@guardian/cdk 59.5.1 → 59.5.3

package/lib/constants/metadata-keys.d.ts

@@ -4,5 +4,6 @@ export declare const MetadataKeys: {
     REPOSITORY_NAME: string;
     LOG_KINESIS_STREAM_NAME: string;
     SYSTEMD_UNIT: string;
+    BUILD_IDENTIFIER: string;
 };
 //# sourceMappingURL=metadata-keys.d.ts.map

package/lib/constants/metadata-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metadata-keys.d.ts","sourceRoot":"","sources":["../../src/constants/metadata-keys.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY;;;;;;CAMxB,CAAC"}
+{"version":3,"file":"metadata-keys.d.ts","sourceRoot":"","sources":["../../src/constants/metadata-keys.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY;;;;;;;CAOxB,CAAC"}

package/lib/constants/metadata-keys.js

@@ -7,5 +7,6 @@ exports.MetadataKeys = {
     REPOSITORY_NAME: "gu:repo",
     LOG_KINESIS_STREAM_NAME: "LogKinesisStreamName",
     SYSTEMD_UNIT: "SystemdUnit",
+    BUILD_IDENTIFIER: "gu:build-identifier",
 };
 //# sourceMappingURL=metadata-keys.js.map

package/lib/constants/metadata-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"metadata-keys.js","sourceRoot":"","sources":["../../src/constants/metadata-keys.ts"],"names":[],"mappings":";;;AAAa,QAAA,YAAY,GAAG;IAC1B,OAAO,EAAE,gBAAgB;IACzB,cAAc,EAAE,mBAAmB;IACnC,eAAe,EAAE,SAAS;IAC1B,uBAAuB,EAAE,sBAAsB;IAC/C,YAAY,EAAE,aAAa;CAC5B,CAAC","sourcesContent":["export const MetadataKeys = {\n  VERSION: \"gu:cdk:version\",\n  CONSTRUCTS_KEY: \"gu:cdk:constructs\",\n  REPOSITORY_NAME: \"gu:repo\",\n  LOG_KINESIS_STREAM_NAME: \"LogKinesisStreamName\",\n  SYSTEMD_UNIT: \"SystemdUnit\",\n};\n"]}
+{"version":3,"file":"metadata-keys.js","sourceRoot":"","sources":["../../src/constants/metadata-keys.ts"],"names":[],"mappings":";;;AAAa,QAAA,YAAY,GAAG;IAC1B,OAAO,EAAE,gBAAgB;IACzB,cAAc,EAAE,mBAAmB;IACnC,eAAe,EAAE,SAAS;IAC1B,uBAAuB,EAAE,sBAAsB;IAC/C,YAAY,EAAE,aAAa;IAC3B,gBAAgB,EAAE,qBAAqB;CACxC,CAAC","sourcesContent":["export const MetadataKeys = {\n  VERSION: \"gu:cdk:version\",\n  CONSTRUCTS_KEY: \"gu:cdk:constructs\",\n  REPOSITORY_NAME: \"gu:repo\",\n  LOG_KINESIS_STREAM_NAME: \"LogKinesisStreamName\",\n  SYSTEMD_UNIT: \"SystemdUnit\",\n  BUILD_IDENTIFIER: \"gu:build-identifier\",\n};\n"]}

package/lib/constructs/autoscaling/asg.d.ts

@@ -1,6 +1,7 @@
 import type { Duration } from "aws-cdk-lib";
 import { AutoScalingGroup } from "aws-cdk-lib/aws-autoscaling";
 import type { AutoScalingGroupProps } from "aws-cdk-lib/aws-autoscaling";
+import { LaunchTemplate } from "aws-cdk-lib/aws-ec2";
 import type { InstanceType, ISecurityGroup, UserData } from "aws-cdk-lib/aws-ec2";
 import type { ApplicationTargetGroup } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import type { GuAsgCapacity } from "../../types";
@@ -59,6 +60,7 @@ export declare class GuAutoScalingGroup extends GuAutoScalingGroup_base {
     readonly app: string;
     readonly amiParameter: GuAmiParameter;
     readonly imageRecipe?: string | AmigoProps;
+    readonly instanceLaunchTemplate: LaunchTemplate;
     constructor(scope: GuStack, id: string, props: GuAutoScalingGroupProps);
 }
 export {};

package/lib/constructs/autoscaling/asg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asg.d.ts","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAgB,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,6BAA6B,CAAC;AAE9F,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAsB,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQpD,MAAM,WAAW,uBACf,SAAQ,IAAI,CACR,qBAAqB,EACnB,SAAS,GACT,QAAQ,GACR,cAAc,GACd,UAAU,GACV,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,eAAe,GACf,eAAe,CAClB,EACD,WAAW,EACX,aAAa;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,wBAAwB,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,iCAAiC,CAAC,EAAE,OAAO,CAAC;IAC5C,qBAAqB,CAAC,EAAE,QAAQ,CAAC;CAClC;;;;;;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kBAAmB,SAAQ,uBAAqC;IAC3E,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,cAAc,CAAC;IAC7C,SAAgB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;gBAEtC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAgGvE"}
+{"version":3,"file":"asg.d.ts","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAgB,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAuB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAsB,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQpD,MAAM,WAAW,uBACf,SAAQ,IAAI,CACR,qBAAqB,EACnB,SAAS,GACT,QAAQ,GACR,cAAc,GACd,UAAU,GACV,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,eAAe,GACf,eAAe,CAClB,EACD,WAAW,EACX,aAAa;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,wBAAwB,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,iCAAiC,CAAC,EAAE,OAAO,CAAC;IAC5C,qBAAqB,CAAC,EAAE,QAAQ,CAAC;CAClC;;;;;;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kBAAmB,SAAQ,uBAAqC;IAC3E,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,cAAc,CAAC;IAC7C,SAAgB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAGlD,SAAgB,sBAAsB,EAAE,cAAc,CAAC;gBAE3C,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAiGvE"}

package/lib/constructs/autoscaling/asg.js

@@ -81,6 +81,7 @@ class GuAutoScalingGroup extends (0, app_aware_construct_1.GuAppAwareConstruct)(
         this.app = app;
         this.amiParameter = imageId;
         this.imageRecipe = imageRecipe;
+        this.instanceLaunchTemplate = launchTemplate;
         targetGroup && this.attachToApplicationTargetGroup(targetGroup);
         const cfnAsg = this.node.defaultChild;
         // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group

