@guardian/cdk 61.4.0 → 61.5.0

package/lib/constructs/autoscaling/asg.d.ts

@@ -45,9 +45,8 @@ declare const GuAutoScalingGroup_base: {
  * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions
  * to be passed in.
  *
- * All EC2 instances in this group will be automatically associated with two security groups:
- * 1. [[`GuHttpsEgressSecurityGroup`]], which allows outbound traffic over HTTPS.
- * 2. [[`GuWazuhAccess`]], which allows instances to communicate with Wazuh (for security monitoring).
+ * All EC2 instances in this group will be automatically associated with the [[`GuHttpsEgressSecurityGroup`]] security groups,
+ * which allows outbound traffic over HTTPS.
  *
  * If additional ingress or egress rules are required, define custom security groups and pass them in via the
  * `additionalSecurityGroups` prop.

package/lib/constructs/autoscaling/asg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asg.d.ts","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAgB,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAuB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAsB,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQpD,MAAM,WAAW,uBACf,SAAQ,IAAI,CACR,qBAAqB,EACnB,SAAS,GACT,QAAQ,GACR,cAAc,GACd,UAAU,GACV,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,eAAe,GACf,eAAe,CAClB,EACD,WAAW,EACX,aAAa;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,wBAAwB,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,iCAAiC,CAAC,EAAE,OAAO,CAAC;IAC5C,qBAAqB,CAAC,EAAE,QAAQ,CAAC;CAClC;;;;;;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kBAAmB,SAAQ,uBAAqC;IAC3E,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,cAAc,CAAC;IAC7C,SAAgB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAGlD,SAAgB,sBAAsB,EAAE,cAAc,CAAC;gBAE3C,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAwGvE"}
+{"version":3,"file":"asg.d.ts","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAgB,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAuB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAsB,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQpD,MAAM,WAAW,uBACf,SAAQ,IAAI,CACR,qBAAqB,EACnB,SAAS,GACT,QAAQ,GACR,cAAc,GACd,UAAU,GACV,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,eAAe,GACf,eAAe,CAClB,EACD,WAAW,EACX,aAAa;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,wBAAwB,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,iCAAiC,CAAC,EAAE,OAAO,CAAC;IAC5C,qBAAqB,CAAC,EAAE,QAAQ,CAAC;CAClC;;;;;;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,kBAAmB,SAAQ,uBAAqC;IAC3E,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,cAAc,CAAC;IAC7C,SAAgB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAGlD,SAAgB,sBAAsB,EAAE,cAAc,CAAC;gBAE3C,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAsGvE"}

package/lib/constructs/autoscaling/asg.js

@@ -18,9 +18,8 @@ const iam_1 = require("../iam");
  * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions
  * to be passed in.
  *
- * All EC2 instances in this group will be automatically associated with two security groups:
- * 1. [[`GuHttpsEgressSecurityGroup`]], which allows outbound traffic over HTTPS.
- * 2. [[`GuWazuhAccess`]], which allows instances to communicate with Wazuh (for security monitoring).
+ * All EC2 instances in this group will be automatically associated with the [[`GuHttpsEgressSecurityGroup`]] security groups,
+ * which allows outbound traffic over HTTPS.
  *
  * If additional ingress or egress rules are required, define custom security groups and pass them in via the
  * `additionalSecurityGroups` prop.
@@ -63,10 +62,10 @@ class GuAutoScalingGroup extends (0, app_aware_construct_1.GuAppAwareConstruct)(
             role,
             httpPutResponseHopLimit,
         });
-        // Add Wazuh & additional consumer specified Security Groups
+        // Add additional consumer specified Security Groups
         // Note: Launch templates via CDK allow specifying only one SG, so use connections
         // https://github.com/aws/aws-cdk/issues/18712
-        [ec2_1.GuWazuhAccess.getInstance(scope, vpc), ...additionalSecurityGroups].forEach((sg) => launchTemplate.connections.addSecurityGroup(sg));
+        additionalSecurityGroups.forEach((sg) => launchTemplate.connections.addSecurityGroup(sg));
         const asgProps = {
             ...props,
             launchTemplate,

