@guardian/cdk 61.3.3 → 61.4.0

package/lib/bin/commands/account-readiness/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/bin/commands/account-readiness/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxE,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,uBAAuB,UAAiB,SAAS,uBAoB7D,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/bin/commands/account-readiness/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxE,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,uBAAuB,UAAiB,SAAS,uBAsB7D,CAAC"}

package/lib/bin/commands/account-readiness/index.js

@@ -14,7 +14,9 @@ const accountReadinessCommand = async (props) => {
         return 1;
     }
     if (!report.isPass) {
-        report.msg && console.log(report.msg + "\n");
+        if (report.msg) {
+            console.log(report.msg + "\n");
+        }
         report.errors.forEach((errMsg, name) => console.log(`${chalk_1.default.red(name)}: ${errMsg}`));
         console.log();
     }

package/lib/bin/commands/account-readiness/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/bin/commands/account-readiness/index.ts"],"names":[],"mappings":";;;;;;AAAA,kDAA0B;AAE1B,+BAA4C;AAWrC,MAAM,uBAAuB,GAAG,KAAK,EAAE,KAAgB,EAAsB,EAAE;IACpF,MAAM,MAAM,GAAG,MAAM,IAAA,YAAS,EAAC,KAAK,CAAC,CAAC;IAEtC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEzF,IAAI,MAAM,CAAC,eAAe,KAAK,CAAC,EAAE;QAChC,OAAO,CAAC,GAAG,CACT,yHAAyH,CAC1H,CAAC;QAEF,OAAO,CAAC,CAAC;KACV;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;QAClB,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,eAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,EAAE,CAAC;KACf;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC,CAAC;AApBW,QAAA,uBAAuB,2BAoBlC","sourcesContent":["import chalk from \"chalk\";\nimport type { AwsConfig, CliCommandResponse } from \"../../../types/cli\";\nimport { report as reportSSM } from \"./ssm\";\n\nexport interface Report {\n  name: string;\n  isPass: boolean;\n  msg?: string;\n  errors: Map<string, string>;\n  parametersFound: number;\n  parametersMissing: number;\n}\n\nexport const accountReadinessCommand = async (props: AwsConfig): CliCommandResponse => {\n  const report = await reportSSM(props);\n\n  console.log(chalk.bold(report.name + \":\") + \" \" + (report.isPass ? \"✅ Pass\" : \"❌ Fail\"));\n\n  if (report.parametersFound === 0) {\n    console.log(\n      `It looks like this account has not been set up for @guardian/cdk yet. See https://github.com/guardian/aws-account-setup`,\n    );\n\n    return 1;\n  }\n\n  if (!report.isPass) {\n    report.msg && console.log(report.msg + \"\\n\");\n    report.errors.forEach((errMsg, name) => console.log(`${chalk.red(name)}: ${errMsg}`));\n    console.log();\n  }\n\n  return report.isPass ? 0 : 1;\n};\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/bin/commands/account-readiness/index.ts"],"names":[],"mappings":";;;;;;AAAA,kDAA0B;AAE1B,+BAA4C;AAWrC,MAAM,uBAAuB,GAAG,KAAK,EAAE,KAAgB,EAAsB,EAAE;IACpF,MAAM,MAAM,GAAG,MAAM,IAAA,YAAS,EAAC,KAAK,CAAC,CAAC;IAEtC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEzF,IAAI,MAAM,CAAC,eAAe,KAAK,CAAC,EAAE;QAChC,OAAO,CAAC,GAAG,CACT,yHAAyH,CAC1H,CAAC;QAEF,OAAO,CAAC,CAAC;KACV;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;QAClB,IAAI,MAAM,CAAC,GAAG,EAAE;YACd,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;SAChC;QACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,eAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,EAAE,CAAC;KACf;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC,CAAC;AAtBW,QAAA,uBAAuB,2BAsBlC","sourcesContent":["import chalk from \"chalk\";\nimport type { AwsConfig, CliCommandResponse } from \"../../../types/cli\";\nimport { report as reportSSM } from \"./ssm\";\n\nexport interface Report {\n  name: string;\n  isPass: boolean;\n  msg?: string;\n  errors: Map<string, string>;\n  parametersFound: number;\n  parametersMissing: number;\n}\n\nexport const accountReadinessCommand = async (props: AwsConfig): CliCommandResponse => {\n  const report = await reportSSM(props);\n\n  console.log(chalk.bold(report.name + \":\") + \" \" + (report.isPass ? \"✅ Pass\" : \"❌ Fail\"));\n\n  if (report.parametersFound === 0) {\n    console.log(\n      `It looks like this account has not been set up for @guardian/cdk yet. See https://github.com/guardian/aws-account-setup`,\n    );\n\n    return 1;\n  }\n\n  if (!report.isPass) {\n    if (report.msg) {\n      console.log(report.msg + \"\\n\");\n    }\n    report.errors.forEach((errMsg, name) => console.log(`${chalk.red(name)}: ${errMsg}`));\n    console.log();\n  }\n\n  return report.isPass ? 0 : 1;\n};\n"]}

package/lib/bin/commands/account-readiness/ssm.js

@@ -54,7 +54,9 @@ const report = async (props) => {
         errs.set(missingParamsMsg, `\n${missingParams.join("\n")}`);
     }
     if (output.defaultVPCReferences.length > 0) {
-        errs.set("Default VPC referenced in VPC parameters", `you should use a custom VPC instead. Default VPC is referenced in paths: ${output.defaultVPCReferences.join(", ")}.`);
+        errs.set("Default VPC referenced in VPC parameters", `you should use a custom VPC instead. Default VPC is referenced in paths: ${output.defaultVPCReferences
+            .map((vpc) => vpc.path)
+            .join(", ")}.`);
     }
     return {
         name: "SSM Parameter Readiness",

package/lib/bin/commands/account-readiness/ssm.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssm.js","sourceRoot":"","sources":["../../../../src/bin/commands/account-readiness/ssm.ts"],"names":[],"mappings":";;;;;;AAAA,sDAA0B;AAC1B,kDAA0B;AAE1B,kDAA6D;AAE7D,gDAAiF;AASjF,MAAM,iBAAiB,GAAG,KAAK,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAa,EAAwC,EAAE;IAClH,MAAM,SAAS,GAAG,IAAI,iBAAG,CAAC,GAAG,CAAC;QAC5B,kBAAkB;QAClB,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,iBAAG,CAAC,GAAG,CAAC;QAC5B,kBAAkB;QAClB,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,mCAAuB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAa,SAAS,CAAC,GAAG,CAAC,CAAC,KAAuB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE/E,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAE9E,MAAM,kBAAkB,GAAG,WAAW,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC/D,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtF,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEpF,MAAM,IAAI,GAAG,MAAM,IAAA,qBAAe,EAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,oBAAoB,GAAG,MAAM,IAAA,4BAAsB,EAAC,SAAS,CAAC,CAAC;IACrE,MAAM,WAAW,GAAa,IAAI;SAC/B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;SAC9B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACX,sEAAsE;QACtE,OAAO,GAAG,CAAC,KAAM,CAAC;IACpB,CAAC,CAAC,CAAC;IAEL,MAAM,+BAA+B,GAAG,oBAAoB,CAAC,MAAM,CACjE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CACpD,CAAC;IAEF,MAAM,wBAAwB,GAAG,+BAA+B;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAEzD,OAAO;QACL,eAAe,EAAE,aAAa;QAC9B,iBAAiB,EAAE,gBAAgB;QACnC,oBAAoB,EAAE,wBAAwB;KAC/C,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,MAAM,GAAG,KAAK,EAAE,KAAgB,EAAmB,EAAE;IAChE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,CAAC;IAEjG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,aAAa,GACjB,+OAA+O,CAAC;IAElP,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;IAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,eAAK,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAE/G,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE;QACvC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;KAC7D;IAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE;QAC1C,IAAI,CAAC,GAAG,CACN,0CAA0C,EAC1C,4EAA4E,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAC1G,IAAI,CACL,GAAG,CACL,CAAC;KACH;IAED,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,aAAa;QAClB,MAAM,EAAE,IAAI;QACZ,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,MAAM;QAC9C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;KACnD,CAAC;AACJ,CAAC,CAAC;AAhCW,QAAA,MAAM,UAgCjB;AAEK,MAAM,MAAM,GAAG,CAAC,MAAmC,EAAW,EAAE;IACrE,OAAO,MAAM,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC;AAC/C,CAAC,CAAC;AAFW,QAAA,MAAM,UAEjB","sourcesContent":["import AWS from \"aws-sdk\";\nimport chalk from \"chalk\";\nimport type { SsmParameterPath } from \"../../../constants\";\nimport { ALL_SSM_PARAMETER_PATHS } from \"../../../constants\";\nimport type { AwsConfig } from \"../../../types/cli\";\nimport { getSsmParametersForVpc, getVpcsInDetail } from \"../../../utils/cli/vpc\";\nimport type { Report } from \".\";\n\ninterface SSMParameterReadinessOutput {\n  missingParameters: SsmParameterPath[];\n  foundParameters: SsmParameterPath[];\n  defaultVPCReferences: SsmParameterPath[];\n}\n\nconst ssmParamReadiness = async ({ credentialProvider, region }: AwsConfig): Promise<SSMParameterReadinessOutput> => {\n  const ssmClient = new AWS.SSM({\n    credentialProvider,\n    region,\n  });\n\n  const ec2Client = new AWS.EC2({\n    credentialProvider,\n    region,\n  });\n\n  const ssmParams = ALL_SSM_PARAMETER_PATHS.filter((param) => !param.optional);\n  const paths: string[] = ssmParams.map((param: SsmParameterPath) => param.path);\n\n  const awsResponse = await ssmClient.getParameters({ Names: paths }).promise();\n\n  const notFoundParameters = awsResponse.InvalidParameters ?? [];\n  const notFoundInDetail = ssmParams.filter((_) => notFoundParameters.includes(_.path));\n  const foundInDetail = ssmParams.filter((_) => !notFoundParameters.includes(_.path));\n\n  const vpcs = await getVpcsInDetail(ec2Client);\n  const ssmParamsFromAccount = await getSsmParametersForVpc(ssmClient);\n  const defaultVpcs: string[] = vpcs\n    .filter((vpc) => vpc.IsDefault)\n    .map((vpc) => {\n      // Non-null-assertion, A VPC always has an ID, the type in CDK is odd!\n      return vpc.VpcId!;\n    });\n\n  const ssmParametersMatchingDefaultVpc = ssmParamsFromAccount.filter(\n    ({ Value }) => Value && defaultVpcs.includes(Value),\n  );\n\n  const defaultVPCReferencePaths = ssmParametersMatchingDefaultVpc\n    .map((param) => {\n      return ssmParams.find((p) => p.path === param.Name);\n    })\n    .filter((p): p is SsmParameterPath => p !== undefined);\n\n  return {\n    foundParameters: foundInDetail,\n    missingParameters: notFoundInDetail,\n    defaultVPCReferences: defaultVPCReferencePaths,\n  };\n};\n\nexport const report = async (props: AwsConfig): Promise<Report> => {\n  const output = await ssmParamReadiness(props);\n  const isPass = output.missingParameters.length === 0 && output.defaultVPCReferences.length === 0;\n\n  const errs = new Map<string, string>();\n  const parametersMsg =\n    \"CDK uses predefined SSM parameters within patterns and constructs. For example, the EC2 APP pattern uses a parameter to determine which Kinesis stream to forward logs to. Your CDK app may fail at runtime if these parameters do not exist.\";\n\n  const missingParamsMsg = \"Required parameters are missing\";\n  const missingParams = output.missingParameters.map((p) => `  ${chalk.yellowBright(p.path)}: ${p.description}`);\n\n  if (output.missingParameters.length > 0) {\n    errs.set(missingParamsMsg, `\\n${missingParams.join(\"\\n\")}`);\n  }\n\n  if (output.defaultVPCReferences.length > 0) {\n    errs.set(\n      \"Default VPC referenced in VPC parameters\",\n      `you should use a custom VPC instead. Default VPC is referenced in paths: ${output.defaultVPCReferences.join(\n        \", \",\n      )}.`,\n    );\n  }\n\n  return {\n    name: \"SSM Parameter Readiness\",\n    isPass: isPass,\n    msg: parametersMsg,\n    errors: errs,\n    parametersFound: output.foundParameters.length,\n    parametersMissing: output.missingParameters.length,\n  };\n};\n\nexport const isPass = (output: SSMParameterReadinessOutput): boolean => {\n  return output.missingParameters.length === 0;\n};\n"]}
+{"version":3,"file":"ssm.js","sourceRoot":"","sources":["../../../../src/bin/commands/account-readiness/ssm.ts"],"names":[],"mappings":";;;;;;AAAA,sDAA0B;AAC1B,kDAA0B;AAE1B,kDAA6D;AAE7D,gDAAiF;AASjF,MAAM,iBAAiB,GAAG,KAAK,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAa,EAAwC,EAAE;IAClH,MAAM,SAAS,GAAG,IAAI,iBAAG,CAAC,GAAG,CAAC;QAC5B,kBAAkB;QAClB,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,iBAAG,CAAC,GAAG,CAAC;QAC5B,kBAAkB;QAClB,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,mCAAuB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAa,SAAS,CAAC,GAAG,CAAC,CAAC,KAAuB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE/E,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAE9E,MAAM,kBAAkB,GAAG,WAAW,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC/D,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtF,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEpF,MAAM,IAAI,GAAG,MAAM,IAAA,qBAAe,EAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,oBAAoB,GAAG,MAAM,IAAA,4BAAsB,EAAC,SAAS,CAAC,CAAC;IACrE,MAAM,WAAW,GAAa,IAAI;SAC/B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;SAC9B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACX,sEAAsE;QACtE,OAAO,GAAG,CAAC,KAAM,CAAC;IACpB,CAAC,CAAC,CAAC;IAEL,MAAM,+BAA+B,GAAG,oBAAoB,CAAC,MAAM,CACjE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CACpD,CAAC;IAEF,MAAM,wBAAwB,GAAG,+BAA+B;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAEzD,OAAO;QACL,eAAe,EAAE,aAAa;QAC9B,iBAAiB,EAAE,gBAAgB;QACnC,oBAAoB,EAAE,wBAAwB;KAC/C,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,MAAM,GAAG,KAAK,EAAE,KAAgB,EAAmB,EAAE;IAChE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,CAAC;IAEjG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,aAAa,GACjB,+OAA+O,CAAC;IAElP,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;IAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,eAAK,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAE/G,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE;QACvC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;KAC7D;IAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE;QAC1C,IAAI,CAAC,GAAG,CACN,0CAA0C,EAC1C,4EAA4E,MAAM,CAAC,oBAAoB;aACpG,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;aACtB,IAAI,CAAC,IAAI,CAAC,GAAG,CACjB,CAAC;KACH;IAED,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,aAAa;QAClB,MAAM,EAAE,IAAI;QACZ,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,MAAM;QAC9C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;KACnD,CAAC;AACJ,CAAC,CAAC;AAhCW,QAAA,MAAM,UAgCjB;AAEK,MAAM,MAAM,GAAG,CAAC,MAAmC,EAAW,EAAE;IACrE,OAAO,MAAM,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC;AAC/C,CAAC,CAAC;AAFW,QAAA,MAAM,UAEjB","sourcesContent":["import AWS from \"aws-sdk\";\nimport chalk from \"chalk\";\nimport type { SsmParameterPath } from \"../../../constants\";\nimport { ALL_SSM_PARAMETER_PATHS } from \"../../../constants\";\nimport type { AwsConfig } from \"../../../types/cli\";\nimport { getSsmParametersForVpc, getVpcsInDetail } from \"../../../utils/cli/vpc\";\nimport type { Report } from \".\";\n\ninterface SSMParameterReadinessOutput {\n  missingParameters: SsmParameterPath[];\n  foundParameters: SsmParameterPath[];\n  defaultVPCReferences: SsmParameterPath[];\n}\n\nconst ssmParamReadiness = async ({ credentialProvider, region }: AwsConfig): Promise<SSMParameterReadinessOutput> => {\n  const ssmClient = new AWS.SSM({\n    credentialProvider,\n    region,\n  });\n\n  const ec2Client = new AWS.EC2({\n    credentialProvider,\n    region,\n  });\n\n  const ssmParams = ALL_SSM_PARAMETER_PATHS.filter((param) => !param.optional);\n  const paths: string[] = ssmParams.map((param: SsmParameterPath) => param.path);\n\n  const awsResponse = await ssmClient.getParameters({ Names: paths }).promise();\n\n  const notFoundParameters = awsResponse.InvalidParameters ?? [];\n  const notFoundInDetail = ssmParams.filter((_) => notFoundParameters.includes(_.path));\n  const foundInDetail = ssmParams.filter((_) => !notFoundParameters.includes(_.path));\n\n  const vpcs = await getVpcsInDetail(ec2Client);\n  const ssmParamsFromAccount = await getSsmParametersForVpc(ssmClient);\n  const defaultVpcs: string[] = vpcs\n    .filter((vpc) => vpc.IsDefault)\n    .map((vpc) => {\n      // Non-null-assertion, A VPC always has an ID, the type in CDK is odd!\n      return vpc.VpcId!;\n    });\n\n  const ssmParametersMatchingDefaultVpc = ssmParamsFromAccount.filter(\n    ({ Value }) => Value && defaultVpcs.includes(Value),\n  );\n\n  const defaultVPCReferencePaths = ssmParametersMatchingDefaultVpc\n    .map((param) => {\n      return ssmParams.find((p) => p.path === param.Name);\n    })\n    .filter((p): p is SsmParameterPath => p !== undefined);\n\n  return {\n    foundParameters: foundInDetail,\n    missingParameters: notFoundInDetail,\n    defaultVPCReferences: defaultVPCReferencePaths,\n  };\n};\n\nexport const report = async (props: AwsConfig): Promise<Report> => {\n  const output = await ssmParamReadiness(props);\n  const isPass = output.missingParameters.length === 0 && output.defaultVPCReferences.length === 0;\n\n  const errs = new Map<string, string>();\n  const parametersMsg =\n    \"CDK uses predefined SSM parameters within patterns and constructs. For example, the EC2 APP pattern uses a parameter to determine which Kinesis stream to forward logs to. Your CDK app may fail at runtime if these parameters do not exist.\";\n\n  const missingParamsMsg = \"Required parameters are missing\";\n  const missingParams = output.missingParameters.map((p) => `  ${chalk.yellowBright(p.path)}: ${p.description}`);\n\n  if (output.missingParameters.length > 0) {\n    errs.set(missingParamsMsg, `\\n${missingParams.join(\"\\n\")}`);\n  }\n\n  if (output.defaultVPCReferences.length > 0) {\n    errs.set(\n      \"Default VPC referenced in VPC parameters\",\n      `you should use a custom VPC instead. Default VPC is referenced in paths: ${output.defaultVPCReferences\n        .map((vpc) => vpc.path)\n        .join(\", \")}.`,\n    );\n  }\n\n  return {\n    name: \"SSM Parameter Readiness\",\n    isPass: isPass,\n    msg: parametersMsg,\n    errors: errs,\n    parametersFound: output.foundParameters.length,\n    parametersMissing: output.missingParameters.length,\n  };\n};\n\nexport const isPass = (output: SSMParameterReadinessOutput): boolean => {\n  return output.missingParameters.length === 0;\n};\n"]}

package/lib/bin/commands/new-project/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/bin/commands/new-project/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAW7D,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,CAAC;AAE5C,UAAU,eAAe;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,cAAc,CAAC;CAChC;AAuED,eAAO,MAAM,aAAa,UAAiB,eAAe,uBAgFzD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/bin/commands/new-project/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAW7D,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,CAAC;AAE5C,UAAU,eAAe;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,cAAc,CAAC;CAChC;AAuED,eAAO,MAAM,aAAa,UAAiB,eAAe,uBA4EzD,CAAC"}

package/lib/bin/commands/new-project/index.js

@@ -108,7 +108,7 @@ const newCdkProject = async (props) => {
         core_1.ux.action.stop();
     }
     // Run `eslint --fix` on the generated files instead of trying to generate code that completely satisfies the linter
-    await (0, exec_1.execute)("./node_modules/.bin/eslint", ["lib/** bin/**", "--ext .ts", "--no-error-on-unmatched-pattern", "--fix"], {
+    await (0, exec_1.execute)("./node_modules/.bin/eslint", ["lib/** bin/**", "--no-error-on-unmatched-pattern", "--fix"], {
         cwd: config.cdkDir,
     });
     core_1.ux.action.start(chalk_1.default.yellow("Running lint check..."));

