@guardian/cdk 60.1.3 → 61.0.0

package/lib/constructs/iam/roles/github-actions.d.ts

@@ -1,3 +1,4 @@
+import { CfnResource } from "aws-cdk-lib";
 import type { GuStack } from "../../core";
 import type { GuPolicy } from "../policies";
 import { GuRole } from "./roles";
@@ -22,6 +23,9 @@ export interface GuGithubActionsRoleProps {
      */
     condition?: GuGithubActionsRepositoryCondition;
 }
+export declare class GitHubOidcProvider extends CfnResource {
+    constructor(scope: GuStack);
+}
 /**
  * A construct to create an IAM role for GitHub Actions to assume via `AssumeRoleWithWebIdentity`.
  *

package/lib/constructs/iam/roles/github-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-actions.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/github-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAgBjC,MAAM,WAAW,kCAAkC;IACjD;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAYD,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,kCAAkC,CAAC;CAChD;AAyBD;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,MAAM;gBACjC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,wBAAwB;CAmB5D"}
+{"version":3,"file":"github-actions.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/github-actions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,WAAW,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAgBjC,MAAM,WAAW,kCAAkC;IACjD;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAYD,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,kCAAkC,CAAC;CAChD;AAgBD,qBAAa,kBAAmB,SAAQ,WAAW;gBACrC,KAAK,EAAE,OAAO;CAU3B;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,MAAM;gBACjC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,wBAAwB;CAmB5D"}

package/lib/constructs/iam/roles/github-actions.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GuGithubActionsRole = void 0;
+exports.GuGithubActionsRole = exports.GitHubOidcProvider = void 0;
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const aws_iam_1 = require("aws-cdk-lib/aws-iam");
 const roles_1 = require("./roles");
@@ -24,6 +24,10 @@ const ALL_GUARDIAN_REPOSITORIES = {
     repositories: "*",
 };
 /*
+Note you can only have one of these per AWS account - `OIDCProvider`s are keyed by the
+provider domain, ie `token.actions.githubusercontent.com`, so this must be instantiated
+as a singleton. At the Guardian we do this in https://github.com/guardian/aws-account-setup .
+
 AWS CDK implements an OIDCProvider as a custom resource.
 This requires a lambda to be deployed into the account.
 As far as I can tell, the lambda is automating the setting of `ThumbprintList`, which is quite generic.
@@ -45,6 +49,7 @@ class GitHubOidcProvider extends aws_cdk_lib_1.CfnResource {
         });
     }
 }
+exports.GitHubOidcProvider = GitHubOidcProvider;
 /**
  * A construct to create an IAM role for GitHub Actions to assume via `AssumeRoleWithWebIdentity`.
  *
@@ -57,7 +62,7 @@ class GitHubOidcProvider extends aws_cdk_lib_1.CfnResource {
 class GuGithubActionsRole extends roles_1.GuRole {
     constructor(scope, props) {
         super(scope, "GithubActionsRole", {
-            assumedBy: new aws_iam_1.FederatedPrincipal(new GitHubOidcProvider(scope).ref, {
+            assumedBy: new aws_iam_1.FederatedPrincipal(`arn:aws:iam::${scope.account}:oidc-provider/${GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN}`, {
                 StringLike: {
                     [`${GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN}:sub`]: GuGithubActionsRepositoryCondition.toString(props.condition ?? ALL_GUARDIAN_REPOSITORIES),
                 },

