@guardian/cdk 53.1.1 → 54.1.0

package/lib/constructs/ecs/ecs-task.d.ts

@@ -104,6 +104,16 @@ export interface GuEcsTaskProps extends AppIdentity {
      * shoud set this value to `false`.
      */
     enableDistributablePolicy?: boolean;
+    /**
+     * When this parameter is true, the container is given read-only access to its root file system.
+     * @default false
+     */
+    readonlyRootFilesystem?: boolean;
+    /**
+     * If `true`, CloudWatch Container Insights will be enabled for the cluster
+     * @default false
+     */
+    containerInsights?: boolean;
 }
 /**
  * Pattern which creates all of the resources needed for a fargate task

package/lib/constructs/ecs/ecs-task.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ecs-task.d.ts","sourceRoot":"","sources":["../../../src/constructs/ecs/ecs-task.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAShE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAgC,YAAY,EAAW,MAAM,+BAA+B,CAAC;AACpG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAEnF,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,WAAW,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,IAAI,EAAE,UAAU,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;AAE7E,MAAM,MAAM,wBAAwB,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,KAAK,CAAA;CAAE,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,GAAG,EAAE,IAAI,CAAC;IACV,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,YAAY,GAAG,wBAAwB,CAAC;IACjE,cAAc,CAAC,EAAE,cAAc,EAAE,CAAC;IAClC,kBAAkB,CAAC,EAAE,eAAe,EAAE,CAAC;IACvC,oBAAoB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AAcD;;;;;;;;;;GAUG;AACH,qBAAa,SAAU,SAAQ,SAAS;IACtC,YAAY,EAAE,YAAY,CAAC;gBAEf,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc;CAoI9D"}
+{"version":3,"file":"ecs-task.d.ts","sourceRoot":"","sources":["../../../src/constructs/ecs/ecs-task.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAShE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAgD,YAAY,EAAW,MAAM,+BAA+B,CAAC;AACpH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAEnF,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGtC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,WAAW,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,IAAI,EAAE,UAAU,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;AAE7E,MAAM,MAAM,wBAAwB,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,KAAK,CAAA;CAAE,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,GAAG,EAAE,IAAI,CAAC;IACV,sBAAsB,EAAE,sBAAsB,CAAC;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,YAAY,GAAG,wBAAwB,CAAC;IACjE,cAAc,CAAC,EAAE,cAAc,EAAE,CAAC;IAClC,kBAAkB,CAAC,EAAE,eAAe,EAAE,CAAC;IACvC,oBAAoB,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAcD;;;;;;;;;;GAUG;AACH,qBAAa,SAAU,SAAQ,SAAS;IACtC,YAAY,EAAE,YAAY,CAAC;gBAEf,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc;CAwI9D"}

package/lib/constructs/ecs/ecs-task.js

@@ -42,7 +42,7 @@ class GuEcsTask extends constructs_1.Construct {
         cpu = 2048, // 2 cores and from 4-16GB memory
         memory = 4096, // 4GB
         storage, // default is 20 GB when not provided in props
-        containerConfiguration, taskCommand, taskTimeoutInMinutes = 15, customTaskPolicies, vpc, monitoringConfiguration, securityGroups = [], environmentOverrides, enableDistributablePolicy = true, } = props;
+        containerConfiguration, taskCommand, taskTimeoutInMinutes = 15, customTaskPolicies, vpc, monitoringConfiguration, securityGroups = [], environmentOverrides, enableDistributablePolicy = true, readonlyRootFilesystem = false, containerInsights = false, } = props;
         if (storage && storage < 21) {
             throw new Error("Storage must be at least 21. See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-ephemeralstorage.html");
         }
@@ -51,6 +51,7 @@ class GuEcsTask extends constructs_1.Construct {
             clusterName: `${app}-cluster-${stage}`,
             enableFargateCapacityProviders: true,
             vpc,
+            containerInsights,
         });
         const taskDefinition = new aws_ecs_1.TaskDefinition(scope, `${id}-TaskDefinition`, {
             compatibility: aws_ecs_1.Compatibility.FARGATE,
@@ -69,6 +70,7 @@ class GuEcsTask extends constructs_1.Construct {
                 streamPrefix: app,
                 logRetention: 14,
             }),
+            readonlyRootFilesystem,
         });
         if (enableDistributablePolicy) {
             const distPolicy = new iam_1.GuGetDistributablePolicyStatement(scope, { app });
@@ -93,7 +95,7 @@ class GuEcsTask extends constructs_1.Construct {
             ],
         });
         this.stateMachine = new aws_stepfunctions_1.StateMachine(scope, `${id}-StateMachine`, {
-            definition: task,
+            definitionBody: aws_stepfunctions_1.DefinitionBody.fromChainable(task),
             stateMachineName: `${app}-${stage}`,
         });
         if (!monitoringConfiguration.noMonitoring) {