package/lib/constructs/autoscaling/asg.js.map

@@ -1 +1 @@
-{"version":3,"file":"asg.js","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":";;;AACA,6CAA0C;AAC1C,iEAA6E;AAE7E,iDAA0E;AAK1E,+EAA4E;AAC5E,kCAAyC;AAEzC,gCAAmE;AACnE,gCAAwC;AA4CxC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,kCAAgB,CAAC;IAK3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,MAAM,EACJ,GAAG,EACH,wBAAwB,GAAG,EAAE,EAC7B,YAAY,EACZ,OAAO,GAAG,IAAI,qBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAC5C,WAAW,EACX,YAAY,EACZ,YAAY,GAAG,CAAC,8BAAY,CAAC,GAAG,EAAE,CAAC,EACnC,gBAAgB,EAChB,gBAAgB,EAChB,IAAI,GAAG,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EACzC,WAAW,EACX,QAAQ,EACR,GAAG,EACH,aAAa,GAAG,KAAK,EACrB,uBAAuB,EACvB,YAAY,EACZ,iCAAiC,EACjC,qBAAqB,GACtB,GAAG,KAAK,CAAC;QAEV,qJAAqJ;QACrJ,IAAI,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE;YACjF,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;SACH;QAED,oCAAoC;QACpC,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,wBAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE;YACjE,YAAY;YACZ,kBAAkB,EAAE,iCAAiC;YACrD,YAAY;YACZ,YAAY,EAAE;gBACZ,QAAQ,EAAE,GAAuB,EAAE;oBACjC,OAAO;wBACL,MAAM,EAAE,6BAAmB,CAAC,KAAK;wBACjC,QAAQ;wBACR,OAAO,EAAE,OAAO,CAAC,aAAa;qBAC/B,CAAC;gBACJ,CAAC;aACF;YACD,6EAA6E;YAC7E,6CAA6C;YAC7C,aAAa,EAAE,gCAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YACrE,aAAa,EAAE,CAAC,aAAa;YAC7B,oBAAoB,EAAE,IAAI;YAC1B,QAAQ;YACR,IAAI;YACJ,uBAAuB;SACxB,CAAC,CAAC;QAEH,4DAA4D;QAC5D,kFAAkF;QAClF,8CAA8C;QAC9C,CAAC,mBAAa,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,wBAAwB,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAClF,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAChD,CAAC;QAEF,MAAM,QAAQ,GAA0B;YACtC,GAAG,KAAK;YACR,cAAc;YACd,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,GAAG,CAAC;YACrD,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,YAAY;YAE1B,iEAAiE;YACjE,yEAAyE;YACzE,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,SAAS;YACvB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,SAAS;YACnB,qBAAqB;SACtB,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAE/B,WAAW,IAAI,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;QAEhE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAmC,CAAC;QAE7D,yFAAyF;QACzF,2DAA2D;QAC3D,+FAA+F;QAC/F,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;SAC5C;QAED,kBAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;CACF;AArGD,gDAqGC","sourcesContent":["import type { Duration } from \"aws-cdk-lib\";\nimport { Tags, Token } from \"aws-cdk-lib\";\nimport { AutoScalingGroup, GroupMetrics } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { AutoScalingGroupProps, CfnAutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport { LaunchTemplate, OperatingSystemType } from \"aws-cdk-lib/aws-ec2\";\nimport type { InstanceType, ISecurityGroup, MachineImageConfig, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { ApplicationTargetGroup } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuAsgCapacity } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport { GuAmiParameter } from \"../core\";\nimport type { AppIdentity, GuStack } from \"../core\";\nimport { GuHttpsEgressSecurityGroup, GuWazuhAccess } from \"../ec2\";\nimport { GuInstanceRole } from \"../iam\";\n\n// Since we want to override the types of what gets passed in for the below props,\n// we need to use Omit<T, U> to remove them from the interface this extends\n// https://www.typescriptlang.org/docs/handbook/utility-types.html#omittype-keys\n// TODO avoid prop nesting to improve discoverability. See https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#flat.\nexport interface GuAutoScalingGroupProps\n  extends Omit<\n      AutoScalingGroupProps,\n      | \"imageId\"\n      | \"osType\"\n      | \"machineImage\"\n      | \"userData\"\n      | \"minCapacity\"\n      | \"maxCapacity\"\n      | \"desiredCapacity\"\n      | \"requireImdsv2\"\n      | \"securityGroup\"\n    >,\n    AppIdentity,\n    GuAsgCapacity {\n  /**\n   * @deprecated\n   * It shouldn't be necessary to specify a value here.\n   * GuCDK will create an AMI parameter by default. Riff-Raff can use this parameter to inject the latest AMI ID for\n   * your AMIgo recipe.\n   */\n  imageId?: GuAmiParameter;\n  /**\n   * If you are using GuCDK to generate your riff-raff.yaml file, specify AMIgo props here.\n   * If you are using a hardcoded riff-raff.yaml file (usually found in project root) then providing a value here has no\n   * effect.\n   */\n  imageRecipe?: string | AmigoProps;\n  instanceType: InstanceType;\n  userData: UserData;\n  additionalSecurityGroups?: ISecurityGroup[];\n  targetGroup?: ApplicationTargetGroup;\n  withoutImdsv2?: boolean;\n  httpPutResponseHopLimit?: number;\n  enabledDetailedInstanceMonitoring?: boolean;\n  defaultInstanceWarmup?: Duration;\n}\n\n/**\n * Construct which creates an Auto Scaling group.\n *\n * By default, all EC2 instances in this group will use [[`GuInstanceRole`]],\n * which provides common permissions (e.g. the ability to download an artifact and write logs to the account's logging Kinesis stream).\n *\n * If additional IAM permissions are required, a custom role can be provided via the `role` prop.\n * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions\n * to be passed in.\n *\n * All EC2 instances in this group will be automatically associated with two security groups:\n * 1. [[`GuHttpsEgressSecurityGroup`]], which allows outbound traffic over HTTPS.\n * 2. [[`GuWazuhAccess`]], which allows instances to communicate with Wazuh (for security monitoring).\n *\n * If additional ingress or egress rules are required, define custom security groups and pass them in via the\n * `additionalSecurityGroups` prop.\n *\n * All EC2 instances provisioned via this construct will use\n * [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html).\n */\nexport class GuAutoScalingGroup extends GuAppAwareConstruct(AutoScalingGroup) {\n  public readonly app: string;\n  public readonly amiParameter: GuAmiParameter;\n  public readonly imageRecipe?: string | AmigoProps;\n\n  constructor(scope: GuStack, id: string, props: GuAutoScalingGroupProps) {\n    const {\n      app,\n      additionalSecurityGroups = [],\n      blockDevices,\n      imageId = new GuAmiParameter(scope, { app }),\n      imageRecipe,\n      instanceType,\n      groupMetrics = [GroupMetrics.all()],\n      minimumInstances,\n      maximumInstances,\n      role = new GuInstanceRole(scope, { app }),\n      targetGroup,\n      userData,\n      vpc,\n      withoutImdsv2 = false,\n      httpPutResponseHopLimit,\n      updatePolicy,\n      enabledDetailedInstanceMonitoring,\n      defaultInstanceWarmup,\n    } = props;\n\n    // Ensure min and max are defined in the same way. Throwing an `Error` when necessary. For example when min is defined via a Mapping, but max is not.\n    if (Token.isUnresolved(minimumInstances) && !Token.isUnresolved(maximumInstances)) {\n      throw new Error(\n        \"minimumInstances is defined via a Mapping, but maximumInstances is not. Create maximumInstances via a Mapping too.\",\n      );\n    }\n\n    // Generate an ID unique to this app\n    const launchTemplateId = `${scope.stack}-${scope.stage}-${app}`;\n    const launchTemplate = new LaunchTemplate(scope, launchTemplateId, {\n      blockDevices,\n      detailedMonitoring: enabledDetailedInstanceMonitoring,\n      instanceType,\n      machineImage: {\n        getImage: (): MachineImageConfig => {\n          return {\n            osType: OperatingSystemType.LINUX,\n            userData,\n            imageId: imageId.valueAsString,\n          };\n        },\n      },\n      // Do not use the default AWS security group which allows egress on any port.\n      // Favour HTTPS only egress rules by default.\n      securityGroup: GuHttpsEgressSecurityGroup.forVpc(scope, { app, vpc }),\n      requireImdsv2: !withoutImdsv2,\n      instanceMetadataTags: true,\n      userData,\n      role,\n      httpPutResponseHopLimit,\n    });\n\n    // Add Wazuh & additional consumer specified Security Groups\n    // Note: Launch templates via CDK allow specifying only one SG, so use connections\n    // https://github.com/aws/aws-cdk/issues/18712\n    [GuWazuhAccess.getInstance(scope, vpc), ...additionalSecurityGroups].forEach((sg) =>\n      launchTemplate.connections.addSecurityGroup(sg),\n    );\n\n    const asgProps: AutoScalingGroupProps = {\n      ...props,\n      launchTemplate,\n      maxCapacity: maximumInstances ?? minimumInstances * 2,\n      minCapacity: minimumInstances,\n      groupMetrics: groupMetrics,\n\n      // Omit userData, instanceType, blockDevices & role from asgProps\n      // As this are specified by the LaunchTemplate and must not be duplicated\n      blockDevices: undefined,\n      instanceType: undefined,\n      role: undefined,\n      userData: undefined,\n      defaultInstanceWarmup,\n    };\n\n    super(scope, id, asgProps);\n\n    this.app = app;\n    this.amiParameter = imageId;\n    this.imageRecipe = imageRecipe;\n\n    targetGroup && this.attachToApplicationTargetGroup(targetGroup);\n\n    const cfnAsg = this.node.defaultChild as CfnAutoScalingGroup;\n\n    // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group\n    // leaves it to the default value, which is actually false.\n    // { UpdatePolicy: { autoScalingScheduledAction: { IgnoreUnmodifiedGroupSizeProperties: true }}\n    if (!updatePolicy) {\n      cfnAsg.addDeletionOverride(\"UpdatePolicy\");\n    }\n\n    Tags.of(launchTemplate).add(\"App\", app);\n  }\n}\n"]}
+{"version":3,"file":"asg.js","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":";;;AACA,6CAA0C;AAC1C,iEAA6E;AAE7E,iDAA0E;AAK1E,+EAA4E;AAC5E,kCAAyC;AAEzC,gCAAmE;AACnE,gCAAwC;AA4CxC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,kCAAgB,CAAC;IAQ3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,MAAM,EACJ,GAAG,EACH,wBAAwB,GAAG,EAAE,EAC7B,YAAY,EACZ,OAAO,GAAG,IAAI,qBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAC5C,WAAW,EACX,YAAY,EACZ,YAAY,GAAG,CAAC,8BAAY,CAAC,GAAG,EAAE,CAAC,EACnC,gBAAgB,EAChB,gBAAgB,EAChB,IAAI,GAAG,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EACzC,WAAW,EACX,QAAQ,EACR,GAAG,EACH,aAAa,GAAG,KAAK,EACrB,uBAAuB,EACvB,YAAY,EACZ,iCAAiC,EACjC,qBAAqB,GACtB,GAAG,KAAK,CAAC;QAEV,qJAAqJ;QACrJ,IAAI,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE;YACjF,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;SACH;QAED,oCAAoC;QACpC,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,wBAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE;YACjE,YAAY;YACZ,kBAAkB,EAAE,iCAAiC;YACrD,YAAY;YACZ,YAAY,EAAE;gBACZ,QAAQ,EAAE,GAAuB,EAAE;oBACjC,OAAO;wBACL,MAAM,EAAE,6BAAmB,CAAC,KAAK;wBACjC,QAAQ;wBACR,OAAO,EAAE,OAAO,CAAC,aAAa;qBAC/B,CAAC;gBACJ,CAAC;aACF;YACD,6EAA6E;YAC7E,6CAA6C;YAC7C,aAAa,EAAE,gCAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YACrE,aAAa,EAAE,CAAC,aAAa;YAC7B,oBAAoB,EAAE,IAAI;YAC1B,QAAQ;YACR,IAAI;YACJ,uBAAuB;SACxB,CAAC,CAAC;QAEH,4DAA4D;QAC5D,kFAAkF;QAClF,8CAA8C;QAC9C,CAAC,mBAAa,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,wBAAwB,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAClF,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAChD,CAAC;QAEF,MAAM,QAAQ,GAA0B;YACtC,GAAG,KAAK;YACR,cAAc;YACd,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,GAAG,CAAC;YACrD,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,YAAY;YAE1B,iEAAiE;YACjE,yEAAyE;YACzE,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,SAAS;YACvB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,SAAS;YACnB,qBAAqB;SACtB,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,sBAAsB,GAAG,cAAc,CAAC;QAE7C,WAAW,IAAI,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;QAEhE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAmC,CAAC;QAE7D,yFAAyF;QACzF,2DAA2D;QAC3D,+FAA+F;QAC/F,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;SAC5C;QAED,kBAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;CACF;AAzGD,gDAyGC","sourcesContent":["import type { Duration } from \"aws-cdk-lib\";\nimport { Tags, Token } from \"aws-cdk-lib\";\nimport { AutoScalingGroup, GroupMetrics } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { AutoScalingGroupProps, CfnAutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport { LaunchTemplate, OperatingSystemType } from \"aws-cdk-lib/aws-ec2\";\nimport type { InstanceType, ISecurityGroup, MachineImageConfig, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { ApplicationTargetGroup } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuAsgCapacity } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport { GuAmiParameter } from \"../core\";\nimport type { AppIdentity, GuStack } from \"../core\";\nimport { GuHttpsEgressSecurityGroup, GuWazuhAccess } from \"../ec2\";\nimport { GuInstanceRole } from \"../iam\";\n\n// Since we want to override the types of what gets passed in for the below props,\n// we need to use Omit<T, U> to remove them from the interface this extends\n// https://www.typescriptlang.org/docs/handbook/utility-types.html#omittype-keys\n// TODO avoid prop nesting to improve discoverability. See https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#flat.\nexport interface GuAutoScalingGroupProps\n  extends Omit<\n      AutoScalingGroupProps,\n      | \"imageId\"\n      | \"osType\"\n      | \"machineImage\"\n      | \"userData\"\n      | \"minCapacity\"\n      | \"maxCapacity\"\n      | \"desiredCapacity\"\n      | \"requireImdsv2\"\n      | \"securityGroup\"\n    >,\n    AppIdentity,\n    GuAsgCapacity {\n  /**\n   * @deprecated\n   * It shouldn't be necessary to specify a value here.\n   * GuCDK will create an AMI parameter by default. Riff-Raff can use this parameter to inject the latest AMI ID for\n   * your AMIgo recipe.\n   */\n  imageId?: GuAmiParameter;\n  /**\n   * If you are using GuCDK to generate your riff-raff.yaml file, specify AMIgo props here.\n   * If you are using a hardcoded riff-raff.yaml file (usually found in project root) then providing a value here has no\n   * effect.\n   */\n  imageRecipe?: string | AmigoProps;\n  instanceType: InstanceType;\n  userData: UserData;\n  additionalSecurityGroups?: ISecurityGroup[];\n  targetGroup?: ApplicationTargetGroup;\n  withoutImdsv2?: boolean;\n  httpPutResponseHopLimit?: number;\n  enabledDetailedInstanceMonitoring?: boolean;\n  defaultInstanceWarmup?: Duration;\n}\n\n/**\n * Construct which creates an Auto Scaling group.\n *\n * By default, all EC2 instances in this group will use [[`GuInstanceRole`]],\n * which provides common permissions (e.g. the ability to download an artifact and write logs to the account's logging Kinesis stream).\n *\n * If additional IAM permissions are required, a custom role can be provided via the `role` prop.\n * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions\n * to be passed in.\n *\n * All EC2 instances in this group will be automatically associated with two security groups:\n * 1. [[`GuHttpsEgressSecurityGroup`]], which allows outbound traffic over HTTPS.\n * 2. [[`GuWazuhAccess`]], which allows instances to communicate with Wazuh (for security monitoring).\n *\n * If additional ingress or egress rules are required, define custom security groups and pass them in via the\n * `additionalSecurityGroups` prop.\n *\n * All EC2 instances provisioned via this construct will use\n * [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html).\n */\nexport class GuAutoScalingGroup extends GuAppAwareConstruct(AutoScalingGroup) {\n  public readonly app: string;\n  public readonly amiParameter: GuAmiParameter;\n  public readonly imageRecipe?: string | AmigoProps;\n\n  // Sadly this cannot be named `launchTemplate` as it would clash with a private property on the `AutoScalingGroup` class\n  public readonly instanceLaunchTemplate: LaunchTemplate;\n\n  constructor(scope: GuStack, id: string, props: GuAutoScalingGroupProps) {\n    const {\n      app,\n      additionalSecurityGroups = [],\n      blockDevices,\n      imageId = new GuAmiParameter(scope, { app }),\n      imageRecipe,\n      instanceType,\n      groupMetrics = [GroupMetrics.all()],\n      minimumInstances,\n      maximumInstances,\n      role = new GuInstanceRole(scope, { app }),\n      targetGroup,\n      userData,\n      vpc,\n      withoutImdsv2 = false,\n      httpPutResponseHopLimit,\n      updatePolicy,\n      enabledDetailedInstanceMonitoring,\n      defaultInstanceWarmup,\n    } = props;\n\n    // Ensure min and max are defined in the same way. Throwing an `Error` when necessary. For example when min is defined via a Mapping, but max is not.\n    if (Token.isUnresolved(minimumInstances) && !Token.isUnresolved(maximumInstances)) {\n      throw new Error(\n        \"minimumInstances is defined via a Mapping, but maximumInstances is not. Create maximumInstances via a Mapping too.\",\n      );\n    }\n\n    // Generate an ID unique to this app\n    const launchTemplateId = `${scope.stack}-${scope.stage}-${app}`;\n    const launchTemplate = new LaunchTemplate(scope, launchTemplateId, {\n      blockDevices,\n      detailedMonitoring: enabledDetailedInstanceMonitoring,\n      instanceType,\n      machineImage: {\n        getImage: (): MachineImageConfig => {\n          return {\n            osType: OperatingSystemType.LINUX,\n            userData,\n            imageId: imageId.valueAsString,\n          };\n        },\n      },\n      // Do not use the default AWS security group which allows egress on any port.\n      // Favour HTTPS only egress rules by default.\n      securityGroup: GuHttpsEgressSecurityGroup.forVpc(scope, { app, vpc }),\n      requireImdsv2: !withoutImdsv2,\n      instanceMetadataTags: true,\n      userData,\n      role,\n      httpPutResponseHopLimit,\n    });\n\n    // Add Wazuh & additional consumer specified Security Groups\n    // Note: Launch templates via CDK allow specifying only one SG, so use connections\n    // https://github.com/aws/aws-cdk/issues/18712\n    [GuWazuhAccess.getInstance(scope, vpc), ...additionalSecurityGroups].forEach((sg) =>\n      launchTemplate.connections.addSecurityGroup(sg),\n    );\n\n    const asgProps: AutoScalingGroupProps = {\n      ...props,\n      launchTemplate,\n      maxCapacity: maximumInstances ?? minimumInstances * 2,\n      minCapacity: minimumInstances,\n      groupMetrics: groupMetrics,\n\n      // Omit userData, instanceType, blockDevices & role from asgProps\n      // As this are specified by the LaunchTemplate and must not be duplicated\n      blockDevices: undefined,\n      instanceType: undefined,\n      role: undefined,\n      userData: undefined,\n      defaultInstanceWarmup,\n    };\n\n    super(scope, id, asgProps);\n\n    this.app = app;\n    this.amiParameter = imageId;\n    this.imageRecipe = imageRecipe;\n    this.instanceLaunchTemplate = launchTemplate;\n\n    targetGroup && this.attachToApplicationTargetGroup(targetGroup);\n\n    const cfnAsg = this.node.defaultChild as CfnAutoScalingGroup;\n\n    // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group\n    // leaves it to the default value, which is actually false.\n    // { UpdatePolicy: { autoScalingScheduledAction: { IgnoreUnmodifiedGroupSizeProperties: true }}\n    if (!updatePolicy) {\n      cfnAsg.addDeletionOverride(\"UpdatePolicy\");\n    }\n\n    Tags.of(launchTemplate).add(\"App\", app);\n  }\n}\n"]}

