@guardian/cdk 63.0.1 → 63.2.0

package/lib/bin/commands/new-project/index.js

@@ -120,7 +120,7 @@ const newCdkProject = async (props) => {
     await commands.synth();
     console.log(chalk_1.default.green("  ✅ Successfully synthesized CDK app"));
     console.log(chalk_1.default.green("Success! Here's a summary of the created files:"));
-    const tree = await (0, exec_1.execute)("tree", ["-I 'node_modules|cdk.out'"], {
+    const tree = await (0, exec_1.execute)("tree", ["-I", "node_modules|cdk.out"], {
         cwd: config.cdkDir,
     });
     console.log(tree);

package/lib/bin/commands/new-project/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/bin/commands/new-project/index.ts"],"names":[],"mappings":";;;;;;AAAA,2BAAgC;AAChC,+BAA+C;AAC/C,kDAA0B;AAE1B,8CAA8C;AAC9C,4CAAkD;AAClD,kDAAkE;AAClE,qCAA2C;AAC3C,6CAA0C;AAC1C,uCAA8C;AAC9C,+CAAiD;AACjD,yCAA+C;AAE/C,yCAA4C;AAuB5C,MAAM,eAAe,GAAG,CAAC,IAAY,EAAQ,EAAE;IAC7C,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE;QACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;KAC7C;AACH,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAQ,EAAE;IACnD,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE;QACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;KACzD;AACH,CAAC,CAAC;AAEF,SAAS,cAAc,CAAC,MAAwB;IAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAChB,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KAChC;IACD,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,iDAAiD;IACxF,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,oBAAoB,EAAE;QAC/B,eAAe,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;KAC9C;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAsB;IACvC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAE1F,MAAM,OAAO,GAAG,IAAA,kBAAY,GAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAErC,MAAM,OAAO,GAAG,IAAA,qBAAY,EAAC,GAAG,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;IACtC,MAAM,cAAc,GAAG,IAAA,oBAAW,EAAC,SAAS,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAqB;QAC/B,IAAI;QACJ,oBAAoB;QACpB,MAAM;QACN,OAAO;QACP,MAAM;QACN,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,OAAO;SAChB;QACD,OAAO,EAAE,GAAG,MAAM,QAAQ,YAAY,KAAK;QAC3C,SAAS,EAAE;YACT,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,SAAS;SAClB;QACD,SAAS,EAAE,GAAG,MAAM,QAAQ,YAAY,KAAK;QAC7C,QAAQ,EAAE,GAAG,MAAM,QAAQ,YAAY,UAAU;QACjD,cAAc;KACf,CAAC;IAEF,cAAc,CAAC,MAAM,CAAC,CAAC;IAEvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,MAAM,aAAa,GAAG,KAAK,EAAE,KAAsB,EAAsB,EAAE;IAChF,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEhC,IAAI,MAAM,CAAC,IAAI,EAAE;QACf,IAAA,qBAAc,EAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;KAC9C;IAED,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,uBAAuB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,SAAS,CAAC,MAAM,uBAAuB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAE3F,gBAAgB;IAChB,MAAM,IAAA,kBAAY,EAAC;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,QAAQ;QACpB,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,MAAM,CAAC,SAAS;QACvB,OAAO,EAAE,iBAAO,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEH,gBAAgB;IAChB,MAAM,IAAA,sBAAc,EAAC;QACnB,OAAO,EAAE,iBAAO,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC/D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAA,eAAQ,EAAC,MAAM,CAAC,SAAS,CAAC;QACtC,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,SAAS,CAAC;QACpC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;KAClD,CAAC,CAAC;IAEH,gBAAgB;IAChB,MAAM,IAAA,wBAAa,EAAC;QAClB,OAAO,EAAE,iBAAO,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAA,eAAQ,EAAC,MAAM,CAAC,QAAQ,CAAC;QACrC,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,SAAS,CAAC;KACrC