package/lib/constructs/iam/roles/github-actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"github-actions.js","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/github-actions.ts"],"names":[],"mappings":";;;AAAA,6CAAqD;AACrD,iDAAyD;AAGzD,mCAAiC;AAEjC,MAAM,sCAAsC,GAAG,qCAAqC,CAAC;AAErF;;;;;;EAME;AACF,MAAM,kDAAkD,GAAG;IACzD,0CAA0C;IAC1C,0CAA0C;CAC3C,CAAC;AAcF,MAAM,kCAAkC,GAAG;IACzC,QAAQ,EAAE,CAAC,EAAE,kBAAkB,EAAE,YAAY,EAAsC,EAAU,EAAE,CAC7F,QAAQ,kBAAkB,IAAI,YAAY,IAAI,GAAG,EAAE;CACtD,CAAC;AAEF,MAAM,yBAAyB,GAAuC;IACpE,kBAAkB,EAAE,UAAU;IAC9B,YAAY,EAAE,GAAG;CAClB,CAAC;AAeF;;;;;;;;;GASG;AACH,MAAM,kBAAmB,SAAQ,yBAAW;IAC1C,YAAY,KAAc;QACxB,KAAK,CAAC,KAAK,EAAE,mBAAmB,EAAE;YAChC,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE;gBACV,GAAG,EAAE,WAAW,sCAAsC,EAAE;gBACxD,YAAY,EAAE,CAAC,mBAAmB,CAAC;gBACnC,cAAc,EAAE,kDAAkD;aACnE;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAa,mBAAoB,SAAQ,cAAM;IAC7C,YAAY,KAAc,EAAE,KAA+B;QACzD,KAAK,CAAC,KAAK,EAAE,mBAAmB,EAAE;YAChC,SAAS,EAAE,IAAI,4BAAkB,CAC/B,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,EACjC;gBACE,UAAU,EAAE;oBACV,CAAC,GAAG,sCAAsC,MAAM,CAAC,EAAE,kCAAkC,CAAC,QAAQ,CAC5F,KAAK,CAAC,SAAS,IAAI,yBAAyB,CAC7C;iBACF;aACF,EACD,+BAA+B,CAChC;SACF,CAAC,CAAC;QAEH,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpD,IAAI,uBAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;CACF;AApBD,kDAoBC","sourcesContent":["import { CfnOutput, CfnResource } from \"aws-cdk-lib\";\nimport { FederatedPrincipal } from \"aws-cdk-lib/aws-iam\";\nimport type { GuStack } from \"../../core\";\nimport type { GuPolicy } from \"../policies\";\nimport { GuRole } from \"./roles\";\n\nconst GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN = \"token.actions.githubusercontent.com\";\n\n/*\nThumbprint of `GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN`.\n\nSee:\n  - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html\n  - https://github.blog/changelog/2023-06-27-github-actions-update-on-oidc-integration-with-aws/\n*/\nconst GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN_THUMBPRINTS = [\n  \"6938fd4d98bab03faadb97b34396831e3780aea1\",\n  \"1c58a3a8518e8759bf075b76b750d4f2df264fcd\",\n];\n\nexport interface GuGithubActionsRepositoryCondition {\n  /**\n   * The GitHub organisation/user to constrain the IAM Role to.\n   */\n  githubOrganisation: string;\n\n  /**\n   * Repositories to constrain the IAM Role to.\n   */\n  repositories?: string;\n}\n\nconst GuGithubActionsRepositoryCondition = {\n  toString: ({ githubOrganisation, repositories }: GuGithubActionsRepositoryCondition): string =>\n    `repo:${githubOrganisation}/${repositories ?? \"*\"}`,\n};\n\nconst ALL_GUARDIAN_REPOSITORIES: GuGithubActionsRepositoryCondition = {\n  githubOrganisation: \"guardian\",\n  repositories: \"*\",\n};\n\nexport interface GuGithubActionsRoleProps {\n  /**\n   * A list of IAM Policies for the GitHub Action.\n   */\n  policies: GuPolicy[];\n\n  /**\n   * Repositories where GitHub Actions can assumes this role.\n   * Defaults to [[`ALL_GUARDIAN_REPOSITORIES`]].\n   */\n  condition?: GuGithubActionsRepositoryCondition;\n}\n\n/*\nAWS CDK implements an OIDCProvider as a custom resource.\nThis requires a lambda to be deployed into the account.\nAs far as I can tell, the lambda is automating the setting of `ThumbprintList`, which is quite generic.\nIt's simpler for us to be specific here.\n\nSee:\n  - https://github.com/aws/aws-cdk/blob/851c8ca9989856fa61496ff113f9cb8c66d02f3b/packages/%40aws-cdk/aws-iam/lib/oidc-provider.ts\n  - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html\n */\nclass GitHubOidcProvider extends CfnResource {\n  constructor(scope: GuStack) {\n    super(scope, \"GithubActionsOidc\", {\n      type: \"AWS::IAM::OIDCProvider\",\n      properties: {\n        Url: `https://${GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN}`,\n        ClientIdList: [\"sts.amazonaws.com\"],\n        ThumbprintList: GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN_THUMBPRINTS,\n      },\n    });\n  }\n}\n\n/**\n * A construct to create an IAM role for GitHub Actions to assume via `AssumeRoleWithWebIdentity`.