@guardian/cdk 50.12.2 → 50.13.0

package/lib/bin/index.js

@@ -71,11 +71,19 @@ parseCommandLineArguments()
             return (0, aws_cdk_version_1.awsCdkVersionCommand)();
         }
         case Commands.AccountReadiness: {
-            const { profile, region } = argv;
-            return (0, account_readiness_1.accountReadinessCommand)({ credentialProvider: (0, aws_credential_provider_1.awsCredentialProviderChain)(profile), region });
+            // TODO remove casting as yargs should be able to infer the type of the options
+            const profile = argv.profile;
+            const region = argv.region;
+            return (0, account_readiness_1.accountReadinessCommand)({ credentialProvider: (0, aws_credential_provider_1.awsCredentialProviderChain)(profile), region: region });
         }
         case Commands.New: {
-            const { init, app, stack, yamlTemplateLocation, stage, packageManager } = argv;
+            // TODO remove casting as yargs should be able to infer the type of the options
+            const init = argv.init;
+            const app = argv.app;
+            const stack = argv.stack;
+            const yamlTemplateLocation = argv["yaml-template-location"];
+            const stage = argv.stage;
+            const packageManager = argv["package-manager"];
             const stages = stage.map((_) => _.toUpperCase());
             return (0, new_project_1.newCdkProject)({
                 init,

package/lib/bin/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/bin/index.ts"],"names":[],"mappings":";;;;;;AAEA,kDAA0B;AAC1B,4CAA2C;AAE3C,uEAAuE;AACvE,oEAAuE;AACvE,gEAAkE;AAElE,wDAAuD;AAEvD,MAAM,QAAQ,GAAG;IACf,aAAa,EAAE,iBAAiB;IAChC,gBAAgB,EAAE,mBAAmB;IACrC,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,yBAAyB,GAAG,GAAG,EAAE;IACrC;;;;;OAKG;IACH,OAAO,OAAO,CAAC,OAAO,CACpB,eAAK;SACF,KAAK,CAAC,mBAAmB,CAAC;SAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,mDAAmD,CAAC;SACpF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,EAAE,8DAA8D,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5G,KAAK;SACF,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;SACjE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CACzF;SACA,OAAO,CACN,QAAQ,CAAC,GAAG,EACZ,kFAAkF,EAClF,CAAC,KAAK,EAAE,EAAE,CACR,KAAK;SACF,MAAM,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,qFAAqF;QAClG,OAAO,EAAE,IAAI;KACd,CAAC;SACD,MAAM,CAAC,KAAK,EAAE;QACb,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,yCAAyC;QACtD,YAAY,EAAE,IAAI;KACnB,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,4HAA4H;QAC9H,YAAY,EAAE,IAAI;KACnB,CAAC;SACD,MAAM,CAAC,wBAAwB,EAAE;QAChC,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0CAA0C;KACxD,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,WAAW,EACT,8FAA8F;QAChG,IAAI,EAAE,OAAO;QACb,YAAY,EAAE,IAAI;KACnB,CAAC;SACD,MAAM,CAAC,iBAAiB,EAAE;QACzB,WAAW,EACT,kNAAkN;QACpN,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,IAAI;KACnB,CAAC,CACP;SACA,OAAO,CACN,GAAG,uBAAW,CAAC,OAAO,uBAAuB,uBAAW,CAAC,eAAe,gBAAgB,uBAAW,CAAC,kBAAkB,GAAG,CAC1H;SACA,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB;SACvC,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,CAC3B,CAAC;AACJ,CAAC,CAAC;AAEF,yBAAyB,EAAE;KACxB,IAAI,CAAC,CAAC,IAAI,EAAsB,EAAE;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,QAAQ,OAAO,EAAE;QACf,KAAK,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC3B,OAAO,IAAA,sCAAoB,GAAE,CAAC;SAC/B;QACD,KAAK,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YAC9B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;YACjC,OAAO,IAAA,2CAAuB,EAAC,EAAE,kBAAkB,EAAE,IAAA,oDAA0B,EAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;SACrG;QACD,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;YAC/E,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAY,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7D,OAAO,IAAA,2BAAa,EAAC;gBACnB,IAAI;gBACJ,GAAG;gBACH,KAAK;gBACL,oBAAoB;gBACpB,MAAM;gBACN,cAAc,EAAE,cAAgC;aACjD,CAAC,CAAC;SACJ;QACD;YACE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;KACxD;AACH,CAAC,CAAC;KACD,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE;IACxB,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE;QACvC,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAC;KACpC;SAAM,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE;QAC9C,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;KAC9B;SAAM;QACL,MAAM,uBAAuB,GAAG,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,uBAAW,CAAC,OAAO,EAAE,EAAE,GAAG,eAAe,EAAE,CAAC;QAC1G,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC,CAAC;KACtD;AACH,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\n\nimport yargs from \"yargs\";\nimport { LibraryInfo } from \"../constants\";\nimport type { CliCommandResponse } from \"../types/cli\";\nimport { awsCredentialProviderChain } from \"./aws-credential-provider\";\nimport { accountReadinessCommand } from \"./commands/account-readiness\";\nimport { awsCdkVersionCommand } from \"./commands/aws-cdk-version\";\nimport type { PackageManager } from \"./commands/new-project\";\nimport { newCdkProject } from \"./commands/new-project\";\n\nconst Commands = {\n  AwsCdkVersion: \"aws-cdk-version\",\n  AccountReadiness: \"account-readiness\",\n  New: \"new\",\n};\n\nconst parseCommandLineArguments = () => {\n  /*\n  The type of `yargs.argv` is `T | Promise<T>`.\n  To avoid creating custom type guards, use `Promise.resolve` which takes `T | PromiseLike<T>` and returns `Promise<T>`.\n  That is, use `Promise.resolve` to provide a single type.\n  See https://github.com/DefinitelyTyped/DefinitelyTyped/blob/7b2f0d45985538a40df96244481bfc6cd309c250/types/yargs/index.d.ts#L74\n   */\n  return Promise.resolve(\n    yargs\n      .usage(\"$0 COMMAND [args]\")\n      .command(Commands.AwsCdkVersion, \"Print the version of AWS CDK libraries being used\")\n      .command(Commands.AccountReadiness, \"Perform checks on an AWS account to see if it is GuCDK ready\", (yargs) =>\n        yargs\n          .option(\"profile\", { type: \"string\", description: \"AWS profile\" })\n          .option(\"region\", { type: \"string\", description: \"AWS region\", default: \"eu-west-1\" }),\n      )\n      .command(\n        Commands.New,\n        \"Creates a new CDK project within a `cdk` directory at the root of the repository\",\n        (yargs) =>\n          yargs\n            .option(\"init\", {\n              type: \"boolean\",\n              description: \"Create the cdk directory before building the app and stack files (defaults to true)\",\n              default: true,\n            })\n            .option(\"app\", {\n              type: \"string\",\n              description: \"The name of your application e.g. Amigo\",\n              demandOption: true,\n            })\n            .option(\"stack\", {\n              type: \"string\",\n              description:\n                \"The Guardian stack being used (as defined in your riff-raff.yaml). This will be applied as a tag to all of your resources.\",\n              demandOption: true,\n            })\n            .option(\"yaml-template-location\", {\n              type: \"string\",\n              description: \"Path to the YAML CloudFormation template\",\n            })\n            .option(\"stage\", {\n              description:\n                \"The stage(s) for your stack. Can be specified multiple times, e.g. --stage CODE --stage PROD\",\n              type: \"array\",\n              demandOption: true,\n            })\n            .option(\"package-manager\", {\n              description:\n                \"The Node package manager to use. Match this to the repository (package-lock.json = npm, yarn.lock = yarn). If the repository has neither file, and there is no strong convention in your team, we recommend npm.\",\n              choices: [\"npm\", \"yarn\"],\n              demandOption: true,\n            }),\n      )\n      .version(\n        `${LibraryInfo.VERSION} (using aws-cdk-lib ${LibraryInfo.AWS_CDK_VERSION}, constructs ${LibraryInfo.CONSTRUCTS_VERSION})`,\n      )\n      .demandCommand(1, \"\") // just print help\n      .help()\n      .alias(\"h\", \"help\").argv,\n  );\n};\n\nparseCommandLineArguments()\n  .then((argv): CliCommandResponse => {\n    const command = argv._[0];\n    switch (command) {\n      case Commands.AwsCdkVersion: {\n        return awsCdkVersionCommand();\n      }\n      case Commands.AccountReadiness: {\n        const { profile, region } = argv;\n        return accountReadinessCommand({ credentialProvider: awsCredentialProviderChain(profile), region });\n      }\n      case Commands.New: {\n        const { init, app, stack, yamlTemplateLocation, stage, packageManager } = argv;\n        const stages = stage.map((_) => (_ as string).toUpperCase());\n        return newCdkProject({\n          init,\n          app,\n          stack,\n          yamlTemplateLocation,\n          stages,\n          packageManager: packageManager as PackageManager,\n        });\n      }\n      default:\n        throw new Error(`Unknown command: ${command ?? \"\"}`);\n    }\n  })\n  .then((commandResponse) => {\n    if (typeof commandResponse === \"number\") {\n      process.exitCode = commandResponse;\n    } else if (typeof commandResponse === \"string\") {\n      console.log(commandResponse);\n    } else {\n      const responseWithVersionInfo = { \"@guardian/cdk\": { version: LibraryInfo.VERSION }, ...commandResponse };\n      console.log(JSON.stringify(responseWithVersionInfo));\n    }\n  })\n  .catch((err) => {\n    console.error(err);\n    process.exitCode = 1;\n  });\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/bin/index.ts"],"names":[],"mappings":";;;;;;AAEA,kDAA0B;AAC1B,4CAA2C;AAE3C,uEAAuE;AACvE,oEAAuE;AACvE,gEAAkE;AAElE,wDAAuD;AAEvD,MAAM,QAAQ,GAAG;IACf,aAAa,EAAE,iBAAiB;IAChC,gBAAgB,EAAE,mBAAmB;IACrC,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,yBAAyB,GAAG,GAAG,EAAE;IACrC;;;;;OAKG;IACH,OAAO,OAAO,CAAC,OAAO,CACpB,eAAK;SACF,KAAK,CAAC,mBAAmB,CAAC;SAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,mDAAmD,CAAC;SACpF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,EAAE,8DAA8D,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5G,KAAK;SACF,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;SACjE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CACzF;SACA,OAAO,CACN,QAAQ,CAAC,GAAG,EACZ,kFAAkF,EAClF,CAAC,KAAK,EAAE,EAAE,CACR,KAAK;SACF,MAAM,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,qFAAqF;QAClG,OAAO,EAAE,IAAI;KACd,CAAC;SACD,MAAM,CAAC,KAAK,EAAE;QACb,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,yCAAyC;QACtD,YAAY,EAAE,IAAI;KACnB,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,4HAA4H;QAC9H,YAAY,EAAE,IAAI;KACnB,CAAC;SACD,MAAM,CAAC,wBAAwB,EAAE;QAChC,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0CAA0C;KACxD,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,WAAW,EACT,8FAA8F;QAChG,IAAI,EAAE,OAAO;QACb,YAAY,EAAE,IAAI;KACnB,CAAC;SACD,MAAM,CAAC,iBAAiB,EAAE;QACzB,WAAW,EACT,kNAAkN;QACpN,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,IAAI;KACnB,CAAC,CACP;SACA,OAAO,CACN,GAAG,uBAAW,CAAC,OAAO,uBAAuB,uBAAW,CAAC,eAAe,gBAAgB,uBAAW,CAAC,kBAAkB,GAAG,CAC1H;SACA,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB;SACvC,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,CAC3B,CAAC;AACJ,CAAC,CAAC;AAEF,yBAAyB,EAAE;KACxB,IAAI,CAAC,CAAC,IAAI,EAAsB,EAAE;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,QAAQ,OAAO,EAAE;QACf,KAAK,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC3B,OAAO,IAAA,sCAAoB,GAAE,CAAC;SAC/B;QACD,KAAK,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YAC9B,+EAA+E;YAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAiB,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgB,CAAC;YACrC,OAAO,IAAA,2CAAuB,EAAC,EAAE,kBAAkB,EAAE,IAAA,oDAA0B,EAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;SAC7G;QACD,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjB,+EAA+E;YAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAe,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAa,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAe,CAAC;YACnC,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,CAAuB,CAAC;YAClF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAiB,CAAC;YACrC,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAW,CAAC;YAEzD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACjD,OAAO,IAAA,2BAAa,EAAC;gBACnB,IAAI;gBACJ,GAAG;gBACH,KAAK;gBACL,oBAAoB;gBACpB,MAAM;gBACN,cAAc,EAAE,cAAgC;aACjD,CAAC,CAAC;SACJ;QACD;YACE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;KACxD;AACH,CAAC,CAAC;KACD,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE;IACxB,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE;QACvC,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAC;KACpC;SAAM,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE;QAC9C,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;KAC9B;SAAM;QACL,MAAM,uBAAuB,GAAG,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,uBAAW,CAAC,OAAO,EAAE,EAAE,GAAG,eAAe,EAAE,CAAC;QAC1G,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC,CAAC;KACtD;AACH,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\n\nimport yargs from \"yargs\";\nimport { LibraryInfo } from \"../constants\";\nimport type { CliCommandResponse } from \"../types/cli\";\nimport { awsCredentialProviderChain } from \"./aws-credential-provider\";\nimport { accountReadinessCommand } from \"./commands/account-readiness\";\nimport { awsCdkVersionCommand } from \"./commands/aws-cdk-version\";\nimport type { PackageManager } from \"./commands/new-project\";\nimport { newCdkProject } from \"./commands/new-project\";\n\nconst Commands = {\n  AwsCdkVersion: \"aws-cdk-version\",\n  AccountReadiness: \"account-readiness\",\n  New: \"new\",\n};\n\nconst parseCommandLineArguments = () => {\n  /*\n  The type of `yargs.argv` is `T | Promise<T>`.\n  To avoid creating custom type guards, use `Promise.resolve` which takes `T | PromiseLike<T>` and returns `Promise<T>`.\n  That is, use `Promise.resolve` to provide a single type.\n  See https://github.com/DefinitelyTyped/DefinitelyTyped/blob/7b2f0d45985538a40df96244481bfc6cd309c250/types/yargs/index.d.ts#L74\n   */\n  return Promise.resolve(\n    yargs\n      .usage(\"$0 COMMAND [args]\")\n      .command(Commands.AwsCdkVersion, \"Print the version of AWS CDK libraries being used\")\n      .command(Commands.AccountReadiness, \"Perform checks on an AWS account to see if it is GuCDK ready\", (yargs) =>\n        yargs\n          .option(\"profile\", { type: \"string\", description: \"AWS profile\" })\n          .option(\"region\", { type: \"string\", description: \"AWS region\", default: \"eu-west-1\" }),\n      )\n      .command(\n        Commands.New,\n        \"Creates a new CDK project within a `cdk` directory at the root of the repository\",\n        (yargs) =>\n          yargs\n            .option(\"init\", {\n              type: \"boolean\",\n              description: \"Create the cdk directory before building the app and stack files (defaults to true)\",\n              default: true,\n            })\n            .option(\"app\", {\n              type: \"string\",\n              description: \"The name of your application e.g. Amigo\",\n              demandOption: true,\n            })\n            .option(\"stack\", {\n              type: \"string\",\n              description:\n                \"The Guardian stack being used (as defined in your riff-raff.yaml). This will be applied as a tag to all of your resources.\",\n              demandOption: true,\n            })\n            .option(\"yaml-template-location\", {\n              type: \"string\",\n              description: \"Path to the YAML CloudFormation template\",\n            })\n            .option(\"stage\", {\n              description:\n                \"The stage(s) for your stack. Can be specified multiple times, e.g. --stage CODE --stage PROD\",\n              type: \"array\",\n              demandOption: true,\n            })\n            .option(\"package-manager\", {\n              description:\n                \"The Node package manager to use. Match this to the repository (package-lock.json = npm, yarn.lock = yarn). If the repository has neither file, and there is no strong convention in your team, we recommend npm.\",\n              choices: [\"npm\", \"yarn\"],\n              demandOption: true,\n            }),\n      )\n      .version(\n        `${LibraryInfo.VERSION} (using aws-cdk-lib ${LibraryInfo.AWS_CDK_VERSION}, constructs ${LibraryInfo.CONSTRUCTS_VERSION})`,\n      )\n      .demandCommand(1, \"\") // just print help\n      .help()\n      .alias(\"h\", \"help\").argv,\n  );\n};\n\nparseCommandLineArguments()\n  .then((argv): CliCommandResponse => {\n    const command = argv._[0];\n    switch (command) {\n      case Commands.AwsCdkVersion: {\n        return awsCdkVersionCommand();\n      }\n      case Commands.AccountReadiness: {\n        // TODO remove casting as yargs should be able to infer the type of the options\n        const profile = argv.profile as string;\n        const region = argv.region as string;\n        return accountReadinessCommand({ credentialProvider: awsCredentialProviderChain(profile), region: region });\n      }\n      case Commands.New: {\n        // TODO remove casting as yargs should be able to infer the type of the options\n        const init = argv.init as boolean;\n        const app = argv.app as string;\n        const stack = argv.stack as string;\n        const yamlTemplateLocation = argv[\"yaml-template-location\"] as string | undefined;\n        const stage = argv.stage as string[];\n        const packageManager = argv[\"package-manager\"] as string;\n\n        const stages = stage.map((_) => _.toUpperCase());\n        return newCdkProject({\n          init,\n          app,\n          stack,\n          yamlTemplateLocation,\n          stages,\n          packageManager: packageManager as PackageManager,\n        });\n      }\n      default:\n        throw new Error(`Unknown command: ${command ?? \"\"}`);\n    }\n  })\n  .then((commandResponse) => {\n    if (typeof commandResponse === \"number\") {\n      process.exitCode = commandResponse;\n    } else if (typeof commandResponse === \"string\") {\n      console.log(commandResponse);\n    } else {\n      const responseWithVersionInfo = { \"@guardian/cdk\": { version: LibraryInfo.VERSION }, ...commandResponse };\n      console.log(JSON.stringify(responseWithVersionInfo));\n    }\n  })\n  .catch((err) => {\n    console.error(err);\n    process.exitCode = 1;\n  });\n"]}