package/lib/experimental/patterns/ec2-app.d.ts

@@ -14,6 +14,14 @@ interface AutoScalingRollingUpdateDurations {
 }
 export declare const RollingUpdateDurations: AutoScalingRollingUpdateDurations;
 export interface GuEc2AppExperimentalProps extends Omit<GuEc2AppProps, "updatePolicy"> {
+    /**
+     * Which application build to run.
+     * This will typically match the build number provided by CI.
+     *
+     * @example
+     * process.env.GITHUB_RUN_NUMBER
+     */
+    buildIdentifier: string;
 }
 /**
  * An experimental pattern to instantiate an EC2 application that is updated entirely via CloudFormation.

package/lib/experimental/patterns/ec2-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ec2-app.d.ts","sourceRoot":"","sources":["../../../src/experimental/patterns/ec2-app.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,QAAQ,EAAE,MAAM,aAAa,CAAC;AAK9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,UAAU,iCAAiC;IACzC;;OAEG;IACH,KAAK,EAAE,QAAQ,CAAC;IAEhB;;OAEG;IACH,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,eAAO,MAAM,sBAAsB,EAAE,iCAGpC,CAAC;AAiNF,MAAM,WAAW,yBAA0B,SAAQ,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC;CAAG;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ;gBACpC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,yBAAyB;CAoF7D"}
+{"version":3,"file":"ec2-app.d.ts","sourceRoot":"","sources":["../../../src/experimental/patterns/ec2-app.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,QAAQ,EAAQ,MAAM,aAAa,CAAC;AAOpE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,UAAU,iCAAiC;IACzC;;OAEG;IACH,KAAK,EAAE,QAAQ,CAAC;IAEhB;;OAEG;IACH,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,eAAO,MAAM,sBAAsB,EAAE,iCAGpC,CAAC;AAiNF,MAAM,WAAW,yBAA0B,SAAQ,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC;IACpF;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ;gBACpC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,yBAAyB;CA+F7D"}

package/lib/experimental/patterns/ec2-app.js

@@ -4,6 +4,7 @@ exports.GuEc2AppExperimental = exports.RollingUpdateDurations = void 0;
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const aws_autoscaling_1 = require("aws-cdk-lib/aws-autoscaling");
 const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const constants_1 = require("../../constants");
 const autoscaling_1 = require("../../constructs/autoscaling");
 const patterns_1 = require("../../patterns");
 const singleton_1 = require("../../utils/singleton");
@@ -217,7 +218,7 @@ class AsgRollingUpdatePolicy extends aws_iam_1.Policy {
 class GuEc2AppExperimental extends patterns_1.GuEc2App {
     constructor(scope, props) {
         const { minimumInstances, maximumInstances = minimumInstances * 2 } = props.scaling;
-        const { applicationPort } = props;
+        const { applicationPort, buildIdentifier } = props;
         const { region, stackId } = scope;
         super(scope, {
             ...props,
@@ -247,7 +248,12 @@ class GuEc2AppExperimental extends patterns_1.GuEc2App {
                 count: minimumInstances,
             },
         };
-        AsgRollingUpdatePolicy.getInstance(scope).attachToRole(role);
+        const policy = AsgRollingUpdatePolicy.getInstance(scope);
+        policy.attachToRole(role);
+        // Create the Policy with necessary permissions first.
+        // Then create the ASG that requires the permissions.
+        const cfnPolicy = policy.node.defaultChild;
+        cfnAutoScalingGroup.addDependency(cfnPolicy);
         /*
         `aws` is available via AMIgo baked AMIs.
         See https://github.com/guardian/amigo/tree/main/roles/aws-tools.
@@ -263,7 +269,7 @@ class GuEc2AppExperimental extends patterns_1.GuEc2App {
         --query "TargetHealthDescriptions[0].TargetHealth.State")
 
       until [ "$STATE" == "\\"healthy\\"" ]; do
-        echo "Instance not yet healthy within target group. Current state $STATE. Sleeping..."
+        echo "Instance running build ${buildIdentifier} not yet healthy within target group. Current state $STATE. Sleeping..."
         sleep ${exports.RollingUpdateDurations.sleep.toSeconds()}
         STATE=$(aws elbv2 describe-target-health \
           --target-group-arn ${targetGroup.targetGroupArn} \
@@ -272,7 +278,7 @@ class GuEc2AppExperimental extends patterns_1.GuEc2App {
           --query "TargetHealthDescriptions[0].TargetHealth.State")
       done
 
