@guardian/cdk 50.3.2 → 50.4.0-beta.1

package/lib/constructs/cloudwatch/ec2-alarms.js

@@ -15,9 +15,9 @@ class GuAlb5xxPercentageAlarm extends alarm_1.GuAlarm {
         const mathExpression = new aws_cloudwatch_1.MathExpression({
             expression: "100*(m1+m2)/m3",
             usingMetrics: {
-                m1: props.loadBalancer.metricHttpCodeElb(aws_elasticloadbalancingv2_1.HttpCodeElb.ELB_5XX_COUNT),
-                m2: props.loadBalancer.metricHttpCodeTarget(aws_elasticloadbalancingv2_1.HttpCodeTarget.TARGET_5XX_COUNT),
-                m3: props.loadBalancer.metricRequestCount(),
+                m1: props.loadBalancer.metrics.httpCodeElb(aws_elasticloadbalancingv2_1.HttpCodeElb.ELB_5XX_COUNT),
+                m2: props.loadBalancer.metrics.httpCodeTarget(aws_elasticloadbalancingv2_1.HttpCodeTarget.TARGET_5XX_COUNT),
+                m3: props.loadBalancer.metrics.requestCount(),
             },
             label: `% of 5XX responses served for ${props.app} (load balancer and instances combined)`,
             period: aws_cdk_lib_1.Duration.minutes(1),
@@ -56,7 +56,7 @@ class GuUnhealthyInstancesAlarm extends alarm_1.GuAlarm {
             ...props,
             alarmName: alarmName,
             alarmDescription: alarmDescription,
-            metric: props.targetGroup.metricUnhealthyHostCount().with({ period, statistic: aws_cloudwatch_1.Statistic.MAXIMUM }),
+            metric: props.targetGroup.metrics.unhealthyHostCount().with({ period, statistic: aws_cloudwatch_1.Statistic.MAXIMUM }),
             treatMissingData: aws_cloudwatch_1.TreatMissingData.NOT_BREACHING,
             threshold: 1,
             comparisonOperator: aws_cloudwatch_1.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,

package/lib/constructs/cloudwatch/ec2-alarms.js.map

@@ -1 +1 @@
-{"version":3,"file":"ec2-alarms.js","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/ec2-alarms.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AACvC,+DAA6G;AAC7G,uFAAqF;AAErF,kCAAsC;AAEtC,mCAAkC;AAWlC;;;GAGG;AACH,MAAa,uBAAwB,SAAQ,eAAO;IAClD,YAAY,KAAc,EAAE,KAAmC;QAC7D,MAAM,cAAc,GAAG,IAAI,+BAAc,CAAC;YACxC,UAAU,EAAE,gBAAgB;YAC5B,YAAY,EAAE;gBACZ,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,iBAAiB,CAAC,wCAAW,CAAC,aAAa,CAAC;gBACnE,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,oBAAoB,CAAC,2CAAc,CAAC,gBAAgB,CAAC;gBAC5E,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,kBAAkB,EAAE;aAC5C;YACD,KAAK,EAAE,iCAAiC,KAAK,CAAC,GAAG,yCAAyC;YAC1F,MAAM,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;SAC5B,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,yBAAyB,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QAChF,MAAM,kBAAkB,GAAG,GAAG,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,sBAAsB,cAAc,CAAC;QAC/F,MAAM,UAAU,GAAG;YACjB,GAAG,KAAK;YACR,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,SAAS,EAAE,KAAK,CAAC,sBAAsB;YACvC,kBAAkB,EAAE,mCAAkB,CAAC,sBAAsB;YAC7D,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB;YAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,kBAAkB;YAC9D,iBAAiB,EAAE,KAAK,CAAC,wCAAwC,IAAI,CAAC;SACvE,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,wBAAwB,CAAC,EAAE,UAAU,CAAC,CAAC;IACpF,CAAC;CACF;AA1BD,0DA0BC;AAED;;GAEG;AACH,MAAa,yBAA0B,SAAQ,eAAO;IACpD,YAAY,KAAc,EAAE,KAAqC;QAC/D,MAAM,SAAS,GAAG,2BAA2B,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QAE3E,MAAM,MAAM,GAAG,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,iBAAiB,GAAG,EAAE,CAAC;QAC7B,MAAM,kBAAkB,GAAG,sBAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,iBAAiB,CAAC,CAAC,aAAa,EAAE,CAAC;QAEpG,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,GAAG,qEAAqE,kBAAkB;;;;cAIlH,KAAK,CAAC,GAAG,yFAAyF,CAAC;QAC7G,MAAM,UAAU,GAAiB;YAC/B,GAAG,KAAK;YACR,SAAS,EAAE,SAAS;YACpB,gBAAgB,EAAE,gBAAgB;YAClC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,wBAAwB,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,0BAAS,CAAC,OAAO,EAAE,CAAC;YACnG,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,SAAS,EAAE,CAAC;YACZ,kBAAkB,EAAE,mCAAkB,CAAC,kCAAkC;YACzE,iBAAiB,EAAE,EAAE;YACrB,iBAAiB;SAClB,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,yBAAyB,CAAC,EAAE,UAAU,CAAC,CAAC;IACrF,CAAC;CACF;AA1BD,8DA0BC","sourcesContent":["import { Duration } from \"aws-cdk-lib\";\nimport { ComparisonOperator, MathExpression, Statistic, TreatMissingData } from \"aws-cdk-lib/aws-cloudwatch\";\nimport { HttpCodeElb, HttpCodeTarget } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuStack } from \"../core\";\nimport { AppIdentity } from \"../core\";\nimport type { GuApplicationLoadBalancer, GuApplicationTargetGroup } from \"../loadbalancing\";\nimport { GuAlarm } from \"./alarm\";\nimport type { GuAlarmProps, Http5xxAlarmProps } from \"./alarm\";\n\ninterface GuAlb5xxPercentageAlarmProps extends Pick<GuAlarmProps, \"snsTopicName\">, Http5xxAlarmProps, AppIdentity {\n  loadBalancer: GuApplicationLoadBalancer;\n}\n\ninterface GuUnhealthyInstancesAlarmProps extends Pick<GuAlarmProps, \"snsTopicName\" | \"actionsEnabled\">, AppIdentity {\n  targetGroup: GuApplicationTargetGroup;\n}\n\n/**\n * Creates an alarm which is triggered whenever the percentage of requests with a 5xx response code exceeds\n * the specified threshold.\n */\nexport class GuAlb5xxPercentageAlarm extends GuAlarm {\n  constructor(scope: GuStack, props: GuAlb5xxPercentageAlarmProps) {\n    const mathExpression = new MathExpression({\n      expression: \"100*(m1+m2)/m3\",\n      usingMetrics: {\n        m1: props.loadBalancer.metricHttpCodeElb(HttpCodeElb.ELB_5XX_COUNT),\n        m2: props.loadBalancer.metricHttpCodeTarget(HttpCodeTarget.TARGET_5XX_COUNT),\n        m3: props.loadBalancer.metricRequestCount(),\n      },\n      label: `% of 5XX responses served for ${props.app} (load balancer and instances combined)`,\n      period: Duration.minutes(1),\n    });\n    const defaultAlarmName = `High 5XX error % from ${props.app} in ${scope.stage}`;\n    const defaultDescription = `${props.app} exceeded ${props.tolerated5xxPercentage}% error rate`;\n    const alarmProps = {\n      ...props,\n      metric: mathExpression,\n      treatMissingData: TreatMissingData.NOT_BREACHING,\n      threshold: props.tolerated5xxPercentage,\n      comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,\n      alarmName: props.alarmName ?? defaultAlarmName,\n      alarmDescription: props.alarmDescription ?? defaultDescription,\n      evaluationPeriods: props.numberOfMinutesAboveThresholdBeforeAlarm ?? 1,\n    };\n    super(scope, AppIdentity.suffixText(props, \"High5xxPercentageAlarm\"), alarmProps);\n  }\n}\n\n/**\n * Creates an alarm which is triggered whenever there have been several healthcheck failures within a single hour.\n */\nexport class GuUnhealthyInstancesAlarm extends GuAlarm {\n  constructor(scope: GuStack, props: GuUnhealthyInstancesAlarmProps) {\n    const alarmName = `Unhealthy instances for ${props.app} in ${scope.stage}`;\n\n    const period = Duration.minutes(1);\n    const evaluationPeriods = 60;\n    const evaluationInterval = Duration.minutes(period.toMinutes() * evaluationPeriods).toHumanString();\n\n    const alarmDescription = `${props.app}'s instances have failed healthchecks several times over the last ${evaluationInterval}.\n      This typically results in the AutoScaling Group cycling instances and can lead to problems with deployment,\n      scaling or handling traffic spikes.\n\n      Check ${props.app}'s application logs or ssh onto an unhealthy instance in order to debug these problems.`;\n    const alarmProps: GuAlarmProps = {\n      ...props,\n      alarmName: alarmName,\n      alarmDescription: alarmDescription,\n      metric: props.targetGroup.metricUnhealthyHostCount().with({ period, statistic: Statistic.MAXIMUM }),\n      treatMissingData: TreatMissingData.NOT_BREACHING,\n      threshold: 1,\n      comparisonOperator: ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,\n      datapointsToAlarm: 30,\n      evaluationPeriods,\n    };\n    super(scope, AppIdentity.suffixText(props, \"UnhealthyInstancesAlarm\"), alarmProps);\n  }\n}\n"]}
+{"version":3,"file":"ec2-alarms.js","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/ec2-alarms.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AACvC,+DAA6G;AAC7G,uFAAqF;AAErF,kCAAsC;AAEtC,mCAAkC;AAWlC;;;GAGG;AACH,MAAa,uBAAwB,SAAQ,eAAO;IAClD,YAAY,KAAc,EAAE,KAAmC;QAC7D,MAAM,cAAc,GAAG,IAAI,+BAAc,CAAC;YACxC,UAAU,EAAE,gBAAgB;YAC5B,YAAY,EAAE;gBACZ,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,wCAAW,CAAC,aAAa,CAAC;gBACrE,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,2CAAc,CAAC,gBAAgB,CAAC;gBAC9E,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,EAAE;aAC9C;YACD,KAAK,EAAE,iCAAiC,KAAK,CAAC,GAAG,yCAAyC;YAC1F,MAAM,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;SAC5B,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,yBAAyB,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QAChF,MAAM,kBAAkB,GAAG,GAAG,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,sBAAsB,cAAc,CAAC;QAC/F,MAAM,UAAU,GAAG;YACjB,GAAG,KAAK;YACR,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,SAAS,EAAE,KAAK,CAAC,sBAAsB;YACvC,kBAAkB,EAAE,mCAAkB,CAAC,sBAAsB;YAC7D,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB;YAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,kBAAkB;YAC9D,iBAAiB,EAAE,KAAK,CAAC,wCAAwC,IAAI,CAAC;SACvE,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,wBAAwB,CAAC,EAAE,UAAU,CAAC,CAAC;IACpF,CAAC;CACF;AA1BD,0DA0BC;AAED;;GAEG;AACH,MAAa,yBAA0B,SAAQ,eAAO;IACpD,YAAY,KAAc,EAAE,KAAqC;QAC/D,MAAM,SAAS,GAAG,2BAA2B,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QAE3E,MAAM,MAAM,GAAG,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,iBAAiB,GAAG,EAAE,CAAC;QAC7B,MAAM,kBAAkB,GAAG,sBAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,iBAAiB,CAAC,CAAC,aAAa,EAAE,CAAC;QAEpG,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,GAAG,qEAAqE,kBAAkB;;;;cAIlH,KAAK,CAAC,GAAG,yFAAyF,CAAC;QAC7G,MAAM,UAAU,GAAiB;YAC/B,GAAG,KAAK;YACR,SAAS,EAAE,SAAS;YACpB,gBAAgB,EAAE,gBAAgB;YAClC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,0BAAS,CAAC,OAAO,EAAE,CAAC;YACrG,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,SAAS,EAAE,CAAC;YACZ,kBAAkB,EAAE,mCAAkB,CAAC,kCAAkC;YACzE,iBAAiB,EAAE,EAAE;YACrB,iBAAiB;SAClB,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,yBAAyB,CAAC,EAAE,UAAU,CAAC,CAAC;IACrF,CAAC;CACF;AA1BD,8DA0BC","sourcesContent":["import { Duration } from \"aws-cdk-lib\";\nimport { ComparisonOperator, MathExpression, Statistic, TreatMissingData } from \"aws-cdk-lib/aws-cloudwatch\";\nimport { HttpCodeElb, HttpCodeTarget } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuStack } from \"../core\";\nimport { AppIdentity } from \"../core\";\nimport type { GuApplicationLoadBalancer, GuApplicationTargetGroup } from \"../loadbalancing\";\nimport { GuAlarm } from \"./alarm\";\nimport type { GuAlarmProps, Http5xxAlarmProps } from \"./alarm\";\n\ninterface GuAlb5xxPercentageAlarmProps extends Pick<GuAlarmProps, \"snsTopicName\">, Http5xxAlarmProps, AppIdentity {\n  loadBalancer: GuApplicationLoadBalancer;\n}\n\ninterface GuUnhealthyInstancesAlarmProps extends Pick<GuAlarmProps, \"snsTopicName\" | \"actionsEnabled\">, AppIdentity {\n  targetGroup: GuApplicationTargetGroup;\n}\n\n/**\n * Creates an alarm which is triggered whenever the percentage of requests with a 5xx response code exceeds\n * the specified threshold.\n */\nexport class GuAlb5xxPercentageAlarm extends GuAlarm {\n  constructor(scope: GuStack, props: GuAlb5xxPercentageAlarmProps) {\n    const mathExpression = new MathExpression({\n      expression: \"100*(m1+m2)/m3\",\n      usingMetrics: {\n        m1: props.loadBalancer.metrics.httpCodeElb(HttpCodeElb.ELB_5XX_COUNT),\n        m2: props.loadBalancer.metrics.httpCodeTarget(HttpCodeTarget.TARGET_5XX_COUNT),\n        m3: props.loadBalancer.metrics.requestCount(),\n      },\n      label: `% of 5XX responses served for ${props.app} (load balancer and instances combined)`,\n      period: Duration.minutes(1),\n    });\n    const defaultAlarmName = `High 5XX error % from ${props.app} in ${scope.stage}`;\n    const defaultDescription = `${props.app} exceeded ${props.tolerated5xxPercentage}% error rate`;\n    const alarmProps = {\n      ...props,\n      metric: mathExpression,\n      treatMissingData: TreatMissingData.NOT_BREACHING,\n      threshold: props.tolerated5xxPercentage,\n      comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,\n      alarmName: props.alarmName ?? defaultAlarmName,\n      alarmDescription: props.alarmDescription ?? defaultDescription,\n      evaluationPeriods: props.numberOfMinutesAboveThresholdBeforeAlarm ?? 1,\n    };\n    super(scope, AppIdentity.suffixText(props, \"High5xxPercentageAlarm\"), alarmProps);\n  }\n}\n\n/**\n * Creates an alarm which is triggered whenever there have been several healthcheck failures within a single hour.\n */\nexport class GuUnhealthyInstancesAlarm extends GuAlarm {\n  constructor(scope: GuStack, props: GuUnhealthyInstancesAlarmProps) {\n    const alarmName = `Unhealthy instances for ${props.app} in ${scope.stage}`;\n\n    const period = Duration.minutes(1);\n    const evaluationPeriods = 60;\n    const evaluationInterval = Duration.minutes(period.toMinutes() * evaluationPeriods).toHumanString();\n\n    const alarmDescription = `${props.app}'s instances have failed healthchecks several times over the last ${evaluationInterval}.\n      This typically results in the AutoScaling Group cycling instances and can lead to problems with deployment,\n      scaling or handling traffic spikes.\n\n      Check ${props.app}'s application logs or ssh onto an unhealthy instance in order to debug these problems.`;\n    const alarmProps: GuAlarmProps = {\n      ...props,\n      alarmName: alarmName,\n      alarmDescription: alarmDescription,\n      metric: props.targetGroup.metrics.unhealthyHostCount().with({ period, statistic: Statistic.MAXIMUM }),\n      treatMissingData: TreatMissingData.NOT_BREACHING,\n      threshold: 1,\n      comparisonOperator: ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,\n      datapointsToAlarm: 30,\n      evaluationPeriods,\n    };\n    super(scope, AppIdentity.suffixText(props, \"UnhealthyInstancesAlarm\"), alarmProps);\n  }\n}\n"]}

