb`,\n *         },\n *       },\n *       certificateProps: {\n *         domainName,\n *       },\n *       monitoringConfiguration,\n *       scaling,\n *     });\n *   }\n * }\n *\n * new MyApp(app, \"MyApp-CODE\", {\n *   stage: \"CODE\",\n *   domainName: \"my-app.code.dev-gutools.co.uk\",\n *   scaling: { minimumInstances: 1 },\n *   monitoringConfiguration: { noMonitoring: true },\n * });\n *\n * new MyApp(app, \"MyApp-PROD\", {\n *   stage: \"PROD\",\n *   domainName: \"my-app.prod.gutools.co.uk\",\n *   scaling: { minimumInstances: 6 },\n *   monitoringConfiguration: {\n *     // config to enable alarms in PROD\n *   },\n * });\n * ```\n *\n * If you _must_ support a non-standard VPC setup, it's possible to override the VPC and subnet selection into which\n * instances will be started. You need to set the three props below in order for this to work:\n *  vpc: this must be an IVpc instance indicating the VPC to deploy into (usually obtained from `Vpc.fromVpcAttributes`)\n *  privateSubnets: a list of ISubnet indicating the subnets for the autoscaling group to deploy instances into (usually\n *    obtained from `GuVpc.subnets`)\n *  publicSubnets: a list of ISubnet indicating the subnets for the loadbalancer to use, if the loadbalancer\n *    is intended for public access (usually obtained from `GuVpc.subnets`)\n *    On the other hand, if the access is private, then an \"internal\" loadbalancer is used in the `privateSubnets` list.\n * Please note that no checking is applied to the subnet lists to ensure that they correspond to the vpc given; as\n * an advanced feature it is assumed that the caller ensures this.  If the subnets are mismatched then the resulting\n * Cloudformation will fail to deploy.\n *\n * ### Customising the infrastructure generated by this pattern\n *\n * Although we allow users to customise many aspects of their infrastructure via [[`GuEc2AppProps`]], it's possible\n * that there are less common use-cases which are currently unsupported via the API. In these circumstances escape\n * hatches can be used to override specific resources in the stack.\n *\n * In order to do this:\n *\n * 1. Create desired resource using Guardian or AWS constructs, for example:\n * ```typescript\n * const sg = new GuSecurityGroup(\n *   // custom parameters\n * );\n * ```\n * 2. Access the CloudFormation version of the resource that you wish to customise, for example:\n * ```typescript\n * const pattern = new GuEc2App(\n *   // all parameters\n * )\n * const cfnLb = pattern.loadBalancer.node.defaultChild as CfnLoadBalancer;\n * ```\n * 3. Replace the resource generated by the pattern with your bespoke resource, for example:\n * ```typescript\n * cfnLb.securityGroups = [sg.securityGroupId];\n * ```\n */\nexport class GuEc2App extends Construct {\n  /*\n   * These are public for now, as this allows users to\n   * modify these constructs as desired to fit their\n   * specific needs.\n   * In the future, we might build functionality to better enable users\n   * to access in-pattern constructs, but this would allow teams to be unblocked\n   * in the short term.\n   * */\n  public readonly vpc: IVpc;\n  public readonly certificate: GuCertificate;\n  public readonly loadBalancer: GuApplicationLoadBalancer;\n  public readonly autoScalingGroup: GuAutoScalingGroup;\n  public readonly listener: GuHttpsApplicationListener;\n  public readonly targetGroup: GuApplicationTargetGroup;\n\n  constructor(scope: GuStack, props: GuEc2AppProps) {\n    const {\n      access,\n      accessLogging = { enabled: false },\n      app,\n      // We should update this default once a significant number of apps have migrated to devx-logs\n      applicationLogging = { enabled: false },\n      applicationPort,\n      blockDevices,\n      certificateProps: { domainName, hostedZoneId },\n      instanceType,\n      monitoringConfiguration,\n      roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n      scaling: { minimumInstances, maximumInstances = minimumInstances * 2 },\n      userData,\n      withoutImdsv2,\n      imageRecipe,\n      vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n      privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n      publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n    } = props;\n\n    super(scope, app); // The assumption is `app` is unique\n\n    // We should really prevent users from doing this via the type system,\n    // but that requires a breaking change to the API\n    if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n      throw new Error(\n        \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n          \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\"\n      );\n    }\n\n    AppAccess.validate(access);\n\n    const certificate = new GuCertificate(scope, {\n      app,\n      domainName,\n      hostedZoneId,\n    });\n\n    const maybePrivateConfigPolicy =\n      typeof userData !