-      echo "Instance is healthy in target group."
+      echo "Instance running build ${buildIdentifier} is healthy in target group."
       `, `# ${GuEc2AppExperimental.name} UserData End`);
         userData.addOnExitCommands(`
         cfn-signal --stack ${stackId} \
@@ -280,6 +286,10 @@ class GuEc2AppExperimental extends patterns_1.GuEc2App {
           --region ${region} \
           --exit-code $exitCode || echo 'Failed to send Cloudformation Signal'
         `);
+        // If https://github.com/guardian/devx-logs is used, this tag will be added as a marker to logs in Central ELK.
+        aws_cdk_lib_1.Tags.of(autoScalingGroup.instanceLaunchTemplate).add(constants_1.MetadataKeys.BUILD_IDENTIFIER, buildIdentifier, {
+            applyToLaunchedInstances: true,
+        });
         // TODO Once out of experimental, instantiate these `Aspect`s directly in `GuStack`.
         aws_cdk_lib_1.Aspects.of(scope).add(AutoScalingRollingUpdateTimeout.getInstance(scope));
         aws_cdk_lib_1.Aspects.of(scope).add(HorizontallyScalingDeploymentProperties.getInstance(scope));

package/lib/experimental/patterns/ec2-app.js.map

@@ -1 +1 @@
-{"version":3,"file":"ec2-app.js","sourceRoot":"","sources":["../../../src/experimental/patterns/ec2-app.ts"],"names":[],"mappings":";;;AACA,6CAA8D;AAC9D,iEAAkH;AAClH,iDAAsE;AAEtE,8DAAkE;AAGlE,6CAA0C;AAC1C,qDAAkE;AAcrD,QAAA,sBAAsB,GAAsC;IACvE,KAAK,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;CAC5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,+BAA+B;IAInC,YAAoB,KAAc;QAChC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAEM,MAAM,CAAC,WAAW,CAAC,KAAc;QACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAA,qCAAyB,EAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACtE,IAAI,CAAC,QAAQ,GAAG,IAAI,+BAA+B,CAAC,KAAK,CAAC,CAAC;SAC5D;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,SAAqB;QAChC,IAAI,SAAS,YAAY,qCAAmB,EAAE;YAC5C,MAAM,oBAAoB,GAAG,SAAS,CAAC,UAAU,CAAC,YAAY,EAAE,wBAAwB,CAAC;YACzF,MAAM,qBAAqB,GAAG,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC;YAElE,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE;gBACrC,MAAM,IAAI,KAAK,CAAC,8DAA8D,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;aACrG;YAED,MAAM,oBAAoB,GAAG,SAAS,CAAC,sBAAsB,GAAG,8BAAsB,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAE1G,IAAI,oBAAoB,EAAE;gBACxB,SAAS,CAAC,UAAU,CAAC,YAAY,GAAG;oBAClC,wBAAwB,EAAE;wBACxB,GAAG,oBAAoB;wBACvB,SAAS,EAAE,sBAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE;qBAChE;iBACF,CAAC;aACH;YAED,IAAI,qBAAqB,EAAE;gBACzB,SAAS,CAAC,UAAU,CAAC,cAAc,GAAG;oBACpC,GAAG,qBAAqB;oBACxB,cAAc,EAAE;wBACd,GAAG,qBAAqB,CAAC,cAAc;wBACvC,OAAO,EAAE,sBAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE;qBAC9D;iBACF,CAAC;aACH;SACF;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,uCAAuC;IAK3C,YAAoB,KAAc;QAChC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,EAAE,CAAC;IACjC,CAAC;IAEM,MAAM,CAAC,WAAW,CAAC,KAAc;QACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAA,qCAAyB,EAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACtE,IAAI,CAAC,QAAQ,GAAG,IAAI,uCAAuC,CAAC,KAAK,CAAC,CAAC;SACpE;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,SAAqB;QAChC,IAAI,SAAS,YAAY,kCAAgB,EAAE;YACzC,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;YAC3B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;YAE9B;;;;;;;;;;;;;eAaG;YACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAA2B,EAAE,CAAC,CAAC,YAAY,gCAAkB,CAAC,CAAC;YAEtG,IAAI,CAAC,gBAAgB,EAAE;gBACrB,MAAM,IAAI,KAAK,CACb,iFAAiF,IAAI,wDAAwD,CAC9I,CAAC;aACH;YAED,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAmC,CAAC;YACtF,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,YAAY,EAAE,wBAAwB,CAAC;YAEnG,IAAI,oBAAoB,EAAE;gBACxB;;;;mBAIG;gBACH,mBAAmB,CAAC,eAAe,GAAG,SAAS,CAAC;gBAEhD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAE3C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;oBACtC,IAAI,CAAC,aAAa,CAAC,GAAG,CACpB,SAAS,EACT,IAAI,0BAAY,CAAC,IAAI,CAAC,KAAK,EAAE,2BAA2B,gBAAgB,CAAC,GAAG,EAAE,EAAE;wBAC9E,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC;wBAC9C,QAAQ,EAAE,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC;qBACpD,CAAC,CACH,CAAC;iBACH;gBAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;gBAEjE,mBAAmB,CAAC,UAAU,CAAC,YAAY,GAAG;oBAC5C,wBAAwB,EAAE;wBACxB,GAAG,oBAAoB;wBACvB,qBAAqB,EAAE,qBAAqB,CAAC,aAAa;qBAC3D;iBACF,CAAC;aACH;SACF;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,sBAAuB,SAAQ,gBAAM;IAGzC,YAAoB,KAAc;QAChC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAE1B,KAAK,CAAC,KAAK,EAAE,wBAAwB,EAAE;YACrC,UAAU,EAAE;gBACV,uCAAuC;gBACvC,IAAI,yBAAe,CAAC;oBAClB,OAAO,EAAE,CAAC,+BAA+B,CAAC;oBAC1C,MAAM,EAAE,gBAAM,CAAC,KAAK;oBACpB,SAAS,EAAE,CAAC,OAAO,CAAC;iBACrB,CAAC;gBAEF;;;;mBAIG;gBACH,IAAI,yBAAe,CAAC;oBAClB,OAAO,EAAE,CAAC,2CAA2C,CAAC;oBACtD,MAAM,EAAE,gBAAM,CAAC,KAAK;oBACpB,SAAS,EAAE,CAAC,GAAG,CAAC;iBACjB,CAAC;aACH;SACF,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,WAAW,CAAC,KAAc;QACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAA,qCAAyB,EAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACtE,IAAI,CAAC,QAAQ,GAAG,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;SACnD;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAa,oBAAqB,SAAQ,mBAAQ;IAChD,YAAY,KAAc,EAAE,KAAgC;QAC1D,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;QACpF,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;QAClC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAElC,KAAK,CAAC,KAAK,EAAE;YACX,GAAG,KAAK;YACR,YAAY,EAAE,8BAAY,CAAC,aAAa,CAAC;gBACvC,YAAY,EAAE,gBAAgB;gBAC9B,qBAAqB,EAAE,gBAAgB;gBACvC,oBAAoB,EAAE,GAAG;gBACzB,qBAAqB,EAAE,IAAI;gBAE3B;;;;;mBAKG;gBACH,gBAAgB,EAAE,CAAC,gCAAc,CAAC,kBAAkB,CAAC;aACtD,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC;QAC5C,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAmC,CAAC;QAEtF,mBAAmB,CAAC,eAAe,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QAElE,mBAAmB,CAAC,UAAU,CAAC,cAAc,GAAG;YAC9C,yBAAyB,EAAE;gBACzB,6BAA6B,EAAE,GAAG;aACnC;YACD,cAAc,EAAE;gBACd,KAAK,EAAE,gBAAgB;aACxB;SACF,CAAC;QAEF,sBAAsB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAE7D;;;WAGG;QACH,QAAQ,CAAC,WAAW,CAClB,KAAK,oBAAoB,CAAC,IAAI,iBAAiB,EAC/C;;;;;6BAKuB,WAAW,CAAC,cAAc;mBACpC,MAAM;yCACgB,eAAe;;;;;gBAKxC,8BAAsB,CAAC,KAAK,CAAC,SAAS,EAAE;;+BAEzB,WAAW,CAAC,cAAc;qBACpC,MAAM;2CACgB,eAAe;;;;;OAKnD,EACD,KAAK,oBAAoB,CAAC,IAAI,eAAe,CAC9C,CAAC;QAEF,QAAQ,CAAC,iBAAiB,CACxB;6BACuB,OAAO;uBACb,mBAAmB,CAAC,SAAS;qBAC/B,MAAM;;SAElB,CACJ,CAAC;QAEF,oFAAoF;QACpF,qBAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1E,qBAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,uCAAuC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACpF,CAAC;CACF;AArFD,oDAqFC","sourcesContent":["import type { IAspect } from \"aws-cdk-lib\";\nimport { Aspects, CfnParameter, Duration } from \"aws-cdk-lib\";\nimport { CfnAutoScalingGroup, CfnScalingPolicy, ScalingProcess, UpdatePolicy } from \"aws-cdk-lib/aws-autoscaling\";\nimport { Effect, Policy, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport type { IConstruct } from \"constructs\";\nimport { GuAutoScalingGroup } from \"../../constructs/autoscaling\";\nimport type { GuStack } from \"../../constructs/core\";\nimport type { GuEc2AppProps } from \"../../patterns\";\nimport { GuEc2App } from \"../../patterns\";\nimport { isSingletonPresentInStack } from \"../../utils/singleton\";\n\ninterface AutoScalingRollingUpdateDurations {\n  /**\n   * The time between each check of an instance's health within the target group.\n   */\n  sleep: Duration;\n\n  /**\n   * Additional time to cover the time spent polling an instance's health within the target group before sending the CloudFormation signal.\n   */\n  buffer: Duration;\n}\n\nexport const RollingUpdateDurations: AutoScalingRollingUpdateDurations = {\n  sleep: Duration.seconds(5),\n  buffer: Duration.minutes(1),\n};\n\n/**\n * Ensures the `AutoScalingRollingUpdate` of an AutoScaling Group has a `PauseTime` matching the healthcheck grace period.\n * It also ensures the `CreationPolicy` resource signal `Timeout` matches the healthcheck grace period.\n *\n * @internal\n *\n * @privateRemarks\n * The ASG healthcheck grace period is hard-coded by {@link GuEc2App}.\n * Customisation of this value is performed via an escape hatch.\n * An `Aspect` is the only way to observe any customisation.\n *\n * TODO Expose the healthcheck grace period as a property on {@link GuEc2App} and remove this `Aspect`.\n */\nclass AutoScalingRollingUpdateTimeout implements IAspect {\n  public readonly stack: GuStack;\n  private static instance: AutoScalingRollingUpdateTimeout | undefined;\n\n  private constructor(scope: GuStack) {\n    this.stack = scope;\n  }\n\n  public static getInstance(stack: GuStack): AutoScalingRollingUpdateTimeout {\n    if (!this.instance || !isSingletonPresentInStack(stack, this.instance)) {\n      this.instance = new AutoScalingRollingUpdateTimeout(stack);\n    }\n    return this.instance;\n  }\n\n  public visit(construct: IConstruct) {\n    if (construct instanceof CfnAutoScalingGroup) {\n      const currentRollingUpdate = construct.cfnOptions.updatePolicy?.autoScalingRollingUpdate;\n      const currentCreationPolicy = construct.cfnOptions.creationPolicy;\n\n      if (!construct.healthCheckGracePeriod) {\n        throw new Error(`The healthcheck grace period not set for autoscaling group ${construct.node.id}.