package/lib/constructs/ecs/ecs-task.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ecs-task.d.ts","sourceRoot":"","sources":["../../../src/constructs/ecs/ecs-task.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAgC,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAEnF,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,WAAW,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;AAE7E,MAAM,MAAM,wBAAwB,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,KAAK,CAAA;CAAE,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,GAAG,EAAE,IAAI,CAAC;IACV,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,YAAY,GAAG,wBAAwB,CAAC;IACjE,cAAc,CAAC,EAAE,cAAc,EAAE,CAAC;IAClC,kBAAkB,CAAC,EAAE,eAAe,EAAE,CAAC;IACvC,oBAAoB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAcD;;;;;;;;;GASG;AACH,qBAAa,SAAU,SAAQ,SAAS;IACtC,YAAY,EAAE,YAAY,CAAC;gBAEf,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc;CAiI9D"}
+{"version":3,"file":"ecs-task.d.ts","sourceRoot":"","sources":["../../../src/constructs/ecs/ecs-task.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAgC,YAAY,EAAW,MAAM,+BAA+B,CAAC;AACpG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAEnF,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,WAAW,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;AAE7E,MAAM,MAAM,wBAAwB,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,KAAK,CAAA;CAAE,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,GAAG,EAAE,IAAI,CAAC;IACV,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,YAAY,GAAG,wBAAwB,CAAC;IACjE,cAAc,CAAC,EAAE,cAAc,EAAE,CAAC;IAClC,kBAAkB,CAAC,EAAE,eAAe,EAAE,CAAC;IACvC,oBAAoB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAcD;;;;;;;;;GASG;AACH,qBAAa,SAAU,SAAQ,SAAS;IACtC,YAAY,EAAE,YAAY,CAAC;gBAEf,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc;CAiI9D"}

package/lib/constructs/ecs/ecs-task.js

@@ -80,7 +80,7 @@ class GuEcsTask extends constructs_1.Construct {
             taskDefinition,
             integrationPattern: aws_stepfunctions_1.IntegrationPattern.RUN_JOB,
             resultPath: aws_stepfunctions_1.JsonPath.DISCARD,
-            timeout: aws_cdk_lib_1.Duration.minutes(taskTimeoutInMinutes),
+            taskTimeout: aws_stepfunctions_1.Timeout.duration(aws_cdk_lib_1.Duration.minutes(taskTimeoutInMinutes)),
             securityGroups,
             containerOverrides: [
                 {