package/lib/constructs/autoscaling/asg.js.map

@@ -1 +1 @@
-{"version":3,"file":"asg.js","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":";;;AACA,6CAA0C;AAC1C,iEAA6E;AAE7E,iDAA0E;AAK1E,+EAA4E;AAC5E,kCAAyC;AAEzC,gCAAmE;AACnE,gCAAwC;AA2CxC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,kCAAgB,CAAC;IAQ3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,MAAM,EACJ,GAAG,EACH,wBAAwB,GAAG,EAAE,EAC7B,YAAY,EACZ,OAAO,GAAG,IAAI,qBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAC5C,WAAW,EACX,YAAY,EACZ,YAAY,GAAG,CAAC,8BAAY,CAAC,GAAG,EAAE,CAAC,EACnC,gBAAgB,EAChB,gBAAgB,EAChB,IAAI,GAAG,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EACzC,WAAW,EACX,QAAQ,EACR,GAAG,EACH,uBAAuB,EACvB,YAAY,EACZ,iCAAiC,EACjC,qBAAqB,GACtB,GAAG,KAAK,CAAC;QAEV,qJAAqJ;QACrJ,IAAI,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE;YACjF,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;SACH;QAED,oCAAoC;QACpC,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,wBAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE;YACjE,YAAY;YACZ,kBAAkB,EAAE,iCAAiC;YACrD,YAAY;YACZ,YAAY,EAAE;gBACZ,QAAQ,EAAE,GAAuB,EAAE;oBACjC,OAAO;wBACL,MAAM,EAAE,6BAAmB,CAAC,KAAK;wBACjC,QAAQ;wBACR,OAAO,EAAE,OAAO,CAAC,aAAa;qBAC/B,CAAC;gBACJ,CAAC;aACF;YACD,6EAA6E;YAC7E,6CAA6C;YAC7C,aAAa,EAAE,gCAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YAErE;;;eAGG;YACH,aAAa,EAAE,IAAI;YAEnB,oBAAoB,EAAE,IAAI;YAC1B,QAAQ;YACR,IAAI;YACJ,uBAAuB;SACxB,CAAC,CAAC;QAEH,4DAA4D;QAC5D,kFAAkF;QAClF,8CAA8C;QAC9C,CAAC,mBAAa,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,wBAAwB,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAClF,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAChD,CAAC;QAEF,MAAM,QAAQ,GAA0B;YACtC,GAAG,KAAK;YACR,cAAc;YACd,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,GAAG,CAAC;YACrD,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,YAAY;YAE1B,iEAAiE;YACjE,yEAAyE;YACzE,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,SAAS;YACvB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,SAAS;YACnB,qBAAqB;SACtB,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,sBAAsB,GAAG,cAAc,CAAC;QAE7C,IAAI,WAAW,EAAE;YACf,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;SAClD;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAmC,CAAC;QAE7D,yFAAyF;QACzF,2DAA2D;QAC3D,+FAA+F;QAC/F,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;SAC5C;QAED,kBAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;CACF;AAhHD,gDAgHC","sourcesContent":["import type { Duration } from \"aws-cdk-lib\";\nimport { Tags, Token } from \"aws-cdk-lib\";\nimport { AutoScalingGroup, GroupMetrics } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { AutoScalingGroupProps, CfnAutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport { LaunchTemplate, OperatingSystemType } from \"aws-cdk-lib/aws-ec2\";\nimport type { InstanceType, ISecurityGroup, MachineImageConfig, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { ApplicationTargetGroup } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuAsgCapacity } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport { GuAmiParameter } from \"../core\";\nimport type { AppIdentity, GuStack } from \"../core\";\nimport { GuHttpsEgressSecurityGroup, GuWazuhAccess } from \"../ec2\";\nimport { GuInstanceRole } from \"../iam\";\n\n// Since we want to override the types of what gets passed in for the below props,\n// we need to use Omit<T, U> to remove them from the interface this extends\n// https://www.typescriptlang.org/docs/handbook/utility-types.html#omittype-keys\n// TODO avoid prop nesting to improve discoverability. See https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#flat.\nexport interface GuAutoScalingGroupProps\n  extends Omit<\n      AutoScalingGroupProps,\n      | \"imageId\"\n      | \"osType\"\n      | \"machineImage\"\n      | \"userData\"\n      | \"minCapacity\"\n      | \"maxCapacity\"\n      | \"desiredCapacity\"\n      | \"requireImdsv2\"\n      | \"securityGroup\"\n    >,\n    AppIdentity,\n    GuAsgCapacity {\n  /**\n   * @deprecated\n   * It shouldn't be necessary to specify a value here.\n   * GuCDK will create an AMI parameter by default. Riff-Raff can use this parameter to inject the latest AMI ID for\n   * your AMIgo recipe.\n   */\n  imageId?: GuAmiParameter;\n  /**\n   * If you are using GuCDK to generate your riff-raff.yaml file, specify AMIgo props here.\n   * If you are using a hardcoded riff-raff.yaml file (usually found in project root) then providing a value here has no\n   * effect.\n   */\n  imageRecipe?: string | AmigoProps;\n  instanceType: InstanceType;\n  userData: UserData;\n  additionalSecurityGroups?: ISecurityGroup[];\n  targetGroup?: ApplicationTargetGroup;\n  httpPutResponseHopLimit?: number;\n  enabledDetailedInstanceMonitoring?: boolean;\n  defaultInstanceWarmup?: Duration;\n}\n\n/**\n * Construct which creates an Auto Scaling group.\n *\n * By default, all EC2 instances in this group will use [[`GuInstanceRole`]],\n * which provides common permissions (e.g. the ability to download an artifact and write logs to the account's logging Kinesis stream).\n *\n * If additional IAM permissions are required, a custom role can be provided via the `role` prop.\n * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions\n * to be passed in.\n *\n * All EC2 instances in this group will be automatically associated with two security groups:\n * 1. [[`GuHttpsEgressSecurityGroup`]], which allows outbound traffic over HTTPS.\n * 2. [[`GuWazuhAccess`]], which allows instances to communicate with Wazuh (for security monitoring).\n *\n * If additional ingress or egress rules are required, define custom security groups and pass them in via the\n * `additionalSecurityGroups` prop.\n *\n * All EC2 instances provisioned via this construct will use\n * [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html).\n */\nexport class GuAutoScalingGroup extends GuAppAwareConstruct(AutoScalingGroup) {\n  public readonly app: string;\n  public readonly amiParameter: GuAmiParameter;\n  public readonly imageRecipe?: string | AmigoProps;\n\n  // Sadly this cannot be named `launchTemplate` as it would clash with a private property on the `AutoScalingGroup` class\n  public readonly instanceLaunchTemplate: LaunchTemplate;\n\n  constructor(scope: GuStack, id: string, props: GuAutoScalingGroupProps) {\n    const {\n      app,\n      additionalSecurityGroups = [],\n      blockDevices,\n      imageId = new GuAmiParameter(scope, { app }),\n      imageRecipe,\n      instanceType,\n      groupMetrics = [GroupMetrics.all()],\n      minimumInstances,\n      maximumInstances,\n      role = new GuInstanceRole(scope, { app }),\n      targetGroup,\n      userData,\n      vpc,\n      httpPutResponseHopLimit,\n      updatePolicy,\n      enabledDetailedInstanceMonitoring,\n      defaultInstanceWarmup,\n    } = props;\n\n    // Ensure min and max are defined in the same way. Throwing an `Error` when necessary. For example when min is defined via a Mapping, but max is not.\n    if (Token.isUnresolved(minimumInstances) && !Token.isUnresolved(maximumInstances)) {\n      throw new Error(\n        \"minimumInstances is defined via a Mapping, but maximumInstances is not. Create maximumInstances via a Mapping too.\",\n      );\n    }\n\n    // Generate an ID unique to this app\n    const launchTemplateId = `${scope.stack}-${scope.stage}-${app}`;\n    const launchTemplate = new LaunchTemplate(scope, launchTemplateId, {\n      blockDevices,\n      detailedMonitoring: enabledDetailedInstanceMonitoring,\n      instanceType,\n      machineImage: {\n        getImage: (): MachineImageConfig => {\n          return {\n            osType: OperatingSystemType.LINUX,\n            userData,\n            imageId: imageId.valueAsString,\n          };\n        },\n      },\n      // Do not use the default AWS security group which allows egress on any port.\n      // Favour HTTPS only egress rules by default.\n      securityGroup: GuHttpsEgressSecurityGroup.forVpc(scope, { app, vpc }),\n\n      /*\n      Ensure we satisfy FSBP EC2.8 control. If needed, an escape hatch can override this.\n      See https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-8.\n       */\n      requireImdsv2: true,\n\n      instanceMetadataTags: true,\n      userData,\n      role,\n      httpPutResponseHopLimit,\n    });\n\n    // Add Wazuh & additional consumer specified Security Groups\n    // Note: Launch templates via CDK allow specifying only one SG, so use connections\n    // https://github.com/aws/aws-cdk/issues/18712\n    [GuWazuhAccess.getInstance(scope, vpc), ...additionalSecurityGroups].forEach((sg) =>\n      launchTemplate.connections.addSecurityGroup(sg),\n    );\n\n    const asgProps: AutoScalingGroupProps = {\n      ...props,\n      launchTemplate,\n      maxCapacity: maximumInstances ?? minimumInstances * 2,\n      minCapacity: minimumInstances,\n      groupMetrics: groupMetrics,\n\n      // Omit userData, instanceType, blockDevices & role from asgProps\n      // As this are specified by the LaunchTemplate and must not be duplicated\n      blockDevices: undefined,\n      instanceType: undefined,\n      role: undefined,\n      userData: undefined,\n      defaultInstanceWarmup,\n    };\n\n    super(scope, id, asgProps);\n\n    this.app = app;\n    this.amiParameter = imageId;\n    this.imageRecipe = imageRecipe;\n    this.instanceLaunchTemplate = launchTemplate;\n\n    if (targetGroup) {\n      this.attachToApplicationTargetGroup(targetGroup);\n    }\n\n    const cfnAsg = this.node.defaultChild as CfnAutoScalingGroup;\n\n    // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group\n    // leaves it to the default value, which is actually false.\n    // { UpdatePolicy: { autoScalingScheduledAction: { IgnoreUnmodifiedGroupSizeProperties: true }}\n    if (!updatePolicy) {\n      cfnAsg.addDeletionOverride(\"UpdatePolicy\");\n    }\n\n    Tags.of(launchTemplate).add(\"App\", app);\n  }\n}\n"]}