`);\n      }\n\n      const signalTimeoutSeconds = construct.healthCheckGracePeriod + RollingUpdateDurations.buffer.toSeconds();\n\n      if (currentRollingUpdate) {\n        construct.cfnOptions.updatePolicy = {\n          autoScalingRollingUpdate: {\n            ...currentRollingUpdate,\n            pauseTime: Duration.seconds(signalTimeoutSeconds).toIsoString(),\n          },\n        };\n      }\n\n      if (currentCreationPolicy) {\n        construct.cfnOptions.creationPolicy = {\n          ...currentCreationPolicy,\n          resourceSignal: {\n            ...currentCreationPolicy.resourceSignal,\n            timeout: Duration.seconds(signalTimeoutSeconds).toIsoString(),\n          },\n        };\n      }\n    }\n  }\n}\n\n/**\n * An `Aspect` that adjusts the properties of an AutoScaling Group using an `AutoScalingRollingUpdate` update policy.\n *\n * It'll unset the `DesiredCapacity` of the ASG as a rolling update sets `Desired` back to the template version,\n * undoing any changes that a scale-out event may have done.\n * Having `DesiredCapacity` unset ensures the service remains at-capacity at all times.\n *\n * It'll also make the `MinInstancesInService` property dynamic via a CFN Parameter that Riff-Raff will set.\n * The value depends on the current capacity of the ASG:\n *  - If the service is running normally, it'll be set to the `MinSize` capacity\n *  - If the service is partially scaled, it'll be set to the current `DesiredCapacity`\n *  - If the service is fully scaled, it'll be set to (at least) `MaxSize` - 1\n *\n * @privateRemarks\n * - Temporarily implemented as a singleton to ensure only one instance is added to a stack,\n *   else multiple attempts to add the same CFN Parameter will be made and fail.\n * - Once out of experimental, instantiate this `Aspect` directly in {@link GuStack}.\n *\n * @see https://github.com/guardian/testing-asg-rolling-update\n */\nclass HorizontallyScalingDeploymentProperties implements IAspect {\n  public readonly stack: GuStack;\n  private readonly asgToParamMap: Map<string, CfnParameter>;\n  private static instance: HorizontallyScalingDeploymentProperties | undefined;\n\n  private constructor(scope: GuStack) {\n    this.stack = scope;\n    this.asgToParamMap = new Map();\n  }\n\n  public static getInstance(stack: GuStack): HorizontallyScalingDeploymentProperties {\n    if (!this.instance || !isSingletonPresentInStack(stack, this.instance)) {\n      this.instance = new HorizontallyScalingDeploymentProperties(stack);\n    }\n\n    return this.instance;\n  }\n\n  public visit(construct: IConstruct) {\n    if (construct instanceof CfnScalingPolicy) {\n      const { node } = construct;\n      const { scopes, path } = node;\n\n      /*\n      Requiring a `CfnScalingPolicy` to be created in the scope of a `GuAutoScalingGroup`\n      is the most reliable way to associate the two together.\n\n      Though the `autoScalingGroupName` property is passed to a `CfnScalingPolicy` when instantiating,\n      this does not create a concrete link as AWS CDK sets the value to be the ASG's `Ref`.\n      That is, it is a `Token` until it is synthesised.\n      This is even if the ASG has an explicit name set.\n\n      See also:\n        - https://docs.aws.amazon.com/cdk/v2/guide/tokens.html\n        - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-autoscaling-autoscalinggroup.html#aws-resource-autoscaling-autoscalinggroup-return-values\n        - https://github.com/aws/aws-cdk/blob/f6b649d47f8bc30ca741fbb7a4852d51e8275002/packages/aws-cdk-lib/aws-autoscaling/lib/auto-scaling-group.ts#L1560\n       */\n      const autoScalingGroup = scopes.find((_): _ is GuAutoScalingGroup => _ instanceof GuAutoScalingGroup);\n\n      if (!autoScalingGroup) {\n        throw new Error(\n          `Failed to detect the autoscaling group relating to the scaling policy on path ${path}. Was it created in the scope of a GuAutoScalingGroup?`,\n        );\n      }\n\n      const cfnAutoScalingGroup = autoScalingGroup.node.defaultChild as CfnAutoScalingGroup;\n      const currentRollingUpdate = cfnAutoScalingGroup.cfnOptions.updatePolicy?.autoScalingRollingUpdate;\n\n      if (currentRollingUpdate) {\n        /*\n        An autoscaling group that horizontally scales should not explicitly set `Desired`,\n        as a rolling update will set the current `Desired` back to the template version,\n        undoing any changes that a scale-out event may have done.\n         */\n        cfnAutoScalingGroup.desiredCapacity = undefined;\n\n        const asgNodeId = autoScalingGroup.node.id;\n\n        if (!this.asgToParamMap.has(asgNodeId)) {\n          this.asgToParamMap.set(\n            asgNodeId,\n            new CfnParameter(this.stack, `MinInstancesInServiceFor${autoScalingGroup.app}`, {\n              type: \"Number\",\n              default: parseInt(cfnAutoScalingGroup.minSize),\n              maxValue: parseInt(cfnAutoScalingGroup.maxSize) - 1,\n            }),\n          );\n        }\n\n        const minInstancesInService = this.asgToParamMap.get(asgNodeId)!;\n\n        cfnAutoScalingGroup.cfnOptions.updatePolicy = {\n          autoScalingRollingUpdate: {\n            ...currentRollingUpdate,\n            minInstancesInService: minInstancesInService.valueAsNumber,\n          },\n        };\n      }\n    }\n  }\n}\n\n/**\n * An IAM Policy allowing the sending of a CloudFormation signal.\n *\n * @privateRemarks\n * Implemented as a singleton as the resources can only be tightened at most to the CloudFormation stack.\n */\nclass AsgRollingUpdatePolicy extends Policy {\n  private static instance: AsgRollingUpdatePolicy | undefined;\n\n  private constructor(scope: GuStack) {\n    const { stackId } = scope;\n\n    super(scope, \"AsgRollingUpdatePolicy\", {\n      statements: [\n        // Allow usage of command `cfn-signal`.\n        new PolicyStatement({\n          actions: [\"cloudformation:SignalResource\"],\n          effect: Effect.ALLOW,\n          resources: [stackId],\n        }),\n\n        /*\n        Allow usage of command `aws elbv2 describe-target-health`.\n        AWS Elastic Load Balancing does not support resource based policies, so the resource has to be `*` (any) here.\n        See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html\n         */\n        new PolicyStatement({\n          actions: [\"elasticloadbalancing:DescribeTargetHealth\"],\n          effect: Effect.ALLOW,\n          resources: [\"*\"],\n        }),\n      ],\n    });\n  }\n\n  public static getInstance(stack: GuStack): AsgRollingUpdatePolicy {\n    if (!this.instance || !isSingletonPresentInStack(stack, this.instance)) {\n      this.instance = new AsgRollingUpdatePolicy(stack);\n    }\n\n    return this.instance;\n  }\n}\n\nexport interface GuEc2AppExperimentalProps extends Omit<GuEc2AppProps, \"updatePolicy\"> {}\n\n/**\n * An experimental pattern to instantiate an EC2 application that is updated entirely via CloudFormation.\n * It sets the update policy of the `AWS::AutoScaling::AutoScalingGroup` to `AutoScalingRollingUpdate`.\n * When a CloudFormation update is applied, the current instances in the ASG will be replaced.\n *\n * This pattern also updates the User Data, running some commands AFTER yours.\n * These changes are wrapped in start and end marking comments.\n *\n * This pattern does not enable for scaling events to trigger _during_ a deployment\n * as during testing it was found that scale-in events during deployment led to unpredictable service availability.\n *\n * If a deployment fails, for example when the healthcheck fails, CloudFormation will automatically rollback the changes.\n * This improves on the behaviour of Riff-Raff's `autoscaling` deployment which requires manual intervention on deployment failure.\n *\n * To update the application's code, a CloudFormation update must be triggered.\n * The best way to do this is to include the build number in the application artifact.\n * TODO test User Data includes a build number.\n *\n * @remarks\n * - The rate at which instances are replaced are conditional based on how scaled up the service is.\n *   The more an application is scaled, the longer it'll take to deploy.\n * - It is not necessary to use the `autoscaling` Riff-Raff deployment type in conjunction with this.\n *   Doing so won't break anything, however it'll lengthen the deployment time as instances will be rotated twice.\n *   Please remove it from any manually created `riff-raff.yaml` file.\n * - Your application should include a build number in its filename.\n *   This value will change across builds, and therefore create a CloudFormation template difference to be deployed.\n * - Requires the AWS CLI and `cfn-signal` binaries to be available on the instance, and on the `PATH`.\n *   AMIgo adds these via the `aws-tools` role.\n *\n * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-updatepolicy.html#cfn-attributes-updatepolicy-rollingupdate\n * @see https://github.com/guardian/testing-asg-rolling-update\n *\n * @experimental\n */\nexport class GuEc2AppExperimental extends GuEc2App {\n  constructor(scope: GuStack, props: GuEc2AppExperimentalProps) {\n    const { minimumInstances, maximumInstances = minimumInstances * 2 } = props.scaling;\n    const { applicationPort } = props;\n    const { region, stackId } = scope;\n\n    super(scope, {\n      ...props,\n      updatePolicy: UpdatePolicy.rollingUpdate({\n        maxBatchSize: maximumInstances,\n        minInstancesInService: minimumInstances,\n        minSuccessPercentage: 100,\n        waitOnResourceSignals: true,\n\n        /*\n        If a scale-in event fires during an `AutoScalingRollingUpdate` operation, the update could fail and rollback.