package/lib/constructs/ecs/ecs-task.js.map

@@ -1 +1 @@
-{"version":3,"file":"ecs-task.js","sourceRoot":"","sources":["../../../src/constructs/ecs/ecs-task.ts"],"names":[],"mappings":";;;AAAA,6CAAkD;AAClD,+DAAqE;AACrE,+EAA+D;AAG/D,iDAO6B;AAE7B,iDAA4C;AAC5C,qEAA2F;AAE3F,iFAAyF;AACzF,2CAAuC;AAGvC,kCAAsC;AACtC,gCAA2D;AA8F3D;;;GAGG;AACH,MAAM,YAAY,GAAG,CAAC,MAA8B,EAAE,EAAE;IACtD,IAAI,MAAM,CAAC,IAAI,IAAI,YAAY,EAAE;QAC/B,OAAO,wBAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;KAC5E;SAAM;QACL,OAAO,wBAAc,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,cAAc,CAAC,CAAC;KACjE;AACH,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAa,SAAU,SAAQ,sBAAS;IAGtC,YAAY,KAAc,EAAE,EAAU,EAAE,KAAqB;QAC3D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,MAAM,EACJ,GAAG;QAEH,iJAAiJ;QACjJ,GAAG,GAAG,IAAI,EAAE,iCAAiC;QAC7C,MAAM,GAAG,IAAI,EAAE,MAAM;QACrB,OAAO,EAAE,8CAA8C;QACvD,sBAAsB,EACtB,WAAW,EACX,oBAAoB,GAAG,EAAE,EACzB,kBAAkB,EAClB,GAAG,EACH,uBAAuB,EACvB,cAAc,GAAG,EAAE,EACnB,oBAAoB,GACrB,GAAG,KAAK,CAAC;QAEV,IAAI,OAAO,IAAI,OAAO,GAAG,EAAE,EAAE;YAC3B,MAAM,IAAI,KAAK,CACb,yJAAyJ,CAC1J,CAAC;SACH;QAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAE/B,MAAM,OAAO,GAAG,IAAI,iBAAO,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE;YAClD,WAAW,EAAE,GAAG,GAAG,YAAY,KAAK,EAAE;YACtC,8BAA8B,EAAE,IAAI;YACpC,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,IAAI,wBAAc,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE;YACvE,aAAa,EAAE,uBAAa,CAAC,OAAO;YACpC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;YACnB,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE;YAC5B,MAAM,EAAE,GAAG,KAAK,IAAI,KAAK,IAAI,GAAG,EAAE;YAClC,mBAAmB,EAAE,OAAO;SAC7B,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,cAAc,CAAC,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE;YAC7E,KAAK,EAAE,YAAY,CAAC,sBAAsB,CAAC;YAC3C,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YACjD,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YACtD,GAAG;YACH,cAAc,EAAE,MAAM;YACtB,OAAO,EAAE,oBAAU,CAAC,OAAO,CAAC;gBAC1B,YAAY,EAAE,GAAG;gBACjB,YAAY,EAAE,EAAE;aACjB,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI,uCAAiC,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAEzE,cAAc,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC/C,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjF,MAAM,IAAI,GAAG,IAAI,oCAAU,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;YAC/C,OAAO;YACP,YAAY,EAAE,IAAI,gDAAsB,CAAC;gBACvC,eAAe,EAAE,gCAAsB,CAAC,MAAM;aAC/C,CAAC;YACF,cAAc;YACd,kBAAkB,EAAE,sCAAkB,CAAC,OAAO;YAC9C,UAAU,EAAE,4BAAQ,CAAC,OAAO;YAC5B,OAAO,EAAE,sBAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC;YAC/C,cAAc;YACd,kBAAkB,EAAE;gBAClB;oBACE,mBAAmB,EAAE,mBAAmB;oBACxC,WAAW,EAAE,oBAAoB;iBAClC;aACF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,GAAG,IAAI,gCAAY,CAAC,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE;YAChE,UAAU,EAAE,IAAI;YAChB,gBAAgB,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,UAAU,GAAG,eAAK,CAAC,YAAY,CACnC,KAAK,EACL,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,EAC3C,uBAAuB,CAAC,WAAW,CACpC,CAAC;YACF,MAAM,MAAM,GAAG;gBACb;oBACE,IAAI,EAAE,GAAG,GAAG,mBAAmB;oBAC/B,WAAW,EAAE,GAAG,GAAG,IAAI,KAAK,cAAc;oBAC1C,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;wBACrC,MAAM,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;wBACzB,SAAS,EAAE,KAAK;qBACjB,CAAC;iBACH;gBACD;oBACE,IAAI,EAAE,GAAG,GAAG,UAAU;oBACtB,WAAW,EAAE,GAAG,GAAG,IAAI,KAAK,iBAAiB;oBAC7C,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC;wBACvC,MAAM,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;wBACzB,SAAS,EAAE,KAAK;qBACjB,CAAC;iBACH;aACF,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;gBAC/C,MAAM,KAAK,GAAG,IAAI,sBAAK,CAAC,KAAK,EAAE,IAAI,EAAE;oBACnC,gBAAgB,EAAE,WAAW;oBAC7B,cAAc,EAAE,IAAI;oBACpB,MAAM,EAAE,MAAM;oBACd,kEAAkE;oBAClE,SAAS,EAAE,CAAC;oBACZ,iBAAiB,EAAE,CAAC;oBACpB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;iBACjD,CAAC,CAAC;gBACH,KAAK,CAAC,cAAc,CAAC,IAAI,kCAAS,CAAC,UAAU,CAAC,CAAC,CAAC;gBAChD,kBAAW,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;SACJ;QAED,0CAA0C;QAC1C,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAW,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAE3G,IAAI,uBAAS,CAAC,KAAK,EAAE,GAAG,EAAE,wBAAwB,EAAE;YAClD,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,eAAe;SACzC,CAAC,CAAC;IACL,CAAC;CACF;AApID,8BAoIC","sourcesContent":["import { CfnOutput, Duration } from \"aws-cdk-lib\";\nimport { Alarm, TreatMissingData } from \"aws-cdk-lib/aws-cloudwatch\";\nimport { SnsAction } from \"aws-cdk-lib/aws-cloudwatch-actions\";\nimport type { ISecurityGroup, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport type { IRepository } from \"aws-cdk-lib/aws-ecr\";\nimport {\n  Cluster,\n  Compatibility,\n  ContainerImage,\n  FargatePlatformVersion,\n  LogDrivers,\n  TaskDefinition,\n} from \"aws-cdk-lib/aws-ecs\";\nimport type { PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Topic } from \"aws-cdk-lib/aws-sns\";\nimport { IntegrationPattern, JsonPath, StateMachine } from \"aws-cdk-lib/aws-stepfunctions\";\nimport type { TaskEnvironmentVariable } from \"aws-cdk-lib/aws-stepfunctions-tasks\";\nimport { EcsFargateLaunchTarget, EcsRunTask } from \"aws-cdk-lib/aws-stepfunctions-tasks\";\nimport { Construct } from \"constructs\";\nimport type { NoMonitoring } from \"../cloudwatch\";\nimport type { GuStack } from \"../core\";\nimport { AppIdentity } from \"../core\";\nimport { GuGetDistributablePolicyStatement } from \"../iam\";\n\n/**\n * Configuration to determine what container to use for the task\n * For example, to run the task in the latest node container:\n *\n * ```typescript\n * const containerConfiguration = {\n *     id: 'node:latest'\n * }\n * ```\n *\n * Alternatively you can specify a repository and version, for example for an ECR repository:\n * ```typescript\n * import { Repository } from \"aws-cdk-lib/aws-ecr\";\n * const repository = new Repository(scope, `${app}-repository`, {\n    repositoryName: app,\n  });\n * const containerConfiguration = {\n *     repository: Repository.fromRepositoryArn(\"<repository arn>\"),\n *     version: '1'\n * }\n * ```\n */\n\nexport type RepositoryContainer = {\n  repository: IRepository;\n  version: string;\n  type: \"repository\";\n};\n\nexport type RegistryContainer = {\n  id?: string;\n  type: \"registry\";\n};\n\nexport type ContainerConfiguration = RepositoryContainer | RegistryContainer;\n\nexport type GuEcsTaskMonitoringProps = { snsTopicArn: string; noMonitoring: false };\n\n/**\n * Configuration options for the [[`GuEcsTask`]] pattern.\n *\n * See [[`ContainerConfiguration`]] for details of how to configure the container used to run the task.\n *\n * `taskTimeoutInMinutes` does what is says on the tin. The default timeout is 15 minutes.\n *\n * The `taskCommand` prop allows you to specify a command to run when the task starts (this can also be done via a CMD statement in\n * your Dockerfile). For example:\n *\n * const props = {\n *    //other props\n *    taskCommand: `aws s3 cp s3://${distbucket}/${stack}/${stage}/${app}/task.sh . && ./task.sh\n    }\n *\n * It is advisable to configure alarms for when the job fails/times out. To do this specify the alarmSnsTopicArn prop.\n *\n * `customTaskPolicies` allows your task to interact with other AWS services. By default a task\n * will have read access to the distribution bucket for your account.\n *\n * You can specify security groups to apply to task using the `securityGroups` prop.\n *\n * You can also set the memory and cpu units for your task. See https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#task_size\n * for further details.\n *\n * If you want to pass input from the step function into your EcsTask you can do so via the `environmentOverrides` prop, which allows you to wire up\n * step function input JSON to environment variables set on the container. For example,\n * const props = {\n *  ...otherProps\n *   environmentOverrides: [\n      {\n        name: \"VERSION\",\n        value: JsonPath.stringAt(\"$.version\"),\n      },\n    }\n * With the above override, your task will attempt to find a `version` property in the JSON input passed to the step function, and apply it to the\n * VERSION environment variable. Alternatively, you could hard code a value for the variable in CDK.\n * See https://docs.aws.amazon.com/step-functions/latest/dg/connect-ecs.html for further detail and  other override options - this construct currently\n * only supports environment variables.\n */\nexport interface GuEcsTaskProps extends AppIdentity {\n  vpc: IVpc;\n  containerConfiguration: ContainerConfiguration;\n  taskTimeoutInMinutes?: number;\n  cpu?: number;\n  memory?: number;\n  taskCommand?: string;\n  monitoringConfiguration: NoMonitoring | GuEcsTaskMonitoringProps;\n  securityGroups?: ISecurityGroup[];\n  customTaskPolicies?: PolicyStatement[];\n  environmentOverrides?: TaskEnvironmentVariable[];\n  storage?: number;\n}\n\n/**\n * Containers can be specified either via a repository and version or by container id (in which case it will\n * be fetched from docker hub).\n */\nconst getContainer = (config: ContainerConfiguration) => {\n  if (config.type == \"repository\") {\n    return ContainerImage.fromEcrRepository(config.repository, config.version);\n  } else {\n    return ContainerImage.fromRegistry(config.id ?? \"ubuntu:focal\");\n  }\n};\n\n/**\n * Pattern which creates all of the resources needed for a fargate task\n *\n * The task will be wrapped in a step function to allow for easier triggering and alarming on failure.\n *\n * For all configuration options, see [[`GuEcsTaskProps`]].\n *\n * Note that if your task reliably completes in less than 15 minutes then you should probably use a [[`GuLambda`]] instead. This\n * pattern was mainly created to work around the 15 minute lambda timeout.\n */\nexport class GuEcsTask extends Construct {\n  stateMachine: StateMachine;\n\n  constructor(scope: GuStack, id: string, props: GuEcsTaskProps) {\n    super(scope, id);\n\n    const {\n      app,\n\n      // see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-taskdefinition.html#cfn-ecs-taskdefinition-cpu for details\n      cpu = 2048, // 2 cores and from 4-16GB memory\n      memory = 4096, // 4GB\n      storage, // default is 20 GB when not provided in props\n      containerConfiguration,\n      taskCommand,\n      taskTimeoutInMinutes = 15,\n      customTaskPolicies,\n      vpc,\n      monitoringConfiguration,\n      securityGroups = [],\n      environmentOverrides,\n    } = props;\n\n    if (storage && storage < 21) {\n      throw new Error(\n        \"Storage must be at least 21. See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-ephemeralstorage.html\"\n      );\n    }\n\n    const { stack, stage } = scope;\n\n    const cluster = new Cluster(scope, `${id}-Cluster`, {\n      clusterName: `${app}-cluster-${stage}`,\n      enableFargateCapacityProviders: true,\n      vpc,\n    });\n\n    const taskDefinition = new TaskDefinition(scope, `${id}-TaskDefinition`, {\n      compatibility: Compatibility.FARGATE,\n      cpu: cpu.toString(),\n      memoryMiB: memory.toString(),\n      family: `${stack}-${stage}-${app}`,\n      ephemeralStorageGiB: storage,\n    });\n\n    const containerDefinition = taskDefinition.addContainer(`${id}-TaskContainer`, {\n      image: getContainer(containerConfiguration),\n      entryPoint: taskCommand ? [\"/bin/sh\"] : undefined,\n      command: taskCommand ? [\"-c\", taskCommand] : undefined, // if unset, falls back to CMD in docker file, or no command will be run\n      cpu,\n      memoryLimitMiB: memory,\n      logging: LogDrivers.awsLogs({\n        streamPrefix: app,\n        logRetention: 14,\n      }),\n    });\n\n    const distPolicy = new GuGetDistributablePolicyStatement(scope, { app });\n\n    taskDefinition.addToTaskRolePolicy(distPolicy);\n    (customTaskPolicies ?? []).forEach((p) => taskDefinition.addToTaskRolePolicy(p));\n\n    const task = new EcsRunTask(scope, `${id}-task`, {\n      cluster,\n      launchTarget: new EcsFargateLaunchTarget({\n        platformVersion: FargatePlatformVersion.LATEST,\n      }),\n      taskDefinition,\n      integrationPattern: IntegrationPattern.RUN_JOB,\n      resultPath: JsonPath.DISCARD,\n      timeout: Duration.minutes(taskTimeoutInMinutes),\n      securityGroups,\n      containerOverrides: [\n        {\n          containerDefinition: containerDefinition,\n          environment: environmentOverrides,\n        },\n      ],\n    });\n\n    this.stateMachine = new StateMachine(scope, `${id}-StateMachine`, {\n      definition: task,\n      stateMachineName: `${app}-${stage}`,\n    });\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const alarmTopic = Topic.fromTopicArn(\n        scope,\n        AppIdentity.suffixText(props, \"AlarmTopic\"),\n        monitoringConfiguration.snsTopicArn\n      );\n      const alarms = [\n        {\n          name: `${app}-execution-failed`,\n          description: `${app}-${stage} job failed `,\n          metric: this.stateMachine.metricFailed({\n            period: Duration.hours(1),\n            statistic: \"sum\",\n          }),\n        },\n        {\n          name: `${app}-timeout`,\n          description: `${app}-${stage} job timed out `,\n          metric: this.stateMachine.metricTimedOut({\n            period: Duration.hours(1),\n            statistic: \"sum\",\n          }),\n        },\n      ];\n\n      alarms.forEach(({ name, description, metric }) => {\n        const alarm = new Alarm(scope, name, {\n          alarmDescription: description,\n          actionsEnabled: true,\n          metric: metric,\n          // default for comparisonOperator is GreaterThanOrEqualToThreshold\n          threshold: 1,\n          evaluationPeriods: 1,\n          treatMissingData: TreatMissingData.NOT_BREACHING,\n        });\n        alarm.addAlarmAction(new SnsAction(alarmTopic));\n        AppIdentity.taggedConstruct({ app }, alarm);\n      });\n    }\n\n    // Tag all constructs with correct app tag\n    [cluster, task, taskDefinition, this.stateMachine].forEach((c) => AppIdentity.taggedConstruct({ app }, c));\n\n    new CfnOutput(scope, `${id}-StateMachineArnOutput`, {\n      value: this.stateMachine.stateMachineArn,\n    });\n  }\n}\n"]}