package/lib/constructs/ecs/ecs-task.js.map

@@ -1 +1 @@
-{"version":3,"file":"ecs-task.js","sourceRoot":"","sources":["../../../src/constructs/ecs/ecs-task.ts"],"names":[],"mappings":";;;AAAA,6CAAkD;AAClD,+DAAqE;AACrE,+EAA+D;AAI/D,iDAO6B;AAE7B,iDAA4C;AAC5C,qEAAoG;AAEpG,iFAAyF;AACzF,2CAAuC;AAGvC,kCAAsC;AACtC,gCAA2D;AAsG3D;;;GAGG;AACH,MAAM,YAAY,GAAG,CAAC,MAA8B,EAAE,EAAE;IACtD,IAAI,MAAM,CAAC,IAAI,IAAI,YAAY,EAAE;QAC/B,OAAO,wBAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;KAC5E;SAAM;QACL,OAAO,wBAAc,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;KACpF;AACH,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAa,SAAU,SAAQ,sBAAS;IAGtC,YAAY,KAAc,EAAE,EAAU,EAAE,KAAqB;QAC3D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,MAAM,EACJ,GAAG;QAEH,iJAAiJ;QACjJ,GAAG,GAAG,IAAI,EAAE,iCAAiC;QAC7C,MAAM,GAAG,IAAI,EAAE,MAAM;QACrB,OAAO,EAAE,8CAA8C;QACvD,sBAAsB,EACtB,WAAW,EACX,oBAAoB,GAAG,EAAE,EACzB,kBAAkB,EAClB,GAAG,EACH,uBAAuB,EACvB,cAAc,GAAG,EAAE,EACnB,oBAAoB,EACpB,yBAAyB,GAAG,IAAI,GACjC,GAAG,KAAK,CAAC;QAEV,IAAI,OAAO,IAAI,OAAO,GAAG,EAAE,EAAE;YAC3B,MAAM,IAAI,KAAK,CACb,yJAAyJ,CAC1J,CAAC;SACH;QAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAE/B,MAAM,OAAO,GAAG,IAAI,iBAAO,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE;YAClD,WAAW,EAAE,GAAG,GAAG,YAAY,KAAK,EAAE;YACtC,8BAA8B,EAAE,IAAI;YACpC,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,IAAI,wBAAc,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE;YACvE,aAAa,EAAE,uBAAa,CAAC,OAAO;YACpC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;YACnB,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE;YAC5B,MAAM,EAAE,GAAG,KAAK,IAAI,KAAK,IAAI,GAAG,EAAE;YAClC,mBAAmB,EAAE,OAAO;SAC7B,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,cAAc,CAAC,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE;YAC7E,KAAK,EAAE,YAAY,CAAC,sBAAsB,CAAC;YAC3C,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YACjD,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YACtD,GAAG;YACH,cAAc,EAAE,MAAM;YACtB,OAAO,EAAE,oBAAU,CAAC,OAAO,CAAC;gBAC1B,YAAY,EAAE,GAAG;gBACjB,YAAY,EAAE,EAAE;aACjB,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,yBAAyB,EAAE;YAC7B,MAAM,UAAU,GAAG,IAAI,uCAAiC,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACzE,cAAc,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;SAChD;QAED,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjF,MAAM,IAAI,GAAG,IAAI,oCAAU,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;YAC/C,OAAO;YACP,YAAY,EAAE,IAAI,gDAAsB,CAAC;gBACvC,eAAe,EAAE,gCAAsB,CAAC,MAAM;aAC/C,CAAC;YACF,cAAc;YACd,kBAAkB,EAAE,sCAAkB,CAAC,OAAO;YAC9C,UAAU,EAAE,4BAAQ,CAAC,OAAO;YAC5B,WAAW,EAAE,2BAAO,CAAC,QAAQ,CAAC,sBAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;YACrE,cAAc;YACd,kBAAkB,EAAE;gBAClB;oBACE,mBAAmB,EAAE,mBAAmB;oBACxC,WAAW,EAAE,oBAAoB;iBAClC;aACF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,GAAG,IAAI,gCAAY,CAAC,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE;YAChE,UAAU,EAAE,IAAI;YAChB,gBAAgB,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,UAAU,GAAG,eAAK,CAAC,YAAY,CACnC,KAAK,EACL,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,EAC3C,uBAAuB,CAAC,WAAW,CACpC,CAAC;YACF,MAAM,MAAM,GAAG;gBACb;oBACE,IAAI,EAAE,GAAG,GAAG,mBAAmB;oBAC/B,WAAW,EAAE,GAAG,GAAG,IAAI,KAAK,cAAc;oBAC1C,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;wBACrC,MAAM,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;wBACzB,SAAS,EAAE,KAAK;qBACjB,CAAC;iBACH;gBACD;oBACE,IAAI,EAAE,GAAG,GAAG,UAAU;oBACtB,WAAW,EAAE,GAAG,GAAG,IAAI,KAAK,iBAAiB;oBAC7C,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC;wBACvC,MAAM,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;wBACzB,SAAS,EAAE,KAAK;qBACjB,CAAC;iBACH;aACF,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;gBAC/C,MAAM,KAAK,GAAG,IAAI,sBAAK,CAAC,KAAK,EAAE,IAAI,EAAE;oBACnC,gBAAgB,EAAE,WAAW;oBAC7B,cAAc,EAAE,IAAI;oBACpB,MAAM,EAAE,MAAM;oBACd,kEAAkE;oBAClE,SAAS,EAAE,CAAC;oBACZ,iBAAiB,EAAE,CAAC;oBACpB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;iBACjD,CAAC,CAAC;gBACH,KAAK,CAAC,cAAc,CAAC,IAAI,kCAAS,CAAC,UAAU,CAAC,CAAC,CAAC;gBAChD,kBAAW,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;SACJ;QAED,0CAA0C;QAC1C,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAW,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAE3G,IAAI,uBAAS,CAAC,KAAK,EAAE,GAAG,EAAE,wBAAwB,EAAE;YAClD,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,eAAe;SACzC,CAAC,CAAC;IACL,CAAC;CACF;AAvID,8BAuIC","sourcesContent":["import { CfnOutput, Duration } from \"aws-cdk-lib\";\nimport { Alarm, TreatMissingData } from \"aws-cdk-lib/aws-cloudwatch\";\nimport { SnsAction } from \"aws-cdk-lib/aws-cloudwatch-actions\";\nimport type { ISecurityGroup, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport type { IRepository } from \"aws-cdk-lib/aws-ecr\";\nimport type { RepositoryImageProps } from \"aws-cdk-lib/aws-ecs\";\nimport {\n  Cluster,\n  Compatibility,\n  ContainerImage,\n  FargatePlatformVersion,\n  LogDrivers,\n  TaskDefinition,\n} from \"aws-cdk-lib/aws-ecs\";\nimport type { PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Topic } from \"aws-cdk-lib/aws-sns\";\nimport { IntegrationPattern, JsonPath, StateMachine, Timeout } from \"aws-cdk-lib/aws-stepfunctions\";\nimport type { TaskEnvironmentVariable } from \"aws-cdk-lib/aws-stepfunctions-tasks\";\nimport { EcsFargateLaunchTarget, EcsRunTask } from \"aws-cdk-lib/aws-stepfunctions-tasks\";\nimport { Construct } from \"constructs\";\nimport type { NoMonitoring } from \"../cloudwatch\";\nimport type { GuStack } from \"../core\";\nimport { AppIdentity } from \"../core\";\nimport { GuGetDistributablePolicyStatement } from \"../iam\";\n\n/**\n * Configuration to determine what container to use for the task\n * For example, to run the task in the latest node container:\n *\n * ```typescript\n * const containerConfiguration = {\n *     id: 'node:latest'\n * }\n * ```\n *\n * Alternatively you can specify a repository and version, for example for an ECR repository:\n * ```typescript\n * import { Repository } from \"aws-cdk-lib/aws-ecr\";\n * const repository = new Repository(scope, `${app}-repository`, {\n    repositoryName: app,\n  });\n * const containerConfiguration = {\n *     repository: Repository.fromRepositoryArn(\"<repository arn>\"),\n *     version: '1'\n * }\n * ```\n */\n\nexport type RepositoryContainer = {\n  repository: IRepository;\n  version: string;\n  type: \"repository\";\n};\n\nexport type RegistryContainer = {\n  id?: string;\n  imageProps?: RepositoryImageProps;\n  type: \"registry\";\n};\n\nexport type ContainerConfiguration = RepositoryContainer | RegistryContainer;\n\nexport type GuEcsTaskMonitoringProps = { snsTopicArn: string; noMonitoring: false };\n\n/**\n * Configuration options for the [[`GuEcsTask`]] pattern.\n *\n * See [[`ContainerConfiguration`]] for details of how to configure the container used to run the task.\n *\n * `taskTimeoutInMinutes` does what is says on the tin. The default timeout is 15 minutes.\n *\n * The `taskCommand` prop allows you to specify a command to run when the task starts (this can also be done via a CMD statement in\n * your Dockerfile). For example:\n *\n * const props = {\n *    //other props\n *    taskCommand: `aws s3 cp s3://${distbucket}/${stack}/${stage}/${app}/task.sh . && ./task.sh\n    }\n *\n * It is advisable to configure alarms for when the job fails/times out. To do this specify the alarmSnsTopicArn prop.\n *\n * `customTaskPolicies` allows your task to interact with other AWS services. By default a task\n * will have read access to the distribution bucket for your account.\n *\n * You can specify security groups to apply to task using the `securityGroups` prop.