package/lib/bin/commands/new-project/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/bin/commands/new-project/index.ts"],"names":[],"mappings":";;;;;;AAAA,2BAAgC;AAChC,+BAA+C;AAC/C,sCAAiC;AACjC,kDAA0B;AAC1B,wEAAyC;AAEzC,8CAA8C;AAC9C,4CAAkD;AAClD,qCAA2C;AAC3C,6CAA0C;AAC1C,uCAA8C;AAC9C,+CAAiD;AACjD,yCAA+C;AAE/C,yCAAwD;AAuBxD,MAAM,eAAe,GAAG,CAAC,IAAY,EAAQ,EAAE;IAC7C,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE;QACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;KAC7C;AACH,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAQ,EAAE;IACnD,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE;QACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;KACzD;AACH,CAAC,CAAC;AAEF,SAAS,cAAc,CAAC,MAAwB;IAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAChB,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KAChC;IACD,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,iDAAiD;IACxF,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,oBAAoB,EAAE;QAC/B,eAAe,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;KAC9C;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAsB;IACvC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAE1F,MAAM,OAAO,GAAG,IAAA,kBAAY,GAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAErC,MAAM,OAAO,GAAG,IAAA,kBAAU,EAAC,GAAG,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,IAAA,0BAAS,EAAC,OAAO,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAA,kBAAU,EAAC,KAAK,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,IAAA,0BAAS,EAAC,SAAS,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAqB;QAC/B,IAAI;QACJ,oBAAoB;QACpB,MAAM;QACN,OAAO;QACP,MAAM;QACN,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,OAAO;SAChB;QACD,OAAO,EAAE,GAAG,MAAM,QAAQ,YAAY,KAAK;QAC3C,SAAS,EAAE;YACT,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,SAAS;SAClB;QACD,SAAS,EAAE,GAAG,MAAM,QAAQ,YAAY,KAAK;QAC7C,QAAQ,EAAE,GAAG,MAAM,QAAQ,YAAY,UAAU;QACjD,cAAc;KACf,CAAC;IAEF,cAAc,CAAC,MAAM,CAAC,CAAC;IAEvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,MAAM,aAAa,GAAG,KAAK,EAAE,KAAsB,EAAsB,EAAE;IAChF,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEhC,IAAI,MAAM,CAAC,IAAI,EAAE;QACf,IAAA,qBAAc,EAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;KAC9C;IAED,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,uBAAuB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,SAAS,CAAC,MAAM,uBAAuB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAE3F,gBAAgB;IAChB,MAAM,IAAA,kBAAY,EAAC;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,QAAQ;QACpB,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,MAAM,CAAC,SAAS;QACvB,OAAO,EAAE,iBAAO,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEH,gBAAgB;IAChB,MAAM,IAAA,sBAAc,EAAC;QACnB,OAAO,EAAE,iBAAO,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC/D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAA,eAAQ,EAAC,MAAM,CAAC,SAAS,CAAC;QACtC,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,SAAS,CAAC;QACpC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;KAClD,CAAC,CAAC;IAEH,gBAAgB;IAChB,MAAM,IAAA,wBAAa,EAAC;QAClB,OAAO,EAAE,iBAAO,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAA,eAAQ,EAAC,MAAM,CAAC,QAAQ,CAAC;QACrC,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,SAAS,CAAC;KACrC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAA,mBAAW,EAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnE,IAAI,MAAM,CAAC,IAAI,EAAE;QACf,SAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC,CAAC;QACnF,MAAM,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACrC,SAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;KAClB;IAED,oHAAoH;IACpH,MAAM,IAAA,cAAO,EACX,4BAA4B,EAC5B,CAAC,eAAe,EAAE,WAAW,EAAE,iCAAiC,EAAE,OAAO,CAAC,EAC1E;QACE,GAAG,EAAE,MAAM,CAAC,MAAM;KACnB,CACF,CAAC;IAEF,SAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACvD,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtB,SAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAEjB,SAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAClD,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtB,SAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAEjB,SAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,SAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAEjB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,IAAA,cAAO,EAAC,MAAM,EAAE,CAAC,2BAA2B,CAAC,EAAE;QAChE,GAAG,EAAE,MAAM,CAAC,MAAM;KACnB,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAElB,MAAM,OAAO,GAAG,gDAAgD,CAAC;IACjE,SAAE,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,wBAAwB,OAAO,mBAAmB,CAAC,EAAE,OAAO,CAAC,CAAC;IAEjF,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC,CAAC;AAhFW,QAAA,aAAa,iBAgFxB","sourcesContent":["import { existsSync } from \"fs\";\nimport { basename, dirname, join } from \"path\";\nimport { ux } from \"@oclif/core\";\nimport chalk from \"chalk\";\nimport kebabCase from \"lodash.kebabcase\";\nimport type { CliCommandResponse } from \"../../../types/cli\";\nimport { execute } from \"../../../utils/exec\";\nimport { gitRootOrCwd } from \"../../../utils/git\";\nimport { constructApp } from \"./utils/app\";\nimport { Imports } from \"./utils/imports\";\nimport { buildDirectory } from \"./utils/init\";\nimport { constructTest } from \"./utils/snapshot\";\nimport { constructStack } from \"./utils/stack\";\nimport type { Name } from \"./utils/utils\";\nimport { getCommands, pascalCase } from \"./utils/utils\";\n\nexport type PackageManager = \"npm\" | \"yarn\";\n\ninterface NewProjectProps {\n  init: boolean;\n  app: string;\n  stack: string;\n  stages: string[];\n  regions: string[];\n  yamlTemplateLocation?: string;\n  packageManager: PackageManager;\n}\n\ninterface NewProjectConfig extends Omit<NewProjectProps, \"stack\" | \"app\"> {\n  cdkDir: string;\n  appPath: string;\n  appName: Name;\n  stackPath: string;\n  stackName: Name;\n  testPath: string;\n}\n\nconst checkPathExists = (path: string): void => {\n  if (!existsSync(path)) {\n    throw new Error(`File not found - ${path}`);\n  }\n};\n\nconst checkPathDoesNotExist = (path: string): void => {\n  if (existsSync(path)) {\n    throw new Error(`There is already a file at - ${path}`);\n  }\n};\n\nfunction validateConfig(config: NewProjectConfig): void {\n  if (!config.init) {\n    checkPathExists(config.cdkDir);\n  }\n  checkPathDoesNotExist(config.appPath); // TODO: Update the app file if it already exists\n  checkPathDoesNotExist(config.stackPath);\n\n  if (config.yamlTemplateLocation) {\n    checkPathExists(config.yamlTemplateLocation);\n  }\n}\n\nfunction getConfig(props: NewProjectProps): NewProjectConfig {\n  const { init, app, stack, stages, regions, yamlTemplateLocation, packageManager } = props;\n\n  const rootDir = gitRootOrCwd();\n  const cdkDir = join(rootDir, \"/cdk\");\n\n  const appName = pascalCase(app);\n  const kebabAppName = kebabCase(appName);\n  const stackName = pascalCase(stack);\n  const kebabStackName = kebabCase(stackName);\n\n  const config: NewProjectConfig = {\n    init,\n    yamlTemplateLocation,\n    stages,\n    regions,\n    cdkDir,\n    appName: {\n      kebab: kebabAppName,\n      pascal: appName,\n    },\n    appPath: `${cdkDir}/bin/${kebabAppName}.ts`,\n    stackName: {\n      kebab: kebabStackName,\n      pascal: stackName,\n    },\n    stackPath: `${cdkDir}/lib/${kebabAppName}.ts`,\n    testPath: `${cdkDir}/lib/${kebabAppName}.test.ts`,\n    packageManager,\n  };\n\n  validateConfig(config);\n\n  return config;\n}\n\nexport const newCdkProject = async (props: NewProjectProps): CliCommandResponse => {\n  console.log(\"Starting CDK generator\");\n\n  const config = getConfig(props);\n\n  if (config.init) {\n    buildDirectory({ outputDir: config.cdkDir });\n  }\n\n  console.log(`New app ${config.appName.pascal} will be written to ${config.appPath}`);\n  console.log(`New stack ${config.stackName.pascal} will be written to ${config.stackPath}`);\n\n  // bin directory\n  await constructApp({\n    appName: config.appName,\n    outputFile: \"cdk.ts\",\n    outputDir: dirname(config.appPath),\n    stack: config.stackName,\n    imports: Imports.newAppImports(config.appName),\n    stages: config.stages,\n    regions: config.regions,\n  });\n\n  // lib directory\n  await constructStack({\n    imports: Imports.newStackImports(!!config.yamlTemplateLocation),\n    appName: config.appName,\n    outputFile: basename(config.stackPath),\n    outputDir: dirname(config.stackPath),\n    yamlTemplateLocation: config.yamlTemplateLocation,\n  });\n\n  // lib directory\n  await constructTest({\n    imports: Imports.newTestImports(config.appName),\n    stackName: config.stackName,\n    appName: config.appName,\n    outputFile: basename(config.testPath),\n    outputDir: dirname(config.stackPath),\n  });\n\n  const commands = getCommands(config.packageManager, config.cdkDir);\n\n  if (config.init) {\n    ux.action.start(chalk.yellow(\"Installing dependencies. This may take a while...\"));\n    await commands.installDependencies();\n    ux.action.stop();\n  }\n\n  // Run `eslint --fix` on the generated files instead of trying to generate code that completely satisfies the linter\n  await execute(\n    \"./node_modules/.bin/eslint\",\n    [\"lib/** bin/**\", \"--ext .ts\", \"--no-error-on-unmatched-pattern\", \"--fix\"],\n    {\n      cwd: config.cdkDir,\n    },\n  );\n\n  ux.action.start(chalk.yellow(\"Running lint check...\"));\n  await commands.lint();\n  ux.action.stop();\n\n  ux.action.start(chalk.yellow(\"Running tests...\"));\n  await commands.test();\n  ux.action.stop();\n\n  ux.action.start(chalk.yellow(\"Running initial synthesis...\"));\n  await commands.synth();\n  ux.action.stop();\n\n  console.log(chalk.green(\"Success! Here's a summary of the created files:\"));\n  const tree = await execute(\"tree\", [\"-I 'node_modules|cdk.out'\"], {\n    cwd: config.cdkDir,\n  });\n  console.log(tree);\n\n  const docsUrl = \"https://github.com/guardian/cdk/tree/main/docs\";\n  ux.url(chalk.green(`Please see the docs (${docsUrl}) for next steps.`), docsUrl);\n\n  return Promise.resolve(0);\n};\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/bin/commands/new-project/index.ts"],"names":[],"mappings":";;;;;;AAAA,2BAAgC;AAChC,+BAA+C;AAC/C,sCAAiC;AACjC,kDAA0B;AAC1B,wEAAyC;AAEzC,8CAA8C;AAC9C,4CAAkD;AAClD,qCAA2C;AAC3C,6CAA0C;AAC1C,uCAA8C;AAC9C,+CAAiD;AACjD,yCAA+C;AAE/C,yCAAwD;AAuBxD,MAAM,eAAe,GAAG,CAAC,IAAY,EAAQ,EAAE;IAC7C,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE;QACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;KAC7C;AACH,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAQ,EAAE;IACnD,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE;QACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;KACzD;AACH,CAAC,CAAC;AAEF,SAAS,cAAc,CAAC,MAAwB;IAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAChB,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KAChC;IACD,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,iDAAiD;IACxF,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,oBAAoB,EAAE;QAC/B,eAAe,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;KAC9C;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAsB;IACvC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAE1F,MAAM,OAAO,GAAG,IAAA,kBAAY,GAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAErC,MAAM,OAAO,GAAG,IAAA,kBAAU,EAAC,GAAG,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,IAAA,0BAAS,EAAC,OAAO,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAA,kBAAU,EAAC,KAAK,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,IAAA,0BAAS,EAAC,SAAS,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAqB;QAC/B,IAAI;QACJ,oBAAoB;QACpB,MAAM;QACN,OAAO;QACP,MAAM;QACN,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,OAAO;SAChB;QACD,OAAO,EAAE,GAAG,MAAM,QAAQ,YAAY,KAAK;QAC3C,SAAS,EAAE;YACT,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,SAAS;SAClB;QACD,SAAS,EAAE,GAAG,MAAM,QAAQ,YAAY,KAAK;QAC7C,QAAQ,EAAE,GAAG,MAAM,QAAQ,YAAY,UAAU;QACjD,cAAc;KACf,CAAC;IAEF,cAAc,CAAC,MAAM,CAAC,CAAC;IAEvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,MAAM,aAAa,GAAG,KAAK,EAAE,KAAsB,EAAsB,EAAE;IAChF,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEhC,IAAI,MAAM,CAAC,IAAI,EAAE;QACf,IAAA,qBAAc,EAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;KAC9C;IAED,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,uBAAuB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,SAAS,CAAC,MAAM,uBAAuB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAE3F,gBAAgB;IAChB,MAAM,IAAA,kBAAY,EAAC;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,QAAQ;QACpB,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,MAAM,CAAC,SAAS;QACvB,OAAO,EAAE,iBAAO,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEH,gBAAgB;IAChB,MAAM,IAAA,sBAAc,EAAC;QACnB,OAAO,EAAE,iBAAO,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC/D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAA,eAAQ,EAAC,MAAM,CAAC,SAAS,CAAC;QACtC,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,SAAS,CAAC;QACpC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;KAClD,CAAC,CAAC;IAEH,gBAAgB;IAChB,MAAM,IAAA,wBAAa,EAAC;QAClB,OAAO,EAAE,iBAAO,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAA,eAAQ,EAAC,MAAM,CAAC,QAAQ,CAAC;QACrC,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,SAAS,CAAC;KACrC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAA,mBAAW,EAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnE,IAAI,MAAM,CAAC,IAAI,EAAE;QACf,SAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC,CAAC;QACnF,MAAM,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACrC,SAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;KAClB;IAED,oHAAoH;IACpH,MAAM,IAAA,cAAO,EAAC,4BAA4B,EAAE,CAAC,eAAe,EAAE,iCAAiC,EAAE,OAAO,CAAC,EAAE;QACzG,GAAG,EAAE,MAAM,CAAC,MAAM;KACnB,CAAC,CAAC;IAEH,SAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACvD,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtB,SAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAEjB,SAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAClD,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtB,SAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAEjB,SAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAK,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,SAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAEjB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,IAAA,cAAO,EAAC,MAAM,EAAE,CAAC,2BAA2B,CAAC,EAAE;QAChE,GAAG,EAAE,MAAM,CAAC,MAAM;KACnB,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAElB,MAAM,OAAO,GAAG,gDAAgD,CAAC;IACjE,SAAE,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,wBAAwB,OAAO,mBAAmB,CAAC,EAAE,OAAO,CAAC,CAAC;IAEjF,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC,CAAC;AA5EW,QAAA,aAAa,iBA4ExB","sourcesContent":["import { existsSync } from \"fs\";\nimport { basename, dirname, join } from \"path\";\nimport { ux } from \"@oclif/core\";\nimport chalk from \"chalk\";\nimport kebabCase from \"lodash.kebabcase\";\nimport type { CliCommandResponse } from \"../../../types/cli\";\nimport { execute } from \"../../../utils/exec\";\nimport { gitRootOrCwd } from \"../../../utils/git\";\nimport { constructApp } from \"./utils/app\";\nimport { Imports } from \"./utils/imports\";\nimport { buildDirectory } from \"./utils/init\";\nimport { constructTest } from \"./utils/snapshot\";\nimport { constructStack } from \"./utils/stack\";\nimport type { Name } from \"./utils/utils\";\nimport { getCommands, pascalCase } from \"./utils/utils\";\n\nexport type PackageManager = \"npm\" | \"yarn\";\n\ninterface NewProjectProps {\n  init: boolean;\n  app: string;\n  stack: string;\n  stages: string[];\n  regions: string[];\n  yamlTemplateLocation?: string;\n  packageManager: PackageManager;\n}\n\ninterface NewProjectConfig extends Omit<NewProjectProps, \"stack\" | \"app\"> {\n  cdkDir: string;\n  appPath: string;\n  appName: Name;\n  stackPath: string;\n  stackName: Name;\n  testPath: string;\n}\n\nconst checkPathExists = (path: string): void => {\n  if (!existsSync(path)) {\n    throw new Error(`File not found - ${path}`);\n  }\n};\n\nconst checkPathDoesNotExist = (path: string): void => {\n  if (existsSync(path)) {\n    throw new Error(`There is already a file at - ${path}`);\n  }\n};\n\nfunction validateConfig(config: NewProjectConfig): void {\n  if (!config.init) {\n    checkPathExists(config.cdkDir);\n  }\n  checkPathDoesNotExist(config.appPath); // TODO: Update the app file if it already exists\n  checkPathDoesNotExist(config.stackPath);\n\n  if (config.yamlTemplateLocation) {\n    checkPathExists(config.yamlTemplateLocation);\n  }\n}\n\nfunction getConfig(props: NewProjectProps): NewProjectConfig {\n  const { init, app, stack, stages, regions, yamlTemplateLocation, packageManager } = props;\n\n  const rootDir = gitRootOrCwd();\n  const cdkDir = join(rootDir, \"/cdk\");\n\n  const appName = pascalCase(app);\n  const kebabAppName = kebabCase(appName);\n  const stackName = pascalCase(stack);\n  const kebabStackName = kebabCase(stackName);\n\n  const config: NewProjectConfig = {\n    init,\n    yamlTemplateLocation,\n    stages,\n    regions,\n    cdkDir,\n    appName: {\n      kebab: kebabAppName,\n      pascal: appName,\n    },\n    appPath: `${cdkDir}/bin/${kebabAppName}.ts`,\n    stackName: {\n      kebab: kebabStackName,\n      pascal: stackName,\n    },\n    stackPath: `${cdkDir}/lib/${kebabAppName}.ts`,\n    testPath: `${cdkDir}/lib/${kebabAppName}.test.ts`,\n    packageManager,\n  };\n\n  validateConfig(config);\n\n  return config;\n}\n\nexport const newCdkProject = async (props: NewProjectProps): CliCommandResponse => {\n  console.log(\"Starting CDK generator\");\n\n  const config = getConfig(props);\n\n  if (config.init) {\n    buildDirectory({ outputDir: config.cdkDir });\n  }\n\n  console.log(`New app ${config.appName.pascal} will be written to ${config.appPath}`);\n  console.log(`New stack ${config.stackName.pascal} will be written to ${config.stackPath}`);\n\n  // bin directory\n  await constructApp({\n    appName: config.appName,\n    outputFile: \"cdk.ts\",\n    outputDir: dirname(config.appPath),\n    stack: config.stackName,\n    imports: Imports.newAppImports(config.appName),\n    stages: config.stages,\n    regions: config.regions,\n  });\n\n  // lib directory\n  await constructStack({\n    imports: Imports.newStackImports(!!config.yamlTemplateLocation),\n    appName: config.appName,\n    outputFile: basename(config.stackPath),\n    outputDir: dirname(config.stackPath),\n    yamlTemplateLocation: config.yamlTemplateLocation,\n  });\n\n  // lib directory\n  await constructTest({\n    imports: Imports.newTestImports(config.appName),\n    stackName: config.stackName,\n    appName: config.appName,\n    outputFile: basename(config.testPath),\n    outputDir: dirname(config.stackPath),\n  });\n\n  const commands = getCommands(config.packageManager, config.cdkDir);\n\n  if (config.init) {\n    ux.action.start(chalk.yellow(\"Installing dependencies. This may take a while...\"));\n    await commands.installDependencies();\n    ux.action.stop();\n  }\n\n  // Run `eslint --fix` on the generated files instead of trying to generate code that completely satisfies the linter\n  await execute(\"./node_modules/.bin/eslint\", [\"lib/** bin/**\", \"--no-error-on-unmatched-pattern\", \"--fix\"], {\n    cwd: config.cdkDir,\n  });\n\n  ux.action.start(chalk.yellow(\"Running lint check...\"));\n  await commands.lint();\n  ux.action.stop();\n\n  ux.action.start(chalk.yellow(\"Running tests...\"));\n  await commands.test();\n  ux.action.stop();\n\n  ux.action.start(chalk.yellow(\"Running initial synthesis...\"));\n  await commands.synth();\n  ux.action.stop();\n\n  console.log(chalk.green(\"Success! Here's a summary of the created files:\"));\n  const tree = await execute(\"tree\", [\"-I 'node_modules|cdk.out'\"], {\n    cwd: config.cdkDir,\n  });\n  console.log(tree);\n\n  const docsUrl = \"https://github.com/guardian/cdk/tree/main/docs\";\n  ux.url(chalk.green(`Please see the docs (${docsUrl}) for next steps.`), docsUrl);\n\n  return Promise.resolve(0);\n};\n"]}

package/lib/bin/commands/new-project/template/eslint.config.mjs

@@ -0,0 +1,6 @@
+import guardian from '@guardian/eslint-config';
+
+export default [
+	...guardian.configs.recommended,
+	...guardian.configs.jest
+];

package/lib/bin/commands/new-project/template/jest.setup.js

@@ -1 +1,2 @@
+/* eslint-disable no-undef -- jest globals are missing due to guardian.recommended.jest eslint rules not covering jest.setup.js */
 jest.mock("@guardian/cdk/lib/constants/tracking-tag");

package/lib/bin/commands/new-project/utils/imports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"imports.d.ts","sourceRoot":"","sources":["../../../../../src/bin/commands/new-project/utils/imports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAQpC,qBAAa,OAAO;IAClB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IAEjD,OAAO;WAIO,eAAe,CAAC,oBAAoB,EAAE,OAAO,GAAG,OAAO;WAuBvD,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,GAAG,OAAO;WAkB/C,cAAc,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,GAAG,OAAO;IAiB9D,MAAM,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;CA0B9B"}
+{"version":3,"file":"imports.d.ts","sourceRoot":"","sources":["../../../../../src/bin/commands/new-project/utils/imports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAQpC,qBAAa,OAAO;IAClB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IAEjD,OAAO;WAIO,eAAe,CAAC,oBAAoB,EAAE,OAAO,GAAG,OAAO;WAuBvD,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,GAAG,OAAO;WAkB/C,cAAc,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,GAAG,OAAO;IAiB9D,MAAM,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;CAgC9B"}

package/lib/bin/commands/new-project/utils/imports.js

@@ -82,9 +82,15 @@ class Imports {
             }
         })
             .forEach(([lib, imports]) => {
-            imports.basic && code.line(`import "${lib}";`);
-            imports.types.length && code.line(`import type { ${imports.types.sort().join(", ")} } from "${lib}";`);
-            imports.components.length && code.line(`import { ${imports.components.sort().join(", ")} } from "${lib}";`);
+            if (imports.basic) {
+                code.line(`import "${lib}";`);
+            }
+            if (imports.types.length) {
+                code.line(`import type { ${imports.types.sort().join(", ")} } from "${lib}";`);
+            }
+            if (imports.components.length) {
+                code.line(`import { ${imports.components.sort().join(", ")} } from "${lib}";`);
+            }
         });
         code.line();
     }