+{"version":3,"file":"ecs-task.js","sourceRoot":"","sources":["../../../src/constructs/ecs/ecs-task.ts"],"names":[],"mappings":";;;AAAA,6CAAkD;AAClD,+DAAqE;AACrE,+EAA+D;AAG/D,iDAO6B;AAE7B,iDAA4C;AAC5C,qEAAoG;AAEpG,iFAAyF;AACzF,2CAAuC;AAGvC,kCAAsC;AACtC,gCAA2D;AA8F3D;;;GAGG;AACH,MAAM,YAAY,GAAG,CAAC,MAA8B,EAAE,EAAE;IACtD,IAAI,MAAM,CAAC,IAAI,IAAI,YAAY,EAAE;QAC/B,OAAO,wBAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;KAC5E;SAAM;QACL,OAAO,wBAAc,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,cAAc,CAAC,CAAC;KACjE;AACH,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAa,SAAU,SAAQ,sBAAS;IAGtC,YAAY,KAAc,EAAE,EAAU,EAAE,KAAqB;QAC3D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,MAAM,EACJ,GAAG;QAEH,iJAAiJ;QACjJ,GAAG,GAAG,IAAI,EAAE,iCAAiC;QAC7C,MAAM,GAAG,IAAI,EAAE,MAAM;QACrB,OAAO,EAAE,8CAA8C;QACvD,sBAAsB,EACtB,WAAW,EACX,oBAAoB,GAAG,EAAE,EACzB,kBAAkB,EAClB,GAAG,EACH,uBAAuB,EACvB,cAAc,GAAG,EAAE,EACnB,oBAAoB,GACrB,GAAG,KAAK,CAAC;QAEV,IAAI,OAAO,IAAI,OAAO,GAAG,EAAE,EAAE;YAC3B,MAAM,IAAI,KAAK,CACb,yJAAyJ,CAC1J,CAAC;SACH;QAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAE/B,MAAM,OAAO,GAAG,IAAI,iBAAO,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE;YAClD,WAAW,EAAE,GAAG,GAAG,YAAY,KAAK,EAAE;YACtC,8BAA8B,EAAE,IAAI;YACpC,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,IAAI,wBAAc,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE;YACvE,aAAa,EAAE,uBAAa,CAAC,OAAO;YACpC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;YACnB,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE;YAC5B,MAAM,EAAE,GAAG,KAAK,IAAI,KAAK,IAAI,GAAG,EAAE;YAClC,mBAAmB,EAAE,OAAO;SAC7B,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,cAAc,CAAC,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE;YAC7E,KAAK,EAAE,YAAY,CAAC,sBAAsB,CAAC;YAC3C,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YACjD,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YACtD,GAAG;YACH,cAAc,EAAE,MAAM;YACtB,OAAO,EAAE,oBAAU,CAAC,OAAO,CAAC;gBAC1B,YAAY,EAAE,GAAG;gBACjB,YAAY,EAAE,EAAE;aACjB,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI,uCAAiC,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAEzE,cAAc,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC/C,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjF,MAAM,IAAI,GAAG,IAAI,oCAAU,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;YAC/C,OAAO;YACP,YAAY,EAAE,IAAI,gDAAsB,CAAC;gBACvC,eAAe,EAAE,gCAAsB,CAAC,MAAM;aAC/C,CAAC;YACF,cAAc;YACd,kBAAkB,EAAE,sCAAkB,CAAC,OAAO;YAC9C,UAAU,EAAE,4BAAQ,CAAC,OAAO;YAC5B,WAAW,EAAE,2BAAO,CAAC,QAAQ,CAAC,sBAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;YACrE,cAAc;YACd,kBAAkB,EAAE;gBAClB;oBACE,mBAAmB,EAAE,mBAAmB;oBACxC,WAAW,EAAE,oBAAoB;iBAClC;aACF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,GAAG,IAAI,gCAAY,CAAC,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE;YAChE,UAAU,EAAE,IAAI;YAChB,gBAAgB,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,UAAU,GAAG,eAAK,CAAC,YAAY,CACnC,KAAK,EACL,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,EAC3C,uBAAuB,CAAC,WAAW,CACpC,CAAC;YACF,MAAM,MAAM,GAAG;gBACb;oBACE,IAAI,EAAE,GAAG,GAAG,mBAAmB;oBAC/B,WAAW,EAAE,GAAG,GAAG,IAAI,KAAK,cAAc;oBAC1C,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;wBACrC,MAAM,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;wBACzB,SAAS,EAAE,KAAK;qBACjB,CAAC;iBACH;gBACD;oBACE,IAAI,EAAE,GAAG,GAAG,UAAU;oBACtB,WAAW,EAAE,GAAG,GAAG,IAAI,KAAK,iBAAiB;oBAC7C,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC;wBACvC,MAAM,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;wBACzB,SAAS,EAAE,KAAK;qBACjB,CAAC;iBACH;aACF,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;gBAC/C,MAAM,KAAK,GAAG,IAAI,sBAAK,CAAC,KAAK,EAAE,IAAI,EAAE;oBACnC,gBAAgB,EAAE,WAAW;oBAC7B,cAAc,EAAE,IAAI;oBACpB,MAAM,EAAE,MAAM;oBACd,kEAAkE;oBAClE,SAAS,EAAE,CAAC;oBACZ,iBAAiB,EAAE,CAAC;oBACpB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;iBACjD,CAAC,CAAC;gBACH,KAAK,CAAC,cAAc,CAAC,IAAI,kCAAS,CAAC,UAAU,CAAC,CAAC,CAAC;gBAChD,kBAAW,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;SACJ;QAED,0CAA0C;QAC1C,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAW,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAE3G,IAAI,uBAAS,CAAC,KAAK,EAAE,GAAG,EAAE,wBAAwB,EAAE;YAClD,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,eAAe;SACzC,CAAC,CAAC;IACL,CAAC;CACF;AApID,8BAoIC","sourcesContent":["import { CfnOutput, Duration } from \"aws-cdk-lib\";\nimport { Alarm, TreatMissingData } from \"aws-cdk-lib/aws-cloudwatch\";\nimport { SnsAction } from \"aws-cdk-lib/aws-cloudwatch-actions\";\nimport type { ISecurityGroup, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport type { IRepository } from \"aws-cdk-lib/aws-ecr\";\nimport {\n  Cluster,\n  Compatibility,\n  ContainerImage,\n  FargatePlatformVersion,\n  LogDrivers,\n  TaskDefinition,\n} from \"aws-cdk-lib/aws-ecs\";\nimport type { PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Topic } from \"aws-cdk-lib/aws-sns\";\nimport { IntegrationPattern, JsonPath, StateMachine, Timeout } from \"aws-cdk-lib/aws-stepfunctions\";\nimport type { TaskEnvironmentVariable } from \"aws-cdk-lib/aws-stepfunctions-tasks\";\nimport { EcsFargateLaunchTarget, EcsRunTask } from \"aws-cdk-lib/aws-stepfunctions-tasks\";\nimport { Construct } from \"constructs\";\nimport type { NoMonitoring } from \"../cloudwatch\";\nimport type { GuStack } from \"../core\";\nimport { AppIdentity } from \"../core\";\nimport { GuGetDistributablePolicyStatement } from \"../iam\";\n\n/**\n * Configuration to determine what container to use for the task\n * For example, to run the task in the latest node container:\n *\n * ```typescript\n * const containerConfiguration = {\n *     id: 'node:latest'\n * }\n * ```\n *\n * Alternatively you can specify a repository and version, for example for an ECR repository:\n * ```typescript\n * import { Repository } from \"aws-cdk-lib/aws-ecr\";\n * const repository = new Repository(scope, `${app}-repository`, {\n    repositoryName: app,\n  });\n * const containerConfiguration = {\n *     repository: Repository.fromRepositoryArn(\"<repository arn>\"),\n *     version: '1'\n * }\n * ```\n */\n\nexport type RepositoryContainer = {\n  repository: IRepository;\n  version: string;\n  type: \"repository\";\n};\n\nexport type RegistryContainer = {\n  id?: string;\n  type: \"registry\";\n};\n\nexport type ContainerConfiguration = RepositoryContainer | RegistryContainer;\n\nexport type GuEcsTaskMonitoringProps = { snsTopicArn: string; noMonitoring: false };\n\n/**\n * Configuration options for the [[`GuEcsTask`]] pattern.\n *\n * See [[`ContainerConfiguration`]] for details of how to configure the container used to run the task.\n *\n * `taskTimeoutInMinutes` does what is says on the tin. The default timeout is 15 minutes.\n *\n * The `taskCommand` prop allows you to specify a command to run when the task starts (this can also be done via a CMD statement in\n * your Dockerfile). For example:\n *\n * const props = {\n *    //other props\n *    taskCommand: `aws s3 cp s3://${distbucket}/${stack}/${stage}/${app}/task.sh . && ./task.sh\n    }\n *\n * It is advisable to configure alarms for when the job fails/times out. To do this specify the alarmSnsTopicArn prop.\n *\n * `customTaskPolicies` allows your task to interact with other AWS services. By default a task\n * will have read access to the distribution bucket for your account.\n *\n * You can specify security groups to apply to task using the `securityGroups` prop.\n *\n * You can also set the memory and cpu units for your task. See https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#task_size\n * for further details.\n *\n * If you want to pass input from the step function into your EcsTask you can do so via the `environmentOverrides` prop, which allows you to wire up\n * step function input JSON to environment variables set on the container. For example,\n * const props = {\n *  ...otherProps\n *   environmentOverrides: [\n      {\n        name: \"VERSION\",\n        value: JsonPath.stringAt(\"$.version\"),\n      },\n    }\n * With the above override, your task will attempt to find a `version` property in the JSON input passed to the step function, and apply it to the\n * VERSION environment variable. Alternatively, you could hard code a value for the variable in CDK.\n * See https://docs.aws.amazon.com/step-functions/latest/dg/connect-ecs.html for further detail and  other override options - this construct currently\n * only supports environment variables.\n */\nexport interface GuEcsTaskProps extends AppIdentity {\n  vpc: IVpc;\n  containerConfiguration: ContainerConfiguration;\n  taskTimeoutInMinutes?: number;\n  cpu?: number;\n  memory?: number;\n  taskCommand?: string;\n  monitoringConfiguration: NoMonitoring | GuEcsTaskMonitoringProps;\n  securityGroups?: ISecurityGroup[];\n  customTaskPolicies?: PolicyStatement[];\n  environmentOverrides?: TaskEnvironmentVariable[];\n  storage?: number;\n}\n\n/**\n * Containers can be specified either via a repository and version or by container id (in which case it will\n * be fetched from docker hub).\n */\nconst getContainer = (config: ContainerConfiguration) => {\n  if (config.type == \"repository\") {\n    return ContainerImage.fromEcrRepository(config.repository, config.version);\n  } else {\n    return ContainerImage.fromRegistry(config.id ?? \"ubuntu:focal\");\n  }\n};\n\n/**\n * Pattern which creates all of the resources needed for a fargate task\n *\n * The task will be wrapped in a step function to allow for easier triggering and alarming on failure.\n *\n * For all configuration options, see [[`GuEcsTaskProps`]].\n *\n * Note that if your task reliably completes in less than 15 minutes then you should probably use a [[`GuLambda`]] instead. This\n * pattern was mainly created to work around the 15 minute lambda timeout.\n */\nexport class GuEcsTask extends Construct {\n  stateMachine: StateMachine;\n\n  constructor(scope: GuStack, id: string, props: GuEcsTaskProps) {\n    super(scope, id);\n\n    const {\n      app,\n\n      // see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-taskdefinition.html#cfn-ecs-taskdefinition-cpu for details\n      cpu = 2048, // 2 cores and from 4-16GB memory\n      memory = 4096, // 4GB\n      storage, // default is 20 GB when not provided in props\n      containerConfiguration,\n      taskCommand,\n      taskTimeoutInMinutes = 15,\n      customTaskPolicies,\n      vpc,\n      monitoringConfiguration,\n      securityGroups = [],\n      environmentOverrides,\n    } = props;\n\n    if (storage && storage < 21) {\n      throw new Error(\n        \"Storage must be at least 21. See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-ephemeralstorage.html\"\n      );\n    }\n\n    const { stack, stage } = scope;\n\n    const cluster = new Cluster(scope, `${id}-Cluster`, {\n      clusterName: `${app}-cluster-${stage}`,\n      enableFargateCapacityProviders: true,\n      vpc,\n    });\n\n    const taskDefinition = new TaskDefinition(scope, `${id}-TaskDefinition`, {\n      compatibility: Compatibility.FARGATE,\n      cpu: cpu.toString(),\n      memoryMiB: memory.toString(),\n      family: `${stack}-${stage}-${app}`,\n      ephemeralStorageGiB: storage,\n    });\n\n    const containerDefinition = taskDefinition.addContainer(`${id}-TaskContainer`, {\n      image: getContainer(containerConfiguration),\n      entryPoint: taskCommand ? [\"/bin/sh\"] : undefined,\n      command: taskCommand ? [\"-c\", taskCommand] : undefined, // if unset, falls back to CMD in docker file, or no command will be run\n      cpu,\n      memoryLimitMiB: memory,\n      logging: LogDrivers.awsLogs({\n        streamPrefix: app,\n        logRetention: 14,\n      }),\n    });\n\n    const distPolicy = new GuGetDistributablePolicyStatement(scope, { app });\n\n    taskDefinition.addToTaskRolePolicy(distPolicy);\n    (customTaskPolicies ?? []).forEach((p) => taskDefinition.addToTaskRolePolicy(p));\n\n    const task = new EcsRunTask(scope, `${id}-task`, {\n      cluster,\n      launchTarget: new EcsFargateLaunchTarget({\n        platformVersion: FargatePlatformVersion.LATEST,\n      }),\n      taskDefinition,\n      integrationPattern: IntegrationPattern.RUN_JOB,\n      resultPath: JsonPath.DISCARD,\n      taskTimeout: Timeout.duration(Duration.minutes(taskTimeoutInMinutes)),\n      securityGroups,\n      containerOverrides: [\n        {\n          containerDefinition: containerDefinition,\n          environment: environmentOverrides,\n        },\n      ],\n    });\n\n    this.stateMachine = new StateMachine(scope, `${id}-StateMachine`, {\n      definition: task,\n      stateMachineName: `${app}-${stage}`,\n    });\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const alarmTopic = Topic.fromTopicArn(\n        scope,\n        AppIdentity.suffixText(props, \"AlarmTopic\"),\n        monitoringConfiguration.snsTopicArn\n      );\n      const alarms = [\n        {\n          name: `${app}-execution-failed`,\n          description: `${app}-${stage} job failed `,\n          metric: this.stateMachine.metricFailed({\n            period: Duration.hours(1),\n            statistic: \"sum\",\n          }),\n        },\n        {\n          name: `${app}-timeout`,\n          description: `${app}-${stage} job timed out `,\n          metric: this.stateMachine.metricTimedOut({\n            period: Duration.hours(1),\n            statistic: \"sum\",\n          }),\n        },\n      ];\n\n      alarms.forEach(({ name, description, metric }) => {\n        const alarm = new Alarm(scope, name, {\n          alarmDescription: description,\n          actionsEnabled: true,\n          metric: metric,\n          // default for comparisonOperator is GreaterThanOrEqualToThreshold\n          threshold: 1,\n          evaluationPeriods: 1,\n          treatMissingData: TreatMissingData.NOT_BREACHING,\n        });\n        alarm.addAlarmAction(new SnsAction(alarmTopic));\n        AppIdentity.taggedConstruct({ app }, alarm);\n      });\n    }\n\n    // Tag all constructs with correct app tag\n    [cluster, task, taskDefinition, this.stateMachine].forEach((c) => AppIdentity.taggedConstruct({ app }, c));\n\n    new CfnOutput(scope, `${id}-StateMachineArnOutput`, {\n      value: this.stateMachine.stateMachineArn,\n    });\n  }\n}\n"]}