\n *\n * An Output will be added to the stack with the Role's ARN for use with https://github.com/aws-actions/configure-aws-credentials.\n *\n * See:\n *   - https://github.com/aws-actions/configure-aws-credentials\n *   - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html\n */\nexport class GuGithubActionsRole extends GuRole {\n  constructor(scope: GuStack, props: GuGithubActionsRoleProps) {\n    super(scope, \"GithubActionsRole\", {\n      assumedBy: new FederatedPrincipal(\n        new GitHubOidcProvider(scope).ref,\n        {\n          StringLike: {\n            [`${GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN}:sub`]: GuGithubActionsRepositoryCondition.toString(\n              props.condition ?? ALL_GUARDIAN_REPOSITORIES,\n            ),\n          },\n        },\n        \"sts:AssumeRoleWithWebIdentity\",\n      ),\n    });\n\n    props.policies.forEach((p) => p.attachToRole(this));\n\n    new CfnOutput(this, `${this.node.id}-Arn`, { value: this.roleArn });\n  }\n}\n"]}
+{"version":3,"file":"github-actions.js","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/github-actions.ts"],"names":[],"mappings":";;;AAAA,6CAAqD;AACrD,iDAAyD;AAGzD,mCAAiC;AAEjC,MAAM,sCAAsC,GAAG,qCAAqC,CAAC;AAErF;;;;;;EAME;AACF,MAAM,kDAAkD,GAAG;IACzD,0CAA0C;IAC1C,0CAA0C;CAC3C,CAAC;AAcF,MAAM,kCAAkC,GAAG;IACzC,QAAQ,EAAE,CAAC,EAAE,kBAAkB,EAAE,YAAY,EAAsC,EAAU,EAAE,CAC7F,QAAQ,kBAAkB,IAAI,YAAY,IAAI,GAAG,EAAE;CACtD,CAAC;AAEF,MAAM,yBAAyB,GAAuC;IACpE,kBAAkB,EAAE,UAAU;IAC9B,YAAY,EAAE,GAAG;CAClB,CAAC;AAeF;;;;;;;;;;;;;GAaG;AACH,MAAa,kBAAmB,SAAQ,yBAAW;IACjD,YAAY,KAAc;QACxB,KAAK,CAAC,KAAK,EAAE,mBAAmB,EAAE;YAChC,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE;gBACV,GAAG,EAAE,WAAW,sCAAsC,EAAE;gBACxD,YAAY,EAAE,CAAC,mBAAmB,CAAC;gBACnC,cAAc,EAAE,kDAAkD;aACnE;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAXD,gDAWC;AAED;;;;;;;;GAQG;AACH,MAAa,mBAAoB,SAAQ,cAAM;IAC7C,YAAY,KAAc,EAAE,KAA+B;QACzD,KAAK,CAAC,KAAK,EAAE,mBAAmB,EAAE;YAChC,SAAS,EAAE,IAAI,4BAAkB,CAC/B,gBAAgB,KAAK,CAAC,OAAO,kBAAkB,sCAAsC,EAAE,EACvF;gBACE,UAAU,EAAE;oBACV,CAAC,GAAG,sCAAsC,MAAM,CAAC,EAAE,kCAAkC,CAAC,QAAQ,CAC5F,KAAK,CAAC,SAAS,IAAI,yBAAyB,CAC7C;iBACF;aACF,EACD,+BAA+B,CAChC;SACF,CAAC,CAAC;QAEH,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpD,IAAI,uBAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;CACF;AApBD,kDAoBC","sourcesContent":["import { CfnOutput, CfnResource } from \"aws-cdk-lib\";\nimport { FederatedPrincipal } from \"aws-cdk-lib/aws-iam\";\nimport type { GuStack } from \"../../core\";\nimport type { GuPolicy } from \"../policies\";\nimport { GuRole } from \"./roles\";\n\nconst GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN = \"token.actions.githubusercontent.com\";\n\n/*\nThumbprint of `GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN`.\n\nSee:\n  - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html\n  - https://github.blog/changelog/2023-06-27-github-actions-update-on-oidc-integration-with-aws/\n*/\nconst GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN_THUMBPRINTS = [\n  \"6938fd4d98bab03faadb97b34396831e3780aea1\",\n  \"1c58a3a8518e8759bf075b76b750d4f2df264fcd\",\n];\n\nexport interface GuGithubActionsRepositoryCondition {\n  /**\n   * The GitHub organisation/user to constrain the IAM Role to.\n   */\n  githubOrganisation: string;\n\n  /**\n   * Repositories to constrain the IAM Role to.\n   */\n  repositories?: string;\n}\n\nconst GuGithubActionsRepositoryCondition = {\n  toString: ({ githubOrganisation, repositories }: GuGithubActionsRepositoryCondition): string =>\n    `repo:${githubOrganisation}/${repositories ?? \"*\"}`,\n};\n\nconst ALL_GUARDIAN_REPOSITORIES: GuGithubActionsRepositoryCondition = {\n  githubOrganisation: \"guardian\",\n  repositories: \"*\",\n};\n\nexport interface GuGithubActionsRoleProps {\n  /**\n   * A list of IAM Policies for the GitHub Action.\n   */\n  policies: GuPolicy[];\n\n  /**\n   * Repositories where GitHub Actions can assumes this role.