package/lib/bin/commands/new-project/utils/imports.js.map

@@ -1 +1 @@
-{"version":3,"file":"imports.js","sourceRoot":"","sources":["../../../../../src/bin/commands/new-project/utils/imports.ts"],"names":[],"mappings":";;;AASA,MAAa,OAAO;IAGlB,YAAoB,OAA+B;QACjD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAEM,MAAM,CAAC,eAAe,CAAC,oBAA6B;QACzD,OAAO,IAAI,OAAO,CAAC;YACjB,GAAG,CAAC,oBAAoB,IAAI;gBAC1B,IAAI,EAAE;oBACJ,KAAK,EAAE,EAAE;oBACT,UAAU,EAAE,CAAC,MAAM,CAAC;iBACrB;gBACD,oCAAoC,EAAE;oBACpC,KAAK,EAAE,EAAE;oBACT,UAAU,EAAE,CAAC,YAAY,CAAC;iBAC3B;aACF,CAAC;YACF,aAAa,EAAE;gBACb,KAAK,EAAE,CAAC,KAAK,CAAC;gBACd,UAAU,EAAE,EAAE;aACf;YACD,mCAAmC,EAAE;gBACnC,KAAK,EAAE,CAAC,cAAc,CAAC;gBACvB,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB;SACF,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,EAAQ;QACjD,OAAO,IAAI,OAAO,CAAC;YACjB,6BAA6B,EAAE;gBAC7B,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,EAAE;aACf;YACD,mCAAmC,EAAE;gBACnC,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,CAAC,QAAQ,CAAC;aACvB;YACD,CAAC,UAAU,KAAK,EAAE,CAAC,EAAE;gBACnB,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,CAAC,MAAM,CAAC;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,MAAM,EAAQ;QAClD,OAAO,IAAI,OAAO,CAAC;YACjB,aAAa,EAAE;gBACb,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,CAAC,KAAK,CAAC;aACpB;YACD,wBAAwB,EAAE;gBACxB,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,CAAC,UAAU,CAAC;aACzB;YACD,CAAC,KAAK,KAAK,EAAE,CAAC,EAAE;gBACd,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,CAAC,MAAM,CAAC;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAe;QACpB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1B,wEAAwE;YACxE,iDAAiD;aAChD,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE;YAC3C,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE;gBACrC,OAAO,CAAC,CAAC,CAAC;aACX;iBAAM,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE;gBAC5C,OAAO,CAAC,CAAC;aACV;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;gBACxD,OAAO,CAAC,CAAC;aACV;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;gBACxD,OAAO,CAAC,CAAC,CAAC;aACX;iBAAM;gBACL,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;aACjC;QACH,CAAC,CAAC;aACD,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE;YAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;YAE/C,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;YAEvG,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;QAC9G,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;CACF;AA3FD,0BA2FC","sourcesContent":["import type { CodeMaker } from \"codemaker\";\nimport type { Name } from \"./utils\";\n\ninterface Import {\n  types: string[];\n  components: string[];\n  basic?: boolean;\n}\n\nexport class Imports {\n  private readonly imports: Record<string, Import>;\n\n  private constructor(imports: Record<string, Import>) {\n    this.imports = imports;\n  }\n\n  public static newStackImports(addCfnIncludeImports: boolean): Imports {\n    return new Imports({\n      ...(addCfnIncludeImports && {\n        path: {\n          types: [],\n          components: [\"join\"],\n        },\n        \"aws-cdk-lib/cloudformation-include\": {\n          types: [],\n          components: [\"CfnInclude\"],\n        },\n      }),\n      \"aws-cdk-lib\": {\n        types: [\"App\"],\n        components: [],\n      },\n      \"@guardian/cdk/lib/constructs/core\": {\n        types: [\"GuStackProps\"],\n        components: [\"GuStack\"],\n      },\n    });\n  }\n\n  public static newAppImports({ kebab, pascal }: Name): Imports {\n    return new Imports({\n      \"source-map-support/register\": {\n        basic: true,\n        types: [],\n        components: [],\n      },\n      \"@guardian/cdk/lib/constructs/root\": {\n        types: [],\n        components: [\"GuRoot\"],\n      },\n      [`../lib/${kebab}`]: {\n        types: [],\n        components: [pascal],\n      },\n    });\n  }\n\n  public static newTestImports({ kebab, pascal }: Name): Imports {\n    return new Imports({\n      \"aws-cdk-lib\": {\n        types: [],\n        components: [\"App\"],\n      },\n      \"aws-cdk-lib/assertions\": {\n        types: [],\n        components: [\"Template\"],\n      },\n      [`./${kebab}`]: {\n        types: [],\n        components: [pascal],\n      },\n    });\n  }\n\n  render(code: CodeMaker): void {\n    Object.entries(this.imports)\n      // Render \"basic\" imports before any others, still in alphabetical order\n      // Render relative imports after absolute imports\n      .sort(([aKey, aImports], [bKey, bImports]) => {\n        if (aImports.basic && !bImports.basic) {\n          return -1;\n        } else if (bImports.basic && !aImports.basic) {\n          return 1;\n        } else if (aKey.startsWith(\".\") && !bKey.startsWith(\".\")) {\n          return 1;\n        } else if (bKey.startsWith(\".\") && !aKey.startsWith(\".\")) {\n          return -1;\n        } else {\n          return aKey.localeCompare(bKey);\n        }\n      })\n      .forEach(([lib, imports]) => {\n        imports.basic && code.line(`import \"${lib}\";`);\n\n        imports.types.length && code.line(`import type { ${imports.types.sort().join(\", \")} } from \"${lib}\";`);\n\n        imports.components.length && code.line(`import { ${imports.components.sort().join(\", \")} } from \"${lib}\";`);\n      });\n    code.line();\n  }\n}\n"]}
+{"version":3,"file":"imports.js","sourceRoot":"","sources":["../../../../../src/bin/commands/new-project/utils/imports.ts"],"names":[],"mappings":";;;AASA,MAAa,OAAO;IAGlB,YAAoB,OAA+B;QACjD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAEM,MAAM,CAAC,eAAe,CAAC,oBAA6B;QACzD,OAAO,IAAI,OAAO,CAAC;YACjB,GAAG,CAAC,oBAAoB,IAAI;gBAC1B,IAAI,EAAE;oBACJ,KAAK,EAAE,EAAE;oBACT,UAAU,EAAE,CAAC,MAAM,CAAC;iBACrB;gBACD,oCAAoC,EAAE;oBACpC,KAAK,EAAE,EAAE;oBACT,UAAU,EAAE,CAAC,YAAY,CAAC;iBAC3B;aACF,CAAC;YACF,aAAa,EAAE;gBACb,KAAK,EAAE,CAAC,KAAK,CAAC;gBACd,UAAU,EAAE,EAAE;aACf;YACD,mCAAmC,EAAE;gBACnC,KAAK,EAAE,CAAC,cAAc,CAAC;gBACvB,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB;SACF,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,EAAQ;QACjD,OAAO,IAAI,OAAO,CAAC;YACjB,6BAA6B,EAAE;gBAC7B,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,EAAE;aACf;YACD,mCAAmC,EAAE;gBACnC,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,CAAC,QAAQ,CAAC;aACvB;YACD,CAAC,UAAU,KAAK,EAAE,CAAC,EAAE;gBACnB,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,CAAC,MAAM,CAAC;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,MAAM,EAAQ;QAClD,OAAO,IAAI,OAAO,CAAC;YACjB,aAAa,EAAE;gBACb,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,CAAC,KAAK,CAAC;aACpB;YACD,wBAAwB,EAAE;gBACxB,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,CAAC,UAAU,CAAC;aACzB;YACD,CAAC,KAAK,KAAK,EAAE,CAAC,EAAE;gBACd,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,CAAC,MAAM,CAAC;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAe;QACpB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1B,wEAAwE;YACxE,iDAAiD;aAChD,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE;YAC3C,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE;gBACrC,OAAO,CAAC,CAAC,CAAC;aACX;iBAAM,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE;gBAC5C,OAAO,CAAC,CAAC;aACV;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;gBACxD,OAAO,CAAC,CAAC;aACV;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;gBACxD,OAAO,CAAC,CAAC,CAAC;aACX;iBAAM;gBACL,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;aACjC;QACH,CAAC,CAAC;aACD,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE;YAC1B,IAAI,OAAO,CAAC,KAAK,EAAE;gBACjB,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;aAC/B;YAED,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE;gBACxB,IAAI,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;aAChF;YAED,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE;gBAC7B,IAAI,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;aAChF;QACH,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;CACF;AAjGD,0BAiGC","sourcesContent":["import type { CodeMaker } from \"codemaker\";\nimport type { Name } from \"./utils\";\n\ninterface Import {\n  types: string[];\n  components: string[];\n  basic?: boolean;\n}\n\nexport class Imports {\n  private readonly imports: Record<string, Import>;\n\n  private constructor(imports: Record<string, Import>) {\n    this.imports = imports;\n  }\n\n  public static newStackImports(addCfnIncludeImports: boolean): Imports {\n    return new Imports({\n      ...(addCfnIncludeImports && {\n        path: {\n          types: [],\n          components: [\"join\"],\n        },\n        \"aws-cdk-lib/cloudformation-include\": {\n          types: [],\n          components: [\"CfnInclude\"],\n        },\n      }),\n      \"aws-cdk-lib\": {\n        types: [\"App\"],\n        components: [],\n      },\n      \"@guardian/cdk/lib/constructs/core\": {\n        types: [\"GuStackProps\"],\n        components: [\"GuStack\"],\n      },\n    });\n  }\n\n  public static newAppImports({ kebab, pascal }: Name): Imports {\n    return new Imports({\n      \"source-map-support/register\": {\n        basic: true,\n        types: [],\n        components: [],\n      },\n      \"@guardian/cdk/lib/constructs/root\": {\n        types: [],\n        components: [\"GuRoot\"],\n      },\n      [`../lib/${kebab}`]: {\n        types: [],\n        components: [pascal],\n      },\n    });\n  }\n\n  public static newTestImports({ kebab, pascal }: Name): Imports {\n    return new Imports({\n      \"aws-cdk-lib\": {\n        types: [],\n        components: [\"App\"],\n      },\n      \"aws-cdk-lib/assertions\": {\n        types: [],\n        components: [\"Template\"],\n      },\n      [`./${kebab}`]: {\n        types: [],\n        components: [pascal],\n      },\n    });\n  }\n\n  render(code: CodeMaker): void {\n    Object.entries(this.imports)\n      // Render \"basic\" imports before any others, still in alphabetical order\n      // Render relative imports after absolute imports\n      .sort(([aKey, aImports], [bKey, bImports]) => {\n        if (aImports.basic && !bImports.basic) {\n          return -1;\n        } else if (bImports.basic && !aImports.basic) {\n          return 1;\n        } else if (aKey.startsWith(\".\") && !bKey.startsWith(\".\")) {\n          return 1;\n        } else if (bKey.startsWith(\".\") && !aKey.startsWith(\".\")) {\n          return -1;\n        } else {\n          return aKey.localeCompare(bKey);\n        }\n      })\n      .forEach(([lib, imports]) => {\n        if (imports.basic) {\n          code.line(`import \"${lib}\";`);\n        }\n\n        if (imports.types.length) {\n          code.line(`import type { ${imports.types.sort().join(\", \")} } from \"${lib}\";`);\n        }\n\n        if (imports.components.length) {\n          code.line(`import { ${imports.components.sort().join(\", \")} } from \"${lib}\";`);\n        }\n      });\n    code.line();\n  }\n}\n"]}

package/lib/bin/commands/new-project/utils/init.js

@@ -61,7 +61,7 @@ function createPackageJson(outputDirectory) {
     const { NODE_ENV, CI } = process.env;
     const isTest = NODE_ENV?.toUpperCase() === "TEST" || CI?.toUpperCase() === "TRUE";
     const coreDeps = [
-        "@guardian/eslint-config-typescript",
+        "@guardian/eslint-config",
         "@guardian/tsconfig",
         "@types/jest",
         "@types/node",
@@ -101,7 +101,7 @@ function createPackageJson(outputDirectory) {
             test: "jest",
             "test-update": "jest -u",
             format: 'prettier --write "{lib,bin}/**/*.ts"',
-            lint: "eslint lib/** bin/** --ext .ts --no-error-on-unmatched-pattern",
+            lint: "eslint lib/** bin/** --no-error-on-unmatched-pattern",
             synth: "cdk synth --path-metadata false --version-reporting false",
             diff: "cdk diff --path-metadata false --version-reporting false",
         },
@@ -114,24 +114,6 @@ function createPackageJson(outputDirectory) {
             },
             setupFilesAfterEnv: ["./jest.setup.js"],
         },
-        eslintConfig: {
-            root: true,
-            env: {
-                node: true,
-                jest: true,
-            },
-            extends: ["@guardian/eslint-config-typescript"],
-            parserOptions: {
-                ecmaVersion: 2020,
-                sourceType: "module",
-            },
-            plugins: ["@typescript-eslint"],
-            rules: {
-                "@typescript-eslint/no-inferrable-types": 0,
-                "import/no-namespace": 2,
-            },
-            ignorePatterns: ["**/*.js", "node_modules", "cdk.out", ".eslintrc.js", "jest.config.js"],
-        },
     };
     (0, fs_1.writeFileSync)(`${outputDirectory}/package.json`, JSON.stringify(contents, null, 2));
 }