\n *\n * You can also set the memory and cpu units for your task. See https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#task_size\n * for further details.\n *\n * If you want to pass input from the step function into your EcsTask you can do so via the `environmentOverrides` prop, which allows you to wire up\n * step function input JSON to environment variables set on the container. For example,\n * const props = {\n *  ...otherProps\n *   environmentOverrides: [\n      {\n        name: \"VERSION\",\n        value: JsonPath.stringAt(\"$.version\"),\n      },\n    }\n * With the above override, your task will attempt to find a `version` property in the JSON input passed to the step function, and apply it to the\n * VERSION environment variable. Alternatively, you could hard code a value for the variable in CDK.\n * See https://docs.aws.amazon.com/step-functions/latest/dg/connect-ecs.html for further detail and  other override options - this construct currently\n * only supports environment variables.\n */\nexport interface GuEcsTaskProps extends AppIdentity {\n  vpc: IVpc;\n  containerConfiguration: ContainerConfiguration;\n  taskTimeoutInMinutes?: number;\n  cpu?: number;\n  memory?: number;\n  taskCommand?: string;\n  monitoringConfiguration: NoMonitoring | GuEcsTaskMonitoringProps;\n  securityGroups?: ISecurityGroup[];\n  customTaskPolicies?: PolicyStatement[];\n  environmentOverrides?: TaskEnvironmentVariable[];\n  storage?: number;\n  /**\n   * Whether to give the task IAM role access to the account's dist bucket.\n   * This is enabled by default to avoid breaking changes, but consumers of this pattern\n   * that pull a container image that doesn't need extra dependencies from S3\n   * shoud set this value to `false`.\n   */\n  enableDistributablePolicy?: boolean;\n}\n\n/**\n * Containers can be specified either via a repository and version or by container id (in which case it will\n * be fetched from docker hub).\n */\nconst getContainer = (config: ContainerConfiguration) => {\n  if (config.type == \"repository\") {\n    return ContainerImage.fromEcrRepository(config.repository, config.version);\n  } else {\n    return ContainerImage.fromRegistry(config.id ?? \"ubuntu:jammy\", config.imageProps);\n  }\n};\n\n/**\n * Pattern which creates all of the resources needed for a fargate task\n *\n * The task will be wrapped in a step function to allow for easier triggering and alarming on failure.\n *\n * For all configuration options, see [[`GuEcsTaskProps`]].\n *\n * Note that if your task reliably completes in less than 15 minutes then you should probably use a [[`GuLambda`]] instead. This\n * pattern was mainly created to work around the 15 minute lambda timeout.\n *\n */\nexport class GuEcsTask extends Construct {\n  stateMachine: StateMachine;\n\n  constructor(scope: GuStack, id: string, props: GuEcsTaskProps) {\n    super(scope, id);\n\n    const {\n      app,\n\n      // see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-taskdefinition.html#cfn-ecs-taskdefinition-cpu for details\n      cpu = 2048, // 2 cores and from 4-16GB memory\n      memory = 4096, // 4GB\n      storage, // default is 20 GB when not provided in props\n      containerConfiguration,\n      taskCommand,\n      taskTimeoutInMinutes = 15,\n      customTaskPolicies,\n      vpc,\n      monitoringConfiguration,\n      securityGroups = [],\n      environmentOverrides,\n      enableDistributablePolicy = true,\n    } = props;\n\n    if (storage && storage < 21) {\n      throw new Error(\n        \"Storage must be at least 21. See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-ephemeralstorage.html\",\n      );\n    }\n\n    const { stack, stage } = scope;\n\n    const cluster = new Cluster(scope, `${id}-Cluster`, {\n      clusterName: `${app}-cluster-${stage}`,\n      enableFargateCapacityProviders: true,\n      vpc,\n    });\n\n    const taskDefinition = new TaskDefinition(scope, `${id}-TaskDefinition`, {\n      compatibility: Compatibility.FARGATE,\n      cpu: cpu.toString(),\n      memoryMiB: memory.toString(),\n      family: `${stack}-${stage}-${app}`,\n      ephemeralStorageGiB: storage,\n    });\n\n    const containerDefinition = taskDefinition.addContainer(`${id}-TaskContainer`, {\n      image: getContainer(containerConfiguration),\n      entryPoint: taskCommand ? [\"/bin/sh\"] : undefined,\n      command: taskCommand ? [\"-c\", taskCommand] : undefined, // if unset, falls back to CMD in docker file, or no command will be run\n      cpu,\n      memoryLimitMiB: memory,\n      logging: LogDrivers.awsLogs({\n        streamPrefix: app,\n        logRetention: 14,\n      }),\n    });\n\n    if (enableDistributablePolicy) {\n      const distPolicy = new GuGetDistributablePolicyStatement(scope, { app });\n      taskDefinition.addToTaskRolePolicy(distPolicy);\n    }\n\n    (customTaskPolicies ?? []).forEach((p) => taskDefinition.addToTaskRolePolicy(p));\n\n    const task = new EcsRunTask(scope, `${id}-task`, {\n      cluster,\n      launchTarget: new EcsFargateLaunchTarget({\n        platformVersion: FargatePlatformVersion.LATEST,\n      }),\n      taskDefinition,\n      integrationPattern: IntegrationPattern.RUN_JOB,\n      resultPath: JsonPath.DISCARD,\n      taskTimeout: Timeout.duration(Duration.minutes(taskTimeoutInMinutes)),\n      securityGroups,\n      containerOverrides: [\n        {\n          containerDefinition: containerDefinition,\n          environment: environmentOverrides,\n        },\n      ],\n    });\n\n    this.stateMachine = new StateMachine(scope, `${id}-StateMachine`, {\n      definition: task,\n      stateMachineName: `${app}-${stage}`,\n    });\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const alarmTopic = Topic.fromTopicArn(\n        scope,\n        AppIdentity.suffixText(props, \"AlarmTopic\"),\n        monitoringConfiguration.snsTopicArn,\n      );\n      const alarms = [\n        {\n          name: `${app}-execution-failed`,\n          description: `${app}-${stage} job failed `,\n          metric: this.stateMachine.metricFailed({\n            period: Duration.hours(1),\n            statistic: \"sum\",\n          }),\n        },\n        {\n          name: `${app}-timeout`,\n          description: `${app}-${stage} job timed out `,\n          metric: this.stateMachine.metricTimedOut({\n            period: Duration.hours(1),\n            statistic: \"sum\",\n          }),\n        },\n      ];\n\n      alarms.forEach(({ name, description, metric }) => {\n        const alarm = new Alarm(scope, name, {\n          alarmDescription: description,\n          actionsEnabled: true,\n          metric: metric,\n          // default for comparisonOperator is GreaterThanOrEqualToThreshold\n          threshold: 1,\n          evaluationPeriods: 1,\n          treatMissingData: TreatMissingData.NOT_BREACHING,\n        });\n        alarm.addAlarmAction(new SnsAction(alarmTopic));\n        AppIdentity.taggedConstruct({ app }, alarm);\n      });\n    }\n\n    // Tag all constructs with correct app tag\n    [cluster, task, taskDefinition, this.stateMachine].forEach((c) => AppIdentity.taggedConstruct({ app }, c));\n\n    new CfnOutput(scope, `${id}-StateMachineArnOutput`, {\n      value: this.stateMachine.stateMachineArn,\n    });\n  }\n}\n"]}