== \"string\" && userData.configuration\n        ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n        : [];\n\n    const mergedRoleConfiguration: GuInstanceRoleProps = {\n      withoutLogShipping: roleConfiguration.withoutLogShipping,\n      additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n    };\n\n    const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n      app,\n      vpc,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      withoutImdsv2,\n      role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n      healthCheck: HealthCheck.elb({ grace: Duration.minutes(2) }), // should this be defaulted at pattern or construct level?\n      userData: typeof userData !== \"string\" ? new GuUserData(scope, { app, ...userData }).userData : userData,\n      vpcSubnets: { subnets: privateSubnets },\n      ...(blockDevices && { blockDevices }),\n      imageRecipe,\n    });\n\n    // This allows automatic shipping of instance Cloud Init logs when using the\n    // `cdk-base` Amigo role on your AMI.\n    Tags.of(autoScalingGroup).add(\n      MetadataKeys.LOG_KINESIS_STREAM_NAME,\n      GuLoggingStreamNameParameter.getInstance(scope).valueAsString\n    );\n\n    if (applicationLogging.enabled) {\n      // This allows automatic shipping of application logs when using the\n      // `cdk-base` Amigo role on your AMI.\n      Tags.of(autoScalingGroup).add(\n        MetadataKeys.SYSTEMD_UNIT,\n        applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`\n      );\n    }\n\n    const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n      app,\n      vpc,\n      // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n      internetFacing: access.scope !== AccessScope.INTERNAL,\n      vpcSubnets: {\n        subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n      },\n    });\n\n    if (accessLogging.enabled) {\n      const accessLoggingBucket = new GuStringParameter(scope, \"AccessLoggingBucket\", {\n        description: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.description,\n        default: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.path,\n        fromSSM: true,\n      });\n\n      loadBalancer.logAccessLogs(\n        Bucket.fromBucketName(\n          scope,\n          AppIdentity.suffixText(props, \"AccessLoggingBucket\"),\n          accessLoggingBucket.valueAsString\n        ),\n        accessLogging.prefix\n      );\n    }\n\n    const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n      app,\n      vpc,\n      protocol: ApplicationProtocol.HTTP,\n      targets: [autoScalingGroup],\n      port: applicationPort,\n    });\n\n    const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n      app,\n      loadBalancer,\n      certificate,\n      targetGroup,\n      // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n      open: access.scope === AccessScope.PUBLIC,\n    });\n\n    // Since AWS won't create a security group automatically when open=false, we need to add our own\n    if (access.scope !== AccessScope.PUBLIC) {\n      loadBalancer.addSecurityGroup(\n        new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n          app,\n          vpc,\n          description: \"Allow restricted ingress from CIDR ranges\",\n          allowAllOutbound: false,\n          ingresses: restrictedCidrRanges(access.cidrRanges),\n        })\n      );\n    }\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const { http5xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n      if (http5xxAlarm) {\n        new GuAlb5xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http5xxAlarm,\n        });\n      }\n      if (unhealthyInstancesAlarm) {\n        new GuUnhealthyInstancesAlarm(scope, {\n          app,\n          targetGroup,\n          snsTopicName,\n        });\n      }\n    }\n\n    this.vpc = vpc;\n    this.certificate = certificate;\n    this.loadBalancer = loadBalancer;\n    this.autoScalingGroup = autoScalingGroup;\n    this.listener = listener;\n    this.targetGroup = targetGroup;\n  }\n}\n"]}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;AAAA,6CAA6C;AAE7C,iEAA0D;AAE1D,iDAA2C;AAC3C,uFAA6E;AAC7E,+CAA4C;AAC5C,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAAiG;AAEjG,gDAAqG;AACrG,8CAA0E;AAE1E,8CAAgF;AAChF,kEAIwC;AACxC,uCAAwC;AA+HxC,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2KG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,aAAa,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAClC,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EACR,aAAa,EACb,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GACpF,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,WAAW;YACrC,CAAC,CAAC,IAAI,mBAAa,CAAC,KAAK,EAAE;gBACvB,GAAG;gBACH,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,YAAY,EAAE,gBAAgB,CAAC,YAAY;aAC5C,