\n   * Defaults to [[`ALL_GUARDIAN_REPOSITORIES`]].\n   */\n  condition?: GuGithubActionsRepositoryCondition;\n}\n\n/*\nNote you can only have one of these per AWS account - `OIDCProvider`s are keyed by the\nprovider domain, ie `token.actions.githubusercontent.com`, so this must be instantiated\nas a singleton. At the Guardian we do this in https://github.com/guardian/aws-account-setup .\n\nAWS CDK implements an OIDCProvider as a custom resource.\nThis requires a lambda to be deployed into the account.\nAs far as I can tell, the lambda is automating the setting of `ThumbprintList`, which is quite generic.\nIt's simpler for us to be specific here.\n\nSee:\n  - https://github.com/aws/aws-cdk/blob/851c8ca9989856fa61496ff113f9cb8c66d02f3b/packages/%40aws-cdk/aws-iam/lib/oidc-provider.ts\n  - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html\n */\nexport class GitHubOidcProvider extends CfnResource {\n  constructor(scope: GuStack) {\n    super(scope, \"GithubActionsOidc\", {\n      type: \"AWS::IAM::OIDCProvider\",\n      properties: {\n        Url: `https://${GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN}`,\n        ClientIdList: [\"sts.amazonaws.com\"],\n        ThumbprintList: GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN_THUMBPRINTS,\n      },\n    });\n  }\n}\n\n/**\n * A construct to create an IAM role for GitHub Actions to assume via `AssumeRoleWithWebIdentity`.\n *\n * An Output will be added to the stack with the Role's ARN for use with https://github.com/aws-actions/configure-aws-credentials.\n *\n * See:\n *   - https://github.com/aws-actions/configure-aws-credentials\n *   - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html\n */\nexport class GuGithubActionsRole extends GuRole {\n  constructor(scope: GuStack, props: GuGithubActionsRoleProps) {\n    super(scope, \"GithubActionsRole\", {\n      assumedBy: new FederatedPrincipal(\n        `arn:aws:iam::${scope.account}:oidc-provider/${GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN}`,\n        {\n          StringLike: {\n            [`${GITHUB_ACTIONS_ID_TOKEN_REQUEST_DOMAIN}:sub`]: GuGithubActionsRepositoryCondition.toString(\n              props.condition ?? ALL_GUARDIAN_REPOSITORIES,\n            ),\n          },\n        },\n        \"sts:AssumeRoleWithWebIdentity\",\n      ),\n    });\n\n    props.policies.forEach((p) => p.attachToRole(this));\n\n    new CfnOutput(this, `${this.node.id}-Arn`, { value: this.roleArn });\n  }\n}\n"]}

package/lib/constructs/rds/instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../../src/constructs/rds/instance.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEpD,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,IAAI,CAAC;CACf;AAGD,MAAM,WAAW,MAAO,SAAQ,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,uBAAuB,CAAC;IACtG,OAAO,EAAE,KAAK,CAAC;IACf;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBACf,SAAQ,IAAI,CAAC,qBAAqB,EAAE,cAAc,GAAG,iBAAiB,GAAG,uBAAuB,CAAC,EAC/F,WAAW;IACb,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,WAAW,EAAE,KAAK,GAAG,MAAM,CAAC;CAC7B;;;;;;AAED,qBAAa,kBAAmB,SAAQ,uBAAqC;gBAC/D,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAgBvE"}
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../../src/constructs/rds/instance.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAe,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEpD,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,IAAI,CAAC;CACf;AAGD,MAAM,WAAW,MAAO,SAAQ,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,uBAAuB,CAAC;IACtG,OAAO,EAAE,KAAK,CAAC;IACf;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBACf,SAAQ,IAAI,CAAC,qBAAqB,EAAE,cAAc,GAAG,iBAAiB,GAAG,uBAAuB,CAAC,EAC/F,WAAW;IACb,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,WAAW,EAAE,KAAK,GAAG,MAAM,CAAC;CAC7B;;;;;;AAED,qBAAa,kBAAmB,SAAQ,uBAAqC;gBAC/D,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAiBvE"}