+{"version":3,"file":"ecs-task.js","sourceRoot":"","sources":["../../../src/constructs/ecs/ecs-task.ts"],"names":[],"mappings":";;;AAAA,6CAAkD;AAClD,+DAAqE;AACrE,+EAA+D;AAI/D,iDAO6B;AAE7B,iDAA4C;AAC5C,qEAAoH;AAEpH,iFAAyF;AACzF,2CAAuC;AAGvC,kCAAsC;AACtC,gCAA2D;AAgH3D;;;GAGG;AACH,MAAM,YAAY,GAAG,CAAC,MAA8B,EAAE,EAAE;IACtD,IAAI,MAAM,CAAC,IAAI,IAAI,YAAY,EAAE;QAC/B,OAAO,wBAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;KAC5E;SAAM;QACL,OAAO,wBAAc,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,IAAI,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;KACpF;AACH,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAa,SAAU,SAAQ,sBAAS;IAGtC,YAAY,KAAc,EAAE,EAAU,EAAE,KAAqB;QAC3D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,MAAM,EACJ,GAAG;QAEH,iJAAiJ;QACjJ,GAAG,GAAG,IAAI,EAAE,iCAAiC;QAC7C,MAAM,GAAG,IAAI,EAAE,MAAM;QACrB,OAAO,EAAE,8CAA8C;QACvD,sBAAsB,EACtB,WAAW,EACX,oBAAoB,GAAG,EAAE,EACzB,kBAAkB,EAClB,GAAG,EACH,uBAAuB,EACvB,cAAc,GAAG,EAAE,EACnB,oBAAoB,EACpB,yBAAyB,GAAG,IAAI,EAChC,sBAAsB,GAAG,KAAK,EAC9B,iBAAiB,GAAG,KAAK,GAC1B,GAAG,KAAK,CAAC;QAEV,IAAI,OAAO,IAAI,OAAO,GAAG,EAAE,EAAE;YAC3B,MAAM,IAAI,KAAK,CACb,yJAAyJ,CAC1J,CAAC;SACH;QAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAE/B,MAAM,OAAO,GAAG,IAAI,iBAAO,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE;YAClD,WAAW,EAAE,GAAG,GAAG,YAAY,KAAK,EAAE;YACtC,8BAA8B,EAAE,IAAI;YACpC,GAAG;YACH,iBAAiB;SAClB,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,IAAI,wBAAc,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE;YACvE,aAAa,EAAE,uBAAa,CAAC,OAAO;YACpC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;YACnB,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE;YAC5B,MAAM,EAAE,GAAG,KAAK,IAAI,KAAK,IAAI,GAAG,EAAE;YAClC,mBAAmB,EAAE,OAAO;SAC7B,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,cAAc,CAAC,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE;YAC7E,KAAK,EAAE,YAAY,CAAC,sBAAsB,CAAC;YAC3C,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YACjD,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YACtD,GAAG;YACH,cAAc,EAAE,MAAM;YACtB,OAAO,EAAE,oBAAU,CAAC,OAAO,CAAC;gBAC1B,YAAY,EAAE,GAAG;gBACjB,YAAY,EAAE,EAAE;aACjB,CAAC;YACF,sBAAsB;SACvB,CAAC,CAAC;QAEH,IAAI,yBAAyB,EAAE;YAC7B,MAAM,UAAU,GAAG,IAAI,uCAAiC,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACzE,cAAc,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;SAChD;QAED,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjF,MAAM,IAAI,GAAG,IAAI,oCAAU,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;YAC/C,OAAO;YACP,YAAY,EAAE,IAAI,gDAAsB,CAAC;gBACvC,eAAe,EAAE,gCAAsB,CAAC,MAAM;aAC/C,CAAC;YACF,cAAc;YACd,kBAAkB,EAAE,sCAAkB,CAAC,OAAO;YAC9C,UAAU,EAAE,4BAAQ,CAAC,OAAO;YAC5B,WAAW,EAAE,2BAAO,CAAC,QAAQ,CAAC,sBAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;YACrE,cAAc;YACd,kBAAkB,EAAE;gBAClB;oBACE,mBAAmB,EAAE,mBAAmB;oBACxC,WAAW,EAAE,oBAAoB;iBAClC;aACF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,GAAG,IAAI,gCAAY,CAAC,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE;YAChE,cAAc,EAAE,kCAAc,CAAC,aAAa,CAAC,IAAI,CAAC;YAClD,gBAAgB,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,UAAU,GAAG,eAAK,CAAC,YAAY,CACnC,KAAK,EACL,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,EAC3C,uBAAuB,CAAC,WAAW,CACpC,CAAC;YACF,MAAM,MAAM,GAAG;gBACb;oBACE,IAAI,EAAE,GAAG,GAAG,mBAAmB;oBAC/B,WAAW,EAAE,GAAG,GAAG,IAAI,KAAK,cAAc;oBAC1C,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;wBACrC,MAAM,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;wBACzB,SAAS,EAAE,KAAK;qBACjB,CAAC;iBACH;gBACD;oBACE,IAAI,EAAE,GAAG,GAAG,UAAU;oBACtB,WAAW,EAAE,GAAG,GAAG,IAAI,KAAK,iBAAiB;oBAC7C,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC;wBACvC,MAAM,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;wBACzB,SAAS,EAAE,KAAK;qBACjB,CAAC;iBACH;aACF,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;gBAC/C,MAAM,KAAK,GAAG,IAAI,sBAAK,CAAC,KAAK,EAAE,IAAI,EAAE;oBACnC,gBAAgB,EAAE,WAAW;oBAC7B,cAAc,EAAE,IAAI;oBACpB,MAAM,EAAE,MAAM;oBACd,kEAAkE;oBAClE,SAAS,EAAE,CAAC;oBACZ,iBAAiB,EAAE,CAAC;oBACpB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;iBACjD,CAAC,CAAC;gBACH,KAAK,CAAC,cAAc,CAAC,IAAI,kCAAS,CAAC,UAAU,CAAC,CAAC,CAAC;gBAChD,kBAAW,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;SACJ;QAED,0CAA0C;QAC1C,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAW,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAE3G,IAAI,uBAAS,CAAC,KAAK,EAAE,GAAG,EAAE,wBAAwB,EAAE;YAClD,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,eAAe;SACzC,CAAC,CAAC;IACL,CAAC;CACF;AA3ID,8BA2IC","sourcesContent":["import { CfnOutput, Duration } from \"aws-cdk-lib\";\nimport { Alarm, TreatMissingData } from \"aws-cdk-lib/aws-cloudwatch\";\nimport { SnsAction } from \"aws-cdk-lib/aws-cloudwatch-actions\";\nimport type { ISecurityGroup, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport type { IRepository } from \"aws-cdk-lib/aws-ecr\";\nimport type { RepositoryImageProps } from \"aws-cdk-lib/aws-ecs\";\nimport {\n  Cluster,\n  Compatibility,\n  ContainerImage,\n  FargatePlatformVersion,\n  LogDrivers,\n  TaskDefinition,\n} from \"aws-cdk-lib/aws-ecs\";\nimport type { PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Topic } from \"aws-cdk-lib/aws-sns\";\nimport { DefinitionBody, IntegrationPattern, JsonPath, StateMachine, Timeout } from \"aws-cdk-lib/aws-stepfunctions\";\nimport type { TaskEnvironmentVariable } from \"aws-cdk-lib/aws-stepfunctions-tasks\";\nimport { EcsFargateLaunchTarget, EcsRunTask } from \"aws-cdk-lib/aws-stepfunctions-tasks\";\nimport { Construct } from \"constructs\";\nimport type { NoMonitoring } from \"../cloudwatch\";\nimport type { GuStack } from \"../core\";\nimport { AppIdentity } from \"../core\";\nimport { GuGetDistributablePolicyStatement } from \"../iam\";\n\n/**\n * Configuration to determine what container to use for the task\n * For example, to run the task in the latest node container:\n *\n * ```typescript\n * const containerConfiguration = {\n *     id: 'node:latest'\n * }\n * ```\n *\n * Alternatively you can specify a repository and version, for example for an ECR repository:\n * ```typescript\n * import { Repository } from \"aws-cdk-lib/aws-ecr\";\n * const repository = new Repository(scope, `${app}-repository`, {\n    repositoryName: app,\n  });\n * const containerConfiguration = {\n *     repository: Repository.fromRepositoryArn(\"<repository arn>\"),\n *     version: '1'\n * }\n * ```\n */\n\nexport type RepositoryContainer = {\n  repository: IRepository;\n  version: string;\n  type: \"repository\";\n};\n\nexport type RegistryContainer = {\n  id?: string;\n  imageProps?: RepositoryImageProps;\n  type: \"registry\";\n};\n\nexport type ContainerConfiguration = RepositoryContainer | RegistryContainer;\n\nexport type GuEcsTaskMonitoringProps = { snsTopicArn: string; noMonitoring: false };\n\n/**\n * Configuration options for the [[`GuEcsTask`]] pattern.\n *\n * See [[`ContainerConfiguration`]] for details of how to configure the container used to run the task.\n *\n * `taskTimeoutInMinutes` does what is says on the tin. The default timeout is 15 minutes.\n *\n * The `taskCommand` prop allows you to specify a command to run when the task starts (this can also be done via a CMD statement in\n * your Dockerfile). For example:\n *\n * const props = {\n *    //other props\n *    taskCommand: `aws s3 cp s3://${distbucket}/${stack}/${stage}/${app}/task.sh . && ./task.sh\n    }\n *\n * It is advisable to configure alarms for when the job fails/times out. To do this specify the alarmSnsTopicArn prop.\n *\n * `customTaskPolicies` allows your task to interact with other AWS services. By default a task\n * will have read access to the distribution bucket for your account.\n *\n * You can specify security groups to apply to task using the `securityGroups` prop.\n *\n * You can also set the memory and cpu units for your task. See https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#task_size\n * for further details.