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAA,mBAAW,EAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnE,IAAI,MAAM,CAAC,IAAI,EAAE;QACf,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC,CAAC;QAC/E,MAAM,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;KACrE;IAED,oHAAoH;IACpH,MAAM,IAAA,cAAO,EAAC,4BAA4B,EAAE,CAAC,eAAe,EAAE,iCAAiC,EAAE,OAAO,CAAC,EAAE;QACzG,GAAG,EAAE,MAAM,CAAC,MAAM;KACnB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAE/D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC9C,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;IAE1D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;IAEjE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,IAAA,cAAO,EAAC,MAAM,EAAE,CAAC,2BAA2B,CAAC,EAAE;QAChE,GAAG,EAAE,MAAM,CAAC,MAAM;KACnB,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAElB,MAAM,OAAO,GAAG,gDAAgD,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,wBAAwB,OAAO,mBAAmB,CAAC,CAAC,CAAC;IAE7E,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC,CAAC;AA5EW,QAAA,aAAa,iBA4ExB","sourcesContent":["import { existsSync } from \"fs\";\nimport { basename, dirname, join } from \"path\";\nimport chalk from \"chalk\";\nimport type { CliCommandResponse } from \"../../../types/cli\";\nimport { execute } from \"../../../utils/exec\";\nimport { gitRootOrCwd } from \"../../../utils/git\";\nimport { toKebabCase, toPascalCase } from \"../../../utils/string\";\nimport { constructApp } from \"./utils/app\";\nimport { Imports } from \"./utils/imports\";\nimport { buildDirectory } from \"./utils/init\";\nimport { constructTest } from \"./utils/snapshot\";\nimport { constructStack } from \"./utils/stack\";\nimport type { Name } from \"./utils/utils\";\nimport { getCommands } from \"./utils/utils\";\n\nexport type PackageManager = \"npm\" | \"yarn\";\n\ninterface NewProjectProps {\n  init: boolean;\n  app: string;\n  stack: string;\n  stages: string[];\n  regions: string[];\n  yamlTemplateLocation?: string;\n  packageManager: PackageManager;\n}\n\ninterface NewProjectConfig extends Omit<NewProjectProps, \"stack\" | \"app\"> {\n  cdkDir: string;\n  appPath: string;\n  appName: Name;\n  stackPath: string;\n  stackName: Name;\n  testPath: string;\n}\n\nconst checkPathExists = (path: string): void => {\n  if (!existsSync(path)) {\n    throw new Error(`File not found - ${path}`);\n  }\n};\n\nconst checkPathDoesNotExist = (path: string): void => {\n  if (existsSync(path)) {\n    throw new Error(`There is already a file at - ${path}`);\n  }\n};\n\nfunction validateConfig(config: NewProjectConfig): void {\n  if (!config.init) {\n    checkPathExists(config.cdkDir);\n  }\n  checkPathDoesNotExist(config.appPath); // TODO: Update the app file if it already exists\n  checkPathDoesNotExist(config.stackPath);\n\n  if (config.yamlTemplateLocation) {\n    checkPathExists(config.yamlTemplateLocation);\n  }\n}\n\nfunction getConfig(props: NewProjectProps): NewProjectConfig {\n  const { init, app, stack, stages, regions, yamlTemplateLocation, packageManager } = props;\n\n  const rootDir = gitRootOrCwd();\n  const cdkDir = join(rootDir, \"/cdk\");\n\n  const appName = toPascalCase(app);\n  const kebabAppName = toKebabCase(appName);\n  const stackName = toPascalCase(stack);\n  const kebabStackName = toKebabCase(stackName);\n\n  const config: NewProjectConfig = {\n    init,\n    yamlTemplateLocation,\n    stages,\n    regions,\n    cdkDir,\n    appName: {\n      kebab: kebabAppName,\n      pascal: appName,\n    },\n    appPath: `${cdkDir}/bin/${kebabAppName}.ts`,\n    stackName: {\n      kebab: kebabStackName,\n      pascal: stackName,\n    },\n    stackPath: `${cdkDir}/lib/${kebabAppName}.ts`,\n    testPath: `${cdkDir}/lib/${kebabAppName}.test.ts`,\n    