package/lib/constructs/rds/instance.js

@@ -12,6 +12,7 @@ class GuDatabaseInstance extends (0, app_aware_construct_1.GuAppAwareConstruct)(
         // This logic ensures the "db." prefix is removed before applying the CFN
         const instanceType = new aws_ec2_1.InstanceType(aws_cdk_lib_1.Fn.join("", aws_cdk_lib_1.Fn.split("db.", props.instanceType)));
         super(scope, id, {
+            storageType: aws_rds_1.StorageType.GP3,
             deletionProtection: true,
             deleteAutomatedBackups: false,
             backupRetention: props.devXBackups.enabled ? undefined : props.devXBackups.backupRetention,

package/lib/constructs/rds/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../../src/constructs/rds/instance.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AACvC,iDAAmD;AACnD,iDAAuD;AAEvD,+EAA4E;AA6B5E,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,0BAAgB,CAAC;IAC3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,4CAA4C;QAC5C,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,YAAY,GAAG,IAAI,sBAAY,CAAC,gBAAE,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAExF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,KAAK;YAC7B,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe;YAC1F,qBAAqB,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,qBAAqB;YACtG,GAAG,KAAK;YACR,YAAY;SACb,CAAC,CAAC;QACH,kBAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;CACF;AAjBD,gDAiBC","sourcesContent":["import { Fn, Tags } from \"aws-cdk-lib\";\nimport { InstanceType } from \"aws-cdk-lib/aws-ec2\";\nimport { DatabaseInstance } from \"aws-cdk-lib/aws-rds\";\nimport type { DatabaseInstanceProps } from \"aws-cdk-lib/aws-rds\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../core\";\n\nexport interface OptIn {\n  enabled: true;\n}\n\n// Using Pick here means that we get the AWS documentation for these properties rather than needing to define it ourselves\nexport interface OptOut extends Pick<DatabaseInstanceProps, \"backupRetention\" | \"preferredBackupWindow\"> {\n  enabled: false;\n  /**\n   * We recommend using DevX Backups where possible. If it is not suitable for your use-case please document\n   * this here so that we can understand why this is switched off when performing security audits.\n   */\n  optOutReason: string;\n}\n\nexport interface GuDatabaseInstanceProps\n  extends Omit<DatabaseInstanceProps, \"instanceType\" | \"backupRetention\" | \"preferredBackupWindow\">,\n    AppIdentity {\n  instanceType: string;\n  /**\n   * We recommend using DevX Backups to protect your RDS instance's backups.\n   * For more details on this feature, see the\n   * [documentation](https://docs.google.com/document/d/1VDCSxYFlWs4R6g0Waa6OmmfytV60AROyHxfIGho7cLA/edit#heading=h.vwt7syo8ng40).\n   */\n  devXBackups: OptIn | OptOut;\n}\n\nexport class GuDatabaseInstance extends GuAppAwareConstruct(DatabaseInstance) {\n  constructor(scope: GuStack, id: string, props: GuDatabaseInstanceProps) {\n    // CDK just wants \"t3.micro\" format, whereas\n    // some CFN yaml might have the older \"db.t3.micro\" with the \"db.\" prefix\n    // This logic ensures the \"db.\" prefix is removed before applying the CFN\n    const instanceType = new InstanceType(Fn.join(\"\", Fn.split(\"db.\", props.instanceType)));\n\n    super(scope, id, {\n      deletionProtection: true,\n      deleteAutomatedBackups: false,\n      backupRetention: props.devXBackups.enabled ? undefined : props.devXBackups.backupRetention,\n      preferredBackupWindow: props.devXBackups.enabled ? undefined : props.devXBackups.preferredBackupWindow,\n      ...props,\n      instanceType,\n    });\n    Tags.of(this).add(\"devx-backup-enabled\", String(props.devXBackups.enabled));\n  }\n}\n"]}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../../src/constructs/rds/instance.