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,wBAAwB,GAC5B,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa;YACpD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,aAAa;YACb,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YACpE,WAAW,EAAE,6BAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACxG,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;SACZ,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;SACF,CAAC,CAAC;QAEH,IAAI,aAAa,CAAC,OAAO,EAAE;YACzB,MAAM,mBAAmB,GAAG,IAAI,wBAAiB,CAAC,KAAK,EAAE,qBAAqB,EAAE;gBAC9E,WAAW,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,WAAW;gBACtE,OAAO,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,IAAI;gBAC3D,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,YAAY,CAAC,aAAa,CACxB,eAAM,CAAC,cAAc,CACnB,KAAK,EACL,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,qBAAqB,CAAC,EACpD,mBAAmB,CAAC,aAAa,CAClC,EACD,aAAa,CAAC,MAAM,CACrB,CAAC;SACH;QAED,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,IAAI,OAAO,WAAW,KAAK,WAAW;SAChF,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAExF,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAzLD,4BAyLC","sourcesContent":["import { Duration, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice } from \"aws-cdk-lib/aws-autoscaling\";\nimport { HealthCheck } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port } from \"aws-cdk-lib/aws-ec2\";\nimport { ApplicationProtocol } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport { GuAlb5xxPercentageAlarm, GuUnhealthyInstancesAlarm } from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuLoggingStreamNameParameter, GuStringParameter } from \"../../constructs/core\";\nimport { GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport {\n  GuApplicationLoadBalancer,\n  GuApplicationTargetGroup,\n  GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\n\nexport interface AccessLoggingProps {\n  enabled: boolean;\n  prefix?: string;\n}\n\n/**\n * To ship your application logs to ELK automatically, you must:\n *\n * 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n *\n * Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n */\nexport interface ApplicationLoggingProps {\n  enabled: boolean;\n  /**\n   * Defaults to app name. That is, if your app runs as `<app>.service`\n   * (e.g. `janus.service`), this will 'just work'.\n   *\n   * If it runs with a non-standard name, you will need to override the default\n   * behavour. I.e. if your app is running as `some-different-name.service`, then\n   * this prop should be set to `some-different-name`.\n   */\n  systemdUnitName?: string;\n}\n\nexport interface Alarms {\n  snsTopicName: string;\n  http5xxAlarm: false | Http5xxAlarmProps;\n  unhealthyInstancesAlarm: boolean;\n  noMonitoring?: false;\n}\n\n/**\n * Configuration options for the [[`GuEc2App`]] pattern.\n *\n * To grant EC2 instances additional IAM permissions, use the `roleConfiguration` prop. For example,\n * to allow your app to write to DynamoDB:\n *\n * ```typescript\n * // other props\n * roleConfiguration: {\n *   additionalPolicies: [new GuDynamoDBWritePolicy(stack, \"DynamoTable\", { tableName: \"my-dynamo-table\" })],\n * }\n * ```\n *\n * To create alarms (recommended), use:\n * ```typescript\n * // other props\n * monitoringConfiguration: {\n *   snsTopicName: \"alerts-topic-for-my-team\",\n *   http5xxAlarm: {\n *     tolerated5xxPercentage: 1,\n *   },\n *   unhealthyInstancesAlarm: true,\n * }\n * ```\n *\n * To opt out of creating alarms, use:\n *```typescript\n * // other props\n * monitoringConfiguration: { noMonitoring: true }\n * ```\n *\n * To automatically ship application logs from `stdout` to ELK, use:\n *\n * ```typescript\n * {\n *   // other props\n *   applicationLogging: { enabled: true }\n * }\n * ```\n *\n * For more details on the requirements for application log shipping, see [[`ApplicationLoggingProps`]].\n *\n * To enable access logging for your load balancer, you can specify the prefix to write the logs to.\n * The S3 bucket used to hold these access logs must be specified in SSM at `/account/services/access-logging/bucket`\n * You must specify a region in your stack declaration if you are to use this prop, as specified here:\n * https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html#logwbraccesswbrlogsbucket-prefix\n * For example:\n * ```typescript\n * {\n *   // other props\n *   accessLogging: {\n *     enabled: true,\n *     prefix: \"my-application-logs\"\n *   }\n * }\n *\n * If you would like to enable access logging at the root of the S3 bucket (ie without a prefix), you can omit the prefix\n * For example:\n * ```typescript\n * {\n *   // other props\n *   accessLogging: {\n *     enabled: true,\n *   }\n * }\n * ```\n */\nexport interface GuEc2AppProps extends AppIdentity {\n  userData: GuUserDataProps | string;\n  access: AppAccess;\n  applicationPort: number;\n  roleConfiguration?: GuInstanceRoleProps;\n  monitoringConfiguration: Alarms | NoMonitoring;\n  instanceType: InstanceType;\n  applicationLogging?: ApplicationLoggingProps;\n  accessLogging?: AccessLoggingProps;\n  blockDevices?: BlockDevice[];\n  scaling: GuAsgCapacity;\n  certificateProps?: GuDomainName;\n  withoutImdsv2?: boolean;\n  imageRecipe?: string | AmigoProps;\n  vpc?: IVpc;\n  privateSubnets?: ISubnet[];\n  publicSubnets?: ISubnet[];\n}\n\nfunction restrictedCidrRanges(ranges: IPeer[]) {\n  return ranges.map((range) => ({\n    range,\n    port: Port.tcp(443),\n    description: `Allow access on port 443 from ${range.uniqueId}`,\n  }));\n}\n\n/**\n * Pattern which creates the resources needed to run an application on EC2 instances.\n * For convenience, you may wish to use [[`GuPlayApp`]] or [[`GuNodeApp`]], which extend this class.\n *\n * This pattern will grant your EC2 instances a number of commonly needed IAM permissions. For more information on\n * this, see [[`GuInstanceRole`]]. To add additional permissions to your EC2 instances, see [[`GuEc2AppProps`]].\n *\n * This pattern will automatically create security groups/rules which allow for:\n * 1. Incoming traffic over HTTPS (from the whole internet or from the specified CIDR ranges, depending on the\n * [[`AppAccess`]] specified).\n * 2. Communication between the load balancer and the EC2 instances over HTTP, via the specified application port.\n * 3. Outbound traffic from your EC2 instances over HTTPS (to enable communication with third-party APIs).\n *\n * Example usage for a public facing app (open to the internet):\n * ```typescript\n * new GuEc2App(stack, {\n *   applicationPort: 1234,\n *   app: \"app-name\",\n *   access: { scope: AccessScope.PUBLIC },\n *   instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),\n *   certificateProps:{\n *     domainName: \"domain-name-for-your-application.example\",\n *   },\n *   monitoringConfiguration: {\n *     snsTopicName: \"alerts-topic-for-my-team\",\n *     http5xxAlarm: {\n *       tolerated5xxPercentage: 1,\n *     },\n *     unhealthyInstancesAlarm: true,\n *   },\n *   userData: {\n *     distributable: {\n *       fileName: \"app-name.deb\",\n *       executionStatement: `dpkg -i /app-name/app-name.deb`,\n *     }\n *   },\n * });\n * ```\n *\n * Example usage for an app which is restricted to specific CIDR ranges:\n * ```typescript\n * new GuEc2App(stack, {\n *   applicationPort: 1234,\n *   app: \"app-name\",\n *   access: {\n *     scope: AccessScope.RESTRICTED,\n *     cidrRanges: [Peer.ipv4(\"192.168.1.1/32\"), Peer.ipv4(\"8.8.8.8/32\")],\n *   },\n *   instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),\n *   certificateProps:{\n *     domainName: \"domain-name-for-your-application.example\",\n *   },\n *   monitoringConfiguration: {\n *     snsTopicName: \"alerts-topic-for-my-team\",\n *     http5xxAlarm: {\n *       tolerated5xxPercentage: 1,\n *     },\n *     unhealthyInstancesAlarm: true,\n *   }\n *   userData: {\n *     distributable: {\n *       fileName: \"app-name.deb\",\n *       executionStatement: `dpkg -i /app-name/app-name.deb`,\n *     }\n *   },\n * });\n * ```\n *\n * ### Varying values by stage\n *\n * There are times when you want a resource's configuration to be stage aware,\n * for example the number of instances in an ASG.\n *\n * To do this, we can use a simple ternary:\n * ```typescript\n * new GuEc2App(this, {\n *   // other required properties\n *   scaling: this.stage === \"PROD\" ? { minimumInstances: 6 } : { minimumInstances: 1 }\n * });\n * ```\n *\n * If multiple properties need to be stage aware, consider encoding this into the `props` of the calling class:\n *\n * ```typescript\n * export interface MyAppProps extends GuStackProps {\n *   domainName: string;\n *   scaling: GuAsgCapacity;\n *   monitoringConfiguration: Alarms | NoMonitoring;\n * }\n *\n * export class MyApp extends GuStack {\n *   private static app = \"cdk-playground\";\n *\n *   constructor(scope: App, id: string, props: MyAppProps) {\n *     const { stage, domainName, scaling, monitoringConfiguration } = props;\n *\n *     super(scope, id, props);\n *\n *     new GuPlayApp(this, {\n *       app: \"my-app\",\n *       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MICRO),\n *       access: { scope: AccessScope.PUBLIC },\n *       userData: {\n *         distributable: {\n *           fileName: `my-app.deb`,\n *           executionStatement: `dpkg -i /my-app/my-app.deb`,\n *         },\n *       },\n *       certificateProps: {\n *         domainName,\n *       },\n *       monitoringConfiguration,\n *       scaling,\n *     });\n *   }\n * }\n *\n * new MyApp(app, \"MyApp-CODE\", {\n *   stage: \"CODE\",\n *   domainName: \"my-app.code.dev-gutools.co.uk\",\n *   scaling: { minimumInstances: 1 },\n *   monitoringConfiguration: { noMonitoring: true },\n * });\n *\n * new MyApp(app, \"MyApp-PROD\", {\n *   stage: \"PROD\",\n *   domainName: \"my-app.prod.gutools.co.uk\",\n *   scaling: { minimumInstances: 6 },\n *   monitoringConfiguration: {\n *     // config to enable alarms in PROD\n *   },\n * });\n * ```\n *\n * If you _must_ support a non-standard VPC setup, it's possible to override the VPC and subnet selection into which\n * instances will be started. You need to set the three props below in order for this to work:\n *  vpc: this must be an IVpc instance indicating the VPC to deploy into (usually obtained from `Vpc.fromVpcAttributes`)\n *  privateSubnets: a list of ISubnet indicating the subnets for the autoscaling group to deploy instances into (usually\n *    obtained from `GuVpc.subnets`)\n *  publicSubnets: a list of ISubnet indicating the subnets for the loadbalancer to use, if the loadbalancer\n *    is intended for public access (usually obtained from `GuVpc.subnets`)\n *    On the other hand, if the access is private, then an \"internal\" loadbalancer is used in the `privateSubnets` list.\n * Please note that no checking is applied to the subnet lists to ensure that they correspond to the vpc given; as\n * an advanced feature it is assumed that the caller ensures this.  If the subnets are mismatched then the resulting\n * Cloudformation will fail to deploy.\n *\n * ### Customising the infrastructure generated by this pattern\n *\n * Although we allow users to customise many aspects of their infrastructure via [[`GuEc2AppProps`]], it's possible\n * that there are less common use-cases which are currently unsupported via the API. In these circumstances escape\n * hatches can be used to override specific resources in the stack.\n *\n * In order to do this:\n *\n * 1. Create desired resource using Guardian or AWS constructs, for example:\n * ```typescript\n * const sg = new GuSecurityGroup(\n *   // custom parameters\n * );\n * ```\n * 2. Access the CloudFormation version of the resource that you wish to customise, for example:\n * ```typescript\n * const pattern = new GuEc2App(\n *   // all parameters\n * )\n * const cfnLb = pattern.loadBalancer.node.defaultChild as CfnLoadBalancer;\n * ```\n * 3. Replace the resource generated by the pattern with your bespoke resource, for example:\n * ```typescript\n * cfnLb.securityGroups = [sg.securityGroupId];\n * ```\n */\nexport class GuEc2App extends Construct {\n  /*\n   * These are public for now, as this allows users to\n   * modify these constructs as desired to fit their\n   * specific needs.\n   * In the future, we might build functionality to better enable users\n   * to access in-pattern constructs, but this would allow teams to be unblocked\n   * in the short term.\n   * */\n  public readonly vpc: IVpc;\n  public readonly certificate?: GuCertificate;\n  public readonly loadBalancer: GuApplicationLoadBalancer;\n  public readonly autoScalingGroup: GuAutoScalingGroup;\n  public readonly listener: GuHttpsApplicationListener;\n  public readonly targetGroup: GuApplicationTargetGroup;\n\n  constructor(scope: GuStack, props: GuEc2AppProps) {\n    const {\n      access,\n      accessLogging = { enabled: false },\n      app,\n      // We should update this default once a significant number of apps have migrated to devx-logs\n      applicationLogging = { enabled: false },\n      applicationPort,\n      blockDevices,\n      certificateProps,\n      instanceType,\n      monitoringConfiguration,\n      roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n      scaling: { minimumInstances, maximumInstances = minimumInstances * 2 },\n      userData,\n      withoutImdsv2,\n      imageRecipe,\n      vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n      privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n      publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n    } = props;\n\n    super(scope, app); // The assumption is `app` is unique\n\n    // We should really prevent users from doing this via the type system,\n    // but that requires a breaking change to the API\n    if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n      throw new Error(\n        \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n          \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\"\n      );\n    }\n\n    AppAccess.validate(access);\n\n    const certificate =\n      typeof certificateProps !== \"undefined\"\n        ? new GuCertificate(scope, {\n            app,\n            domainName: certificateProps.domainName,\n            hostedZoneId: certificateProps.hostedZoneId,\n          })\n        : undefined;\n\n    const maybePrivateConfigPolicy =\n      typeof userData !