\n        For this reason, we suspend the `AlarmNotification` process, else availability of a service cannot be guaranteed.\n        Consequently, services cannot scale-out during deployments.\n        If AWS ever supports suspending scale-out and scale-in independently, we should allow scale-out.\n         */\n        suspendProcesses: [ScalingProcess.ALARM_NOTIFICATION],\n      }),\n    });\n\n    const { autoScalingGroup, targetGroup } = this;\n    const { userData, role } = autoScalingGroup;\n    const cfnAutoScalingGroup = autoScalingGroup.node.defaultChild as CfnAutoScalingGroup;\n\n    cfnAutoScalingGroup.desiredCapacity = minimumInstances.toString();\n\n    cfnAutoScalingGroup.cfnOptions.creationPolicy = {\n      autoScalingCreationPolicy: {\n        minSuccessfulInstancesPercent: 100,\n      },\n      resourceSignal: {\n        count: minimumInstances,\n      },\n    };\n\n    AsgRollingUpdatePolicy.getInstance(scope).attachToRole(role);\n\n    /*\n    `aws` is available via AMIgo baked AMIs.\n    See https://github.com/guardian/amigo/tree/main/roles/aws-tools.\n     */\n    userData.addCommands(\n      `# ${GuEc2AppExperimental.name} UserData Start`,\n      `\n      TOKEN=$(curl -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\")\n      INSTANCE_ID=$(curl -H \"X-aws-ec2-metadata-token: $TOKEN\" \"http://169.254.169.254/latest/meta-data/instance-id\")\n\n      STATE=$(aws elbv2 describe-target-health \\\n        --target-group-arn ${targetGroup.targetGroupArn} \\\n        --region ${region} \\\n        --targets Id=$INSTANCE_ID,Port=${applicationPort} \\\n        --query \"TargetHealthDescriptions[0].TargetHealth.State\")\n\n      until [ \"$STATE\" == \"\\\\\"healthy\\\\\"\" ]; do\n        echo \"Instance not yet healthy within target group. Current state $STATE. Sleeping...\"\n        sleep ${RollingUpdateDurations.sleep.toSeconds()}\n        STATE=$(aws elbv2 describe-target-health \\\n          --target-group-arn ${targetGroup.targetGroupArn} \\\n          --region ${region} \\\n          --targets Id=$INSTANCE_ID,Port=${applicationPort} \\\n          --query \"TargetHealthDescriptions[0].TargetHealth.State\")\n      done\n\n      echo \"Instance is healthy in target group.\"\n      `,\n      `# ${GuEc2AppExperimental.name} UserData End`,\n    );\n\n    userData.addOnExitCommands(\n      `\n        cfn-signal --stack ${stackId} \\\n          --resource ${cfnAutoScalingGroup.logicalId} \\\n          --region ${region} \\\n          --exit-code $exitCode || echo 'Failed to send Cloudformation Signal'\n        `,\n    );\n\n    // TODO Once out of experimental, instantiate these `Aspect`s directly in `GuStack`.\n    Aspects.of(scope).add(AutoScalingRollingUpdateTimeout.getInstance(scope));\n    Aspects.of(scope).add(HorizontallyScalingDeploymentProperties.getInstance(scope));\n  }\n}\n"]}
+{"version":3,"file":"ec2-app.js","sourceRoot":"","sources":["../../../src/experimental/patterns/ec2-app.ts"],"names":[],"mappings":";;;AACA,6CAAoE;AACpE,iEAAkH;AAElH,iDAAsE;AAEtE,+CAA+C;AAC/C,8DAAkE;AAGlE,6CAA0C;AAC1C,qDAAkE;AAcrD,QAAA,sBAAsB,GAAsC;IACvE,KAAK,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;CAC5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,+BAA+B;IAInC,YAAoB,KAAc;QAChC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAEM,MAAM,CAAC,WAAW,CAAC,KAAc;QACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAA,qCAAyB,EAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACtE,IAAI,CAAC,QAAQ,GAAG,IAAI,+BAA+B,CAAC,KAAK,CAAC,CAAC;SAC5D;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,SAAqB;QAChC,IAAI,SAAS,YAAY,qCAAmB,EAAE;YAC5C,MAAM,oBAAoB,GAAG,SAAS,CAAC,UAAU,CAAC,YAAY,EAAE,wBAAwB,CAAC;YACzF,MAAM,qBAAqB,GAAG,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC;YAElE,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE;gBACrC,MAAM,IAAI,KAAK,CAAC,8DAA8D,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;aACrG;YAED,MAAM,oBAAoB,GAAG,SAAS,CAAC,sBAAsB,GAAG,8BAAsB,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAE1G,IAAI,oBAAoB,EAAE;gBACxB,SAAS,CAAC,UAAU,CAAC,YAAY,GAAG;oBAClC,wBAAwB,EAAE;wBACxB,GAAG,oBAAoB;wBACvB,SAAS,EAAE,sBAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE;qBAChE;iBACF,CAAC;aACH;YAED,IAAI,qBAAqB,EAAE;gBACzB,SAAS,CAAC,UAAU,CAAC,cAAc,GAAG;oBACpC,GAAG,qBAAqB;oBACxB,cAAc,EAAE;wBACd,GAAG,qBAAqB,CAAC,cAAc;wBACvC,OAAO,EAAE,sBAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE;qBAC9D;iBACF,CAAC;aACH;SACF;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,uCAAuC;IAK3C,YAAoB,KAAc;QAChC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,EAAE,CAAC;IACjC,CAAC;IAEM,MAAM,CAAC,WAAW,CAAC,KAAc;QACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAA,qCAAyB,EAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACtE,IAAI,CAAC,QAAQ,GAAG,IAAI,uCAAuC,CAAC,KAAK,CAAC,CAAC;SACpE;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,SAAqB;QAChC,IAAI,SAAS,YAAY,kCAAgB,EAAE;YACzC,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;YAC3B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;YAE9B;;;;;;;;;;;;;eAaG;YACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAA2B,EAAE,CAAC,CAAC,YAAY,gCAAkB,CAAC,CAAC;YAEtG,IAAI,CAAC,gBAAgB,EAAE;gBACrB,MAAM,IAAI,KAAK,CACb,iFAAiF,IAAI,wDAAwD,CAC9I,CAAC;aACH;YAED,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAmC,CAAC;YACtF,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,YAAY,EAAE,wBAAwB,CAAC;YAEnG,IAAI,oBAAoB,EAAE;gBACxB;;;;mBAIG;gBACH,mBAAmB,CAAC,eAAe,GAAG,SAAS,CAAC;gBAEhD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAE3C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;oBACtC,IAAI,CAAC,aAAa,CAAC,GAAG,CACpB,SAAS,EACT,IAAI,0BAAY,CAAC,IAAI,CAAC,KAAK,EAAE,2BAA2B,gBAAgB,CAAC,GAAG,EAAE,EAAE;wBAC9E,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC;wBAC9C,QAAQ,EAAE,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC;qBACpD,CAAC,CACH,CAAC;iBACH;gBAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;gBAEjE,mBAAmB,CAAC,UAAU,CAAC,YAAY,GAAG;oBAC5C,wBAAwB,EAAE;wBACxB,GAAG,oBAAoB;wBACvB,qBAAqB,EAAE,qBAAqB,CAAC,aAAa;qBAC3D;iBACF,CAAC;aACH;SACF;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,sBAAuB,SAAQ,gBAAM;IAGzC,YAAoB,KAAc;QAChC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAE1B,KAAK,CAAC,KAAK,EAAE,wBAAwB,EAAE;YACrC,UAAU,EAAE;gBACV,uCAAuC;gBACvC,IAAI,yBAAe,CAAC;oBAClB,OAAO,EAAE,CAAC,+BAA+B,CAAC;oBAC1C,MAAM,EAAE,gBAAM,CAAC,KAAK;oBACpB,SAAS,EAAE,CAAC,OAAO,CAAC;iBACrB,CAAC;gBAEF;;;;mBAIG;gBACH,IAAI,yBAAe,CAAC;oBAClB,OAAO,EAAE,CAAC,2CAA2C,CAAC;oBACtD,MAAM,EAAE,gBAAM,CAAC,KAAK;oBACpB,SAAS,EAAE,CAAC,GAAG,CAAC;iBACjB,CAAC;aACH;SACF,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,WAAW,CAAC,KAAc;QACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAA,qCAAyB,EAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACtE,IAAI,CAAC,QAAQ,GAAG,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;SACnD;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAa,oBAAqB,SAAQ,mBAAQ;IAChD,YAAY,KAAc,EAAE,KAAgC;QAC1D,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;QACpF,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;QACnD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAElC,KAAK,CAAC,KAAK,EAAE;YACX,GAAG,KAAK;YACR,YAAY,EAAE,8BAAY,CAAC,aAAa,CAAC;gBACvC,YAAY,EAAE,gBAAgB;gBAC9B,qBAAqB,EAAE,gBAAgB;gBACvC,oBAAoB,EAAE,GAAG;gBACzB,qBAAqB,EAAE,IAAI;gBAE3B;;;;;mBAKG;gBACH,gBAAgB,EAAE,CAAC,gCAAc,CAAC,kBAAkB,CAAC;aACtD,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC;QAC5C,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAmC,CAAC;QAEtF,mBAAmB,CAAC,eAAe,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QAElE,mBAAmB,CAAC,UAAU,CAAC,cAAc,GAAG;YAC9C,yBAAyB,EAAE;gBACzB,6BAA6B,EAAE,GAAG;aACnC;YACD,cAAc,EAAE;gBACd,KAAK,EAAE,gBAAgB;aACxB;SACF,CAAC;QAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAE1B,sDAAsD;QACtD,qDAAqD;QACrD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAyB,CAAC;QACxD,mBAAmB,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAE7C;;;WAGG;QACH,QAAQ,CAAC,WAAW,CAClB,KAAK,oBAAoB,CAAC,IAAI,iBAAiB,EAC/C;;;;;6BAKuB,WAAW,CAAC,cAAc;mBACpC,MAAM;yCACgB,eAAe;;;;uCAIjB,eAAe;gBACtC,8BAAsB,CAAC,KAAK,CAAC,SAAS,EAAE;;+BAEzB,WAAW,CAAC,cAAc;qBACpC,MAAM;2CACgB,eAAe;;;;qCAIrB,eAAe;OAC7C,EACD,KAAK,oBAAoB,CAAC,IAAI,eAAe,CAC9C,CAAC;QAEF,QAAQ,CAAC,iBAAiB,CACxB;6BACuB,OAAO;uBACb,mBAAmB,CAAC,SAAS;qBAC/B,MAAM;;SAElB,CACJ,CAAC;QAEF,+GAA+G;QAC/G,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,wBAAY,CAAC,gBAAgB,EAAE,eAAe,EAAE;YACnG,wBAAwB,EAAE,IAAI;SAC/B,CAAC,CAAC;QAEH,oFAAoF;QACpF,qBAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1E,qBAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,uCAAuC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACpF,CAAC;CACF;AAhGD,oDAgGC","sourcesContent":["import type { IAspect } from \"aws-cdk-lib\";\nimport { Aspects, CfnParameter, Duration, Tags } from \"aws-cdk-lib\";\nimport { CfnAutoScalingGroup, CfnScalingPolicy, ScalingProcess, UpdatePolicy } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { CfnPolicy } from \"aws-cdk-lib/aws-iam\";\nimport { Effect, Policy, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport type { IConstruct } from \"constructs\";\nimport { MetadataKeys } from \"../../constants\";\nimport { GuAutoScalingGroup } from \"../../constructs/autoscaling\";\nimport type { GuStack } from \"../../constructs/core\";\nimport type { GuEc2AppProps } from \"../../patterns\";\nimport { GuEc2App } from \"../../patterns\";\nimport { isSingletonPresentInStack } from \"../../utils/singleton\";\n\ninterface AutoScalingRollingUpdateDurations {\n  /**\n   * The time between each check of an instance's health within the target group.