package/lib/constructs/cloudwatch/alarm.d.ts

@@ -5,6 +5,10 @@ export interface GuAlarmProps extends AlarmProps, AppIdentity {
     snsTopicName: string;
     okAction?: boolean;
 }
+export interface Http4xxAlarmProps extends Omit<GuAlarmProps, "snsTopicName" | "evaluationPeriods" | "metric" | "period" | "threshold" | "treatMissingData" | "app"> {
+    tolerated4xxPercentage: number;
+    numberOfMinutesAboveThresholdBeforeAlarm?: number;
+}
 export interface Http5xxAlarmProps extends Omit<GuAlarmProps, "snsTopicName" | "evaluationPeriods" | "metric" | "period" | "threshold" | "treatMissingData" | "app"> {
     tolerated5xxPercentage: number;
     numberOfMinutesAboveThresholdBeforeAlarm?: number;

package/lib/constructs/cloudwatch/alarm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alarm.d.ts","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/alarm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAI7D,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEpD,MAAM,WAAW,YAAa,SAAQ,UAAU,EAAE,WAAW;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBACf,SAAQ,IAAI,CACV,YAAY,EACZ,cAAc,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,kBAAkB,GAAG,KAAK,CACtG;IACD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wCAAwC,CAAC,EAAE,MAAM,CAAC;CACnD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,OAAQ,SAAQ,KAAK;gBACpB,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;CAa5D"}
+{"version":3,"file":"alarm.d.ts","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/alarm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAI7D,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEpD,MAAM,WAAW,YAAa,SAAQ,UAAU,EAAE,WAAW;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBACf,SAAQ,IAAI,CACV,YAAY,EACZ,cAAc,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,kBAAkB,GAAG,KAAK,CACtG;IACD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wCAAwC,CAAC,EAAE,MAAM,CAAC;CACnD;AAED,MAAM,WAAW,iBACf,SAAQ,IAAI,CACV,YAAY,EACZ,cAAc,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,kBAAkB,GAAG,KAAK,CACtG;IACD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wCAAwC,CAAC,EAAE,MAAM,CAAC;CACnD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,OAAQ,SAAQ,KAAK;gBACpB,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;CAa5D"}

package/lib/constructs/cloudwatch/alarm.js.map

@@ -1 +1 @@
-{"version":3,"file":"alarm.js","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/alarm.ts"],"names":[],"mappings":";;;AAAA,+DAAmD;AAEnD,+EAA+D;AAC/D,iDAA4C;AAkB5C;;;;;;;;;;;;;;;GAeG;AACH,MAAa,OAAQ,SAAQ,sBAAK;IAChC,YAAY,KAAc,EAAE,EAAU,EAAE,KAAmB;QACzD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAClC,MAAM,EAAE,YAAY,EAAE,cAAc,GAAG,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAEhE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAW,eAAe,MAAM,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;QAC5E,MAAM,QAAQ,GAAW,eAAK,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjF,IAAI,CAAC,cAAc,CAAC,IAAI,kCAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,IAAI,QAAQ,EAAE;YACZ,IAAI,CAAC,WAAW,CAAC,IAAI,kCAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;SAC3C;IACH,CAAC;CACF;AAdD,0BAcC","sourcesContent":["import { Alarm } from \"aws-cdk-lib/aws-cloudwatch\";\nimport type { AlarmProps } from \"aws-cdk-lib/aws-cloudwatch\";\nimport { SnsAction } from \"aws-cdk-lib/aws-cloudwatch-actions\";\nimport { Topic } from \"aws-cdk-lib/aws-sns\";\nimport type { ITopic } from \"aws-cdk-lib/aws-sns\";\nimport type { AppIdentity, GuStack } from \"../core\";\n\nexport interface GuAlarmProps extends AlarmProps, AppIdentity {\n  snsTopicName: string;\n  okAction?: boolean;\n}\n\nexport interface Http5xxAlarmProps\n  extends Omit<\n    GuAlarmProps,\n    \"snsTopicName\" | \"evaluationPeriods\" | \"metric\" | \"period\" | \"threshold\" | \"treatMissingData\" | \"app\"\n  > {\n  tolerated5xxPercentage: number;\n  numberOfMinutesAboveThresholdBeforeAlarm?: number;\n}\n\n/**\n * Creates a CloudWatch alarm which sends notifications to the specified SNS topic.\n *\n * Alarm actions are enabled by default.\n *\n * To enable the alarm only in PROD, use the value of `Stage`:\n * ```typescript\n * new GuAlarm(stack, \"alarm\", {\n *   // other required props\n *   actionsEnabled: this.stage === \"PROD\",\n * });\n * ```\n *\n * This library provides an implementation of some commonly used alarms, which require less boilerplate than this construct,\n * for example the [[`GuAlb5xxPercentageAlarm`]]. Prefer using these more specific implementations where possible.\n */\nexport class GuAlarm extends Alarm {\n  constructor(scope: GuStack, id: string, props: GuAlarmProps) {\n    const { region, account } = scope;\n    const { snsTopicName, actionsEnabled = true, okAction } = props;\n\n    super(scope, id, { ...props, actionsEnabled });\n\n    const topicArn: string = `arn:aws:sns:${region}:${account}:${snsTopicName}`;\n    const snsTopic: ITopic = Topic.fromTopicArn(scope, `SnsTopicFor${id}`, topicArn);\n    this.addAlarmAction(new SnsAction(snsTopic));\n    if (okAction) {\n      this.addOkAction(new SnsAction(snsTopic));\n    }\n  }\n}\n"]}
+{"version":3,"file":"alarm.js","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/alarm.ts"],"names":[],"mappings":";;;AAAA,+DAAmD;AAEnD,+EAA+D;AAC/D,iDAA4C;AA2B5C;;;;;;;;;;;;;;;GAeG;AACH,MAAa,OAAQ,SAAQ,sBAAK;IAChC,YAAY,KAAc,EAAE,EAAU,EAAE,KAAmB;QACzD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAClC,MAAM,EAAE,YAAY,EAAE,cAAc,GAAG,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAEhE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAW,eAAe,MAAM,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;QAC5E,MAAM,QAAQ,GAAW,eAAK,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjF,IAAI,CAAC,cAAc,CAAC,IAAI,kCAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,IAAI,QAAQ,EAAE;YACZ,IAAI,CAAC,WAAW,CAAC,IAAI,kCAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;SAC3C;IACH,CAAC;CACF;AAdD,0BAcC","sourcesContent":["import { Alarm } from \"aws-cdk-lib/aws-cloudwatch\";\nimport type { AlarmProps } from \"aws-cdk-lib/aws-cloudwatch\";\nimport { SnsAction } from \"aws-cdk-lib/aws-cloudwatch-actions\";\nimport { Topic } from \"aws-cdk-lib/aws-sns\";\nimport type { ITopic } from \"aws-cdk-lib/aws-sns\";\nimport type { AppIdentity, GuStack } from \"../core\";\n\nexport interface GuAlarmProps extends AlarmProps, AppIdentity {\n  snsTopicName: string;\n  okAction?: boolean;\n}\n\nexport interface Http4xxAlarmProps\n  extends Omit<\n    GuAlarmProps,\n    \"snsTopicName\" | \"evaluationPeriods\" | \"metric\" | \"period\" | \"threshold\" | \"treatMissingData\" | \"app\"\n  > {\n  tolerated4xxPercentage: number;\n  numberOfMinutesAboveThresholdBeforeAlarm?: number;\n}\n\nexport interface Http5xxAlarmProps\n  extends Omit<\n    GuAlarmProps,\n    \"snsTopicName\" | \"evaluationPeriods\" | \"metric\" | \"period\" | \"threshold\" | \"treatMissingData\" | \"app\"\n  > {\n  tolerated5xxPercentage: number;\n  numberOfMinutesAboveThresholdBeforeAlarm?: number;\n}\n\n/**\n * Creates a CloudWatch alarm which sends notifications to the specified SNS topic.\n *\n * Alarm actions are enabled by default.\n *\n * To enable the alarm only in PROD, use the value of `Stage`:\n * ```typescript\n * new GuAlarm(stack, \"alarm\", {\n *   // other required props\n *   actionsEnabled: this.stage === \"PROD\",\n * });\n * ```\n *\n * This library provides an implementation of some commonly used alarms, which require less boilerplate than this construct,\n * for example the [[`GuAlb5xxPercentageAlarm`]]. Prefer using these more specific implementations where possible.\n */\nexport class GuAlarm extends Alarm {\n  constructor(scope: GuStack, id: string, props: GuAlarmProps) {\n    const { region, account } = scope;\n    const { snsTopicName, actionsEnabled = true, okAction } = props;\n\n    super(scope, id, { ...props, actionsEnabled });\n\n    const topicArn: string = `arn:aws:sns:${region}:${account}:${snsTopicName}`;\n    const snsTopic: ITopic = Topic.fromTopicArn(scope, `SnsTopicFor${id}`, topicArn);\n    this.addAlarmAction(new SnsAction(snsTopic));\n    if (okAction) {\n      this.addOkAction(new SnsAction(snsTopic));\n    }\n  }\n}\n"]}

package/lib/constructs/cloudwatch/ec2-alarms.d.ts

@@ -2,7 +2,10 @@ import type { GuStack } from "../core";
 import { AppIdentity } from "../core";
 import type { GuApplicationLoadBalancer, GuApplicationTargetGroup } from "../loadbalancing";
 import { GuAlarm } from "./alarm";
-import type { GuAlarmProps, Http5xxAlarmProps } from "./alarm";
+import type { GuAlarmProps, Http4xxAlarmProps, Http5xxAlarmProps } from "./alarm";
+interface GuAlb4xxPercentageAlarmProps extends Pick<GuAlarmProps, "snsTopicName">, Http4xxAlarmProps, AppIdentity {
+    loadBalancer: GuApplicationLoadBalancer;
+}
 interface GuAlb5xxPercentageAlarmProps extends Pick<GuAlarmProps, "snsTopicName">, Http5xxAlarmProps, AppIdentity {
     loadBalancer: GuApplicationLoadBalancer;
 }
@@ -16,6 +19,13 @@ interface GuUnhealthyInstancesAlarmProps extends Pick<GuAlarmProps, "snsTopicNam
 export declare class GuAlb5xxPercentageAlarm extends GuAlarm {
     constructor(scope: GuStack, props: GuAlb5xxPercentageAlarmProps);
 }
+/**
+ * Creates an alarm which is triggered whenever the percentage of requests with a 4xx response code exceeds
+ * the specified threshold.
+ */
+export declare class GuAlb4xxPercentageAlarm extends GuAlarm {
+    constructor(scope: GuStack, props: GuAlb4xxPercentageAlarmProps);
+}
 /**
  * Creates an alarm which is triggered whenever there have been several healthcheck failures within a single hour.
  */

package/lib/constructs/cloudwatch/ec2-alarms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ec2-alarms.d.ts","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/ec2-alarms.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,KAAK,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE/D,UAAU,4BAA6B,SAAQ,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,iBAAiB,EAAE,WAAW;IAC/G,YAAY,EAAE,yBAAyB,CAAC;CACzC;AAED,UAAU,8BAA+B,SAAQ,IAAI,CAAC,YAAY,EAAE,cAAc,GAAG,gBAAgB,CAAC,EAAE,WAAW;IACjH,WAAW,EAAE,wBAAwB,CAAC;CACvC;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,OAAO;gBACtC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B;CAyBhE;AAED;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,OAAO;gBACxC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,8BAA8B;CAyBlE"}
+{"version":3,"file":"ec2-alarms.d.ts","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/ec2-alarms.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,KAAK,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAElF,UAAU,4BAA6B,SAAQ,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,iBAAiB,EAAE,WAAW;IAC/G,YAAY,EAAE,yBAAyB,CAAC;CACzC;AACD,UAAU,4BAA6B,SAAQ,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,iBAAiB,EAAE,WAAW;IAC/G,YAAY,EAAE,yBAAyB,CAAC;CACzC;AAED,UAAU,8BAA+B,SAAQ,IAAI,CAAC,YAAY,EAAE,cAAc,GAAG,gBAAgB,CAAC,EAAE,WAAW;IACjH,WAAW,EAAE,wBAAwB,CAAC;CACvC;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,OAAO;gBACtC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B;CAyBhE;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,OAAO;gBACtC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B;CAyBhE;AAED;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,OAAO;gBACxC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,8BAA8B;CAyBlE"}

package/lib/constructs/cloudwatch/ec2-alarms.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GuUnhealthyInstancesAlarm = exports.GuAlb5xxPercentageAlarm = void 0;
+exports.GuUnhealthyInstancesAlarm = exports.GuAlb4xxPercentageAlarm = exports.GuAlb5xxPercentageAlarm = void 0;
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const aws_cloudwatch_1 = require("aws-cdk-lib/aws-cloudwatch");
 const aws_elasticloadbalancingv2_1 = require("aws-cdk-lib/aws-elasticloadbalancingv2");
@@ -38,6 +38,38 @@ class GuAlb5xxPercentageAlarm extends alarm_1.GuAlarm {
     }
 }
 exports.GuAlb5xxPercentageAlarm = GuAlb5xxPercentageAlarm;
+/**
+ * Creates an alarm which is triggered whenever the percentage of requests with a 4xx response code exceeds
+ * the specified threshold.
+ */
+class GuAlb4xxPercentageAlarm extends alarm_1.GuAlarm {
+    constructor(scope, props) {
+        const mathExpression = new aws_cloudwatch_1.MathExpression({
+            expression: "100*(m1+m2)/m3",
+            usingMetrics: {
+                m1: props.loadBalancer.metrics.httpCodeElb(aws_elasticloadbalancingv2_1.HttpCodeElb.ELB_4XX_COUNT),
+                m2: props.loadBalancer.metrics.httpCodeTarget(aws_elasticloadbalancingv2_1.HttpCodeTarget.TARGET_4XX_COUNT),
+                m3: props.loadBalancer.metrics.requestCount(),
+            },
+            label: `% of 4XX responses served for ${props.app} (load balancer and instances combined)`,
+            period: aws_cdk_lib_1.Duration.minutes(1),
+        });
+        const defaultAlarmName = `High 4XX error percentage from ${props.app} in ${scope.stage}`;
+        const defaultDescription = `${props.app} exceeded ${props.tolerated4xxPercentage}% error rate`;
+        const alarmProps = {
+            ...props,
+            metric: mathExpression,
+            treatMissingData: aws_cloudwatch_1.TreatMissingData.NOT_BREACHING,
+            threshold: props.tolerated4xxPercentage,
+            comparisonOperator: aws_cloudwatch_1.ComparisonOperator.GREATER_THAN_THRESHOLD,
+            alarmName: props.alarmName ?? defaultAlarmName,
+            alarmDescription: props.alarmDescription ?? defaultDescription,
+            evaluationPeriods: props.numberOfMinutesAboveThresholdBeforeAlarm ?? 1,
+        };
+        super(scope, core_1.AppIdentity.suffixText(props, "High4xxPercentageAlarm"), alarmProps);
+    }
+}
+exports.GuAlb4xxPercentageAlarm = GuAlb4xxPercentageAlarm;
 /**
  * Creates an alarm which is triggered whenever there have been several healthcheck failures within a single hour.
  */

package/lib/constructs/cloudwatch/ec2-alarms.js.map

@@ -1 +1 @@
-{"version":3,"file":"ec2-alarms.js","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/ec2-alarms.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AACvC,+DAA6G;AAC7G,uFAAqF;AAErF,kCAAsC;AAEtC,mCAAkC;AAWlC;;;GAGG;AACH,MAAa,uBAAwB,SAAQ,eAAO;IAClD,YAAY,KAAc,EAAE,KAAmC;QAC7D,MAAM,cAAc,GAAG,IAAI,+BAAc,CAAC;YACxC,UAAU,EAAE,gBAAgB;YAC5B,YAAY,EAAE;gBACZ,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,wCAAW,CAAC,aAAa,CAAC;gBACrE,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,2CAAc,CAAC,gBAAgB,CAAC;gBAC9E,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,EAAE;aAC9C;YACD,KAAK,EAAE,iCAAiC,KAAK,CAAC,GAAG,yCAAyC;YAC1F,MAAM,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;SAC5B,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,kCAAkC,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QACzF,MAAM,kBAAkB,GAAG,GAAG,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,sBAAsB,cAAc,CAAC;QAC/F,MAAM,UAAU,GAAG;YACjB,GAAG,KAAK;YACR,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,SAAS,EAAE,KAAK,CAAC,sBAAsB;YACvC,kBAAkB,EAAE,mCAAkB,CAAC,sBAAsB;YAC7D,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB;YAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,kBAAkB;YAC9D,iBAAiB,EAAE,KAAK,CAAC,wCAAwC,IAAI,CAAC;SACvE,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,wBAAwB,CAAC,EAAE,UAAU,CAAC,CAAC;IACpF,CAAC;CACF;AA1BD,0DA0BC;AAED;;GAEG;AACH,MAAa,yBAA0B,SAAQ,eAAO;IACpD,YAAY,KAAc,EAAE,KAAqC;QAC/D,MAAM,SAAS,GAAG,2BAA2B,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QAE3E,MAAM,MAAM,GAAG,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,iBAAiB,GAAG,EAAE,CAAC;QAC7B,MAAM,kBAAkB,GAAG,sBAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,iBAAiB,CAAC,CAAC,aAAa,EAAE,CAAC;QAEpG,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,GAAG,qEAAqE,kBAAkB;;;;cAIlH,KAAK,CAAC,GAAG,yFAAyF,CAAC;QAC7G,MAAM,UAAU,GAAiB;YAC/B,GAAG,KAAK;YACR,SAAS,EAAE,SAAS;YACpB,gBAAgB,EAAE,gBAAgB;YAClC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,0BAAS,CAAC,OAAO,EAAE,CAAC;YACrG,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,SAAS,EAAE,CAAC;YACZ,kBAAkB,EAAE,mCAAkB,CAAC,kCAAkC;YACzE,iBAAiB,EAAE,EAAE;YACrB,iBAAiB;SAClB,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,yBAAyB,CAAC,EAAE,UAAU,CAAC,CAAC;IACrF,CAAC;CACF;AA1BD,8DA0BC","sourcesContent":["import { Duration } from \"aws-cdk-lib\";\nimport { ComparisonOperator, MathExpression, Statistic, TreatMissingData } from \"aws-cdk-lib/aws-cloudwatch\";\nimport { HttpCodeElb, HttpCodeTarget } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuStack } from \"../core\";\nimport { AppIdentity } from \"../core\";\nimport type { GuApplicationLoadBalancer, GuApplicationTargetGroup } from \"../loadbalancing\";\nimport { GuAlarm } from \"./alarm\";\nimport type { GuAlarmProps, Http5xxAlarmProps } from \"./alarm\";\n\ninterface GuAlb5xxPercentageAlarmProps extends Pick<GuAlarmProps, \"snsTopicName\">, Http5xxAlarmProps, AppIdentity {\n  loadBalancer: GuApplicationLoadBalancer;\n}\n\ninterface GuUnhealthyInstancesAlarmProps extends Pick<GuAlarmProps, \"snsTopicName\" | \"actionsEnabled\">, AppIdentity {\n  targetGroup: GuApplicationTargetGroup;\n}\n\n/**\n * Creates an alarm which is triggered whenever the percentage of requests with a 5xx response code exceeds\n * the specified threshold.\n */\nexport class GuAlb5xxPercentageAlarm extends GuAlarm {\n  constructor(scope: GuStack, props: GuAlb5xxPercentageAlarmProps) {\n    const mathExpression = new MathExpression({\n      expression: \"100*(m1+m2)/m3\",\n      usingMetrics: {\n        m1: props.loadBalancer.metrics.httpCodeElb(HttpCodeElb.ELB_5XX_COUNT),\n        m2: props.loadBalancer.metrics.httpCodeTarget(HttpCodeTarget.TARGET_5XX_COUNT),\n        m3: props.loadBalancer.metrics.requestCount(),\n      },\n      label: `% of 5XX responses served for ${props.app} (load balancer and instances combined)`,\n      period: Duration.minutes(1),\n    });\n    const defaultAlarmName = `High 5XX error percentage from ${props.app} in ${scope.stage}`;\n    const defaultDescription = `${props.app} exceeded ${props.tolerated5xxPercentage}% error rate`;\n    const alarmProps = {\n      ...props,\n      metric: mathExpression,\n      treatMissingData: TreatMissingData.NOT_BREACHING,\n      threshold: props.tolerated5xxPercentage,\n      comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,\n      alarmName: props.alarmName ?? defaultAlarmName,\n      alarmDescription: props.alarmDescription ?? defaultDescription,\n      evaluationPeriods: props.numberOfMinutesAboveThresholdBeforeAlarm ?? 1,\n    };\n    super(scope, AppIdentity.suffixText(props, \"High5xxPercentageAlarm\"), alarmProps);\n  }\n}\n\n/**\n * Creates an alarm which is triggered whenever there have been several healthcheck failures within a single hour.\n */\nexport class GuUnhealthyInstancesAlarm extends GuAlarm {\n  constructor(scope: GuStack, props: GuUnhealthyInstancesAlarmProps) {\n    const alarmName = `Unhealthy instances for ${props.app} in ${scope.stage}`;\n\n    const period = Duration.minutes(1);\n    const evaluationPeriods = 60;\n    const evaluationInterval = Duration.minutes(period.toMinutes() * evaluationPeriods).toHumanString();\n\n    const alarmDescription = `${props.app}'s instances have failed healthchecks several times over the last ${evaluationInterval}.\n      This typically results in the AutoScaling Group cycling instances and can lead to problems with deployment,\n      scaling or handling traffic spikes.\n\n      Check ${props.app}'s application logs or ssh onto an unhealthy instance in order to debug these problems.`;\n    const alarmProps: GuAlarmProps = {\n      ...props,\n      alarmName: alarmName,\n      alarmDescription: alarmDescription,\n      metric: props.targetGroup.metrics.unhealthyHostCount().with({ period, statistic: Statistic.MAXIMUM }),\n      treatMissingData: TreatMissingData.NOT_BREACHING,\n      threshold: 1,\n      comparisonOperator: ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,\n      datapointsToAlarm: 30,\n      evaluationPeriods,\n    };\n    super(scope, AppIdentity.suffixText(props, \"UnhealthyInstancesAlarm\"), alarmProps);\n  }\n}\n"]}
+{"version":3,"file":"ec2-alarms.js","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/ec2-alarms.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AACvC,+DAA6G;AAC7G,uFAAqF;AAErF,kCAAsC;AAEtC,mCAAkC;AAclC;;;GAGG;AACH,MAAa,uBAAwB,SAAQ,eAAO;IAClD,YAAY,KAAc,EAAE,KAAmC;QAC7D,MAAM,cAAc,GAAG,IAAI,+BAAc,CAAC;YACxC,UAAU,EAAE,gBAAgB;YAC5B,YAAY,EAAE;gBACZ,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,wCAAW,CAAC,aAAa,CAAC;gBACrE,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,2CAAc,CAAC,gBAAgB,CAAC;gBAC9E,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,EAAE;aAC9C;YACD,KAAK,EAAE,iCAAiC,KAAK,CAAC,GAAG,yCAAyC;YAC1F,MAAM,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;SAC5B,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,kCAAkC,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QACzF,MAAM,kBAAkB,GAAG,GAAG,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,sBAAsB,cAAc,CAAC;QAC/F,MAAM,UAAU,GAAG;YACjB,GAAG,KAAK;YACR,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,SAAS,EAAE,KAAK,CAAC,sBAAsB;YACvC,kBAAkB,EAAE,mCAAkB,CAAC,sBAAsB;YAC7D,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB;YAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,kBAAkB;YAC9D,iBAAiB,EAAE,KAAK,CAAC,wCAAwC,IAAI,CAAC;SACvE,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,wBAAwB,CAAC,EAAE,UAAU,CAAC,CAAC;IACpF,CAAC;CACF;AA1BD,0DA0BC;AAED;;;GAGG;AACH,MAAa,uBAAwB,SAAQ,eAAO;IAClD,YAAY,KAAc,EAAE,KAAmC;QAC7D,MAAM,cAAc,GAAG,IAAI,+BAAc,CAAC;YACxC,UAAU,EAAE,gBAAgB;YAC5B,YAAY,EAAE;gBACZ,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,wCAAW,CAAC,aAAa,CAAC;gBACrE,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,2CAAc,CAAC,gBAAgB,CAAC;gBAC9E,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,EAAE;aAC9C;YACD,KAAK,EAAE,iCAAiC,KAAK,CAAC,GAAG,yCAAyC;YAC1F,MAAM,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;SAC5B,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,kCAAkC,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QACzF,MAAM,kBAAkB,GAAG,GAAG,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,sBAAsB,cAAc,CAAC;QAC/F,MAAM,UAAU,GAAG;YACjB,GAAG,KAAK;YACR,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,SAAS,EAAE,KAAK,CAAC,sBAAsB;YACvC,kBAAkB,EAAE,mCAAkB,CAAC,sBAAsB;YAC7D,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB;YAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,kBAAkB;YAC9D,iBAAiB,EAAE,KAAK,CAAC,wCAAwC,IAAI,CAAC;SACvE,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,wBAAwB,CAAC,EAAE,UAAU,CAAC,CAAC;IACpF,CAAC;CACF;AA1BD,0DA0BC;AAED;;GAEG;AACH,MAAa,yBAA0B,SAAQ,eAAO;IACpD,YAAY,KAAc,EAAE,KAAqC;QAC/D,MAAM,SAAS,GAAG,2BAA2B,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QAE3E,MAAM,MAAM,GAAG,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,iBAAiB,GAAG,EAAE,CAAC;QAC7B,MAAM,kBAAkB,GAAG,sBAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,iBAAiB,CAAC,CAAC,aAAa,EAAE,CAAC;QAEpG,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,GAAG,qEAAqE,kBAAkB;;;;cAIlH,KAAK,CAAC,GAAG,yFAAyF,CAAC;QAC7G,MAAM,UAAU,GAAiB;YAC/B,GAAG,KAAK;YACR,SAAS,EAAE,SAAS;YACpB,gBAAgB,EAAE,gBAAgB;YAClC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,0BAAS,CAAC,OAAO,EAAE,CAAC;YACrG,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,SAAS,EAAE,CAAC;YACZ,kBAAkB,EAAE,mCAAkB,CAAC,kCAAkC;YACzE,iBAAiB,EAAE,EAAE;YACrB,iBAAiB;SAClB,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,yBAAyB,CAAC,EAAE,UAAU,CAAC,CAAC;IACrF,CAAC;CACF;AA1BD,8DA0BC","sourcesContent":["import { Duration } from \"aws-cdk-lib\";\nimport { ComparisonOperator, MathExpression, Statistic, TreatMissingData } from \"aws-cdk-lib/aws-cloudwatch\";\nimport { HttpCodeElb, HttpCodeTarget } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuStack } from \"../core\";\nimport { AppIdentity } from \"../core\";\nimport type { GuApplicationLoadBalancer, GuApplicationTargetGroup } from \"../loadbalancing\";\nimport { GuAlarm } from \"./alarm\";\nimport type { GuAlarmProps, Http4xxAlarmProps, Http5xxAlarmProps } from \"./alarm\";\n\ninterface GuAlb4xxPercentageAlarmProps extends Pick<GuAlarmProps, \"snsTopicName\">, Http4xxAlarmProps, AppIdentity {\n  loadBalancer: GuApplicationLoadBalancer;\n}\ninterface GuAlb5xxPercentageAlarmProps extends Pick<GuAlarmProps, \"snsTopicName\">, Http5xxAlarmProps, AppIdentity {\n  loadBalancer: GuApplicationLoadBalancer;\n}\n\ninterface GuUnhealthyInstancesAlarmProps extends Pick<GuAlarmProps, \"snsTopicName\" | \"actionsEnabled\">, AppIdentity {\n  targetGroup: GuApplicationTargetGroup;\n}\n\n/**\n * Creates an alarm which is triggered whenever the percentage of requests with a 5xx response code exceeds\n * the specified threshold.\n */\nexport class GuAlb5xxPercentageAlarm extends GuAlarm {\n  constructor(scope: GuStack, props: GuAlb5xxPercentageAlarmProps) {\n    const mathExpression = new MathExpression({\n      expression: \"100*(m1+m2)/m3\",\n      usingMetrics: {\n        m1: props.loadBalancer.metrics.httpCodeElb(HttpCodeElb.ELB_5XX_COUNT),\n        m2: props.loadBalancer.metrics.httpCodeTarget(HttpCodeTarget.TARGET_5XX_COUNT),\n        m3: props.loadBalancer.metrics.requestCount(),\n      },\n      label: `% of 5XX responses served for ${props.app} (load balancer and instances combined)`,\n      period: Duration.minutes(1),\n    });\n    const defaultAlarmName = `High 5XX error percentage from ${props.app} in ${scope.stage}`;\n    const defaultDescription = `${props.app} exceeded ${props.tolerated5xxPercentage}% error rate`;\n    const alarmProps = {\n      ...props,\n      metric: mathExpression,\n      treatMissingData: TreatMissingData.NOT_BREACHING,\n      threshold: props.tolerated5xxPercentage,\n      comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,\n      alarmName: props.alarmName ?? defaultAlarmName,\n      alarmDescription: props.alarmDescription ?? defaultDescription,\n      evaluationPeriods: props.numberOfMinutesAboveThresholdBeforeAlarm ?? 1,\n    };\n    super(scope, AppIdentity.suffixText(props, \"High5xxPercentageAlarm\"), alarmProps);\n  }\n}\n\n/**\n * Creates an alarm which is triggered whenever the percentage of requests with a 4xx response code exceeds\n * the specified threshold.\n */\nexport class GuAlb4xxPercentageAlarm extends GuAlarm {\n  constructor(scope: GuStack, props: GuAlb4xxPercentageAlarmProps) {\n    const mathExpression = new MathExpression({\n      expression: \"100*(m1+m2)/m3\",\n      usingMetrics: {\n        m1: props.loadBalancer.metrics.httpCodeElb(HttpCodeElb.ELB_4XX_COUNT),\n        m2: props.loadBalancer.metrics.httpCodeTarget(HttpCodeTarget.TARGET_4XX_COUNT),\n        m3: props.loadBalancer.metrics.requestCount(),\n      },\n      label: `% of 4XX responses served for ${props.app} (load balancer and instances combined)`,\n      period: Duration.minutes(1),\n    });\n    const defaultAlarmName = `High 4XX error percentage from ${props.app} in ${scope.stage}`;\n    const defaultDescription = `${props.app} exceeded ${props.tolerated4xxPercentage}% error rate`;\n    const alarmProps = {\n      ...props,\n      metric: mathExpression,\n      treatMissingData: TreatMissingData.NOT_BREACHING,\n      threshold: props.tolerated4xxPercentage,\n      comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,\n      alarmName: props.alarmName ?? defaultAlarmName,\n      alarmDescription: props.alarmDescription ?? defaultDescription,\n      evaluationPeriods: props.numberOfMinutesAboveThresholdBeforeAlarm ?? 1,\n    };\n    super(scope, AppIdentity.suffixText(props, \"High4xxPercentageAlarm\"), alarmProps);\n  }\n}\n\n/**\n * Creates an alarm which is triggered whenever there have been several healthcheck failures within a single hour.\n */\nexport class GuUnhealthyInstancesAlarm extends GuAlarm {\n  constructor(scope: GuStack, props: GuUnhealthyInstancesAlarmProps) {\n    const alarmName = `Unhealthy instances for ${props.app} in ${scope.stage}`;\n\n    const period = Duration.minutes(1);\n    const evaluationPeriods = 60;\n    const evaluationInterval = Duration.minutes(period.toMinutes() * evaluationPeriods).toHumanString();\n\n    const alarmDescription = `${props.app}'s instances have failed healthchecks several times over the last ${evaluationInterval}.\n      This typically results in the AutoScaling Group cycling instances and can lead to problems with deployment,\n      scaling or handling traffic spikes.\n\n      Check ${props.app}'s application logs or ssh onto an unhealthy instance in order to debug these problems.`;\n    const alarmProps: GuAlarmProps = {\n      ...props,\n      alarmName: alarmName,\n      alarmDescription: alarmDescription,\n      metric: props.targetGroup.metrics.unhealthyHostCount().with({ period, statistic: Statistic.MAXIMUM }),\n      treatMissingData: TreatMissingData.NOT_BREACHING,\n      threshold: 1,\n      comparisonOperator: ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,\n      datapointsToAlarm: 30,\n      evaluationPeriods,\n    };\n    super(scope, AppIdentity.suffixText(props, \"UnhealthyInstancesAlarm\"), alarmProps);\n  }\n}\n"]}

package/lib/patterns/ec2-app/base.d.ts

@@ -5,7 +5,7 @@ import { Construct } from "constructs";
 import { GuCertificate } from "../../constructs/acm";
 import type { GuUserDataProps } from "../../constructs/autoscaling";
 import { GuAutoScalingGroup } from "../../constructs/autoscaling";
-import type { Http5xxAlarmProps, NoMonitoring } from "../../constructs/cloudwatch";
+import type { Http4xxAlarmProps, Http5xxAlarmProps, NoMonitoring } from "../../constructs/cloudwatch";
 import type { GuStack } from "../../constructs/core";
 import { AppIdentity } from "../../constructs/core";
 import type { GuInstanceRoleProps } from "../../constructs/iam";
@@ -80,6 +80,10 @@ export interface Alarms {
      * Enable the 5xx alarm with settings.
      */
     http5xxAlarm: false | Http5xxAlarmProps;
+    /**
+     * Enable the 4xx alarm with settings.
+     */
+    http4xxAlarm?: false | Http4xxAlarmProps;
     /**
      * Enable the unhealthy instances alarm.
      */

package/lib/patterns/ec2-app/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAQ/D,OAAO,KAAK,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,WAAW,IAAI,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAO5F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAc,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEnF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAmD,MAAM,uBAAuB,CAAC;AAErG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGhE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,YAAY,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACxC;;OAEG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD;;OAEG;IACH,QAAQ,EAAE,eAAe,GAAG,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC;;OAEG;IACH,uBAAuB,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/C;;;OAGG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAC7C;;OAEG;IACH,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;OAEG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B;;OAEG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,YAAY,CAAC;IAChC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAE3B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAE1B;;OAEG;IACH,UAAU,CAAC,EAAE;QACX;;;;;;;;;;;;;;;;WAgBG;QACH,OAAO,EAAE,IAAI,CAAC;QACd;;;;WAIG;QACH,MAAM,EAAE,MAAM,CAAC;QACf;;;;;;;;;;WAUG;QACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB;;;;;;;;;WASG;QACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC;;;;;;;;;;;;;;;;;;WAkBG;QACH,6BAA6B,CAAC,EAAE,MAAM,CAAC;KACxC,CAAC;IAEF;;OAEG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAE7B;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAUD;;;;;;GAMG;AACH,qBAAa,QAAS,SAAQ,SAAS;IASrC,SAAgB,GAAG,EAAE,IAAI,CAAC;IAC1B,SAAgB,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5C,SAAgB,YAAY,EAAE,yBAAyB,CAAC;IACxD,SAAgB,gBAAgB,EAAE,kBAAkB,CAAC;IACrD,SAAgB,QAAQ,EAAE,0BAA0B,CAAC;IACrD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;gBAE1C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa;CAoTjD"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAQ/D,OAAO,KAAK,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,KAAK,EAAE,WAAW,IAAI,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAO5F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAc,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAMtG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAmD,MAAM,uBAAuB,CAAC;AAErG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGhE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,YAAY,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACxC;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACzC;;OAEG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD;;OAEG;IACH,QAAQ,EAAE,eAAe,GAAG,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC;;OAEG;IACH,uBAAuB,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/C;;;OAGG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAC7C;;OAEG;IACH,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;OAEG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B;;OAEG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,YAAY,CAAC;IAChC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAE3B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAE1B;;OAEG;IACH,UAAU,CAAC,EAAE;QACX;;;;;;;;;;;;;;;;WAgBG;QACH,OAAO,EAAE,IAAI,CAAC;QACd;;;;WAIG;QACH,MAAM,EAAE,MAAM,CAAC;QACf;;;;;;;;;;WAUG;QACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB;;;;;;;;;WASG;QACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC;;;;;;;;;;;;;;;;;;WAkBG;QACH,6BAA6B,CAAC,EAAE,MAAM,CAAC;KACxC,CAAC;IAEF;;OAEG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAE7B;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAUD;;;;;;GAMG;AACH,qBAAa,QAAS,SAAQ,SAAS;IASrC,SAAgB,GAAG,EAAE,IAAI,CAAC;IAC1B,SAAgB,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5C,SAAgB,YAAY,EAAE,yBAAyB,CAAC;IACxD,SAAgB,gBAAgB,EAAE,kBAAkB,CAAC;IACrD,SAAgB,QAAQ,EAAE,0BAA0B,CAAC;IACrD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;gBAE1C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa;CA4TjD"}