packageManager,\n  };\n\n  validateConfig(config);\n\n  return config;\n}\n\nexport const newCdkProject = async (props: NewProjectProps): CliCommandResponse => {\n  console.log(\"Starting CDK generator\");\n\n  const config = getConfig(props);\n\n  if (config.init) {\n    buildDirectory({ outputDir: config.cdkDir });\n  }\n\n  console.log(`New app ${config.appName.pascal} will be written to ${config.appPath}`);\n  console.log(`New stack ${config.stackName.pascal} will be written to ${config.stackPath}`);\n\n  // bin directory\n  await constructApp({\n    appName: config.appName,\n    outputFile: \"cdk.ts\",\n    outputDir: dirname(config.appPath),\n    stack: config.stackName,\n    imports: Imports.newAppImports(config.appName),\n    stages: config.stages,\n    regions: config.regions,\n  });\n\n  // lib directory\n  await constructStack({\n    imports: Imports.newStackImports(!!config.yamlTemplateLocation),\n    appName: config.appName,\n    outputFile: basename(config.stackPath),\n    outputDir: dirname(config.stackPath),\n    yamlTemplateLocation: config.yamlTemplateLocation,\n  });\n\n  // lib directory\n  await constructTest({\n    imports: Imports.newTestImports(config.appName),\n    stackName: config.stackName,\n    appName: config.appName,\n    outputFile: basename(config.testPath),\n    outputDir: dirname(config.stackPath),\n  });\n\n  const commands = getCommands(config.packageManager, config.cdkDir);\n\n  if (config.init) {\n    console.log(chalk.yellow(\"Installing dependencies. This may take a while...\"));\n    await commands.installDependencies();\n    console.log(chalk.green(\"  ✅ Successfully installed dependencies\"));\n  }\n\n  // Run `eslint --fix` on the generated files instead of trying to generate code that completely satisfies the linter\n  await execute(\"./node_modules/.bin/eslint\", [\"lib/** bin/**\", \"--no-error-on-unmatched-pattern\", \"--fix\"], {\n    cwd: config.cdkDir,\n  });\n\n  console.log(chalk.yellow(\"Running lint check...\"));\n  await commands.lint();\n  console.log(chalk.green(\"  ✅ Successfully passed lint check\"));\n\n  console.log(chalk.yellow(\"Running tests...\"));\n  await commands.test();\n  console.log(chalk.green(\"  ✅ Successfully passed tests\"));\n\n  console.log(chalk.yellow(\"Running initial synthesis...\"));\n  await commands.synth();\n  console.log(chalk.green(\"  ✅ Successfully synthesized CDK app\"));\n\n  console.log(chalk.green(\"Success! Here's a summary of the created files:\"));\n  const tree = await execute(\"tree\", [\"-I 'node_modules|cdk.out'\"], {\n    cwd: config.cdkDir,\n  });\n  console.log(tree);\n\n  const docsUrl = \"https://github.com/guardian/cdk/tree/main/docs\";\n  console.log(chalk.green(`Please see the docs (${docsUrl}) for next steps.`));\n\n  return Promise.resolve(0);\n};\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/bin/commands/new-project/index.ts"],"names":[],"mappings":";;;;;;AAAA,2BAAgC;AAChC,+BAA+C;AAC/C,kDAA0B;AAE1B,8CAA8C;AAC9C,4CAAkD;AAClD,kDAAkE;AAClE,qCAA2C;AAC3C,6CAA0C;AAC1C,uCAA8C;AAC9C,+CAAiD;AACjD,yCAA+C;AAE/C,yCAA4C;AAuB5C,MAAM,eAAe,GAAG,CAAC,IAAY,EAAQ,EAAE;IAC7C,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE;QACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;KAC7C;AACH,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAQ,EAAE;IACnD,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE;QACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;KACzD;AACH,CAAC,CAAC;AAEF,SAAS,cAAc,CAAC,MAAwB;IAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAChB,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KAChC;IACD,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,iDAAiD;IACxF,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,oBAAoB,EAAE;QAC/B,eAAe,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;KAC9C;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAsB;IACvC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAE1F,MAAM,OAAO,GAAG,IAAA,kBAAY,GAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAErC,MAAM,OAAO,GAAG,IAAA,qBAAY,EAAC,GAAG,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAA,qBAAY,EAAC,KAAK,CAAC,CAAC;IACtC,MAAM,cAAc,GAAG,IAAA,oBAAW,EAAC,SAAS,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAqB;QAC/B,IAAI;QACJ,oBAAoB;QACpB,MAAM;QACN,OAAO;QACP,MAAM;QACN,OAAO,EAAE;YACP,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,OAAO;SAChB;QACD,OAAO,EAAE,GAAG,MAAM,QAAQ,YAAY,KAAK;QAC3C,SAAS,EAAE;YACT,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,SAAS;SAClB;QACD,SAAS,EAAE,GAAG,MAAM,QAAQ,YAAY,KAAK;QAC7C,QAAQ,EAAE,GAAG,MAAM,QAAQ,YAAY,UAAU;QACjD,cAAc;KACf,CAAC;IAEF,cAAc,CAAC,MAAM,CAAC,CAAC;IAEvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,MAAM,aAAa,GAAG,KAAK,EAAE,KAAsB,EAAsB,EAAE;IAChF,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEhC,IAAI,MAAM,CAAC,IAAI,EAAE;QACf,IAAA,qBAAc,EAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;KAC9C;IAED,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,uBAAuB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,SAAS,CAAC,MAAM,uBAAuB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAE3F,gBAAgB;IAChB,MAAM,IAAA,kBAAY,EAAC;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,QAAQ;QACpB,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,MAAM,CAAC,SAAS;QACvB,OAAO,EAAE,iBAAO,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QAC9C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEH,gBAAgB;IAChB,MAAM,IAAA,sBAAc,EAAC;QACnB,OAAO,EAAE,iBAAO,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC/D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAA,eAAQ,EAAC,MAAM,CAAC,SAAS,CAAC;QACtC,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,SAAS,CAAC;QACpC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;KAClD,CAAC,CAAC;IAEH,gBAAgB;IAChB,MAAM,IAAA,wBAAa,EAAC;QAClB,OAAO,EAAE,iBAAO,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAA,eAAQ,EAAC,MAAM,CAAC,QAAQ,CAAC;QACrC,SAAS,EAAE,IAAA,cAAO,EAAC,MAAM,CAAC,SAAS,CAAC;KACrC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAA,mBAAW,EAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnE,IAAI,MAAM,CAAC,IAAI,EAAE;QACf,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC,CAAC;QAC/E,MAAM,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;KACrE;IAED,oHAAoH;IACpH,MAAM,IAAA,cAAO,EAAC,4BAA4B,EAAE,CAAC,eAAe,EAAE,iCAAiC,EAAE,OAAO,CAAC,EAAE;QACzG,GAAG,EAAE,MAAM,CAAC,MAAM;KACnB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAE/D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC9C,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;IAE1D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;IAEjE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,IAAA,cAAO,EAAC,MAAM,EAAE,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE;QACjE,GAAG,EAAE,MAAM,CAAC,MAAM;KACnB,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAElB,MAAM,OAAO,GAAG,gDAAgD,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,wBAAwB,OAAO,mBAAmB,CAAC,CAAC,CAAC;IAE7E,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC,CAAC;AA5EW,QAAA,aAAa,iBA4ExB","sourcesContent":["import { existsSync } from \"fs\";\nimport { basename, dirname, join } from \"path\";\nimport chalk from \"chalk\";\nimport type { CliCommandResponse } from \"../../../types/cli\";\nimport { execute } from \"../../../utils/exec\";\nimport { gitRootOrCwd } from \"../../../utils/git\";\nimport { toKebabCase, toPascalCase } from \"../../../utils/string\";\nimport { constructApp } from \"./utils/app\";\nimport { Imports } from \"./utils/imports\";\nimport { buildDirectory } from \"./utils/init\";\nimport { constructTest } from \"./utils/snapshot\";\nimport { constructStack } from \"./utils/stack\";\nimport type { Name } from \"./utils/utils\";\nimport { getCommands } from \"./utils/utils\";\n\nexport type PackageManager = \"npm\" | \"yarn\";\n\ninterface NewProjectProps {\n  init: boolean;\n  app: string;\n  stack: string;\n  stages: string[];\n  regions: string[];\n  yamlTemplateLocation?: string;\n  packageManager: PackageManager;\n}\n\ninterface NewProjectConfig extends Omit<NewProjectProps, \"stack\" | \"app\"> {\n  cdkDir: string;\n  appPath: string;\n  appName: Name;\n  stackPath: string;\n  stackName: Name;\n  testPath: string;\n}\n\nconst checkPathExists = (path: string): void => {\n  if (!existsSync(path)) {\n    throw new Error(`File not found - ${path}`);\n  }\n};\n\nconst checkPathDoesNotExist = (path: string): void => {\n  if (existsSync(path)) {\n    throw new Error(`There is already a file at - ${path}`);\n  }\n};\n\nfunction validateConfig(config: NewProjectConfig): void {\n  if (!config.init) {\n    checkPathExists(config.cdkDir);\n  }\n  checkPathDoesNotExist(config.appPath); // TODO: Update the app file if it already exists\n  checkPathDoesNotExist(config.stackPath);\n\n  if (config.yamlTemplateLocation) {\n    checkPathExists(config.yamlTemplateLocation);\n  }\n}\n\nfunction getConfig(props: NewProjectProps): NewProjectConfig {\n  const { init, app, stack, stages, regions, yamlTemplateLocation, packageManager } = props;\n\n  const rootDir = gitRootOrCwd();\n  const cdkDir = join(rootDir, \"/cdk\");\n\n  const appName = toPascalCase(app);\n  const kebabAppName = toKebabCase(appName);\n  const stackName = toPascalCase(stack);\n  const kebabStackName = toKebabCase(stackName);\n\n  const config: NewProjectConfig = {\n    init,\n    yamlTemplateLocation,\n    stages,\n    regions,\n    cdkDir,\n    appName: {\n      kebab: kebabAppName,\n      pascal: appName,\n    },\n    appPath: `${cdkDir}/bin/${kebabAppName}.ts`,\n    stackName: {\n      kebab: kebabStackName,\n      pascal: stackName,\n    },\n    stackPath: `${cdkDir}/lib/${kebabAppName}.ts`,\n    testPath: `${cdkDir}/lib/${kebabAppName}.test.ts`,\n    packageManager,\n  };\n\n  validateConfig(config);\n\n  return config;\n}\n\nexport const newCdkProject = async (props: NewProjectProps): CliCommandResponse => {\n  console.log(\"Starting CDK generator\");\n\n  const config = getConfig(props);\n\n  if (config.init) {\n    buildDirectory({ outputDir: config.cdkDir });\n  }\n\n  console.log(`New app ${config.appName.pascal} will be written to ${config.appPath}`);\n  console.log(`New stack ${config.stackName.pascal} will be written to ${config.stackPath}`);\n\n  // bin directory\n  await constructApp({\n    appName: config.appName,\n    outputFile: \"cdk.ts\",\n    outputDir: dirname(config.appPath),\n    stack: config.stackName,\n    imports: Imports.newAppImports(config.appName),\n    stages: config.stages,\n    regions: config.regions,\n  });\n\n  // lib directory\n  await constructStack({\n    imports: Imports.newStackImports(!!config.yamlTemplateLocation),\n    appName: config.appName,\n    outputFile: basename(config.stackPath),\n    outputDir: dirname(config.stackPath),\n    yamlTemplateLocation: config.yamlTemplateLocation,\n  });\n\n  // lib directory\n  await constructTest({\n    imports: Imports.newTestImports(config.appName),\n    stackName: config.stackName,\n    appName: config.appName,\n    outputFile: basename(config.testPath),\n    outputDir: dirname(config.stackPath),\n  });\n\n  const commands = getCommands(config.packageManager, config.cdkDir);\n\n  if (config.init) {\n    console.log(chalk.yellow(\"Installing dependencies. This may take a while...