== \"string\" && userData.configuration\n        ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n        : [];\n\n    const mergedRoleConfiguration: GuInstanceRoleProps = {\n      withoutLogShipping: roleConfiguration.withoutLogShipping,\n      additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n    };\n\n    const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n      app,\n      vpc,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      withoutImdsv2,\n      role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n      healthCheck: HealthCheck.elb({ grace: Duration.minutes(2) }), // should this be defaulted at pattern or construct level?\n      userData: typeof userData !== \"string\" ? new GuUserData(scope, { app, ...userData }).userData : userData,\n      vpcSubnets: { subnets: privateSubnets },\n      ...(blockDevices && { blockDevices }),\n      imageRecipe,\n    });\n\n    // This allows automatic shipping of instance Cloud Init logs when using the\n    // `cdk-base` Amigo role on your AMI.\n    Tags.of(autoScalingGroup).add(\n      MetadataKeys.LOG_KINESIS_STREAM_NAME,\n      GuLoggingStreamNameParameter.getInstance(scope).valueAsString\n    );\n\n    if (applicationLogging.enabled) {\n      // This allows automatic shipping of application logs when using the\n      // `cdk-base` Amigo role on your AMI.\n      Tags.of(autoScalingGroup).add(\n        MetadataKeys.SYSTEMD_UNIT,\n        applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`\n      );\n    }\n\n    const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n      app,\n      vpc,\n      // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n      internetFacing: access.scope !== AccessScope.INTERNAL,\n      vpcSubnets: {\n        subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n      },\n    });\n\n    if (accessLogging.enabled) {\n      const accessLoggingBucket = new GuStringParameter(scope, \"AccessLoggingBucket\", {\n        description: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.description,\n        default: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.path,\n        fromSSM: true,\n      });\n\n      loadBalancer.logAccessLogs(\n        Bucket.fromBucketName(\n          scope,\n          AppIdentity.suffixText(props, \"AccessLoggingBucket\"),\n          accessLoggingBucket.valueAsString\n        ),\n        accessLogging.prefix\n      );\n    }\n\n    const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n      app,\n      vpc,\n      protocol: ApplicationProtocol.HTTP,\n      targets: [autoScalingGroup],\n      port: applicationPort,\n    });\n\n    const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n      app,\n      loadBalancer,\n      certificate,\n      targetGroup,\n      // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n      open: access.scope === AccessScope.PUBLIC && typeof certificate !== \"undefined\",\n    });\n\n    // Since AWS won't create a security group automatically when open=false, we need to add our own\n    if (access.scope !== AccessScope.PUBLIC) {\n      loadBalancer.addSecurityGroup(\n        new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n          app,\n          vpc,\n          description: \"Allow restricted ingress from CIDR ranges\",\n          allowAllOutbound: false,\n          ingresses: restrictedCidrRanges(access.cidrRanges),\n        })\n      );\n    }\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const { http5xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n      if (http5xxAlarm) {\n        new GuAlb5xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http5xxAlarm,\n        });\n      }\n      if (unhealthyInstancesAlarm) {\n        new GuUnhealthyInstancesAlarm(scope, {\n          app,\n          targetGroup,\n          snsTopicName,\n        });\n      }\n    }\n\n    this.vpc = vpc;\n    this.certificate = certificate;\n    this.loadBalancer = loadBalancer;\n    this.autoScalingGroup = autoScalingGroup;\n    this.listener = listener;\n    this.targetGroup = targetGroup;\n  }\n}\n"]}

package/lib/patterns/ec2-app/framework.d.ts

@@ -1,7 +1,19 @@
 import type { GuStack } from "../../constructs/core";
+import type { GuDomainName } from "../../types";
 import type { GuEc2AppProps } from "./base";
 import { GuEc2App } from "./base";
-type GuEc2FrameworkAppProps = Omit<GuEc2AppProps, "applicationPort">;
+type GuEc2FrameworkAppProps = Omit<GuEc2AppProps, "applicationPort"> & {
+    certificateProps: GuDomainName;
+};
+type GuEc2WorkerProps = Omit<GuEc2AppProps, "applicationPort" | "access">;
+/**
+ * Creates an instance of [[`GuEc2App`]], with an application port of 9000 and no access to the load balancer.
+ * This is useful for applications that only have an LB for health check purposes
+ */
+export declare class GuPlayWorkerApp extends GuEc2App {
+    static readonly PORT: number;
+    constructor(scope: GuStack, props: GuEc2WorkerProps);
+}
 /**
  * Creates an instance of [[`GuEc2App`]], with an application port of 9000.