\n   */\n  sleep: Duration;\n\n  /**\n   * Additional time to cover the time spent polling an instance's health within the target group before sending the CloudFormation signal.\n   */\n  buffer: Duration;\n}\n\nexport const RollingUpdateDurations: AutoScalingRollingUpdateDurations = {\n  sleep: Duration.seconds(5),\n  buffer: Duration.minutes(1),\n};\n\n/**\n * Ensures the `AutoScalingRollingUpdate` of an AutoScaling Group has a `PauseTime` matching the healthcheck grace period.\n * It also ensures the `CreationPolicy` resource signal `Timeout` matches the healthcheck grace period.\n *\n * @internal\n *\n * @privateRemarks\n * The ASG healthcheck grace period is hard-coded by {@link GuEc2App}.\n * Customisation of this value is performed via an escape hatch.\n * An `Aspect` is the only way to observe any customisation.\n *\n * TODO Expose the healthcheck grace period as a property on {@link GuEc2App} and remove this `Aspect`.\n */\nclass AutoScalingRollingUpdateTimeout implements IAspect {\n  public readonly stack: GuStack;\n  private static instance: AutoScalingRollingUpdateTimeout | undefined;\n\n  private constructor(scope: GuStack) {\n    this.stack = scope;\n  }\n\n  public static getInstance(stack: GuStack): AutoScalingRollingUpdateTimeout {\n    if (!this.instance || !isSingletonPresentInStack(stack, this.instance)) {\n      this.instance = new AutoScalingRollingUpdateTimeout(stack);\n    }\n    return this.instance;\n  }\n\n  public visit(construct: IConstruct) {\n    if (construct instanceof CfnAutoScalingGroup) {\n      const currentRollingUpdate = construct.cfnOptions.updatePolicy?.autoScalingRollingUpdate;\n      const currentCreationPolicy = construct.cfnOptions.creationPolicy;\n\n      if (!construct.healthCheckGracePeriod) {\n        throw new Error(`The healthcheck grace period not set for autoscaling group ${construct.node.id}.`);\n      }\n\n      const signalTimeoutSeconds = construct.healthCheckGracePeriod + RollingUpdateDurations.buffer.toSeconds();\n\n      if (currentRollingUpdate) {\n        construct.cfnOptions.updatePolicy = {\n          autoScalingRollingUpdate: {\n            ...currentRollingUpdate,\n            pauseTime: Duration.seconds(signalTimeoutSeconds).toIsoString(),\n          },\n        };\n      }\n\n      if (currentCreationPolicy) {\n        construct.cfnOptions.creationPolicy = {\n          ...currentCreationPolicy,\n          resourceSignal: {\n            ...currentCreationPolicy.resourceSignal,\n            timeout: Duration.seconds(signalTimeoutSeconds).toIsoString(),\n          },\n        };\n      }\n    }\n  }\n}\n\n/**\n * An `Aspect` that adjusts the properties of an AutoScaling Group using an `AutoScalingRollingUpdate` update policy.\n *\n * It'll unset the `DesiredCapacity` of the ASG as a rolling update sets `Desired` back to the template version,\n * undoing any changes that a scale-out event may have done.\n * Having `DesiredCapacity` unset ensures the service remains at-capacity at all times.\n *\n * It'll also make the `MinInstancesInService` property dynamic via a CFN Parameter that Riff-Raff will set.\n * The value depends on the current capacity of the ASG:\n *  - If the service is running normally, it'll be set to the `MinSize` capacity\n *  - If the service is partially scaled, it'll be set to the current `DesiredCapacity`\n *  - If the service is fully scaled, it'll be set to (at least) `MaxSize` - 1\n *\n * @privateRemarks\n * - Temporarily implemented as a singleton to ensure only one instance is added to a stack,\n *   else multiple attempts to add the same CFN Parameter will be made and fail.\n * - Once out of experimental, instantiate this `Aspect` directly in {@link GuStack}.\n *\n * @see https://github.com/guardian/testing-asg-rolling-update\n */\nclass HorizontallyScalingDeploymentProperties implements IAspect {\n  public readonly stack: GuStack;\n  private readonly asgToParamMap: Map<string, CfnParameter>;\n  private static instance: HorizontallyScalingDeploymentProperties | undefined;\n\n  private constructor(scope: GuStack) {\n    this.stack = scope;\n    this.asgToParamMap = new Map();\n  }\n\n  public static getInstance(stack: GuStack): HorizontallyScalingDeploymentProperties {\n    if (!this.instance || !isSingletonPresentInStack(stack, this.instance)) {\n      this.instance = new HorizontallyScalingDeploymentProperties(stack);\n    }\n\n    return this.instance;\n  }\n\n  public visit(construct: IConstruct) {\n    if (construct instanceof CfnScalingPolicy) {\n      const { node } = construct;\n      const { scopes, path } = node;\n\n      /*\n      Requiring a `CfnScalingPolicy` to be created in the scope of a `GuAutoScalingGroup`\n      is the most reliable way to associate the two together.\n\n      Though the `autoScalingGroupName` property is passed to a `CfnScalingPolicy` when instantiating,\n      this does not create a concrete link as AWS CDK sets the value to be the ASG's `Ref`.\n      That is, it is a `Token` until it is synthesised.\n      This is even if the ASG has an explicit name set.\n\n      See also:\n        - https://docs.aws.amazon.com/cdk/v2/guide/tokens.html\n        - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-autoscaling-autoscalinggroup.html#aws-resource-autoscaling-autoscalinggroup-return-values\n        - https://github.com/aws/aws-cdk/blob/f6b649d47f8bc30ca741fbb7a4852d51e8275002/packages/aws-cdk-lib/aws-autoscaling/lib/auto-scaling-group.ts#L1560\n       */\n      const autoScalingGroup = scopes.find((_): _ is GuAutoScalingGroup => _ instanceof GuAutoScalingGroup);\n\n      if (!autoScalingGroup) {\n        throw new Error(\n          `Failed to detect the autoscaling group relating to the scaling policy on path ${path}. Was it created in the scope of a GuAutoScalingGroup?`,\n        );\n      }\n\n      const cfnAutoScalingGroup = autoScalingGroup.node.defaultChild as CfnAutoScalingGroup;\n      const currentRollingUpdate = cfnAutoScalingGroup.cfnOptions.updatePolicy?.autoScalingRollingUpdate;\n\n      if (currentRollingUpdate) {\n        /*\n        An autoscaling group that horizontally scales should not explicitly set `Desired`,\n        as a rolling update will set the current `Desired` back to the template version,\n        undoing any changes that a scale-out event may have done.\n         */\n        cfnAutoScalingGroup.desiredCapacity = undefined;\n\n        const asgNodeId = autoScalingGroup.node.id;\n\n        if (!this.asgToParamMap.has(asgNodeId)) {\n          this.asgToParamMap.set(\n            asgNodeId,\n            new CfnParameter(this.stack, `MinInstancesInServiceFor${autoScalingGroup.app}`, {\n              type: \"Number\",\n              default: parseInt(cfnAutoScalingGroup.minSize),\n              maxValue: parseInt(cfnAutoScalingGroup.maxSize) - 1,\n            }),\n          );\n        }\n\n        const minInstancesInService = this.asgToParamMap.get(asgNodeId)!;\n\n        cfnAutoScalingGroup.cfnOptions.updatePolicy = {\n          autoScalingRollingUpdate: {\n            ...currentRollingUpdate,\n            minInstancesInService: minInstancesInService.valueAsNumber,\n          },\n        };\n      }\n    }\n  }\n}\n\n/**\n * An IAM Policy allowing the sending of a CloudFormation signal.\n *\n * @privateRemarks\n * Implemented as a singleton as the resources can only be tightened at most to the CloudFormation stack.\n */\nclass AsgRollingUpdatePolicy extends Policy {\n  private static instance: AsgRollingUpdatePolicy | undefined;\n\n  private constructor(scope: GuStack) {\n    const { stackId } = scope;\n\n    super(scope, \"AsgRollingUpdatePolicy\", {\n      statements: [\n        // Allow usage of command `cfn-signal`.\n        new PolicyStatement({\n          actions: [\"cloudformation:SignalResource\"],\n          effect: Effect.ALLOW,\n          resources: [stackId],\n        }),\n\n        /*\n        Allow usage of command `aws elbv2 describe-target-health`.\n        AWS Elastic Load Balancing does not support resource based policies, so the resource has to be `*` (any) here.\n        See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html\n         */\n        new PolicyStatement({\n          actions: [\"elasticloadbalancing:DescribeTargetHealth\"],\n          effect: Effect.ALLOW,\n          resources: [\"*\"],\n        }),\n      ],\n    });\n  }\n\n  public static getInstance(stack: GuStack): AsgRollingUpdatePolicy {\n    if (!this.instance || !isSingletonPresentInStack(stack, this.instance)) {\n      this.instance = new AsgRollingUpdatePolicy(stack);\n    }\n\n    return this.instance;\n  }\n}\n\nexport interface GuEc2AppExperimentalProps extends Omit<GuEc2AppProps, \"updatePolicy\"> {\n  /**\n   * Which application build to run.\n   * This will typically match the build number provided by CI.\n   *\n   * @example\n   * process.env.GITHUB_RUN_NUMBER\n   */\n  buildIdentifier: string;\n}\n\n/**\n * An experimental pattern to instantiate an EC2 application that is updated entirely via CloudFormation.\n * It sets the update policy of the `AWS::AutoScaling::AutoScalingGroup` to `AutoScalingRollingUpdate`.