\n *\n * If you want to pass input from the step function into your EcsTask you can do so via the `environmentOverrides` prop, which allows you to wire up\n * step function input JSON to environment variables set on the container. For example,\n * const props = {\n *  ...otherProps\n *   environmentOverrides: [\n      {\n        name: \"VERSION\",\n        value: JsonPath.stringAt(\"$.version\"),\n      },\n    }\n * With the above override, your task will attempt to find a `version` property in the JSON input passed to the step function, and apply it to the\n * VERSION environment variable. Alternatively, you could hard code a value for the variable in CDK.\n * See https://docs.aws.amazon.com/step-functions/latest/dg/connect-ecs.html for further detail and  other override options - this construct currently\n * only supports environment variables.\n */\nexport interface GuEcsTaskProps extends AppIdentity {\n  vpc: IVpc;\n  containerConfiguration: ContainerConfiguration;\n  taskTimeoutInMinutes?: number;\n  cpu?: number;\n  memory?: number;\n  taskCommand?: string;\n  monitoringConfiguration: NoMonitoring | GuEcsTaskMonitoringProps;\n  securityGroups?: ISecurityGroup[];\n  customTaskPolicies?: PolicyStatement[];\n  environmentOverrides?: TaskEnvironmentVariable[];\n  storage?: number;\n  /**\n   * Whether to give the task IAM role access to the account's dist bucket.\n   * This is enabled by default to avoid breaking changes, but consumers of this pattern\n   * that pull a container image that doesn't need extra dependencies from S3\n   * shoud set this value to `false`.\n   */\n  enableDistributablePolicy?: boolean;\n  /**\n   * When this parameter is true, the container is given read-only access to its root file system.\n   * @default false\n   */\n  readonlyRootFilesystem?: boolean;\n  /**\n   * If `true`, CloudWatch Container Insights will be enabled for the cluster\n   * @default false\n   */\n  containerInsights?: boolean;\n}\n\n/**\n * Containers can be specified either via a repository and version or by container id (in which case it will\n * be fetched from docker hub).\n */\nconst getContainer = (config: ContainerConfiguration) => {\n  if (config.type == \"repository\") {\n    return ContainerImage.fromEcrRepository(config.repository, config.version);\n  } else {\n    return ContainerImage.fromRegistry(config.id ?? \"ubuntu:jammy\", config.imageProps);\n  }\n};\n\n/**\n * Pattern which creates all of the resources needed for a fargate task\n *\n * The task will be wrapped in a step function to allow for easier triggering and alarming on failure.\n *\n * For all configuration options, see [[`GuEcsTaskProps`]].\n *\n * Note that if your task reliably completes in less than 15 minutes then you should probably use a [[`GuLambda`]] instead. This\n * pattern was mainly created to work around the 15 minute lambda timeout.\n *\n */\nexport class GuEcsTask extends Construct {\n  stateMachine: StateMachine;\n\n  constructor(scope: GuStack, id: string, props: GuEcsTaskProps) {\n    super(scope, id);\n\n    const {\n      app,\n\n      // see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-taskdefinition.html#cfn-ecs-taskdefinition-cpu for details\n      cpu = 2048, // 2 cores and from 4-16GB memory\n      memory = 4096, // 4GB\n      storage, // default is 20 GB when not provided in props\n      containerConfiguration,\n      taskCommand,\n      taskTimeoutInMinutes = 15,\n      customTaskPolicies,\n      vpc,\n      monitoringConfiguration,\n      securityGroups = [],\n      environmentOverrides,\n      enableDistributablePolicy = true,\n      readonlyRootFilesystem = false,\n      containerInsights = false,\n    } = props;\n\n    if (storage && storage < 21) {\n      throw new Error(\n        \"Storage must be at least 21. See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ecs-taskdefinition-ephemeralstorage.html\",\n      );\n    }\n\n    const { stack, stage } = scope;\n\n    const cluster = new Cluster(scope, `${id}-Cluster`, {\n      clusterName: `${app}-cluster-${stage}`,\n      enableFargateCapacityProviders: true,\n      vpc,\n      containerInsights,\n    });\n\n    const taskDefinition = new TaskDefinition(scope, `${id}-TaskDefinition`, {\n      compatibility: Compatibility.FARGATE,\n      cpu: cpu.toString(),\n      memoryMiB: memory.toString(),\n      family: `${stack}-${stage}-${app}`,\n      ephemeralStorageGiB: storage,\n    });\n\n    const containerDefinition = taskDefinition.addContainer(`${id}-TaskContainer`, {\n      image: getContainer(containerConfiguration),\n      entryPoint: taskCommand ? [\"/bin/sh\"] : undefined,\n      command: taskCommand ? [\"-c\", taskCommand] : undefined, // if unset, falls back to CMD in docker file, or no command will be run\n      cpu,\n      memoryLimitMiB: memory,\n      logging: LogDrivers.awsLogs({\n        streamPrefix: app,\n        logRetention: 14,\n      }),\n      readonlyRootFilesystem,\n    });\n\n    if (enableDistributablePolicy) {\n      const distPolicy = new GuGetDistributablePolicyStatement(scope, { app });\n      taskDefinition.addToTaskRolePolicy(distPolicy);\n    }\n\n    (customTaskPolicies ?? []).forEach((p) => taskDefinition.addToTaskRolePolicy(p));\n\n    const task = new EcsRunTask(scope, `${id}-task`, {\n      cluster,\n      launchTarget: new EcsFargateLaunchTarget({\n        platformVersion: FargatePlatformVersion.LATEST,\n      }),\n      taskDefinition,\n      integrationPattern: IntegrationPattern.RUN_JOB,\n      resultPath: JsonPath.DISCARD,\n      taskTimeout: Timeout.duration(Duration.minutes(taskTimeoutInMinutes)),\n      securityGroups,\n      containerOverrides: [\n        {\n          containerDefinition: containerDefinition,\n          environment: environmentOverrides,\n        },\n      ],\n    });\n\n    this.stateMachine = new StateMachine(scope, `${id}-StateMachine`, {\n      definitionBody: DefinitionBody.fromChainable(task),\n      stateMachineName: `${app}-${stage}`,\n    });\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const alarmTopic = Topic.fromTopicArn(\n        scope,\n        AppIdentity.suffixText(props, \"AlarmTopic\"),\n        monitoringConfiguration.snsTopicArn,\n      );\n      const alarms = [\n        {\n          name: `${app}-execution-failed`,\n          description: `${app}-${stage} job failed `,\n          metric: this.stateMachine.metricFailed({\n            period: Duration.hours(1),\n            statistic: \"sum\",\n          }),\n        },\n        {\n          name: `${app}-timeout`,\n          description: `${app}-${stage} job timed out `,\n          metric: this.stateMachine.metricTimedOut({\n            period: Duration.hours(1),\n            statistic: \"sum\",\n          }),\n        },\n      ];\n\n      alarms.forEach(({ name, description, metric }) => {\n        const alarm = new Alarm(scope, name, {\n          alarmDescription: description,\n          actionsEnabled: true,\n          metric: metric,\n          // default for comparisonOperator is GreaterThanOrEqualToThreshold\n          threshold: 1,\n          evaluationPeriods: 1,\n          treatMissingData: TreatMissingData.NOT_BREACHING,\n        });\n        alarm.addAlarmAction(new SnsAction(alarmTopic));\n        AppIdentity.taggedConstruct({ app }, alarm);\n      });\n    }\n\n    // Tag all constructs with correct app tag\n    [cluster, task, taskDefinition, this.stateMachine].forEach((c) => AppIdentity.taggedConstruct({ app }, c));\n\n    new CfnOutput(scope, `${id}-StateMachineArnOutput`, {\n      value: this.stateMachine.stateMachineArn,\n    });\n  }\n}\n"]}