package/lib/patterns/ec2-app/base.d.ts

@@ -164,6 +164,67 @@ export interface GuEc2AppProps extends AppIdentity {
      * discouraged) to limit to a subset of the available subnets.
      */
     publicSubnets?: ISubnet[];
+    /**
+     * Configure Google Auth.
+     */
+    googleAuth?: {
+        /**
+         * Enables Google Auth (via Cognito). **Additional MANUAL steps required -
+         * see below.**
+         *
+         * Limits access to members of the allowed Google groups.
+         *
+         * Note, this does not currently support simultaneous machine access, so
+         * only set to true if you only require staff access to your service, or are
+         * supporting machine access in some other way.
+         *
+         * MANUAL STEPS: to get this to work, we need a Google Project and
+         * associated credentials. Full instructions can be found here:
+         *
+         * https://docs.google.com/document/d/1_k1FSE52AZHXufWLTiKTI3xy5cGpziyHazSHTKrYfco/edit?usp=sharing
+         *
+         * DevX hope to automate this process in the near future.
+         */
+        enabled: true;
+        /**
+         * The domain users will access your service.
+         *
+         * Set this to the same as for certificateProps.
+         */
+        domain: string;
+        /**
+         * Groups used for membership checks.
+         *
+         * If specified, cannot be empty. Users must be a member of at least one
+         * group to gain access.
+         *
+         * WARNING: groups must be specified with the `guardian.co.uk` domain, even
+         * if that is the non-idiomatic choice for daily use.
+         *
+         * @defaultValue [`engineering@guardian.co.uk`]
+         */
+        allowedGroups?: string[];
+        /**
+         * Secrets Manager path containing Google OAuth2 Client credentials.
+         *
+         * NOTE: you do not need to set this value, but you DO need to generate and
+         * store the associated credentials in Secrets Manager.
+         *
+         * Credentials should be stored in Secrets Manager as JSON:
+         *
+         * ```json
+         * {
+         *   "clientId": "my-client-id",
+         *   "clientSecret": "my-client-secret"
+         * }
+         * ```
+         *
+         * @see `googleAuth.enabled` for how to generate.
+         *
+         * @defaultValue /:STAGE/:stack/:app/google-auth-credentials
+         */
+        credentialsSecretsManagerPath?: string;
+    };
 }
 /**
  * Pattern which creates the resources needed to run an application on EC2

package/lib/patterns/ec2-app/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,KAAK,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAI9E,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAc,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEnF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAmD,MAAM,uBAAuB,CAAC;AAErG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,YAAY,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACxC;;OAEG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD;;OAEG;IACH,QAAQ,EAAE,eAAe,GAAG,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC;;OAEG;IACH,uBAAuB,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/C;;;OAGG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAC7C;;OAEG;IACH,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;OAEG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B;;OAEG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,YAAY,CAAC;IAChC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAE3B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;CAC3B;AAUD;;;;;;GAMG;AACH,qBAAa,QAAS,SAAQ,SAAS;IASrC,SAAgB,GAAG,EAAE,IAAI,CAAC;IAC1B,SAAgB,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5C,SAAgB,YAAY,EAAE,yBAAyB,CAAC;IACxD,SAAgB,gBAAgB,EAAE,kBAAkB,CAAC;IACrD,SAAgB,QAAQ,EAAE,0BAA0B,CAAC;IACrD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;gBAE1C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa;CAyKjD"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAQ/D,OAAO,KAAK,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAQ9E,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAc,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEnF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAmD,MAAM,uBAAuB,CAAC;AAErG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGhE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,YAAY,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACxC;;OAEG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD;;OAEG;IACH,QAAQ,EAAE,eAAe,GAAG,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC;;OAEG;IACH,uBAAuB,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/C;;;OAGG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAC7C;;OAEG;IACH,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;OAEG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B;;OAEG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,YAAY,CAAC;IAChC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAE3B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAE1B;;OAEG;IACH,UAAU,CAAC,EAAE;QACX;;;;;;;;;;;;;;;;WAgBG;QACH,OAAO,EAAE,IAAI,CAAC;QACd;;;;WAIG;QACH,MAAM,EAAE,MAAM,CAAC;QACf;;;;;;;;;;WAUG;QACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QAEzB;;;;;;;;;;;;;;;;;;WAkBG;QACH,6BAA6B,CAAC,EAAE,MAAM,CAAC;KACxC,CAAC;CACH;AAUD;;;;;;GAMG;AACH,qBAAa,QAAS,SAAQ,SAAS;IASrC,SAAgB,GAAG,EAAE,IAAI,CAAC;IAC1B,SAAgB,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5C,SAAgB,YAAY,EAAE,yBAAyB,CAAC;IACxD,SAAgB,gBAAgB,EAAE,kBAAkB,CAAC;IACrD,SAAgB,QAAQ,EAAE,0BAA0B,CAAC;IACrD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;gBAE1C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa;CA8RjD"}

package/lib/patterns/ec2-app/base.js

@@ -1,11 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GuEc2App = void 0;
+/* eslint "@guardian/tsdoc-required/tsdoc-required": 2 -- to begin rolling this out for public APIs. */
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const aws_autoscaling_1 = require("aws-cdk-lib/aws-autoscaling");
+const aws_cognito_1 = require("aws-cdk-lib/aws-cognito");
 const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
 const aws_elasticloadbalancingv2_1 = require("aws-cdk-lib/aws-elasticloadbalancingv2");
+const aws_elasticloadbalancingv2_actions_1 = require("aws-cdk-lib/aws-elasticloadbalancingv2-actions");
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const aws_lambda_1 = require("aws-cdk-lib/aws-lambda");
 const aws_s3_1 = require("aws-cdk-lib/aws-s3");
+const aws_ssm_1 = require("aws-cdk-lib/aws-ssm");
 const constructs_1 = require("constructs");
 const constants_1 = require("../../constants");
 const acm_1 = require("../../constructs/acm");
@@ -14,6 +20,7 @@ const cloudwatch_1 = require("../../constructs/cloudwatch");
 const core_1 = require("../../constructs/core");
 const ec2_1 = require("../../constructs/ec2");
 const iam_1 = require("../../constructs/iam");
+const lambda_1 = require("../../constructs/lambda");
 const loadbalancing_1 = require("../../constructs/loadbalancing");
 const types_1 = require("../../types");
 function restrictedCidrRanges(ranges) {
@@ -139,6 +146,98 @@ class GuEc2App extends constructs_1.Construct {
                 });
             }
         }
+        if (props.googleAuth?.enabled) {
+            const prefix = `/${scope.stage}/${scope.stack}/${app}`;
+            const { allowedGroups = ["engineering@guardian.co.uk"], credentialsSecretsManagerPath = `${prefix}/google-auth-credentials`, } = props.googleAuth;
+            if (allowedGroups.length < 1) {
+                throw new Error("googleAuth.allowedGroups cannot be empty!");
+            }
+            if (allowedGroups.find((group) => !group.endsWith("@guardian.co.uk"))) {
+                throw new Error("googleAuth.allowedGroups must use the @guardian.co.uk domain.");
+            }
+            const deployToolsAccountId = aws_ssm_1.StringParameter.fromStringParameterName(scope, "deploy-tools-account-id-parameter", constants_1.NAMED_SSM_PARAMETER_PATHS.DeployToolsAccountId.path);
+            // See https://github.com/guardian/cognito-auth-lambdas for the source
+            // code here. ARN format is:
+            // arn:aws:lambda:aws-region:acct-id:function:helloworld.
+            const gatekeeperFunctionArn = `arn:aws:lambda:eu-west-1:${deployToolsAccountId.stringValue}:function:deploy-PROD-gatekeeper-lambda`;
+            // Note, handler and filename must match here:
+            // https://github.com/guardian/cognito-auth-lambdas.
+            const authLambda = new lambda_1.GuLambdaFunction(scope, "auth-lambda", {
+                app: app,
+                memorySize: 128,
+                handler: "devx-cognito-lambda-amd64-v1",
+                runtime: aws_lambda_1.Runtime.GO_1_X,
+                fileName: "devx-cognito-lambda-amd64-v1.zip",
+                bucketNamePath: constants_1.NAMED_SSM_PARAMETER_PATHS.OrganisationDistributionBucket.path,
+                architecture: aws_lambda_1.Architecture.X86_64,
+                environment: {
+                    ALLOWED_GROUPS: allowedGroups.join(","),
+                    GATEKEEPER_FUNCTION_ARN: gatekeeperFunctionArn,
+                },
+            });
+            authLambda.addToRolePolicy(new aws_iam_1.PolicyStatement({
+                effect: aws_iam_1.Effect.ALLOW,
+                actions: ["lambda:InvokeFunction"],
+                resources: [gatekeeperFunctionArn],
+            }));
+            // Cognito user pool. We require both lambdas: pre-sign-up runs the first
+            // time a user attempts to authenticate (before they exist in the User
+            // Pool); pre-auth runs in subsequent authentication flows.
+            const userPool = new aws_cognito_1.UserPool(this, "user-pool", {
+                lambdaTriggers: {
+                    preAuthentication: authLambda,
+                    preSignUp: authLambda,
+                },
+            });
+            const userPoolDomain = userPool.addDomain("domain", {
+                cognitoDomain: {
+                    // Must be unique (as global across AWS)
+                    domainPrefix: `com-gu-${app.toLowerCase()}-${scope.stage.toLowerCase()}-${new Date().valueOf().toString()}`,
+                },
+            });
+            const clientId = aws_cdk_lib_1.SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: "clientId" });
+            const clientSecret = aws_cdk_lib_1.SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: "clientSecret" });
+            const userPoolIdp = new aws_cognito_1.UserPoolIdentityProviderGoogle(scope, "google-idp", {
+                userPool: userPool,
+                clientId: clientId.toString(),
+                clientSecret: clientSecret.toString(),
+                attributeMapping: {
+                    email: aws_cognito_1.ProviderAttribute.GOOGLE_EMAIL,
+                    givenName: aws_cognito_1.ProviderAttribute.GOOGLE_GIVEN_NAME,
+                    familyName: aws_cognito_1.ProviderAttribute.GOOGLE_FAMILY_NAME,
+                    profilePicture: aws_cognito_1.ProviderAttribute.GOOGLE_PICTURE,
+                    custom: {
+                        name: aws_cognito_1.ProviderAttribute.GOOGLE_NAME,
+                    },
+                },
+                scopes: ["openid", "email", "profile"],
+            });
+            const userPoolClient = userPool.addClient("alb-client", {
+                supportedIdentityProviders: [aws_cognito_1.UserPoolClientIdentityProvider.GOOGLE],
+                generateSecret: true,
+                oAuth: {
+                    callbackUrls: [`https://${props.googleAuth.domain}/oauth2/idpresponse`],
+                },
+                // Note: id and access validity token validity cannot be less than one
+                // hour (this is the cognito cookie duration). To quickly invalidate
+                // credentials, disable the user in Cognito. It might be that we want to
+                // parameterise these going forward, but that would require Infosec
+                // discussion.
+                idTokenValidity: aws_cdk_lib_1.Duration.hours(1),
+                accessTokenValidity: aws_cdk_lib_1.Duration.hours(1),
+                refreshTokenValidity: aws_cdk_lib_1.Duration.days(7),
+            });
+            userPoolClient.node.addDependency(userPoolIdp);
+            listener.addAction("CognitoAuth", {
+                action: new aws_elasticloadbalancingv2_actions_1.AuthenticateCognitoAction({
+                    userPool: userPool,
+                    userPoolClient: userPoolClient,
+                    userPoolDomain: userPoolDomain,
+                    next: aws_elasticloadbalancingv2_1.ListenerAction.forward([targetGroup]),
+                    sessionTimeout: aws_cdk_lib_1.Duration.minutes(15),
+                }),
+            });
+        }
         this.vpc = vpc;
         this.certificate = certificate;
         this.loadBalancer = loadBalancer;