package/lib/patterns/ec2-app/base.js

@@ -135,7 +135,15 @@ class GuEc2App extends constructs_1.Construct {
             }));
         }
         if (!monitoringConfiguration.noMonitoring) {
-            const { http5xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;
+            const { http5xxAlarm, http4xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;
+            if (http4xxAlarm) {
+                new cloudwatch_1.GuAlb4xxPercentageAlarm(scope, {
+                    app,
+                    loadBalancer,
+                    snsTopicName,
+                    ...http4xxAlarm,
+                });
+            }
             if (http5xxAlarm) {
                 new cloudwatch_1.GuAlb5xxPercentageAlarm(scope, {
                     app,

package/lib/patterns/ec2-app/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;;;;AAAA,uGAAuG;AACvG,oDAA4B;AAC5B,6CAA0D;AAE1D,iEAA0D;AAC1D,yDAKiC;AAEjC,iDAA2C;AAE3C,uFAA6F;AAC7F,uGAA2F;AAC3F,iDAA8D;AAC9D,uDAA+D;AAC/D,+CAA4C;AAC5C,iDAAsD;AACtD,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAAiG;AAEjG,gDAAqG;AACrG,8CAAsG;AAEtG,8CAAgF;AAChF,oDAA2D;AAC3D,kEAIwC;AACxC,uCAAwC;AAuPxC,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,aAAa,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAClC,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EACR,aAAa,EACb,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EACnF,wBAAwB,GACzB,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,WAAW;YACrC,CAAC,CAAC,IAAI,mBAAa,CAAC,KAAK,EAAE;gBACvB,GAAG;gBACH,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,YAAY,EAAE,gBAAgB,CAAC,YAAY;aAC5C,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,wBAAwB,GAC5B,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa;YACpD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,aAAa;YACb,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YACpE,WAAW,EAAE,6BAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACxG,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;YACX,uBAAuB,EAAE,wBAAwB;SAClD,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;SACF,CAAC,CAAC;QAEH,IAAI,aAAa,CAAC,OAAO,EAAE;YACzB,MAAM,mBAAmB,GAAG,IAAI,wBAAiB,CAAC,KAAK,EAAE,qBAAqB,EAAE;gBAC9E,WAAW,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,WAAW;gBACtE,OAAO,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,IAAI;gBAC3D,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,YAAY,CAAC,aAAa,CACxB,eAAM,CAAC,cAAc,CACnB,KAAK,EACL,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,qBAAqB,CAAC,EACpD,mBAAmB,CAAC,aAAa,CAClC,EACD,aAAa,CAAC,MAAM,CACrB,CAAC;SACH;QAED,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,IAAI,OAAO,WAAW,KAAK,WAAW;SAChF,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAExF,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;YAC7B,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;YAEvD,MAAM,EACJ,aAAa,GAAG,CAAC,4BAA4B,CAAC,EAC9C,uBAAuB,GAAG,EAAE,EAC5B,6BAA6B,GAAG,GAAG,MAAM,0BAA0B,GACpE,GAAG,KAAK,CAAC,UAAU,CAAC;YAErB,IAAI,uBAAuB,GAAG,EAAE,EAAE;gBAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;aACtE;YAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC5B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;aAC9D;YAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAAE;gBACrE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;aAClF;YAED,MAAM,oBAAoB,GAAG,yBAAe,CAAC,uBAAuB,CAClE,KAAK,EACL,mCAAmC,EACnC,qCAAyB,CAAC,oBAAoB,CAAC,IAAI,CACpD,CAAC;YAEF,sEAAsE;YACtE,4BAA4B;YAC5B,yDAAyD;YACzD,MAAM,qBAAqB,GAAG,4BAA4B,oBAAoB,CAAC,WAAW,yCAAyC,CAAC;YAEpI,8CAA8C;YAC9C,oDAAoD;YACpD,MAAM,UAAU,GAAG,IAAI,yBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE;gBAC5D,GAAG,EAAE,GAAG;gBACR,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,oBAAO,CAAC,YAAY;gBAC7B,QAAQ,EAAE,8DAA8D;gBACxE,iBAAiB,EAAE,IAAI;gBACvB,qBAAqB,EAAE,IAAI;gBAC3B,cAAc,EAAE,qCAAyB,CAAC,8BAA8B,CAAC,IAAI;gBAC7E,YAAY,EAAE,yBAAY,CAAC,MAAM;gBACjC,WAAW,EAAE;oBACX,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;oBACvC,uBAAuB,EAAE,qBAAqB;iBAC/C;aACF,CAAC,CAAC;YAEH,UAAU,CAAC,eAAe,CACxB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,KAAK;gBACpB,OAAO,EAAE,CAAC,uBAAuB,CAAC;gBAClC,SAAS,EAAE,CAAC,qBAAqB,CAAC;aACnC,CAAC,CACH,CAAC;YAEF,yEAAyE;YACzE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,IAAI,sBAAQ,CAAC,IAAI,EAAE,WAAW,EAAE;gBAC/C,cAAc,EAAE;oBACd,iBAAiB,EAAE,UAAU;oBAC7B,SAAS,EAAE,UAAU;iBACtB;aACF,CAAC,CAAC;YAEH,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,gBAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE3E,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE;oBACb,YAAY,EAAE,GAAG,YAAY,IAAI,MAAM,EAAE;iBAC1C;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACtG,MAAM,YAAY,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;YAE9G,MAAM,WAAW,GAAG,IAAI,4CAA8B,CAAC,KAAK,EAAE,YAAY,EAAE;gBAC1E,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;gBACrC,gBAAgB,EAAE;oBAChB,KAAK,EAAE,+BAAiB,CAAC,YAAY;oBACrC,SAAS,EAAE,+BAAiB,CAAC,iBAAiB;oBAC9C,UAAU,EAAE,+BAAiB,CAAC,kBAAkB;oBAChD,cAAc,EAAE,+BAAiB,CAAC,cAAc;oBAChD,MAAM,EAAE;wBACN,IAAI,EAAE,+BAAiB,CAAC,WAAW;qBACpC;iBACF;gBACD,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;aACvC,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;gBACtD,0BAA0B,EAAE,CAAC,4CAA8B,CAAC,MAAM,CAAC;gBACnE,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,WAAW,KAAK,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC;iBACxE;gBAED,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,mEAAmE;gBACnE,cAAc;gBACd,eAAe,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,mBAAmB,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtC,oBAAoB,EAAE,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC;YAEH,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAE/C,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE;gBAChC,MAAM,EAAE,IAAI,8DAAyB,CAAC;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,cAAc,EAAE,cAAc;oBAC9B,cAAc,EAAE,cAAc;oBAC9B,IAAI,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;oBAC3C,cAAc,EAAE,sBAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC;iBAC1D,CAAC;aACH,CAAC,CAAC;YAEH,qEAAqE;YACrE,MAAM,sBAAsB,GAAG,IAAI,gCAA0B,CAAC,KAAK,EAAE,YAAY,EAAE;gBACjF,GAAG;gBACH,GAAG;aACJ,CAAC,CAAC;YAEH,YAAY,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;SACvD;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AApUD,4BAoUC","sourcesContent":["/* eslint \"@guardian/tsdoc-required/tsdoc-required\": 2 -- to begin rolling this out for public APIs. */\nimport crypto from \"crypto\";\nimport { Duration, SecretValue, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice } from \"aws-cdk-lib/aws-autoscaling\";\nimport { HealthCheck } from \"aws-cdk-lib/aws-autoscaling\";\nimport {\n  ProviderAttribute,\n  UserPool,\n  UserPoolClientIdentityProvider,\n  UserPoolIdentityProviderGoogle,\n} from \"aws-cdk-lib/aws-cognito\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port } from \"aws-cdk-lib/aws-ec2\";\nimport type { HealthCheck as ALBHealthCheck } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { ApplicationProtocol, ListenerAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { AuthenticateCognitoAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2-actions\";\nimport { Effect, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Architecture, Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport { GuAlb5xxPercentageAlarm, GuUnhealthyInstancesAlarm } from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuLoggingStreamNameParameter, GuStringParameter } from \"../../constructs/core\";\nimport { GuHttpsEgressSecurityGroup, GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport { GuLambdaFunction } from \"../../constructs/lambda\";\nimport {\n  GuApplicationLoadBalancer,\n  GuApplicationTargetGroup,\n  GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\n\nexport interface AccessLoggingProps {\n  /**\n   * Enable (load balancer) access logs.\n   *\n   * Note, you will need to specify a region in your stack declaration to use\n   * this.\n   * See`https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html#logwbraccesswbrlogsbucket-prefix`\n   */\n  enabled: boolean;\n  /**\n   * S3 prefix for the logs.\n   *\n   * @defaultValue no prefix\n   */\n  prefix?: string;\n}\n\n/**\n * To ship your application logs to ELK automatically, you must:\n *\n * 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n *\n * Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n */\nexport interface ApplicationLoggingProps {\n  /**\n   * Enables forwarding of application logs to the Guardian ELK stack.\n   *\n   * Note, to work, you will need to also do the following non-CDK things:\n   *\n   * 1. Include the `cdk-base` Amigo role in your AMI.\n   * 2. Log to `journald`. We recommend doing this by logging to `stdout` and\n   *    using `systemd` to start your app\n   * 3. Confirm that your [[`systemdUnitName`]] is configured properly.\n   *\n   * Unless you have explicitly opted-out, appropriate IAM permissions for\n   * logging to Kinesis will be configured automatically via the [[`GuEc2App`]]\n   * pattern.\n   *\n   * @see https://github.com/guardian/amigo/tree/main/roles/cdk-base\n   */\n  enabled: boolean;\n  /**\n   * This needs to match the name of your SystemD unit.\n   *\n   * If your systemd unit is not `<app>.service` set this value.\n   *\n   * @defaultValue `<app>.service`\n   */\n  systemdUnitName?: string;\n}\n\n/**\n * @privateRemarks we should rename this to AlarmsProps.\n */\nexport interface Alarms {\n  /**\n   * Name of the target (SNS Topic) for alarm notifications.\n   */\n  snsTopicName: string;\n  /**\n   * Enable the 5xx alarm with settings.\n   */\n  http5xxAlarm: false | Http5xxAlarmProps;\n  /**\n   * Enable the unhealthy instances alarm.\n   */\n  unhealthyInstancesAlarm: boolean;\n  /**\n   * Internal flag - users of this library should ignore this setting.\n   */\n  noMonitoring?: false;\n}\n\nexport interface GuEc2AppProps extends AppIdentity {\n  /**\n   * User data for the autoscaling group.\n   */\n  userData: GuUserDataProps | string;\n  /**\n   * Network access restrictions for your load balancer.\n   *\n   * Note, this merely provides defence in depth; you should, for example, limit\n   * access to the VPN and then treat that as sufficient. Instead, use Google\n   * Auth for human access, or a suitable machine auth mechanism.\n   */\n  access: AppAccess;\n  /**\n   * The port your application runs on.\n   */\n  applicationPort: number;\n  /**\n   * Configure IAM roles for autoscaling group EC2 instances.\n   */\n  roleConfiguration?: GuInstanceRoleProps;\n  /**\n   * Enable and configure alarms.\n   */\n  monitoringConfiguration: Alarms | NoMonitoring;\n  /**\n   * EC2 instance type. Note, ensure your code is built for the same\n   * architecture family (arm64 - 'Graviton' instances - or x64).\n   */\n  instanceType: InstanceType;\n  /**\n   * Enable and configures application logs.\n   */\n  applicationLogging?: ApplicationLoggingProps;\n  /**\n   * Enable and configures access logs.\n   */\n  accessLogging?: AccessLoggingProps;\n  /**\n   * Add block devices (additional storage).\n   */\n  blockDevices?: BlockDevice[];\n  /**\n   * Autoscaling group min and max sizes.\n   */\n  scaling: GuAsgCapacity;\n  /**\n   * Specify certificate for the load balancer.\n   */\n  certificateProps?: GuDomainName;\n  /**\n   * Disable imdsv2. Most of the time you should not set this.\n   *\n   * @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html\n   */\n  withoutImdsv2?: boolean;\n  /**\n   * Configure AMIgo image recipe. This is only necessary if you are using GuCDK to generate your riff-raff.yaml file.\n   */\n  imageRecipe?: string | AmigoProps;\n  /**\n   * Specify the VPC to use.\n   *\n   * @see https://github.com/guardian/aws-account-setup\n   */\n  vpc?: IVpc;\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  privateSubnets?: ISubnet[];\n\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  publicSubnets?: ISubnet[];\n\n  /**\n   * Configure Google Auth.\n   */\n  googleAuth?: {\n    /**\n     * Enables Google Auth (via Cognito). **Additional MANUAL steps required -\n     * see below.**\n     *\n     * Limits access to members of the allowed Google groups.\n     *\n     * Note, this does not currently support simultaneous machine access, so\n     * only set to true if you only require staff access to your service, or are\n     * supporting machine access in some other way.\n     *\n     * MANUAL STEPS: to get this to work, we need a Google Project and\n     * associated credentials. Full instructions can be found here:\n     *\n     * https://docs.google.com/document/d/1_k1FSE52AZHXufWLTiKTI3xy5cGpziyHazSHTKrYfco/edit?usp=sharing\n     *\n     * DevX hope to automate this process in the near future.\n     */\n    enabled: true;\n    /**\n     * The domain users will access your service.\n     *\n     * Set this to the same as for certificateProps.\n     */\n    domain: string;\n    /**\n     * Groups used for membership checks.\n     *\n     * If specified, cannot be empty. Users must be a member of at least one\n     * group to gain access.\n     *\n     * WARNING: groups must be specified with the `guardian.co.uk` domain, even\n     * if that is the non-idiomatic choice for daily use.\n     *\n     * @defaultValue [`engineering@guardian.co.uk`]\n     */\n    allowedGroups?: string[];\n    /**\n     * The number of minutes before the session expires.\n     *\n     * Set this value to a safe period of time that revoked users\n     * sessions will continue to function.\n     *\n     * NOTE: This value cannot be larger than 60 minutes.\n     *\n     * @defaultValue 15\n     */\n    sessionTimeoutInMinutes?: number;\n    /**\n     * Secrets Manager path containing Google OAuth2 Client credentials.\n     *\n     * NOTE: you do not need to set this value, but you DO need to generate and\n     * store the associated credentials in Secrets Manager.\n     *\n     * Credentials should be stored in Secrets Manager as JSON:\n     *\n     * ```json\n     * {\n     *   \"clientId\": \"my-client-id\",\n     *   \"clientSecret\": \"my-client-secret\"\n     * }\n     * ```\n     *\n     * @see `googleAuth.enabled` for how to generate.\n     *\n     * @defaultValue /:STAGE/:stack/:app/google-auth-credentials\n     */\n    credentialsSecretsManagerPath?: string;\n  };\n\n  /**\n   * Specify custom healthcheck\n   */\n  healthcheck?: ALBHealthCheck;\n\n  /**\n   * Set http put response hop limit for the launch template.\n   * It can be necessary to raise this value from the default of 1\n   * for example when sharing the instance profile with a docker container running on the instance.\n   */\n  instanceMetadataHopLimit?: number;\n}\n\nfunction restrictedCidrRanges(ranges: IPeer[]) {\n  return ranges.map((range) => ({\n    range,\n    port: Port.tcp(443),\n    description: `Allow access on port 443 from ${range.uniqueId}`,\n  }));\n}\n\n/**\n * Pattern which creates the resources needed to run an application on EC2\n * behind a load balancer. For convenience, you may wish to use [[`GuPlayApp`]]\n * or [[`GuNodeApp`]], which extend this class.\n *\n * See props for further details.\n */\nexport class GuEc2App extends Construct {\n  /*\n   * These are public for now, as this allows users to\n   * modify these constructs as desired to fit their\n   * specific needs.\n   * In the future, we might build functionality to better enable users\n   * to access in-pattern constructs, but this would allow teams to be unblocked\n   * in the short term.\n   * */\n  public readonly vpc: IVpc;\n  public readonly certificate?: GuCertificate;\n  public readonly loadBalancer: GuApplicationLoadBalancer;\n  public readonly autoScalingGroup: GuAutoScalingGroup;\n  public readonly listener: GuHttpsApplicationListener;\n  public readonly targetGroup: GuApplicationTargetGroup;\n\n  constructor(scope: GuStack, props: GuEc2AppProps) {\n    const {\n      access,\n      accessLogging = { enabled: false },\n      app,\n      // We should update this default once a significant number of apps have migrated to devx-logs\n      applicationLogging = { enabled: false },\n      applicationPort,\n      blockDevices,\n      certificateProps,\n      instanceType,\n      monitoringConfiguration,\n      roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n      scaling: { minimumInstances, maximumInstances = minimumInstances * 2 },\n      userData,\n      withoutImdsv2,\n      imageRecipe,\n      vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n      privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n      publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n      instanceMetadataHopLimit,\n    } = props;\n\n    super(scope, app); // The assumption is `app` is unique\n\n    // We should really prevent users from doing this via the type system,\n    // but that requires a breaking change to the API\n    if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n      throw new Error(\n        \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n          \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\",\n      );\n    }\n\n    AppAccess.validate(access);\n\n    const certificate =\n      typeof certificateProps !== \"undefined\"\n        ? new GuCertificate(scope, {\n            app,\n            domainName: certificateProps.domainName,\n            hostedZoneId: certificateProps.hostedZoneId,\n          })\n        : undefined;\n\n    const maybePrivateConfigPolicy =\n      typeof userData !== \"string\" && userData.configuration\n        ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n        : [];\n\n    const mergedRoleConfiguration: GuInstanceRoleProps = {\n      withoutLogShipping: roleConfiguration.withoutLogShipping,\n      additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n    };\n\n    const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n      app,\n      vpc,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      withoutImdsv2,\n      role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n      healthCheck: HealthCheck.elb({ grace: Duration.minutes(2) }), // should this be defaulted at pattern or construct level?\n      userData: typeof userData !== \"string\" ? new GuUserData(scope, { app, ...userData }).userData : userData,\n      vpcSubnets: { subnets: privateSubnets },\n      ...(blockDevices && { blockDevices }),\n      imageRecipe,\n      httpPutResponseHopLimit: instanceMetadataHopLimit,\n    });\n\n    // This allows automatic shipping of instance Cloud Init logs when using the\n    // `cdk-base` Amigo role on your AMI.\n    Tags.of(autoScalingGroup).add(\n      MetadataKeys.LOG_KINESIS_STREAM_NAME,\n      GuLoggingStreamNameParameter.getInstance(scope).valueAsString,\n    );\n\n    if (applicationLogging.enabled) {\n      // This allows automatic shipping of application logs when using the\n      // `cdk-base` Amigo role on your AMI.\n      Tags.of(autoScalingGroup).add(\n        MetadataKeys.SYSTEMD_UNIT,\n        applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`,\n      );\n    }\n\n    const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n      app,\n      vpc,\n      // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n      internetFacing: access.scope !== AccessScope.INTERNAL,\n      vpcSubnets: {\n        subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n      },\n    });\n\n    if (accessLogging.enabled) {\n      const accessLoggingBucket = new GuStringParameter(scope, \"AccessLoggingBucket\", {\n        description: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.description,\n        default: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.path,\n        fromSSM: true,\n      });\n\n      loadBalancer.logAccessLogs(\n        Bucket.fromBucketName(\n          scope,\n          AppIdentity.suffixText(props, \"AccessLoggingBucket\"),\n          accessLoggingBucket.valueAsString,\n        ),\n        accessLogging.prefix,\n      );\n    }\n\n    const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n      app,\n      vpc,\n      protocol: ApplicationProtocol.HTTP,\n      targets: [autoScalingGroup],\n      port: applicationPort,\n      healthCheck: props.healthcheck,\n    });\n\n    const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n      app,\n      loadBalancer,\n      certificate,\n      targetGroup,\n      // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n      open: access.scope === AccessScope.PUBLIC && typeof certificate !== \"undefined\",\n    });\n\n    // Since AWS won't create a security group automatically when open=false, we need to add our own\n    if (access.scope !== AccessScope.PUBLIC) {\n      loadBalancer.addSecurityGroup(\n        new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n          app,\n          vpc,\n          description: \"Allow restricted ingress from CIDR ranges\",\n          allowAllOutbound: false,\n          ingresses: restrictedCidrRanges(access.cidrRanges),\n        }),\n      );\n    }\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const { http5xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n      if (http5xxAlarm) {\n        new GuAlb5xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http5xxAlarm,\n        });\n      }\n      if (unhealthyInstancesAlarm) {\n        new GuUnhealthyInstancesAlarm(scope, {\n          app,\n          targetGroup,\n          snsTopicName,\n        });\n      }\n    }\n\n    if (props.googleAuth?.enabled) {\n      const prefix = `/${scope.stage}/${scope.stack}/${app}`;\n\n      const {\n        allowedGroups = [\"engineering@guardian.co.uk\"],\n        sessionTimeoutInMinutes = 15,\n        credentialsSecretsManagerPath = `${prefix}/google-auth-credentials`,\n      } = props.googleAuth;\n\n      if (sessionTimeoutInMinutes > 60) {\n        throw new Error(\"googleAuth.sessionTimeoutInMinutes must be <= 60!\");\n      }\n\n      if (allowedGroups.length < 1) {\n        throw new Error(\"googleAuth.allowedGroups cannot be empty!\");\n      }\n\n      if (allowedGroups.find((group) => !group.endsWith(\"@guardian.co.uk\"))) {\n        throw new Error(\"googleAuth.allowedGroups must use the @guardian.co.uk domain.\");\n      }\n\n      const deployToolsAccountId = StringParameter.fromStringParameterName(\n        scope,\n        \"deploy-tools-account-id-parameter\",\n        NAMED_SSM_PARAMETER_PATHS.DeployToolsAccountId.path,\n      );\n\n      // See https://github.com/guardian/cognito-auth-lambdas for the source\n      // code here. ARN format is:\n      // arn:aws:lambda:aws-region:acct-id:function:helloworld.\n      const gatekeeperFunctionArn = `arn:aws:lambda:eu-west-1:${deployToolsAccountId.stringValue}:function:deploy-PROD-gatekeeper-lambda`;\n\n      // Note, handler and filename must match here:\n      // https://github.com/guardian/cognito-auth-lambdas.\n      const authLambda = new GuLambdaFunction(scope, \"auth-lambda\", {\n        app: app,\n        memorySize: 128,\n        handler: \"bootstrap\",\n        runtime: Runtime.PROVIDED_AL2,\n        fileName: \"deploy/INFRA/cognito-lambda/devx-cognito-lambda-amd64-v2.zip\",\n        withoutFilePrefix: true,\n        withoutArtifactUpload: true,\n        bucketNamePath: NAMED_SSM_PARAMETER_PATHS.OrganisationDistributionBucket.path,\n        architecture: Architecture.X86_64,\n        environment: {\n          ALLOWED_GROUPS: allowedGroups.join(\",\"),\n          GATEKEEPER_FUNCTION_ARN: gatekeeperFunctionArn,\n        },\n      });\n\n      authLambda.addToRolePolicy(\n        new PolicyStatement({\n          effect: Effect.ALLOW,\n          actions: [\"lambda:InvokeFunction\"],\n          resources: [gatekeeperFunctionArn],\n        }),\n      );\n\n      // Cognito user pool. We require both lambdas: pre-sign-up runs the first\n      // time a user attempts to authenticate (before they exist in the User\n      // Pool); pre-auth runs in subsequent authentication flows.\n      const userPool = new UserPool(this, \"user-pool\", {\n        lambdaTriggers: {\n          preAuthentication: authLambda,\n          preSignUp: authLambda,\n        },\n      });\n\n      // These help ensure domain is deterministic but also unique. Key\n      // assumption is that app/stack/stage combo are unique within Guardian.\n      const domainPrefix = `com-gu-${app.toLowerCase()}-${scope.stage.toLowerCase()}`;\n      const suffix = crypto.createHash(\"md5\").update(domainPrefix).digest(\"hex\");\n\n      const userPoolDomain = userPool.addDomain(\"domain\", {\n        cognitoDomain: {\n          domainPrefix: `${domainPrefix}-${suffix}`,\n        },\n      });\n\n      const clientId = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientId\" });\n      const clientSecret = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientSecret\" });\n\n      const userPoolIdp = new UserPoolIdentityProviderGoogle(scope, \"google-idp\", {\n        userPool: userPool,\n        clientId: clientId.toString(),\n        clientSecret: clientSecret.toString(),\n        attributeMapping: {\n          email: ProviderAttribute.GOOGLE_EMAIL,\n          givenName: ProviderAttribute.GOOGLE_GIVEN_NAME,\n          familyName: ProviderAttribute.GOOGLE_FAMILY_NAME,\n          profilePicture: ProviderAttribute.GOOGLE_PICTURE,\n          custom: {\n            name: ProviderAttribute.GOOGLE_NAME,\n          },\n        },\n        scopes: [\"openid\", \"email\", \"profile\"],\n      });\n\n      const userPoolClient = userPool.addClient(\"alb-client\", {\n        supportedIdentityProviders: [UserPoolClientIdentityProvider.GOOGLE],\n        generateSecret: true,\n        oAuth: {\n          callbackUrls: [`https://${props.googleAuth.domain}/oauth2/idpresponse`],\n        },\n\n        // Note: id and access validity token validity cannot be less than one\n        // hour (this is the cognito cookie duration). To quickly invalidate\n        // credentials, disable the user in Cognito. It might be that we want to\n        // parameterise these going forward, but that would require Infosec\n        // discussion.\n        idTokenValidity: Duration.hours(1),\n        accessTokenValidity: Duration.hours(1),\n        refreshTokenValidity: Duration.days(7),\n      });\n\n      userPoolClient.node.addDependency(userPoolIdp);\n\n      listener.addAction(\"CognitoAuth\", {\n        action: new AuthenticateCognitoAction({\n          userPool: userPool,\n          userPoolClient: userPoolClient,\n          userPoolDomain: userPoolDomain,\n          next: ListenerAction.forward([targetGroup]),\n          sessionTimeout: Duration.minutes(sessionTimeoutInMinutes),\n        }),\n      });\n\n      // Need to give the ALB outbound access on 443 for the IdP endpoints.