+{"version":3,"file":"asg.js","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":";;;AACA,6CAA0C;AAC1C,iEAA6E;AAE7E,iDAA0E;AAK1E,+EAA4E;AAC5E,kCAAyC;AAEzC,gCAAoD;AACpD,gCAAwC;AA2CxC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,kCAAgB,CAAC;IAQ3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,MAAM,EACJ,GAAG,EACH,wBAAwB,GAAG,EAAE,EAC7B,YAAY,EACZ,OAAO,GAAG,IAAI,qBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAC5C,WAAW,EACX,YAAY,EACZ,YAAY,GAAG,CAAC,8BAAY,CAAC,GAAG,EAAE,CAAC,EACnC,gBAAgB,EAChB,gBAAgB,EAChB,IAAI,GAAG,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EACzC,WAAW,EACX,QAAQ,EACR,GAAG,EACH,uBAAuB,EACvB,YAAY,EACZ,iCAAiC,EACjC,qBAAqB,GACtB,GAAG,KAAK,CAAC;QAEV,qJAAqJ;QACrJ,IAAI,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE;YACjF,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;SACH;QAED,oCAAoC;QACpC,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,wBAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE;YACjE,YAAY;YACZ,kBAAkB,EAAE,iCAAiC;YACrD,YAAY;YACZ,YAAY,EAAE;gBACZ,QAAQ,EAAE,GAAuB,EAAE;oBACjC,OAAO;wBACL,MAAM,EAAE,6BAAmB,CAAC,KAAK;wBACjC,QAAQ;wBACR,OAAO,EAAE,OAAO,CAAC,aAAa;qBAC/B,CAAC;gBACJ,CAAC;aACF;YACD,6EAA6E;YAC7E,6CAA6C;YAC7C,aAAa,EAAE,gCAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YAErE;;;eAGG;YACH,aAAa,EAAE,IAAI;YAEnB,oBAAoB,EAAE,IAAI;YAC1B,QAAQ;YACR,IAAI;YACJ,uBAAuB;SACxB,CAAC,CAAC;QAEH,oDAAoD;QACpD,kFAAkF;QAClF,8CAA8C;QAC9C,wBAAwB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QAE1F,MAAM,QAAQ,GAA0B;YACtC,GAAG,KAAK;YACR,cAAc;YACd,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,GAAG,CAAC;YACrD,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,YAAY;YAE1B,iEAAiE;YACjE,yEAAyE;YACzE,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,SAAS;YACvB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,SAAS;YACnB,qBAAqB;SACtB,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,sBAAsB,GAAG,cAAc,CAAC;QAE7C,IAAI,WAAW,EAAE;YACf,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;SAClD;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAmC,CAAC;QAE7D,yFAAyF;QACzF,2DAA2D;QAC3D,+FAA+F;QAC/F,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;SAC5C;QAED,kBAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;CACF;AA9GD,gDA8GC","sourcesContent":["import type { Duration } from \"aws-cdk-lib\";\nimport { Tags, Token } from \"aws-cdk-lib\";\nimport { AutoScalingGroup, GroupMetrics } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { AutoScalingGroupProps, CfnAutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport { LaunchTemplate, OperatingSystemType } from \"aws-cdk-lib/aws-ec2\";\nimport type { InstanceType, ISecurityGroup, MachineImageConfig, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { ApplicationTargetGroup } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuAsgCapacity } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport { GuAmiParameter } from \"../core\";\nimport type { AppIdentity, GuStack } from \"../core\";\nimport { GuHttpsEgressSecurityGroup } from \"../ec2\";\nimport { GuInstanceRole } from \"../iam\";\n\n// Since we want to override the types of what gets passed in for the below props,\n// we need to use Omit<T, U> to remove them from the interface this extends\n// https://www.typescriptlang.org/docs/handbook/utility-types.html#omittype-keys\n// TODO avoid prop nesting to improve discoverability. See https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#flat.\nexport interface GuAutoScalingGroupProps\n  extends Omit<\n      AutoScalingGroupProps,\n      | \"imageId\"\n      | \"osType\"\n      | \"machineImage\"\n      | \"userData\"\n      | \"minCapacity\"\n      | \"maxCapacity\"\n      | \"desiredCapacity\"\n      | \"requireImdsv2\"\n      | \"securityGroup\"\n    >,\n    AppIdentity,\n    GuAsgCapacity {\n  /**\n   * @deprecated\n   * It shouldn't be necessary to specify a value here.\n   * GuCDK will create an AMI parameter by default. Riff-Raff can use this parameter to inject the latest AMI ID for\n   * your AMIgo recipe.\n   */\n  imageId?: GuAmiParameter;\n  /**\n   * If you are using GuCDK to generate your riff-raff.yaml file, specify AMIgo props here.\n   * If you are using a hardcoded riff-raff.yaml file (usually found in project root) then providing a value here has no\n   * effect.\n   */\n  imageRecipe?: string | AmigoProps;\n  instanceType: InstanceType;\n  userData: UserData;\n  additionalSecurityGroups?: ISecurityGroup[];\n  targetGroup?: ApplicationTargetGroup;\n  httpPutResponseHopLimit?: number;\n  enabledDetailedInstanceMonitoring?: boolean;\n  defaultInstanceWarmup?: Duration;\n}\n\n/**\n * Construct which creates an Auto Scaling group.\n *\n * By default, all EC2 instances in this group will use [[`GuInstanceRole`]],\n * which provides common permissions (e.g. the ability to download an artifact and write logs to the account's logging Kinesis stream).\n *\n * If additional IAM permissions are required, a custom role can be provided via the `role` prop.\n * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions\n * to be passed in.\n *\n * All EC2 instances in this group will be automatically associated with the [[`GuHttpsEgressSecurityGroup`]] security groups,\n * which allows outbound traffic over HTTPS.\n *\n * If additional ingress or egress rules are required, define custom security groups and pass them in via the\n * `additionalSecurityGroups` prop.\n *\n * All EC2 instances provisioned via this construct will use\n * [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html).\n */\nexport class GuAutoScalingGroup extends GuAppAwareConstruct(AutoScalingGroup) {\n  public readonly app: string;\n  public readonly amiParameter: GuAmiParameter;\n  public readonly imageRecipe?: string | AmigoProps;\n\n  // Sadly this cannot be named `launchTemplate` as it would clash with a private property on the `AutoScalingGroup` class\n  public readonly instanceLaunchTemplate: LaunchTemplate;\n\n  constructor(scope: GuStack, id: string, props: GuAutoScalingGroupProps) {\n    const {\n      app,\n      additionalSecurityGroups = [],\n      blockDevices,\n      imageId = new GuAmiParameter(scope, { app }),\n      imageRecipe,\n      instanceType,\n      groupMetrics = [GroupMetrics.all()],\n      minimumInstances,\n      maximumInstances,\n      role = new GuInstanceRole(scope, { app }),\n      targetGroup,\n      userData,\n      vpc,\n      httpPutResponseHopLimit,\n      updatePolicy,\n      enabledDetailedInstanceMonitoring,\n      defaultInstanceWarmup,\n    } = props;\n\n    // Ensure min and max are defined in the same way. Throwing an `Error` when necessary. For example when min is defined via a Mapping, but max is not.\n    if (Token.isUnresolved(minimumInstances) && !Token.isUnresolved(maximumInstances)) {\n      throw new Error(\n        \"minimumInstances is defined via a Mapping, but maximumInstances is not. Create maximumInstances via a Mapping too.\",\n      );\n    }\n\n    // Generate an ID unique to this app\n    const launchTemplateId = `${scope.stack}-${scope.stage}-${app}`;\n    const launchTemplate = new LaunchTemplate(scope, launchTemplateId, {\n      blockDevices,\n      detailedMonitoring: enabledDetailedInstanceMonitoring,\n      instanceType,\n      machineImage: {\n        getImage: (): MachineImageConfig => {\n          return {\n            osType: OperatingSystemType.LINUX,\n            userData,\n            imageId: imageId.valueAsString,\n          };\n        },\n      },\n      // Do not use the default AWS security group which allows egress on any port.\n      // Favour HTTPS only egress rules by default.\n      securityGroup: GuHttpsEgressSecurityGroup.forVpc(scope, { app, vpc }),\n\n      /*\n      Ensure we satisfy FSBP EC2.8 control. If needed, an escape hatch can override this.\n      See https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-8.\n       */\n      requireImdsv2: true,\n\n      instanceMetadataTags: true,\n      userData,\n      role,\n      httpPutResponseHopLimit,\n    });\n\n    // Add additional consumer specified Security Groups\n    // Note: Launch templates via CDK allow specifying only one SG, so use connections\n    // https://github.com/aws/aws-cdk/issues/18712\n    additionalSecurityGroups.forEach((sg) => launchTemplate.connections.addSecurityGroup(sg));\n\n    const asgProps: AutoScalingGroupProps = {\n      ...props,\n      launchTemplate,\n      maxCapacity: maximumInstances ?? minimumInstances * 2,\n      minCapacity: minimumInstances,\n      groupMetrics: groupMetrics,\n\n      // Omit userData, instanceType, blockDevices & role from asgProps\n      // As this are specified by the LaunchTemplate and must not be duplicated\n      blockDevices: undefined,\n      instanceType: undefined,\n      role: undefined,\n      userData: undefined,\n      defaultInstanceWarmup,\n    };\n\n    super(scope, id, asgProps);\n\n    this.app = app;\n    this.amiParameter = imageId;\n    this.imageRecipe = imageRecipe;\n    this.instanceLaunchTemplate = launchTemplate;\n\n    if (targetGroup) {\n      this.attachToApplicationTargetGroup(targetGroup);\n    }\n\n    const cfnAsg = this.node.defaultChild as CfnAutoScalingGroup;\n\n    // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group\n    // leaves it to the default value, which is actually false.\n    // { UpdatePolicy: { autoScalingScheduledAction: { IgnoreUnmodifiedGroupSizeProperties: true }}\n    if (!updatePolicy) {\n      cfnAsg.addDeletionOverride(\"UpdatePolicy\");\n    }\n\n    Tags.of(launchTemplate).add(\"App\", app);\n  }\n}\n"]}