package/lib/patterns/ec2-app/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;AAAA,6CAA6C;AAE7C,iEAA0D;AAE1D,iDAA2C;AAC3C,uFAA6E;AAC7E,+CAA4C;AAC5C,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAAiG;AAEjG,gDAAqG;AACrG,8CAA0E;AAE1E,8CAAgF;AAChF,kEAIwC;AACxC,uCAAwC;AAkKxC,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,aAAa,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAClC,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EACR,aAAa,EACb,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GACpF,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,WAAW;YACrC,CAAC,CAAC,IAAI,mBAAa,CAAC,KAAK,EAAE;gBACvB,GAAG;gBACH,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,YAAY,EAAE,gBAAgB,CAAC,YAAY;aAC5C,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,wBAAwB,GAC5B,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa;YACpD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,aAAa;YACb,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YACpE,WAAW,EAAE,6BAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACxG,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;SACZ,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;SACF,CAAC,CAAC;QAEH,IAAI,aAAa,CAAC,OAAO,EAAE;YACzB,MAAM,mBAAmB,GAAG,IAAI,wBAAiB,CAAC,KAAK,EAAE,qBAAqB,EAAE;gBAC9E,WAAW,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,WAAW;gBACtE,OAAO,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,IAAI;gBAC3D,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,YAAY,CAAC,aAAa,CACxB,eAAM,CAAC,cAAc,CACnB,KAAK,EACL,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,qBAAqB,CAAC,EACpD,mBAAmB,CAAC,aAAa,CAClC,EACD,aAAa,CAAC,MAAM,CACrB,CAAC;SACH;QAED,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,IAAI,OAAO,WAAW,KAAK,WAAW;SAChF,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAExF,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAzLD,4BAyLC","sourcesContent":["import { Duration, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice } from \"aws-cdk-lib/aws-autoscaling\";\nimport { HealthCheck } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port } from \"aws-cdk-lib/aws-ec2\";\nimport { ApplicationProtocol } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport { GuAlb5xxPercentageAlarm, GuUnhealthyInstancesAlarm } from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuLoggingStreamNameParameter, GuStringParameter } from \"../../constructs/core\";\nimport { GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport {\n  GuApplicationLoadBalancer,\n  GuApplicationTargetGroup,\n  GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\n\nexport interface AccessLoggingProps {\n  /**\n   * Enable (load balancer) access logs.\n   *\n   * Note, you will need to specify a region in your stack declaration to use\n   * this.\n   * See`https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html#logwbraccesswbrlogsbucket-prefix`\n   */\n  enabled: boolean;\n  /**\n   * S3 prefix for the logs.\n   *\n   * @defaultValue no prefix\n   */\n  prefix?: string;\n}\n\n/**\n * To ship your application logs to ELK automatically, you must:\n *\n * 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n *\n * Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n */\nexport interface ApplicationLoggingProps {\n  /**\n   * Enables forwarding of application logs to the Guardian ELK stack.\n   *\n   * Note, to work, you will need to also do the following non-CDK things:\n   *\n   * 1. Include the `cdk-base` Amigo role in your AMI.\n   * 2. Log to `journald`. We recommend doing this by logging to `stdout` and\n   *    using `systemd` to start your app\n   * 3. Confirm that your [[`systemdUnitName`]] is configured properly.\n   *\n   * Unless you have explicitly opted-out, appropriate IAM permissions for\n   * logging to Kinesis will be configured automatically via the [[`GuEc2App`]]\n   * pattern.\n   *\n   * @see https://github.com/guardian/amigo/tree/main/roles/cdk-base\n   */\n  enabled: boolean;\n  /**\n   * This needs to match the name of your SystemD unit.\n   *\n   * If your systemd unit is not `<app>.service` set this value.\n   *\n   * @defaultValue `<app>.service`\n   */\n  systemdUnitName?: string;\n}\n\n/**\n * @privateRemarks we should rename this to AlarmsProps.\n */\nexport interface Alarms {\n  /**\n   * Name of the target (SNS Topic) for alarm notifications.\n   */\n  snsTopicName: string;\n  /**\n   * Enable the 5xx alarm with settings.\n   */\n  http5xxAlarm: false | Http5xxAlarmProps;\n  /**\n   * Enable the unhealthy instances alarm.\n   */\n  unhealthyInstancesAlarm: boolean;\n  /**\n   * Internal flag - users of this library should ignore this setting.\n   */\n  noMonitoring?: false;\n}\n\nexport interface GuEc2AppProps extends AppIdentity {\n  /**\n   * User data for the autoscaling group.\n   */\n  userData: GuUserDataProps | string;\n  /**\n   * Network access restrictions for your load balancer.\n   *\n   * Note, this merely provides defence in depth; you should, for example, limit\n   * access to the VPN and then treat that as sufficient. Instead, use Google\n   * Auth for human access, or a suitable machine auth mechanism.\n   */\n  access: AppAccess;\n  /**\n   * The port your application runs on.\n   */\n  applicationPort: number;\n  /**\n   * Configure IAM roles for autoscaling group EC2 instances.\n   */\n  roleConfiguration?: GuInstanceRoleProps;\n  /**\n   * Enable and configure alarms.\n   */\n  monitoringConfiguration: Alarms | NoMonitoring;\n  /**\n   * EC2 instance type. Note, ensure your code is built for the same\n   * architecture family (arm64 - 'Graviton' instances - or x64).\n   */\n  instanceType: InstanceType;\n  /**\n   * Enable and configures application logs.\n   */\n  applicationLogging?: ApplicationLoggingProps;\n  /**\n   * Enable and configures access logs.\n   */\n  accessLogging?: AccessLoggingProps;\n  /**\n   * Add block devices (additional storage).\n   */\n  blockDevices?: BlockDevice[];\n  /**\n   * Autoscaling group min and max sizes.\n   */\n  scaling: GuAsgCapacity;\n  /**\n   * Specify certificate for the load balancer.\n   */\n  certificateProps?: GuDomainName;\n  /**\n   * Disable imdsv2. Most of the time you should not set this.\n   *\n   * @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html\n   */\n  withoutImdsv2?: boolean;\n  /**\n   * Configure Amigo image recipe.\n   */\n  imageRecipe?: string | AmigoProps;\n  /**\n   * Specify the VPC to use.\n   *\n   * @see https://github.com/guardian/aws-account-setup\n   */\n  vpc?: IVpc;\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  privateSubnets?: ISubnet[];\n\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  publicSubnets?: ISubnet[];\n}\n\nfunction restrictedCidrRanges(ranges: IPeer[]) {\n  return ranges.map((range) => ({\n    range,\n    port: Port.tcp(443),\n    description: `Allow access on port 443 from ${range.uniqueId}`,\n  }));\n}\n\n/**\n * Pattern which creates the resources needed to run an application on EC2\n * behind a load balancer. For convenience, you may wish to use [[`GuPlayApp`]]\n * or [[`GuNodeApp`]], which extend this class.\n *\n * See props for further details.\n */\nexport class GuEc2App extends Construct {\n  /*\n   * These are public for now, as this allows users to\n   * modify these constructs as desired to fit their\n   * specific needs.\n   * In the future, we might build functionality to better enable users\n   * to access in-pattern constructs, but this would allow teams to be unblocked\n   * in the short term.\n   * */\n  public readonly vpc: IVpc;\n  public readonly certificate?: GuCertificate;\n  public readonly loadBalancer: GuApplicationLoadBalancer;\n  public readonly autoScalingGroup: GuAutoScalingGroup;\n  public readonly listener: GuHttpsApplicationListener;\n  public readonly targetGroup: GuApplicationTargetGroup;\n\n  constructor(scope: GuStack, props: GuEc2AppProps) {\n    const {\n      access,\n      accessLogging = { enabled: false },\n      app,\n      // We should update this default once a significant number of apps have migrated to devx-logs\n      applicationLogging = { enabled: false },\n      applicationPort,\n      blockDevices,\n      certificateProps,\n      instanceType,\n      monitoringConfiguration,\n      roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n      scaling: { minimumInstances, maximumInstances = minimumInstances * 2 },\n      userData,\n      withoutImdsv2,\n      imageRecipe,\n      vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n      privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n      publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n    } = props;\n\n    super(scope, app); // The assumption is `app` is unique\n\n    // We should really prevent users from doing this via the type system,\n    // but that requires a breaking change to the API\n    if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n      throw new Error(\n        \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n          \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\"\n      );\n    }\n\n    AppAccess.validate(access);\n\n    const certificate =\n      typeof certificateProps !== \"undefined\"\n        ? new GuCertificate(scope, {\n            app,\n            domainName: certificateProps.domainName,\n            hostedZoneId: certificateProps.hostedZoneId,\n          })\n        : undefined;\n\n    const maybePrivateConfigPolicy =\n      typeof userData !== \"string\" && userData.configuration\n        ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n        : [];\n\n    const mergedRoleConfiguration: GuInstanceRoleProps = {\n      withoutLogShipping: roleConfiguration.withoutLogShipping,\n      additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n    };\n\n    const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n      app,\n      vpc,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      withoutImdsv2,\n      role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n      healthCheck: HealthCheck.elb({ grace: Duration.minutes(2) }), // should this be defaulted at pattern or construct level?\n      userData: typeof userData !== \"string\" ? new GuUserData(scope, { app, ...userData }).userData : userData,\n      vpcSubnets: { subnets: privateSubnets },\n      ...(blockDevices && { blockDevices }),\n      imageRecipe,\n    });\n\n    // This allows automatic shipping of instance Cloud Init logs when using the\n    // `cdk-base` Amigo role on your AMI.\n    Tags.of(autoScalingGroup).add(\n      MetadataKeys.LOG_KINESIS_STREAM_NAME,\n      GuLoggingStreamNameParameter.getInstance(scope).valueAsString\n    );\n\n    if (applicationLogging.enabled) {\n      // This allows automatic shipping of application logs when using the\n      // `cdk-base` Amigo role on your AMI.\n      Tags.of(autoScalingGroup).add(\n        MetadataKeys.SYSTEMD_UNIT,\n        applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`\n      );\n    }\n\n    const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n      app,\n      vpc,\n      // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n      internetFacing: access.scope !== AccessScope.INTERNAL,\n      vpcSubnets: {\n        subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n      },\n    });\n\n    if (accessLogging.enabled) {\n      const accessLoggingBucket = new GuStringParameter(scope, \"AccessLoggingBucket\", {\n        description: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.description,\n        default: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.path,\n        fromSSM: true,\n      });\n\n      loadBalancer.logAccessLogs(\n        Bucket.fromBucketName(\n          scope,\n          AppIdentity.suffixText(props, \"AccessLoggingBucket\"),\n          accessLoggingBucket.valueAsString\n        ),\n        accessLogging.prefix\n      );\n    }\n\n    const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n      app,\n      vpc,\n      protocol: ApplicationProtocol.HTTP,\n      targets: [autoScalingGroup],\n      port: applicationPort,\n    });\n\n    const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n      app,\n      loadBalancer,\n      certificate,\n      targetGroup,\n      // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n      open: access.scope === AccessScope.PUBLIC && typeof certificate !== \"undefined\",\n    });\n\n    // Since AWS won't create a security group automatically when open=false, we need to add our own\n    if (access.scope !