\n      const idpEgressSecurityGroup = new GuHttpsEgressSecurityGroup(scope, \"ldp-access\", {\n        app,\n        vpc,\n      });\n\n      loadBalancer.addSecurityGroup(idpEgressSecurityGroup);\n    }\n\n    this.vpc = vpc;\n    this.certificate = certificate;\n    this.loadBalancer = loadBalancer;\n    this.autoScalingGroup = autoScalingGroup;\n    this.listener = listener;\n    this.targetGroup = targetGroup;\n  }\n}\n"]}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;;;;AAAA,uGAAuG;AACvG,oDAA4B;AAC5B,6CAA0D;AAE1D,iEAA0D;AAC1D,yDAKiC;AAEjC,iDAA2C;AAE3C,uFAA6F;AAC7F,uGAA2F;AAC3F,iDAA8D;AAC9D,uDAA+D;AAC/D,+CAA4C;AAC5C,iDAAsD;AACtD,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAIqC;AAErC,gDAAqG;AACrG,8CAAsG;AAEtG,8CAAgF;AAChF,oDAA2D;AAC3D,kEAIwC;AACxC,uCAAwC;AA2PxC,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,aAAa,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAClC,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EACR,aAAa,EACb,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EACnF,wBAAwB,GACzB,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,WAAW;YACrC,CAAC,CAAC,IAAI,mBAAa,CAAC,KAAK,EAAE;gBACvB,GAAG;gBACH,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,YAAY,EAAE,gBAAgB,CAAC,YAAY;aAC5C,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,wBAAwB,GAC5B,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa;YACpD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,aAAa;YACb,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YACpE,WAAW,EAAE,6BAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACxG,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;YACX,uBAAuB,EAAE,wBAAwB;SAClD,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;SACF,CAAC,CAAC;QAEH,IAAI,aAAa,CAAC,OAAO,EAAE;YACzB,MAAM,mBAAmB,GAAG,IAAI,wBAAiB,CAAC,KAAK,EAAE,qBAAqB,EAAE;gBAC9E,WAAW,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,WAAW;gBACtE,OAAO,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,IAAI;gBAC3D,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,YAAY,CAAC,aAAa,CACxB,eAAM,CAAC,cAAc,CACnB,KAAK,EACL,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,qBAAqB,CAAC,EACpD,mBAAmB,CAAC,aAAa,CAClC,EACD,aAAa,CAAC,MAAM,CACrB,CAAC;SACH;QAED,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,IAAI,OAAO,WAAW,KAAK,WAAW;SAChF,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAEtG,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;YAC7B,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;YAEvD,MAAM,EACJ,aAAa,GAAG,CAAC,4BAA4B,CAAC,EAC9C,uBAAuB,GAAG,EAAE,EAC5B,6BAA6B,GAAG,GAAG,MAAM,0BAA0B,GACpE,GAAG,KAAK,CAAC,UAAU,CAAC;YAErB,IAAI,uBAAuB,GAAG,EAAE,EAAE;gBAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;aACtE;YAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC5B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;aAC9D;YAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAAE;gBACrE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;aAClF;YAED,MAAM,oBAAoB,GAAG,yBAAe,CAAC,uBAAuB,CAClE,KAAK,EACL,mCAAmC,EACnC,qCAAyB,CAAC,oBAAoB,CAAC,IAAI,CACpD,CAAC;YAEF,sEAAsE;YACtE,4BAA4B;YAC5B,yDAAyD;YACzD,MAAM,qBAAqB,GAAG,4BAA4B,oBAAoB,CAAC,WAAW,yCAAyC,CAAC;YAEpI,8CAA8C;YAC9C,oDAAoD;YACpD,MAAM,UAAU,GAAG,IAAI,yBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE;gBAC5D,GAAG,EAAE,GAAG;gBACR,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,oBAAO,CAAC,YAAY;gBAC7B,QAAQ,EAAE,8DAA8D;gBACxE,iBAAiB,EAAE,IAAI;gBACvB,qBAAqB,EAAE,IAAI;gBAC3B,cAAc,EAAE,qCAAyB,CAAC,8BAA8B,CAAC,IAAI;gBAC7E,YAAY,EAAE,yBAAY,CAAC,MAAM;gBACjC,WAAW,EAAE;oBACX,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;oBACvC,uBAAuB,EAAE,qBAAqB;iBAC/C;aACF,CAAC,CAAC;YAEH,UAAU,CAAC,eAAe,CACxB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,KAAK;gBACpB,OAAO,EAAE,CAAC,uBAAuB,CAAC;gBAClC,SAAS,EAAE,CAAC,qBAAqB,CAAC;aACnC,CAAC,CACH,CAAC;YAEF,yEAAyE;YACzE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,IAAI,sBAAQ,CAAC,IAAI,EAAE,WAAW,EAAE;gBAC/C,cAAc,EAAE;oBACd,iBAAiB,EAAE,UAAU;oBAC7B,SAAS,EAAE,UAAU;iBACtB;aACF,CAAC,CAAC;YAEH,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,gBAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE3E,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE;oBACb,YAAY,EAAE,GAAG,YAAY,IAAI,MAAM,EAAE;iBAC1C;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACtG,MAAM,YAAY,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;YAE9G,MAAM,WAAW,GAAG,IAAI,4CAA8B,CAAC,KAAK,EAAE,YAAY,EAAE;gBAC1E,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;gBACrC,gBAAgB,EAAE;oBAChB,KAAK,EAAE,+BAAiB,CAAC,YAAY;oBACrC,SAAS,EAAE,+BAAiB,CAAC,iBAAiB;oBAC9C,UAAU,EAAE,+BAAiB,CAAC,kBAAkB;oBAChD,cAAc,EAAE,+BAAiB,CAAC,cAAc;oBAChD,MAAM,EAAE;wBACN,IAAI,EAAE,+BAAiB,CAAC,WAAW;qBACpC;iBACF;gBACD,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;aACvC,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;gBACtD,0BAA0B,EAAE,CAAC,4CAA8B,CAAC,MAAM,CAAC;gBACnE,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,WAAW,KAAK,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC;iBACxE;gBAED,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,mEAAmE;gBACnE,cAAc;gBACd,eAAe,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,mBAAmB,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtC,oBAAoB,EAAE,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC;YAEH,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAE/C,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE;gBAChC,MAAM,EAAE,IAAI,8DAAyB,CAAC;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,cAAc,EAAE,cAAc;oBAC9B,cAAc,EAAE,cAAc;oBAC9B,IAAI,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;oBAC3C,cAAc,EAAE,sBAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC;iBAC1D,CAAC;aACH,CAAC,CAAC;YAEH,qEAAqE;YACrE,MAAM,sBAAsB,GAAG,IAAI,gCAA0B,CAAC,KAAK,EAAE,YAAY,EAAE;gBACjF,GAAG;gBACH,GAAG;aACJ,CAAC,CAAC;YAEH,YAAY,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;SACvD;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AA5UD,4BA4UC","sourcesContent":["/* eslint \"@guardian/tsdoc-required/tsdoc-required\": 2 -- to begin rolling this out for public APIs. */\nimport crypto from \"crypto\";\nimport { Duration, SecretValue, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice } from \"aws-cdk-lib/aws-autoscaling\";\nimport { HealthCheck } from \"aws-cdk-lib/aws-autoscaling\";\nimport {\n  ProviderAttribute,\n  UserPool,\n  UserPoolClientIdentityProvider,\n  UserPoolIdentityProviderGoogle,\n} from \"aws-cdk-lib/aws-cognito\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port } from \"aws-cdk-lib/aws-ec2\";\nimport type { HealthCheck as ALBHealthCheck } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { ApplicationProtocol, ListenerAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { AuthenticateCognitoAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2-actions\";\nimport { Effect, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Architecture, Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http4xxAlarmProps, Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport {\n  GuAlb4xxPercentageAlarm,\n  GuAlb5xxPercentageAlarm,\n  GuUnhealthyInstancesAlarm,\n} from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuLoggingStreamNameParameter, GuStringParameter } from \"../../constructs/core\";\nimport { GuHttpsEgressSecurityGroup, GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport { GuLambdaFunction } from \"../../constructs/lambda\";\nimport {\n  GuApplicationLoadBalancer,\n  GuApplicationTargetGroup,\n  GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\n\nexport interface AccessLoggingProps {\n  /**\n   * Enable (load balancer) access logs.\n   *\n   * Note, you will need to specify a region in your stack declaration to use\n   * this.\n   * See`https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html#logwbraccesswbrlogsbucket-prefix`\n   */\n  enabled: boolean;\n  /**\n   * S3 prefix for the logs.\n   *\n   * @defaultValue no prefix\n   */\n  prefix?: string;\n}\n\n/**\n * To ship your application logs to ELK automatically, you must:\n *\n * 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n *\n * Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n */\nexport interface ApplicationLoggingProps {\n  /**\n   * Enables forwarding of application logs to the Guardian ELK stack.\n   *\n   * Note, to work, you will need to also do the following non-CDK things:\n   *\n   * 1. Include the `cdk-base` Amigo role in your AMI.\n   * 2. Log to `journald`. We recommend doing this by logging to `stdout` and\n   *    using `systemd` to start your app\n   * 3. Confirm that your [[`systemdUnitName`]] is configured properly.\n   *\n   * Unless you have explicitly opted-out, appropriate IAM permissions for\n   * logging to Kinesis will be configured automatically via the [[`GuEc2App`]]\n   * pattern.\n   *\n   * @see https://github.com/guardian/amigo/tree/main/roles/cdk-base\n   */\n  enabled: boolean;\n  /**\n   * This needs to match the name of your SystemD unit.\n   *\n   * If your systemd unit is not `<app>.service` set this value.\n   *\n   * @defaultValue `<app>.service`\n   */\n  systemdUnitName?: string;\n}\n\n/**\n * @privateRemarks we should rename this to AlarmsProps.\n */\nexport interface Alarms {\n  /**\n   * Name of the target (SNS Topic) for alarm notifications.\n   */\n  snsTopicName: string;\n  /**\n   * Enable the 5xx alarm with settings.\n   */\n  http5xxAlarm: false | Http5xxAlarmProps;\n  /**\n   * Enable the 4xx alarm with settings.\n   */\n  http4xxAlarm?: false | Http4xxAlarmProps;\n  /**\n   * Enable the unhealthy instances alarm.\n   */\n  unhealthyInstancesAlarm: boolean;\n  /**\n   * Internal flag - users of this library should ignore this setting.\n   */\n  noMonitoring?: false;\n}\n\nexport interface GuEc2AppProps extends AppIdentity {\n  /**\n   * User data for the autoscaling group.\n   */\n  userData: GuUserDataProps | string;\n  /**\n   * Network access restrictions for your load balancer.\n   *\n   * Note, this merely provides defence in depth; you should, for example, limit\n   * access to the VPN and then treat that as sufficient. Instead, use Google\n   * Auth for human access, or a suitable machine auth mechanism.\n   */\n  access: AppAccess;\n  /**\n   * The port your application runs on.\n   */\n  applicationPort: number;\n  /**\n   * Configure IAM roles for autoscaling group EC2 instances.\n   */\n  roleConfiguration?: GuInstanceRoleProps;\n  /**\n   * Enable and configure alarms.\n   */\n  monitoringConfiguration: Alarms | NoMonitoring;\n  /**\n   * EC2 instance type. Note, ensure your code is built for the same\n   * architecture family (arm64 - 'Graviton' instances - or x64).\n   */\n  instanceType: InstanceType;\n  /**\n   * Enable and configures application logs.\n   */\n  applicationLogging?: ApplicationLoggingProps;\n  /**\n   * Enable and configures access logs.\n   */\n  accessLogging?: AccessLoggingProps;\n  /**\n   * Add block devices (additional storage).\n   */\n  blockDevices?: BlockDevice[];\n  /**\n   * Autoscaling group min and max sizes.\n   */\n  scaling: GuAsgCapacity;\n  /**\n   * Specify certificate for the load balancer.\n   */\n  certificateProps?: GuDomainName;\n  /**\n   * Disable imdsv2. Most of the time you should not set this.\n   *\n   * @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html\n   */\n  withoutImdsv2?: boolean;\n  /**\n   * Configure AMIgo image recipe. This is only necessary if you are using GuCDK to generate your riff-raff.yaml file.\n   */\n  imageRecipe?: string | AmigoProps;\n  /**\n   * Specify the VPC to use.\n   *\n   * @see https://github.com/guardian/aws-account-setup\n   */\n  vpc?: IVpc;\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  privateSubnets?: ISubnet[];\n\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  publicSubnets?: ISubnet[];\n\n  /**\n   * Configure Google Auth.\n   */\n  googleAuth?: {\n    /**\n     * Enables Google Auth (via Cognito). **Additional MANUAL steps required -\n     * see below.**\n     *\n     * Limits access to members of the allowed Google groups.\n     *\n     * Note, this does not currently support simultaneous machine access, so\n     * only set to true if you only require staff access to your service, or are\n     * supporting machine access in some other way.\n     *\n     * MANUAL STEPS: to get this to work, we need a Google Project and\n     * associated credentials. Full instructions can be found here:\n     *\n     * https://docs.google.com/document/d/1_k1FSE52AZHXufWLTiKTI3xy5cGpziyHazSHTKrYfco/edit?usp=sharing\n     *\n     * DevX hope to automate this process in the near future.\n     */\n    enabled: true;\n    /**\n     * The domain users will access your service.\n     *\n     * Set this to the same as for certificateProps.\n     */\n    domain: string;\n    /**\n     * Groups used for membership checks.\n     *\n     * If specified, cannot be empty. Users must be a member of at least one\n     * group to gain access.\n     *\n     * WARNING: groups must be specified with the `guardian.co.uk` domain, even\n     * if that is the non-idiomatic choice for daily use.\n     *\n     * @defaultValue [`engineering@guardian.co.uk`]\n     */\n    allowedGroups?: string[];\n    /**\n     * The number of minutes before the session expires.\n     *\n     * Set this value to a safe period of time that revoked users\n     * sessions will continue to function.\n     *\n     * NOTE: This value cannot be larger than 60 minutes.\n     *\n     * @defaultValue 15\n     */\n    sessionTimeoutInMinutes?: number;\n    /**\n     * Secrets Manager path containing Google OAuth2 Client credentials.\n     *\n     * NOTE: you do not need to set this value, but you DO need to generate and\n     * store the associated credentials in Secrets Manager.