package/lib/constructs/ec2/security-groups/base.d.ts

@@ -35,7 +35,6 @@ export interface GuSecurityGroupProps extends GuBaseSecurityGroupProps, AppIdent
  * An ingress rule on port 22 is strictly forbidden as SSH via SSM is preferred.
  *
  * Prefer to use a concrete implementation where possible. See:
- * - [[GuWazuhAccess]]
  * - [[GuPublicInternetAccessSecurityGroup]]
  * - [[GuHttpsEgressSecurityGroup]]
  */

package/lib/constructs/ec2/security-groups/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/constructs/ec2/security-groups/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,IAAI,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAErE,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC;IAEb;;;;OAIG;IACH,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAyB,SAAQ,kBAAkB;IAClE,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACtC,QAAQ,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,oBAAqB,SAAQ,wBAAwB,EAAE,WAAW;CAAG;AAEtF;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,SAAQ,aAAa;gBACxC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB;CAkBxE;;;;;;AAED,qBAAa,eAAgB,SAAQ,oBAAwC;gBAC/D,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB;CAGpE;AAED;;GAEG;AAEH,qBAAa,0BAA2B,SAAQ,eAAe;gBACjD,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB;WAUrD,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,GAAG,0BAA0B;CAG9F"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/constructs/ec2/security-groups/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,IAAI,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAErE,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC;IAEb;;;;OAIG;IACH,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAyB,SAAQ,kBAAkB;IAClE,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACtC,QAAQ,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,oBAAqB,SAAQ,wBAAwB,EAAE,WAAW;CAAG;AAEtF;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,SAAQ,aAAa;gBACxC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB;CAkBxE;;;;;;AAED,qBAAa,eAAgB,SAAQ,oBAAwC;gBAC/D,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB;CAGpE;AAED;;GAEG;AAEH,qBAAa,0BAA2B,SAAQ,eAAe;gBACjD,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB;WAUrD,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,GAAG,0BAA0B;CAG9F"}

package/lib/constructs/ec2/security-groups/base.js

@@ -9,7 +9,6 @@ const app_aware_construct_1 = require("../../../utils/mixin/app-aware-construct"
  * An ingress rule on port 22 is strictly forbidden as SSH via SSM is preferred.
  *
  * Prefer to use a concrete implementation where possible. See:
- * - [[GuWazuhAccess]]
  * - [[GuPublicInternetAccessSecurityGroup]]
  * - [[GuHttpsEgressSecurityGroup]]
  */