package/lib/bin/commands/new-project/utils/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../../../src/bin/commands/new-project/utils/init.ts"],"names":[],"mappings":";;;AAAA,2BAAgG;AAChG,+BAA4B;AAC5B,qDAAsE;AAMtE,8BAA8B;AAC9B,MAAa,cAAc;IAWzB,YAAY,MAAkB;QAV9B,gBAAW,GAAG,GAAG,SAAS,cAAc,CAAC;QAWvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,cAAc;QACZ,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE3C,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACjD,IAAA,cAAS,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;SAClC;QAED,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEzC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,8DAA8D;QAC9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAExD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAED,SAAS,CAAC,UAAkB,EAAE,UAAkB;QAC9C,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAW,EAAC,UAAU,CAAC,EAAE;YAC1C,MAAM,IAAI,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAEpC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;gBAC5B,SAAS;aACV;iBAAM,IAAI,IAAA,cAAS,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;gBACxC,MAAM,gBAAgB,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAChD,IAAI,CAAC,IAAA,eAAU,EAAC,gBAAgB,CAAC,EAAE;oBACjC,IAAA,cAAS,EAAC,gBAAgB,CAAC,CAAC;iBAC7B;gBACD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;aACxC;iBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;gBACrC,IAAA,iBAAY,EAAC,IAAI,EAAE,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;aACrE;iBAAM;gBACL,IAAA,iBAAY,EAAC,IAAI,EAAE,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;aAC5C;SACF;IACH,CAAC;;AAnDH,wCAoDC;AAhDQ,6BAAc,GAAG,CAAC,MAAkB,EAAQ,EAAE;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;IAC9B,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,IAAI,IAAA,gBAAW,EAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;QACpD,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,eAAe,CAAC,CAAC;KACnD;AACH,CAAC,AALoB,CAKnB;AA6CG,MAAM,cAAc,GAAG,CAAC,MAAkB,EAAQ,EAAE;IACzD,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,CAAC,cAAc,EAAE,CAAC;AAC3B,CAAC,CAAC;AAHW,QAAA,cAAc,kBAGzB;AAEF,SAAS,iBAAiB,CAAC,eAAuB;IAChD,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAG,QAAQ,EAAE,WAAW,EAAE,KAAK,MAAM,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;IAElF,MAAM,QAAQ,GAA2B;QACvC,oCAAoC;QACpC,oBAAoB;QACpB,aAAa;QACb,aAAa;QACb,QAAQ;QACR,MAAM;QACN,UAAU;QACV,SAAS;QACT,SAAS;QACT,YAAY;KACb,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAEpF,MAAM,OAAO,GAA2B;QACtC;;;;;aAKK;QACL,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,eAAe,EAAE,uBAAW,CAAC,OAAO,EAAE,CAAC;QAExD,SAAS,EAAE,uBAAW,CAAC,eAAe;QACtC,aAAa,EAAE,uBAAW,CAAC,mBAAmB;QAC9C,UAAU,EAAE,uBAAW,CAAC,kBAAkB;KAC3C,CAAC;IAEF,MAAM,UAAU,GAAG;QACjB,oBAAoB,EAAE,SAAS;QAC/B,oBAAoB,EAAE,OAAO;KAC9B,CAAC;IAEF,MAAM,OAAO,GAA2B,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC;IAEnF,MAAM,eAAe,GAA2B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;SACjE,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,MAAM;YACZ,aAAa,EAAE,SAAS;YACxB,MAAM,EAAE,sCAAsC;YAC9C,IAAI,EAAE,gEAAgE;YACtE,KAAK,EAAE,2DAA2D;YAClE,IAAI,EAAE,0DAA0D;SACjE;QACD,eAAe;QAEf,QAAQ,EAAE,oBAAoB;QAE9B,IAAI,EAAE;YACJ,SAAS,EAAE,CAAC,4BAA4B,CAAC;YACzC,SAAS,EAAE;gBACT,aAAa,EAAE,SAAS;aACzB;YACD,kBAAkB,EAAE,CAAC,iBAAiB,CAAC;SACxC;QAED,YAAY,EAAE;YACZ,IAAI,EAAE,IAAI;YACV,GAAG,EAAE;gBACH,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,IAAI;aACX;YACD,OAAO,EAAE,CAAC,oCAAoC,CAAC;YAC/C,aAAa,EAAE;gBACb,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,QAAQ;aACrB;YACD,OAAO,EAAE,CAAC,oBAAoB,CAAC;YAC/B,KAAK,EAAE;gBACL,wCAAwC,EAAE,CAAC;gBAC3C,qBAAqB,EAAE,CAAC;aACzB;YACD,cAAc,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,CAAC;SACzF;KACF,CAAC;IACF,IAAA,kBAAa,EAAC,GAAG,eAAe,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC","sourcesContent":["import { copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, writeFileSync } from \"fs\";\nimport { join } from \"path\";\nimport { getDevDependency, LibraryInfo } from \"../../../../constants\";\n\nexport interface InitConfig {\n  outputDir: string;\n}\n\n// TODO: Add project name flag\nexport class ProjectBuilder {\n  templateDir = `${__dirname}/../template`;\n  config: InitConfig;\n\n  static validateConfig = (config: InitConfig): void => {\n    const path = config.outputDir;\n    if (existsSync(path) && readdirSync(path).length > 0) {\n      throw new Error(`Directory ${path} is not empty`);\n    }\n  };\n\n  constructor(config: InitConfig) {\n    this.config = config;\n  }\n\n  buildDirectory(): void {\n    ProjectBuilder.validateConfig(this.config);\n\n    if (!existsSync(this.config.outputDir)) {\n      console.log(`Creating ${this.config.outputDir}`);\n      mkdirSync(this.config.outputDir);\n    }\n\n    console.log(\"Creating package.json\");\n    createPackageJson(this.config.outputDir);\n\n    console.log(\"Copying template files\");\n    // TODO: Replace any params in files with .template extensions\n    this.copyFiles(this.templateDir, this.config.outputDir);\n\n    console.log(\"Success!\");\n  }\n\n  copyFiles(sourcePath: string, targetPath: string): void {\n    for (const file of readdirSync(sourcePath)) {\n      const path = join(sourcePath, file);\n\n      if (path.endsWith(\".ignore\")) {\n        continue;\n      } else if (lstatSync(path).isDirectory()) {\n        const nestedTargetPath = join(targetPath, file);\n        if (!existsSync(nestedTargetPath)) {\n          mkdirSync(nestedTargetPath);\n        }\n        this.copyFiles(path, nestedTargetPath);\n      } else if (path.endsWith(\".template\")) {\n        copyFileSync(path, join(targetPath, file.replace(\".template\", \"\")));\n      } else {\n        copyFileSync(path, join(targetPath, file));\n      }\n    }\n  }\n}\n\nexport const buildDirectory = (config: InitConfig): void => {\n  const builder = new ProjectBuilder(config);\n  builder.buildDirectory();\n};\n\nfunction createPackageJson(outputDirectory: string): void {\n  const { NODE_ENV, CI } = process.env;\n  const isTest = NODE_ENV?.toUpperCase() === \"TEST\" || CI?.toUpperCase() === \"TRUE\";\n\n  const coreDeps: Record<string, string> = [\n    \"@guardian/eslint-config-typescript\",\n    \"@guardian/tsconfig\",\n    \"@types/jest\",\n    \"@types/node\",\n    \"eslint\",\n    \"jest\",\n    \"prettier\",\n    \"ts-jest\",\n    \"ts-node\",\n    \"typescript\",\n  ].reduce((acc, depName) => ({ ...acc, [depName]: getDevDependency(depName)! }), {});\n\n  const cdkDeps: Record<string, string> = {\n    /*\n      Do not add `@guardian/cdk` to the generated `package.json` file when in TEST as we'll `npm link` it instead.\n      See https://docs.npmjs.com/cli/v8/commands/npm-link#caveat\n\n      TODO remove this once the `new` command allows opting out of automatic dependency installation\n       */\n    ...(!isTest && { \"@guardian/cdk\": LibraryInfo.VERSION }),\n\n    \"aws-cdk\": LibraryInfo.AWS_CDK_VERSION,\n    \"aws-cdk-lib\": LibraryInfo.AWS_CDK_LIB_VERSION,\n    constructs: LibraryInfo.CONSTRUCTS_VERSION,\n  };\n\n  const customDeps = {\n    \"source-map-support\": \"^0.5.20\",\n    \"@guardian/prettier\": \"5.0.0\",\n  };\n\n  const allDeps: Record<string, string> = { ...coreDeps, ...cdkDeps, ...customDeps };\n\n  const devDependencies: Record<string, string> = Object.keys(allDeps)\n    .sort()\n    .reduce((acc, depName) => ({ ...acc, [depName]: allDeps[depName] }), {});\n\n  const contents = {\n    name: \"cdk\",\n    version: \"0.0.0\",\n    private: true,\n    scripts: {\n      build: \"tsc\",\n      test: \"jest\",\n      \"test-update\": \"jest -u\",\n      format: 'prettier --write \"{lib,bin}/**/*.ts\"',\n      lint: \"eslint lib/** bin/** --ext .ts --no-error-on-unmatched-pattern\",\n      synth: \"cdk synth --path-metadata false --version-reporting false\",\n      diff: \"cdk diff --path-metadata false --version-reporting false\",\n    },\n    devDependencies,\n\n    prettier: \"@guardian/prettier\",\n\n    jest: {\n      testMatch: [\"<rootDir>/lib/**/*.test.ts\"],\n      transform: {\n        \"^.+\\\\.tsx?$\": \"ts-jest\",\n      },\n      setupFilesAfterEnv: [\"./jest.setup.js\"],\n    },\n\n    eslintConfig: {\n      root: true,\n      env: {\n        node: true,\n        jest: true,\n      },\n      extends: [\"@guardian/eslint-config-typescript\"],\n      parserOptions: {\n        ecmaVersion: 2020,\n        sourceType: \"module\",\n      },\n      plugins: [\"@typescript-eslint\"],\n      rules: {\n        \"@typescript-eslint/no-inferrable-types\": 0,\n        \"import/no-namespace\": 2,\n      },\n      ignorePatterns: [\"**/*.js\", \"node_modules\", \"cdk.out\", \".eslintrc.js\", \"jest.config.js\"],\n    },\n  };\n  writeFileSync(`${outputDirectory}/package.json`, JSON.stringify(contents, null, 2));\n}\n"]}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../../../src/bin/commands/new-project/utils/init.ts"],"names":[],"mappings":";;;AAAA,2BAAgG;AAChG,+BAA4B;AAC5B,qDAAsE;AAMtE,8BAA8B;AAC9B,MAAa,cAAc;IAWzB,YAAY,MAAkB;QAV9B,gBAAW,GAAG,GAAG,SAAS,cAAc,CAAC;QAWvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,cAAc;QACZ,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE3C,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACjD,IAAA,cAAS,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;SAClC;QAED,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEzC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,8DAA8D;QAC9D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAExD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAED,SAAS,CAAC,UAAkB,EAAE,UAAkB;QAC9C,KAAK,MAAM,IAAI,IAAI,IAAA,gBAAW,EAAC,UAAU,CAAC,EAAE;YAC1C,MAAM,IAAI,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAEpC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;gBAC5B,SAAS;aACV;iBAAM,IAAI,IAAA,cAAS,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;gBACxC,MAAM,gBAAgB,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAChD,IAAI,CAAC,IAAA,eAAU,EAAC,gBAAgB,CAAC,EAAE;oBACjC,IAAA,cAAS,EAAC,gBAAgB,CAAC,CAAC;iBAC7B;gBACD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;aACxC;iBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;gBACrC,IAAA,iBAAY,EAAC,IAAI,EAAE,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;aACrE;iBAAM;gBACL,IAAA,iBAAY,EAAC,IAAI,EAAE,IAAA,WAAI,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;aAC5C;SACF;IACH,CAAC;;AAnDH,wCAoDC;AAhDQ,6BAAc,GAAG,CAAC,MAAkB,EAAQ,EAAE;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;IAC9B,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,IAAI,IAAA,gBAAW,EAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;QACpD,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,eAAe,CAAC,CAAC;KACnD;AACH,CAAC,AALoB,CAKnB;AA6CG,MAAM,cAAc,GAAG,CAAC,MAAkB,EAAQ,EAAE;IACzD,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,CAAC,cAAc,EAAE,CAAC;AAC3B,CAAC,CAAC;AAHW,QAAA,cAAc,kBAGzB;AAEF,SAAS,iBAAiB,CAAC,eAAuB;IAChD,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAG,QAAQ,EAAE,WAAW,EAAE,KAAK,MAAM,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;IAElF,MAAM,QAAQ,GAA2B;QACvC,yBAAyB;QACzB,oBAAoB;QACpB,aAAa;QACb,aAAa;QACb,QAAQ;QACR,MAAM;QACN,UAAU;QACV,SAAS;QACT,SAAS;QACT,YAAY;KACb,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAEpF,MAAM,OAAO,GAA2B;QACtC;;;;;aAKK;QACL,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,eAAe,EAAE,uBAAW,CAAC,OAAO,EAAE,CAAC;QAExD,SAAS,EAAE,uBAAW,CAAC,eAAe;QACtC,aAAa,EAAE,uBAAW,CAAC,mBAAmB;QAC9C,UAAU,EAAE,uBAAW,CAAC,kBAAkB;KAC3C,CAAC;IAEF,MAAM,UAAU,GAAG;QACjB,oBAAoB,EAAE,SAAS;QAC/B,oBAAoB,EAAE,OAAO;KAC9B,CAAC;IAEF,MAAM,OAAO,GAA2B,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC;IAEnF,MAAM,eAAe,GAA2B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;SACjE,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,MAAM;YACZ,aAAa,EAAE,SAAS;YACxB,MAAM,EAAE,sCAAsC;YAC9C,IAAI,EAAE,sDAAsD;YAC5D,KAAK,EAAE,2DAA2D;YAClE,IAAI,EAAE,0DAA0D;SACjE;QACD,eAAe;QAEf,QAAQ,EAAE,oBAAoB;QAE9B,IAAI,EAAE;YACJ,SAAS,EAAE,CAAC,4BAA4B,CAAC;YACzC,SAAS,EAAE;gBACT,aAAa,EAAE,SAAS;aACzB;YACD,kBAAkB,EAAE,CAAC,iBAAiB,CAAC;SACxC;KACF,CAAC;IACF,IAAA,kBAAa,EAAC,GAAG,eAAe,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC","sourcesContent":["import { copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, writeFileSync } from \"fs\";\nimport { join } from \"path\";\nimport { getDevDependency, LibraryInfo } from \"../../../../constants\";\n\nexport interface InitConfig {\n  outputDir: string;\n}\n\n// TODO: Add project name flag\nexport class ProjectBuilder {\n  templateDir = `${__dirname}/../template`;\n  config: InitConfig;\n\n  static validateConfig = (config: InitConfig): void => {\n    const path = config.outputDir;\n    if (existsSync(path) && readdirSync(path).length > 0) {\n      throw new Error(`Directory ${path} is not empty`);\n    }\n  };\n\n  constructor(config: InitConfig) {\n    this.config = config;\n  }\n\n  buildDirectory(): void {\n    ProjectBuilder.validateConfig(this.config);\n\n    if (!existsSync(this.config.outputDir)) {\n      console.log(`Creating ${this.config.outputDir}`);\n      mkdirSync(this.config.outputDir);\n    }\n\n    console.log(\"Creating package.json\");\n    createPackageJson(this.config.outputDir);\n\n    console.log(\"Copying template files\");\n    // TODO: Replace any params in files with .template extensions\n    this.copyFiles(this.templateDir, this.config.outputDir);\n\n    console.log(\"Success!\");\n  }\n\n  copyFiles(sourcePath: string, targetPath: string): void {\n    for (const file of readdirSync(sourcePath)) {\n      const path = join(sourcePath, file);\n\n      if (path.endsWith(\".ignore\")) {\n        continue;\n      } else if (lstatSync(path).isDirectory()) {\n        const nestedTargetPath = join(targetPath, file);\n        if (!existsSync(nestedTargetPath)) {\n          mkdirSync(nestedTargetPath);\n        }\n        this.copyFiles(path, nestedTargetPath);\n      } else if (path.endsWith(\".template\")) {\n        copyFileSync(path, join(targetPath, file.replace(\".template\", \"\")));\n      } else {\n        copyFileSync(path, join(targetPath, file));\n      }\n    }\n  }\n}\n\nexport const buildDirectory = (config: InitConfig): void => {\n  const builder = new ProjectBuilder(config);\n  builder.buildDirectory();\n};\n\nfunction createPackageJson(outputDirectory: string): void {\n  const { NODE_ENV, CI } = process.env;\n  const isTest = NODE_ENV?.toUpperCase() === \"TEST\" || CI?.toUpperCase() === \"TRUE\";\n\n  const coreDeps: Record<string, string> = [\n    \"@guardian/eslint-config\",\n    \"@guardian/tsconfig\",\n    \"@types/jest\",\n    \"@types/node\",\n    \"eslint\",\n    \"jest\",\n    \"prettier\",\n    \"ts-jest\",\n    \"ts-node\",\n    \"typescript\",\n  ].reduce((acc, depName) => ({ ...acc, [depName]: getDevDependency(depName)! }), {});\n\n  const cdkDeps: Record<string, string> = {\n    /*\n      Do not add `@guardian/cdk` to the generated `package.json` file when in TEST as we'll `npm link` it instead.\n      See https://docs.npmjs.com/cli/v8/commands/npm-link#caveat\n\n      TODO remove this once the `new` command allows opting out of automatic dependency installation\n       */\n    ...(!isTest && { \"@guardian/cdk\": LibraryInfo.VERSION }),\n\n    \"aws-cdk\": LibraryInfo.AWS_CDK_VERSION,\n    \"aws-cdk-lib\": LibraryInfo.AWS_CDK_LIB_VERSION,\n    constructs: LibraryInfo.CONSTRUCTS_VERSION,\n  };\n\n  const customDeps = {\n    \"source-map-support\": \"^0.5.20\",\n    \"@guardian/prettier\": \"5.0.0\",\n  };\n\n  const allDeps: Record<string, string> = { ...coreDeps, ...cdkDeps, ...customDeps };\n\n  const devDependencies: Record<string, string> = Object.keys(allDeps)\n    .sort()\n    .reduce((acc, depName) => ({ ...acc, [depName]: allDeps[depName] }), {});\n\n  const contents = {\n    name: \"cdk\",\n    version: \"0.0.0\",\n    private: true,\n    scripts: {\n      build: \"tsc\",\n      test: \"jest\",\n      \"test-update\": \"jest -u\",\n      format: 'prettier --write \"{lib,bin}/**/*.ts\"',\n      lint: \"eslint lib/** bin/** --no-error-on-unmatched-pattern\",\n      synth: \"cdk synth --path-metadata false --version-reporting false\",\n      diff: \"cdk diff --path-metadata false --version-reporting false\",\n    },\n    devDependencies,\n\n    prettier: \"@guardian/prettier\",\n\n    jest: {\n      testMatch: [\"<rootDir>/lib/**/*.test.ts\"],\n      transform: {\n        \"^.+\\\\.tsx?$\": \"ts-jest\",\n      },\n      setupFilesAfterEnv: [\"./jest.setup.js\"],\n    },\n  };\n  writeFileSync(`${outputDirectory}/package.json`, JSON.stringify(contents, null, 2));\n}\n"]}

package/lib/constructs/autoscaling/asg.d.ts

@@ -26,7 +26,6 @@ export interface GuAutoScalingGroupProps extends Omit<AutoScalingGroupProps, "im
     userData: UserData;
     additionalSecurityGroups?: ISecurityGroup[];
     targetGroup?: ApplicationTargetGroup;
-    withoutImdsv2?: boolean;
     httpPutResponseHopLimit?: number;
     enabledDetailedInstanceMonitoring?: boolean;
     defaultInstanceWarmup?: Duration;

package/lib/constructs/autoscaling/asg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asg.d.ts","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAgB,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAuB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAsB,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQpD,MAAM,WAAW,uBACf,SAAQ,IAAI,CACR,qBAAqB,EACnB,SAAS,GACT,QAAQ,GACR,cAAc,GACd,UAAU,GACV,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,eAAe,GACf,eAAe,CAClB,EACD,WAAW,EACX,aAAa;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,wBAAwB,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,iCAAiC,CAAC,EAAE,OAAO,CAAC;IAC5C,qBAAqB,CAAC,EAAE,QAAQ,CAAC;CAClC;;;;;;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kBAAmB,SAAQ,uBAAqC;IAC3E,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,cAAc,CAAC;IAC7C,SAAgB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAGlD,SAAgB,sBAAsB,EAAE,cAAc,CAAC;gBAE3C,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAiGvE"}
+{"version":3,"file":"asg.d.ts","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAgB,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAuB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAsB,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQpD,MAAM,WAAW,uBACf,SAAQ,IAAI,CACR,qBAAqB,EACnB,SAAS,GACT,QAAQ,GACR,cAAc,GACd,UAAU,GACV,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,eAAe,GACf,eAAe,CAClB,EACD,WAAW,EACX,aAAa;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,wBAAwB,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,iCAAiC,CAAC,EAAE,OAAO,CAAC;IAC5C,qBAAqB,CAAC,EAAE,QAAQ,CAAC;CAClC;;;;;;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kBAAmB,SAAQ,uBAAqC;IAC3E,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,cAAc,CAAC;IAC7C,SAAgB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAGlD,SAAgB,sBAAsB,EAAE,cAAc,CAAC;gBAE3C,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAwGvE"}

package/lib/constructs/autoscaling/asg.js

@@ -30,7 +30,7 @@ const iam_1 = require("../iam");
  */
 class GuAutoScalingGroup extends (0, app_aware_construct_1.GuAppAwareConstruct)(aws_autoscaling_1.AutoScalingGroup) {
     constructor(scope, id, props) {
-        const { app, additionalSecurityGroups = [], blockDevices, imageId = new core_1.GuAmiParameter(scope, { app }), imageRecipe, instanceType, groupMetrics = [aws_autoscaling_1.GroupMetrics.all()], minimumInstances, maximumInstances, role = new iam_1.GuInstanceRole(scope, { app }), targetGroup, userData, vpc, withoutImdsv2 = false, httpPutResponseHopLimit, updatePolicy, enabledDetailedInstanceMonitoring, defaultInstanceWarmup, } = props;
+        const { app, additionalSecurityGroups = [], blockDevices, imageId = new core_1.GuAmiParameter(scope, { app }), imageRecipe, instanceType, groupMetrics = [aws_autoscaling_1.GroupMetrics.all()], minimumInstances, maximumInstances, role = new iam_1.GuInstanceRole(scope, { app }), targetGroup, userData, vpc, httpPutResponseHopLimit, updatePolicy, enabledDetailedInstanceMonitoring, defaultInstanceWarmup, } = props;
         // Ensure min and max are defined in the same way. Throwing an `Error` when necessary. For example when min is defined via a Mapping, but max is not.
         if (aws_cdk_lib_1.Token.isUnresolved(minimumInstances) && !aws_cdk_lib_1.Token.isUnresolved(maximumInstances)) {
             throw new Error("minimumInstances is defined via a Mapping, but maximumInstances is not. Create maximumInstances via a Mapping too.");
@@ -53,7 +53,11 @@ class GuAutoScalingGroup extends (0, app_aware_construct_1.GuAppAwareConstruct)(
             // Do not use the default AWS security group which allows egress on any port.
             // Favour HTTPS only egress rules by default.
             securityGroup: ec2_1.GuHttpsEgressSecurityGroup.forVpc(scope, { app, vpc }),
-            requireImdsv2: !withoutImdsv2,
+            /*
+            Ensure we satisfy FSBP EC2.8 control. If needed, an escape hatch can override this.
+            See https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-8.
+             */
+            requireImdsv2: true,
             instanceMetadataTags: true,
             userData,
             role,
@@ -82,7 +86,9 @@ class GuAutoScalingGroup extends (0, app_aware_construct_1.GuAppAwareConstruct)(
         this.amiParameter = imageId;
         this.imageRecipe = imageRecipe;
         this.instanceLaunchTemplate = launchTemplate;
-        targetGroup && this.attachToApplicationTargetGroup(targetGroup);
+        if (targetGroup) {
+            this.attachToApplicationTargetGroup(targetGroup);
+        }
         const cfnAsg = this.node.defaultChild;
         // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group
         // leaves it to the default value, which is actually false.

