@guardian/cdk 62.1.3 → 62.2.0

package/lib/constructs/iam/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./policies";
 export * from "./roles";
 export * from "./fastly-logs-iam";
+export * from "./janus-assumable-role";
 //# sourceMappingURL=index.d.ts.map

package/lib/constructs/iam/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constructs/iam/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,SAAS,CAAC;AACxB,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constructs/iam/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,SAAS,CAAC;AACxB,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC"}

package/lib/constructs/iam/index.js

@@ -17,4 +17,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./policies"), exports);
 __exportStar(require("./roles"), exports);
 __exportStar(require("./fastly-logs-iam"), exports);
+__exportStar(require("./janus-assumable-role"), exports);
 //# sourceMappingURL=index.js.map

package/lib/constructs/iam/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constructs/iam/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,0CAAwB;AACxB,oDAAkC","sourcesContent":["export * from \"./policies\";\nexport * from \"./roles\";\nexport * from \"./fastly-logs-iam\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constructs/iam/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,0CAAwB;AACxB,oDAAkC;AAClC,yDAAuC","sourcesContent":["export * from \"./policies\";\nexport * from \"./roles\";\nexport * from \"./fastly-logs-iam\";\nexport * from \"./janus-assumable-role\";\n"]}

package/lib/constructs/iam/janus-assumable-role.d.ts

@@ -0,0 +1,34 @@
+import type { GuStack } from "../core";
+import { GuRole } from "./roles";
+export interface GuJanusAssumableRoleProps {
+    /**
+     * Tells Janus which ProvisionedRole this IAM role is part of.
+     */
+    janusPermission: string;
+    /**
+     * A friendly name for this IAM role to be shown in Janus.
+     * It should help Janus users to choose the right role.
+     */
+    janusName?: string;
+    /**
+     * A description of this IAM role to be shown in Janus.
+     * It should help Janus users to choose the right role.
+     */
+    janusDescription?: string;
+}
+/**
+ * Construct that creates an IAM role with the additional tags that Janus uses to find the role
+ * and its metadata.
+ *
+ * ```typescript
+ * new GuJanusAssumableRole(stack, {
+ *   janusPermission: "some-app-dev",
+ *   janusName: "Some App Developer",
+ *   janusDescription: "Description of role that will be shown in Janus.",
+ * })
+ * ```
+ */
+export declare class GuJanusAssumableRole extends GuRole {
+    constructor(scope: GuStack, props: GuJanusAssumableRoleProps);
+}
+//# sourceMappingURL=janus-assumable-role.d.ts.map

package/lib/constructs/iam/janus-assumable-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"janus-assumable-role.d.ts","sourceRoot":"","sources":["../../../src/constructs/iam/janus-assumable-role.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,oBAAqB,SAAQ,MAAM;gBAClC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,yBAAyB;CAiB7D"}

package/lib/constructs/iam/janus-assumable-role.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuJanusAssumableRole = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const aws_ssm_1 = require("aws-cdk-lib/aws-ssm");
+const roles_1 = require("./roles");
+/**
+ * Construct that creates an IAM role with the additional tags that Janus uses to find the role
+ * and its metadata.
+ *
+ * ```typescript
+ * new GuJanusAssumableRole(stack, {
+ *   janusPermission: "some-app-dev",
+ *   janusName: "Some App Developer",
+ *   janusDescription: "Description of role that will be shown in Janus.",
+ * })
+ * ```
+ */
+class GuJanusAssumableRole extends roles_1.GuRole {
+    constructor(scope, props) {
+        // Existing SSM param in stack account that holds Janus user ARN
+        const janusArnParamValue = aws_ssm_1.StringParameter.valueForStringParameter(scope, "/security/janus/user-arn");
+        super(scope, `${props.janusPermission}Role`, {
+            // Will be assumed by Janus user
+            assumedBy: new aws_iam_1.ArnPrincipal(janusArnParamValue),
+        });
+        const tags = aws_cdk_lib_1.Tags.of(this);
+        tags.add("gu:janus:discoverable", "true");
+        tags.add("gu:janus:permission", props.janusPermission);
+        if (props.janusName) {
+            tags.add("gu:janus:name", props.janusName);
+        }
+        if (props.janusDescription) {
+            tags.add("gu:janus:description", props.janusDescription);
+        }
+    }
+}
+exports.GuJanusAssumableRole = GuJanusAssumableRole;
+//# sourceMappingURL=janus-assumable-role.js.map