\n     *\n     * Credentials should be stored in Secrets Manager as JSON:\n     *\n     * ```json\n     * {\n     *   \"clientId\": \"my-client-id\",\n     *   \"clientSecret\": \"my-client-secret\"\n     * }\n     * ```\n     *\n     * @see `googleAuth.enabled` for how to generate.\n     *\n     * @defaultValue /:STAGE/:stack/:app/google-auth-credentials\n     */\n    credentialsSecretsManagerPath?: string;\n  };\n\n  /**\n   * Specify custom healthcheck\n   */\n  healthcheck?: ALBHealthCheck;\n\n  /**\n   * Set http put response hop limit for the launch template.\n   * It can be necessary to raise this value from the default of 1\n   * for example when sharing the instance profile with a docker container running on the instance.\n   */\n  instanceMetadataHopLimit?: number;\n}\n\nfunction restrictedCidrRanges(ranges: IPeer[]) {\n  return ranges.map((range) => ({\n    range,\n    port: Port.tcp(443),\n    description: `Allow access on port 443 from ${range.uniqueId}`,\n  }));\n}\n\n/**\n * Pattern which creates the resources needed to run an application on EC2\n * behind a load balancer. For convenience, you may wish to use [[`GuPlayApp`]]\n * or [[`GuNodeApp`]], which extend this class.\n *\n * See props for further details.\n */\nexport class GuEc2App extends Construct {\n  /*\n   * These are public for now, as this allows users to\n   * modify these constructs as desired to fit their\n   * specific needs.\n   * In the future, we might build functionality to better enable users\n   * to access in-pattern constructs, but this would allow teams to be unblocked\n   * in the short term.\n   * */\n  public readonly vpc: IVpc;\n  public readonly certificate?: GuCertificate;\n  public readonly loadBalancer: GuApplicationLoadBalancer;\n  public readonly autoScalingGroup: GuAutoScalingGroup;\n  public readonly listener: GuHttpsApplicationListener;\n  public readonly targetGroup: GuApplicationTargetGroup;\n\n  constructor(scope: GuStack, props: GuEc2AppProps) {\n    const {\n      access,\n      accessLogging = { enabled: false },\n      app,\n      // We should update this default once a significant number of apps have migrated to devx-logs\n      applicationLogging = { enabled: false },\n      applicationPort,\n      blockDevices,\n      certificateProps,\n      instanceType,\n      monitoringConfiguration,\n      roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n      scaling: { minimumInstances, maximumInstances = minimumInstances * 2 },\n      userData,\n      withoutImdsv2,\n      imageRecipe,\n      vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n      privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n      publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n      instanceMetadataHopLimit,\n    } = props;\n\n    super(scope, app); // The assumption is `app` is unique\n\n    // We should really prevent users from doing this via the type system,\n    // but that requires a breaking change to the API\n    if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n      throw new Error(\n        \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n          \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\",\n      );\n    }\n\n    AppAccess.validate(access);\n\n    const certificate =\n      typeof certificateProps !== \"undefined\"\n        ? new GuCertificate(scope, {\n            app,\n            domainName: certificateProps.domainName,\n            hostedZoneId: certificateProps.hostedZoneId,\n          })\n        : undefined;\n\n    const maybePrivateConfigPolicy =\n      typeof userData !== \"string\" && userData.configuration\n        ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n        : [];\n\n    const mergedRoleConfiguration: GuInstanceRoleProps = {\n      withoutLogShipping: roleConfiguration.withoutLogShipping,\n      additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n    };\n\n    const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n      app,\n      vpc,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      withoutImdsv2,\n      role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n      healthCheck: HealthCheck.elb({ grace: Duration.minutes(2) }), // should this be defaulted at pattern or construct level?\n      userData: typeof userData !== \"string\" ? new GuUserData(scope, { app, ...userData }).userData : userData,\n      vpcSubnets: { subnets: privateSubnets },\n      ...(blockDevices && { blockDevices }),\n      imageRecipe,\n      httpPutResponseHopLimit: instanceMetadataHopLimit,\n    });\n\n    // This allows automatic shipping of instance Cloud Init logs when using the\n    // `cdk-base` Amigo role on your AMI.\n    Tags.of(autoScalingGroup).add(\n      MetadataKeys.LOG_KINESIS_STREAM_NAME,\n      GuLoggingStreamNameParameter.getInstance(scope).valueAsString,\n    );\n\n    if (applicationLogging.enabled) {\n      // This allows automatic shipping of application logs when using the\n      // `cdk-base` Amigo role on your AMI.\n      Tags.of(autoScalingGroup).add(\n        MetadataKeys.SYSTEMD_UNIT,\n        applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`,\n      );\n    }\n\n    const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n      app,\n      vpc,\n      // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n      internetFacing: access.scope !== AccessScope.INTERNAL,\n      vpcSubnets: {\n        subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n      },\n    });\n\n    if (accessLogging.enabled) {\n      const accessLoggingBucket = new GuStringParameter(scope, \"AccessLoggingBucket\", {\n        description: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.description,\n        default: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.path,\n        fromSSM: true,\n      });\n\n      loadBalancer.logAccessLogs(\n        Bucket.fromBucketName(\n          scope,\n          AppIdentity.suffixText(props, \"AccessLoggingBucket\"),\n          accessLoggingBucket.valueAsString,\n        ),\n        accessLogging.prefix,\n      );\n    }\n\n    const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n      app,\n      vpc,\n      protocol: ApplicationProtocol.HTTP,\n      targets: [autoScalingGroup],\n      port: applicationPort,\n      healthCheck: props.healthcheck,\n    });\n\n    const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n      app,\n      loadBalancer,\n      certificate,\n      targetGroup,\n      // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n      open: access.scope === AccessScope.PUBLIC && typeof certificate !== \"undefined\",\n    });\n\n    // Since AWS won't create a security group automatically when open=false, we need to add our own\n    if (access.scope !== AccessScope.PUBLIC) {\n      loadBalancer.addSecurityGroup(\n        new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n          app,\n          vpc,\n          description: \"Allow restricted ingress from CIDR ranges\",\n          allowAllOutbound: false,\n          ingresses: restrictedCidrRanges(access.cidrRanges),\n        }),\n      );\n    }\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const { http5xxAlarm, http4xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n      if (http4xxAlarm) {\n        new GuAlb4xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http4xxAlarm,\n        });\n      }\n      if (http5xxAlarm) {\n        new GuAlb5xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http5xxAlarm,\n        });\n      }\n      if (unhealthyInstancesAlarm) {\n        new GuUnhealthyInstancesAlarm(scope, {\n          app,\n          targetGroup,\n          snsTopicName,\n        });\n      }\n    }\n\n    if (props.googleAuth?.enabled) {\n      const prefix = `/${scope.stage}/${scope.stack}/${app}`;\n\n      const {\n        allowedGroups = [\"engineering@guardian.co.uk\"],\n        sessionTimeoutInMinutes = 15,\n        credentialsSecretsManagerPath = `${prefix}/google-auth-credentials`,\n      } = props.googleAuth;\n\n      if (sessionTimeoutInMinutes > 60) {\n        throw new Error(\"googleAuth.sessionTimeoutInMinutes must be <= 60!\");\n      }\n\n      if (allowedGroups.length < 1) {\n        throw new Error(\"googleAuth.allowedGroups cannot be empty!\");\n      }\n\n      if (allowedGroups.find((group) => !group.endsWith(\"@guardian.co.uk\"))) {\n        throw new Error(\"googleAuth.allowedGroups must use the @guardian.co.uk domain.\");\n      }\n\n      const deployToolsAccountId = StringParameter.fromStringParameterName(\n        scope,\n        \"deploy-tools-account-id-parameter\",\n        NAMED_SSM_PARAMETER_PATHS.DeployToolsAccountId.path,\n      );\n\n      // See https://github.com/guardian/cognito-auth-lambdas for the source\n      // code here. ARN format is:\n      // arn:aws:lambda:aws-region:acct-id:function:helloworld.\n      const gatekeeperFunctionArn = `arn:aws:lambda:eu-west-1:${deployToolsAccountId.stringValue}:function:deploy-PROD-gatekeeper-lambda`;\n\n      // Note, handler and filename must match here:\n      // https://github.com/guardian/cognito-auth-lambdas.\n      const authLambda = new GuLambdaFunction(scope, \"auth-lambda\", {\n        app: app,\n        memorySize: 128,\n        handler: \"bootstrap\",\n        runtime: Runtime.PROVIDED_AL2,\n        fileName: \"deploy/INFRA/cognito-lambda/devx-cognito-lambda-amd64-v2.zip\",\n        withoutFilePrefix: true,\n        withoutArtifactUpload: true,\n        bucketNamePath: NAMED_SSM_PARAMETER_PATHS.OrganisationDistributionBucket.path,\n        architecture: Architecture.X86_64,\n        environment: {\n          ALLOWED_GROUPS: allowedGroups.join(\",\"),\n          GATEKEEPER_FUNCTION_ARN: gatekeeperFunctionArn,\n        },\n      });\n\n      authLambda.addToRolePolicy(\n        new PolicyStatement({\n          effect: Effect.ALLOW,\n          actions: [\"lambda:InvokeFunction\"],\n          resources: [gatekeeperFunctionArn],\n        }),\n      );\n\n      // Cognito user pool. We require both lambdas: pre-sign-up runs the first\n      // time a user attempts to authenticate (before they exist in the User\n      // Pool); pre-auth runs in subsequent authentication flows.\n      const userPool = new UserPool(this, \"user-pool\", {\n        lambdaTriggers: {\n          preAuthentication: authLambda,\n          preSignUp: authLambda,\n        },\n      });\n\n      // These help ensure domain is deterministic but also unique. Key\n      // assumption is that app/stack/stage combo are unique within Guardian.\n      const domainPrefix = `com-gu-${app.toLowerCase()}-${scope.stage.toLowerCase()}`;\n      const suffix = crypto.createHash(\"md5\").update(domainPrefix).digest(\"hex\");\n\n      const userPoolDomain = userPool.addDomain(\"domain\", {\n        cognitoDomain: {\n          domainPrefix: `${domainPrefix}-${suffix}`,\n        },\n      });\n\n      const clientId = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientId\" });\n      const clientSecret = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientSecret\" });\n\n      const userPoolIdp = new UserPoolIdentityProviderGoogle(scope, \"google-idp\", {\n        userPool: userPool,\n        clientId: clientId.toString(),\n        clientSecret: clientSecret.toString(),\n        attributeMapping: {\n          email: ProviderAttribute.GOOGLE_EMAIL,\n          givenName: ProviderAttribute.GOOGLE_GIVEN_NAME,\n          familyName: ProviderAttribute.GOOGLE_FAMILY_NAME,\n          profilePicture: ProviderAttribute.GOOGLE_PICTURE,\n          custom: {\n            name: ProviderAttribute.GOOGLE_NAME,\n          },\n        },\n        scopes: [\"openid\", \"email\", \"profile\"],\n      });\n\n      const userPoolClient = userPool.addClient(\"alb-client\", {\n        supportedIdentityProviders: [UserPoolClientIdentityProvider.GOOGLE],\n        generateSecret: true,\n        oAuth: {\n          callbackUrls: [`https://${props.googleAuth.domain}/oauth2/idpresponse`],\n        },\n\n        // Note: id and access validity token validity cannot be less than one\n        // hour (this is the cognito cookie duration). To quickly invalidate\n        // credentials, disable the user in Cognito. It might be that we want to\n        // parameterise these going forward, but that would require Infosec\n        // discussion.\n        idTokenValidity: Duration.hours(1),\n        accessTokenValidity: Duration.hours(1),\n        refreshTokenValidity: Duration.days(7),\n      });\n\n      userPoolClient.node.addDependency(userPoolIdp);\n\n      listener.addAction(\"CognitoAuth\", {\n        action: new AuthenticateCognitoAction({\n          userPool: userPool,\n          userPoolClient: userPoolClient,\n          userPoolDomain: userPoolDomain,\n          next: ListenerAction.forward([targetGroup]),\n          sessionTimeout: Duration.minutes(sessionTimeoutInMinutes),\n        }),\n      });\n\n      // Need to give the ALB outbound access on 443 for the IdP endpoints.\n      const idpEgressSecurityGroup = new GuHttpsEgressSecurityGroup(scope, \"ldp-access\", {\n        app,\n        vpc,\n      });\n\n      loadBalancer.addSecurityGroup(idpEgressSecurityGroup);\n    }\n\n    this.vpc = vpc;\n    this.certificate = certificate;\n    this.loadBalancer = loadBalancer;\n    this.autoScalingGroup = autoScalingGroup;\n    this.listener = listener;\n    this.targetGroup = targetGroup;\n  }\n}\n"]}