\n * When a CloudFormation update is applied, the current instances in the ASG will be replaced.\n *\n * This pattern also updates the User Data, running some commands AFTER yours.\n * These changes are wrapped in start and end marking comments.\n *\n * This pattern does not enable for scaling events to trigger _during_ a deployment\n * as during testing it was found that scale-in events during deployment led to unpredictable service availability.\n *\n * If a deployment fails, for example when the healthcheck fails, CloudFormation will automatically rollback the changes.\n * This improves on the behaviour of Riff-Raff's `autoscaling` deployment which requires manual intervention on deployment failure.\n *\n * To update the application's code, a CloudFormation update must be triggered.\n * The best way to do this is to include the build number in the application artifact.\n * TODO test User Data includes a build number.\n *\n * @remarks\n * - The rate at which instances are replaced are conditional based on how scaled up the service is.\n *   The more an application is scaled, the longer it'll take to deploy.\n * - It is not necessary to use the `autoscaling` Riff-Raff deployment type in conjunction with this.\n *   Doing so won't break anything, however it'll lengthen the deployment time as instances will be rotated twice.\n *   Please remove it from any manually created `riff-raff.yaml` file.\n * - Your application should include a build number in its filename.\n *   This value will change across builds, and therefore create a CloudFormation template difference to be deployed.\n * - Requires the AWS CLI and `cfn-signal` binaries to be available on the instance, and on the `PATH`.\n *   AMIgo adds these via the `aws-tools` role.\n *\n * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-updatepolicy.html#cfn-attributes-updatepolicy-rollingupdate\n * @see https://github.com/guardian/testing-asg-rolling-update\n *\n * @experimental\n */\nexport class GuEc2AppExperimental extends GuEc2App {\n  constructor(scope: GuStack, props: GuEc2AppExperimentalProps) {\n    const { minimumInstances, maximumInstances = minimumInstances * 2 } = props.scaling;\n    const { applicationPort, buildIdentifier } = props;\n    const { region, stackId } = scope;\n\n    super(scope, {\n      ...props,\n      updatePolicy: UpdatePolicy.rollingUpdate({\n        maxBatchSize: maximumInstances,\n        minInstancesInService: minimumInstances,\n        minSuccessPercentage: 100,\n        waitOnResourceSignals: true,\n\n        /*\n        If a scale-in event fires during an `AutoScalingRollingUpdate` operation, the update could fail and rollback.\n        For this reason, we suspend the `AlarmNotification` process, else availability of a service cannot be guaranteed.\n        Consequently, services cannot scale-out during deployments.\n        If AWS ever supports suspending scale-out and scale-in independently, we should allow scale-out.\n         */\n        suspendProcesses: [ScalingProcess.ALARM_NOTIFICATION],\n      }),\n    });\n\n    const { autoScalingGroup, targetGroup } = this;\n    const { userData, role } = autoScalingGroup;\n    const cfnAutoScalingGroup = autoScalingGroup.node.defaultChild as CfnAutoScalingGroup;\n\n    cfnAutoScalingGroup.desiredCapacity = minimumInstances.toString();\n\n    cfnAutoScalingGroup.cfnOptions.creationPolicy = {\n      autoScalingCreationPolicy: {\n        minSuccessfulInstancesPercent: 100,\n      },\n      resourceSignal: {\n        count: minimumInstances,\n      },\n    };\n\n    const policy = AsgRollingUpdatePolicy.getInstance(scope);\n    policy.attachToRole(role);\n\n    // Create the Policy with necessary permissions first.\n    // Then create the ASG that requires the permissions.\n    const cfnPolicy = policy.node.defaultChild as CfnPolicy;\n    cfnAutoScalingGroup.addDependency(cfnPolicy);\n\n    /*\n    `aws` is available via AMIgo baked AMIs.\n    See https://github.com/guardian/amigo/tree/main/roles/aws-tools.\n     */\n    userData.addCommands(\n      `# ${GuEc2AppExperimental.name} UserData Start`,\n      `\n      TOKEN=$(curl -X PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\")\n      INSTANCE_ID=$(curl -H \"X-aws-ec2-metadata-token: $TOKEN\" \"http://169.254.169.254/latest/meta-data/instance-id\")\n\n      STATE=$(aws elbv2 describe-target-health \\\n        --target-group-arn ${targetGroup.targetGroupArn} \\\n        --region ${region} \\\n        --targets Id=$INSTANCE_ID,Port=${applicationPort} \\\n        --query \"TargetHealthDescriptions[0].TargetHealth.State\")\n\n      until [ \"$STATE\" == \"\\\\\"healthy\\\\\"\" ]; do\n        echo \"Instance running build ${buildIdentifier} not yet healthy within target group. Current state $STATE. Sleeping...\"\n        sleep ${RollingUpdateDurations.sleep.toSeconds()}\n        STATE=$(aws elbv2 describe-target-health \\\n          --target-group-arn ${targetGroup.targetGroupArn} \\\n          --region ${region} \\\n          --targets Id=$INSTANCE_ID,Port=${applicationPort} \\\n          --query \"TargetHealthDescriptions[0].TargetHealth.State\")\n      done\n\n      echo \"Instance running build ${buildIdentifier} is healthy in target group.\"\n      `,\n      `# ${GuEc2AppExperimental.name} UserData End`,\n    );\n\n    userData.addOnExitCommands(\n      `\n        cfn-signal --stack ${stackId} \\\n          --resource ${cfnAutoScalingGroup.logicalId} \\\n          --region ${region} \\\n          --exit-code $exitCode || echo 'Failed to send Cloudformation Signal'\n        `,\n    );\n\n    // If https://github.com/guardian/devx-logs is used, this tag will be added as a marker to logs in Central ELK.\n    Tags.of(autoScalingGroup.instanceLaunchTemplate).add(MetadataKeys.BUILD_IDENTIFIER, buildIdentifier, {\n      applyToLaunchedInstances: true,\n    });\n\n    // TODO Once out of experimental, instantiate these `Aspect`s directly in `GuStack`.\n    Aspects.of(scope).add(AutoScalingRollingUpdateTimeout.getInstance(scope));\n    Aspects.of(scope).add(HorizontallyScalingDeploymentProperties.getInstance(scope));\n  }\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@guardian/cdk",
   "description": "Generic Guardian flavoured AWS CDK components",
-  "version": "59.5.1",
+  "version": "59.5.3",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [
@@ -28,7 +28,7 @@
     "cli:dev": "ts-node src/bin/index.ts"
   },
   "devDependencies": {
-    "@changesets/cli": "2.27.8",
+    "@changesets/cli": "2.27.9",
     "@guardian/eslint-config-typescript": "8.0.0",
     "@guardian/eslint-plugin-tsdoc-required": "^0.1.3",
     "@guardian/tsconfig": "^1.0.0",
@@ -38,7 +38,7 @@
     "@types/lodash.camelcase": "^4.3.9",
     "@types/lodash.kebabcase": "^4.1.9",
     "@types/lodash.upperfirst": "^4.3.9",
-    "@types/node": "22.5.5",
+    "@types/node": "22.7.5",
     "@types/yargs": "^17.0.33",
     "aws-cdk": "2.157.0",
     "aws-cdk-lib": "2.157.0",
@@ -51,7 +51,7 @@
     "serve": "^14.2.3",
     "ts-jest": "^29.2.5",
     "ts-node": "^10.9.2",
-    "typedoc": "^0.26.7",
+    "typedoc": "^0.26.8",
     "typescript": "5.1.6"
   },
   "dependencies": {
@@ -71,5 +71,37 @@
     "aws-cdk": "2.157.0",
     "aws-cdk-lib": "2.157.0",
     "constructs": "10.3.0"
+  },
+  "exports": {
+    ".": "./lib/index.js",
+    "./lib/constants/access": "./lib/constants/access.js",
+    "./lib/constants/context-keys": "./lib/constants/context-keys.js",
+    "./lib/constants/fastly-aws-account-ids": "./lib/constants/fastly-aws-account-ids.js",
+    "./lib/constants/library-info": "./lib/constants/library-info.js",
+    "./lib/constants/metadata-keys": "./lib/constants/metadata-keys.js",
+    "./lib/constants/regex-pattern": "./lib/constants/regex-pattern.js",
+    "./lib/constants/ssm-parameter-paths": "./lib/constants/ssm-parameter-paths.js",
+    "./lib/constants/tracking-tag": "./lib/constants/tracking-tag.js",
+    "./lib/constructs/acm": "./lib/constructs/acm/index.js",
+    "./lib/constructs/autoscaling": "./lib/constructs/autoscaling/index.js",
+    "./lib/constructs/cloudwatch": "./lib/constructs/cloudwatch/index.js",
+    "./lib/constructs/core": "./lib/constructs/core/index.js",
+    "./lib/constructs/dns": "./lib/constructs/dns/index.js",
+    "./lib/constructs/dynamodb": "./lib/constructs/dynamodb/index.js",
+    "./lib/constructs/ec2": "./lib/constructs/ec2/index.js",
+    "./lib/constructs/ecs": "./lib/constructs/ecs/index.js",
+    "./lib/constructs/iam": "./lib/constructs/iam/index.js",
+    "./lib/constructs/kinesis": "./lib/constructs/kinesis/index.js",
+    "./lib/constructs/lambda": "./lib/constructs/lambda/index.js",
+    "./lib/constructs/loadbalancing": "./lib/constructs/loadbalancing/index.js",
+    "./lib/constructs/rds": "./lib/constructs/rds/index.js",
+    "./lib/constructs/s3": "./lib/constructs/s3/index.js",
+    "./lib/constructs/ses": "./lib/constructs/ses/index.js",
+    "./lib/constructs/vpc": "./lib/constructs/vpc/index.js",
+    "./lib/constructs/root": "./lib/constructs/root.js",
+    "./lib/experimental": "./lib/experimental/patterns/index.js",
+    "./lib/experimental/constructs/iam": "./lib/experimental/constructs/iam/index.js",
+    "./lib/experimental/constructs/policies": "./lib/experimental/constructs/policies/index.js",
+    "./lib/riff-raff-yaml-file": "./lib/riff-raff-yaml-file/index.js"
   }
 }