package/lib/constructs/iam/policies/ssm-ssh.d.ts

@@ -0,0 +1,19 @@
+import type { GuStack } from "../../core";
+import { GuAllowPolicy } from "./base-policy";
+/**
+ * A minimal policy enabling SSM+SSH access to EC2 instances.
+ *
+ * This is favoured over the AWS Managed Policy `AmazonSSMManagedInstanceCore`,
+ * `AmazonSSMManagedInstanceCore` provides read access to all SSM Parameters.
+ * This is not required for SSM+SSH, and given our usage of SSM Parameters for configuration, is not following least privilege.
+ * Access to SSM Parameters should be scoped to the Stack, Stage, and Application.
+ *
+ * @see https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html
+ * @see https://github.com/guardian/ssm-scala
+ */
+export declare class GuSsmSshPolicy extends GuAllowPolicy {
+    private static instance;
+    private constructor();
+    static getInstance(stack: GuStack): GuSsmSshPolicy;
+}
+//# sourceMappingURL=ssm-ssh.d.ts.map

package/lib/constructs/iam/policies/ssm-ssh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssm-ssh.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/policies/ssm-ssh.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,qBAAa,cAAe,SAAQ,aAAa;IAC/C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAA6B;IAEpD,OAAO;WAyBO,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc;CAO1D"}

package/lib/constructs/iam/policies/ssm-ssh.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuSsmSshPolicy = void 0;
+const singleton_1 = require("../../../utils/singleton");
+const base_policy_1 = require("./base-policy");
+/**
+ * A minimal policy enabling SSM+SSH access to EC2 instances.
+ *
+ * This is favoured over the AWS Managed Policy `AmazonSSMManagedInstanceCore`,
+ * `AmazonSSMManagedInstanceCore` provides read access to all SSM Parameters.
+ * This is not required for SSM+SSH, and given our usage of SSM Parameters for configuration, is not following least privilege.
+ * Access to SSM Parameters should be scoped to the Stack, Stage, and Application.
+ *
+ * @see https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html
+ * @see https://github.com/guardian/ssm-scala
+ */
+class GuSsmSshPolicy extends base_policy_1.GuAllowPolicy {
+    constructor(scope) {
+        super(scope, "SsmSshPolicy", {
+            policyName: "ssm-ssh-policy",
+            actions: [
+                "ec2messages:AcknowledgeMessage",
+                "ec2messages:DeleteMessage",
+                "ec2messages:FailMessage",
+                "ec2messages:GetEndpoint",
+                "ec2messages:GetMessages",
+                "ec2messages:SendReply",
+                "ssm:UpdateInstanceInformation",
+                "ssm:ListInstanceAssociations",
+                "ssm:DescribeInstanceProperties",
+                "ssm:DescribeDocumentParameters",
+                "ssmmessages:CreateControlChannel",
+                "ssmmessages:CreateDataChannel",
+                "ssmmessages:OpenControlChannel",
+                "ssmmessages:OpenDataChannel",
+            ],
+            // TODO can this be scoped to the stack, stage, and application? If so, it won't make sense to be a singleton.
+            resources: ["*"],
+        });
+    }
+    static getInstance(stack) {
+        if (!this.instance || !(0, singleton_1.isSingletonPresentInStack)(stack, this.instance)) {
+            this.instance = new GuSsmSshPolicy(stack);
+        }
+        return this.instance;
+    }
+}
+exports.GuSsmSshPolicy = GuSsmSshPolicy;
+//# sourceMappingURL=ssm-ssh.js.map

package/lib/constructs/iam/policies/ssm-ssh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssm-ssh.js","sourceRoot":"","sources":["../../../../src/constructs/iam/policies/ssm-ssh.ts"],"names":[],"mappings":";;;AAAA,wDAAqE;AAErE,+CAA8C;AAE9C;;;;;;;;;;GAUG;AACH,MAAa,cAAe,SAAQ,2BAAa;IAG/C,YAAoB,KAAc;QAChC,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE;YAC3B,UAAU,EAAE,gBAAgB;YAC5B,OAAO,EAAE;gBACP,gCAAgC;gBAChC,2BAA2B;gBAC3B,yBAAyB;gBACzB,yBAAyB;gBACzB,yBAAyB;gBACzB,uBAAuB;gBACvB,+BAA+B;gBAC/B,8BAA8B;gBAC9B,gCAAgC;gBAChC,gCAAgC;gBAChC,kCAAkC;gBAClC,+BAA+B;gBAC/B,gCAAgC;gBAChC,6BAA6B;aAC9B;YAED,8GAA8G;YAC9G,SAAS,EAAE,CAAC,GAAG,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,WAAW,CAAC,KAAc;QACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAA,qCAAyB,EAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACtE,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC;SAC3C;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF;AAnCD,wCAmCC","sourcesContent":["import { isSingletonPresentInStack } from \"../../../utils/singleton\";\nimport type { GuStack } from \"../../core\";\nimport { GuAllowPolicy } from \"./base-policy\";\n\n/**\n * A minimal policy enabling SSM+SSH access to EC2 instances.\n *\n * This is favoured over the AWS Managed Policy `AmazonSSMManagedInstanceCore`,\n * `AmazonSSMManagedInstanceCore` provides read access to all SSM Parameters.\n * This is not required for SSM+SSH, and given our usage of SSM Parameters for configuration, is not following least privilege.\n * Access to SSM Parameters should be scoped to the Stack, Stage, and Application.\n *\n * @see https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html\n * @see https://github.com/guardian/ssm-scala\n */\nexport class GuSsmSshPolicy extends GuAllowPolicy {\n  private static instance: GuSsmSshPolicy | undefined;\n\n  private constructor(scope: GuStack) {\n    super(scope, \"SsmSshPolicy\", {\n      policyName: \"ssm-ssh-policy\",\n      actions: [\n        \"ec2messages:AcknowledgeMessage\",\n        \"ec2messages:DeleteMessage\",\n        \"ec2messages:FailMessage\",\n        \"ec2messages:GetEndpoint\",\n        \"ec2messages:GetMessages\",\n        \"ec2messages:SendReply\",\n        \"ssm:UpdateInstanceInformation\",\n        \"ssm:ListInstanceAssociations\",\n        \"ssm:DescribeInstanceProperties\",\n        \"ssm:DescribeDocumentParameters\",\n        \"ssmmessages:CreateControlChannel\",\n        \"ssmmessages:CreateDataChannel\",\n        \"ssmmessages:OpenControlChannel\",\n        \"ssmmessages:OpenDataChannel\",\n      ],\n\n      // TODO can this be scoped to the stack, stage, and application? If so, it won't make sense to be a singleton.\n      resources: [\"*\"],\n    });\n  }\n\n  public static getInstance(stack: GuStack): GuSsmSshPolicy {\n    if (!this.instance || !isSingletonPresentInStack(stack, this.instance)) {\n      this.instance = new GuSsmSshPolicy(stack);\n    }\n\n    return this.instance;\n  }\n}\n"]}

package/lib/constructs/iam/roles/instance-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance-role.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/instance-role.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAOvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC;CACjC;AAED,MAAM,MAAM,0BAA0B,GAAG,mBAAmB,GAAG,WAAW,CAAC;;;;;;AAE3E;;;;;;;;;;;;;;GAcG;AACH,qBAAa,cAAe,SAAQ,mBAA2B;gBACjD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,0BAA0B;CAwB9D"}
+{"version":3,"file":"instance-role.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/instance-role.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAOvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC;CACjC;AAED,MAAM,MAAM,0BAA0B,GAAG,mBAAmB,GAAG,WAAW,CAAC;;;;;;AAE3E;;;;;;;;;;;;;;GAcG;AACH,qBAAa,cAAe,SAAQ,mBAA2B;gBACjD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,0BAA0B;CAsB9D"}

package/lib/constructs/iam/roles/instance-role.js

@@ -4,6 +4,7 @@ exports.GuInstanceRole = void 0;
 const aws_iam_1 = require("aws-cdk-lib/aws-iam");
 const app_aware_construct_1 = require("../../../utils/mixin/app-aware-construct");
 const policies_1 = require("../policies");
+const ssm_ssh_1 = require("../policies/ssm-ssh");
 const roles_1 = require("./roles");
 /**
  * Creates an IAM role with common policies that are needed by most Guardian applications.
@@ -28,6 +29,7 @@ class GuInstanceRole extends (0, app_aware_construct_1.GuAppAwareConstruct)(role
             ...props,
         });
         const sharedPolicies = [
+            ssm_ssh_1.GuSsmSshPolicy.getInstance(scope),
             policies_1.GuDescribeEC2Policy.getInstance(scope),
             ...(props.withoutLogShipping ? [] : [policies_1.GuLogShippingPolicy.getInstance(scope)]),
         ];
@@ -37,9 +39,7 @@ class GuInstanceRole extends (0, app_aware_construct_1.GuAppAwareConstruct)(role
             new policies_1.GuParameterStoreReadPolicy(scope, props),
             ...(props.additionalPolicies ? props.additionalPolicies : []),
         ];
-        const managedPolicies = [aws_iam_1.ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore")];
         policies.forEach((p) => p.attachToRole(this));
-        managedPolicies.forEach((p) => this.addManagedPolicy(p));
     }
 }
 exports.GuInstanceRole = GuInstanceRole;

package/lib/constructs/iam/roles/instance-role.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance-role.js","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/instance-role.ts"],"names":[],"mappings":";;;AAAA,iDAAsE;AACtE,kFAA+E;AAE/E,0CAKqB;AAErB,mCAAiC;AAgBjC;;;;;;;;;;;;;;GAcG;AACH,MAAa,cAAe,SAAQ,IAAA,yCAAmB,EAAC,cAAM,CAAC;IAC7D,YAAY,KAAc,EAAE,KAAiC;QAC3D,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE;YAC3B,IAAI,EAAE,GAAG;YACT,SAAS,EAAE,IAAI,0BAAgB,CAAC,mBAAmB,CAAC;YACpD,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG;YACrB,8BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;SAC9E,CAAC;QAEF,MAAM,QAAQ,GAAG;YACf,GAAG,cAAc;YACjB,IAAI,mCAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;YAC1C,IAAI,qCAA0B,CAAC,KAAK,EAAE,KAAK,CAAC;YAC5C,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QAEF,MAAM,eAAe,GAAG,CAAC,uBAAa,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAEjG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;CACF;AAzBD,wCAyBC","sourcesContent":["import { ManagedPolicy, ServicePrincipal } from \"aws-cdk-lib/aws-iam\";\nimport { GuAppAwareConstruct } from \"../../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../../core\";\nimport {\n  GuDescribeEC2Policy,\n  GuGetDistributablePolicy,\n  GuLogShippingPolicy,\n  GuParameterStoreReadPolicy,\n} from \"../policies\";\nimport type { GuPolicy } from \"../policies\";\nimport { GuRole } from \"./roles\";\n\nexport interface GuInstanceRoleProps {\n  /**\n   * By default, instances are given permissions to write to Kinesis. Set to\n   * 'true' to prevent this. Note, disabling will prevent not just application\n   * logs being shipped but also anything else - for example, automatic log\n   * shipping of Cloud Init and other logs by the cdk-base role in your AMI.\n   */\n  withoutLogShipping?: boolean;\n\n  additionalPolicies?: GuPolicy[];\n}\n\nexport type GuInstanceRolePropsWithApp = GuInstanceRoleProps & AppIdentity;\n\n/**\n * Creates an IAM role with common policies that are needed by most Guardian applications.\n *\n * More specifically:\n * 1. Allows for `ssh` access to an EC2 instance via [ssm-scala](https://github.com/guardian/ssm-scala) (instead of standard `ssh`).\n * 2. Allows EC2 instances to communicate with Wazuh, for security monitoring.\n * 3. Allows EC2 instances to download an artifact from AWS S3, for application deployment.\n * 4. Allows EC2 instances to download private configuration from AWS Parameter Store. See [[`GuParameterStoreReadPolicy`]]\n * for specific details.\n * 5. Allows EC2 instances to write logs into our central ELK stack via Kinesis.\n *\n * If additional IAM permissions are required, create custom policies and pass them in via the `additionalPolicies` prop.\n *\n * If log shipping is not required, opt out by setting the `withoutLogShipping` prop to `true`.\n */\nexport class GuInstanceRole extends GuAppAwareConstruct(GuRole) {\n  constructor(scope: GuStack, props: GuInstanceRolePropsWithApp) {\n    super(scope, \"InstanceRole\", {\n      path: \"/\",\n      assumedBy: new ServicePrincipal(\"ec2.amazonaws.com\"),\n      ...props,\n    });\n\n    const sharedPolicies = [\n      GuDescribeEC2Policy.getInstance(scope),\n      ...(props.withoutLogShipping ? [] : [GuLogShippingPolicy.getInstance(scope)]),\n    ];\n\n    const policies = [\n      ...sharedPolicies,\n      new GuGetDistributablePolicy(scope, props),\n      new GuParameterStoreReadPolicy(scope, props),\n      ...(props.additionalPolicies ? props.additionalPolicies : []),\n    ];\n\n    const managedPolicies = [ManagedPolicy.fromAwsManagedPolicyName(\"AmazonSSMManagedInstanceCore\")];\n\n    policies.forEach((p) => p.attachToRole(this));\n    managedPolicies.forEach((p) => this.addManagedPolicy(p));\n  }\n}\n"]}
+{"version":3,"file":"instance-role.js","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/instance-role.ts"],"names":[],"mappings":";;;AAAA,iDAAuD;AACvD,kFAA+E;AAE/E,0CAKqB;AAErB,iDAAqD;AACrD,mCAAiC;AAgBjC;;;;;;;;;;;;;;GAcG;AACH,MAAa,cAAe,SAAQ,IAAA,yCAAmB,EAAC,cAAM,CAAC;IAC7D,YAAY,KAAc,EAAE,KAAiC;QAC3D,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE;YAC3B,IAAI,EAAE,GAAG;YACT,SAAS,EAAE,IAAI,0BAAgB,CAAC,mBAAmB,CAAC;YACpD,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG;YACrB,wBAAc,CAAC,WAAW,CAAC,KAAK,CAAC;YACjC,8BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;SAC9E,CAAC;QAEF,MAAM,QAAQ,GAAG;YACf,GAAG,cAAc;YACjB,IAAI,mCAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;YAC1C,IAAI,qCAA0B,CAAC,KAAK,EAAE,KAAK,CAAC;YAC5C,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QAEF,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;CACF;AAvBD,wCAuBC","sourcesContent":["import { ServicePrincipal } from \"aws-cdk-lib/aws-iam\";\nimport { GuAppAwareConstruct } from \"../../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../../core\";\nimport {\n  GuDescribeEC2Policy,\n  GuGetDistributablePolicy,\n  GuLogShippingPolicy,\n  GuParameterStoreReadPolicy,\n} from \"../policies\";\nimport type { GuPolicy } from \"../policies\";\nimport { GuSsmSshPolicy } from \"../policies/ssm-ssh\";\nimport { GuRole } from \"./roles\";\n\nexport interface GuInstanceRoleProps {\n  /**\n   * By default, instances are given permissions to write to Kinesis. Set to\n   * 'true' to prevent this. Note, disabling will prevent not just application\n   * logs being shipped but also anything else - for example, automatic log\n   * shipping of Cloud Init and other logs by the cdk-base role in your AMI.\n   */\n  withoutLogShipping?: boolean;\n\n  additionalPolicies?: GuPolicy[];\n}\n\nexport type GuInstanceRolePropsWithApp = GuInstanceRoleProps & AppIdentity;\n\n/**\n * Creates an IAM role with common policies that are needed by most Guardian applications.\n *\n * More specifically:\n * 1. Allows for `ssh` access to an EC2 instance via [ssm-scala](https://github.com/guardian/ssm-scala) (instead of standard `ssh`).\n * 2. Allows EC2 instances to communicate with Wazuh, for security monitoring.\n * 3. Allows EC2 instances to download an artifact from AWS S3, for application deployment.\n * 4. Allows EC2 instances to download private configuration from AWS Parameter Store. See [[`GuParameterStoreReadPolicy`]]\n * for specific details.\n * 5. Allows EC2 instances to write logs into our central ELK stack via Kinesis.\n *\n * If additional IAM permissions are required, create custom policies and pass them in via the `additionalPolicies` prop.\n *\n * If log shipping is not required, opt out by setting the `withoutLogShipping` prop to `true`.\n */\nexport class GuInstanceRole extends GuAppAwareConstruct(GuRole) {\n  constructor(scope: GuStack, props: GuInstanceRolePropsWithApp) {\n    super(scope, \"InstanceRole\", {\n      path: \"/\",\n      assumedBy: new ServicePrincipal(\"ec2.amazonaws.com\"),\n      ...props,\n    });\n\n    const sharedPolicies = [\n      GuSsmSshPolicy.getInstance(scope),\n      GuDescribeEC2Policy.getInstance(scope),\n      ...(props.withoutLogShipping ? [] : [GuLogShippingPolicy.getInstance(scope)]),\n    ];\n\n    const policies = [\n      ...sharedPolicies,\n      new GuGetDistributablePolicy(scope, props),\n      new GuParameterStoreReadPolicy(scope, props),\n      ...(props.additionalPolicies ? props.additionalPolicies : []),\n    ];\n\n    policies.forEach((p) => p.attachToRole(this));\n  }\n}\n"]}