== AccessScope.PUBLIC) {\n      loadBalancer.addSecurityGroup(\n        new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n          app,\n          vpc,\n          description: \"Allow restricted ingress from CIDR ranges\",\n          allowAllOutbound: false,\n          ingresses: restrictedCidrRanges(access.cidrRanges),\n        })\n      );\n    }\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const { http5xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n      if (http5xxAlarm) {\n        new GuAlb5xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http5xxAlarm,\n        });\n      }\n      if (unhealthyInstancesAlarm) {\n        new GuUnhealthyInstancesAlarm(scope, {\n          app,\n          targetGroup,\n          snsTopicName,\n        });\n      }\n    }\n\n    this.vpc = vpc;\n    this.certificate = certificate;\n    this.loadBalancer = loadBalancer;\n    this.autoScalingGroup = autoScalingGroup;\n    this.listener = listener;\n    this.targetGroup = targetGroup;\n  }\n}\n"]}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;AAAA,uGAAuG;AACvG,6CAA0D;AAE1D,iEAA0D;AAC1D,yDAKiC;AAEjC,iDAA2C;AAC3C,uFAA6F;AAC7F,uGAA2F;AAC3F,iDAA8D;AAC9D,uDAA+D;AAC/D,+CAA4C;AAC5C,iDAAsD;AACtD,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAAiG;AAEjG,gDAAqG;AACrG,8CAA0E;AAE1E,8CAAgF;AAChF,oDAA2D;AAC3D,kEAIwC;AACxC,uCAAwC;AAiOxC,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,aAAa,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAClC,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EACR,aAAa,EACb,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GACpF,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,WAAW;YACrC,CAAC,CAAC,IAAI,mBAAa,CAAC,KAAK,EAAE;gBACvB,GAAG;gBACH,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,YAAY,EAAE,gBAAgB,CAAC,YAAY;aAC5C,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,wBAAwB,GAC5B,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa;YACpD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,aAAa;YACb,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YACpE,WAAW,EAAE,6BAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACxG,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;SACZ,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;SACF,CAAC,CAAC;QAEH,IAAI,aAAa,CAAC,OAAO,EAAE;YACzB,MAAM,mBAAmB,GAAG,IAAI,wBAAiB,CAAC,KAAK,EAAE,qBAAqB,EAAE;gBAC9E,WAAW,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,WAAW;gBACtE,OAAO,EAAE,qCAAyB,CAAC,mBAAmB,CAAC,IAAI;gBAC3D,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,YAAY,CAAC,aAAa,CACxB,eAAM,CAAC,cAAc,CACnB,KAAK,EACL,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,qBAAqB,CAAC,EACpD,mBAAmB,CAAC,aAAa,CAClC,EACD,aAAa,CAAC,MAAM,CACrB,CAAC;SACH;QAED,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,IAAI,OAAO,WAAW,KAAK,WAAW;SAChF,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAExF,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;YAC7B,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;YAEvD,MAAM,EACJ,aAAa,GAAG,CAAC,4BAA4B,CAAC,EAC9C,6BAA6B,GAAG,GAAG,MAAM,0BAA0B,GACpE,GAAG,KAAK,CAAC,UAAU,CAAC;YAErB,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC5B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;aAC9D;YAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAAE;gBACrE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;aAClF;YAED,MAAM,oBAAoB,GAAG,yBAAe,CAAC,uBAAuB,CAClE,KAAK,EACL,mCAAmC,EACnC,qCAAyB,CAAC,oBAAoB,CAAC,IAAI,CACpD,CAAC;YAEF,sEAAsE;YACtE,4BAA4B;YAC5B,yDAAyD;YACzD,MAAM,qBAAqB,GAAG,4BAA4B,oBAAoB,CAAC,WAAW,yCAAyC,CAAC;YAEpI,8CAA8C;YAC9C,oDAAoD;YACpD,MAAM,UAAU,GAAG,IAAI,yBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE;gBAC5D,GAAG,EAAE,GAAG;gBACR,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,8BAA8B;gBACvC,OAAO,EAAE,oBAAO,CAAC,MAAM;gBACvB,QAAQ,EAAE,kCAAkC;gBAC5C,cAAc,EAAE,qCAAyB,CAAC,8BAA8B,CAAC,IAAI;gBAC7E,YAAY,EAAE,yBAAY,CAAC,MAAM;gBACjC,WAAW,EAAE;oBACX,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;oBACvC,uBAAuB,EAAE,qBAAqB;iBAC/C;aACF,CAAC,CAAC;YAEH,UAAU,CAAC,eAAe,CACxB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,KAAK;gBACpB,OAAO,EAAE,CAAC,uBAAuB,CAAC;gBAClC,SAAS,EAAE,CAAC,qBAAqB,CAAC;aACnC,CAAC,CACH,CAAC;YAEF,yEAAyE;YACzE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,IAAI,sBAAQ,CAAC,IAAI,EAAE,WAAW,EAAE;gBAC/C,cAAc,EAAE;oBACd,iBAAiB,EAAE,UAAU;oBAC7B,SAAS,EAAE,UAAU;iBACtB;aACF,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE;oBACb,wCAAwC;oBACxC,YAAY,EAAE,UAAU,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;iBAC5G;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACtG,MAAM,YAAY,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;YAE9G,MAAM,WAAW,GAAG,IAAI,4CAA8B,CAAC,KAAK,EAAE,YAAY,EAAE;gBAC1E,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;gBACrC,gBAAgB,EAAE;oBAChB,KAAK,EAAE,+BAAiB,CAAC,YAAY;oBACrC,SAAS,EAAE,+BAAiB,CAAC,iBAAiB;oBAC9C,UAAU,EAAE,+BAAiB,CAAC,kBAAkB;oBAChD,cAAc,EAAE,+BAAiB,CAAC,cAAc;oBAChD,MAAM,EAAE;wBACN,IAAI,EAAE,+BAAiB,CAAC,WAAW;qBACpC;iBACF;gBACD,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;aACvC,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;gBACtD,0BAA0B,EAAE,CAAC,4CAA8B,CAAC,MAAM,CAAC;gBACnE,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,WAAW,KAAK,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC;iBACxE;gBAED,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,mEAAmE;gBACnE,cAAc;gBACd,eAAe,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,mBAAmB,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtC,oBAAoB,EAAE,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC;YAEH,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAE/C,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE;gBAChC,MAAM,EAAE,IAAI,8DAAyB,CAAC;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,cAAc,EAAE,cAAc;oBAC9B,cAAc,EAAE,cAAc;oBAC9B,IAAI,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;oBAC3C,cAAc,EAAE,sBAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;iBACrC,CAAC;aACH,CAAC,CAAC;SACJ;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AA9SD,4BA8SC","sourcesContent":["/* eslint \"@guardian/tsdoc-required/tsdoc-required\": 2 -- to begin rolling this out for public APIs. */\nimport { Duration, SecretValue, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice } from \"aws-cdk-lib/aws-autoscaling\";\nimport { HealthCheck } from \"aws-cdk-lib/aws-autoscaling\";\nimport {\n  ProviderAttribute,\n  UserPool,\n  UserPoolClientIdentityProvider,\n  UserPoolIdentityProviderGoogle,\n} from \"aws-cdk-lib/aws-cognito\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port } from \"aws-cdk-lib/aws-ec2\";\nimport { ApplicationProtocol, ListenerAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { AuthenticateCognitoAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2-actions\";\nimport { Effect, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Architecture, Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport { GuAlb5xxPercentageAlarm, GuUnhealthyInstancesAlarm } from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuLoggingStreamNameParameter, GuStringParameter } from \"../../constructs/core\";\nimport { GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport { GuLambdaFunction } from \"../../constructs/lambda\";\nimport {\n  GuApplicationLoadBalancer,\n  GuApplicationTargetGroup,\n  GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\n\nexport interface AccessLoggingProps {\n  /**\n   * Enable (load balancer) access logs.\n   *\n   * Note, you will need to specify a region in your stack declaration to use\n   * this.\n   * See`https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html#logwbraccesswbrlogsbucket-prefix`\n   */\n  enabled: boolean;\n  /**\n   * S3 prefix for the logs.\n   *\n   * @defaultValue no prefix\n   */\n  prefix?: string;\n}\n\n/**\n * To ship your application logs to ELK automatically, you must:\n *\n * 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n *\n * Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n */\nexport interface ApplicationLoggingProps {\n  /**\n   * Enables forwarding of application logs to the Guardian ELK stack.\n   *\n   * Note, to work, you will need to also do the following non-CDK things:\n   *\n   * 1. Include the `cdk-base` Amigo role in your AMI.\n   * 2. Log to `journald`. We recommend doing this by logging to `stdout` and\n   *    using `systemd` to start your app\n   * 3. Confirm that your [[`systemdUnitName`]] is configured properly.\n   *\n   * Unless you have explicitly opted-out, appropriate IAM permissions for\n   * logging to Kinesis will be configured automatically via the [[`GuEc2App`]]\n   * pattern.\n   *\n   * @see https://github.com/guardian/amigo/tree/main/roles/cdk-base\n   */\n  enabled: boolean;\n  /**\n   * This needs to match the name of your SystemD unit.\n   *\n   * If your systemd unit is not `<app>.service` set this value.\n   *\n   * @defaultValue `<app>.service`\n   */\n  systemdUnitName?: string;\n}\n\n/**\n * @privateRemarks we should rename this to AlarmsProps.\n */\nexport interface Alarms {\n  /**\n   * Name of the target (SNS Topic) for alarm notifications.\n   */\n  snsTopicName: string;\n  /**\n   * Enable the 5xx alarm with settings.\n   */\n  http5xxAlarm: false | Http5xxAlarmProps;\n  /**\n   * Enable the unhealthy instances alarm.\n   */\n  unhealthyInstancesAlarm: boolean;\n  /**\n   * Internal flag - users of this library should ignore this setting.\n   */\n  noMonitoring?: false;\n}\n\nexport interface GuEc2AppProps extends AppIdentity {\n  /**\n   * User data for the autoscaling group.\n   */\n  userData: GuUserDataProps | string;\n  /**\n   * Network access restrictions for your load balancer.\n   *\n   * Note, this merely provides defence in depth; you should, for example, limit\n   * access to the VPN and then treat that as sufficient. Instead, use Google\n   * Auth for human access, or a suitable machine auth mechanism.\n   */\n  access: AppAccess;\n  /**\n   * The port your application runs on.\n   */\n  applicationPort: number;\n  /**\n   * Configure IAM roles for autoscaling group EC2 instances.\n   */\n  roleConfiguration?: GuInstanceRoleProps;\n  /**\n   * Enable and configure alarms.\n   */\n  monitoringConfiguration: Alarms | NoMonitoring;\n  /**\n   * EC2 instance type. Note, ensure your code is built for the same\n   * architecture family (arm64 - 'Graviton' instances - or x64).\n   */\n  instanceType: InstanceType;\n  /**\n   * Enable and configures application logs.\n   */\n  applicationLogging?: ApplicationLoggingProps;\n  /**\n   * Enable and configures access logs.\n   */\n  accessLogging?: AccessLoggingProps;\n  /**\n   * Add block devices (additional storage).\n   */\n  blockDevices?: BlockDevice[];\n  /**\n   * Autoscaling group min and max sizes.\n   */\n  scaling: GuAsgCapacity;\n  /**\n   * Specify certificate for the load balancer.\n   */\n  certificateProps?: GuDomainName;\n  /**\n   * Disable imdsv2. Most of the time you should not set this.\n   *\n   * @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html\n   */\n  withoutImdsv2?: boolean;\n  /**\n   * Configure Amigo image recipe.\n   */\n  imageRecipe?: string | AmigoProps;\n  /**\n   * Specify the VPC to use.\n   *\n   * @see https://github.com/guardian/aws-account-setup\n   */\n  vpc?: IVpc;\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  privateSubnets?: ISubnet[];\n\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  publicSubnets?: ISubnet[];\n\n  /**\n   * Configure Google Auth.\n   */\n  googleAuth?: {\n    /**\n     * Enables Google Auth (via Cognito). **Additional MANUAL steps required -\n     * see below.**\n     *\n     * Limits access to members of the allowed Google groups.\n     *\n     * Note, this does not currently support simultaneous machine access, so\n     * only set to true if you only require staff access to your service, or are\n     * supporting machine access in some other way.\n     *\n     * MANUAL STEPS: to get this to work, we need a Google Project and\n     * associated credentials. Full instructions can be found here:\n     *\n     * https://docs.google.com/document/d/1_k1FSE52AZHXufWLTiKTI3xy5cGpziyHazSHTKrYfco/edit?usp=sharing\n     *\n     * DevX hope to automate this process in the near future.\n     */\n    enabled: true;\n    /**\n     * The domain users will access your service.\n     *\n     * Set this to the same as for certificateProps.\n     */\n    domain: string;\n    /**\n     * Groups used for membership checks.\n     *\n     * If specified, cannot be empty. Users must be a member of at least one\n     * group to gain access.\n     *\n     * WARNING: groups must be specified with the `guardian.co.uk` domain, even\n     * if that is the non-idiomatic choice for daily use.