package/lib/constructs/ec2/security-groups/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../../src/constructs/ec2/security-groups/base.ts"],"names":[],"mappings":";;;AAAA,iDAAgE;AAEhE,kFAA+E;AAmC/E;;;;;;;;;GASG;AACH,MAAa,mBAAoB,SAAQ,uBAAa;IACpD,YAAY,KAAc,EAAE,EAAU,EAAE,KAA+B;QACrE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;YACxD,MAAM,UAAU,GAAS,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAE1E,IAAI,UAAU,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;aAC5F;YAED,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;YACvD,MAAM,UAAU,GAAS,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1E,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAnBD,kDAmBC;AAED,MAAa,eAAgB,SAAQ,IAAA,yCAAmB,EAAC,mBAAmB,CAAC;IAC3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA2B;QACjE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;CACF;AAJD,0CAIC;AAED;;GAEG;AACH,mCAAmC;AACnC,MAAa,0BAA2B,SAAQ,eAAe;IAC7D,YAAY,KAAc,EAAE,EAAU,EAAE,KAA2B;QACjE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,GAAG,KAAK;YACR,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,kCAAkC;YAC/C,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,cAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;SAClG,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,MAAM,CAAC,KAAc,EAAE,KAA2B;QAC9D,OAAO,IAAI,0BAA0B,CAAC,KAAK,EAAE,4BAA4B,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;CACF;AAdD,gEAcC","sourcesContent":["import { Peer, Port, SecurityGroup } from \"aws-cdk-lib/aws-ec2\";\nimport type { IPeer, SecurityGroupProps } from \"aws-cdk-lib/aws-ec2\";\nimport { GuAppAwareConstruct } from \"../../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../../core\";\n\n/**\n * A way to describe an ingress or egress rule for a security group.\n *\n * See [[transformToSecurityGroupAccessRule]] for a handy helper function.\n */\nexport interface SecurityGroupAccessRule {\n  /**\n   * The CIDR address for this rule.\n   * Use `Peer.anyIpv4()` for global access.\n   */\n  range: IPeer;\n\n  /**\n   * The port to open in a security group.\n   * The default protocol is TCP.\n   * Use `Port.udp(port)` for the UDP protocol.\n   */\n  port: number | Port;\n\n  /**\n   * A short explanation for this rule.\n   */\n  description: string;\n}\n\nexport interface GuBaseSecurityGroupProps extends SecurityGroupProps {\n  ingresses?: SecurityGroupAccessRule[];\n  egresses?: SecurityGroupAccessRule[];\n}\n\nexport interface GuSecurityGroupProps extends GuBaseSecurityGroupProps, AppIdentity {}\n\n/**\n * Defining an AWS Security Group with ingress and egress rules.\n *\n * An ingress rule on port 22 is strictly forbidden as SSH via SSM is preferred.\n *\n * Prefer to use a concrete implementation where possible. See:\n * - [[GuWazuhAccess]]\n * - [[GuPublicInternetAccessSecurityGroup]]\n * - [[GuHttpsEgressSecurityGroup]]\n */\nexport class GuBaseSecurityGroup extends SecurityGroup {\n  constructor(scope: GuStack, id: string, props: GuBaseSecurityGroupProps) {\n    super(scope, id, props);\n\n    props.ingresses?.forEach(({ range, port, description }) => {\n      const connection: Port = typeof port === \"number\" ? Port.tcp(port) : port;\n\n      if (connection.toString() === \"22\") {\n        throw new Error(\"An ingress rule on port 22 is not allowed. Prefer to setup SSH via SSM.\");\n      }\n\n      this.addIngressRule(range, connection, description);\n    });\n\n    props.egresses?.forEach(({ range, port, description }) => {\n      const connection: Port = typeof port === \"number\" ? Port.tcp(port) : port;\n      this.addEgressRule(range, connection, description);\n    });\n  }\n}\n\nexport class GuSecurityGroup extends GuAppAwareConstruct(GuBaseSecurityGroup) {\n  constructor(scope: GuStack, id: string, props: GuSecurityGroupProps) {\n    super(scope, id, props);\n  }\n}\n\n/**\n * Creates a security group which allows all outbound HTTPS traffic.\n */\n// TODO should this be a singleton?\nexport class GuHttpsEgressSecurityGroup extends GuSecurityGroup {\n  constructor(scope: GuStack, id: string, props: GuSecurityGroupProps) {\n    super(scope, id, {\n      ...props,\n      allowAllOutbound: false,\n      description: \"Allow all outbound HTTPS traffic\",\n      ingresses: [],\n      egresses: [{ range: Peer.anyIpv4(), port: 443, description: \"Allow all outbound HTTPS traffic\" }],\n    });\n  }\n\n  public static forVpc(scope: GuStack, props: GuSecurityGroupProps): GuHttpsEgressSecurityGroup {\n    return new GuHttpsEgressSecurityGroup(scope, \"GuHttpsEgressSecurityGroup\", props);\n  }\n}\n"]}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../../src/constructs/ec2/security-groups/base.ts"],"names":[],"mappings":";;;AAAA,iDAAgE;AAEhE,kFAA+E;AAmC/E;;;;;;;;GAQG;AACH,MAAa,mBAAoB,SAAQ,uBAAa;IACpD,YAAY,KAAc,EAAE,EAAU,EAAE,KAA+B;QACrE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAExB,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;YACxD,MAAM,UAAU,GAAS,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAE1E,IAAI,UAAU,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;aAC5F;YAED,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;YACvD,MAAM,UAAU,GAAS,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1E,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAnBD,kDAmBC;AAED,MAAa,eAAgB,SAAQ,IAAA,yCAAmB,EAAC,mBAAmB,CAAC;IAC3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA2B;QACjE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;CACF;AAJD,0CAIC;AAED;;GAEG;AACH,mCAAmC;AACnC,MAAa,0BAA2B,SAAQ,eAAe;IAC7D,YAAY,KAAc,EAAE,EAAU,EAAE,KAA2B;QACjE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,GAAG,KAAK;YACR,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,kCAAkC;YAC/C,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,cAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;SAClG,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,MAAM,CAAC,KAAc,EAAE,KAA2B;QAC9D,OAAO,IAAI,0BAA0B,CAAC,KAAK,EAAE,4BAA4B,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;CACF;AAdD,gEAcC","sourcesContent":["import { Peer, Port, SecurityGroup } from \"aws-cdk-lib/aws-ec2\";\nimport type { IPeer, SecurityGroupProps } from \"aws-cdk-lib/aws-ec2\";\nimport { GuAppAwareConstruct } from \"../../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../../core\";\n\n/**\n * A way to describe an ingress or egress rule for a security group.\n *\n * See [[transformToSecurityGroupAccessRule]] for a handy helper function.\n */\nexport interface SecurityGroupAccessRule {\n  /**\n   * The CIDR address for this rule.\n   * Use `Peer.anyIpv4()` for global access.\n   */\n  range: IPeer;\n\n  /**\n   * The port to open in a security group.\n   * The default protocol is TCP.\n   * Use `Port.udp(port)` for the UDP protocol.\n   */\n  port: number | Port;\n\n  /**\n   * A short explanation for this rule.\n   */\n  description: string;\n}\n\nexport interface GuBaseSecurityGroupProps extends SecurityGroupProps {\n  ingresses?: SecurityGroupAccessRule[];\n  egresses?: SecurityGroupAccessRule[];\n}\n\nexport interface GuSecurityGroupProps extends GuBaseSecurityGroupProps, AppIdentity {}\n\n/**\n * Defining an AWS Security Group with ingress and egress rules.\n *\n * An ingress rule on port 22 is strictly forbidden as SSH via SSM is preferred.\n *\n * Prefer to use a concrete implementation where possible. See:\n * - [[GuPublicInternetAccessSecurityGroup]]\n * - [[GuHttpsEgressSecurityGroup]]\n */\nexport class GuBaseSecurityGroup extends SecurityGroup {\n  constructor(scope: GuStack, id: string, props: GuBaseSecurityGroupProps) {\n    super(scope, id, props);\n\n    props.ingresses?.forEach(({ range, port, description }) => {\n      const connection: Port = typeof port === \"number\" ? Port.tcp(port) : port;\n\n      if (connection.toString() === \"22\") {\n        throw new Error(\"An ingress rule on port 22 is not allowed. Prefer to setup SSH via SSM.\");\n      }\n\n      this.addIngressRule(range, connection, description);\n    });\n\n    props.egresses?.forEach(({ range, port, description }) => {\n      const connection: Port = typeof port === \"number\" ? Port.tcp(port) : port;\n      this.addEgressRule(range, connection, description);\n    });\n  }\n}\n\nexport class GuSecurityGroup extends GuAppAwareConstruct(GuBaseSecurityGroup) {\n  constructor(scope: GuStack, id: string, props: GuSecurityGroupProps) {\n    super(scope, id, props);\n  }\n}\n\n/**\n * Creates a security group which allows all outbound HTTPS traffic.\n */\n// TODO should this be a singleton?\nexport class GuHttpsEgressSecurityGroup extends GuSecurityGroup {\n  constructor(scope: GuStack, id: string, props: GuSecurityGroupProps) {\n    super(scope, id, {\n      ...props,\n      allowAllOutbound: false,\n      description: \"Allow all outbound HTTPS traffic\",\n      ingresses: [],\n      egresses: [{ range: Peer.anyIpv4(), port: 443, description: \"Allow all outbound HTTPS traffic\" }],\n    });\n  }\n\n  public static forVpc(scope: GuStack, props: GuSecurityGroupProps): GuHttpsEgressSecurityGroup {\n    return new GuHttpsEgressSecurityGroup(scope, \"GuHttpsEgressSecurityGroup\", props);\n  }\n}\n"]}

package/lib/constructs/ec2/security-groups/index.d.ts

@@ -1,3 +1,2 @@
 export * from "./base";
-export * from "./wazuh";
 //# sourceMappingURL=index.d.ts.map

package/lib/constructs/ec2/security-groups/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/constructs/ec2/security-groups/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/constructs/ec2/security-groups/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC"}

package/lib/constructs/ec2/security-groups/index.js

@@ -15,5 +15,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./base"), exports);
-__exportStar(require("./wazuh"), exports);
 //# sourceMappingURL=index.js.map

package/lib/constructs/ec2/security-groups/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/constructs/ec2/security-groups/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yCAAuB;AACvB,0CAAwB","sourcesContent":["export * from \"./base\";\nexport * from \"./wazuh\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/constructs/ec2/security-groups/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yCAAuB","sourcesContent":["export * from \"./base\";\n"]}

package/lib/constructs/iam/roles/instance-role.d.ts

@@ -22,11 +22,10 @@ declare const GuInstanceRole_base: {
  *
  * More specifically:
  * 1. Allows for `ssh` access to an EC2 instance via [ssm-scala](https://github.com/guardian/ssm-scala) (instead of standard `ssh`).
- * 2. Allows EC2 instances to communicate with Wazuh, for security monitoring.
- * 3. Allows EC2 instances to download an artifact from AWS S3, for application deployment.
- * 4. Allows EC2 instances to download private configuration from AWS Parameter Store. See [[`GuParameterStoreReadPolicy`]]
+ * 2. Allows EC2 instances to download an artifact from AWS S3, for application deployment.
+ * 3. Allows EC2 instances to download private configuration from AWS Parameter Store. See [[`GuParameterStoreReadPolicy`]]
  * for specific details.
- * 5. Allows EC2 instances to write logs into our central ELK stack via Kinesis.
+ * 4. Allows EC2 instances to write logs into our central ELK stack via Kinesis.
  *
  * If additional IAM permissions are required, create custom policies and pass them in via the `additionalPolicies` prop.
  *