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AACvC,iDAAmD;AACnD,iDAAoE;AAEpE,+EAA4E;AA6B5E,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,0BAAgB,CAAC;IAC3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,4CAA4C;QAC5C,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,YAAY,GAAG,IAAI,sBAAY,CAAC,gBAAE,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAExF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,WAAW,EAAE,qBAAW,CAAC,GAAG;YAC5B,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,KAAK;YAC7B,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe;YAC1F,qBAAqB,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,qBAAqB;YACtG,GAAG,KAAK;YACR,YAAY;SACb,CAAC,CAAC;QACH,kBAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;CACF;AAlBD,gDAkBC","sourcesContent":["import { Fn, Tags } from \"aws-cdk-lib\";\nimport { InstanceType } from \"aws-cdk-lib/aws-ec2\";\nimport { DatabaseInstance, StorageType } from \"aws-cdk-lib/aws-rds\";\nimport type { DatabaseInstanceProps } from \"aws-cdk-lib/aws-rds\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../core\";\n\nexport interface OptIn {\n  enabled: true;\n}\n\n// Using Pick here means that we get the AWS documentation for these properties rather than needing to define it ourselves\nexport interface OptOut extends Pick<DatabaseInstanceProps, \"backupRetention\" | \"preferredBackupWindow\"> {\n  enabled: false;\n  /**\n   * We recommend using DevX Backups where possible. If it is not suitable for your use-case please document\n   * this here so that we can understand why this is switched off when performing security audits.\n   */\n  optOutReason: string;\n}\n\nexport interface GuDatabaseInstanceProps\n  extends Omit<DatabaseInstanceProps, \"instanceType\" | \"backupRetention\" | \"preferredBackupWindow\">,\n    AppIdentity {\n  instanceType: string;\n  /**\n   * We recommend using DevX Backups to protect your RDS instance's backups.\n   * For more details on this feature, see the\n   * [documentation](https://docs.google.com/document/d/1VDCSxYFlWs4R6g0Waa6OmmfytV60AROyHxfIGho7cLA/edit#heading=h.vwt7syo8ng40).\n   */\n  devXBackups: OptIn | OptOut;\n}\n\nexport class GuDatabaseInstance extends GuAppAwareConstruct(DatabaseInstance) {\n  constructor(scope: GuStack, id: string, props: GuDatabaseInstanceProps) {\n    // CDK just wants \"t3.micro\" format, whereas\n    // some CFN yaml might have the older \"db.t3.micro\" with the \"db.\" prefix\n    // This logic ensures the \"db.\" prefix is removed before applying the CFN\n    const instanceType = new InstanceType(Fn.join(\"\", Fn.split(\"db.\", props.instanceType)));\n\n    super(scope, id, {\n      storageType: StorageType.GP3,\n      deletionProtection: true,\n      deleteAutomatedBackups: false,\n      backupRetention: props.devXBackups.enabled ? undefined : props.devXBackups.backupRetention,\n      preferredBackupWindow: props.devXBackups.enabled ? undefined : props.devXBackups.preferredBackupWindow,\n      ...props,\n      instanceType,\n    });\n    Tags.of(this).add(\"devx-backup-enabled\", String(props.devXBackups.enabled));\n  }\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@guardian/cdk",
   "description": "Generic Guardian flavoured AWS CDK components",
-  "version": "60.1.3",
+  "version": "61.0.0",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [
@@ -38,7 +38,7 @@
     "@types/lodash.camelcase": "^4.3.9",
     "@types/lodash.kebabcase": "^4.1.9",
     "@types/lodash.upperfirst": "^4.3.9",
-    "@types/node": "22.9.1",
+    "@types/node": "22.10.0",
     "@types/yargs": "^17.0.33",
     "aws-cdk": "2.170.0",
     "aws-cdk-lib": "2.170.0",
@@ -47,7 +47,7 @@
     "eslint-plugin-custom-rules": "file:tools/eslint",
     "gh-pages": "^6.2.0",
     "jest": "^29.7.0",
-    "prettier": "^3.3.3",
+    "prettier": "^3.4.2",
     "serve": "^14.2.4",
     "ts-jest": "^29.2.5",
     "ts-node": "^10.9.2",