\n     *\n     * @defaultValue [`engineering@guardian.co.uk`]\n     */\n    allowedGroups?: string[];\n\n    /**\n     * Secrets Manager path containing Google OAuth2 Client credentials.\n     *\n     * NOTE: you do not need to set this value, but you DO need to generate and\n     * store the associated credentials in Secrets Manager.\n     *\n     * Credentials should be stored in Secrets Manager as JSON:\n     *\n     * ```json\n     * {\n     *   \"clientId\": \"my-client-id\",\n     *   \"clientSecret\": \"my-client-secret\"\n     * }\n     * ```\n     *\n     * @see `googleAuth.enabled` for how to generate.\n     *\n     * @defaultValue /:STAGE/:stack/:app/google-auth-credentials\n     */\n    credentialsSecretsManagerPath?: string;\n  };\n}\n\nfunction restrictedCidrRanges(ranges: IPeer[]) {\n  return ranges.map((range) => ({\n    range,\n    port: Port.tcp(443),\n    description: `Allow access on port 443 from ${range.uniqueId}`,\n  }));\n}\n\n/**\n * Pattern which creates the resources needed to run an application on EC2\n * behind a load balancer. For convenience, you may wish to use [[`GuPlayApp`]]\n * or [[`GuNodeApp`]], which extend this class.\n *\n * See props for further details.\n */\nexport class GuEc2App extends Construct {\n  /*\n   * These are public for now, as this allows users to\n   * modify these constructs as desired to fit their\n   * specific needs.\n   * In the future, we might build functionality to better enable users\n   * to access in-pattern constructs, but this would allow teams to be unblocked\n   * in the short term.\n   * */\n  public readonly vpc: IVpc;\n  public readonly certificate?: GuCertificate;\n  public readonly loadBalancer: GuApplicationLoadBalancer;\n  public readonly autoScalingGroup: GuAutoScalingGroup;\n  public readonly listener: GuHttpsApplicationListener;\n  public readonly targetGroup: GuApplicationTargetGroup;\n\n  constructor(scope: GuStack, props: GuEc2AppProps) {\n    const {\n      access,\n      accessLogging = { enabled: false },\n      app,\n      // We should update this default once a significant number of apps have migrated to devx-logs\n      applicationLogging = { enabled: false },\n      applicationPort,\n      blockDevices,\n      certificateProps,\n      instanceType,\n      monitoringConfiguration,\n      roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n      scaling: { minimumInstances, maximumInstances = minimumInstances * 2 },\n      userData,\n      withoutImdsv2,\n      imageRecipe,\n      vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n      privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n      publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n    } = props;\n\n    super(scope, app); // The assumption is `app` is unique\n\n    // We should really prevent users from doing this via the type system,\n    // but that requires a breaking change to the API\n    if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n      throw new Error(\n        \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n          \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\"\n      );\n    }\n\n    AppAccess.validate(access);\n\n    const certificate =\n      typeof certificateProps !== \"undefined\"\n        ? new GuCertificate(scope, {\n            app,\n            domainName: certificateProps.domainName,\n            hostedZoneId: certificateProps.hostedZoneId,\n          })\n        : undefined;\n\n    const maybePrivateConfigPolicy =\n      typeof userData !== \"string\" && userData.configuration\n        ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n        : [];\n\n    const mergedRoleConfiguration: GuInstanceRoleProps = {\n      withoutLogShipping: roleConfiguration.withoutLogShipping,\n      additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n    };\n\n    const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n      app,\n      vpc,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      withoutImdsv2,\n      role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n      healthCheck: HealthCheck.elb({ grace: Duration.minutes(2) }), // should this be defaulted at pattern or construct level?\n      userData: typeof userData !== \"string\" ? new GuUserData(scope, { app, ...userData }).userData : userData,\n      vpcSubnets: { subnets: privateSubnets },\n      ...(blockDevices && { blockDevices }),\n      imageRecipe,\n    });\n\n    // This allows automatic shipping of instance Cloud Init logs when using the\n    // `cdk-base` Amigo role on your AMI.\n    Tags.of(autoScalingGroup).add(\n      MetadataKeys.LOG_KINESIS_STREAM_NAME,\n      GuLoggingStreamNameParameter.getInstance(scope).valueAsString\n    );\n\n    if (applicationLogging.enabled) {\n      // This allows automatic shipping of application logs when using the\n      // `cdk-base` Amigo role on your AMI.\n      Tags.of(autoScalingGroup).add(\n        MetadataKeys.SYSTEMD_UNIT,\n        applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`\n      );\n    }\n\n    const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n      app,\n      vpc,\n      // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n      internetFacing: access.scope !== AccessScope.INTERNAL,\n      vpcSubnets: {\n        subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n      },\n    });\n\n    if (accessLogging.enabled) {\n      const accessLoggingBucket = new GuStringParameter(scope, \"AccessLoggingBucket\", {\n        description: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.description,\n        default: NAMED_SSM_PARAMETER_PATHS.AccessLoggingBucket.path,\n        fromSSM: true,\n      });\n\n      loadBalancer.logAccessLogs(\n        Bucket.fromBucketName(\n          scope,\n          AppIdentity.suffixText(props, \"AccessLoggingBucket\"),\n          accessLoggingBucket.valueAsString\n        ),\n        accessLogging.prefix\n      );\n    }\n\n    const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n      app,\n      vpc,\n      protocol: ApplicationProtocol.HTTP,\n      targets: [autoScalingGroup],\n      port: applicationPort,\n    });\n\n    const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n      app,\n      loadBalancer,\n      certificate,\n      targetGroup,\n      // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n      open: access.scope === AccessScope.PUBLIC && typeof certificate !== \"undefined\",\n    });\n\n    // Since AWS won't create a security group automatically when open=false, we need to add our own\n    if (access.scope !== AccessScope.PUBLIC) {\n      loadBalancer.addSecurityGroup(\n        new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n          app,\n          vpc,\n          description: \"Allow restricted ingress from CIDR ranges\",\n          allowAllOutbound: false,\n          ingresses: restrictedCidrRanges(access.cidrRanges),\n        })\n      );\n    }\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const { http5xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n      if (http5xxAlarm) {\n        new GuAlb5xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http5xxAlarm,\n        });\n      }\n      if (unhealthyInstancesAlarm) {\n        new GuUnhealthyInstancesAlarm(scope, {\n          app,\n          targetGroup,\n          snsTopicName,\n        });\n      }\n    }\n\n    if (props.googleAuth?.enabled) {\n      const prefix = `/${scope.stage}/${scope.stack}/${app}`;\n\n      const {\n        allowedGroups = [\"engineering@guardian.co.uk\"],\n        credentialsSecretsManagerPath = `${prefix}/google-auth-credentials`,\n      } = props.googleAuth;\n\n      if (allowedGroups.length < 1) {\n        throw new Error(\"googleAuth.allowedGroups cannot be empty!\");\n      }\n\n      if (allowedGroups.find((group) => !group.endsWith(\"@guardian.co.uk\"))) {\n        throw new Error(\"googleAuth.allowedGroups must use the @guardian.co.uk domain.\");\n      }\n\n      const deployToolsAccountId = StringParameter.fromStringParameterName(\n        scope,\n        \"deploy-tools-account-id-parameter\",\n        NAMED_SSM_PARAMETER_PATHS.DeployToolsAccountId.path\n      );\n\n      // See https://github.com/guardian/cognito-auth-lambdas for the source\n      // code here. ARN format is:\n      // arn:aws:lambda:aws-region:acct-id:function:helloworld.\n      const gatekeeperFunctionArn = `arn:aws:lambda:eu-west-1:${deployToolsAccountId.stringValue}:function:deploy-PROD-gatekeeper-lambda`;\n\n      // Note, handler and filename must match here:\n      // https://github.com/guardian/cognito-auth-lambdas.\n      const authLambda = new GuLambdaFunction(scope, \"auth-lambda\", {\n        app: app,\n        memorySize: 128,\n        handler: \"devx-cognito-lambda-amd64-v1\",\n        runtime: Runtime.GO_1_X,\n        fileName: \"devx-cognito-lambda-amd64-v1.zip\",\n        bucketNamePath: NAMED_SSM_PARAMETER_PATHS.OrganisationDistributionBucket.path,\n        architecture: Architecture.X86_64,\n        environment: {\n          ALLOWED_GROUPS: allowedGroups.join(\",\"),\n          GATEKEEPER_FUNCTION_ARN: gatekeeperFunctionArn,\n        },\n      });\n\n      authLambda.addToRolePolicy(\n        new PolicyStatement({\n          effect: Effect.ALLOW,\n          actions: [\"lambda:InvokeFunction\"],\n          resources: [gatekeeperFunctionArn],\n        })\n      );\n\n      // Cognito user pool. We require both lambdas: pre-sign-up runs the first\n      // time a user attempts to authenticate (before they exist in the User\n      // Pool); pre-auth runs in subsequent authentication flows.\n      const userPool = new UserPool(this, \"user-pool\", {\n        lambdaTriggers: {\n          preAuthentication: authLambda,\n          preSignUp: authLambda,\n        },\n      });\n\n      const userPoolDomain = userPool.addDomain(\"domain\", {\n        cognitoDomain: {\n          // Must be unique (as global across AWS)\n          domainPrefix: `com-gu-${app.toLowerCase()}-${scope.stage.toLowerCase()}-${new Date().valueOf().toString()}`,\n        },\n      });\n\n      const clientId = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientId\" });\n      const clientSecret = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientSecret\" });\n\n      const userPoolIdp = new UserPoolIdentityProviderGoogle(scope, \"google-idp\", {\n        userPool: userPool,\n        clientId: clientId.toString(),\n        clientSecret: clientSecret.toString(),\n        attributeMapping: {\n          email: ProviderAttribute.GOOGLE_EMAIL,\n          givenName: ProviderAttribute.GOOGLE_GIVEN_NAME,\n          familyName: ProviderAttribute.GOOGLE_FAMILY_NAME,\n          profilePicture: ProviderAttribute.GOOGLE_PICTURE,\n          custom: {\n            name: ProviderAttribute.GOOGLE_NAME,\n          },\n        },\n        scopes: [\"openid\", \"email\", \"profile\"],\n      });\n\n      const userPoolClient = userPool.addClient(\"alb-client\", {\n        supportedIdentityProviders: [UserPoolClientIdentityProvider.GOOGLE],\n        generateSecret: true,\n        oAuth: {\n          callbackUrls: [`https://${props.googleAuth.domain}/oauth2/idpresponse`],\n        },\n\n        // Note: id and access validity token validity cannot be less than one\n        // hour (this is the cognito cookie duration). To quickly invalidate\n        // credentials, disable the user in Cognito. It might be that we want to\n        // parameterise these going forward, but that would require Infosec\n        // discussion.\n        idTokenValidity: Duration.hours(1),\n        accessTokenValidity: Duration.hours(1),\n        refreshTokenValidity: Duration.days(7),\n      });\n\n      userPoolClient.node.addDependency(userPoolIdp);\n\n      listener.addAction(\"CognitoAuth\", {\n        action: new AuthenticateCognitoAction({\n          userPool: userPool,\n          userPoolClient: userPoolClient,\n          userPoolDomain: userPoolDomain,\n          next: ListenerAction.forward([targetGroup]),\n          sessionTimeout: Duration.minutes(15),\n        }),\n      });\n    }\n\n    this.vpc = vpc;\n    this.certificate = certificate;\n    this.loadBalancer = loadBalancer;\n    this.autoScalingGroup = autoScalingGroup;\n    this.listener = listener;\n    this.targetGroup = targetGroup;\n  }\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@guardian/cdk",
   "description": "Generic Guardian flavoured AWS CDK components",
-  "version": "50.3.2",
+  "version": "50.4.0-beta.1",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [