npm - @guardian/cdk - Versions diffs - 62.2.1 → 62.3.1 - Mend

@guardian/cdk 62.2.1 → 62.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (19) hide show

package/lib/constructs/autoscaling/asg.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"asg.d.ts","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAgB,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAuB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAsB,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIpD,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,SAAS,CAAC;AAM9D,MAAM,WAAW,uBACf,~~SAAQ~~,IAAI,~~CACR~~,qBAAqB,EACnB,SAAS,GACT,QAAQ,GACR,cAAc,GACd,UAAU,GACV,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,eAAe,GACf,eAAe,CAClB,EACD,WAAW,EACX,aAAa;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IAEnB;;;;;;;;OAQG;IACH,yBAAyB,EAAE,yBAAyB,CAAC;IAErD,wBAAwB,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,QAAQ,CAAC;CAClC;;;;;;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,kBAAmB,SAAQ,uBAAqC;IAC3E,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,cAAc,CAAC;IAC7C,SAAgB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAGlD,SAAgB,sBAAsB,EAAE,cAAc,CAAC;gBAE3C,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAwGvE"}
1	+ {"version":3,"file":"asg.d.ts","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAgB,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAuB,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAuB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAsB,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIpD,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,SAAS,CAAC;AAM9D,MAAM,WAAW,uBACf,SACE,IAAI,CACF,qBAAqB,EACnB,SAAS,GACT,QAAQ,GACR,cAAc,GACd,UAAU,GACV,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,eAAe,GACf,eAAe,CAClB,EACD,WAAW,EACX,aAAa;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IAEnB;;;;;;;;OAQG;IACH,yBAAyB,EAAE,yBAAyB,CAAC;IAErD,wBAAwB,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,QAAQ,CAAC;CAClC;;;;;;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,kBAAmB,SAAQ,uBAAqC;IAC3E,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,cAAc,CAAC;IAC7C,SAAgB,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAGlD,SAAgB,sBAAsB,EAAE,cAAc,CAAC;gBAE3C,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAwGvE"}

package/lib/constructs/autoscaling/asg.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"asg.js","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":";;;AACA,6CAA0C;AAC1C,iEAA6E;AAE7E,iDAA0E;AAK1E,+EAA4E;AAC5E,kCAAyC;AAEzC,gCAAoD;AACpD,gCAAwC;AAwDxC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,kCAAgB,CAAC;IAQ3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,MAAM,EACJ,GAAG,EACH,wBAAwB,GAAG,EAAE,EAC7B,YAAY,EACZ,OAAO,GAAG,IAAI,qBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAC5C,WAAW,EACX,YAAY,EACZ,YAAY,GAAG,CAAC,8BAAY,CAAC,GAAG,EAAE,CAAC,EACnC,gBAAgB,EAChB,gBAAgB,EAChB,IAAI,GAAG,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EACzC,WAAW,EACX,QAAQ,EACR,GAAG,EACH,uBAAuB,EACvB,YAAY,EACZ,qBAAqB,EACrB,yBAAyB,GAC1B,GAAG,KAAK,CAAC;QAEV,qJAAqJ;QACrJ,IAAI,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE;YACjF,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;SACH;QAED,MAAM,kBAAkB,GAAG,yBAAyB,KAAK,SAAS,CAAC;QAEnE,oCAAoC;QACpC,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,wBAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE;YACjE,YAAY;YACZ,kBAAkB;YAClB,YAAY;YACZ,YAAY,EAAE;gBACZ,QAAQ,EAAE,GAAuB,EAAE;oBACjC,OAAO;wBACL,MAAM,EAAE,6BAAmB,CAAC,KAAK;wBACjC,QAAQ;wBACR,OAAO,EAAE,OAAO,CAAC,aAAa;qBAC/B,CAAC;gBACJ,CAAC;aACF;YACD,6EAA6E;YAC7E,6CAA6C;YAC7C,aAAa,EAAE,gCAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YAErE;;;eAGG;YACH,aAAa,EAAE,IAAI;YAEnB,oBAAoB,EAAE,IAAI;YAC1B,QAAQ;YACR,IAAI;YACJ,uBAAuB;SACxB,CAAC,CAAC;QAEH,oDAAoD;QACpD,kFAAkF;QAClF,8CAA8C;QAC9C,wBAAwB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QAE1F,MAAM,QAAQ,GAA0B;YACtC,GAAG,KAAK;YACR,cAAc;YACd,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,GAAG,CAAC;YACrD,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,YAAY;YAE1B,iEAAiE;YACjE,yEAAyE;YACzE,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,SAAS;YACvB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,SAAS;YACnB,qBAAqB;SACtB,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,sBAAsB,GAAG,cAAc,CAAC;QAE7C,IAAI,WAAW,EAAE;YACf,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;SAClD;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAmC,CAAC;QAE7D,yFAAyF;QACzF,2DAA2D;QAC3D,+FAA+F;QAC/F,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;SAC5C;QAED,kBAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;CACF;AAhHD,gDAgHC","sourcesContent":["import type { Duration } from \"aws-cdk-lib\";\nimport { Tags, Token } from \"aws-cdk-lib\";\nimport { AutoScalingGroup, GroupMetrics } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { AutoScalingGroupProps, CfnAutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport { LaunchTemplate, OperatingSystemType } from \"aws-cdk-lib/aws-ec2\";\nimport type { InstanceType, ISecurityGroup, MachineImageConfig, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { ApplicationTargetGroup } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuAsgCapacity } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport { GuAmiParameter } from \"../core\";\nimport type { AppIdentity, GuStack } from \"../core\";\nimport { GuHttpsEgressSecurityGroup } from \"../ec2\";\nimport { GuInstanceRole } from \"../iam\";\n\nexport type InstanceMetricGranularity = \"1Minute\" \| \"5Minute\";\n\n// Since we want to override the types of what gets passed in for the below props,\n// we need to use Omit<T, U> to remove them from the interface this extends\n// https://www.typescriptlang.org/docs/handbook/utility-types.html#omittype-keys\n// TODO avoid prop nesting to improve discoverability. See https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#flat.\nexport interface GuAutoScalingGroupProps\n extends Omit<\n AutoScalingGroupProps,\n \| \"imageId\"\n \| \"osType\"\n \| \"machineImage\"\n \| \"userData\"\n \| \"minCapacity\"\n \| \"maxCapacity\"\n \| \"desiredCapacity\"\n \| \"requireImdsv2\"\n \| \"securityGroup\"\n >,\n AppIdentity,\n GuAsgCapacity {\n /*\n @deprecated\n * It shouldn't be necessary to specify a value here.\n * GuCDK will create an AMI parameter by default. Riff-Raff can use this parameter to inject the latest AMI ID for\n * your AMIgo recipe.\n /\n imageId?: GuAmiParameter;\n /\n If you are using GuCDK to generate your riff-raff.yaml file, specify AMIgo props here.\n * If you are using a hardcoded riff-raff.yaml file (usually found in project root) then providing a value here has no\n * effect.\n /\n imageRecipe?: string \| AmigoProps;\n instanceType: InstanceType;\n userData: UserData;\n\n /\n How often to send EC2 metrics, such as CPU usage.\n * By default, AWS will produce `5Minute` granular metrics.\n \n It is recommended to produce `1Minute` granular metrics in production,\n * especially when using ASG metrics to trigger horizontal scaling as it allows for earlier scaling.\n \n @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html\n /\n instanceMetricGranularity: InstanceMetricGranularity;\n\n additionalSecurityGroups?: ISecurityGroup[];\n targetGroup?: ApplicationTargetGroup;\n httpPutResponseHopLimit?: number;\n defaultInstanceWarmup?: Duration;\n}\n\n/\n Construct which creates an Auto Scaling group.\n \n By default, all EC2 instances in this group will use [[`GuInstanceRole`]],\n * which provides common permissions (e.g. the ability to download an artifact and write logs to the account's logging Kinesis stream).\n \n If additional IAM permissions are required, a custom role can be provided via the `role` prop.\n * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions\n * to be passed in.\n \n All EC2 instances in this group will be automatically associated with the [[`GuHttpsEgressSecurityGroup`]] security groups,\n * which allows outbound traffic over HTTPS.\n \n If additional ingress or egress rules are required, define custom security groups and pass them in via the\n * `additionalSecurityGroups` prop.\n \n All EC2 instances provisioned via this construct will use\n * [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html).\n /\nexport class GuAutoScalingGroup extends GuAppAwareConstruct(AutoScalingGroup) {\n public readonly app: string;\n public readonly amiParameter: GuAmiParameter;\n public readonly imageRecipe?: string \| AmigoProps;\n\n // Sadly this cannot be named `launchTemplate` as it would clash with a private property on the `AutoScalingGroup` class\n public readonly instanceLaunchTemplate: LaunchTemplate;\n\n constructor(scope: GuStack, id: string, props: GuAutoScalingGroupProps) {\n const {\n app,\n additionalSecurityGroups = [],\n blockDevices,\n imageId = new GuAmiParameter(scope, { app }),\n imageRecipe,\n instanceType,\n groupMetrics = [GroupMetrics.all()],\n minimumInstances,\n maximumInstances,\n role = new GuInstanceRole(scope, { app }),\n targetGroup,\n userData,\n vpc,\n httpPutResponseHopLimit,\n updatePolicy,\n defaultInstanceWarmup,\n instanceMetricGranularity,\n } = props;\n\n // Ensure min and max are defined in the same way. Throwing an `Error` when necessary. For example when min is defined via a Mapping, but max is not.\n if (Token.isUnresolved(minimumInstances) && !Token.isUnresolved(maximumInstances)) {\n throw new Error(\n \"minimumInstances is defined via a Mapping, but maximumInstances is not. Create maximumInstances via a Mapping too.\",\n );\n }\n\n const detailedMonitoring = instanceMetricGranularity === \"1Minute\";\n\n // Generate an ID unique to this app\n const launchTemplateId = `${scope.stack}-${scope.stage}-${app}`;\n const launchTemplate = new LaunchTemplate(scope, launchTemplateId, {\n blockDevices,\n detailedMonitoring,\n instanceType,\n machineImage: {\n getImage: (): MachineImageConfig => {\n return {\n osType: OperatingSystemType.LINUX,\n userData,\n imageId: imageId.valueAsString,\n };\n },\n },\n // Do not use the default AWS security group which allows egress on any port.\n // Favour HTTPS only egress rules by default.\n securityGroup: GuHttpsEgressSecurityGroup.forVpc(scope, { app, vpc }),\n\n /\n Ensure we satisfy FSBP EC2.8 control. If needed, an escape hatch can override this.\n See https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-8.\n /\n requireImdsv2: true,\n\n instanceMetadataTags: true,\n userData,\n role,\n httpPutResponseHopLimit,\n });\n\n // Add additional consumer specified Security Groups\n // Note: Launch templates via CDK allow specifying only one SG, so use connections\n // https://github.com/aws/aws-cdk/issues/18712\n additionalSecurityGroups.forEach((sg) => launchTemplate.connections.addSecurityGroup(sg));\n\n const asgProps: AutoScalingGroupProps = {\n ...props,\n launchTemplate,\n maxCapacity: maximumInstances ?? minimumInstances 2,\n minCapacity: minimumInstances,\n groupMetrics: groupMetrics,\n\n // Omit userData, instanceType, blockDevices & role from asgProps\n // As this are specified by the LaunchTemplate and must not be duplicated\n blockDevices: undefined,\n instanceType: undefined,\n role: undefined,\n userData: undefined,\n defaultInstanceWarmup,\n };\n\n super(scope, id, asgProps);\n\n this.app = app;\n this.amiParameter = imageId;\n this.imageRecipe = imageRecipe;\n this.instanceLaunchTemplate = launchTemplate;\n\n if (targetGroup) {\n this.attachToApplicationTargetGroup(targetGroup);\n }\n\n const cfnAsg = this.node.defaultChild as CfnAutoScalingGroup;\n\n // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group\n // leaves it to the default value, which is actually false.\n // { UpdatePolicy: { autoScalingScheduledAction: { IgnoreUnmodifiedGroupSizeProperties: true }}\n if (!updatePolicy) {\n cfnAsg.addDeletionOverride(\"UpdatePolicy\");\n }\n\n Tags.of(launchTemplate).add(\"App\", app);\n }\n}\n"]}
1	+ {"version":3,"file":"asg.js","sourceRoot":"","sources":["../../../src/constructs/autoscaling/asg.ts"],"names":[],"mappings":";;;AACA,6CAA0C;AAC1C,iEAA6E;AAE7E,iDAA0E;AAK1E,+EAA4E;AAC5E,kCAAyC;AAEzC,gCAAoD;AACpD,gCAAwC;AAyDxC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,kCAAgB,CAAC;IAQ3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,MAAM,EACJ,GAAG,EACH,wBAAwB,GAAG,EAAE,EAC7B,YAAY,EACZ,OAAO,GAAG,IAAI,qBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAC5C,WAAW,EACX,YAAY,EACZ,YAAY,GAAG,CAAC,8BAAY,CAAC,GAAG,EAAE,CAAC,EACnC,gBAAgB,EAChB,gBAAgB,EAChB,IAAI,GAAG,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EACzC,WAAW,EACX,QAAQ,EACR,GAAG,EACH,uBAAuB,EACvB,YAAY,EACZ,qBAAqB,EACrB,yBAAyB,GAC1B,GAAG,KAAK,CAAC;QAEV,qJAAqJ;QACrJ,IAAI,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,mBAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE;YACjF,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;SACH;QAED,MAAM,kBAAkB,GAAG,yBAAyB,KAAK,SAAS,CAAC;QAEnE,oCAAoC;QACpC,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,IAAI,wBAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE;YACjE,YAAY;YACZ,kBAAkB;YAClB,YAAY;YACZ,YAAY,EAAE;gBACZ,QAAQ,EAAE,GAAuB,EAAE;oBACjC,OAAO;wBACL,MAAM,EAAE,6BAAmB,CAAC,KAAK;wBACjC,QAAQ;wBACR,OAAO,EAAE,OAAO,CAAC,aAAa;qBAC/B,CAAC;gBACJ,CAAC;aACF;YACD,6EAA6E;YAC7E,6CAA6C;YAC7C,aAAa,EAAE,gCAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YAErE;;;eAGG;YACH,aAAa,EAAE,IAAI;YAEnB,oBAAoB,EAAE,IAAI;YAC1B,QAAQ;YACR,IAAI;YACJ,uBAAuB;SACxB,CAAC,CAAC;QAEH,oDAAoD;QACpD,kFAAkF;QAClF,8CAA8C;QAC9C,wBAAwB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QAE1F,MAAM,QAAQ,GAA0B;YACtC,GAAG,KAAK;YACR,cAAc;YACd,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,GAAG,CAAC;YACrD,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,YAAY;YAE1B,iEAAiE;YACjE,yEAAyE;YACzE,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,SAAS;YACvB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,SAAS;YACnB,qBAAqB;SACtB,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,sBAAsB,GAAG,cAAc,CAAC;QAE7C,IAAI,WAAW,EAAE;YACf,IAAI,CAAC,8BAA8B,CAAC,WAAW,CAAC,CAAC;SAClD;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAmC,CAAC;QAE7D,yFAAyF;QACzF,2DAA2D;QAC3D,+FAA+F;QAC/F,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;SAC5C;QAED,kBAAI,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;CACF;AAhHD,gDAgHC","sourcesContent":["import type { Duration } from \"aws-cdk-lib\";\nimport { Tags, Token } from \"aws-cdk-lib\";\nimport { AutoScalingGroup, GroupMetrics } from \"aws-cdk-lib/aws-autoscaling\";\nimport type { AutoScalingGroupProps, CfnAutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport { LaunchTemplate, OperatingSystemType } from \"aws-cdk-lib/aws-ec2\";\nimport type { InstanceType, ISecurityGroup, MachineImageConfig, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { ApplicationTargetGroup } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { GuAsgCapacity } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport { GuAmiParameter } from \"../core\";\nimport type { AppIdentity, GuStack } from \"../core\";\nimport { GuHttpsEgressSecurityGroup } from \"../ec2\";\nimport { GuInstanceRole } from \"../iam\";\n\nexport type InstanceMetricGranularity = \"1Minute\" \| \"5Minute\";\n\n// Since we want to override the types of what gets passed in for the below props,\n// we need to use Omit<T, U> to remove them from the interface this extends\n// https://www.typescriptlang.org/docs/handbook/utility-types.html#omittype-keys\n// TODO avoid prop nesting to improve discoverability. See https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#flat.\nexport interface GuAutoScalingGroupProps\n extends\n Omit<\n AutoScalingGroupProps,\n \| \"imageId\"\n \| \"osType\"\n \| \"machineImage\"\n \| \"userData\"\n \| \"minCapacity\"\n \| \"maxCapacity\"\n \| \"desiredCapacity\"\n \| \"requireImdsv2\"\n \| \"securityGroup\"\n >,\n AppIdentity,\n GuAsgCapacity {\n /*\n @deprecated\n * It shouldn't be necessary to specify a value here.\n * GuCDK will create an AMI parameter by default. Riff-Raff can use this parameter to inject the latest AMI ID for\n * your AMIgo recipe.\n /\n imageId?: GuAmiParameter;\n /\n If you are using GuCDK to generate your riff-raff.yaml file, specify AMIgo props here.\n * If you are using a hardcoded riff-raff.yaml file (usually found in project root) then providing a value here has no\n * effect.\n /\n imageRecipe?: string \| AmigoProps;\n instanceType: InstanceType;\n userData: UserData;\n\n /\n How often to send EC2 metrics, such as CPU usage.\n * By default, AWS will produce `5Minute` granular metrics.\n \n It is recommended to produce `1Minute` granular metrics in production,\n * especially when using ASG metrics to trigger horizontal scaling as it allows for earlier scaling.\n \n @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html\n /\n instanceMetricGranularity: InstanceMetricGranularity;\n\n additionalSecurityGroups?: ISecurityGroup[];\n targetGroup?: ApplicationTargetGroup;\n httpPutResponseHopLimit?: number;\n defaultInstanceWarmup?: Duration;\n}\n\n/\n Construct which creates an Auto Scaling group.\n \n By default, all EC2 instances in this group will use [[`GuInstanceRole`]],\n * which provides common permissions (e.g. the ability to download an artifact and write logs to the account's logging Kinesis stream).\n \n If additional IAM permissions are required, a custom role can be provided via the `role` prop.\n * You may wish to instantiate [[`GuInstanceRole`]] yourself as a basis for this custom role, as it allows custom permissions\n * to be passed in.\n \n All EC2 instances in this group will be automatically associated with the [[`GuHttpsEgressSecurityGroup`]] security groups,\n * which allows outbound traffic over HTTPS.\n \n If additional ingress or egress rules are required, define custom security groups and pass them in via the\n * `additionalSecurityGroups` prop.\n \n All EC2 instances provisioned via this construct will use\n * [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html).\n /\nexport class GuAutoScalingGroup extends GuAppAwareConstruct(AutoScalingGroup) {\n public readonly app: string;\n public readonly amiParameter: GuAmiParameter;\n public readonly imageRecipe?: string \| AmigoProps;\n\n // Sadly this cannot be named `launchTemplate` as it would clash with a private property on the `AutoScalingGroup` class\n public readonly instanceLaunchTemplate: LaunchTemplate;\n\n constructor(scope: GuStack, id: string, props: GuAutoScalingGroupProps) {\n const {\n app,\n additionalSecurityGroups = [],\n blockDevices,\n imageId = new GuAmiParameter(scope, { app }),\n imageRecipe,\n instanceType,\n groupMetrics = [GroupMetrics.all()],\n minimumInstances,\n maximumInstances,\n role = new GuInstanceRole(scope, { app }),\n targetGroup,\n userData,\n vpc,\n httpPutResponseHopLimit,\n updatePolicy,\n defaultInstanceWarmup,\n instanceMetricGranularity,\n } = props;\n\n // Ensure min and max are defined in the same way. Throwing an `Error` when necessary. For example when min is defined via a Mapping, but max is not.\n if (Token.isUnresolved(minimumInstances) && !Token.isUnresolved(maximumInstances)) {\n throw new Error(\n \"minimumInstances is defined via a Mapping, but maximumInstances is not. Create maximumInstances via a Mapping too.\",\n );\n }\n\n const detailedMonitoring = instanceMetricGranularity === \"1Minute\";\n\n // Generate an ID unique to this app\n const launchTemplateId = `${scope.stack}-${scope.stage}-${app}`;\n const launchTemplate = new LaunchTemplate(scope, launchTemplateId, {\n blockDevices,\n detailedMonitoring,\n instanceType,\n machineImage: {\n getImage: (): MachineImageConfig => {\n return {\n osType: OperatingSystemType.LINUX,\n userData,\n imageId: imageId.valueAsString,\n };\n },\n },\n // Do not use the default AWS security group which allows egress on any port.\n // Favour HTTPS only egress rules by default.\n securityGroup: GuHttpsEgressSecurityGroup.forVpc(scope, { app, vpc }),\n\n /\n Ensure we satisfy FSBP EC2.8 control. If needed, an escape hatch can override this.\n See https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-8.\n /\n requireImdsv2: true,\n\n instanceMetadataTags: true,\n userData,\n role,\n httpPutResponseHopLimit,\n });\n\n // Add additional consumer specified Security Groups\n // Note: Launch templates via CDK allow specifying only one SG, so use connections\n // https://github.com/aws/aws-cdk/issues/18712\n additionalSecurityGroups.forEach((sg) => launchTemplate.connections.addSecurityGroup(sg));\n\n const asgProps: AutoScalingGroupProps = {\n ...props,\n launchTemplate,\n maxCapacity: maximumInstances ?? minimumInstances 2,\n minCapacity: minimumInstances,\n groupMetrics: groupMetrics,\n\n // Omit userData, instanceType, blockDevices & role from asgProps\n // As this are specified by the LaunchTemplate and must not be duplicated\n blockDevices: undefined,\n instanceType: undefined,\n role: undefined,\n userData: undefined,\n defaultInstanceWarmup,\n };\n\n super(scope, id, asgProps);\n\n this.app = app;\n this.amiParameter = imageId;\n this.imageRecipe = imageRecipe;\n this.instanceLaunchTemplate = launchTemplate;\n\n if (targetGroup) {\n this.attachToApplicationTargetGroup(targetGroup);\n }\n\n const cfnAsg = this.node.defaultChild as CfnAutoScalingGroup;\n\n // A CDK AutoScalingGroup comes with this update policy, whereas the CFN autscaling group\n // leaves it to the default value, which is actually false.\n // { UpdatePolicy: { autoScalingScheduledAction: { IgnoreUnmodifiedGroupSizeProperties: true }}\n if (!updatePolicy) {\n cfnAsg.addDeletionOverride(\"UpdatePolicy\");\n }\n\n Tags.of(launchTemplate).add(\"App\", app);\n }\n}\n"]}

package/lib/constructs/cloudwatch/alarm.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"alarm.d.ts","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/alarm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAI7D,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEpD,MAAM,WAAW,YAAa,SAAQ,UAAU,EAAE,WAAW;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,~~iBACf~~,SAAQ,IAAI,~~CACV~~,YAAY,EACZ,cAAc,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,kBAAkB,GAAG,KAAK,CACtG;~~IACD~~,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wCAAwC,CAAC,EAAE,MAAM,CAAC;CACnD;AAED,MAAM,WAAW,~~iBACf~~,SAAQ,IAAI,~~CACV~~,YAAY,EACZ,cAAc,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,kBAAkB,GAAG,KAAK,CACtG;~~IACD~~,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wCAAwC,CAAC,EAAE,MAAM,CAAC;CACnD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,OAAQ,SAAQ,KAAK;gBACpB,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;CAa5D"}
1	+ {"version":3,"file":"alarm.d.ts","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/alarm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAI7D,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEpD,MAAM,WAAW,YAAa,SAAQ,UAAU,EAAE,WAAW;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,YAAY,EACZ,cAAc,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,kBAAkB,GAAG,KAAK,CACtG;IACC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wCAAwC,CAAC,EAAE,MAAM,CAAC;CACnD;AAED,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAC7C,YAAY,EACZ,cAAc,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,kBAAkB,GAAG,KAAK,CACtG;IACC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wCAAwC,CAAC,EAAE,MAAM,CAAC;CACnD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,OAAQ,SAAQ,KAAK;gBACpB,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY;CAa5D"}

package/lib/constructs/cloudwatch/alarm.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"alarm.js","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/alarm.ts"],"names":[],"mappings":";;;AAAA,+DAAmD;AAEnD,+EAA+D;AAC/D,iDAA4C;~~AA2B5C~~;;;;;;;;;;;;;;;GAeG;AACH,MAAa,OAAQ,SAAQ,sBAAK;IAChC,YAAY,KAAc,EAAE,EAAU,EAAE,KAAmB;QACzD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAClC,MAAM,EAAE,YAAY,EAAE,cAAc,GAAG,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAEhE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAW,eAAe,MAAM,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;QAC5E,MAAM,QAAQ,GAAW,eAAK,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjF,IAAI,CAAC,cAAc,CAAC,IAAI,kCAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,IAAI,QAAQ,EAAE;YACZ,IAAI,CAAC,WAAW,CAAC,IAAI,kCAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;SAC3C;IACH,CAAC;CACF;AAdD,0BAcC","sourcesContent":["import { Alarm } from \"aws-cdk-lib/aws-cloudwatch\";\nimport type { AlarmProps } from \"aws-cdk-lib/aws-cloudwatch\";\nimport { SnsAction } from \"aws-cdk-lib/aws-cloudwatch-actions\";\nimport { Topic } from \"aws-cdk-lib/aws-sns\";\nimport type { ITopic } from \"aws-cdk-lib/aws-sns\";\nimport type { AppIdentity, GuStack } from \"../core\";\n\nexport interface GuAlarmProps extends AlarmProps, AppIdentity {\n snsTopicName: string;\n okAction?: boolean;\n}\n\nexport interface Http4xxAlarmProps\n extends Omit<\n GuAlarmProps,\n \"snsTopicName\" \| \"evaluationPeriods\" \| \"metric\" \| \"period\" \| \"threshold\" \| \"treatMissingData\" \| \"app\"\n > {\n tolerated4xxPercentage: number;\n numberOfMinutesAboveThresholdBeforeAlarm?: number;\n}\n\nexport interface Http5xxAlarmProps\n extends Omit<\n GuAlarmProps,\n \"snsTopicName\" \| \"evaluationPeriods\" \| \"metric\" \| \"period\" \| \"threshold\" \| \"treatMissingData\" \| \"app\"\n > {\n tolerated5xxPercentage: number;\n numberOfMinutesAboveThresholdBeforeAlarm?: number;\n}\n\n/*\n Creates a CloudWatch alarm which sends notifications to the specified SNS topic.\n \n Alarm actions are enabled by default.\n \n To enable the alarm only in PROD, use the value of `Stage`:\n * ```typescript\n * new GuAlarm(stack, \"alarm\", {\n * // other required props\n * actionsEnabled: this.stage === \"PROD\",\n * });\n * ```\n \n This library provides an implementation of some commonly used alarms, which require less boilerplate than this construct,\n * for example the [[`GuAlb5xxPercentageAlarm`]]. Prefer using these more specific implementations where possible.\n */\nexport class GuAlarm extends Alarm {\n constructor(scope: GuStack, id: string, props: GuAlarmProps) {\n const { region, account } = scope;\n const { snsTopicName, actionsEnabled = true, okAction } = props;\n\n super(scope, id, { ...props, actionsEnabled });\n\n const topicArn: string = `arn:aws:sns:${region}:${account}:${snsTopicName}`;\n const snsTopic: ITopic = Topic.fromTopicArn(scope, `SnsTopicFor${id}`, topicArn);\n this.addAlarmAction(new SnsAction(snsTopic));\n if (okAction) {\n this.addOkAction(new SnsAction(snsTopic));\n }\n }\n}\n"]}
1	+ {"version":3,"file":"alarm.js","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/alarm.ts"],"names":[],"mappings":";;;AAAA,+DAAmD;AAEnD,+EAA+D;AAC/D,iDAA4C;AAyB5C;;;;;;;;;;;;;;;GAeG;AACH,MAAa,OAAQ,SAAQ,sBAAK;IAChC,YAAY,KAAc,EAAE,EAAU,EAAE,KAAmB;QACzD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAClC,MAAM,EAAE,YAAY,EAAE,cAAc,GAAG,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAEhE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAW,eAAe,MAAM,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;QAC5E,MAAM,QAAQ,GAAW,eAAK,CAAC,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjF,IAAI,CAAC,cAAc,CAAC,IAAI,kCAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,IAAI,QAAQ,EAAE;YACZ,IAAI,CAAC,WAAW,CAAC,IAAI,kCAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;SAC3C;IACH,CAAC;CACF;AAdD,0BAcC","sourcesContent":["import { Alarm } from \"aws-cdk-lib/aws-cloudwatch\";\nimport type { AlarmProps } from \"aws-cdk-lib/aws-cloudwatch\";\nimport { SnsAction } from \"aws-cdk-lib/aws-cloudwatch-actions\";\nimport { Topic } from \"aws-cdk-lib/aws-sns\";\nimport type { ITopic } from \"aws-cdk-lib/aws-sns\";\nimport type { AppIdentity, GuStack } from \"../core\";\n\nexport interface GuAlarmProps extends AlarmProps, AppIdentity {\n snsTopicName: string;\n okAction?: boolean;\n}\n\nexport interface Http4xxAlarmProps extends Omit<\n GuAlarmProps,\n \"snsTopicName\" \| \"evaluationPeriods\" \| \"metric\" \| \"period\" \| \"threshold\" \| \"treatMissingData\" \| \"app\"\n> {\n tolerated4xxPercentage: number;\n numberOfMinutesAboveThresholdBeforeAlarm?: number;\n}\n\nexport interface Http5xxAlarmProps extends Omit<\n GuAlarmProps,\n \"snsTopicName\" \| \"evaluationPeriods\" \| \"metric\" \| \"period\" \| \"threshold\" \| \"treatMissingData\" \| \"app\"\n> {\n tolerated5xxPercentage: number;\n numberOfMinutesAboveThresholdBeforeAlarm?: number;\n}\n\n/*\n Creates a CloudWatch alarm which sends notifications to the specified SNS topic.\n \n Alarm actions are enabled by default.\n \n To enable the alarm only in PROD, use the value of `Stage`:\n * ```typescript\n * new GuAlarm(stack, \"alarm\", {\n * // other required props\n * actionsEnabled: this.stage === \"PROD\",\n * });\n * ```\n \n This library provides an implementation of some commonly used alarms, which require less boilerplate than this construct,\n * for example the [[`GuAlb5xxPercentageAlarm`]]. Prefer using these more specific implementations where possible.\n */\nexport class GuAlarm extends Alarm {\n constructor(scope: GuStack, id: string, props: GuAlarmProps) {\n const { region, account } = scope;\n const { snsTopicName, actionsEnabled = true, okAction } = props;\n\n super(scope, id, { ...props, actionsEnabled });\n\n const topicArn: string = `arn:aws:sns:${region}:${account}:${snsTopicName}`;\n const snsTopic: ITopic = Topic.fromTopicArn(scope, `SnsTopicFor${id}`, topicArn);\n this.addAlarmAction(new SnsAction(snsTopic));\n if (okAction) {\n this.addOkAction(new SnsAction(snsTopic));\n }\n }\n}\n"]}

package/lib/constructs/cloudwatch/api-gateway-alarms.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"api-gateway-alarms.d.ts","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/api-gateway-alarms.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,UAAU,mCACR,SAAQ,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,~~EACxC~~,iBAAiB,~~EACjB~~,WAAW;~~IACb~~,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,OAAO;gBAC7C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,mCAAmC;CAwBvE"}
1	+ {"version":3,"file":"api-gateway-alarms.d.ts","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/api-gateway-alarms.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,UAAU,mCACR,SAAQ,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,iBAAiB,EAAE,WAAW;IAC1E,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,OAAO;gBAC7C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,mCAAmC;CAwBvE"}

package/lib/constructs/cloudwatch/api-gateway-alarms.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"api-gateway-alarms.js","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/api-gateway-alarms.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AAEvC,+DAAkG;AAElG,kCAAsC;AAEtC,mCAAkC;~~AASlC~~;;;GAGG;AACH,MAAa,8BAA+B,SAAQ,eAAO;IACzD,YAAY,KAAc,EAAE,KAA0C;QACpE,MAAM,cAAc,GAAG,IAAI,+BAAc,CAAC;YACxC,UAAU,EAAE,WAAW;YACvB,YAAY,EAAE;gBACZ,EAAE,EAAE,KAAK,CAAC,kBAAkB,CAAC,iBAAiB,EAAE;gBAChD,EAAE,EAAE,KAAK,CAAC,kBAAkB,CAAC,WAAW,EAAE;aAC3C;YACD,KAAK,EAAE,iCAAiC,KAAK,CAAC,GAAG,EAAE;YACnD,MAAM,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;SAC5B,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,kCAAkC,KAAK,CAAC,GAAG,oBAAoB,KAAK,CAAC,KAAK,EAAE,CAAC;QACtG,MAAM,kBAAkB,GAAG,GAAG,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,sBAAsB,cAAc,CAAC;QAC/F,MAAM,UAAU,GAAG;YACjB,GAAG,KAAK;YACR,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,SAAS,EAAE,KAAK,CAAC,sBAAsB;YACvC,kBAAkB,EAAE,mCAAkB,CAAC,sBAAsB;YAC7D,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB;YAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,kBAAkB;YAC9D,iBAAiB,EAAE,KAAK,CAAC,wCAAwC,IAAI,CAAC;SACvE,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,kCAAkC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC9F,CAAC;CACF;AAzBD,wEAyBC","sourcesContent":["import { Duration } from \"aws-cdk-lib\";\nimport type { RestApi } from \"aws-cdk-lib/aws-apigateway\";\nimport { ComparisonOperator, MathExpression, TreatMissingData } from \"aws-cdk-lib/aws-cloudwatch\";\nimport type { GuStack } from \"../core\";\nimport { AppIdentity } from \"../core\";\nimport type { GuAlarmProps, Http5xxAlarmProps } from \"./alarm\";\nimport { GuAlarm } from \"./alarm\";\n\ninterface GuApiGateway5xxPercentageAlarmProps\n extends Pick<GuAlarmProps, \"snsTopicName\"~~>,\n~~ Http5xxAlarmProps~~,\n~~ AppIdentity {\n apiGatewayInstance: RestApi;\n}\n\n/*\n Creates an alarm which is triggered whenever the percentage of requests with a 5xx response code exceeds\n * the specified threshold.\n /\nexport class GuApiGateway5xxPercentageAlarm extends GuAlarm {\n constructor(scope: GuStack, props: GuApiGateway5xxPercentageAlarmProps) {\n const mathExpression = new MathExpression({\n expression: \"100m1/m2\",\n usingMetrics: {\n m1: props.apiGatewayInstance.metricServerError(),\n m2: props.apiGatewayInstance.metricCount(),\n },\n label: `% of 5XX responses served for ${props.app}`,\n period: Duration.minutes(1),\n });\n const defaultAlarmName = `High 5XX error percentage from ${props.app} (ApiGateway) in ${scope.stage}`;\n const defaultDescription = `${props.app} exceeded ${props.tolerated5xxPercentage}% error rate`;\n const alarmProps = {\n ...props,\n metric: mathExpression,\n treatMissingData: TreatMissingData.NOT_BREACHING,\n threshold: props.tolerated5xxPercentage,\n comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,\n alarmName: props.alarmName ?? defaultAlarmName,\n alarmDescription: props.alarmDescription ?? defaultDescription,\n evaluationPeriods: props.numberOfMinutesAboveThresholdBeforeAlarm ?? 1,\n };\n super(scope, AppIdentity.suffixText(props, \"ApiGatewayHigh5xxPercentageAlarm\"), alarmProps);\n }\n}\n"]}
1	+ {"version":3,"file":"api-gateway-alarms.js","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/api-gateway-alarms.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AAEvC,+DAAkG;AAElG,kCAAsC;AAEtC,mCAAkC;AAOlC;;;GAGG;AACH,MAAa,8BAA+B,SAAQ,eAAO;IACzD,YAAY,KAAc,EAAE,KAA0C;QACpE,MAAM,cAAc,GAAG,IAAI,+BAAc,CAAC;YACxC,UAAU,EAAE,WAAW;YACvB,YAAY,EAAE;gBACZ,EAAE,EAAE,KAAK,CAAC,kBAAkB,CAAC,iBAAiB,EAAE;gBAChD,EAAE,EAAE,KAAK,CAAC,kBAAkB,CAAC,WAAW,EAAE;aAC3C;YACD,KAAK,EAAE,iCAAiC,KAAK,CAAC,GAAG,EAAE;YACnD,MAAM,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;SAC5B,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,kCAAkC,KAAK,CAAC,GAAG,oBAAoB,KAAK,CAAC,KAAK,EAAE,CAAC;QACtG,MAAM,kBAAkB,GAAG,GAAG,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,sBAAsB,cAAc,CAAC;QAC/F,MAAM,UAAU,GAAG;YACjB,GAAG,KAAK;YACR,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,SAAS,EAAE,KAAK,CAAC,sBAAsB;YACvC,kBAAkB,EAAE,mCAAkB,CAAC,sBAAsB;YAC7D,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB;YAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,kBAAkB;YAC9D,iBAAiB,EAAE,KAAK,CAAC,wCAAwC,IAAI,CAAC;SACvE,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,KAAK,EAAE,kCAAkC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC9F,CAAC;CACF;AAzBD,wEAyBC","sourcesContent":["import { Duration } from \"aws-cdk-lib\";\nimport type { RestApi } from \"aws-cdk-lib/aws-apigateway\";\nimport { ComparisonOperator, MathExpression, TreatMissingData } from \"aws-cdk-lib/aws-cloudwatch\";\nimport type { GuStack } from \"../core\";\nimport { AppIdentity } from \"../core\";\nimport type { GuAlarmProps, Http5xxAlarmProps } from \"./alarm\";\nimport { GuAlarm } from \"./alarm\";\n\ninterface GuApiGateway5xxPercentageAlarmProps\n extends Pick<GuAlarmProps, \"snsTopicName\">, Http5xxAlarmProps, AppIdentity {\n apiGatewayInstance: RestApi;\n}\n\n/*\n Creates an alarm which is triggered whenever the percentage of requests with a 5xx response code exceeds\n * the specified threshold.\n /\nexport class GuApiGateway5xxPercentageAlarm extends GuAlarm {\n constructor(scope: GuStack, props: GuApiGateway5xxPercentageAlarmProps) {\n const mathExpression = new MathExpression({\n expression: \"100m1/m2\",\n usingMetrics: {\n m1: props.apiGatewayInstance.metricServerError(),\n m2: props.apiGatewayInstance.metricCount(),\n },\n label: `% of 5XX responses served for ${props.app}`,\n period: Duration.minutes(1),\n });\n const defaultAlarmName = `High 5XX error percentage from ${props.app} (ApiGateway) in ${scope.stage}`;\n const defaultDescription = `${props.app} exceeded ${props.tolerated5xxPercentage}% error rate`;\n const alarmProps = {\n ...props,\n metric: mathExpression,\n treatMissingData: TreatMissingData.NOT_BREACHING,\n threshold: props.tolerated5xxPercentage,\n comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,\n alarmName: props.alarmName ?? defaultAlarmName,\n alarmDescription: props.alarmDescription ?? defaultDescription,\n evaluationPeriods: props.numberOfMinutesAboveThresholdBeforeAlarm ?? 1,\n };\n super(scope, AppIdentity.suffixText(props, \"ApiGatewayHigh5xxPercentageAlarm\"), alarmProps);\n }\n}\n"]}

package/lib/constructs/cloudwatch/lambda-alarms.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"lambda-alarms.d.ts","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/lambda-alarms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,MAAM,WAAW,~~sCACf~~,SAAQ,IAAI,~~CACV~~,YAAY,EACZ,QAAQ,GAAG,WAAW,GAAG,oBAAoB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,KAAK,CACjG;~~IACD~~,wBAAwB,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,QAAQ,CAAC;IACpC,kDAAkD,CAAC,EAAE,MAAM,CAAC;IAC5D,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED,UAAU,kBAAmB,SAAQ,sCAAsC;IACzE,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,OAAO;gBAC3C,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB;CAsBlE;AAED,MAAM,WAAW,~~iCACf~~,SAAQ,IAAI,~~CACV~~,YAAY,EACZ,QAAQ,GAAG,WAAW,GAAG,oBAAoB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,KAAK,CACjG;~~IACD~~;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAElC;;;;OAIG;IACH,wCAAwC,CAAC,EAAE,MAAM,CAAC;IAElD,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED,UAAU,4BAA6B,SAAQ,iCAAiC;IAC9E,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,qBAAa,uBAAwB,SAAQ,OAAO;gBACtC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,4BAA4B;CAkB5E"}
1	+ {"version":3,"file":"lambda-alarms.d.ts","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/lambda-alarms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,MAAM,WAAW,sCAAuC,SAAQ,IAAI,CAClE,YAAY,EACZ,QAAQ,GAAG,WAAW,GAAG,oBAAoB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,KAAK,CACjG;IACC,wBAAwB,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,QAAQ,CAAC;IACpC,kDAAkD,CAAC,EAAE,MAAM,CAAC;IAC5D,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED,UAAU,kBAAmB,SAAQ,sCAAsC;IACzE,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,OAAO;gBAC3C,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB;CAsBlE;AAED,MAAM,WAAW,iCAAkC,SAAQ,IAAI,CAC7D,YAAY,EACZ,QAAQ,GAAG,WAAW,GAAG,oBAAoB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,KAAK,CACjG;IACC;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAElC;;;;OAIG;IACH,wCAAwC,CAAC,EAAE,MAAM,CAAC;IAElD,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED,UAAU,4BAA6B,SAAQ,iCAAiC;IAC9E,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,qBAAa,uBAAwB,SAAQ,OAAO;gBACtC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,4BAA4B;CAkB5E"}

package/lib/constructs/cloudwatch/lambda-alarms.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"lambda-alarms.js","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/lambda-alarms.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AACvC,+DAAkG;AAGlG,mCAAkC;~~AAkBlC~~;;GAEG;AACH,MAAa,4BAA6B,SAAQ,eAAO;IACvD,YAAY,KAAc,EAAE,EAAU,EAAE,KAAyB;QAC/D,MAAM,cAAc,GAAG,IAAI,+BAAc,CAAC;YACxC,UAAU,EAAE,WAAW;YACvB,YAAY,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE;YACvF,KAAK,EAAE,cAAc,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE;YAChD,MAAM,EAAE,KAAK,CAAC,wBAAwB,IAAI,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,8BAA8B,KAAK,CAAC,MAAM,CAAC,YAAY,cAAc,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5G,MAAM,kBAAkB,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,aAAa,KAAK,CAAC,wBAAwB,cAAc,CAAC;QACjH,MAAM,UAAU,GAAiB;YAC/B,GAAG,KAAK;YACR,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;YACrB,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,SAAS,EAAE,KAAK,CAAC,wBAAwB;YACzC,kBAAkB,EAAE,mCAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,KAAK,CAAC,kDAAkD,IAAI,CAAC;YAChF,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB;YAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,kBAAkB;SAC/D,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IAC/B,CAAC;CACF;AAvBD,oEAuBC;~~AA4BD~~,MAAa,uBAAwB,SAAQ,eAAO;IAClD,YAAY,KAAc,EAAE,EAAU,EAAE,KAAmC;QACzE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,GAAG,KAAK;YACR,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;YACrB,SAAS,EACP,KAAK,CAAC,SAAS,IAAI,+BAA+B,KAAK,CAAC,MAAM,CAAC,YAAY,cAAc,KAAK,CAAC,KAAK,GAAG;YACzG,gBAAgB,EACd,KAAK,CAAC,gBAAgB,IAAI,4EAA4E;YACxG,SAAS,EAAE,KAAK,CAAC,wBAAwB,IAAI,CAAC;YAC9C,iBAAiB,EAAE,KAAK,CAAC,wCAAwC,IAAI,CAAC;YACtE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC;gBACnC,MAAM,EAAE,sBAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,SAAS,EAAE,KAAK;aACjB,CAAC;YACF,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,kBAAkB,EAAE,mCAAkB,CAAC,sBAAsB;SAC9D,CAAC,CAAC;IACL,CAAC;CACF;AAnBD,0DAmBC","sourcesContent":["import { Duration } from \"aws-cdk-lib\";\nimport { ComparisonOperator, MathExpression, TreatMissingData } from \"aws-cdk-lib/aws-cloudwatch\";\nimport type { GuStack } from \"../core\";\nimport type { GuLambdaFunction } from \"../lambda\";\nimport { GuAlarm } from \"./alarm\";\nimport type { GuAlarmProps } from \"./alarm\";\n\nexport interface GuLambdaErrorPercentageMonitoringProps\n extends Omit<\n GuAlarmProps,\n \"metric\" \| \"threshold\" \| \"comparisonOperator\" \| \"evaluationPeriods\" \| \"treatMissingData\" \| \"app\"\n > {\n toleratedErrorPercentage: number;\n lengthOfEvaluationPeriod?: Duration;\n numberOfEvaluationPeriodsAboveThresholdBeforeAlarm?: number;\n noMonitoring?: false;\n}\n\ninterface GuLambdaAlarmProps extends GuLambdaErrorPercentageMonitoringProps {\n lambda: GuLambdaFunction;\n}\n\n/*\n Creates an alarm which is triggered whenever the error percentage specified is exceeded.\n /\nexport class GuLambdaErrorPercentageAlarm extends GuAlarm {\n constructor(scope: GuStack, id: string, props: GuLambdaAlarmProps) {\n const mathExpression = new MathExpression({\n expression: \"100m1/m2\",\n usingMetrics: { m1: props.lambda.metricErrors(), m2: props.lambda.metricInvocations() },\n label: `Error % of ${props.lambda.functionName}`,\n period: props.lengthOfEvaluationPeriod ?? Duration.minutes(1),\n });\n const defaultAlarmName = `High error percentage from ${props.lambda.functionName} lambda in ${scope.stage}`;\n const defaultDescription = `${props.lambda.functionName} exceeded ${props.toleratedErrorPercentage}% error rate`;\n const alarmProps: GuAlarmProps = {\n ...props,\n app: props.lambda.app,\n metric: mathExpression,\n treatMissingData: TreatMissingData.NOT_BREACHING,\n threshold: props.toleratedErrorPercentage,\n comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,\n evaluationPeriods: props.numberOfEvaluationPeriodsAboveThresholdBeforeAlarm ?? 1,\n alarmName: props.alarmName ?? defaultAlarmName,\n alarmDescription: props.alarmDescription ?? defaultDescription,\n };\n super(scope, id, alarmProps);\n }\n}\n\nexport interface GuLambdaThrottlingMonitoringProps\n extends Omit<\n GuAlarmProps,\n \"metric\" \| \"threshold\" \| \"comparisonOperator\" \| \"evaluationPeriods\" \| \"treatMissingData\" \| \"app\"\n > {\n /*\n Sum of thottled invocations above which to alarm.\n \n @defaultValue 0\n /\n toleratedThrottlingCount?: number;\n\n /\n Evaluation period in minutes for alarm.\n \n @defaultValue 1\n */\n numberOfMinutesAboveThresholdBeforeAlarm?: number;\n\n noMonitoring?: false;\n}\n\ninterface GuLambdaThrottlingAlarmProps extends GuLambdaThrottlingMonitoringProps {\n lambda: GuLambdaFunction;\n}\n\nexport class GuLambdaThrottlingAlarm extends GuAlarm {\n constructor(scope: GuStack, id: string, props: GuLambdaThrottlingAlarmProps) {\n super(scope, id, {\n ...props,\n app: props.lambda.app,\n alarmName:\n props.alarmName ?? `Lambda throttling alarm for ${props.lambda.functionName} lambda in ${scope.stage}.`,\n alarmDescription:\n props.alarmDescription ?? \"Alarm when lambda is throttled (which causes requests to fail with a 429).\",\n threshold: props.toleratedThrottlingCount ?? 0,\n evaluationPeriods: props.numberOfMinutesAboveThresholdBeforeAlarm ?? 1,\n metric: props.lambda.metricThrottles({\n period: Duration.seconds(60),\n statistic: \"sum\",\n }),\n treatMissingData: TreatMissingData.NOT_BREACHING,\n comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,\n });\n }\n}\n"]}
1	+ {"version":3,"file":"lambda-alarms.js","sourceRoot":"","sources":["../../../src/constructs/cloudwatch/lambda-alarms.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AACvC,+DAAkG;AAGlG,mCAAkC;AAiBlC;;GAEG;AACH,MAAa,4BAA6B,SAAQ,eAAO;IACvD,YAAY,KAAc,EAAE,EAAU,EAAE,KAAyB;QAC/D,MAAM,cAAc,GAAG,IAAI,+BAAc,CAAC;YACxC,UAAU,EAAE,WAAW;YACvB,YAAY,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE;YACvF,KAAK,EAAE,cAAc,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE;YAChD,MAAM,EAAE,KAAK,CAAC,wBAAwB,IAAI,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,8BAA8B,KAAK,CAAC,MAAM,CAAC,YAAY,cAAc,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5G,MAAM,kBAAkB,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,aAAa,KAAK,CAAC,wBAAwB,cAAc,CAAC;QACjH,MAAM,UAAU,GAAiB;YAC/B,GAAG,KAAK;YACR,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;YACrB,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,SAAS,EAAE,KAAK,CAAC,wBAAwB;YACzC,kBAAkB,EAAE,mCAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,KAAK,CAAC,kDAAkD,IAAI,CAAC;YAChF,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB;YAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,kBAAkB;SAC/D,CAAC;QACF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IAC/B,CAAC;CACF;AAvBD,oEAuBC;AA2BD,MAAa,uBAAwB,SAAQ,eAAO;IAClD,YAAY,KAAc,EAAE,EAAU,EAAE,KAAmC;QACzE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,GAAG,KAAK;YACR,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;YACrB,SAAS,EACP,KAAK,CAAC,SAAS,IAAI,+BAA+B,KAAK,CAAC,MAAM,CAAC,YAAY,cAAc,KAAK,CAAC,KAAK,GAAG;YACzG,gBAAgB,EACd,KAAK,CAAC,gBAAgB,IAAI,4EAA4E;YACxG,SAAS,EAAE,KAAK,CAAC,wBAAwB,IAAI,CAAC;YAC9C,iBAAiB,EAAE,KAAK,CAAC,wCAAwC,IAAI,CAAC;YACtE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC;gBACnC,MAAM,EAAE,sBAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,SAAS,EAAE,KAAK;aACjB,CAAC;YACF,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;YAChD,kBAAkB,EAAE,mCAAkB,CAAC,sBAAsB;SAC9D,CAAC,CAAC;IACL,CAAC;CACF;AAnBD,0DAmBC","sourcesContent":["import { Duration } from \"aws-cdk-lib\";\nimport { ComparisonOperator, MathExpression, TreatMissingData } from \"aws-cdk-lib/aws-cloudwatch\";\nimport type { GuStack } from \"../core\";\nimport type { GuLambdaFunction } from \"../lambda\";\nimport { GuAlarm } from \"./alarm\";\nimport type { GuAlarmProps } from \"./alarm\";\n\nexport interface GuLambdaErrorPercentageMonitoringProps extends Omit<\n GuAlarmProps,\n \"metric\" \| \"threshold\" \| \"comparisonOperator\" \| \"evaluationPeriods\" \| \"treatMissingData\" \| \"app\"\n> {\n toleratedErrorPercentage: number;\n lengthOfEvaluationPeriod?: Duration;\n numberOfEvaluationPeriodsAboveThresholdBeforeAlarm?: number;\n noMonitoring?: false;\n}\n\ninterface GuLambdaAlarmProps extends GuLambdaErrorPercentageMonitoringProps {\n lambda: GuLambdaFunction;\n}\n\n/*\n Creates an alarm which is triggered whenever the error percentage specified is exceeded.\n /\nexport class GuLambdaErrorPercentageAlarm extends GuAlarm {\n constructor(scope: GuStack, id: string, props: GuLambdaAlarmProps) {\n const mathExpression = new MathExpression({\n expression: \"100m1/m2\",\n usingMetrics: { m1: props.lambda.metricErrors(), m2: props.lambda.metricInvocations() },\n label: `Error % of ${props.lambda.functionName}`,\n period: props.lengthOfEvaluationPeriod ?? Duration.minutes(1),\n });\n const defaultAlarmName = `High error percentage from ${props.lambda.functionName} lambda in ${scope.stage}`;\n const defaultDescription = `${props.lambda.functionName} exceeded ${props.toleratedErrorPercentage}% error rate`;\n const alarmProps: GuAlarmProps = {\n ...props,\n app: props.lambda.app,\n metric: mathExpression,\n treatMissingData: TreatMissingData.NOT_BREACHING,\n threshold: props.toleratedErrorPercentage,\n comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,\n evaluationPeriods: props.numberOfEvaluationPeriodsAboveThresholdBeforeAlarm ?? 1,\n alarmName: props.alarmName ?? defaultAlarmName,\n alarmDescription: props.alarmDescription ?? defaultDescription,\n };\n super(scope, id, alarmProps);\n }\n}\n\nexport interface GuLambdaThrottlingMonitoringProps extends Omit<\n GuAlarmProps,\n \"metric\" \| \"threshold\" \| \"comparisonOperator\" \| \"evaluationPeriods\" \| \"treatMissingData\" \| \"app\"\n> {\n /*\n Sum of thottled invocations above which to alarm.\n \n @defaultValue 0\n /\n toleratedThrottlingCount?: number;\n\n /\n Evaluation period in minutes for alarm.\n \n @defaultValue 1\n */\n numberOfMinutesAboveThresholdBeforeAlarm?: number;\n\n noMonitoring?: false;\n}\n\ninterface GuLambdaThrottlingAlarmProps extends GuLambdaThrottlingMonitoringProps {\n lambda: GuLambdaFunction;\n}\n\nexport class GuLambdaThrottlingAlarm extends GuAlarm {\n constructor(scope: GuStack, id: string, props: GuLambdaThrottlingAlarmProps) {\n super(scope, id, {\n ...props,\n app: props.lambda.app,\n alarmName:\n props.alarmName ?? `Lambda throttling alarm for ${props.lambda.functionName} lambda in ${scope.stage}.`,\n alarmDescription:\n props.alarmDescription ?? \"Alarm when lambda is throttled (which causes requests to fail with a 429).\",\n threshold: props.toleratedThrottlingCount ?? 0,\n evaluationPeriods: props.numberOfMinutesAboveThresholdBeforeAlarm ?? 1,\n metric: props.lambda.metricThrottles({\n period: Duration.seconds(60),\n statistic: \"sum\",\n }),\n treatMissingData: TreatMissingData.NOT_BREACHING,\n comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,\n });\n }\n}\n"]}

package/lib/constructs/iam/janus-assumable-role.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"janus-assumable-role.d.ts","sourceRoot":"","sources":["../../../src/constructs/iam/janus-assumable-role.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,oBAAqB,SAAQ,MAAM;gBAClC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,yBAAyB;~~CAiB7D~~"}
1	+ {"version":3,"file":"janus-assumable-role.d.ts","sourceRoot":"","sources":["../../../src/constructs/iam/janus-assumable-role.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,oBAAqB,SAAQ,MAAM;gBAClC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,yBAAyB;CAoB7D"}

package/lib/constructs/iam/janus-assumable-role.js CHANGED Viewed

@@ -24,8 +24,11 @@ class GuJanusAssumableRole extends roles_1.GuRole {
         super(scope, `${props.janusPermission}Role`, {
             // Will be assumed by Janus user
             assumedBy: new aws_iam_1.ArnPrincipal(janusArnParamValue),
+            // IAM API only allows filtering by path prefix
+            path: "/gu/janus/discoverable/",
         });
         const tags = aws_cdk_lib_1.Tags.of(this);
+        // Discoverability marked by tag as well as path because tags are easier to find
         tags.add("gu:janus:discoverable", "true");
         tags.add("gu:janus:permission", props.janusPermission);
         if (props.janusName) {

package/lib/constructs/iam/janus-assumable-role.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"janus-assumable-role.js","sourceRoot":"","sources":["../../../src/constructs/iam/janus-assumable-role.ts"],"names":[],"mappings":";;;AAAA,6CAAmC;AACnC,iDAAmD;AACnD,iDAAsD;AAEtD,mCAAiC;AAqBjC;;;;;;;;;;;GAWG;AACH,MAAa,oBAAqB,SAAQ,cAAM;IAC9C,YAAY,KAAc,EAAE,KAAgC;QAC1D,gEAAgE;QAChE,MAAM,kBAAkB,GAAG,yBAAe,CAAC,uBAAuB,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;QACtG,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,eAAe,MAAM,EAAE;YAC3C,gCAAgC;YAChC,SAAS,EAAE,IAAI,sBAAY,CAAC,kBAAkB,CAAC;~~SAChD~~,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,kBAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,SAAS,EAAE;YACnB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;SAC5C;QACD,IAAI,KAAK,CAAC,gBAAgB,EAAE;YAC1B,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;SAC1D;IACH,CAAC;CACF;~~AAlBD~~,~~oDAkBC~~","sourcesContent":["import { Tags } from \"aws-cdk-lib\";\nimport { ArnPrincipal } from \"aws-cdk-lib/aws-iam\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport type { GuStack } from \"../core\";\nimport { GuRole } from \"./roles\";\n\nexport interface GuJanusAssumableRoleProps {\n /*\n Tells Janus which ProvisionedRole this IAM role is part of.\n /\n janusPermission: string;\n\n /\n A friendly name for this IAM role to be shown in Janus.\n * It should help Janus users to choose the right role.\n /\n janusName?: string;\n\n /\n A description of this IAM role to be shown in Janus.\n * It should help Janus users to choose the right role.\n /\n janusDescription?: string;\n}\n\n/\n Construct that creates an IAM role with the additional tags that Janus uses to find the role\n * and its metadata.\n \n ```typescript\n * new GuJanusAssumableRole(stack, {\n * janusPermission: \"some-app-dev\",\n * janusName: \"Some App Developer\",\n * janusDescription: \"Description of role that will be shown in Janus.\",\n * })\n * ```\n */\nexport class GuJanusAssumableRole extends GuRole {\n constructor(scope: GuStack, props: GuJanusAssumableRoleProps) {\n // Existing SSM param in stack account that holds Janus user ARN\n const janusArnParamValue = StringParameter.valueForStringParameter(scope, \"/security/janus/user-arn\");\n super(scope, `${props.janusPermission}Role`, {\n // Will be assumed by Janus user\n assumedBy: new ArnPrincipal(janusArnParamValue),\n });\n const tags = Tags.of(this);\n tags.add(\"gu:janus:discoverable\", \"true\");\n tags.add(\"gu:janus:permission\", props.janusPermission);\n if (props.janusName) {\n tags.add(\"gu:janus:name\", props.janusName);\n }\n if (props.janusDescription) {\n tags.add(\"gu:janus:description\", props.janusDescription);\n }\n }\n}\n"]}
1	+ {"version":3,"file":"janus-assumable-role.js","sourceRoot":"","sources":["../../../src/constructs/iam/janus-assumable-role.ts"],"names":[],"mappings":";;;AAAA,6CAAmC;AACnC,iDAAmD;AACnD,iDAAsD;AAEtD,mCAAiC;AAqBjC;;;;;;;;;;;GAWG;AACH,MAAa,oBAAqB,SAAQ,cAAM;IAC9C,YAAY,KAAc,EAAE,KAAgC;QAC1D,gEAAgE;QAChE,MAAM,kBAAkB,GAAG,yBAAe,CAAC,uBAAuB,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;QACtG,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,eAAe,MAAM,EAAE;YAC3C,gCAAgC;YAChC,SAAS,EAAE,IAAI,sBAAY,CAAC,kBAAkB,CAAC;YAC/C,+CAA+C;YAC/C,IAAI,EAAE,yBAAyB;SAChC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,kBAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3B,gFAAgF;QAChF,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,SAAS,EAAE;YACnB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;SAC5C;QACD,IAAI,KAAK,CAAC,gBAAgB,EAAE;YAC1B,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;SAC1D;IACH,CAAC;CACF;AArBD,oDAqBC","sourcesContent":["import { Tags } from \"aws-cdk-lib\";\nimport { ArnPrincipal } from \"aws-cdk-lib/aws-iam\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport type { GuStack } from \"../core\";\nimport { GuRole } from \"./roles\";\n\nexport interface GuJanusAssumableRoleProps {\n /*\n Tells Janus which ProvisionedRole this IAM role is part of.\n /\n janusPermission: string;\n\n /\n A friendly name for this IAM role to be shown in Janus.\n * It should help Janus users to choose the right role.\n /\n janusName?: string;\n\n /\n A description of this IAM role to be shown in Janus.\n * It should help Janus users to choose the right role.\n /\n janusDescription?: string;\n}\n\n/\n Construct that creates an IAM role with the additional tags that Janus uses to find the role\n * and its metadata.\n \n ```typescript\n * new GuJanusAssumableRole(stack, {\n * janusPermission: \"some-app-dev\",\n * janusName: \"Some App Developer\",\n * janusDescription: \"Description of role that will be shown in Janus.\",\n * })\n * ```\n */\nexport class GuJanusAssumableRole extends GuRole {\n constructor(scope: GuStack, props: GuJanusAssumableRoleProps) {\n // Existing SSM param in stack account that holds Janus user ARN\n const janusArnParamValue = StringParameter.valueForStringParameter(scope, \"/security/janus/user-arn\");\n super(scope, `${props.janusPermission}Role`, {\n // Will be assumed by Janus user\n assumedBy: new ArnPrincipal(janusArnParamValue),\n // IAM API only allows filtering by path prefix\n path: \"/gu/janus/discoverable/\",\n });\n const tags = Tags.of(this);\n // Discoverability marked by tag as well as path because tags are easier to find\n tags.add(\"gu:janus:discoverable\", \"true\");\n tags.add(\"gu:janus:permission\", props.janusPermission);\n if (props.janusName) {\n tags.add(\"gu:janus:name\", props.janusName);\n }\n if (props.janusDescription) {\n tags.add(\"gu:janus:description\", props.janusDescription);\n }\n }\n}\n"]}

package/lib/constructs/loadbalancing/alb/application-listener.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-listener.d.ts","sourceRoot":"","sources":["../../../../src/constructs/loadbalancing/alb/application-listener.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EAIpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,WAAW,0BAA2B,SAAQ,wBAAwB,EAAE,WAAW;CAAG;;;;;;AAE5F;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAsB,SAAQ,0BAAwC;gBACrE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B;CAG1E;AAED,MAAM,WAAW,+BACf,SAAQ,IAAI,CAAC,0BAA0B,EAAE,eAAe,GAAG,cAAc,CAAC,~~EACxE~~,WAAW;~~IACb~~,WAAW,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;;;;;;AAED;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,+BAAwC;gBAC1E,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,+BAA+B;CAoB/E"}
1	+ {"version":3,"file":"application-listener.d.ts","sourceRoot":"","sources":["../../../../src/constructs/loadbalancing/alb/application-listener.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EAIpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,WAAW,0BAA2B,SAAQ,wBAAwB,EAAE,WAAW;CAAG;;;;;;AAE5F;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAsB,SAAQ,0BAAwC;gBACrE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B;CAG1E;AAED,MAAM,WAAW,+BACf,SAAQ,IAAI,CAAC,0BAA0B,EAAE,eAAe,GAAG,cAAc,CAAC,EAAE,WAAW;IACvF,WAAW,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;;;;;;AAED;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,+BAAwC;gBAC1E,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,+BAA+B;CAoB/E"}

package/lib/constructs/loadbalancing/alb/application-listener.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-listener.js","sourceRoot":"","sources":["../../../../src/constructs/loadbalancing/alb/application-listener.ts"],"names":[],"mappings":";;;AAAA,uFAKgD;AAEhD,kFAA+E;AAO/E;;;;;;;;;;;;GAYG;AACH,MAAa,qBAAsB,SAAQ,IAAA,yCAAmB,EAAC,gDAAmB,CAAC;IACjF,YAAY,KAAc,EAAE,EAAU,EAAE,KAAiC;QACvE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,gDAAmB,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;CACF;AAJD,sDAIC;~~AASD~~;;;;;;GAMG;AACH,MAAa,0BAA2B,SAAQ,IAAA,yCAAmB,EAAC,gDAAmB,CAAC;IACtF,YAAY,KAAc,EAAE,EAAU,EAAE,KAAsC;QAC5E,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;QAE3C,MAAM,WAAW,GAA+B;YAC9C,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YAC9B,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,gDAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,gDAAmB,CAAC,IAAI;YAC5E,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,sCAAS,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YAC9D,GAAG,KAAK;YACR,YAAY,EAAE,WAAW;gBACvB,CAAC,CAAC;oBACE;wBACE,cAAc,EAAE,WAAW,CAAC,cAAc;qBAC3C;iBACF;gBACH,CAAC,CAAC,EAAE;YACN,aAAa,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;SACrD,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAChC,CAAC;CACF;AArBD,gEAqBC","sourcesContent":["import {\n ApplicationListener,\n ApplicationProtocol,\n ListenerAction,\n SslPolicy,\n} from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { ApplicationListenerProps } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { GuAppAwareConstruct } from \"../../../utils/mixin/app-aware-construct\";\nimport type { GuCertificate } from \"../../acm\";\nimport type { AppIdentity, GuStack } from \"../../core\";\nimport type { GuApplicationTargetGroup } from \"./application-target-group\";\n\nexport interface GuApplicationListenerProps extends ApplicationListenerProps, AppIdentity {}\n\n/*\n Construct which creates a Listener.\n \n This construct should be used in conjunction with [[`GuApplicationLoadBalancer`]] and [[`GuApplicationTargetGroup`]]\n * to route traffic to your application. For more details on these three components, see the\n * [AWS documentation](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html#application-load-balancer-components).\n \n If you are running an application which only accepts traffic over HTTPS, consider using [[`GuHttpsApplicationListener`]]\n * to reduce the amount of boilerplate needed when configuring your Listener.\n \n This resource is stateful.\n * @see https://github.com/guardian/cdk/blob/main/docs/stateful-resources.md\n /\nexport class GuApplicationListener extends GuAppAwareConstruct(ApplicationListener) {\n constructor(scope: GuStack, id: string, props: GuApplicationListenerProps) {\n super(scope, id, { port: 443, protocol: ApplicationProtocol.HTTPS, ...props });\n }\n}\n\nexport interface GuHttpsApplicationListenerProps\n extends Omit<GuApplicationListenerProps, \"defaultAction\" \| \"certificates\"~~>,\n~~ AppIdentity {\n targetGroup: GuApplicationTargetGroup;\n certificate?: GuCertificate;\n}\n\n/\n Construct which creates a Listener which accepts HTTPS traffic.\n \n You must pass a [[`GuCertificate`]] to this Listener via the `certificate` prop.\n \n For general details about Listeners, see [[`GuApplicationListener`]].\n */\nexport class GuHttpsApplicationListener extends GuAppAwareConstruct(ApplicationListener) {\n constructor(scope: GuStack, id: string, props: GuHttpsApplicationListenerProps) {\n const { certificate, targetGroup } = props;\n\n const mergedProps: GuApplicationListenerProps = {\n port: certificate ? 443 : 8080,\n protocol: certificate ? ApplicationProtocol.HTTPS : ApplicationProtocol.HTTP,\n sslPolicy: certificate ? SslPolicy.RECOMMENDED_TLS : undefined,\n ...props,\n certificates: certificate\n ? [\n {\n certificateArn: certificate.certificateArn,\n },\n ]\n : [],\n defaultAction: ListenerAction.forward([targetGroup]),\n };\n\n super(scope, id, mergedProps);\n }\n}\n"]}
1	+ {"version":3,"file":"application-listener.js","sourceRoot":"","sources":["../../../../src/constructs/loadbalancing/alb/application-listener.ts"],"names":[],"mappings":";;;AAAA,uFAKgD;AAEhD,kFAA+E;AAO/E;;;;;;;;;;;;GAYG;AACH,MAAa,qBAAsB,SAAQ,IAAA,yCAAmB,EAAC,gDAAmB,CAAC;IACjF,YAAY,KAAc,EAAE,EAAU,EAAE,KAAiC;QACvE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,gDAAmB,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;CACF;AAJD,sDAIC;AAQD;;;;;;GAMG;AACH,MAAa,0BAA2B,SAAQ,IAAA,yCAAmB,EAAC,gDAAmB,CAAC;IACtF,YAAY,KAAc,EAAE,EAAU,EAAE,KAAsC;QAC5E,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;QAE3C,MAAM,WAAW,GAA+B;YAC9C,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YAC9B,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,gDAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,gDAAmB,CAAC,IAAI;YAC5E,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,sCAAS,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YAC9D,GAAG,KAAK;YACR,YAAY,EAAE,WAAW;gBACvB,CAAC,CAAC;oBACE;wBACE,cAAc,EAAE,WAAW,CAAC,cAAc;qBAC3C;iBACF;gBACH,CAAC,CAAC,EAAE;YACN,aAAa,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;SACrD,CAAC;QAEF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAChC,CAAC;CACF;AArBD,gEAqBC","sourcesContent":["import {\n ApplicationListener,\n ApplicationProtocol,\n ListenerAction,\n SslPolicy,\n} from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport type { ApplicationListenerProps } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { GuAppAwareConstruct } from \"../../../utils/mixin/app-aware-construct\";\nimport type { GuCertificate } from \"../../acm\";\nimport type { AppIdentity, GuStack } from \"../../core\";\nimport type { GuApplicationTargetGroup } from \"./application-target-group\";\n\nexport interface GuApplicationListenerProps extends ApplicationListenerProps, AppIdentity {}\n\n/*\n Construct which creates a Listener.\n \n This construct should be used in conjunction with [[`GuApplicationLoadBalancer`]] and [[`GuApplicationTargetGroup`]]\n * to route traffic to your application. For more details on these three components, see the\n * [AWS documentation](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html#application-load-balancer-components).\n \n If you are running an application which only accepts traffic over HTTPS, consider using [[`GuHttpsApplicationListener`]]\n * to reduce the amount of boilerplate needed when configuring your Listener.\n \n This resource is stateful.\n * @see https://github.com/guardian/cdk/blob/main/docs/stateful-resources.md\n /\nexport class GuApplicationListener extends GuAppAwareConstruct(ApplicationListener) {\n constructor(scope: GuStack, id: string, props: GuApplicationListenerProps) {\n super(scope, id, { port: 443, protocol: ApplicationProtocol.HTTPS, ...props });\n }\n}\n\nexport interface GuHttpsApplicationListenerProps\n extends Omit<GuApplicationListenerProps, \"defaultAction\" \| \"certificates\">, AppIdentity {\n targetGroup: GuApplicationTargetGroup;\n certificate?: GuCertificate;\n}\n\n/\n Construct which creates a Listener which accepts HTTPS traffic.\n \n You must pass a [[`GuCertificate`]] to this Listener via the `certificate` prop.\n \n For general details about Listeners, see [[`GuApplicationListener`]].\n */\nexport class GuHttpsApplicationListener extends GuAppAwareConstruct(ApplicationListener) {\n constructor(scope: GuStack, id: string, props: GuHttpsApplicationListenerProps) {\n const { certificate, targetGroup } = props;\n\n const mergedProps: GuApplicationListenerProps = {\n port: certificate ? 443 : 8080,\n protocol: certificate ? ApplicationProtocol.HTTPS : ApplicationProtocol.HTTP,\n sslPolicy: certificate ? SslPolicy.RECOMMENDED_TLS : undefined,\n ...props,\n certificates: certificate\n ? [\n {\n certificateArn: certificate.certificateArn,\n },\n ]\n : [],\n defaultAction: ListenerAction.forward([targetGroup]),\n };\n\n super(scope, id, mergedProps);\n }\n}\n"]}

package/lib/constructs/rds/instance.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../../src/constructs/rds/instance.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAe,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEpD,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,IAAI,CAAC;CACf;AAGD,MAAM,WAAW,MAAO,SAAQ,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,uBAAuB,CAAC;IACtG,OAAO,EAAE,KAAK,CAAC;IACf;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBACf,SAAQ,IAAI,CAAC,qBAAqB,EAAE,cAAc,GAAG,iBAAiB,GAAG,uBAAuB,CAAC,~~EAC/F~~,WAAW;~~IACb~~,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,WAAW,EAAE,KAAK,GAAG,MAAM,CAAC;CAC7B;;;;;;AAED,qBAAa,kBAAmB,SAAQ,uBAAqC;gBAC/D,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAiBvE"}
1	+ {"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../../src/constructs/rds/instance.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAe,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEpD,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,IAAI,CAAC;CACf;AAGD,MAAM,WAAW,MAAO,SAAQ,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,GAAG,uBAAuB,CAAC;IACtG,OAAO,EAAE,KAAK,CAAC;IACf;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBACf,SAAQ,IAAI,CAAC,qBAAqB,EAAE,cAAc,GAAG,iBAAiB,GAAG,uBAAuB,CAAC,EAAE,WAAW;IAC9G,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,WAAW,EAAE,KAAK,GAAG,MAAM,CAAC;CAC7B;;;;;;AAED,qBAAa,kBAAmB,SAAQ,uBAAqC;gBAC/D,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,uBAAuB;CAiBvE"}

package/lib/constructs/rds/instance.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"instance.js","sourceRoot":"","sources":["../../../src/constructs/rds/instance.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AACvC,iDAAmD;AACnD,iDAAoE;AAEpE,+EAA4E;~~AA6B5E~~,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,0BAAgB,CAAC;IAC3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,4CAA4C;QAC5C,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,YAAY,GAAG,IAAI,sBAAY,CAAC,gBAAE,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAExF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,WAAW,EAAE,qBAAW,CAAC,GAAG;YAC5B,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,KAAK;YAC7B,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe;YAC1F,qBAAqB,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,qBAAqB;YACtG,GAAG,KAAK;YACR,YAAY;SACb,CAAC,CAAC;QACH,kBAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;CACF;AAlBD,gDAkBC","sourcesContent":["import { Fn, Tags } from \"aws-cdk-lib\";\nimport { InstanceType } from \"aws-cdk-lib/aws-ec2\";\nimport { DatabaseInstance, StorageType } from \"aws-cdk-lib/aws-rds\";\nimport type { DatabaseInstanceProps } from \"aws-cdk-lib/aws-rds\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../core\";\n\nexport interface OptIn {\n enabled: true;\n}\n\n// Using Pick here means that we get the AWS documentation for these properties rather than needing to define it ourselves\nexport interface OptOut extends Pick<DatabaseInstanceProps, \"backupRetention\" \| \"preferredBackupWindow\"> {\n enabled: false;\n /*\n We recommend using DevX Backups where possible. If it is not suitable for your use-case please document\n * this here so that we can understand why this is switched off when performing security audits.\n /\n optOutReason: string;\n}\n\nexport interface GuDatabaseInstanceProps\n extends Omit<DatabaseInstanceProps, \"instanceType\" \| \"backupRetention\" \| \"preferredBackupWindow\"~~>,\n~~ AppIdentity {\n instanceType: string;\n /\n We recommend using DevX Backups to protect your RDS instance's backups.\n * For more details on this feature, see the\n * [documentation](https://docs.google.com/document/d/1VDCSxYFlWs4R6g0Waa6OmmfytV60AROyHxfIGho7cLA/edit#heading=h.vwt7syo8ng40).\n */\n devXBackups: OptIn \| OptOut;\n}\n\nexport class GuDatabaseInstance extends GuAppAwareConstruct(DatabaseInstance) {\n constructor(scope: GuStack, id: string, props: GuDatabaseInstanceProps) {\n // CDK just wants \"t3.micro\" format, whereas\n // some CFN yaml might have the older \"db.t3.micro\" with the \"db.\" prefix\n // This logic ensures the \"db.\" prefix is removed before applying the CFN\n const instanceType = new InstanceType(Fn.join(\"\", Fn.split(\"db.\", props.instanceType)));\n\n super(scope, id, {\n storageType: StorageType.GP3,\n deletionProtection: true,\n deleteAutomatedBackups: false,\n backupRetention: props.devXBackups.enabled ? undefined : props.devXBackups.backupRetention,\n preferredBackupWindow: props.devXBackups.enabled ? undefined : props.devXBackups.preferredBackupWindow,\n ...props,\n instanceType,\n });\n Tags.of(this).add(\"devx-backup-enabled\", String(props.devXBackups.enabled));\n }\n}\n"]}
1	+ {"version":3,"file":"instance.js","sourceRoot":"","sources":["../../../src/constructs/rds/instance.ts"],"names":[],"mappings":";;;AAAA,6CAAuC;AACvC,iDAAmD;AACnD,iDAAoE;AAEpE,+EAA4E;AA4B5E,MAAa,kBAAmB,SAAQ,IAAA,yCAAmB,EAAC,0BAAgB,CAAC;IAC3E,YAAY,KAAc,EAAE,EAAU,EAAE,KAA8B;QACpE,4CAA4C;QAC5C,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,YAAY,GAAG,IAAI,sBAAY,CAAC,gBAAE,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAExF,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,WAAW,EAAE,qBAAW,CAAC,GAAG;YAC5B,kBAAkB,EAAE,IAAI;YACxB,sBAAsB,EAAE,KAAK;YAC7B,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe;YAC1F,qBAAqB,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,qBAAqB;YACtG,GAAG,KAAK;YACR,YAAY;SACb,CAAC,CAAC;QACH,kBAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;CACF;AAlBD,gDAkBC","sourcesContent":["import { Fn, Tags } from \"aws-cdk-lib\";\nimport { InstanceType } from \"aws-cdk-lib/aws-ec2\";\nimport { DatabaseInstance, StorageType } from \"aws-cdk-lib/aws-rds\";\nimport type { DatabaseInstanceProps } from \"aws-cdk-lib/aws-rds\";\nimport { GuAppAwareConstruct } from \"../../utils/mixin/app-aware-construct\";\nimport type { AppIdentity, GuStack } from \"../core\";\n\nexport interface OptIn {\n enabled: true;\n}\n\n// Using Pick here means that we get the AWS documentation for these properties rather than needing to define it ourselves\nexport interface OptOut extends Pick<DatabaseInstanceProps, \"backupRetention\" \| \"preferredBackupWindow\"> {\n enabled: false;\n /*\n We recommend using DevX Backups where possible. If it is not suitable for your use-case please document\n * this here so that we can understand why this is switched off when performing security audits.\n /\n optOutReason: string;\n}\n\nexport interface GuDatabaseInstanceProps\n extends Omit<DatabaseInstanceProps, \"instanceType\" \| \"backupRetention\" \| \"preferredBackupWindow\">, AppIdentity {\n instanceType: string;\n /\n We recommend using DevX Backups to protect your RDS instance's backups.\n * For more details on this feature, see the\n * [documentation](https://docs.google.com/document/d/1VDCSxYFlWs4R6g0Waa6OmmfytV60AROyHxfIGho7cLA/edit#heading=h.vwt7syo8ng40).\n */\n devXBackups: OptIn \| OptOut;\n}\n\nexport class GuDatabaseInstance extends GuAppAwareConstruct(DatabaseInstance) {\n constructor(scope: GuStack, id: string, props: GuDatabaseInstanceProps) {\n // CDK just wants \"t3.micro\" format, whereas\n // some CFN yaml might have the older \"db.t3.micro\" with the \"db.\" prefix\n // This logic ensures the \"db.\" prefix is removed before applying the CFN\n const instanceType = new InstanceType(Fn.join(\"\", Fn.split(\"db.\", props.instanceType)));\n\n super(scope, id, {\n storageType: StorageType.GP3,\n deletionProtection: true,\n deleteAutomatedBackups: false,\n backupRetention: props.devXBackups.enabled ? undefined : props.devXBackups.backupRetention,\n preferredBackupWindow: props.devXBackups.enabled ? undefined : props.devXBackups.preferredBackupWindow,\n ...props,\n instanceType,\n });\n Tags.of(this).add(\"devx-backup-enabled\", String(props.devXBackups.enabled));\n }\n}\n"]}

package/lib/patterns/ec2-app/base.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAQ7E,OAAO,KAAK,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAQ,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,IAAI,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAM5F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAc,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAMtG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAC;AAElF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGhE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,YAAY,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACxC;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACzC;;OAEG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD;;OAEG;IACH,QAAQ,EAAE,eAAe,GAAG,QAAQ,CAAC;IACrC;;;;;;OAMG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC;;OAEG;IACH,uBAAuB,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/C;;;OAGG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAE7C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;OAEG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B;;OAEG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,YAAY,CAAC;IAEhC;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAE3B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAE1B;;OAEG;IACH,UAAU,CAAC,EAAE;QACX;;;;;;;;;;;;;;;;WAgBG;QACH,OAAO,EAAE,IAAI,CAAC;QACd;;;;WAIG;QACH,MAAM,EAAE,MAAM,CAAC;QACf;;;;;;;;;;WAUG;QACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB;;;;;;;;;WASG;QACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC;;;;;;;;;;;;;;;;;;WAkBG;QACH,6BAA6B,CAAC,EAAE,MAAM,CAAC;QAEvC;;;;;;WAMG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;OAEG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAE7B;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAElC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAE5B;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,QAAQ,CAAC;IAEjC;;;;;;;;OAQG;IACH,yBAAyB,EAAE,SAAS,GAAG,SAAS,CAAC;CAClD;AAUD;;;;;;GAMG;AACH,qBAAa,QAAS,SAAQ,SAAS;IASrC,SAAgB,GAAG,EAAE,IAAI,CAAC;IAC1B,SAAgB,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5C,SAAgB,YAAY,EAAE,yBAAyB,CAAC;IACxD,SAAgB,gBAAgB,EAAE,kBAAkB,CAAC;IACrD,SAAgB,QAAQ,EAAE,0BAA0B,CAAC;IACrD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;gBAE1C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa;~~CAyTjD~~"}
1	+ {"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAQ7E,OAAO,KAAK,EAAE,YAAY,EAAS,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAQ,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,IAAI,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAM5F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAc,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAMtG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAC;AAElF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGhE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,YAAY,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACxC;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACzC;;OAEG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;OAEG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD;;OAEG;IACH,QAAQ,EAAE,eAAe,GAAG,QAAQ,CAAC;IACrC;;;;;;OAMG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC;;OAEG;IACH,uBAAuB,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/C;;;OAGG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B;;OAEG;IACH,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAE7C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;OAEG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B;;OAEG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB;;OAEG;IACH,gBAAgB,CAAC,EAAE,YAAY,CAAC;IAEhC;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAE3B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAE1B;;OAEG;IACH,UAAU,CAAC,EAAE;QACX;;;;;;;;;;;;;;;;WAgBG;QACH,OAAO,EAAE,IAAI,CAAC;QACd;;;;WAIG;QACH,MAAM,EAAE,MAAM,CAAC;QACf;;;;;;;;;;WAUG;QACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB;;;;;;;;;WASG;QACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC;;;;;;;;;;;;;;;;;;WAkBG;QACH,6BAA6B,CAAC,EAAE,MAAM,CAAC;QAEvC;;;;;;WAMG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;OAEG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAE7B;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAElC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAE5B;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,QAAQ,CAAC;IAEjC;;;;;;;;OAQG;IACH,yBAAyB,EAAE,SAAS,GAAG,SAAS,CAAC;CAClD;AAUD;;;;;;GAMG;AACH,qBAAa,QAAS,SAAQ,SAAS;IASrC,SAAgB,GAAG,EAAE,IAAI,CAAC;IAC1B,SAAgB,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5C,SAAgB,YAAY,EAAE,yBAAyB,CAAC;IACxD,SAAgB,gBAAgB,EAAE,kBAAkB,CAAC;IACrD,SAAgB,QAAQ,EAAE,0BAA0B,CAAC;IACrD,SAAgB,WAAW,EAAE,wBAAwB,CAAC;gBAE1C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa;CA2TjD"}

package/lib/patterns/ec2-app/base.js CHANGED Viewed

@@ -191,6 +191,7 @@ class GuEc2App extends constructs_1.Construct {
                     GATEKEEPER_FUNCTION_ARN: gatekeeperFunctionArn,
                 },
             });
+            aws_cdk_lib_1.Tags.of(authLambda).add("Owner", "DevX");
             authLambda.addToRolePolicy(new aws_iam_1.PolicyStatement({
                 effect: aws_iam_1.Effect.ALLOW,
                 actions: ["lambda:InvokeFunction"],

package/lib/patterns/ec2-app/base.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;AAAA,uGAAuG;AACvG,6CAA0D;AAE1D,iEAAsF;AACtF,yDAKiC;AAEjC,iDAAqD;AAErD,uFAA6F;AAC7F,uGAA2F;AAC3F,iDAA8D;AAC9D,uDAA+D;AAC/D,iDAAsD;AACtD,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAIqC;AAErC,gDAAkF;AAClF,8CAAsG;AAEtG,8CAAgF;AAChF,oDAA2D;AAC3D,kEAIwC;AACxC,uCAAwC;AAGxC,yDAAsE;AAkRtE,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,iBAAiB,GAAG,IAAI,EACxB,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EAAE,YAAY,EACtB,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EACnF,wBAAwB,EACxB,YAAY,EACZ,qBAAqB,EACrB,yBAAyB,GAC1B,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,MAAM,QAAQ,GAAG,YAAY,YAAY,kBAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QAEnH,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,WAAW;YACrC,CAAC,CAAC,IAAI,mBAAa,CAAC,KAAK,EAAE;gBACvB,GAAG;gBACH,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,YAAY,EAAE,gBAAgB,CAAC,YAAY;aAC5C,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,wBAAwB,GAC5B,QAAQ,YAAY,wBAAU,IAAI,QAAQ,CAAC,aAAa;YACtD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YAEpE,+DAA+D;YAC/D,YAAY,EAAE,8BAAY,CAAC,oBAAoB,CAAC;gBAC9C,eAAe,EAAE,CAAC,2CAAyB,CAAC,GAAG,CAAC;gBAChD,WAAW,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;aACjC,CAAC;YAEF,QAAQ,EAAE,QAAQ,YAAY,wBAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACvE,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;YACX,uBAAuB,EAAE,wBAAwB;YACjD,YAAY;YACZ,qBAAqB;YACrB,yBAAyB;SAC1B,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;YACD,iBAAiB;SAClB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,IAAI,OAAO,WAAW,KAAK,WAAW;SAChF,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAEtG,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;YAC7B,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;YAEvD,MAAM,EACJ,aAAa,GAAG,CAAC,4BAA4B,CAAC,EAC9C,uBAAuB,GAAG,EAAE,EAC5B,6BAA6B,GAAG,GAAG,MAAM,0BAA0B,GACpE,GAAG,KAAK,CAAC,UAAU,CAAC;YAErB,IAAI,uBAAuB,GAAG,EAAE,EAAE;gBAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;aACtE;YAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC5B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;aAC9D;YAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAAE;gBACrE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;aAClF;YAED,MAAM,oBAAoB,GAAG,yBAAe,CAAC,uBAAuB,CAClE,KAAK,EACL,mCAAmC,EACnC,qCAAyB,CAAC,oBAAoB,CAAC,IAAI,CACpD,CAAC;YAEF,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,gBAAgB,IAAI,MAAM,CAAC;YAErE,sEAAsE;YACtE,4BAA4B;YAC5B,yDAAyD;YACzD,MAAM,qBAAqB,GAAG,4BAA4B,oBAAoB,CAAC,WAAW,oBAAoB,gBAAgB,oBAAoB,CAAC;YAEnJ,8CAA8C;YAC9C,oDAAoD;YACpD,MAAM,UAAU,GAAG,IAAI,yBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE;gBAC5D,GAAG,EAAE,GAAG;gBACR,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,oBAAO,CAAC,YAAY;gBAC7B,QAAQ,EAAE,UAAU,gBAAgB,kDAAkD;gBACtF,iBAAiB,EAAE,IAAI;gBACvB,qBAAqB,EAAE,IAAI;gBAC3B,cAAc,EAAE,qCAAyB,CAAC,8BAA8B,CAAC,IAAI;gBAC7E,YAAY,EAAE,yBAAY,CAAC,MAAM;gBACjC,WAAW,EAAE;oBACX,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;oBACvC,uBAAuB,EAAE,qBAAqB;iBAC/C;aACF,CAAC,CAAC;YAEH,UAAU,CAAC,eAAe,CACxB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,KAAK;gBACpB,OAAO,EAAE,CAAC,uBAAuB,CAAC;gBAClC,SAAS,EAAE,CAAC,qBAAqB,CAAC;aACnC,CAAC,CACH,CAAC;YAEF,yEAAyE;YACzE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,IAAI,sBAAQ,CAAC,IAAI,EAAE,WAAW,EAAE;gBAC/C,cAAc,EAAE;oBACd,iBAAiB,EAAE,UAAU;oBAC7B,SAAS,EAAE,UAAU;iBACtB;aACF,CAAC,CAAC;YAEH,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAEhF,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE;oBACb,YAAY,EAAE,IAAA,iCAAuB,EAAC,YAAY,CAAC;iBACpD;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACtG,MAAM,YAAY,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;YAE9G,MAAM,WAAW,GAAG,IAAI,4CAA8B,CAAC,KAAK,EAAE,YAAY,EAAE;gBAC1E,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,iBAAiB,EAAE,YAAY;gBAC/B,gBAAgB,EAAE;oBAChB,KAAK,EAAE,+BAAiB,CAAC,YAAY;oBACrC,SAAS,EAAE,+BAAiB,CAAC,iBAAiB;oBAC9C,UAAU,EAAE,+BAAiB,CAAC,kBAAkB;oBAChD,cAAc,EAAE,+BAAiB,CAAC,cAAc;oBAChD,MAAM,EAAE;wBACN,IAAI,EAAE,+BAAiB,CAAC,WAAW;qBACpC;iBACF;gBACD,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;aACvC,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;gBACtD,0BAA0B,EAAE,CAAC,4CAA8B,CAAC,MAAM,CAAC;gBACnE,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,WAAW,KAAK,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC;iBACxE;gBAED,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,mEAAmE;gBACnE,cAAc;gBACd,eAAe,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,mBAAmB,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtC,oBAAoB,EAAE,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC;YAEH,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAE/C,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE;gBAChC,MAAM,EAAE,IAAI,8DAAyB,CAAC;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,cAAc,EAAE,cAAc;oBAC9B,cAAc,EAAE,cAAc;oBAC9B,IAAI,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;oBAC3C,cAAc,EAAE,sBAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC;iBAC1D,CAAC;aACH,CAAC,CAAC;YAEH,qEAAqE;YACrE,MAAM,sBAAsB,GAAG,IAAI,gCAA0B,CAAC,KAAK,EAAE,YAAY,EAAE;gBACjF,GAAG;gBACH,GAAG;aACJ,CAAC,CAAC;YAEH,YAAY,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;SACvD;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAzUD,4BAyUC","sourcesContent":["/* eslint \"@guardian/tsdoc-required/tsdoc-required\": 2 -- to begin rolling this out for public APIs. /\nimport { Duration, SecretValue, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice, UpdatePolicy } from \"aws-cdk-lib/aws-autoscaling\";\nimport { AdditionalHealthCheckType, HealthChecks } from \"aws-cdk-lib/aws-autoscaling\";\nimport {\n ProviderAttribute,\n UserPool,\n UserPoolClientIdentityProvider,\n UserPoolIdentityProviderGoogle,\n} from \"aws-cdk-lib/aws-cognito\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { HealthCheck as ALBHealthCheck } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { ApplicationProtocol, ListenerAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { AuthenticateCognitoAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2-actions\";\nimport { Effect, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Architecture, Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http4xxAlarmProps, Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport {\n GuAlb4xxPercentageAlarm,\n GuAlb5xxPercentageAlarm,\n GuUnhealthyInstancesAlarm,\n} from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuLoggingStreamNameParameter } from \"../../constructs/core\";\nimport { GuHttpsEgressSecurityGroup, GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport { GuLambdaFunction } from \"../../constructs/lambda\";\nimport {\n GuApplicationLoadBalancer,\n GuApplicationTargetGroup,\n GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { getUserPoolDomainPrefix } from \"../../utils/cognito/cognito\";\n\n/\n To ship your application logs to ELK automatically, you must:\n \n 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n \n Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n /\nexport interface ApplicationLoggingProps {\n /\n Enables forwarding of application logs to the Guardian ELK stack.\n \n Note, to work, you will need to also do the following non-CDK things:\n \n 1. Include the `cdk-base` Amigo role in your AMI.\n * 2. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 3. Confirm that your [[`systemdUnitName`]] is configured properly.\n \n Unless you have explicitly opted-out, appropriate IAM permissions for\n * logging to Kinesis will be configured automatically via the [[`GuEc2App`]]\n * pattern.\n \n @see https://github.com/guardian/amigo/tree/main/roles/cdk-base\n /\n enabled: boolean;\n /\n This needs to match the name of your SystemD unit.\n \n If your systemd unit is not `<app>.service` set this value.\n \n @defaultValue `<app>.service`\n /\n systemdUnitName?: string;\n}\n\n/\n @privateRemarks we should rename this to AlarmsProps.\n /\nexport interface Alarms {\n /\n Name of the target (SNS Topic) for alarm notifications.\n /\n snsTopicName: string;\n /\n Enable the 5xx alarm with settings.\n /\n http5xxAlarm: false \| Http5xxAlarmProps;\n /\n Enable the 4xx alarm with settings.\n /\n http4xxAlarm?: false \| Http4xxAlarmProps;\n /\n Enable the unhealthy instances alarm.\n /\n unhealthyInstancesAlarm: boolean;\n /\n Internal flag - users of this library should ignore this setting.\n /\n noMonitoring?: false;\n}\n\nexport interface GuEc2AppProps extends AppIdentity {\n /\n User data for the autoscaling group.\n /\n userData: GuUserDataProps \| UserData;\n /\n Network access restrictions for your load balancer.\n \n Note, this merely provides defence in depth; you should, for example, limit\n * access to the VPN and then treat that as sufficient. Instead, use Google\n * Auth for human access, or a suitable machine auth mechanism.\n /\n access: AppAccess;\n /\n The port your application runs on.\n /\n applicationPort: number;\n /\n Configure IAM roles for autoscaling group EC2 instances.\n /\n roleConfiguration?: GuInstanceRoleProps;\n /\n Enable and configure alarms.\n /\n monitoringConfiguration: Alarms \| NoMonitoring;\n /\n EC2 instance type. Note, ensure your code is built for the same\n * architecture family (arm64 - 'Graviton' instances - or x64).\n /\n instanceType: InstanceType;\n /\n Enable and configures application logs.\n /\n applicationLogging?: ApplicationLoggingProps;\n\n /\n Enable access logging for this load balancer.\n * Access logs are written to an S3 bucket within your AWS account.\n * The bucket is created by {@link https://github.com/guardian/aws-account-setup}.\n * The logs are queryable via the `gucdk_access_logs` Athena database.\n \n @defaultValue true\n /\n withAccessLogging?: boolean;\n\n /\n Add block devices (additional storage).\n /\n blockDevices?: BlockDevice[];\n /\n Autoscaling group min and max sizes.\n /\n scaling: GuAsgCapacity;\n /\n Specify certificate for the load balancer.\n /\n certificateProps?: GuDomainName;\n\n /\n Configure AMIgo image recipe. This is only necessary if you are using GuCDK to generate your riff-raff.yaml file.\n /\n imageRecipe?: string \| AmigoProps;\n /\n Specify the VPC to use.\n \n @see https://github.com/guardian/aws-account-setup\n /\n vpc?: IVpc;\n /\n Specify private subnets if using a non-default VPC or (generally\n * discouraged) to limit to a subset of the available subnets.\n /\n privateSubnets?: ISubnet[];\n\n /\n Specify private subnets if using a non-default VPC or (generally\n * discouraged) to limit to a subset of the available subnets.\n /\n publicSubnets?: ISubnet[];\n\n /\n Configure Google Auth.\n /\n googleAuth?: {\n /\n Enables Google Auth (via Cognito). *Additional MANUAL steps required -\n see below.*\n \n * Limits access to members of the allowed Google groups.\n \n Note, this does not currently support simultaneous machine access, so\n * only set to true if you only require staff access to your service, or are\n * supporting machine access in some other way.\n \n MANUAL STEPS: to get this to work, we need a Google Project and\n * associated credentials. Full instructions can be found here:\n \n https://docs.google.com/document/d/1_k1FSE52AZHXufWLTiKTI3xy5cGpziyHazSHTKrYfco/edit?usp=sharing\n \n DevX hope to automate this process in the near future.\n /\n enabled: true;\n /\n The domain users will access your service.\n \n Set this to the same as for certificateProps.\n /\n domain: string;\n /\n Groups used for membership checks.\n \n If specified, cannot be empty. Users must be a member of at least one\n * group to gain access.\n \n WARNING: groups must be specified with the `guardian.co.uk` domain, even\n * if that is the non-idiomatic choice for daily use.\n \n @defaultValue [`engineering@guardian.co.uk`]\n /\n allowedGroups?: string[];\n /\n The number of minutes before the session expires.\n \n Set this value to a safe period of time that revoked users\n * sessions will continue to function.\n \n NOTE: This value cannot be larger than 60 minutes.\n \n @defaultValue 15\n /\n sessionTimeoutInMinutes?: number;\n /\n Secrets Manager path containing Google OAuth2 Client credentials.\n \n NOTE: you do not need to set this value, but you DO need to generate and\n * store the associated credentials in Secrets Manager.\n \n Credentials should be stored in Secrets Manager as JSON:\n \n ```json\n * {\n * \"clientId\": \"my-client-id\",\n * \"clientSecret\": \"my-client-secret\"\n * }\n * ```\n \n @see `googleAuth.enabled` for how to generate.\n \n @defaultValue /:STAGE/:stack/:app/google-auth-credentials\n /\n credentialsSecretsManagerPath?: string;\n\n /\n When using Auth in the ALB, which stage of cognito-lambda to use.\n \n For most applications this should always be PROD, even in the CODE environments.\n \n @defaultValue PROD\n /\n cognitoAuthStage?: string;\n };\n\n /\n Specify custom healthcheck\n /\n healthcheck?: ALBHealthCheck;\n\n /\n Set http put response hop limit for the launch template.\n * It can be necessary to raise this value from the default of 1\n * for example when sharing the instance profile with a docker container running on the instance.\n /\n instanceMetadataHopLimit?: number;\n\n /\n Specify an update policy for the ASG created by this pattern.\n \n @see https://docs.aws.amazon.com/cdk/api/latest/docs/aws-autoscaling-readme.html#update-policy\n \n @defaultValue UpdatePolicy.none() - Cloudformation does not attempt to rotate instances in the ASG\n * and must rely on riffraff to do so.\n /\n updatePolicy?: UpdatePolicy;\n\n /\n You can specify how long after an instance reaches the InService state it waits before contributing\n * usage data to the aggregated metrics. This specified time is called the default instance warmup.\n * This keeps dynamic scaling from being affected by metrics for individual instances that aren't yet\n * handling application traffic and that might be experiencing temporarily high usage of compute resources.\n \n @see https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-default-instance-warmup.html\n /\n defaultInstanceWarmup?: Duration;\n\n /\n How often to send EC2 metrics, such as CPU usage.\n * By default, AWS will produce `5Minute` granular metrics.\n \n It is recommended to produce `1Minute` granular metrics in production,\n * especially when using ASG metrics to trigger horizontal scaling as it allows for earlier scaling.\n \n @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html\n /\n instanceMetricGranularity: \"1Minute\" \| \"5Minute\";\n}\n\nfunction restrictedCidrRanges(ranges: IPeer[]) {\n return ranges.map((range) => ({\n range,\n port: Port.tcp(443),\n description: `Allow access on port 443 from ${range.uniqueId}`,\n }));\n}\n\n/\n Pattern which creates the resources needed to run an application on EC2\n * behind a load balancer. For convenience, you may wish to use [[`GuPlayApp`]]\n * or [[`GuNodeApp`]], which extend this class.\n \n See props for further details.\n /\nexport class GuEc2App extends Construct {\n /\n * These are public for now, as this allows users to\n * modify these constructs as desired to fit their\n * specific needs.\n * In the future, we might build functionality to better enable users\n * to access in-pattern constructs, but this would allow teams to be unblocked\n * in the short term.\n * /\n public readonly vpc: IVpc;\n public readonly certificate?: GuCertificate;\n public readonly loadBalancer: GuApplicationLoadBalancer;\n public readonly autoScalingGroup: GuAutoScalingGroup;\n public readonly listener: GuHttpsApplicationListener;\n public readonly targetGroup: GuApplicationTargetGroup;\n\n constructor(scope: GuStack, props: GuEc2AppProps) {\n const {\n access,\n withAccessLogging = true,\n app,\n // We should update this default once a significant number of apps have migrated to devx-logs\n applicationLogging = { enabled: false },\n applicationPort,\n blockDevices,\n certificateProps,\n instanceType,\n monitoringConfiguration,\n roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n scaling: { minimumInstances, maximumInstances = minimumInstances 2 },\n userData: userDataLike,\n imageRecipe,\n vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n instanceMetadataHopLimit,\n updatePolicy,\n defaultInstanceWarmup,\n instanceMetricGranularity,\n } = props;\n\n super(scope, app); // The assumption is `app` is unique\n\n // We should really prevent users from doing this via the type system,\n // but that requires a breaking change to the API\n if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n throw new Error(\n \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\",\n );\n }\n\n const userData = userDataLike instanceof UserData ? userDataLike : new GuUserData(scope, { ...userDataLike, app });\n\n AppAccess.validate(access);\n\n const certificate =\n typeof certificateProps !== \"undefined\"\n ? new GuCertificate(scope, {\n app,\n domainName: certificateProps.domainName,\n hostedZoneId: certificateProps.hostedZoneId,\n })\n : undefined;\n\n const maybePrivateConfigPolicy =\n userData instanceof GuUserData && userData.configuration\n ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n : [];\n\n const mergedRoleConfiguration: GuInstanceRoleProps = {\n withoutLogShipping: roleConfiguration.withoutLogShipping,\n additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n };\n\n const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n app,\n vpc,\n instanceType,\n minimumInstances,\n maximumInstances,\n role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n\n // TODO should this be defaulted at pattern or construct level?\n healthChecks: HealthChecks.withAdditionalChecks({\n additionalTypes: [AdditionalHealthCheckType.ELB],\n gracePeriod: Duration.minutes(2),\n }),\n\n userData: userData instanceof GuUserData ? userData.userData : userData,\n vpcSubnets: { subnets: privateSubnets },\n ...(blockDevices && { blockDevices }),\n imageRecipe,\n httpPutResponseHopLimit: instanceMetadataHopLimit,\n updatePolicy,\n defaultInstanceWarmup,\n instanceMetricGranularity,\n });\n\n // This allows automatic shipping of instance Cloud Init logs when using the\n // `cdk-base` Amigo role on your AMI.\n Tags.of(autoScalingGroup).add(\n MetadataKeys.LOG_KINESIS_STREAM_NAME,\n GuLoggingStreamNameParameter.getInstance(scope).valueAsString,\n );\n\n if (applicationLogging.enabled) {\n // This allows automatic shipping of application logs when using the\n // `cdk-base` Amigo role on your AMI.\n Tags.of(autoScalingGroup).add(\n MetadataKeys.SYSTEMD_UNIT,\n applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`,\n );\n }\n\n const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n app,\n vpc,\n // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n internetFacing: access.scope !== AccessScope.INTERNAL,\n vpcSubnets: {\n subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n },\n withAccessLogging,\n });\n\n const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n app,\n vpc,\n protocol: ApplicationProtocol.HTTP,\n targets: [autoScalingGroup],\n port: applicationPort,\n healthCheck: props.healthcheck,\n });\n\n const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n app,\n loadBalancer,\n certificate,\n targetGroup,\n // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n open: access.scope === AccessScope.PUBLIC && typeof certificate !== \"undefined\",\n });\n\n // Since AWS won't create a security group automatically when open=false, we need to add our own\n if (access.scope !== AccessScope.PUBLIC) {\n loadBalancer.addSecurityGroup(\n new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n app,\n vpc,\n description: \"Allow restricted ingress from CIDR ranges\",\n allowAllOutbound: false,\n ingresses: restrictedCidrRanges(access.cidrRanges),\n }),\n );\n }\n\n if (!monitoringConfiguration.noMonitoring) {\n const { http5xxAlarm, http4xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n if (http4xxAlarm) {\n new GuAlb4xxPercentageAlarm(scope, {\n app,\n loadBalancer,\n snsTopicName,\n ...http4xxAlarm,\n });\n }\n if (http5xxAlarm) {\n new GuAlb5xxPercentageAlarm(scope, {\n app,\n loadBalancer,\n snsTopicName,\n ...http5xxAlarm,\n });\n }\n if (unhealthyInstancesAlarm) {\n new GuUnhealthyInstancesAlarm(scope, {\n app,\n targetGroup,\n snsTopicName,\n });\n }\n }\n\n if (props.googleAuth?.enabled) {\n const prefix = `/${scope.stage}/${scope.stack}/${app}`;\n\n const {\n allowedGroups = [\"engineering@guardian.co.uk\"],\n sessionTimeoutInMinutes = 15,\n credentialsSecretsManagerPath = `${prefix}/google-auth-credentials`,\n } = props.googleAuth;\n\n if (sessionTimeoutInMinutes > 60) {\n throw new Error(\"googleAuth.sessionTimeoutInMinutes must be <= 60!\");\n }\n\n if (allowedGroups.length < 1) {\n throw new Error(\"googleAuth.allowedGroups cannot be empty!\");\n }\n\n if (allowedGroups.find((group) => !group.endsWith(\"@guardian.co.uk\"))) {\n throw new Error(\"googleAuth.allowedGroups must use the @guardian.co.uk domain.\");\n }\n\n const deployToolsAccountId = StringParameter.fromStringParameterName(\n scope,\n \"deploy-tools-account-id-parameter\",\n NAMED_SSM_PARAMETER_PATHS.DeployToolsAccountId.path,\n );\n\n const cognitoAuthStage = props.googleAuth.cognitoAuthStage ?? \"PROD\";\n\n // See https://github.com/guardian/cognito-auth-lambdas for the source\n // code here. ARN format is:\n // arn:aws:lambda:aws-region:acct-id:function:helloworld.\n const gatekeeperFunctionArn = `arn:aws:lambda:eu-west-1:${deployToolsAccountId.stringValue}:function:deploy-${cognitoAuthStage}-gatekeeper-lambda`;\n\n // Note, handler and filename must match here:\n // https://github.com/guardian/cognito-auth-lambdas.\n const authLambda = new GuLambdaFunction(scope, \"auth-lambda\", {\n app: app,\n memorySize: 128,\n handler: \"bootstrap\",\n runtime: Runtime.PROVIDED_AL2,\n fileName: `deploy/${cognitoAuthStage}/cognito-lambda/devx-cognito-lambda-amd64-v2.zip`,\n withoutFilePrefix: true,\n withoutArtifactUpload: true,\n bucketNamePath: NAMED_SSM_PARAMETER_PATHS.OrganisationDistributionBucket.path,\n architecture: Architecture.X86_64,\n environment: {\n ALLOWED_GROUPS: allowedGroups.join(\",\"),\n GATEKEEPER_FUNCTION_ARN: gatekeeperFunctionArn,\n },\n });\n\n authLambda.addToRolePolicy(\n new PolicyStatement({\n effect: Effect.ALLOW,\n actions: [\"lambda:InvokeFunction\"],\n resources: [gatekeeperFunctionArn],\n }),\n );\n\n // Cognito user pool. We require both lambdas: pre-sign-up runs the first\n // time a user attempts to authenticate (before they exist in the User\n // Pool); pre-auth runs in subsequent authentication flows.\n const userPool = new UserPool(this, \"user-pool\", {\n lambdaTriggers: {\n preAuthentication: authLambda,\n preSignUp: authLambda,\n },\n });\n\n // These help ensure domain is deterministic but also unique. Key\n // assumption is that app/stack/stage combo are unique within Guardian.\n const domainPrefix = `com-gu-${app.toLowerCase()}-${scope.stage.toLowerCase()}`;\n\n const userPoolDomain = userPool.addDomain(\"domain\", {\n cognitoDomain: {\n domainPrefix: getUserPoolDomainPrefix(domainPrefix),\n },\n });\n\n const clientId = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientId\" });\n const clientSecret = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientSecret\" });\n\n const userPoolIdp = new UserPoolIdentityProviderGoogle(scope, \"google-idp\", {\n userPool: userPool,\n clientId: clientId.toString(),\n clientSecretValue: clientSecret,\n attributeMapping: {\n email: ProviderAttribute.GOOGLE_EMAIL,\n givenName: ProviderAttribute.GOOGLE_GIVEN_NAME,\n familyName: ProviderAttribute.GOOGLE_FAMILY_NAME,\n profilePicture: ProviderAttribute.GOOGLE_PICTURE,\n custom: {\n name: ProviderAttribute.GOOGLE_NAME,\n },\n },\n scopes: [\"openid\", \"email\", \"profile\"],\n });\n\n const userPoolClient = userPool.addClient(\"alb-client\", {\n supportedIdentityProviders: [UserPoolClientIdentityProvider.GOOGLE],\n generateSecret: true,\n oAuth: {\n callbackUrls: [`https://${props.googleAuth.domain}/oauth2/idpresponse`],\n },\n\n // Note: id and access validity token validity cannot be less than one\n // hour (this is the cognito cookie duration). To quickly invalidate\n // credentials, disable the user in Cognito. It might be that we want to\n // parameterise these going forward, but that would require Infosec\n // discussion.\n idTokenValidity: Duration.hours(1),\n accessTokenValidity: Duration.hours(1),\n refreshTokenValidity: Duration.days(7),\n });\n\n userPoolClient.node.addDependency(userPoolIdp);\n\n listener.addAction(\"CognitoAuth\", {\n action: new AuthenticateCognitoAction({\n userPool: userPool,\n userPoolClient: userPoolClient,\n userPoolDomain: userPoolDomain,\n next: ListenerAction.forward([targetGroup]),\n sessionTimeout: Duration.minutes(sessionTimeoutInMinutes),\n }),\n });\n\n // Need to give the ALB outbound access on 443 for the IdP endpoints.\n const idpEgressSecurityGroup = new GuHttpsEgressSecurityGroup(scope, \"ldp-access\", {\n app,\n vpc,\n });\n\n loadBalancer.addSecurityGroup(idpEgressSecurityGroup);\n }\n\n this.vpc = vpc;\n this.certificate = certificate;\n this.loadBalancer = loadBalancer;\n this.autoScalingGroup = autoScalingGroup;\n this.listener = listener;\n this.targetGroup = targetGroup;\n }\n}\n"]}
1	+ {"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;AAAA,uGAAuG;AACvG,6CAA0D;AAE1D,iEAAsF;AACtF,yDAKiC;AAEjC,iDAAqD;AAErD,uFAA6F;AAC7F,uGAA2F;AAC3F,iDAA8D;AAC9D,uDAA+D;AAC/D,iDAAsD;AACtD,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAIqC;AAErC,gDAAkF;AAClF,8CAAsG;AAEtG,8CAAgF;AAChF,oDAA2D;AAC3D,kEAIwC;AACxC,uCAAwC;AAGxC,yDAAsE;AAkRtE,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,iBAAiB,GAAG,IAAI,EACxB,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EAAE,YAAY,EACtB,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EACnF,wBAAwB,EACxB,YAAY,EACZ,qBAAqB,EACrB,yBAAyB,GAC1B,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,MAAM,QAAQ,GAAG,YAAY,YAAY,kBAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QAEnH,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,WAAW;YACrC,CAAC,CAAC,IAAI,mBAAa,CAAC,KAAK,EAAE;gBACvB,GAAG;gBACH,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,YAAY,EAAE,gBAAgB,CAAC,YAAY;aAC5C,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,wBAAwB,GAC5B,QAAQ,YAAY,wBAAU,IAAI,QAAQ,CAAC,aAAa;YACtD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YAEpE,+DAA+D;YAC/D,YAAY,EAAE,8BAAY,CAAC,oBAAoB,CAAC;gBAC9C,eAAe,EAAE,CAAC,2CAAyB,CAAC,GAAG,CAAC;gBAChD,WAAW,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;aACjC,CAAC;YAEF,QAAQ,EAAE,QAAQ,YAAY,wBAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACvE,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;YACX,uBAAuB,EAAE,wBAAwB;YACjD,YAAY;YACZ,qBAAqB;YACrB,yBAAyB;SAC1B,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;YACD,iBAAiB;SAClB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,IAAI,OAAO,WAAW,KAAK,WAAW;SAChF,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAEtG,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;YAC7B,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;YAEvD,MAAM,EACJ,aAAa,GAAG,CAAC,4BAA4B,CAAC,EAC9C,uBAAuB,GAAG,EAAE,EAC5B,6BAA6B,GAAG,GAAG,MAAM,0BAA0B,GACpE,GAAG,KAAK,CAAC,UAAU,CAAC;YAErB,IAAI,uBAAuB,GAAG,EAAE,EAAE;gBAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;aACtE;YAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC5B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;aAC9D;YAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAAE;gBACrE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;aAClF;YAED,MAAM,oBAAoB,GAAG,yBAAe,CAAC,uBAAuB,CAClE,KAAK,EACL,mCAAmC,EACnC,qCAAyB,CAAC,oBAAoB,CAAC,IAAI,CACpD,CAAC;YAEF,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,gBAAgB,IAAI,MAAM,CAAC;YAErE,sEAAsE;YACtE,4BAA4B;YAC5B,yDAAyD;YACzD,MAAM,qBAAqB,GAAG,4BAA4B,oBAAoB,CAAC,WAAW,oBAAoB,gBAAgB,oBAAoB,CAAC;YAEnJ,8CAA8C;YAC9C,oDAAoD;YACpD,MAAM,UAAU,GAAG,IAAI,yBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE;gBAC5D,GAAG,EAAE,GAAG;gBACR,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,oBAAO,CAAC,YAAY;gBAC7B,QAAQ,EAAE,UAAU,gBAAgB,kDAAkD;gBACtF,iBAAiB,EAAE,IAAI;gBACvB,qBAAqB,EAAE,IAAI;gBAC3B,cAAc,EAAE,qCAAyB,CAAC,8BAA8B,CAAC,IAAI;gBAC7E,YAAY,EAAE,yBAAY,CAAC,MAAM;gBACjC,WAAW,EAAE;oBACX,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;oBACvC,uBAAuB,EAAE,qBAAqB;iBAC/C;aACF,CAAC,CAAC;YAEH,kBAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAEzC,UAAU,CAAC,eAAe,CACxB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,KAAK;gBACpB,OAAO,EAAE,CAAC,uBAAuB,CAAC;gBAClC,SAAS,EAAE,CAAC,qBAAqB,CAAC;aACnC,CAAC,CACH,CAAC;YAEF,yEAAyE;YACzE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,IAAI,sBAAQ,CAAC,IAAI,EAAE,WAAW,EAAE;gBAC/C,cAAc,EAAE;oBACd,iBAAiB,EAAE,UAAU;oBAC7B,SAAS,EAAE,UAAU;iBACtB;aACF,CAAC,CAAC;YAEH,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAEhF,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE;oBACb,YAAY,EAAE,IAAA,iCAAuB,EAAC,YAAY,CAAC;iBACpD;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACtG,MAAM,YAAY,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;YAE9G,MAAM,WAAW,GAAG,IAAI,4CAA8B,CAAC,KAAK,EAAE,YAAY,EAAE;gBAC1E,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,iBAAiB,EAAE,YAAY;gBAC/B,gBAAgB,EAAE;oBAChB,KAAK,EAAE,+BAAiB,CAAC,YAAY;oBACrC,SAAS,EAAE,+BAAiB,CAAC,iBAAiB;oBAC9C,UAAU,EAAE,+BAAiB,CAAC,kBAAkB;oBAChD,cAAc,EAAE,+BAAiB,CAAC,cAAc;oBAChD,MAAM,EAAE;wBACN,IAAI,EAAE,+BAAiB,CAAC,WAAW;qBACpC;iBACF;gBACD,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;aACvC,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;gBACtD,0BAA0B,EAAE,CAAC,4CAA8B,CAAC,MAAM,CAAC;gBACnE,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,WAAW,KAAK,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC;iBACxE;gBAED,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,mEAAmE;gBACnE,cAAc;gBACd,eAAe,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,mBAAmB,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtC,oBAAoB,EAAE,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC;YAEH,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAE/C,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE;gBAChC,MAAM,EAAE,IAAI,8DAAyB,CAAC;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,cAAc,EAAE,cAAc;oBAC9B,cAAc,EAAE,cAAc;oBAC9B,IAAI,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;oBAC3C,cAAc,EAAE,sBAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC;iBAC1D,CAAC;aACH,CAAC,CAAC;YAEH,qEAAqE;YACrE,MAAM,sBAAsB,GAAG,IAAI,gCAA0B,CAAC,KAAK,EAAE,YAAY,EAAE;gBACjF,GAAG;gBACH,GAAG;aACJ,CAAC,CAAC;YAEH,YAAY,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;SACvD;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AA3UD,4BA2UC","sourcesContent":["/* eslint \"@guardian/tsdoc-required/tsdoc-required\": 2 -- to begin rolling this out for public APIs. /\nimport { Duration, SecretValue, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice, UpdatePolicy } from \"aws-cdk-lib/aws-autoscaling\";\nimport { AdditionalHealthCheckType, HealthChecks } from \"aws-cdk-lib/aws-autoscaling\";\nimport {\n ProviderAttribute,\n UserPool,\n UserPoolClientIdentityProvider,\n UserPoolIdentityProviderGoogle,\n} from \"aws-cdk-lib/aws-cognito\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { HealthCheck as ALBHealthCheck } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { ApplicationProtocol, ListenerAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { AuthenticateCognitoAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2-actions\";\nimport { Effect, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Architecture, Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http4xxAlarmProps, Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport {\n GuAlb4xxPercentageAlarm,\n GuAlb5xxPercentageAlarm,\n GuUnhealthyInstancesAlarm,\n} from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuLoggingStreamNameParameter } from \"../../constructs/core\";\nimport { GuHttpsEgressSecurityGroup, GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport { GuLambdaFunction } from \"../../constructs/lambda\";\nimport {\n GuApplicationLoadBalancer,\n GuApplicationTargetGroup,\n GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { getUserPoolDomainPrefix } from \"../../utils/cognito/cognito\";\n\n/\n To ship your application logs to ELK automatically, you must:\n \n 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n \n Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n /\nexport interface ApplicationLoggingProps {\n /\n Enables forwarding of application logs to the Guardian ELK stack.\n \n Note, to work, you will need to also do the following non-CDK things:\n \n 1. Include the `cdk-base` Amigo role in your AMI.\n * 2. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 3. Confirm that your [[`systemdUnitName`]] is configured properly.\n \n Unless you have explicitly opted-out, appropriate IAM permissions for\n * logging to Kinesis will be configured automatically via the [[`GuEc2App`]]\n * pattern.\n \n @see https://github.com/guardian/amigo/tree/main/roles/cdk-base\n /\n enabled: boolean;\n /\n This needs to match the name of your SystemD unit.\n \n If your systemd unit is not `<app>.service` set this value.\n \n @defaultValue `<app>.service`\n /\n systemdUnitName?: string;\n}\n\n/\n @privateRemarks we should rename this to AlarmsProps.\n /\nexport interface Alarms {\n /\n Name of the target (SNS Topic) for alarm notifications.\n /\n snsTopicName: string;\n /\n Enable the 5xx alarm with settings.\n /\n http5xxAlarm: false \| Http5xxAlarmProps;\n /\n Enable the 4xx alarm with settings.\n /\n http4xxAlarm?: false \| Http4xxAlarmProps;\n /\n Enable the unhealthy instances alarm.\n /\n unhealthyInstancesAlarm: boolean;\n /\n Internal flag - users of this library should ignore this setting.\n /\n noMonitoring?: false;\n}\n\nexport interface GuEc2AppProps extends AppIdentity {\n /\n User data for the autoscaling group.\n /\n userData: GuUserDataProps \| UserData;\n /\n Network access restrictions for your load balancer.\n \n Note, this merely provides defence in depth; you should, for example, limit\n * access to the VPN and then treat that as sufficient. Instead, use Google\n * Auth for human access, or a suitable machine auth mechanism.\n /\n access: AppAccess;\n /\n The port your application runs on.\n /\n applicationPort: number;\n /\n Configure IAM roles for autoscaling group EC2 instances.\n /\n roleConfiguration?: GuInstanceRoleProps;\n /\n Enable and configure alarms.\n /\n monitoringConfiguration: Alarms \| NoMonitoring;\n /\n EC2 instance type. Note, ensure your code is built for the same\n * architecture family (arm64 - 'Graviton' instances - or x64).\n /\n instanceType: InstanceType;\n /\n Enable and configures application logs.\n /\n applicationLogging?: ApplicationLoggingProps;\n\n /\n Enable access logging for this load balancer.\n * Access logs are written to an S3 bucket within your AWS account.\n * The bucket is created by {@link https://github.com/guardian/aws-account-setup}.\n * The logs are queryable via the `gucdk_access_logs` Athena database.\n \n @defaultValue true\n /\n withAccessLogging?: boolean;\n\n /\n Add block devices (additional storage).\n /\n blockDevices?: BlockDevice[];\n /\n Autoscaling group min and max sizes.\n /\n scaling: GuAsgCapacity;\n /\n Specify certificate for the load balancer.\n /\n certificateProps?: GuDomainName;\n\n /\n Configure AMIgo image recipe. This is only necessary if you are using GuCDK to generate your riff-raff.yaml file.\n /\n imageRecipe?: string \| AmigoProps;\n /\n Specify the VPC to use.\n \n @see https://github.com/guardian/aws-account-setup\n /\n vpc?: IVpc;\n /\n Specify private subnets if using a non-default VPC or (generally\n * discouraged) to limit to a subset of the available subnets.\n /\n privateSubnets?: ISubnet[];\n\n /\n Specify private subnets if using a non-default VPC or (generally\n * discouraged) to limit to a subset of the available subnets.\n /\n publicSubnets?: ISubnet[];\n\n /\n Configure Google Auth.\n /\n googleAuth?: {\n /\n Enables Google Auth (via Cognito). *Additional MANUAL steps required -\n see below.*\n \n * Limits access to members of the allowed Google groups.\n \n Note, this does not currently support simultaneous machine access, so\n * only set to true if you only require staff access to your service, or are\n * supporting machine access in some other way.\n \n MANUAL STEPS: to get this to work, we need a Google Project and\n * associated credentials. Full instructions can be found here:\n \n https://docs.google.com/document/d/1_k1FSE52AZHXufWLTiKTI3xy5cGpziyHazSHTKrYfco/edit?usp=sharing\n \n DevX hope to automate this process in the near future.\n /\n enabled: true;\n /\n The domain users will access your service.\n \n Set this to the same as for certificateProps.\n /\n domain: string;\n /\n Groups used for membership checks.\n \n If specified, cannot be empty. Users must be a member of at least one\n * group to gain access.\n \n WARNING: groups must be specified with the `guardian.co.uk` domain, even\n * if that is the non-idiomatic choice for daily use.\n \n @defaultValue [`engineering@guardian.co.uk`]\n /\n allowedGroups?: string[];\n /\n The number of minutes before the session expires.\n \n Set this value to a safe period of time that revoked users\n * sessions will continue to function.\n \n NOTE: This value cannot be larger than 60 minutes.\n \n @defaultValue 15\n /\n sessionTimeoutInMinutes?: number;\n /\n Secrets Manager path containing Google OAuth2 Client credentials.\n \n NOTE: you do not need to set this value, but you DO need to generate and\n * store the associated credentials in Secrets Manager.\n \n Credentials should be stored in Secrets Manager as JSON:\n \n ```json\n * {\n * \"clientId\": \"my-client-id\",\n * \"clientSecret\": \"my-client-secret\"\n * }\n * ```\n \n @see `googleAuth.enabled` for how to generate.\n \n @defaultValue /:STAGE/:stack/:app/google-auth-credentials\n /\n credentialsSecretsManagerPath?: string;\n\n /\n When using Auth in the ALB, which stage of cognito-lambda to use.\n \n For most applications this should always be PROD, even in the CODE environments.\n \n @defaultValue PROD\n /\n cognitoAuthStage?: string;\n };\n\n /\n Specify custom healthcheck\n /\n healthcheck?: ALBHealthCheck;\n\n /\n Set http put response hop limit for the launch template.\n * It can be necessary to raise this value from the default of 1\n * for example when sharing the instance profile with a docker container running on the instance.\n /\n instanceMetadataHopLimit?: number;\n\n /\n Specify an update policy for the ASG created by this pattern.\n \n @see https://docs.aws.amazon.com/cdk/api/latest/docs/aws-autoscaling-readme.html#update-policy\n \n @defaultValue UpdatePolicy.none() - Cloudformation does not attempt to rotate instances in the ASG\n * and must rely on riffraff to do so.\n /\n updatePolicy?: UpdatePolicy;\n\n /\n You can specify how long after an instance reaches the InService state it waits before contributing\n * usage data to the aggregated metrics. This specified time is called the default instance warmup.\n * This keeps dynamic scaling from being affected by metrics for individual instances that aren't yet\n * handling application traffic and that might be experiencing temporarily high usage of compute resources.\n \n @see https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-default-instance-warmup.html\n /\n defaultInstanceWarmup?: Duration;\n\n /\n How often to send EC2 metrics, such as CPU usage.\n * By default, AWS will produce `5Minute` granular metrics.\n \n It is recommended to produce `1Minute` granular metrics in production,\n * especially when using ASG metrics to trigger horizontal scaling as it allows for earlier scaling.\n \n @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html\n /\n instanceMetricGranularity: \"1Minute\" \| \"5Minute\";\n}\n\nfunction restrictedCidrRanges(ranges: IPeer[]) {\n return ranges.map((range) => ({\n range,\n port: Port.tcp(443),\n description: `Allow access on port 443 from ${range.uniqueId}`,\n }));\n}\n\n/\n Pattern which creates the resources needed to run an application on EC2\n * behind a load balancer. For convenience, you may wish to use [[`GuPlayApp`]]\n * or [[`GuNodeApp`]], which extend this class.\n \n See props for further details.\n /\nexport class GuEc2App extends Construct {\n /\n * These are public for now, as this allows users to\n * modify these constructs as desired to fit their\n * specific needs.\n * In the future, we might build functionality to better enable users\n * to access in-pattern constructs, but this would allow teams to be unblocked\n * in the short term.\n * /\n public readonly vpc: IVpc;\n public readonly certificate?: GuCertificate;\n public readonly loadBalancer: GuApplicationLoadBalancer;\n public readonly autoScalingGroup: GuAutoScalingGroup;\n public readonly listener: GuHttpsApplicationListener;\n public readonly targetGroup: GuApplicationTargetGroup;\n\n constructor(scope: GuStack, props: GuEc2AppProps) {\n const {\n access,\n withAccessLogging = true,\n app,\n // We should update this default once a significant number of apps have migrated to devx-logs\n applicationLogging = { enabled: false },\n applicationPort,\n blockDevices,\n certificateProps,\n instanceType,\n monitoringConfiguration,\n roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n scaling: { minimumInstances, maximumInstances = minimumInstances 2 },\n userData: userDataLike,\n imageRecipe,\n vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n instanceMetadataHopLimit,\n updatePolicy,\n defaultInstanceWarmup,\n instanceMetricGranularity,\n } = props;\n\n super(scope, app); // The assumption is `app` is unique\n\n // We should really prevent users from doing this via the type system,\n // but that requires a breaking change to the API\n if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n throw new Error(\n \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\",\n );\n }\n\n const userData = userDataLike instanceof UserData ? userDataLike : new GuUserData(scope, { ...userDataLike, app });\n\n AppAccess.validate(access);\n\n const certificate =\n typeof certificateProps !== \"undefined\"\n ? new GuCertificate(scope, {\n app,\n domainName: certificateProps.domainName,\n hostedZoneId: certificateProps.hostedZoneId,\n })\n : undefined;\n\n const maybePrivateConfigPolicy =\n userData instanceof GuUserData && userData.configuration\n ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n : [];\n\n const mergedRoleConfiguration: GuInstanceRoleProps = {\n withoutLogShipping: roleConfiguration.withoutLogShipping,\n additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n };\n\n const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n app,\n vpc,\n instanceType,\n minimumInstances,\n maximumInstances,\n role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n\n // TODO should this be defaulted at pattern or construct level?\n healthChecks: HealthChecks.withAdditionalChecks({\n additionalTypes: [AdditionalHealthCheckType.ELB],\n gracePeriod: Duration.minutes(2),\n }),\n\n userData: userData instanceof GuUserData ? userData.userData : userData,\n vpcSubnets: { subnets: privateSubnets },\n ...(blockDevices && { blockDevices }),\n imageRecipe,\n httpPutResponseHopLimit: instanceMetadataHopLimit,\n updatePolicy,\n defaultInstanceWarmup,\n instanceMetricGranularity,\n });\n\n // This allows automatic shipping of instance Cloud Init logs when using the\n // `cdk-base` Amigo role on your AMI.\n Tags.of(autoScalingGroup).add(\n MetadataKeys.LOG_KINESIS_STREAM_NAME,\n GuLoggingStreamNameParameter.getInstance(scope).valueAsString,\n );\n\n if (applicationLogging.enabled) {\n // This allows automatic shipping of application logs when using the\n // `cdk-base` Amigo role on your AMI.\n Tags.of(autoScalingGroup).add(\n MetadataKeys.SYSTEMD_UNIT,\n applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`,\n );\n }\n\n const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n app,\n vpc,\n // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n internetFacing: access.scope !== AccessScope.INTERNAL,\n vpcSubnets: {\n subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n },\n withAccessLogging,\n });\n\n const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n app,\n vpc,\n protocol: ApplicationProtocol.HTTP,\n targets: [autoScalingGroup],\n port: applicationPort,\n healthCheck: props.healthcheck,\n });\n\n const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n app,\n loadBalancer,\n certificate,\n targetGroup,\n // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n open: access.scope === AccessScope.PUBLIC && typeof certificate !== \"undefined\",\n });\n\n // Since AWS won't create a security group automatically when open=false, we need to add our own\n if (access.scope !== AccessScope.PUBLIC) {\n loadBalancer.addSecurityGroup(\n new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n app,\n vpc,\n description: \"Allow restricted ingress from CIDR ranges\",\n allowAllOutbound: false,\n ingresses: restrictedCidrRanges(access.cidrRanges),\n }),\n );\n }\n\n if (!monitoringConfiguration.noMonitoring) {\n const { http5xxAlarm, http4xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n if (http4xxAlarm) {\n new GuAlb4xxPercentageAlarm(scope, {\n app,\n loadBalancer,\n snsTopicName,\n ...http4xxAlarm,\n });\n }\n if (http5xxAlarm) {\n new GuAlb5xxPercentageAlarm(scope, {\n app,\n loadBalancer,\n snsTopicName,\n ...http5xxAlarm,\n });\n }\n if (unhealthyInstancesAlarm) {\n new GuUnhealthyInstancesAlarm(scope, {\n app,\n targetGroup,\n snsTopicName,\n });\n }\n }\n\n if (props.googleAuth?.enabled) {\n const prefix = `/${scope.stage}/${scope.stack}/${app}`;\n\n const {\n allowedGroups = [\"engineering@guardian.co.uk\"],\n sessionTimeoutInMinutes = 15,\n credentialsSecretsManagerPath = `${prefix}/google-auth-credentials`,\n } = props.googleAuth;\n\n if (sessionTimeoutInMinutes > 60) {\n throw new Error(\"googleAuth.sessionTimeoutInMinutes must be <= 60!\");\n }\n\n if (allowedGroups.length < 1) {\n throw new Error(\"googleAuth.allowedGroups cannot be empty!\");\n }\n\n if (allowedGroups.find((group) => !group.endsWith(\"@guardian.co.uk\"))) {\n throw new Error(\"googleAuth.allowedGroups must use the @guardian.co.uk domain.\");\n }\n\n const deployToolsAccountId = StringParameter.fromStringParameterName(\n scope,\n \"deploy-tools-account-id-parameter\",\n NAMED_SSM_PARAMETER_PATHS.DeployToolsAccountId.path,\n );\n\n const cognitoAuthStage = props.googleAuth.cognitoAuthStage ?? \"PROD\";\n\n // See https://github.com/guardian/cognito-auth-lambdas for the source\n // code here. ARN format is:\n // arn:aws:lambda:aws-region:acct-id:function:helloworld.\n const gatekeeperFunctionArn = `arn:aws:lambda:eu-west-1:${deployToolsAccountId.stringValue}:function:deploy-${cognitoAuthStage}-gatekeeper-lambda`;\n\n // Note, handler and filename must match here:\n // https://github.com/guardian/cognito-auth-lambdas.\n const authLambda = new GuLambdaFunction(scope, \"auth-lambda\", {\n app: app,\n memorySize: 128,\n handler: \"bootstrap\",\n runtime: Runtime.PROVIDED_AL2,\n fileName: `deploy/${cognitoAuthStage}/cognito-lambda/devx-cognito-lambda-amd64-v2.zip`,\n withoutFilePrefix: true,\n withoutArtifactUpload: true,\n bucketNamePath: NAMED_SSM_PARAMETER_PATHS.OrganisationDistributionBucket.path,\n architecture: Architecture.X86_64,\n environment: {\n ALLOWED_GROUPS: allowedGroups.join(\",\"),\n GATEKEEPER_FUNCTION_ARN: gatekeeperFunctionArn,\n },\n });\n\n Tags.of(authLambda).add(\"Owner\", \"DevX\");\n\n authLambda.addToRolePolicy(\n new PolicyStatement({\n effect: Effect.ALLOW,\n actions: [\"lambda:InvokeFunction\"],\n resources: [gatekeeperFunctionArn],\n }),\n );\n\n // Cognito user pool. We require both lambdas: pre-sign-up runs the first\n // time a user attempts to authenticate (before they exist in the User\n // Pool); pre-auth runs in subsequent authentication flows.\n const userPool = new UserPool(this, \"user-pool\", {\n lambdaTriggers: {\n preAuthentication: authLambda,\n preSignUp: authLambda,\n },\n });\n\n // These help ensure domain is deterministic but also unique. Key\n // assumption is that app/stack/stage combo are unique within Guardian.\n const domainPrefix = `com-gu-${app.toLowerCase()}-${scope.stage.toLowerCase()}`;\n\n const userPoolDomain = userPool.addDomain(\"domain\", {\n cognitoDomain: {\n domainPrefix: getUserPoolDomainPrefix(domainPrefix),\n },\n });\n\n const clientId = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientId\" });\n const clientSecret = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientSecret\" });\n\n const userPoolIdp = new UserPoolIdentityProviderGoogle(scope, \"google-idp\", {\n userPool: userPool,\n clientId: clientId.toString(),\n clientSecretValue: clientSecret,\n attributeMapping: {\n email: ProviderAttribute.GOOGLE_EMAIL,\n givenName: ProviderAttribute.GOOGLE_GIVEN_NAME,\n familyName: ProviderAttribute.GOOGLE_FAMILY_NAME,\n profilePicture: ProviderAttribute.GOOGLE_PICTURE,\n custom: {\n name: ProviderAttribute.GOOGLE_NAME,\n },\n },\n scopes: [\"openid\", \"email\", \"profile\"],\n });\n\n const userPoolClient = userPool.addClient(\"alb-client\", {\n supportedIdentityProviders: [UserPoolClientIdentityProvider.GOOGLE],\n generateSecret: true,\n oAuth: {\n callbackUrls: [`https://${props.googleAuth.domain}/oauth2/idpresponse`],\n },\n\n // Note: id and access validity token validity cannot be less than one\n // hour (this is the cognito cookie duration). To quickly invalidate\n // credentials, disable the user in Cognito. It might be that we want to\n // parameterise these going forward, but that would require Infosec\n // discussion.\n idTokenValidity: Duration.hours(1),\n accessTokenValidity: Duration.hours(1),\n refreshTokenValidity: Duration.days(7),\n });\n\n userPoolClient.node.addDependency(userPoolIdp);\n\n listener.addAction(\"CognitoAuth\", {\n action: new AuthenticateCognitoAction({\n userPool: userPool,\n userPoolClient: userPoolClient,\n userPoolDomain: userPoolDomain,\n next: ListenerAction.forward([targetGroup]),\n sessionTimeout: Duration.minutes(sessionTimeoutInMinutes),\n }),\n });\n\n // Need to give the ALB outbound access on 443 for the IdP endpoints.\n const idpEgressSecurityGroup = new GuHttpsEgressSecurityGroup(scope, \"ldp-access\", {\n app,\n vpc,\n });\n\n loadBalancer.addSecurityGroup(idpEgressSecurityGroup);\n }\n\n this.vpc = vpc;\n this.certificate = certificate;\n this.loadBalancer = loadBalancer;\n this.autoScalingGroup = autoScalingGroup;\n this.listener = listener;\n this.targetGroup = targetGroup;\n }\n}\n"]}

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "@guardian/cdk",
   "description": "Generic Guardian flavoured AWS CDK components",
-  "version": "62.2.1",
+  "version": "62.3.1",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [
@@ -31,8 +31,8 @@
     "cli:dev": "ts-node src/bin/index.ts"
   },
   "devDependencies": {
-    "@changesets/cli": "2.29.7",
-    "@guardian/eslint-config": "13.0.0",
+    "@changesets/cli": "2.29.8",
+    "@guardian/eslint-config": "13.0.2",
     "@guardian/eslint-plugin-tsdoc-required": "^0.1.3",
     "@guardian/tsconfig": "^1.0.1",
     "@types/git-url-parse": "^9.0.3",
@@ -40,35 +40,35 @@
     "@types/js-yaml": "^4.0.9",
     "@types/node": "22.15.30",
     "@types/yargs": "^17.0.33",
-    "aws-cdk": "2.1033.0",
-    "aws-cdk-lib": "2.232.1",
-    "constructs": "10.4.3",
-    "eslint": "^9.34.0",
+    "aws-cdk": "2.1100.3",
+    "aws-cdk-lib": "2.234.1",
+    "constructs": "10.4.4",
+    "eslint": "^9.39.2",
     "eslint-plugin-custom-rules": "file:tools/eslint",
     "gh-pages": "^6.3.0",
     "jest": "^29.7.0",
-    "prettier": "^3.6.2",
+    "prettier": "^3.8.1",
     "serve": "^14.2.5",
-    "ts-jest": "^29.4.2",
+    "ts-jest": "^29.4.6",
     "ts-node": "^10.9.2",
-    "typedoc": "^0.28.8",
+    "typedoc": "^0.28.16",
     "typescript": "5.1.6"
   },
   "dependencies": {
-    "@aws-sdk/client-ec2": "^3.930.0",
-    "@aws-sdk/client-ssm": "^3.925.0",
-    "@aws-sdk/credential-providers": "^3.925.0",
+    "@aws-sdk/client-ec2": "^3.974.0",
+    "@aws-sdk/client-ssm": "^3.974.0",
+    "@aws-sdk/credential-providers": "^3.974.0",
     "@oclif/core": "3.26.6",
     "chalk": "^4.1.2",
-    "codemaker": "^1.114.1",
+    "codemaker": "^1.125.0",
     "git-url-parse": "^16.0.1",
     "js-yaml": "^4.1.1",
     "read-pkg-up": "7.0.1",
     "yargs": "^17.7.2"
   },
   "peerDependencies": {
-    "aws-cdk": "^2.1033.0",
-    "aws-cdk-lib": "^2.232.1",
-    "constructs": "^10.4.3"
+    "aws-cdk": "^2.1100.3",
+    "aws-cdk-lib": "^2.234.1",
+    "constructs": "^10.4.4"
   }
 }