package/lib/constructs/autoscaling/asg.js.map

@@ -1 +1 @@
-{"version":3,"file":"asg.js","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":";;;AACA,6CAA0C;AAC1C,iEAA6E;AAE7E,iDAA0E;AAK1E,+EAA4E;AAC5E,kCAAyC;AAEzC,gCAAmE;AACnE,gCAAwC;AA4CxC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,kCAAgB,CAAC;IAQ3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,MAAM,EACJ,GAAG,EACH,wBAAwB,GAAG,EAAE,EAC7B,YAAY,EACZ,OAAO,GAAG,IAAI,qBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAC5C,WAAW,EACX,YAAY,EACZ,YAAY,GAAG,CAAC,8BAAY,CAAC,GAAG,EAAE,CAAC,EACnC,gBAAgB,EAChB,gBAAgB,EAChB,IAAI,GAAG,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EACzC,WAAW,EACX,QAAQ,EACR,GAAG,EACH,aAAa,GAAG,KAAK,EACrB,uBAAuB,EACvB,YAAY,EACZ,iCAAiC,EACjC,qBAAqB,GACtB,GAAG,KAAK,CAAC;QAEV,qJAAqJ;QACrJ,IAAI,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE;YACjF,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;SACH;QAED,oCAAoC;QACpC,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,wBAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE;YACjE,YAAY;YACZ,kBAAkB,EAAE,iCAAiC;YACrD,YAAY;YACZ,YAAY,EAAE;gBACZ,QAAQ,EAAE,GAAuB,EAAE;oBACjC,OAAO;wBACL,MAAM,EAAE,6BAAmB,CAAC,KAAK;wBACjC,QAAQ;wBACR,OAAO,EAAE,OAAO,CAAC,aAAa;qBAC/B,CAAC;gBACJ,CAAC;aACF;YACD,6EAA6E;YAC7E,6CAA6C;YAC7C,aAAa,EAAE,gCAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YACrE,aAAa,EAAE,CAAC,aAAa;YAC7B,oBAAoB,EAAE,IAAI;YAC1B,QAAQ;YACR,IAAI;YACJ,uBAAuB;SACxB,CAAC,CAAC;QAEH,4DAA4D;QAC5D,kFAAkF;QAClF,8CAA8C;QAC9C,CAAC,mBAAa,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,wBAAwB,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAClF,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAChD,CAAC;QAEF,MAAM,QAAQ,GAA0B;YACtC,GAAG,KAAK;YACR,cAAc;YACd,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,GAAG,CAAC;YACrD,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,YAAY;YAE1B,iEAAiE;YACjE,yEAAyE;YACzE,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,SAAS;YACvB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,SAAS;YACnB,qBAAqB;SACtB,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,sBAAsB,GAAG,cAAc,CAAC;QAE7C,WAAW,IAAI,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;QAEhE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAmC,CAAC;QAE7D,yFAAyF;QACzF,2DAA2D;QAC3D,+FAA+F;QAC/F,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;SAC5C;QAED,kBAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;CACF;AAzGD,gDAyGC","sourcesContent":["import type { Duration } from \"aws-cdk-lib\";\nimport { Tags, Token } from \"aws-cdk-lib\";\nimport { AutoScalingGroup, GroupMetrics } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { AutoScalingGroupProps, CfnAutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport { LaunchTemplate, OperatingSystemType } from \"aws-cdk-lib/aws-ec2\";\nimport type { InstanceType, ISecurityGroup, MachineImageConfig, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { ApplicationTargetGroup } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuAsgCapacity } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport { GuAmiParameter } from \"../core\";\nimport type { AppIdentity, GuStack } from \"../core\";\nimport { GuHttpsEgressSecurityGroup, GuWazuhAccess } from \"../ec2\";\nimport { GuInstanceRole } from \"../iam\";\n\n// Since we want to override the types of what gets passed in for the below props,\n// we need to use Omit<T, U> to remove them from the interface this extends\n// https://www.typescriptlang.org/docs/handbook/utility-types.html#omittype-keys\n// TODO avoid prop nesting to improve discoverability. See https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#flat.\nexport interface GuAutoScalingGroupProps\n  extends Omit<\n      AutoScalingGroupProps,\n      | \"imageId\"\n      | \"osType\"\n      | \"machineImage\"\n      | \"userData\"\n      | \"minCapacity\"\n      | \"maxCapacity\"\n      | \"desiredCapacity\"\n      | \"requireImdsv2\"\n      | \"securityGroup\"\n    >,\n    AppIdentity,\n    GuAsgCapacity {\n  /**\n   * @deprecated\n   * It shouldn't be necessary to specify a value here.\n   * GuCDK will create an AMI parameter by default. Riff-Raff can use this parameter to inject the latest AMI ID for\n   * your AMIgo recipe.\n   */\n  imageId?: GuAmiParameter;\n  /**\n   * If you are using GuCDK to generate your riff-raff.yaml file, specify AMIgo props here.\n   * If you are using a hardcoded riff-raff.yaml file (usually found in project root) then providing a value here has no\n   * effect.\n   */\n  imageRecipe?: string | AmigoProps;\n  instanceType: InstanceType;\n  userData: UserData;\n  additionalSecurityGroups?: ISecurityGroup[];\n  targetGroup?: ApplicationTargetGroup;\n  withoutImdsv2?: boolean;\n  httpPutResponseHopLimit?: number;\n  enabledDetailedInstanceMonitoring?: boolean;\n  defaultInstanceWarmup?: Duration;\n}\n\n/**\n * Construct which creates an Auto Scaling group.\n *\n * By default, all EC2 instances in this group will use [[`GuInstanceRole`]],\n * which provides common permissions (e.g. the ability to download an artifact and write logs to the account's logging Kinesis stream).\n *\n * If additional IAM permissions are required, a custom role can be provided via the `role` prop.\n * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions\n * to be passed in.\n *\n * All EC2 instances in this group will be automatically associated with two security groups:\n * 1. [[`GuHttpsEgressSecurityGroup`]], which allows outbound traffic over HTTPS.\n * 2. [[`GuWazuhAccess`]], which allows instances to communicate with Wazuh (for security monitoring).\n *\n * If additional ingress or egress rules are required, define custom security groups and pass them in via the\n * `additionalSecurityGroups` prop.\n *\n * All EC2 instances provisioned via this construct will use\n * [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html).\n */\nexport class GuAutoScalingGroup extends GuAppAwareConstruct(AutoScalingGroup) {\n  public readonly app: string;\n  public readonly amiParameter: GuAmiParameter;\n  public readonly imageRecipe?: string | AmigoProps;\n\n  // Sadly this cannot be named `launchTemplate` as it would clash with a private property on the `AutoScalingGroup` class\n  public readonly instanceLaunchTemplate: LaunchTemplate;\n\n  constructor(scope: GuStack, id: string, props: GuAutoScalingGroupProps) {\n    const {\n      app,\n      additionalSecurityGroups = [],\n      blockDevices,\n      imageId = new GuAmiParameter(scope, { app }),\n      imageRecipe,\n      instanceType,\n      groupMetrics = [GroupMetrics.all()],\n      minimumInstances,\n      maximumInstances,\n      role = new GuInstanceRole(scope, { app }),\n      targetGroup,\n      userData,\n      vpc,\n      withoutImdsv2 = false,\n      httpPutResponseHopLimit,\n      updatePolicy,\n      enabledDetailedInstanceMonitoring,\n      defaultInstanceWarmup,\n    } = props;\n\n    // Ensure min and max are defined in the same way. Throwing an `Error` when necessary. For example when min is defined via a Mapping, but max is not.\n    if (Token.isUnresolved(minimumInstances) && !Token.isUnresolved(maximumInstances)) {\n      throw new Error(\n        \"minimumInstances is defined via a Mapping, but maximumInstances is not. Create maximumInstances via a Mapping too.\",\n      );\n    }\n\n    // Generate an ID unique to this app\n    const launchTemplateId = `${scope.stack}-${scope.stage}-${app}`;\n    const launchTemplate = new LaunchTemplate(scope, launchTemplateId, {\n      blockDevices,\n      detailedMonitoring: enabledDetailedInstanceMonitoring,\n      instanceType,\n      machineImage: {\n        getImage: (): MachineImageConfig => {\n          return {\n            osType: OperatingSystemType.LINUX,\n            userData,\n            imageId: imageId.valueAsString,\n          };\n        },\n      },\n      // Do not use the default AWS security group which allows egress on any port.\n      // Favour HTTPS only egress rules by default.\n      securityGroup: GuHttpsEgressSecurityGroup.forVpc(scope, { app, vpc }),\n      requireImdsv2: !withoutImdsv2,\n      instanceMetadataTags: true,\n      userData,\n      role,\n      httpPutResponseHopLimit,\n    });\n\n    // Add Wazuh & additional consumer specified Security Groups\n    // Note: Launch templates via CDK allow specifying only one SG, so use connections\n    // https://github.com/aws/aws-cdk/issues/18712\n    [GuWazuhAccess.getInstance(scope, vpc), ...additionalSecurityGroups].forEach((sg) =>\n      launchTemplate.connections.addSecurityGroup(sg),\n    );\n\n    const asgProps: AutoScalingGroupProps = {\n      ...props,\n      launchTemplate,\n      maxCapacity: maximumInstances ?? minimumInstances * 2,\n      minCapacity: minimumInstances,\n      groupMetrics: groupMetrics,\n\n      // Omit userData, instanceType, blockDevices & role from asgProps\n      // As this are specified by the LaunchTemplate and must not be duplicated\n      blockDevices: undefined,\n      instanceType: undefined,\n      role: undefined,\n      userData: undefined,\n      defaultInstanceWarmup,\n    };\n\n    super(scope, id, asgProps);\n\n    this.app = app;\n    this.amiParameter = imageId;\n    this.imageRecipe = imageRecipe;\n    this.instanceLaunchTemplate = launchTemplate;\n\n    targetGroup && this.attachToApplicationTargetGroup(targetGroup);\n\n    const cfnAsg = this.node.defaultChild as CfnAutoScalingGroup;\n\n    // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group\n    // leaves it to the default value, which is actually false.\n    // { UpdatePolicy: { autoScalingScheduledAction: { IgnoreUnmodifiedGroupSizeProperties: true }}\n    if (!updatePolicy) {\n      cfnAsg.addDeletionOverride(\"UpdatePolicy\");\n    }\n\n    Tags.of(launchTemplate).add(\"App\", app);\n  }\n}\n"]}
+{"version":3,"file":"asg.js","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":";;;AACA,6CAA0C;AAC1C,iEAA6E;AAE7E,iDAA0E;AAK1E,+EAA4E;AAC5E,kCAAyC;AAEzC,gCAAmE;AACnE,gCAAwC;AA2CxC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,kCAAgB,CAAC;IAQ3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,MAAM,EACJ,GAAG,EACH,wBAAwB,GAAG,EAAE,EAC7B,YAAY,EACZ,OAAO,GAAG,IAAI,qBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAC5C,WAAW,EACX,YAAY,EACZ,YAAY,GAAG,CAAC,8BAAY,CAAC,GAAG,EAAE,CAAC,EACnC,gBAAgB,EAChB,gBAAgB,EAChB,IAAI,GAAG,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EACzC,WAAW,EACX,QAAQ,EACR,GAAG,EACH,uBAAuB,EACvB,YAAY,EACZ,iCAAiC,EACjC,qBAAqB,GACtB,GAAG,KAAK,CAAC;QAEV,qJAAqJ;QACrJ,IAAI,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE;YACjF,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;SACH;QAED,oCAAoC;QACpC,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,wBAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE;YACjE,YAAY;YACZ,kBAAkB,EAAE,iCAAiC;YACrD,YAAY;YACZ,YAAY,EAAE;gBACZ,QAAQ,EAAE,GAAuB,EAAE;oBACjC,OAAO;wBACL,MAAM,EAAE,6BAAmB,CAAC,KAAK;wBACjC,QAAQ;wBACR,OAAO,EAAE,OAAO,CAAC,aAAa;qBAC/B,CAAC;gBACJ,CAAC;aACF;YACD,6EAA6E;YAC7E,6CAA6C;YAC7C,aAAa,EAAE,gCAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YAErE;;;eAGG;YACH,aAAa,EAAE,IAAI;YAEnB,oBAAoB,EAAE,IAAI;YAC1B,QAAQ;YACR,IAAI;YACJ,uBAAuB;SACxB,CAAC,CAAC;QAEH,4DAA4D;QAC5D,kFAAkF;QAClF,8CAA8C;QAC9C,CAAC,mBAAa,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,wBAAwB,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAClF,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAChD,CAAC;QAEF,MAAM,QAAQ,GAA0B;YACtC,GAAG,KAAK;YACR,cAAc;YACd,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,GAAG,CAAC;YACrD,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,YAAY;YAE1B,iEAAiE;YACjE,yEAAyE;YACzE,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,SAAS;YACvB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,SAAS;YACnB,qBAAqB;SACtB,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,sBAAsB,GAAG,cAAc,CAAC;QAE7C,IAAI,WAAW,EAAE;YACf,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;SAClD;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAmC,CAAC;QAE7D,yFAAyF;QACzF,2DAA2D;QAC3D,+FAA+F;QAC/F,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;SAC5C;QAED,kBAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;CACF;AAhHD,gDAgHC","sourcesContent":["import type { Duration } from \"aws-cdk-lib\";\nimport { Tags, Token } from \"aws-cdk-lib\";\nimport { AutoScalingGroup, GroupMetrics } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { AutoScalingGroupProps, CfnAutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport { LaunchTemplate, OperatingSystemType } from \"aws-cdk-lib/aws-ec2\";\nimport type { InstanceType, ISecurityGroup, MachineImageConfig, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { ApplicationTargetGroup } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuAsgCapacity } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport { GuAmiParameter } from \"../core\";\nimport type { AppIdentity, GuStack } from \"../core\";\nimport { GuHttpsEgressSecurityGroup, GuWazuhAccess } from \"../ec2\";\nimport { GuInstanceRole } from \"../iam\";\n\n// Since we want to override the types of what gets passed in for the below props,\n// we need to use Omit<T, U> to remove them from the interface this extends\n// https://www.typescriptlang.org/docs/handbook/utility-types.html#omittype-keys\n// TODO avoid prop nesting to improve discoverability. See https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#flat.\nexport interface GuAutoScalingGroupProps\n  extends Omit<\n      AutoScalingGroupProps,\n      | \"imageId\"\n      | \"osType\"\n      | \"machineImage\"\n      | \"userData\"\n      | \"minCapacity\"\n      | \"maxCapacity\"\n      | \"desiredCapacity\"\n      | \"requireImdsv2\"\n      | \"securityGroup\"\n    >,\n    AppIdentity,\n    GuAsgCapacity {\n  /**\n   * @deprecated\n   * It shouldn't be necessary to specify a value here.\n   * GuCDK will create an AMI parameter by default. Riff-Raff can use this parameter to inject the latest AMI ID for\n   * your AMIgo recipe.\n   */\n  imageId?: GuAmiParameter;\n  /**\n   * If you are using GuCDK to generate your riff-raff.yaml file, specify AMIgo props here.\n   * If you are using a hardcoded riff-raff.yaml file (usually found in project root) then providing a value here has no\n   * effect.\n   */\n  imageRecipe?: string | AmigoProps;\n  instanceType: InstanceType;\n  userData: UserData;\n  additionalSecurityGroups?: ISecurityGroup[];\n  targetGroup?: ApplicationTargetGroup;\n  httpPutResponseHopLimit?: number;\n  enabledDetailedInstanceMonitoring?: boolean;\n  defaultInstanceWarmup?: Duration;\n}\n\n/**\n * Construct which creates an Auto Scaling group.\n *\n * By default, all EC2 instances in this group will use [[`GuInstanceRole`]],\n * which provides common permissions (e.g. the ability to download an artifact and write logs to the account's logging Kinesis stream).\n *\n * If additional IAM permissions are required, a custom role can be provided via the `role` prop.\n * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions\n * to be passed in.\n *\n * All EC2 instances in this group will be automatically associated with two security groups:\n * 1. [[`GuHttpsEgressSecurityGroup`]], which allows outbound traffic over HTTPS.\n * 2. [[`GuWazuhAccess`]], which allows instances to communicate with Wazuh (for security monitoring).\n *\n * If additional ingress or egress rules are required, define custom security groups and pass them in via the\n * `additionalSecurityGroups` prop.\n *\n * All EC2 instances provisioned via this construct will use\n * [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html).\n */\nexport class GuAutoScalingGroup extends GuAppAwareConstruct(AutoScalingGroup) {\n  public readonly app: string;\n  public readonly amiParameter: GuAmiParameter;\n  public readonly imageRecipe?: string | AmigoProps;\n\n  // Sadly this cannot be named `launchTemplate` as it would clash with a private property on the `AutoScalingGroup` class\n  public readonly instanceLaunchTemplate: LaunchTemplate;\n\n  constructor(scope: GuStack, id: string, props: GuAutoScalingGroupProps) {\n    const {\n      app,\n      additionalSecurityGroups = [],\n      blockDevices,\n      imageId = new GuAmiParameter(scope, { app }),\n      imageRecipe,\n      instanceType,\n      groupMetrics = [GroupMetrics.all()],\n      minimumInstances,\n      maximumInstances,\n      role = new GuInstanceRole(scope, { app }),\n      targetGroup,\n      userData,\n      vpc,\n      httpPutResponseHopLimit,\n      updatePolicy,\n      enabledDetailedInstanceMonitoring,\n      defaultInstanceWarmup,\n    } = props;\n\n    // Ensure min and max are defined in the same way. Throwing an `Error` when necessary. For example when min is defined via a Mapping, but max is not.\n    if (Token.isUnresolved(minimumInstances) && !Token.isUnresolved(maximumInstances)) {\n      throw new Error(\n        \"minimumInstances is defined via a Mapping, but maximumInstances is not. Create maximumInstances via a Mapping too.\",\n      );\n    }\n\n    // Generate an ID unique to this app\n    const launchTemplateId = `${scope.stack}-${scope.stage}-${app}`;\n    const launchTemplate = new LaunchTemplate(scope, launchTemplateId, {\n      blockDevices,\n      detailedMonitoring: enabledDetailedInstanceMonitoring,\n      instanceType,\n      machineImage: {\n        getImage: (): MachineImageConfig => {\n          return {\n            osType: OperatingSystemType.LINUX,\n            userData,\n            imageId: imageId.valueAsString,\n          };\n        },\n      },\n      // Do not use the default AWS security group which allows egress on any port.\n      // Favour HTTPS only egress rules by default.\n      securityGroup: GuHttpsEgressSecurityGroup.forVpc(scope, { app, vpc }),\n\n      /*\n      Ensure we satisfy FSBP EC2.8 control. If needed, an escape hatch can override this.\n      See https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-8.\n       */\n      requireImdsv2: true,\n\n      instanceMetadataTags: true,\n      userData,\n      role,\n      httpPutResponseHopLimit,\n    });\n\n    // Add Wazuh & additional consumer specified Security Groups\n    // Note: Launch templates via CDK allow specifying only one SG, so use connections\n    // https://github.com/aws/aws-cdk/issues/18712\n    [GuWazuhAccess.getInstance(scope, vpc), ...additionalSecurityGroups].forEach((sg) =>\n      launchTemplate.connections.addSecurityGroup(sg),\n    );\n\n    const asgProps: AutoScalingGroupProps = {\n      ...props,\n      launchTemplate,\n      maxCapacity: maximumInstances ?? minimumInstances * 2,\n      minCapacity: minimumInstances,\n      groupMetrics: groupMetrics,\n\n      // Omit userData, instanceType, blockDevices & role from asgProps\n      // As this are specified by the LaunchTemplate and must not be duplicated\n      blockDevices: undefined,\n      instanceType: undefined,\n      role: undefined,\n      userData: undefined,\n      defaultInstanceWarmup,\n    };\n\n    super(scope, id, asgProps);\n\n    this.app = app;\n    this.amiParameter = imageId;\n    this.imageRecipe = imageRecipe;\n    this.instanceLaunchTemplate = launchTemplate;\n\n    if (targetGroup) {\n      this.attachToApplicationTargetGroup(targetGroup);\n    }\n\n    const cfnAsg = this.node.defaultChild as CfnAutoScalingGroup;\n\n    // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group\n    // leaves it to the default value, which is actually false.\n    // { UpdatePolicy: { autoScalingScheduledAction: { IgnoreUnmodifiedGroupSizeProperties: true }}\n    if (!updatePolicy) {\n      cfnAsg.addDeletionOverride(\"UpdatePolicy\");\n    }\n\n    Tags.of(launchTemplate).add(\"App\", app);\n  }\n}\n"]}

package/lib/constructs/iam/roles/instance-role.js

@@ -37,7 +37,7 @@ class GuInstanceRole extends (0, app_aware_construct_1.GuAppAwareConstruct)(role
             ...sharedPolicies,
             new policies_1.GuGetDistributablePolicy(scope, props),
             new policies_1.GuParameterStoreReadPolicy(scope, props),
-            ...(props.additionalPolicies ? props.additionalPolicies : []),
+            ...(props.additionalPolicies ?? []),
         ];
         policies.forEach((p) => p.attachToRole(this));
     }

package/lib/constructs/iam/roles/instance-role.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance-role.js","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/instance-role.ts"],"names":[],"mappings":";;;AAAA,iDAAuD;AACvD,kFAA+E;AAE/E,0CAKqB;AAErB,iDAAqD;AACrD,mCAAiC;AAgBjC;;;;;;;;;;;;;;GAcG;AACH,MAAa,cAAe,SAAQ,IAAA,yCAAmB,EAAC,cAAM,CAAC;IAC7D,YAAY,KAAc,EAAE,KAAiC;QAC3D,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE;YAC3B,IAAI,EAAE,GAAG;YACT,SAAS,EAAE,IAAI,0BAAgB,CAAC,mBAAmB,CAAC;YACpD,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG;YACrB,wBAAc,CAAC,WAAW,CAAC,KAAK,CAAC;YACjC,8BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;SAC9E,CAAC;QAEF,MAAM,QAAQ,GAAG;YACf,GAAG,cAAc;YACjB,IAAI,mCAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;YAC1C,IAAI,qCAA0B,CAAC,KAAK,EAAE,KAAK,CAAC;YAC5C,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QAEF,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;CACF;AAvBD,wCAuBC","sourcesContent":["import { ServicePrincipal } from \"aws-cdk-lib/aws-iam\";\nimport { GuAppAwareConstruct } from \"../../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../../core\";\nimport {\n  GuDescribeEC2Policy,\n  GuGetDistributablePolicy,\n  GuLogShippingPolicy,\n  GuParameterStoreReadPolicy,\n} from \"../policies\";\nimport type { GuPolicy } from \"../policies\";\nimport { GuSsmSshPolicy } from \"../policies/ssm-ssh\";\nimport { GuRole } from \"./roles\";\n\nexport interface GuInstanceRoleProps {\n  /**\n   * By default, instances are given permissions to write to Kinesis. Set to\n   * 'true' to prevent this. Note, disabling will prevent not just application\n   * logs being shipped but also anything else - for example, automatic log\n   * shipping of Cloud Init and other logs by the cdk-base role in your AMI.\n   */\n  withoutLogShipping?: boolean;\n\n  additionalPolicies?: GuPolicy[];\n}\n\nexport type GuInstanceRolePropsWithApp = GuInstanceRoleProps & AppIdentity;\n\n/**\n * Creates an IAM role with common policies that are needed by most Guardian applications.\n *\n * More specifically:\n * 1. Allows for `ssh` access to an EC2 instance via [ssm-scala](https://github.com/guardian/ssm-scala) (instead of standard `ssh`).\n * 2. Allows EC2 instances to communicate with Wazuh, for security monitoring.\n * 3. Allows EC2 instances to download an artifact from AWS S3, for application deployment.\n * 4. Allows EC2 instances to download private configuration from AWS Parameter Store. See [[`GuParameterStoreReadPolicy`]]\n * for specific details.\n * 5. Allows EC2 instances to write logs into our central ELK stack via Kinesis.\n *\n * If additional IAM permissions are required, create custom policies and pass them in via the `additionalPolicies` prop.\n *\n * If log shipping is not required, opt out by setting the `withoutLogShipping` prop to `true`.\n */\nexport class GuInstanceRole extends GuAppAwareConstruct(GuRole) {\n  constructor(scope: GuStack, props: GuInstanceRolePropsWithApp) {\n    super(scope, \"InstanceRole\", {\n      path: \"/\",\n      assumedBy: new ServicePrincipal(\"ec2.amazonaws.com\"),\n      ...props,\n    });\n\n    const sharedPolicies = [\n      GuSsmSshPolicy.getInstance(scope),\n      GuDescribeEC2Policy.getInstance(scope),\n      ...(props.withoutLogShipping ? [] : [GuLogShippingPolicy.getInstance(scope)]),\n    ];\n\n    const policies = [\n      ...sharedPolicies,\n      new GuGetDistributablePolicy(scope, props),\n      new GuParameterStoreReadPolicy(scope, props),\n      ...(props.additionalPolicies ? props.additionalPolicies : []),\n    ];\n\n    policies.forEach((p) => p.attachToRole(this));\n  }\n}\n"]}
+{"version":3,"file":"instance-role.js","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/instance-role.ts"],"names":[],"mappings":";;;AAAA,iDAAuD;AACvD,kFAA+E;AAE/E,0CAKqB;AAErB,iDAAqD;AACrD,mCAAiC;AAgBjC;;;;;;;;;;;;;;GAcG;AACH,MAAa,cAAe,SAAQ,IAAA,yCAAmB,EAAC,cAAM,CAAC;IAC7D,YAAY,KAAc,EAAE,KAAiC;QAC3D,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE;YAC3B,IAAI,EAAE,GAAG;YACT,SAAS,EAAE,IAAI,0BAAgB,CAAC,mBAAmB,CAAC;YACpD,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG;YACrB,wBAAc,CAAC,WAAW,CAAC,KAAK,CAAC;YACjC,8BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;SAC9E,CAAC;QAEF,MAAM,QAAQ,GAAG;YACf,GAAG,cAAc;YACjB,IAAI,mCAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;YAC1C,IAAI,qCAA0B,CAAC,KAAK,EAAE,KAAK,CAAC;YAC5C,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;SACpC,CAAC;QAEF,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;CACF;AAvBD,wCAuBC","sourcesContent":["import { ServicePrincipal } from \"aws-cdk-lib/aws-iam\";\nimport { GuAppAwareConstruct } from \"../../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../../core\";\nimport {\n  GuDescribeEC2Policy,\n  GuGetDistributablePolicy,\n  GuLogShippingPolicy,\n  GuParameterStoreReadPolicy,\n} from \"../policies\";\nimport type { GuPolicy } from \"../policies\";\nimport { GuSsmSshPolicy } from \"../policies/ssm-ssh\";\nimport { GuRole } from \"./roles\";\n\nexport interface GuInstanceRoleProps {\n  /**\n   * By default, instances are given permissions to write to Kinesis. Set to\n   * 'true' to prevent this. Note, disabling will prevent not just application\n   * logs being shipped but also anything else - for example, automatic log\n   * shipping of Cloud Init and other logs by the cdk-base role in your AMI.\n   */\n  withoutLogShipping?: boolean;\n\n  additionalPolicies?: GuPolicy[];\n}\n\nexport type GuInstanceRolePropsWithApp = GuInstanceRoleProps & AppIdentity;\n\n/**\n * Creates an IAM role with common policies that are needed by most Guardian applications.\n *\n * More specifically:\n * 1. Allows for `ssh` access to an EC2 instance via [ssm-scala](https://github.com/guardian/ssm-scala) (instead of standard `ssh`).\n * 2. Allows EC2 instances to communicate with Wazuh, for security monitoring.\n * 3. Allows EC2 instances to download an artifact from AWS S3, for application deployment.\n * 4. Allows EC2 instances to download private configuration from AWS Parameter Store. See [[`GuParameterStoreReadPolicy`]]\n * for specific details.\n * 5. Allows EC2 instances to write logs into our central ELK stack via Kinesis.\n *\n * If additional IAM permissions are required, create custom policies and pass them in via the `additionalPolicies` prop.\n *\n * If log shipping is not required, opt out by setting the `withoutLogShipping` prop to `true`.\n */\nexport class GuInstanceRole extends GuAppAwareConstruct(GuRole) {\n  constructor(scope: GuStack, props: GuInstanceRolePropsWithApp) {\n    super(scope, \"InstanceRole\", {\n      path: \"/\",\n      assumedBy: new ServicePrincipal(\"ec2.amazonaws.com\"),\n      ...props,\n    });\n\n    const sharedPolicies = [\n      GuSsmSshPolicy.getInstance(scope),\n      GuDescribeEC2Policy.getInstance(scope),\n      ...(props.withoutLogShipping ? [] : [GuLogShippingPolicy.getInstance(scope)]),\n    ];\n\n    const policies = [\n      ...sharedPolicies,\n      new GuGetDistributablePolicy(scope, props),\n      new GuParameterStoreReadPolicy(scope, props),\n      ...(props.additionalPolicies ?? []),\n    ];\n\n    policies.forEach((p) => p.attachToRole(this));\n  }\n}\n"]}

package/lib/patterns/ec2-app/base.d.ts

@@ -145,12 +145,6 @@ export interface GuEc2AppProps extends AppIdentity {
      * Specify certificate for the load balancer.
      */
     certificateProps?: GuDomainName;
-    /**
-     * Disable imdsv2. Most of the time you should not set this.
-     *
-     * @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
-     */
-    withoutImdsv2?: boolean;
     /**
      * Configure AMIgo image recipe. This is only necessary if you are using GuCDK to generate your riff-raff.yaml file.
      */

package/lib/patterns/ec2-app/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAQ7E,OAAO,KAAK,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAQ,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,IAAI,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAO5F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAc,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAMtG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAgE,MAAM,uBAAuB,CAAC;AAElH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGhE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,YAAY,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACxC;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACzC;;OAEG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD;;OAEG;IACH,QAAQ,EAAE,eAAe,GAAG,QAAQ,CAAC;IACrC;;;;;;OAMG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC;;OAEG;IACH,uBAAuB,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/C;;;OAGG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAC7C;;OAEG;IACH,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;OAEG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B;;OAEG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,YAAY,CAAC;IAChC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAE3B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAE1B;;OAEG;IACH,UAAU,CAAC,EAAE;QACX;;;;;;;;;;;;;;;;WAgBG;QACH,OAAO,EAAE,IAAI,CAAC;QACd;;;;WAIG;QACH,MAAM,EAAE,MAAM,CAAC;QACf;;;;;;;;;;WAUG;QACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB;;;;;;;;;WASG;QACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC;;;;;;;;;;;;;;;;;;WAkBG;QACH,6BAA6B,CAAC,EAAE,MAAM,CAAC;QAEvC;;;;;;WAMG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;OAEG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAE7B;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAElC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAE5B;;;;OAIG;IACH,iCAAiC,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,QAAQ,CAAC;CAClC;AAUD;;;;;;GAMG;AACH,qBAAa,QAAS,SAAQ,SAAS;IASrC,SAAgB,GAAG,EAAE,IAAI,CAAC;IAC1B,SAAgB,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5C,SAAgB,YAAY,EAAE,yBAAyB,CAAC;IACxD,SAAgB,gBAAgB,EAAE,kBAAkB,CAAC;IACrD,SAAgB,QAAQ,EAAE,0BAA0B,CAAC;IACrD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;gBAE1C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa;CAiUjD"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAQ7E,OAAO,KAAK,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAQ,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,IAAI,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAO5F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAc,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAMtG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAgE,MAAM,uBAAuB,CAAC;AAElH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGhE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,YAAY,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACxC;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACzC;;OAEG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD;;OAEG;IACH,QAAQ,EAAE,eAAe,GAAG,QAAQ,CAAC;IACrC;;;;;;OAMG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC;;OAEG;IACH,uBAAuB,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/C;;;OAGG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAC7C;;OAEG;IACH,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;OAEG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B;;OAEG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,YAAY,CAAC;IAEhC;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAE3B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAE1B;;OAEG;IACH,UAAU,CAAC,EAAE;QACX;;;;;;;;;;;;;;;;WAgBG;QACH,OAAO,EAAE,IAAI,CAAC;QACd;;;;WAIG;QACH,MAAM,EAAE,MAAM,CAAC;QACf;;;;;;;;;;WAUG;QACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB;;;;;;;;;WASG;QACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC;;;;;;;;;;;;;;;;;;WAkBG;QACH,6BAA6B,CAAC,EAAE,MAAM,CAAC;QAEvC;;;;;;WAMG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;OAEG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAE7B;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAElC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAE5B;;;;OAIG;IACH,iCAAiC,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,QAAQ,CAAC;CAClC;AAUD;;;;;;GAMG;AACH,qBAAa,QAAS,SAAQ,SAAS;IASrC,SAAgB,GAAG,EAAE,IAAI,CAAC;IAC1B,SAAgB,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5C,SAAgB,YAAY,EAAE,yBAAyB,CAAC;IACxD,SAAgB,gBAAgB,EAAE,kBAAkB,CAAC;IACrD,SAAgB,QAAQ,EAAE,0BAA0B,CAAC;IACrD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;gBAE1C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa;CA+TjD"}

package/lib/patterns/ec2-app/base.js

@@ -42,7 +42,7 @@ class GuEc2App extends constructs_1.Construct {
     constructor(scope, props) {
         const { access, accessLogging = { enabled: false }, app, 
         // We should update this default once a significant number of apps have migrated to devx-logs
-        applicationLogging = { enabled: false }, applicationPort, blockDevices, certificateProps, instanceType, monitoringConfiguration, roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] }, scaling: { minimumInstances, maximumInstances = minimumInstances * 2 }, userData: userDataLike, withoutImdsv2, imageRecipe, vpc = ec2_1.GuVpc.fromIdParameter(scope, core_1.AppIdentity.suffixText({ app }, "VPC")), privateSubnets = ec2_1.GuVpc.subnetsFromParameter(scope, { type: ec2_1.SubnetType.PRIVATE, app }), publicSubnets = ec2_1.GuVpc.subnetsFromParameter(scope, { type: ec2_1.SubnetType.PUBLIC, app }), instanceMetadataHopLimit, updatePolicy, enabledDetailedInstanceMonitoring, defaultInstanceWarmup, } = props;
+        applicationLogging = { enabled: false }, applicationPort, blockDevices, certificateProps, instanceType, monitoringConfiguration, roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] }, scaling: { minimumInstances, maximumInstances = minimumInstances * 2 }, userData: userDataLike, imageRecipe, vpc = ec2_1.GuVpc.fromIdParameter(scope, core_1.AppIdentity.suffixText({ app }, "VPC")), privateSubnets = ec2_1.GuVpc.subnetsFromParameter(scope, { type: ec2_1.SubnetType.PRIVATE, app }), publicSubnets = ec2_1.GuVpc.subnetsFromParameter(scope, { type: ec2_1.SubnetType.PUBLIC, app }), instanceMetadataHopLimit, updatePolicy, enabledDetailedInstanceMonitoring, defaultInstanceWarmup, } = props;
         super(scope, app); // The assumption is `app` is unique
         // We should really prevent users from doing this via the type system,
         // but that requires a breaking change to the API
@@ -72,7 +72,6 @@ class GuEc2App extends constructs_1.Construct {
             instanceType,
             minimumInstances,
             maximumInstances,
-            withoutImdsv2,
             role: new iam_1.GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),
             healthCheck: aws_autoscaling_1.HealthCheck.elb({ grace: aws_cdk_lib_1.Duration.minutes(2) }),
             userData: userData instanceof autoscaling_1.GuUserData ? userData.userData : userData,

package/lib/patterns/ec2-app/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;AAAA,uGAAuG;AACvG,6CAA0D;AAE1D,iEAA0D;AAC1D,yDAKiC;AAEjC,iDAAqD;AAErD,uFAA6F;AAC7F,uGAA2F;AAC3F,iDAA8D;AAC9D,uDAA+D;AAC/D,+CAA4C;AAC5C,iDAAsD;AACtD,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAIqC;AAErC,gDAAkH;AAClH,8CAAsG;AAEtG,8CAAgF;AAChF,oDAA2D;AAC3D,kEAIwC;AACxC,uCAAwC;AAGxC,yDAAsE;AA4RtE,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,aAAa,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAClC,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EAAE,YAAY,EACtB,aAAa,EACb,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EACnF,wBAAwB,EACxB,YAAY,EACZ,iCAAiC,EACjC,qBAAqB,GACtB,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,MAAM,QAAQ,GAAG,YAAY,YAAY,kBAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QAEnH,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,WAAW;YACrC,CAAC,CAAC,IAAI,mBAAa,CAAC,KAAK,EAAE;gBACvB,GAAG;gBACH,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,YAAY,EAAE,gBAAgB,CAAC,YAAY;aAC5C,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,wBAAwB,GAC5B,QAAQ,YAAY,wBAAU,IAAI,QAAQ,CAAC,aAAa;YACtD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,aAAa;YACb,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YACpE,WAAW,EAAE,6BAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,QAAQ,EAAE,QAAQ,YAAY,wBAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACvE,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;YACX,uBAAuB,EAAE,wBAAwB;YACjD,YAAY;YACZ,iCAAiC;YACjC,qBAAqB;SACtB,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;SACF,CAAC,CAAC;QAEH,IAAI,aAAa,CAAC,OAAO,EAAE;YACzB,MAAM,mBAAmB,GAAG,qCAA8B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAE9E,YAAY,CAAC,aAAa,CACxB,eAAM,CAAC,cAAc,CACnB,KAAK,EACL,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,qBAAqB,CAAC,EACpD,mBAAmB,CAAC,aAAa,CAClC,EACD,aAAa,CAAC,MAAM,CACrB,CAAC;SACH;QAED,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,IAAI,OAAO,WAAW,KAAK,WAAW;SAChF,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAEtG,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;YAC7B,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;YAEvD,MAAM,EACJ,aAAa,GAAG,CAAC,4BAA4B,CAAC,EAC9C,uBAAuB,GAAG,EAAE,EAC5B,6BAA6B,GAAG,GAAG,MAAM,0BAA0B,GACpE,GAAG,KAAK,CAAC,UAAU,CAAC;YAErB,IAAI,uBAAuB,GAAG,EAAE,EAAE;gBAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;aACtE;YAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC5B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;aAC9D;YAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAAE;gBACrE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;aAClF;YAED,MAAM,oBAAoB,GAAG,yBAAe,CAAC,uBAAuB,CAClE,KAAK,EACL,mCAAmC,EACnC,qCAAyB,CAAC,oBAAoB,CAAC,IAAI,CACpD,CAAC;YAEF,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,gBAAgB,IAAI,MAAM,CAAC;YAErE,sEAAsE;YACtE,4BAA4B;YAC5B,yDAAyD;YACzD,MAAM,qBAAqB,GAAG,4BAA4B,oBAAoB,CAAC,WAAW,oBAAoB,gBAAgB,oBAAoB,CAAC;YAEnJ,8CAA8C;YAC9C,oDAAoD;YACpD,MAAM,UAAU,GAAG,IAAI,yBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE;gBAC5D,GAAG,EAAE,GAAG;gBACR,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,oBAAO,CAAC,YAAY;gBAC7B,QAAQ,EAAE,UAAU,gBAAgB,kDAAkD;gBACtF,iBAAiB,EAAE,IAAI;gBACvB,qBAAqB,EAAE,IAAI;gBAC3B,cAAc,EAAE,qCAAyB,CAAC,8BAA8B,CAAC,IAAI;gBAC7E,YAAY,EAAE,yBAAY,CAAC,MAAM;gBACjC,WAAW,EAAE;oBACX,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;oBACvC,uBAAuB,EAAE,qBAAqB;iBAC/C;aACF,CAAC,CAAC;YAEH,UAAU,CAAC,eAAe,CACxB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,KAAK;gBACpB,OAAO,EAAE,CAAC,uBAAuB,CAAC;gBAClC,SAAS,EAAE,CAAC,qBAAqB,CAAC;aACnC,CAAC,CACH,CAAC;YAEF,yEAAyE;YACzE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,IAAI,sBAAQ,CAAC,IAAI,EAAE,WAAW,EAAE;gBAC/C,cAAc,EAAE;oBACd,iBAAiB,EAAE,UAAU;oBAC7B,SAAS,EAAE,UAAU;iBACtB;aACF,CAAC,CAAC;YAEH,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAEhF,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE;oBACb,YAAY,EAAE,IAAA,iCAAuB,EAAC,YAAY,CAAC;iBACpD;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACtG,MAAM,YAAY,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;YAE9G,MAAM,WAAW,GAAG,IAAI,4CAA8B,CAAC,KAAK,EAAE,YAAY,EAAE;gBAC1E,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,iBAAiB,EAAE,YAAY;gBAC/B,gBAAgB,EAAE;oBAChB,KAAK,EAAE,+BAAiB,CAAC,YAAY;oBACrC,SAAS,EAAE,+BAAiB,CAAC,iBAAiB;oBAC9C,UAAU,EAAE,+BAAiB,CAAC,kBAAkB;oBAChD,cAAc,EAAE,+BAAiB,CAAC,cAAc;oBAChD,MAAM,EAAE;wBACN,IAAI,EAAE,+BAAiB,CAAC,WAAW;qBACpC;iBACF;gBACD,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;aACvC,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;gBACtD,0BAA0B,EAAE,CAAC,4CAA8B,CAAC,MAAM,CAAC;gBACnE,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,WAAW,KAAK,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC;iBACxE;gBAED,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,mEAAmE;gBACnE,cAAc;gBACd,eAAe,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,mBAAmB,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtC,oBAAoB,EAAE,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC;YAEH,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAE/C,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE;gBAChC,MAAM,EAAE,IAAI,8DAAyB,CAAC;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,cAAc,EAAE,cAAc;oBAC9B,cAAc,EAAE,cAAc;oBAC9B,IAAI,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;oBAC3C,cAAc,EAAE,sBAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC;iBAC1D,CAAC;aACH,CAAC,CAAC;YAEH,qEAAqE;YACrE,MAAM,sBAAsB,GAAG,IAAI,gCAA0B,CAAC,KAAK,EAAE,YAAY,EAAE;gBACjF,GAAG;gBACH,GAAG;aACJ,CAAC,CAAC;YAEH,YAAY,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;SACvD;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAjVD,4BAiVC","sourcesContent":["/* eslint \"@guardian/tsdoc-required/tsdoc-required\": 2 -- to begin rolling this out for public APIs. */\nimport { Duration, SecretValue, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice, UpdatePolicy } from \"aws-cdk-lib/aws-autoscaling\";\nimport { HealthCheck } from \"aws-cdk-lib/aws-autoscaling\";\nimport {\n  ProviderAttribute,\n  UserPool,\n  UserPoolClientIdentityProvider,\n  UserPoolIdentityProviderGoogle,\n} from \"aws-cdk-lib/aws-cognito\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { HealthCheck as ALBHealthCheck } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { ApplicationProtocol, ListenerAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { AuthenticateCognitoAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2-actions\";\nimport { Effect, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Architecture, Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http4xxAlarmProps, Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport {\n  GuAlb4xxPercentageAlarm,\n  GuAlb5xxPercentageAlarm,\n  GuUnhealthyInstancesAlarm,\n} from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuAccessLoggingBucketParameter, GuLoggingStreamNameParameter } from \"../../constructs/core\";\nimport { GuHttpsEgressSecurityGroup, GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport { GuLambdaFunction } from \"../../constructs/lambda\";\nimport {\n  GuApplicationLoadBalancer,\n  GuApplicationTargetGroup,\n  GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { getUserPoolDomainPrefix } from \"../../utils/cognito/cognito\";\n\nexport interface AccessLoggingProps {\n  /**\n   * Enable (load balancer) access logs.\n   *\n   * Note, you will need to specify a region in your stack declaration to use\n   * this.\n   * See`https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html#logwbraccesswbrlogsbucket-prefix`\n   */\n  enabled: boolean;\n  /**\n   * S3 prefix for the logs.\n   *\n   * @defaultValue no prefix\n   */\n  prefix?: string;\n}\n\n/**\n * To ship your application logs to ELK automatically, you must:\n *\n * 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n *\n * Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n */\nexport interface ApplicationLoggingProps {\n  /**\n   * Enables forwarding of application logs to the Guardian ELK stack.\n   *\n   * Note, to work, you will need to also do the following non-CDK things:\n   *\n   * 1. Include the `cdk-base` Amigo role in your AMI.\n   * 2. Log to `journald`. We recommend doing this by logging to `stdout` and\n   *    using `systemd` to start your app\n   * 3. Confirm that your [[`systemdUnitName`]] is configured properly.\n   *\n   * Unless you have explicitly opted-out, appropriate IAM permissions for\n   * logging to Kinesis will be configured automatically via the [[`GuEc2App`]]\n   * pattern.\n   *\n   * @see https://github.com/guardian/amigo/tree/main/roles/cdk-base\n   */\n  enabled: boolean;\n  /**\n   * This needs to match the name of your SystemD unit.\n   *\n   * If your systemd unit is not `<app>.service` set this value.\n   *\n   * @defaultValue `<app>.service`\n   */\n  systemdUnitName?: string;\n}\n\n/**\n * @privateRemarks we should rename this to AlarmsProps.\n */\nexport interface Alarms {\n  /**\n   * Name of the target (SNS Topic) for alarm notifications.\n   */\n  snsTopicName: string;\n  /**\n   * Enable the 5xx alarm with settings.\n   */\n  http5xxAlarm: false | Http5xxAlarmProps;\n  /**\n   * Enable the 4xx alarm with settings.\n   */\n  http4xxAlarm?: false | Http4xxAlarmProps;\n  /**\n   * Enable the unhealthy instances alarm.\n   */\n  unhealthyInstancesAlarm: boolean;\n  /**\n   * Internal flag - users of this library should ignore this setting.\n   */\n  noMonitoring?: false;\n}\n\nexport interface GuEc2AppProps extends AppIdentity {\n  /**\n   * User data for the autoscaling group.\n   */\n  userData: GuUserDataProps | UserData;\n  /**\n   * Network access restrictions for your load balancer.\n   *\n   * Note, this merely provides defence in depth; you should, for example, limit\n   * access to the VPN and then treat that as sufficient. Instead, use Google\n   * Auth for human access, or a suitable machine auth mechanism.\n   */\n  access: AppAccess;\n  /**\n   * The port your application runs on.\n   */\n  applicationPort: number;\n  /**\n   * Configure IAM roles for autoscaling group EC2 instances.\n   */\n  roleConfiguration?: GuInstanceRoleProps;\n  /**\n   * Enable and configure alarms.\n   */\n  monitoringConfiguration: Alarms | NoMonitoring;\n  /**\n   * EC2 instance type. Note, ensure your code is built for the same\n   * architecture family (arm64 - 'Graviton' instances - or x64).\n   */\n  instanceType: InstanceType;\n  /**\n   * Enable and configures application logs.\n   */\n  applicationLogging?: ApplicationLoggingProps;\n  /**\n   * Enable and configures access logs.\n   */\n  accessLogging?: AccessLoggingProps;\n  /**\n   * Add block devices (additional storage).\n   */\n  blockDevices?: BlockDevice[];\n  /**\n   * Autoscaling group min and max sizes.\n   */\n  scaling: GuAsgCapacity;\n  /**\n   * Specify certificate for the load balancer.\n   */\n  certificateProps?: GuDomainName;\n  /**\n   * Disable imdsv2. Most of the time you should not set this.\n   *\n   * @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html\n   */\n  withoutImdsv2?: boolean;\n  /**\n   * Configure AMIgo image recipe. This is only necessary if you are using GuCDK to generate your riff-raff.yaml file.\n   */\n  imageRecipe?: string | AmigoProps;\n  /**\n   * Specify the VPC to use.\n   *\n   * @see https://github.com/guardian/aws-account-setup\n   */\n  vpc?: IVpc;\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  privateSubnets?: ISubnet[];\n\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  publicSubnets?: ISubnet[];\n\n  /**\n   * Configure Google Auth.\n   */\n  googleAuth?: {\n    /**\n     * Enables Google Auth (via Cognito). **Additional MANUAL steps required -\n     * see below.**\n     *\n     * Limits access to members of the allowed Google groups.\n     *\n     * Note, this does not currently support simultaneous machine access, so\n     * only set to true if you only require staff access to your service, or are\n     * supporting machine access in some other way.\n     *\n     * MANUAL STEPS: to get this to work, we need a Google Project and\n     * associated credentials. Full instructions can be found here:\n     *\n     * https://docs.google.com/document/d/1_k1FSE52AZHXufWLTiKTI3xy5cGpziyHazSHTKrYfco/edit?usp=sharing\n     *\n     * DevX hope to automate this process in the near future.\n     */\n    enabled: true;\n    /**\n     * The domain users will access your service.\n     *\n     * Set this to the same as for certificateProps.\n     */\n    domain: string;\n    /**\n     * Groups used for membership checks.\n     *\n     * If specified, cannot be empty. Users must be a member of at least one\n     * group to gain access.\n     *\n     * WARNING: groups must be specified with the `guardian.co.uk` domain, even\n     * if that is the non-idiomatic choice for daily use.\n     *\n     * @defaultValue [`engineering@guardian.co.uk`]\n     */\n    allowedGroups?: string[];\n    /**\n     * The number of minutes before the session expires.\n     *\n     * Set this value to a safe period of time that revoked users\n     * sessions will continue to function.\n     *\n     * NOTE: This value cannot be larger than 60 minutes.\n     *\n     * @defaultValue 15\n     */\n    sessionTimeoutInMinutes?: number;\n    /**\n     * Secrets Manager path containing Google OAuth2 Client credentials.\n     *\n     * NOTE: you do not need to set this value, but you DO need to generate and\n     * store the associated credentials in Secrets Manager.\n     *\n     * Credentials should be stored in Secrets Manager as JSON:\n     *\n     * ```json\n     * {\n     *   \"clientId\": \"my-client-id\",\n     *   \"clientSecret\": \"my-client-secret\"\n     * }\n     * ```\n     *\n     * @see `googleAuth.enabled` for how to generate.\n     *\n     * @defaultValue /:STAGE/:stack/:app/google-auth-credentials\n     */\n    credentialsSecretsManagerPath?: string;\n\n    /**\n     * When using Auth in the ALB, which stage of cognito-lambda to use.\n     *\n     * For most applications this should always be PROD, even in the CODE environments.\n     *\n     * @defaultValue PROD\n     */\n    cognitoAuthStage?: string;\n  };\n\n  /**\n   * Specify custom healthcheck\n   */\n  healthcheck?: ALBHealthCheck;\n\n  /**\n   * Set http put response hop limit for the launch template.\n   * It can be necessary to raise this value from the default of 1\n   * for example when sharing the instance profile with a docker container running on the instance.\n   */\n  instanceMetadataHopLimit?: number;\n\n  /**\n   * Specify an update policy for the ASG created by this pattern.\n   *\n   * @see https://docs.aws.amazon.com/cdk/api/latest/docs/aws-autoscaling-readme.html#update-policy\n   *\n   * @defaultValue UpdatePolicy.none() - Cloudformation does not attempt to rotate instances in the ASG\n   * and must rely on riffraff to do so.\n   */\n  updatePolicy?: UpdatePolicy;\n\n  /**\n   * This setting configures the launch template to enable or disable detailed monitoring on instances.\n   *\n   * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-launchtemplate-monitoring.html\n   */\n  enabledDetailedInstanceMonitoring?: boolean;\n  /**\n   * You can specify how long after an instance reaches the InService state it waits before contributing\n   * usage data to the aggregated metrics. This specified time is called the default instance warmup.\n   * This keeps dynamic scaling from being affected by metrics for individual instances that aren't yet\n   * handling application traffic and that might be experiencing temporarily high usage of compute resources.\n   *\n   * @see https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-default-instance-warmup.html\n   */\n  defaultInstanceWarmup?: Duration;\n}\n\nfunction restrictedCidrRanges(ranges: IPeer[]) {\n  return ranges.map((range) => ({\n    range,\n    port: Port.tcp(443),\n    description: `Allow access on port 443 from ${range.uniqueId}`,\n  }));\n}\n\n/**\n * Pattern which creates the resources needed to run an application on EC2\n * behind a load balancer. For convenience, you may wish to use [[`GuPlayApp`]]\n * or [[`GuNodeApp`]], which extend this class.\n *\n * See props for further details.\n */\nexport class GuEc2App extends Construct {\n  /*\n   * These are public for now, as this allows users to\n   * modify these constructs as desired to fit their\n   * specific needs.\n   * In the future, we might build functionality to better enable users\n   * to access in-pattern constructs, but this would allow teams to be unblocked\n   * in the short term.\n   * */\n  public readonly vpc: IVpc;\n  public readonly certificate?: GuCertificate;\n  public readonly loadBalancer: GuApplicationLoadBalancer;\n  public readonly autoScalingGroup: GuAutoScalingGroup;\n  public readonly listener: GuHttpsApplicationListener;\n  public readonly targetGroup: GuApplicationTargetGroup;\n\n  constructor(scope: GuStack, props: GuEc2AppProps) {\n    const {\n      access,\n      accessLogging = { enabled: false },\n      app,\n      // We should update this default once a significant number of apps have migrated to devx-logs\n      applicationLogging = { enabled: false },\n      applicationPort,\n      blockDevices,\n      certificateProps,\n      instanceType,\n      monitoringConfiguration,\n      roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n      scaling: { minimumInstances, maximumInstances = minimumInstances * 2 },\n      userData: userDataLike,\n      withoutImdsv2,\n      imageRecipe,\n      vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n      privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n      publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n      instanceMetadataHopLimit,\n      updatePolicy,\n      enabledDetailedInstanceMonitoring,\n      defaultInstanceWarmup,\n    } = props;\n\n    super(scope, app); // The assumption is `app` is unique\n\n    // We should really prevent users from doing this via the type system,\n    // but that requires a breaking change to the API\n    if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n      throw new Error(\n        \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n          \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\",\n      );\n    }\n\n    const userData = userDataLike instanceof UserData ? userDataLike : new GuUserData(scope, { ...userDataLike, app });\n\n    AppAccess.validate(access);\n\n    const certificate =\n      typeof certificateProps !== \"undefined\"\n        ? new GuCertificate(scope, {\n            app,\n            domainName: certificateProps.domainName,\n            hostedZoneId: certificateProps.hostedZoneId,\n          })\n        : undefined;\n\n    const maybePrivateConfigPolicy =\n      userData instanceof GuUserData && userData.configuration\n        ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n        : [];\n\n    const mergedRoleConfiguration: GuInstanceRoleProps = {\n      withoutLogShipping: roleConfiguration.withoutLogShipping,\n      additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n    };\n\n    const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n      app,\n      vpc,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      withoutImdsv2,\n      role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n      healthCheck: HealthCheck.elb({ grace: Duration.minutes(2) }), // should this be defaulted at pattern or construct level?\n      userData: userData instanceof GuUserData ? userData.userData : userData,\n      vpcSubnets: { subnets: privateSubnets },\n      ...(blockDevices && { blockDevices }),\n      imageRecipe,\n      httpPutResponseHopLimit: instanceMetadataHopLimit,\n      updatePolicy,\n      enabledDetailedInstanceMonitoring,\n      defaultInstanceWarmup,\n    });\n\n    // This allows automatic shipping of instance Cloud Init logs when using the\n    // `cdk-base` Amigo role on your AMI.\n    Tags.of(autoScalingGroup).add(\n      MetadataKeys.LOG_KINESIS_STREAM_NAME,\n      GuLoggingStreamNameParameter.getInstance(scope).valueAsString,\n    );\n\n    if (applicationLogging.enabled) {\n      // This allows automatic shipping of application logs when using the\n      // `cdk-base` Amigo role on your AMI.\n      Tags.of(autoScalingGroup).add(\n        MetadataKeys.SYSTEMD_UNIT,\n        applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`,\n      );\n    }\n\n    const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n      app,\n      vpc,\n      // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n      internetFacing: access.scope !== AccessScope.INTERNAL,\n      vpcSubnets: {\n        subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n      },\n    });\n\n    if (accessLogging.enabled) {\n      const accessLoggingBucket = GuAccessLoggingBucketParameter.getInstance(scope);\n\n      loadBalancer.logAccessLogs(\n        Bucket.fromBucketName(\n          scope,\n          AppIdentity.suffixText(props, \"AccessLoggingBucket\"),\n          accessLoggingBucket.valueAsString,\n        ),\n        accessLogging.prefix,\n      );\n    }\n\n    const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n      app,\n      vpc,\n      protocol: ApplicationProtocol.HTTP,\n      targets: [autoScalingGroup],\n      port: applicationPort,\n      healthCheck: props.healthcheck,\n    });\n\n    const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n      app,\n      loadBalancer,\n      certificate,\n      targetGroup,\n      // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n      open: access.scope === AccessScope.PUBLIC && typeof certificate !== \"undefined\",\n    });\n\n    // Since AWS won't create a security group automatically when open=false, we need to add our own\n    if (access.scope !== AccessScope.PUBLIC) {\n      loadBalancer.addSecurityGroup(\n        new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n          app,\n          vpc,\n          description: \"Allow restricted ingress from CIDR ranges\",\n          allowAllOutbound: false,\n          ingresses: restrictedCidrRanges(access.cidrRanges),\n        }),\n      );\n    }\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const { http5xxAlarm, http4xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n      if (http4xxAlarm) {\n        new GuAlb4xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http4xxAlarm,\n        });\n      }\n      if (http5xxAlarm) {\n        new GuAlb5xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http5xxAlarm,\n        });\n      }\n      if (unhealthyInstancesAlarm) {\n        new GuUnhealthyInstancesAlarm(scope, {\n          app,\n          targetGroup,\n          snsTopicName,\n        });\n      }\n    }\n\n    if (props.googleAuth?.enabled) {\n      const prefix = `/${scope.stage}/${scope.stack}/${app}`;\n\n      const {\n        allowedGroups = [\"engineering@guardian.co.uk\"],\n        sessionTimeoutInMinutes = 15,\n        credentialsSecretsManagerPath = `${prefix}/google-auth-credentials`,\n      } = props.googleAuth;\n\n      if (sessionTimeoutInMinutes > 60) {\n        throw new Error(\"googleAuth.sessionTimeoutInMinutes must be <= 60!\");\n      }\n\n      if (allowedGroups.length < 1) {\n        throw new Error(\"googleAuth.allowedGroups cannot be empty!\");\n      }\n\n      if (allowedGroups.find((group) => !group.endsWith(\"@guardian.co.uk\"))) {\n        throw new Error(\"googleAuth.allowedGroups must use the @guardian.co.uk domain.\");\n      }\n\n      const deployToolsAccountId = StringParameter.fromStringParameterName(\n        scope,\n        \"deploy-tools-account-id-parameter\",\n        NAMED_SSM_PARAMETER_PATHS.DeployToolsAccountId.path,\n      );\n\n      const cognitoAuthStage = props.googleAuth.cognitoAuthStage ?? \"PROD\";\n\n      // See https://github.com/guardian/cognito-auth-lambdas for the source\n      // code here. ARN format is:\n      // arn:aws:lambda:aws-region:acct-id:function:helloworld.\n      const gatekeeperFunctionArn = `arn:aws:lambda:eu-west-1:${deployToolsAccountId.stringValue}:function:deploy-${cognitoAuthStage}-gatekeeper-lambda`;\n\n      // Note, handler and filename must match here:\n      // https://github.com/guardian/cognito-auth-lambdas.\n      const authLambda = new GuLambdaFunction(scope, \"auth-lambda\", {\n        app: app,\n        memorySize: 128,\n        handler: \"bootstrap\",\n        runtime: Runtime.PROVIDED_AL2,\n        fileName: `deploy/${cognitoAuthStage}/cognito-lambda/devx-cognito-lambda-amd64-v2.zip`,\n        withoutFilePrefix: true,\n        withoutArtifactUpload: true,\n        bucketNamePath: NAMED_SSM_PARAMETER_PATHS.OrganisationDistributionBucket.path,\n        architecture: Architecture.X86_64,\n        environment: {\n          ALLOWED_GROUPS: allowedGroups.join(\",\"),\n          GATEKEEPER_FUNCTION_ARN: gatekeeperFunctionArn,\n        },\n      });\n\n      authLambda.addToRolePolicy(\n        new PolicyStatement({\n          effect: Effect.ALLOW,\n          actions: [\"lambda:InvokeFunction\"],\n          resources: [gatekeeperFunctionArn],\n        }),\n      );\n\n      // Cognito user pool. We require both lambdas: pre-sign-up runs the first\n      // time a user attempts to authenticate (before they exist in the User\n      // Pool); pre-auth runs in subsequent authentication flows.\n      const userPool = new UserPool(this, \"user-pool\", {\n        lambdaTriggers: {\n          preAuthentication: authLambda,\n          preSignUp: authLambda,\n        },\n      });\n\n      // These help ensure domain is deterministic but also unique. Key\n      // assumption is that app/stack/stage combo are unique within Guardian.\n      const domainPrefix = `com-gu-${app.toLowerCase()}-${scope.stage.toLowerCase()}`;\n\n      const userPoolDomain = userPool.addDomain(\"domain\", {\n        cognitoDomain: {\n          domainPrefix: getUserPoolDomainPrefix(domainPrefix),\n        },\n      });\n\n      const clientId = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientId\" });\n      const clientSecret = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientSecret\" });\n\n      const userPoolIdp = new UserPoolIdentityProviderGoogle(scope, \"google-idp\", {\n        userPool: userPool,\n        clientId: clientId.toString(),\n        clientSecretValue: clientSecret,\n        attributeMapping: {\n          email: ProviderAttribute.GOOGLE_EMAIL,\n          givenName: ProviderAttribute.GOOGLE_GIVEN_NAME,\n          familyName: ProviderAttribute.GOOGLE_FAMILY_NAME,\n          profilePicture: ProviderAttribute.GOOGLE_PICTURE,\n          custom: {\n            name: ProviderAttribute.GOOGLE_NAME,\n          },\n        },\n        scopes: [\"openid\", \"email\", \"profile\"],\n      });\n\n      const userPoolClient = userPool.addClient(\"alb-client\", {\n        supportedIdentityProviders: [UserPoolClientIdentityProvider.GOOGLE],\n        generateSecret: true,\n        oAuth: {\n          callbackUrls: [`https://${props.googleAuth.domain}/oauth2/idpresponse`],\n        },\n\n        // Note: id and access validity token validity cannot be less than one\n        // hour (this is the cognito cookie duration). To quickly invalidate\n        // credentials, disable the user in Cognito. It might be that we want to\n        // parameterise these going forward, but that would require Infosec\n        // discussion.\n        idTokenValidity: Duration.hours(1),\n        accessTokenValidity: Duration.hours(1),\n        refreshTokenValidity: Duration.days(7),\n      });\n\n      userPoolClient.node.addDependency(userPoolIdp);\n\n      listener.addAction(\"CognitoAuth\", {\n        action: new AuthenticateCognitoAction({\n          userPool: userPool,\n          userPoolClient: userPoolClient,\n          userPoolDomain: userPoolDomain,\n          next: ListenerAction.forward([targetGroup]),\n          sessionTimeout: Duration.minutes(sessionTimeoutInMinutes),\n        }),\n      });\n\n      // Need to give the ALB outbound access on 443 for the IdP endpoints.\n      const idpEgressSecurityGroup = new GuHttpsEgressSecurityGroup(scope, \"ldp-access\", {\n        app,\n        vpc,\n      });\n\n      loadBalancer.addSecurityGroup(idpEgressSecurityGroup);\n    }\n\n    this.vpc = vpc;\n    this.certificate = certificate;\n    this.loadBalancer = loadBalancer;\n    this.autoScalingGroup = autoScalingGroup;\n    this.listener = listener;\n    this.targetGroup = targetGroup;\n  }\n}\n"]}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;AAAA,uGAAuG;AACvG,6CAA0D;AAE1D,iEAA0D;AAC1D,yDAKiC;AAEjC,iDAAqD;AAErD,uFAA6F;AAC7F,uGAA2F;AAC3F,iDAA8D;AAC9D,uDAA+D;AAC/D,+CAA4C;AAC5C,iDAAsD;AACtD,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAIqC;AAErC,gDAAkH;AAClH,8CAAsG;AAEtG,8CAAgF;AAChF,oDAA2D;AAC3D,kEAIwC;AACxC,uCAAwC;AAGxC,yDAAsE;AAuRtE,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,aAAa,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAClC,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EAAE,YAAY,EACtB,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EACnF,wBAAwB,EACxB,YAAY,EACZ,iCAAiC,EACjC,qBAAqB,GACtB,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,MAAM,QAAQ,GAAG,YAAY,YAAY,kBAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QAEnH,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,WAAW;YACrC,CAAC,CAAC,IAAI,mBAAa,CAAC,KAAK,EAAE;gBACvB,GAAG;gBACH,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,YAAY,EAAE,gBAAgB,CAAC,YAAY;aAC5C,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,wBAAwB,GAC5B,QAAQ,YAAY,wBAAU,IAAI,QAAQ,CAAC,aAAa;YACtD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YACpE,WAAW,EAAE,6BAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,QAAQ,EAAE,QAAQ,YAAY,wBAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACvE,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;YACX,uBAAuB,EAAE,wBAAwB;YACjD,YAAY;YACZ,iCAAiC;YACjC,qBAAqB;SACtB,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;SACF,CAAC,CAAC;QAEH,IAAI,aAAa,CAAC,OAAO,EAAE;YACzB,MAAM,mBAAmB,GAAG,qCAA8B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAE9E,YAAY,CAAC,aAAa,CACxB,eAAM,CAAC,cAAc,CACnB,KAAK,EACL,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,qBAAqB,CAAC,EACpD,mBAAmB,CAAC,aAAa,CAClC,EACD,aAAa,CAAC,MAAM,CACrB,CAAC;SACH;QAED,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,IAAI,OAAO,WAAW,KAAK,WAAW;SAChF,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAEtG,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;YAC7B,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;YAEvD,MAAM,EACJ,aAAa,GAAG,CAAC,4BAA4B,CAAC,EAC9C,uBAAuB,GAAG,EAAE,EAC5B,6BAA6B,GAAG,GAAG,MAAM,0BAA0B,GACpE,GAAG,KAAK,CAAC,UAAU,CAAC;YAErB,IAAI,uBAAuB,GAAG,EAAE,EAAE;gBAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;aACtE;YAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC5B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;aAC9D;YAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAAE;gBACrE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;aAClF;YAED,MAAM,oBAAoB,GAAG,yBAAe,CAAC,uBAAuB,CAClE,KAAK,EACL,mCAAmC,EACnC,qCAAyB,CAAC,oBAAoB,CAAC,IAAI,CACpD,CAAC;YAEF,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,gBAAgB,IAAI,MAAM,CAAC;YAErE,sEAAsE;YACtE,4BAA4B;YAC5B,yDAAyD;YACzD,MAAM,qBAAqB,GAAG,4BAA4B,oBAAoB,CAAC,WAAW,oBAAoB,gBAAgB,oBAAoB,CAAC;YAEnJ,8CAA8C;YAC9C,oDAAoD;YACpD,MAAM,UAAU,GAAG,IAAI,yBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE;gBAC5D,GAAG,EAAE,GAAG;gBACR,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,oBAAO,CAAC,YAAY;gBAC7B,QAAQ,EAAE,UAAU,gBAAgB,kDAAkD;gBACtF,iBAAiB,EAAE,IAAI;gBACvB,qBAAqB,EAAE,IAAI;gBAC3B,cAAc,EAAE,qCAAyB,CAAC,8BAA8B,CAAC,IAAI;gBAC7E,YAAY,EAAE,yBAAY,CAAC,MAAM;gBACjC,WAAW,EAAE;oBACX,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;oBACvC,uBAAuB,EAAE,qBAAqB;iBAC/C;aACF,CAAC,CAAC;YAEH,UAAU,CAAC,eAAe,CACxB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,KAAK;gBACpB,OAAO,EAAE,CAAC,uBAAuB,CAAC;gBAClC,SAAS,EAAE,CAAC,qBAAqB,CAAC;aACnC,CAAC,CACH,CAAC;YAEF,yEAAyE;YACzE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,IAAI,sBAAQ,CAAC,IAAI,EAAE,WAAW,EAAE;gBAC/C,cAAc,EAAE;oBACd,iBAAiB,EAAE,UAAU;oBAC7B,SAAS,EAAE,UAAU;iBACtB;aACF,CAAC,CAAC;YAEH,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAEhF,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE;oBACb,YAAY,EAAE,IAAA,iCAAuB,EAAC,YAAY,CAAC;iBACpD;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACtG,MAAM,YAAY,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;YAE9G,MAAM,WAAW,GAAG,IAAI,4CAA8B,CAAC,KAAK,EAAE,YAAY,EAAE;gBAC1E,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,iBAAiB,EAAE,YAAY;gBAC/B,gBAAgB,EAAE;oBAChB,KAAK,EAAE,+BAAiB,CAAC,YAAY;oBACrC,SAAS,EAAE,+BAAiB,CAAC,iBAAiB;oBAC9C,UAAU,EAAE,+BAAiB,CAAC,kBAAkB;oBAChD,cAAc,EAAE,+BAAiB,CAAC,cAAc;oBAChD,MAAM,EAAE;wBACN,IAAI,EAAE,+BAAiB,CAAC,WAAW;qBACpC;iBACF;gBACD,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;aACvC,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;gBACtD,0BAA0B,EAAE,CAAC,4CAA8B,CAAC,MAAM,CAAC;gBACnE,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,WAAW,KAAK,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC;iBACxE;gBAED,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,mEAAmE;gBACnE,cAAc;gBACd,eAAe,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,mBAAmB,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtC,oBAAoB,EAAE,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC;YAEH,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAE/C,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE;gBAChC,MAAM,EAAE,IAAI,8DAAyB,CAAC;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,cAAc,EAAE,cAAc;oBAC9B,cAAc,EAAE,cAAc;oBAC9B,IAAI,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;oBAC3C,cAAc,EAAE,sBAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC;iBAC1D,CAAC;aACH,CAAC,CAAC;YAEH,qEAAqE;YACrE,MAAM,sBAAsB,GAAG,IAAI,gCAA0B,CAAC,KAAK,EAAE,YAAY,EAAE;gBACjF,GAAG;gBACH,GAAG;aACJ,CAAC,CAAC;YAEH,YAAY,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;SACvD;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AA/UD,4BA+UC","sourcesContent":["/* eslint \"@guardian/tsdoc-required/tsdoc-required\": 2 -- to begin rolling this out for public APIs. */\nimport { Duration, SecretValue, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice, UpdatePolicy } from \"aws-cdk-lib/aws-autoscaling\";\nimport { HealthCheck } from \"aws-cdk-lib/aws-autoscaling\";\nimport {\n  ProviderAttribute,\n  UserPool,\n  UserPoolClientIdentityProvider,\n  UserPoolIdentityProviderGoogle,\n} from \"aws-cdk-lib/aws-cognito\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { HealthCheck as ALBHealthCheck } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { ApplicationProtocol, ListenerAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { AuthenticateCognitoAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2-actions\";\nimport { Effect, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Architecture, Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { Bucket } from \"aws-cdk-lib/aws-s3\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http4xxAlarmProps, Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport {\n  GuAlb4xxPercentageAlarm,\n  GuAlb5xxPercentageAlarm,\n  GuUnhealthyInstancesAlarm,\n} from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuAccessLoggingBucketParameter, GuLoggingStreamNameParameter } from \"../../constructs/core\";\nimport { GuHttpsEgressSecurityGroup, GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport { GuLambdaFunction } from \"../../constructs/lambda\";\nimport {\n  GuApplicationLoadBalancer,\n  GuApplicationTargetGroup,\n  GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { getUserPoolDomainPrefix } from \"../../utils/cognito/cognito\";\n\nexport interface AccessLoggingProps {\n  /**\n   * Enable (load balancer) access logs.\n   *\n   * Note, you will need to specify a region in your stack declaration to use\n   * this.\n   * See`https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html#logwbraccesswbrlogsbucket-prefix`\n   */\n  enabled: boolean;\n  /**\n   * S3 prefix for the logs.\n   *\n   * @defaultValue no prefix\n   */\n  prefix?: string;\n}\n\n/**\n * To ship your application logs to ELK automatically, you must:\n *\n * 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n *\n * Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n */\nexport interface ApplicationLoggingProps {\n  /**\n   * Enables forwarding of application logs to the Guardian ELK stack.\n   *\n   * Note, to work, you will need to also do the following non-CDK things:\n   *\n   * 1. Include the `cdk-base` Amigo role in your AMI.\n   * 2. Log to `journald`. We recommend doing this by logging to `stdout` and\n   *    using `systemd` to start your app\n   * 3. Confirm that your [[`systemdUnitName`]] is configured properly.\n   *\n   * Unless you have explicitly opted-out, appropriate IAM permissions for\n   * logging to Kinesis will be configured automatically via the [[`GuEc2App`]]\n   * pattern.\n   *\n   * @see https://github.com/guardian/amigo/tree/main/roles/cdk-base\n   */\n  enabled: boolean;\n  /**\n   * This needs to match the name of your SystemD unit.\n   *\n   * If your systemd unit is not `<app>.service` set this value.\n   *\n   * @defaultValue `<app>.service`\n   */\n  systemdUnitName?: string;\n}\n\n/**\n * @privateRemarks we should rename this to AlarmsProps.\n */\nexport interface Alarms {\n  /**\n   * Name of the target (SNS Topic) for alarm notifications.\n   */\n  snsTopicName: string;\n  /**\n   * Enable the 5xx alarm with settings.\n   */\n  http5xxAlarm: false | Http5xxAlarmProps;\n  /**\n   * Enable the 4xx alarm with settings.\n   */\n  http4xxAlarm?: false | Http4xxAlarmProps;\n  /**\n   * Enable the unhealthy instances alarm.\n   */\n  unhealthyInstancesAlarm: boolean;\n  /**\n   * Internal flag - users of this library should ignore this setting.\n   */\n  noMonitoring?: false;\n}\n\nexport interface GuEc2AppProps extends AppIdentity {\n  /**\n   * User data for the autoscaling group.\n   */\n  userData: GuUserDataProps | UserData;\n  /**\n   * Network access restrictions for your load balancer.\n   *\n   * Note, this merely provides defence in depth; you should, for example, limit\n   * access to the VPN and then treat that as sufficient. Instead, use Google\n   * Auth for human access, or a suitable machine auth mechanism.\n   */\n  access: AppAccess;\n  /**\n   * The port your application runs on.\n   */\n  applicationPort: number;\n  /**\n   * Configure IAM roles for autoscaling group EC2 instances.\n   */\n  roleConfiguration?: GuInstanceRoleProps;\n  /**\n   * Enable and configure alarms.\n   */\n  monitoringConfiguration: Alarms | NoMonitoring;\n  /**\n   * EC2 instance type. Note, ensure your code is built for the same\n   * architecture family (arm64 - 'Graviton' instances - or x64).\n   */\n  instanceType: InstanceType;\n  /**\n   * Enable and configures application logs.\n   */\n  applicationLogging?: ApplicationLoggingProps;\n  /**\n   * Enable and configures access logs.\n   */\n  accessLogging?: AccessLoggingProps;\n  /**\n   * Add block devices (additional storage).\n   */\n  blockDevices?: BlockDevice[];\n  /**\n   * Autoscaling group min and max sizes.\n   */\n  scaling: GuAsgCapacity;\n  /**\n   * Specify certificate for the load balancer.\n   */\n  certificateProps?: GuDomainName;\n\n  /**\n   * Configure AMIgo image recipe. This is only necessary if you are using GuCDK to generate your riff-raff.yaml file.\n   */\n  imageRecipe?: string | AmigoProps;\n  /**\n   * Specify the VPC to use.\n   *\n   * @see https://github.com/guardian/aws-account-setup\n   */\n  vpc?: IVpc;\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  privateSubnets?: ISubnet[];\n\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  publicSubnets?: ISubnet[];\n\n  /**\n   * Configure Google Auth.\n   */\n  googleAuth?: {\n    /**\n     * Enables Google Auth (via Cognito). **Additional MANUAL steps required -\n     * see below.**\n     *\n     * Limits access to members of the allowed Google groups.\n     *\n     * Note, this does not currently support simultaneous machine access, so\n     * only set to true if you only require staff access to your service, or are\n     * supporting machine access in some other way.\n     *\n     * MANUAL STEPS: to get this to work, we need a Google Project and\n     * associated credentials. Full instructions can be found here:\n     *\n     * https://docs.google.com/document/d/1_k1FSE52AZHXufWLTiKTI3xy5cGpziyHazSHTKrYfco/edit?usp=sharing\n     *\n     * DevX hope to automate this process in the near future.\n     */\n    enabled: true;\n    /**\n     * The domain users will access your service.\n     *\n     * Set this to the same as for certificateProps.\n     */\n    domain: string;\n    /**\n     * Groups used for membership checks.\n     *\n     * If specified, cannot be empty. Users must be a member of at least one\n     * group to gain access.\n     *\n     * WARNING: groups must be specified with the `guardian.co.uk` domain, even\n     * if that is the non-idiomatic choice for daily use.\n     *\n     * @defaultValue [`engineering@guardian.co.uk`]\n     */\n    allowedGroups?: string[];\n    /**\n     * The number of minutes before the session expires.\n     *\n     * Set this value to a safe period of time that revoked users\n     * sessions will continue to function.\n     *\n     * NOTE: This value cannot be larger than 60 minutes.\n     *\n     * @defaultValue 15\n     */\n    sessionTimeoutInMinutes?: number;\n    /**\n     * Secrets Manager path containing Google OAuth2 Client credentials.\n     *\n     * NOTE: you do not need to set this value, but you DO need to generate and\n     * store the associated credentials in Secrets Manager.\n     *\n     * Credentials should be stored in Secrets Manager as JSON:\n     *\n     * ```json\n     * {\n     *   \"clientId\": \"my-client-id\",\n     *   \"clientSecret\": \"my-client-secret\"\n     * }\n     * ```\n     *\n     * @see `googleAuth.enabled` for how to generate.\n     *\n     * @defaultValue /:STAGE/:stack/:app/google-auth-credentials\n     */\n    credentialsSecretsManagerPath?: string;\n\n    /**\n     * When using Auth in the ALB, which stage of cognito-lambda to use.\n     *\n     * For most applications this should always be PROD, even in the CODE environments.\n     *\n     * @defaultValue PROD\n     */\n    cognitoAuthStage?: string;\n  };\n\n  /**\n   * Specify custom healthcheck\n   */\n  healthcheck?: ALBHealthCheck;\n\n  /**\n   * Set http put response hop limit for the launch template.\n   * It can be necessary to raise this value from the default of 1\n   * for example when sharing the instance profile with a docker container running on the instance.\n   */\n  instanceMetadataHopLimit?: number;\n\n  /**\n   * Specify an update policy for the ASG created by this pattern.\n   *\n   * @see https://docs.aws.amazon.com/cdk/api/latest/docs/aws-autoscaling-readme.html#update-policy\n   *\n   * @defaultValue UpdatePolicy.none() - Cloudformation does not attempt to rotate instances in the ASG\n   * and must rely on riffraff to do so.\n   */\n  updatePolicy?: UpdatePolicy;\n\n  /**\n   * This setting configures the launch template to enable or disable detailed monitoring on instances.\n   *\n   * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-launchtemplate-monitoring.html\n   */\n  enabledDetailedInstanceMonitoring?: boolean;\n  /**\n   * You can specify how long after an instance reaches the InService state it waits before contributing\n   * usage data to the aggregated metrics. This specified time is called the default instance warmup.\n   * This keeps dynamic scaling from being affected by metrics for individual instances that aren't yet\n   * handling application traffic and that might be experiencing temporarily high usage of compute resources.\n   *\n   * @see https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-default-instance-warmup.html\n   */\n  defaultInstanceWarmup?: Duration;\n}\n\nfunction restrictedCidrRanges(ranges: IPeer[]) {\n  return ranges.map((range) => ({\n    range,\n    port: Port.tcp(443),\n    description: `Allow access on port 443 from ${range.uniqueId}`,\n  }));\n}\n\n/**\n * Pattern which creates the resources needed to run an application on EC2\n * behind a load balancer. For convenience, you may wish to use [[`GuPlayApp`]]\n * or [[`GuNodeApp`]], which extend this class.\n *\n * See props for further details.\n */\nexport class GuEc2App extends Construct {\n  /*\n   * These are public for now, as this allows users to\n   * modify these constructs as desired to fit their\n   * specific needs.\n   * In the future, we might build functionality to better enable users\n   * to access in-pattern constructs, but this would allow teams to be unblocked\n   * in the short term.\n   * */\n  public readonly vpc: IVpc;\n  public readonly certificate?: GuCertificate;\n  public readonly loadBalancer: GuApplicationLoadBalancer;\n  public readonly autoScalingGroup: GuAutoScalingGroup;\n  public readonly listener: GuHttpsApplicationListener;\n  public readonly targetGroup: GuApplicationTargetGroup;\n\n  constructor(scope: GuStack, props: GuEc2AppProps) {\n    const {\n      access,\n      accessLogging = { enabled: false },\n      app,\n      // We should update this default once a significant number of apps have migrated to devx-logs\n      applicationLogging = { enabled: false },\n      applicationPort,\n      blockDevices,\n      certificateProps,\n      instanceType,\n      monitoringConfiguration,\n      roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n      scaling: { minimumInstances, maximumInstances = minimumInstances * 2 },\n      userData: userDataLike,\n      imageRecipe,\n      vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n      privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n      publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n      instanceMetadataHopLimit,\n      updatePolicy,\n      enabledDetailedInstanceMonitoring,\n      defaultInstanceWarmup,\n    } = props;\n\n    super(scope, app); // The assumption is `app` is unique\n\n    // We should really prevent users from doing this via the type system,\n    // but that requires a breaking change to the API\n    if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n      throw new Error(\n        \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n          \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\",\n      );\n    }\n\n    const userData = userDataLike instanceof UserData ? userDataLike : new GuUserData(scope, { ...userDataLike, app });\n\n    AppAccess.validate(access);\n\n    const certificate =\n      typeof certificateProps !== \"undefined\"\n        ? new GuCertificate(scope, {\n            app,\n            domainName: certificateProps.domainName,\n            hostedZoneId: certificateProps.hostedZoneId,\n          })\n        : undefined;\n\n    const maybePrivateConfigPolicy =\n      userData instanceof GuUserData && userData.configuration\n        ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n        : [];\n\n    const mergedRoleConfiguration: GuInstanceRoleProps = {\n      withoutLogShipping: roleConfiguration.withoutLogShipping,\n      additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n    };\n\n    const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n      app,\n      vpc,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n      healthCheck: HealthCheck.elb({ grace: Duration.minutes(2) }), // should this be defaulted at pattern or construct level?\n      userData: userData instanceof GuUserData ? userData.userData : userData,\n      vpcSubnets: { subnets: privateSubnets },\n      ...(blockDevices && { blockDevices }),\n      imageRecipe,\n      httpPutResponseHopLimit: instanceMetadataHopLimit,\n      updatePolicy,\n      enabledDetailedInstanceMonitoring,\n      defaultInstanceWarmup,\n    });\n\n    // This allows automatic shipping of instance Cloud Init logs when using the\n    // `cdk-base` Amigo role on your AMI.\n    Tags.of(autoScalingGroup).add(\n      MetadataKeys.LOG_KINESIS_STREAM_NAME,\n      GuLoggingStreamNameParameter.getInstance(scope).valueAsString,\n    );\n\n    if (applicationLogging.enabled) {\n      // This allows automatic shipping of application logs when using the\n      // `cdk-base` Amigo role on your AMI.\n      Tags.of(autoScalingGroup).add(\n        MetadataKeys.SYSTEMD_UNIT,\n        applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`,\n      );\n    }\n\n    const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n      app,\n      vpc,\n      // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n      internetFacing: access.scope !== AccessScope.INTERNAL,\n      vpcSubnets: {\n        subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n      },\n    });\n\n    if (accessLogging.enabled) {\n      const accessLoggingBucket = GuAccessLoggingBucketParameter.getInstance(scope);\n\n      loadBalancer.logAccessLogs(\n        Bucket.fromBucketName(\n          scope,\n          AppIdentity.suffixText(props, \"AccessLoggingBucket\"),\n          accessLoggingBucket.valueAsString,\n        ),\n        accessLogging.prefix,\n      );\n    }\n\n    const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n      app,\n      vpc,\n      protocol: ApplicationProtocol.HTTP,\n      targets: [autoScalingGroup],\n      port: applicationPort,\n      healthCheck: props.healthcheck,\n    });\n\n    const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n      app,\n      loadBalancer,\n      certificate,\n      targetGroup,\n      // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n      open: access.scope === AccessScope.PUBLIC && typeof certificate !== \"undefined\",\n    });\n\n    // Since AWS won't create a security group automatically when open=false, we need to add our own\n    if (access.scope !== AccessScope.PUBLIC) {\n      loadBalancer.addSecurityGroup(\n        new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n          app,\n          vpc,\n          description: \"Allow restricted ingress from CIDR ranges\",\n          allowAllOutbound: false,\n          ingresses: restrictedCidrRanges(access.cidrRanges),\n        }),\n      );\n    }\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const { http5xxAlarm, http4xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n      if (http4xxAlarm) {\n        new GuAlb4xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http4xxAlarm,\n        });\n      }\n      if (http5xxAlarm) {\n        new GuAlb5xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http5xxAlarm,\n        });\n      }\n      if (unhealthyInstancesAlarm) {\n        new GuUnhealthyInstancesAlarm(scope, {\n          app,\n          targetGroup,\n          snsTopicName,\n        });\n      }\n    }\n\n    if (props.googleAuth?.enabled) {\n      const prefix = `/${scope.stage}/${scope.stack}/${app}`;\n\n      const {\n        allowedGroups = [\"engineering@guardian.co.uk\"],\n        sessionTimeoutInMinutes = 15,\n        credentialsSecretsManagerPath = `${prefix}/google-auth-credentials`,\n      } = props.googleAuth;\n\n      if (sessionTimeoutInMinutes > 60) {\n        throw new Error(\"googleAuth.sessionTimeoutInMinutes must be <= 60!\");\n      }\n\n      if (allowedGroups.length < 1) {\n        throw new Error(\"googleAuth.allowedGroups cannot be empty!\");\n      }\n\n      if (allowedGroups.find((group) => !group.endsWith(\"@guardian.co.uk\"))) {\n        throw new Error(\"googleAuth.allowedGroups must use the @guardian.co.uk domain.\");\n      }\n\n      const deployToolsAccountId = StringParameter.fromStringParameterName(\n        scope,\n        \"deploy-tools-account-id-parameter\",\n        NAMED_SSM_PARAMETER_PATHS.DeployToolsAccountId.path,\n      );\n\n      const cognitoAuthStage = props.googleAuth.cognitoAuthStage ?? \"PROD\";\n\n      // See https://github.com/guardian/cognito-auth-lambdas for the source\n      // code here. ARN format is:\n      // arn:aws:lambda:aws-region:acct-id:function:helloworld.\n      const gatekeeperFunctionArn = `arn:aws:lambda:eu-west-1:${deployToolsAccountId.stringValue}:function:deploy-${cognitoAuthStage}-gatekeeper-lambda`;\n\n      // Note, handler and filename must match here:\n      // https://github.com/guardian/cognito-auth-lambdas.\n      const authLambda = new GuLambdaFunction(scope, \"auth-lambda\", {\n        app: app,\n        memorySize: 128,\n        handler: \"bootstrap\",\n        runtime: Runtime.PROVIDED_AL2,\n        fileName: `deploy/${cognitoAuthStage}/cognito-lambda/devx-cognito-lambda-amd64-v2.zip`,\n        withoutFilePrefix: true,\n        withoutArtifactUpload: true,\n        bucketNamePath: NAMED_SSM_PARAMETER_PATHS.OrganisationDistributionBucket.path,\n        architecture: Architecture.X86_64,\n        environment: {\n          ALLOWED_GROUPS: allowedGroups.join(\",\"),\n          GATEKEEPER_FUNCTION_ARN: gatekeeperFunctionArn,\n        },\n      });\n\n      authLambda.addToRolePolicy(\n        new PolicyStatement({\n          effect: Effect.ALLOW,\n          actions: [\"lambda:InvokeFunction\"],\n          resources: [gatekeeperFunctionArn],\n        }),\n      );\n\n      // Cognito user pool. We require both lambdas: pre-sign-up runs the first\n      // time a user attempts to authenticate (before they exist in the User\n      // Pool); pre-auth runs in subsequent authentication flows.\n      const userPool = new UserPool(this, \"user-pool\", {\n        lambdaTriggers: {\n          preAuthentication: authLambda,\n          preSignUp: authLambda,\n        },\n      });\n\n      // These help ensure domain is deterministic but also unique. Key\n      // assumption is that app/stack/stage combo are unique within Guardian.\n      const domainPrefix = `com-gu-${app.toLowerCase()}-${scope.stage.toLowerCase()}`;\n\n      const userPoolDomain = userPool.addDomain(\"domain\", {\n        cognitoDomain: {\n          domainPrefix: getUserPoolDomainPrefix(domainPrefix),\n        },\n      });\n\n      const clientId = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientId\" });\n      const clientSecret = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientSecret\" });\n\n      const userPoolIdp = new UserPoolIdentityProviderGoogle(scope, \"google-idp\", {\n        userPool: userPool,\n        clientId: clientId.toString(),\n        clientSecretValue: clientSecret,\n        attributeMapping: {\n          email: ProviderAttribute.GOOGLE_EMAIL,\n          givenName: ProviderAttribute.GOOGLE_GIVEN_NAME,\n          familyName: ProviderAttribute.GOOGLE_FAMILY_NAME,\n          profilePicture: ProviderAttribute.GOOGLE_PICTURE,\n          custom: {\n            name: ProviderAttribute.GOOGLE_NAME,\n          },\n        },\n        scopes: [\"openid\", \"email\", \"profile\"],\n      });\n\n      const userPoolClient = userPool.addClient(\"alb-client\", {\n        supportedIdentityProviders: [UserPoolClientIdentityProvider.GOOGLE],\n        generateSecret: true,\n        oAuth: {\n          callbackUrls: [`https://${props.googleAuth.domain}/oauth2/idpresponse`],\n        },\n\n        // Note: id and access validity token validity cannot be less than one\n        // hour (this is the cognito cookie duration). To quickly invalidate\n        // credentials, disable the user in Cognito. It might be that we want to\n        // parameterise these going forward, but that would require Infosec\n        // discussion.\n        idTokenValidity: Duration.hours(1),\n        accessTokenValidity: Duration.hours(1),\n        refreshTokenValidity: Duration.days(7),\n      });\n\n      userPoolClient.node.addDependency(userPoolIdp);\n\n      listener.addAction(\"CognitoAuth\", {\n        action: new AuthenticateCognitoAction({\n          userPool: userPool,\n          userPoolClient: userPoolClient,\n          userPoolDomain: userPoolDomain,\n          next: ListenerAction.forward([targetGroup]),\n          sessionTimeout: Duration.minutes(sessionTimeoutInMinutes),\n        }),\n      });\n\n      // Need to give the ALB outbound access on 443 for the IdP endpoints.\n      const idpEgressSecurityGroup = new GuHttpsEgressSecurityGroup(scope, \"ldp-access\", {\n        app,\n        vpc,\n      });\n\n      loadBalancer.addSecurityGroup(idpEgressSecurityGroup);\n    }\n\n    this.vpc = vpc;\n    this.certificate = certificate;\n    this.loadBalancer = loadBalancer;\n    this.autoScalingGroup = autoScalingGroup;\n    this.listener = listener;\n    this.targetGroup = targetGroup;\n  }\n}\n"]}

package/lib/utils/mixin/types.d.ts

@@ -1,2 +1,2 @@
-export type AnyConstructor = new (...args: any[]) => {};
+export type AnyConstructor = new (...args: any[]) => object;
 //# sourceMappingURL=types.d.ts.map

package/lib/utils/mixin/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/utils/mixin/types.ts"],"names":[],"mappings":"AACA,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/utils/mixin/types.ts"],"names":[],"mappings":"AACA,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,MAAM,CAAC"}

package/lib/utils/mixin/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/utils/mixin/types.ts"],"names":[],"mappings":"","sourcesContent":["// eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/ban-types -- mixin\nexport type AnyConstructor = new (...args: any[]) => {};\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/utils/mixin/types.ts"],"names":[],"mappings":"","sourcesContent":["// eslint-disable-next-line @typescript-eslint/no-explicit-any -- mixin\nexport type AnyConstructor = new (...args: any[]) => object;\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@guardian/cdk",
   "description": "Generic Guardian flavoured AWS CDK components",
-  "version": "61.3.3",
+  "version": "61.4.0",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [
@@ -13,7 +13,7 @@
   "repository": "github:guardian/cdk",
   "scripts": {
     "build": "tsc",
-    "lint": "eslint src --ext .ts",
+    "lint": "eslint src",
     "prettier:check": "prettier --check \"src/**/*.ts\"",
     "format": "prettier --write \"src/**/*.ts\"",
     "watch": "tsc -w",
@@ -28,8 +28,8 @@
     "cli:dev": "ts-node src/bin/index.ts"
   },
   "devDependencies": {
-    "@changesets/cli": "2.28.1",
-    "@guardian/eslint-config-typescript": "8.0.0",
+    "@changesets/cli": "2.29.2",
+    "@guardian/eslint-config": "^11.0.0",
     "@guardian/eslint-plugin-tsdoc-required": "^0.1.3",
     "@guardian/tsconfig": "^1.0.0",
     "@types/git-url-parse": "^9.0.3",
@@ -38,18 +38,18 @@
     "@types/lodash.camelcase": "^4.3.9",
     "@types/lodash.kebabcase": "^4.1.9",
     "@types/lodash.upperfirst": "^4.3.9",
-    "@types/node": "22.14.0",
+    "@types/node": "22.14.1",
     "@types/yargs": "^17.0.33",
     "aws-cdk": "2.1007.0",
     "aws-cdk-lib": "2.189.0",
     "constructs": "10.4.2",
-    "eslint": "^8.57.1",
+    "eslint": "^9.24.0",
     "eslint-plugin-custom-rules": "file:tools/eslint",
     "gh-pages": "^6.3.0",
     "jest": "^29.7.0",
     "prettier": "^3.5.3",
     "serve": "^14.2.4",
-    "ts-jest": "^29.3.1",
+    "ts-jest": "^29.3.2",
     "ts-node": "^10.9.2",
     "typedoc": "^0.28.2",
     "typescript": "5.1.6"