  */

package/lib/patterns/ec2-app/framework.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"framework.d.ts","sourceRoot":"","sources":["../../../src/patterns/ec2-app/framework.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC,KAAK,sBAAsB,GAAG,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;AAErE;;GAEG;AACH,qBAAa,SAAU,SAAQ,QAAQ;IACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAQ;gBAExB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB;CAG1D;AAED;;GAEG;AACH,qBAAa,SAAU,SAAQ,QAAQ;IACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAQ;gBAExB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB;CAG1D"}
+{"version":3,"file":"framework.d.ts","sourceRoot":"","sources":["../../../src/patterns/ec2-app/framework.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC,KAAK,sBAAsB,GAAG,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,GAAG;IAAE,gBAAgB,EAAE,YAAY,CAAA;CAAE,CAAC;AAE1G,KAAK,gBAAgB,GAAG,IAAI,CAAC,aAAa,EAAE,iBAAiB,GAAG,QAAQ,CAAC,CAAC;AAE1E;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;IAC3C,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAQ;gBAExB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB;CAOpD;AAED;;GAEG;AACH,qBAAa,SAAU,SAAQ,QAAQ;IACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAQ;gBAExB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB;CAG1D;AAED;;GAEG;AACH,qBAAa,SAAU,SAAQ,QAAQ;IACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAQ;gBAExB,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB;CAG1D"}

package/lib/patterns/ec2-app/framework.js

@@ -5,8 +5,24 @@ The plan is to sprinkle some framework specific tooling into them.
 For example, a Play app should come with the infrastructure for https://github.com/guardian/play-secret-rotation.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GuNodeApp = exports.GuPlayApp = void 0;
+exports.GuNodeApp = exports.GuPlayApp = exports.GuPlayWorkerApp = void 0;
+const constants_1 = require("../../constants");
 const base_1 = require("./base");
+/**
+ * Creates an instance of [[`GuEc2App`]], with an application port of 9000 and no access to the load balancer.
+ * This is useful for applications that only have an LB for health check purposes
+ */
+class GuPlayWorkerApp extends base_1.GuEc2App {
+    constructor(scope, props) {
+        super(scope, {
+            ...props,
+            applicationPort: GuPlayWorkerApp.PORT,
+            access: { scope: constants_1.AccessScope.INTERNAL, cidrRanges: [] },
+        });
+    }
+}
+exports.GuPlayWorkerApp = GuPlayWorkerApp;
+GuPlayWorkerApp.PORT = 9000;
 /**
  * Creates an instance of [[`GuEc2App`]], with an application port of 9000.
  */

package/lib/patterns/ec2-app/framework.js.map

@@ -1 +1 @@
-{"version":3,"file":"framework.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/framework.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAIH,iCAAkC;AAIlC;;GAEG;AACH,MAAa,SAAU,SAAQ,eAAQ;IAGrC,YAAY,KAAc,EAAE,KAA6B;QACvD,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;;AALH,8BAMC;AALiB,cAAI,GAAW,IAAI,CAAC;AAOtC;;GAEG;AACH,MAAa,SAAU,SAAQ,eAAQ;IAGrC,YAAY,KAAc,EAAE,KAA6B;QACvD,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;;AALH,8BAMC;AALiB,cAAI,GAAW,IAAI,CAAC","sourcesContent":["/*\nThese classes don't do anything amazing. Yet!\nThe plan is to sprinkle some framework specific tooling into them.\nFor example, a Play app should come with the infrastructure for https://github.com/guardian/play-secret-rotation.\n */\n\nimport type { GuStack } from \"../../constructs/core\";\nimport type { GuEc2AppProps } from \"./base\";\nimport { GuEc2App } from \"./base\";\n\ntype GuEc2FrameworkAppProps = Omit<GuEc2AppProps, \"applicationPort\">;\n\n/**\n * Creates an instance of [[`GuEc2App`]], with an application port of 9000.\n */\nexport class GuPlayApp extends GuEc2App {\n  static readonly PORT: number = 9000;\n\n  constructor(scope: GuStack, props: GuEc2FrameworkAppProps) {\n    super(scope, { ...props, applicationPort: GuPlayApp.PORT });\n  }\n}\n\n/**\n * Creates an instance of [[`GuEc2App`]], with an application port of 3000.\n */\nexport class GuNodeApp extends GuEc2App {\n  static readonly PORT: number = 3000;\n\n  constructor(scope: GuStack, props: GuEc2FrameworkAppProps) {\n    super(scope, { ...props, applicationPort: GuNodeApp.PORT });\n  }\n}\n"]}
+{"version":3,"file":"framework.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/framework.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,+CAA8C;AAI9C,iCAAkC;AAMlC;;;GAGG;AACH,MAAa,eAAgB,SAAQ,eAAQ;IAG3C,YAAY,KAAc,EAAE,KAAuB;QACjD,KAAK,CAAC,KAAK,EAAE;YACX,GAAG,KAAK;YACR,eAAe,EAAE,eAAe,CAAC,IAAI;YACrC,MAAM,EAAE,EAAE,KAAK,EAAE,uBAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;;AATH,0CAUC;AATiB,oBAAI,GAAW,IAAI,CAAC;AAWtC;;GAEG;AACH,MAAa,SAAU,SAAQ,eAAQ;IAGrC,YAAY,KAAc,EAAE,KAA6B;QACvD,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;;AALH,8BAMC;AALiB,cAAI,GAAW,IAAI,CAAC;AAOtC;;GAEG;AACH,MAAa,SAAU,SAAQ,eAAQ;IAGrC,YAAY,KAAc,EAAE,KAA6B;QACvD,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;;AALH,8BAMC;AALiB,cAAI,GAAW,IAAI,CAAC","sourcesContent":["/*\nThese classes don't do anything amazing. Yet!\nThe plan is to sprinkle some framework specific tooling into them.\nFor example, a Play app should come with the infrastructure for https://github.com/guardian/play-secret-rotation.\n */\n\nimport { AccessScope } from \"../../constants\";\nimport type { GuStack } from \"../../constructs/core\";\nimport type { GuDomainName } from \"../../types\";\nimport type { GuEc2AppProps } from \"./base\";\nimport { GuEc2App } from \"./base\";\n\ntype GuEc2FrameworkAppProps = Omit<GuEc2AppProps, \"applicationPort\"> & { certificateProps: GuDomainName };\n\ntype GuEc2WorkerProps = Omit<GuEc2AppProps, \"applicationPort\" | \"access\">;\n\n/**\n * Creates an instance of [[`GuEc2App`]], with an application port of 9000 and no access to the load balancer.\n * This is useful for applications that only have an LB for health check purposes\n */\nexport class GuPlayWorkerApp extends GuEc2App {\n  static readonly PORT: number = 9000;\n\n  constructor(scope: GuStack, props: GuEc2WorkerProps) {\n    super(scope, {\n      ...props,\n      applicationPort: GuPlayWorkerApp.PORT,\n      access: { scope: AccessScope.INTERNAL, cidrRanges: [] },\n    });\n  }\n}\n\n/**\n * Creates an instance of [[`GuEc2App`]], with an application port of 9000.\n */\nexport class GuPlayApp extends GuEc2App {\n  static readonly PORT: number = 9000;\n\n  constructor(scope: GuStack, props: GuEc2FrameworkAppProps) {\n    super(scope, { ...props, applicationPort: GuPlayApp.PORT });\n  }\n}\n\n/**\n * Creates an instance of [[`GuEc2App`]], with an application port of 3000.\n */\nexport class GuNodeApp extends GuEc2App {\n  static readonly PORT: number = 3000;\n\n  constructor(scope: GuStack, props: GuEc2FrameworkAppProps) {\n    super(scope, { ...props, applicationPort: GuNodeApp.PORT });\n  }\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@guardian/cdk",
   "description": "Generic Guardian flavoured AWS CDK components",
-  "version": "49.3.0",
+  "version": "49.4.1",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [
@@ -35,29 +35,29 @@
     "@types/lodash.camelcase": "^4.3.7",
     "@types/lodash.kebabcase": "^4.1.7",
     "@types/lodash.upperfirst": "^4.3.7",
-    "@types/node": "18.13.0",
+    "@types/node": "18.14.6",
     "@types/yargs": "^17.0.19",
-    "aws-cdk": "2.64.0",
+    "aws-cdk": "2.68.0",
     "cz-conventional-changelog": "^3.3.0",
-    "eslint": "^8.33.0",
+    "eslint": "^8.35.0",
     "eslint-plugin-custom-rules": "file:tools/eslint",
     "gh-pages": "^5.0.0",
-    "jest": "^29.4.3",
+    "jest": "^29.5.0",
     "prettier": "^2.8.4",
     "semantic-release": "^19.0.5",
     "serve": "^14.2.0",
     "ts-jest": "^29.0.5",
     "ts-node": "^10.9.1",
-    "typedoc": "^0.23.25",
+    "typedoc": "^0.23.26",
     "typescript": "~4.9.5"
   },
   "dependencies": {
     "@oclif/core": "1.24.2",
-    "aws-cdk-lib": "2.64.0",
-    "aws-sdk": "^2.1315.0",
+    "aws-cdk-lib": "2.68.0",
+    "aws-sdk": "^2.1326.0",
     "chalk": "^4.1.2",
-    "codemaker": "^1.75.0",
-    "constructs": "10.1.246",
+    "codemaker": "^1.77.0",
+    "constructs": "10.1.273",
     "git-url-parse": "^13.1.0",
     "js-yaml": "^4.1.0",
     "lodash.camelcase": "^4.3.0",
@@ -67,9 +67,9 @@
     "yargs": "^17.6.2"
   },
   "peerDependencies": {
-    "aws-cdk": "2.64.0",
-    "aws-cdk-lib": "2.64.0",
-    "constructs": "10.1.246"
+    "aws-cdk": "2.68.0",
+    "aws-cdk-lib": "2.68.0",
+    "constructs": "10.1.273"
   },
   "config": {
     "commitizen": {