package/lib/constructs/iam/roles/instance-role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance-role.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/instance-role.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAOvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC;CACjC;AAED,MAAM,MAAM,0BAA0B,GAAG,mBAAmB,GAAG,WAAW,CAAC;;;;;;AAE3E;;;;;;;;;;;;;;GAcG;AACH,qBAAa,cAAe,SAAQ,mBAA2B;gBACjD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,0BAA0B;CAsB9D"}
+{"version":3,"file":"instance-role.d.ts","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/instance-role.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAOvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC;CACjC;AAED,MAAM,MAAM,0BAA0B,GAAG,mBAAmB,GAAG,WAAW,CAAC;;;;;;AAE3E;;;;;;;;;;;;;GAaG;AACH,qBAAa,cAAe,SAAQ,mBAA2B;gBACjD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,0BAA0B;CAsB9D"}

package/lib/constructs/iam/roles/instance-role.js

@@ -11,11 +11,10 @@ const roles_1 = require("./roles");
  *
  * More specifically:
  * 1. Allows for `ssh` access to an EC2 instance via [ssm-scala](https://github.com/guardian/ssm-scala) (instead of standard `ssh`).
- * 2. Allows EC2 instances to communicate with Wazuh, for security monitoring.
- * 3. Allows EC2 instances to download an artifact from AWS S3, for application deployment.
- * 4. Allows EC2 instances to download private configuration from AWS Parameter Store. See [[`GuParameterStoreReadPolicy`]]
+ * 2. Allows EC2 instances to download an artifact from AWS S3, for application deployment.
+ * 3. Allows EC2 instances to download private configuration from AWS Parameter Store. See [[`GuParameterStoreReadPolicy`]]
  * for specific details.
- * 5. Allows EC2 instances to write logs into our central ELK stack via Kinesis.
+ * 4. Allows EC2 instances to write logs into our central ELK stack via Kinesis.
  *
  * If additional IAM permissions are required, create custom policies and pass them in via the `additionalPolicies` prop.
  *

package/lib/constructs/iam/roles/instance-role.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance-role.js","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/instance-role.ts"],"names":[],"mappings":";;;AAAA,iDAAuD;AACvD,kFAA+E;AAE/E,0CAKqB;AAErB,iDAAqD;AACrD,mCAAiC;AAgBjC;;;;;;;;;;;;;;GAcG;AACH,MAAa,cAAe,SAAQ,IAAA,yCAAmB,EAAC,cAAM,CAAC;IAC7D,YAAY,KAAc,EAAE,KAAiC;QAC3D,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE;YAC3B,IAAI,EAAE,GAAG;YACT,SAAS,EAAE,IAAI,0BAAgB,CAAC,mBAAmB,CAAC;YACpD,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG;YACrB,wBAAc,CAAC,WAAW,CAAC,KAAK,CAAC;YACjC,8BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;SAC9E,CAAC;QAEF,MAAM,QAAQ,GAAG;YACf,GAAG,cAAc;YACjB,IAAI,mCAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;YAC1C,IAAI,qCAA0B,CAAC,KAAK,EAAE,KAAK,CAAC;YAC5C,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;SACpC,CAAC;QAEF,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;CACF;AAvBD,wCAuBC","sourcesContent":["import { ServicePrincipal } from \"aws-cdk-lib/aws-iam\";\nimport { GuAppAwareConstruct } from \"../../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../../core\";\nimport {\n  GuDescribeEC2Policy,\n  GuGetDistributablePolicy,\n  GuLogShippingPolicy,\n  GuParameterStoreReadPolicy,\n} from \"../policies\";\nimport type { GuPolicy } from \"../policies\";\nimport { GuSsmSshPolicy } from \"../policies/ssm-ssh\";\nimport { GuRole } from \"./roles\";\n\nexport interface GuInstanceRoleProps {\n  /**\n   * By default, instances are given permissions to write to Kinesis. Set to\n   * 'true' to prevent this. Note, disabling will prevent not just application\n   * logs being shipped but also anything else - for example, automatic log\n   * shipping of Cloud Init and other logs by the cdk-base role in your AMI.\n   */\n  withoutLogShipping?: boolean;\n\n  additionalPolicies?: GuPolicy[];\n}\n\nexport type GuInstanceRolePropsWithApp = GuInstanceRoleProps & AppIdentity;\n\n/**\n * Creates an IAM role with common policies that are needed by most Guardian applications.\n *\n * More specifically:\n * 1. Allows for `ssh` access to an EC2 instance via [ssm-scala](https://github.com/guardian/ssm-scala) (instead of standard `ssh`).\n * 2. Allows EC2 instances to communicate with Wazuh, for security monitoring.\n * 3. Allows EC2 instances to download an artifact from AWS S3, for application deployment.\n * 4. Allows EC2 instances to download private configuration from AWS Parameter Store. See [[`GuParameterStoreReadPolicy`]]\n * for specific details.\n * 5. Allows EC2 instances to write logs into our central ELK stack via Kinesis.\n *\n * If additional IAM permissions are required, create custom policies and pass them in via the `additionalPolicies` prop.\n *\n * If log shipping is not required, opt out by setting the `withoutLogShipping` prop to `true`.\n */\nexport class GuInstanceRole extends GuAppAwareConstruct(GuRole) {\n  constructor(scope: GuStack, props: GuInstanceRolePropsWithApp) {\n    super(scope, \"InstanceRole\", {\n      path: \"/\",\n      assumedBy: new ServicePrincipal(\"ec2.amazonaws.com\"),\n      ...props,\n    });\n\n    const sharedPolicies = [\n      GuSsmSshPolicy.getInstance(scope),\n      GuDescribeEC2Policy.getInstance(scope),\n      ...(props.withoutLogShipping ? [] : [GuLogShippingPolicy.getInstance(scope)]),\n    ];\n\n    const policies = [\n      ...sharedPolicies,\n      new GuGetDistributablePolicy(scope, props),\n      new GuParameterStoreReadPolicy(scope, props),\n      ...(props.additionalPolicies ?? []),\n    ];\n\n    policies.forEach((p) => p.attachToRole(this));\n  }\n}\n"]}
+{"version":3,"file":"instance-role.js","sourceRoot":"","sources":["../../../../src/constructs/iam/roles/instance-role.ts"],"names":[],"mappings":";;;AAAA,iDAAuD;AACvD,kFAA+E;AAE/E,0CAKqB;AAErB,iDAAqD;AACrD,mCAAiC;AAgBjC;;;;;;;;;;;;;GAaG;AACH,MAAa,cAAe,SAAQ,IAAA,yCAAmB,EAAC,cAAM,CAAC;IAC7D,YAAY,KAAc,EAAE,KAAiC;QAC3D,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE;YAC3B,IAAI,EAAE,GAAG;YACT,SAAS,EAAE,IAAI,0BAAgB,CAAC,mBAAmB,CAAC;YACpD,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG;YACrB,wBAAc,CAAC,WAAW,CAAC,KAAK,CAAC;YACjC,8BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;SAC9E,CAAC;QAEF,MAAM,QAAQ,GAAG;YACf,GAAG,cAAc;YACjB,IAAI,mCAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;YAC1C,IAAI,qCAA0B,CAAC,KAAK,EAAE,KAAK,CAAC;YAC5C,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;SACpC,CAAC;QAEF,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;CACF;AAvBD,wCAuBC","sourcesContent":["import { ServicePrincipal } from \"aws-cdk-lib/aws-iam\";\nimport { GuAppAwareConstruct } from \"../../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../../core\";\nimport {\n  GuDescribeEC2Policy,\n  GuGetDistributablePolicy,\n  GuLogShippingPolicy,\n  GuParameterStoreReadPolicy,\n} from \"../policies\";\nimport type { GuPolicy } from \"../policies\";\nimport { GuSsmSshPolicy } from \"../policies/ssm-ssh\";\nimport { GuRole } from \"./roles\";\n\nexport interface GuInstanceRoleProps {\n  /**\n   * By default, instances are given permissions to write to Kinesis. Set to\n   * 'true' to prevent this. Note, disabling will prevent not just application\n   * logs being shipped but also anything else - for example, automatic log\n   * shipping of Cloud Init and other logs by the cdk-base role in your AMI.\n   */\n  withoutLogShipping?: boolean;\n\n  additionalPolicies?: GuPolicy[];\n}\n\nexport type GuInstanceRolePropsWithApp = GuInstanceRoleProps & AppIdentity;\n\n/**\n * Creates an IAM role with common policies that are needed by most Guardian applications.\n *\n * More specifically:\n * 1. Allows for `ssh` access to an EC2 instance via [ssm-scala](https://github.com/guardian/ssm-scala) (instead of standard `ssh`).\n * 2. Allows EC2 instances to download an artifact from AWS S3, for application deployment.\n * 3. Allows EC2 instances to download private configuration from AWS Parameter Store. See [[`GuParameterStoreReadPolicy`]]\n * for specific details.\n * 4. Allows EC2 instances to write logs into our central ELK stack via Kinesis.\n *\n * If additional IAM permissions are required, create custom policies and pass them in via the `additionalPolicies` prop.\n *\n * If log shipping is not required, opt out by setting the `withoutLogShipping` prop to `true`.\n */\nexport class GuInstanceRole extends GuAppAwareConstruct(GuRole) {\n  constructor(scope: GuStack, props: GuInstanceRolePropsWithApp) {\n    super(scope, \"InstanceRole\", {\n      path: \"/\",\n      assumedBy: new ServicePrincipal(\"ec2.amazonaws.com\"),\n      ...props,\n    });\n\n    const sharedPolicies = [\n      GuSsmSshPolicy.getInstance(scope),\n      GuDescribeEC2Policy.getInstance(scope),\n      ...(props.withoutLogShipping ? [] : [GuLogShippingPolicy.getInstance(scope)]),\n    ];\n\n    const policies = [\n      ...sharedPolicies,\n      new GuGetDistributablePolicy(scope, props),\n      new GuParameterStoreReadPolicy(scope, props),\n      ...(props.additionalPolicies ?? []),\n    ];\n\n    policies.forEach((p) => p.attachToRole(this));\n  }\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@guardian/cdk",
   "description": "Generic Guardian flavoured AWS CDK components",
-  "version": "61.4.0",
+  "version": "61.5.0",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [
@@ -43,7 +43,7 @@
     "aws-cdk": "2.1007.0",
     "aws-cdk-lib": "2.189.0",
     "constructs": "10.4.2",
-    "eslint": "^9.24.0",
+    "eslint": "^9.25.1",
     "eslint-plugin-custom-rules": "file:tools/eslint",
     "gh-pages": "^6.3.0",
     "jest": "^29.7.0",
@@ -51,7 +51,7 @@
     "serve": "^14.2.4",
     "ts-jest": "^29.3.2",
     "ts-node": "^10.9.2",
-    "typedoc": "^0.28.2",
+    "typedoc": "^0.28.3",
     "typescript": "5.1.6"
   },
   "dependencies": {

package/lib/constructs/ec2/security-groups/wazuh.d.ts

@@ -1,73 +0,0 @@
-import type { IVpc } from "aws-cdk-lib/aws-ec2";
-import type { GuStack } from "../../core";
-import { GuBaseSecurityGroup } from "./base";
-/**
- * A security group to allow a Wazuh agent on an EC2 instance to communicate with the outside.
- * This is implemented as a singleton, meaning only one resource will be created in a stack.
- * If there are multiple apps in the stack, they will re-use this resource.
- *
- * The logicalId will always be "WazuhSecurityGroup".
- *
- * Will create a resource like this:
- *
- * ```yaml
- * WazuhSecurityGroup:
- *   Type: AWS::EC2::SecurityGroup
- *   Properties:
- *     GroupDescription: Allow outbound traffic from wazuh agent to manager
- *     VpcId:
- *       Ref: VpcId
- *     SecurityGroupEgress:
- *     - Description: Wazuh event logging
- *       IpProtocol: tcp
- *       FromPort: 1514
- *       ToPort: 1514
- *       CidrIp: 0.0.0.0/0
- *     - Description: Wazuh agent registration
- *       IpProtocol: tcp
- *       FromPort: 1515
- *       ToPort: 1515
- *       CidrIp: 0.0.0.0/0
- * ```
- *
- * Which will then get used like this:
- *
- * ```yaml
- * InstanceRoleForAppA:
- *   Type: AWS::IAM::Role
- *   Properties:
- *     SecurityGroups:
- *     - Ref: WazuhSecurityGroup
- *
- * InstanceRoleForAppB:
- *   Type: AWS::IAM::Role
- *   Properties:
- *     SecurityGroups:
- *     - Ref: WazuhSecurityGroup
- * ```
- *
- * Usage within a stack:
- * ```typescript
- * GuWazuhAccess.getInstance(this, vpc);
- * ```
- *
- * @see https://github.com/guardian/security-hq/blob/main/hq/markdown/wazuh.md
- */
-export declare class GuWazuhAccess extends GuBaseSecurityGroup {
-    private static instance;
-    private constructor();
-    /**
-     * GuWazuhAccess is implemented as a singleton meaning only one instance will be created for the entire stack.
-     * If there are multiple apps in the stack, they will re-use this resource.
-     *
-     * Usage:
-     * ```typescript
-     * GuWazuhAccess.getInstance(this, vpc);
-     * ```
-     *
-     * @param stack the stack to add this security group to
-     * @param vpc the vpc to add this security group to
-     */
-    static getInstance(stack: GuStack, vpc: IVpc): GuWazuhAccess;
-}
-//# sourceMappingURL=wazuh.d.ts.map

package/lib/constructs/ec2/security-groups/wazuh.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"wazuh.d.ts","sourceRoot":"","sources":["../../../../src/constructs/ec2/security-groups/wazuh.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAEhD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,qBAAa,aAAc,SAAQ,mBAAmB;IACpD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAA4B;IAEnD,OAAO;IA+BP;;;;;;;;;;;OAWG;WACW,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,aAAa;CAOpE"}

package/lib/constructs/ec2/security-groups/wazuh.js

@@ -1,108 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GuWazuhAccess = void 0;
-const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
-const singleton_1 = require("../../../utils/singleton");
-const base_1 = require("./base");
-/**
- * A security group to allow a Wazuh agent on an EC2 instance to communicate with the outside.
- * This is implemented as a singleton, meaning only one resource will be created in a stack.
- * If there are multiple apps in the stack, they will re-use this resource.
- *
- * The logicalId will always be "WazuhSecurityGroup".
- *
- * Will create a resource like this:
- *
- * ```yaml
- * WazuhSecurityGroup:
- *   Type: AWS::EC2::SecurityGroup
- *   Properties:
- *     GroupDescription: Allow outbound traffic from wazuh agent to manager
- *     VpcId:
- *       Ref: VpcId
- *     SecurityGroupEgress:
- *     - Description: Wazuh event logging
- *       IpProtocol: tcp
- *       FromPort: 1514
- *       ToPort: 1514
- *       CidrIp: 0.0.0.0/0
- *     - Description: Wazuh agent registration
- *       IpProtocol: tcp
- *       FromPort: 1515
- *       ToPort: 1515
- *       CidrIp: 0.0.0.0/0
- * ```
- *
- * Which will then get used like this:
- *
- * ```yaml
- * InstanceRoleForAppA:
- *   Type: AWS::IAM::Role
- *   Properties:
- *     SecurityGroups:
- *     - Ref: WazuhSecurityGroup
- *
- * InstanceRoleForAppB:
- *   Type: AWS::IAM::Role
- *   Properties:
- *     SecurityGroups:
- *     - Ref: WazuhSecurityGroup
- * ```
- *
- * Usage within a stack:
- * ```typescript
- * GuWazuhAccess.getInstance(this, vpc);
- * ```
- *
- * @see https://github.com/guardian/security-hq/blob/main/hq/markdown/wazuh.md
- */
-class GuWazuhAccess extends base_1.GuBaseSecurityGroup {
-    constructor(scope, vpc) {
-        super(scope, "WazuhSecurityGroup", {
-            vpc,
-            /*
-            The group description of a security group is stateful.
-            Be careful about changing this!
-      
-            See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html#cfn-ec2-securitygroup-groupdescription
-             */
-            description: "Allow outbound traffic from wazuh agent to manager",
-            allowAllOutbound: false,
-            egresses: [
-                { range: aws_ec2_1.Peer.anyIpv4(), port: 1514, description: "Wazuh event logging" },
-                { range: aws_ec2_1.Peer.anyIpv4(), port: 1515, description: "Wazuh agent registration" },
-            ],
-        });
-        /*
-        Replacing in-use security groups is difficult as it requires careful orchestration with instances.
-        Fix the logicalId to "WazuhSecurityGroup" regardless of new or migrating stack.
-        This makes it:
-          - easier for YAML defined stacks to move to GuCDK as the resource will be kept
-          - easier for stacks already using GuCDK to upgrade versions
-         */
-        scope.overrideLogicalId(this, {
-            logicalId: "WazuhSecurityGroup",
-            reason: "Avoid tricky security group replacement during a YAML to GuCDK migration.",
-        });
-    }
-    /**
-     * GuWazuhAccess is implemented as a singleton meaning only one instance will be created for the entire stack.
-     * If there are multiple apps in the stack, they will re-use this resource.
-     *
-     * Usage:
-     * ```typescript
-     * GuWazuhAccess.getInstance(this, vpc);
-     * ```
-     *
-     * @param stack the stack to add this security group to
-     * @param vpc the vpc to add this security group to
-     */
-    static getInstance(stack, vpc) {
-        if (!this.instance || !(0, singleton_1.isSingletonPresentInStack)(stack, this.instance)) {
-            this.instance = new GuWazuhAccess(stack, vpc);
-        }
-        return this.instance;
-    }
-}
-exports.GuWazuhAccess = GuWazuhAccess;
-//# sourceMappingURL=wazuh.js.map

package/lib/constructs/ec2/security-groups/wazuh.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"wazuh.js","sourceRoot":"","sources":["../../../../src/constructs/ec2/security-groups/wazuh.ts"],"names":[],"mappings":";;;AAAA,iDAA2C;AAE3C,wDAAqE;AAErE,iCAA6C;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAa,aAAc,SAAQ,0BAAmB;IAGpD,YAAoB,KAAc,EAAE,GAAS;QAC3C,KAAK,CAAC,KAAK,EAAE,oBAAoB,EAAE;YACjC,GAAG;YAEH;;;;;eAKG;YACH,WAAW,EAAE,oDAAoD;YACjE,gBAAgB,EAAE,KAAK;YACvB,QAAQ,EAAE;gBACR,EAAE,KAAK,EAAE,cAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,qBAAqB,EAAE;gBACzE,EAAE,KAAK,EAAE,cAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,0BAA0B,EAAE;aAC/E;SACF,CAAC,CAAC;QAEH;;;;;;WAMG;QACH,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE;YAC5B,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,2EAA2E;SACpF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACI,MAAM,CAAC,WAAW,CAAC,KAAc,EAAE,GAAS;QACjD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAA,qCAAyB,EAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACtE,IAAI,CAAC,QAAQ,GAAG,IAAI,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;SAC/C;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF;AArDD,sCAqDC","sourcesContent":["import { Peer } from \"aws-cdk-lib/aws-ec2\";\nimport type { IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { isSingletonPresentInStack } from \"../../../utils/singleton\";\nimport type { GuStack } from \"../../core\";\nimport { GuBaseSecurityGroup } from \"./base\";\n\n/**\n * A security group to allow a Wazuh agent on an EC2 instance to communicate with the outside.\n * This is implemented as a singleton, meaning only one resource will be created in a stack.\n * If there are multiple apps in the stack, they will re-use this resource.\n *\n * The logicalId will always be \"WazuhSecurityGroup\".\n *\n * Will create a resource like this:\n *\n * ```yaml\n * WazuhSecurityGroup:\n *   Type: AWS::EC2::SecurityGroup\n *   Properties:\n *     GroupDescription: Allow outbound traffic from wazuh agent to manager\n *     VpcId:\n *       Ref: VpcId\n *     SecurityGroupEgress:\n *     - Description: Wazuh event logging\n *       IpProtocol: tcp\n *       FromPort: 1514\n *       ToPort: 1514\n *       CidrIp: 0.0.0.0/0\n *     - Description: Wazuh agent registration\n *       IpProtocol: tcp\n *       FromPort: 1515\n *       ToPort: 1515\n *       CidrIp: 0.0.0.0/0\n * ```\n *\n * Which will then get used like this:\n *\n * ```yaml\n * InstanceRoleForAppA:\n *   Type: AWS::IAM::Role\n *   Properties:\n *     SecurityGroups:\n *     - Ref: WazuhSecurityGroup\n *\n * InstanceRoleForAppB:\n *   Type: AWS::IAM::Role\n *   Properties:\n *     SecurityGroups:\n *     - Ref: WazuhSecurityGroup\n * ```\n *\n * Usage within a stack:\n * ```typescript\n * GuWazuhAccess.getInstance(this, vpc);\n * ```\n *\n * @see https://github.com/guardian/security-hq/blob/main/hq/markdown/wazuh.md\n */\nexport class GuWazuhAccess extends GuBaseSecurityGroup {\n  private static instance: GuWazuhAccess | undefined;\n\n  private constructor(scope: GuStack, vpc: IVpc) {\n    super(scope, \"WazuhSecurityGroup\", {\n      vpc,\n\n      /*\n      The group description of a security group is stateful.\n      Be careful about changing this!\n\n      See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html#cfn-ec2-securitygroup-groupdescription\n       */\n      description: \"Allow outbound traffic from wazuh agent to manager\",\n      allowAllOutbound: false,\n      egresses: [\n        { range: Peer.anyIpv4(), port: 1514, description: \"Wazuh event logging\" },\n        { range: Peer.anyIpv4(), port: 1515, description: \"Wazuh agent registration\" },\n      ],\n    });\n\n    /*\n    Replacing in-use security groups is difficult as it requires careful orchestration with instances.\n    Fix the logicalId to \"WazuhSecurityGroup\" regardless of new or migrating stack.\n    This makes it:\n      - easier for YAML defined stacks to move to GuCDK as the resource will be kept\n      - easier for stacks already using GuCDK to upgrade versions\n     */\n    scope.overrideLogicalId(this, {\n      logicalId: \"WazuhSecurityGroup\",\n      reason: \"Avoid tricky security group replacement during a YAML to GuCDK migration.\",\n    });\n  }\n\n  /**\n   * GuWazuhAccess is implemented as a singleton meaning only one instance will be created for the entire stack.\n   * If there are multiple apps in the stack, they will re-use this resource.\n   *\n   * Usage:\n   * ```typescript\n   * GuWazuhAccess.getInstance(this, vpc);\n   * ```\n   *\n   * @param stack the stack to add this security group to\n   * @param vpc the vpc to add this security group to\n   */\n  public static getInstance(stack: GuStack, vpc: IVpc): GuWazuhAccess {\n    if (!this.instance || !isSingletonPresentInStack(stack, this.instance)) {\n      this.instance = new GuWazuhAccess(stack, vpc);\n    }\n\n    return this.instance;\n  }\n}\n"]}