package/lib/constructs/iam/janus-assumable-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"janus-assumable-role.js","sourceRoot":"","sources":["../../../src/constructs/iam/janus-assumable-role.ts"],"names":[],"mappings":";;;AAAA,6CAAmC;AACnC,iDAAmD;AACnD,iDAAsD;AAEtD,mCAAiC;AAqBjC;;;;;;;;;;;GAWG;AACH,MAAa,oBAAqB,SAAQ,cAAM;IAC9C,YAAY,KAAc,EAAE,KAAgC;QAC1D,gEAAgE;QAChE,MAAM,kBAAkB,GAAG,yBAAe,CAAC,uBAAuB,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;QACtG,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,eAAe,MAAM,EAAE;YAC3C,gCAAgC;YAChC,SAAS,EAAE,IAAI,sBAAY,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,kBAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,SAAS,EAAE;YACnB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;SAC5C;QACD,IAAI,KAAK,CAAC,gBAAgB,EAAE;YAC1B,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;SAC1D;IACH,CAAC;CACF;AAlBD,oDAkBC","sourcesContent":["import { Tags } from \"aws-cdk-lib\";\nimport { ArnPrincipal } from \"aws-cdk-lib/aws-iam\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport type { GuStack } from \"../core\";\nimport { GuRole } from \"./roles\";\n\nexport interface GuJanusAssumableRoleProps {\n  /**\n   * Tells Janus which ProvisionedRole this IAM role is part of.\n   */\n  janusPermission: string;\n\n  /**\n   * A friendly name for this IAM role to be shown in Janus.\n   * It should help Janus users to choose the right role.\n   */\n  janusName?: string;\n\n  /**\n   * A description of this IAM role to be shown in Janus.\n   * It should help Janus users to choose the right role.\n   */\n  janusDescription?: string;\n}\n\n/**\n * Construct that creates an IAM role with the additional tags that Janus uses to find the role\n * and its metadata.\n *\n * ```typescript\n * new GuJanusAssumableRole(stack, {\n *   janusPermission: \"some-app-dev\",\n *   janusName: \"Some App Developer\",\n *   janusDescription: \"Description of role that will be shown in Janus.\",\n * })\n * ```\n */\nexport class GuJanusAssumableRole extends GuRole {\n  constructor(scope: GuStack, props: GuJanusAssumableRoleProps) {\n    // Existing SSM param in stack account that holds Janus user ARN\n    const janusArnParamValue = StringParameter.valueForStringParameter(scope, \"/security/janus/user-arn\");\n    super(scope, `${props.janusPermission}Role`, {\n      // Will be assumed by Janus user\n      assumedBy: new ArnPrincipal(janusArnParamValue),\n    });\n    const tags = Tags.of(this);\n    tags.add(\"gu:janus:discoverable\", \"true\");\n    tags.add(\"gu:janus:permission\", props.janusPermission);\n    if (props.janusName) {\n      tags.add(\"gu:janus:name\", props.janusName);\n    }\n    if (props.janusDescription) {\n      tags.add(\"gu:janus:description\", props.janusDescription);\n    }\n  }\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@guardian/cdk",
   "description": "Generic Guardian flavoured AWS CDK components",
-  "version": "62.1.3",
+  "version": "62.2.0",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [
@@ -32,7 +32,7 @@
   },
   "devDependencies": {
     "@changesets/cli": "2.29.7",
-    "@guardian/eslint-config": "12.0.1",
+    "@guardian/eslint-config": "13.0.0",
     "@guardian/eslint-plugin-tsdoc-required": "^0.1.3",
     "@guardian/tsconfig": "^1.0.1",
     "@types/git-url-parse": "^9.0.3",