\"));\n    await commands.installDependencies();\n    console.log(chalk.green(\"  ✅ Successfully installed dependencies\"));\n  }\n\n  // Run `eslint --fix` on the generated files instead of trying to generate code that completely satisfies the linter\n  await execute(\"./node_modules/.bin/eslint\", [\"lib/** bin/**\", \"--no-error-on-unmatched-pattern\", \"--fix\"], {\n    cwd: config.cdkDir,\n  });\n\n  console.log(chalk.yellow(\"Running lint check...\"));\n  await commands.lint();\n  console.log(chalk.green(\"  ✅ Successfully passed lint check\"));\n\n  console.log(chalk.yellow(\"Running tests...\"));\n  await commands.test();\n  console.log(chalk.green(\"  ✅ Successfully passed tests\"));\n\n  console.log(chalk.yellow(\"Running initial synthesis...\"));\n  await commands.synth();\n  console.log(chalk.green(\"  ✅ Successfully synthesized CDK app\"));\n\n  console.log(chalk.green(\"Success! Here's a summary of the created files:\"));\n  const tree = await execute(\"tree\", [\"-I\", \"node_modules|cdk.out\"], {\n    cwd: config.cdkDir,\n  });\n  console.log(tree);\n\n  const docsUrl = \"https://github.com/guardian/cdk/tree/main/docs\";\n  console.log(chalk.green(`Please see the docs (${docsUrl}) for next steps.`));\n\n  return Promise.resolve(0);\n};\n"]}

package/lib/bin/commands/new-project/utils/utils.js

@@ -2,15 +2,15 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getCommands = void 0;
 const exec_1 = require("../../../../utils/exec");
-async function runTask(packageManager, cwd, task) {
-    return await (0, exec_1.execute)(`${packageManager} ${task}`, [], { cwd });
+async function runTask(packageManager, cwd, args) {
+    return await (0, exec_1.execute)(packageManager, args, { cwd });
 }
 function getCommands(packageManager, cwd) {
     return {
-        installDependencies: () => runTask(packageManager, cwd, "install"),
-        lint: () => runTask(packageManager, cwd, "run lint"),
-        test: () => runTask(packageManager, cwd, "test -- -u"),
-        synth: () => runTask(packageManager, cwd, "run synth"),
+        installDependencies: () => runTask(packageManager, cwd, ["install"]),
+        lint: () => runTask(packageManager, cwd, ["run", "lint"]),
+        test: () => runTask(packageManager, cwd, ["test", "--", "-u"]),
+        synth: () => runTask(packageManager, cwd, ["run", "synth"]),
     };
 }
 exports.getCommands = getCommands;

package/lib/bin/commands/new-project/utils/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../../src/bin/commands/new-project/utils/utils.ts"],"names":[],"mappings":";;;AAAA,iDAAiD;AAQjD,KAAK,UAAU,OAAO,CAAC,cAA8B,EAAE,GAAW,EAAE,IAAY;IAC9E,OAAO,MAAM,IAAA,cAAO,EAAC,GAAG,cAAc,IAAI,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,SAAgB,WAAW,CACzB,cAA8B,EAC9B,GAAW;IAOX,OAAO;QACL,mBAAmB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,SAAS,CAAC;QAClE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,UAAU,CAAC;QACpD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC;QACtD,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,WAAW,CAAC;KACvD,CAAC;AACJ,CAAC;AAfD,kCAeC","sourcesContent":["import { execute } from \"../../../../utils/exec\";\nimport type { PackageManager } from \"../index\";\n\nexport interface Name {\n  kebab: string;\n  pascal: string;\n}\n\nasync function runTask(packageManager: PackageManager, cwd: string, task: string): Promise<string> {\n  return await execute(`${packageManager} ${task}`, [], { cwd });\n}\n\nexport function getCommands(\n  packageManager: PackageManager,\n  cwd: string,\n): {\n  installDependencies: () => Promise<string>;\n  lint: () => Promise<string>;\n  synth: () => Promise<string>;\n  test: () => Promise<string>;\n} {\n  return {\n    installDependencies: () => runTask(packageManager, cwd, \"install\"),\n    lint: () => runTask(packageManager, cwd, \"run lint\"),\n    test: () => runTask(packageManager, cwd, \"test -- -u\"),\n    synth: () => runTask(packageManager, cwd, \"run synth\"),\n  };\n}\n"]}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../../src/bin/commands/new-project/utils/utils.ts"],"names":[],"mappings":";;;AAAA,iDAAiD;AAQjD,KAAK,UAAU,OAAO,CAAC,cAA8B,EAAE,GAAW,EAAE,IAAc;IAChF,OAAO,MAAM,IAAA,cAAO,EAAC,cAAc,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAgB,WAAW,CACzB,cAA8B,EAC9B,GAAW;IAOX,OAAO;QACL,mBAAmB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9D,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;KAC5D,CAAC;AACJ,CAAC;AAfD,kCAeC","sourcesContent":["import { execute } from \"../../../../utils/exec\";\nimport type { PackageManager } from \"../index\";\n\nexport interface Name {\n  kebab: string;\n  pascal: string;\n}\n\nasync function runTask(packageManager: PackageManager, cwd: string, args: string[]): Promise<string> {\n  return await execute(packageManager, args, { cwd });\n}\n\nexport function getCommands(\n  packageManager: PackageManager,\n  cwd: string,\n): {\n  installDependencies: () => Promise<string>;\n  lint: () => Promise<string>;\n  synth: () => Promise<string>;\n  test: () => Promise<string>;\n} {\n  return {\n    installDependencies: () => runTask(packageManager, cwd, [\"install\"]),\n    lint: () => runTask(packageManager, cwd, [\"run\", \"lint\"]),\n    test: () => runTask(packageManager, cwd, [\"test\", \"--\", \"-u\"]),\n    synth: () => runTask(packageManager, cwd, [\"run\", \"synth\"]),\n  };\n}\n"]}

package/lib/experimental/constructs/iam/policies/developer-policy.d.ts

@@ -1,22 +1,24 @@
 import { type PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { ManagedPolicy } from "aws-cdk-lib/aws-iam";
 import type { GuStack } from "../../../../constructs/core";
-export type GuWorkloadPolicyProps = {
+export type GuDeveloperPolicyExperimentalProps = {
     /**
-     * Initial set of permissions to add to this policy document.
-     * You can also use `addPermission(statement)` to add permissions later.
+     * IAM policy statements to include in the developer policy.
      *
-     * @default - No statements.
+     * At least one statement is required.
      */
-    readonly statements?: PolicyStatement[];
+    readonly statements: [PolicyStatement, ...PolicyStatement[]];
     /**
-     * The unique identifier of the policy, which will be displayed when creating credentials.
+     * Unique identifier of the developer policy grant.
+     * This must match the grant ID used in Janus DeveloperPolicyGrant!
      */
-    readonly permission: string;
+    readonly grantId: string;
     /**
-     * An optional description of the policy which will be displayed if present.
+     * A brief description to help choose the correct developer policy in Janus or elsewhere.
+     *
+     * In AWS this will appear as the managed policy description.
      */
-    readonly description?: string;
+    readonly friendlyName: string;
     /**
      * An optional marker which suppresses the check and warnings on overbroad permissions
      */
@@ -27,7 +29,7 @@ export type GuWorkloadPolicyProps = {
  * resources which can then be used to create limited permission credentials for use with specific activities.
  *
  * The permission scope is not controlled.  This class should be used with care to create minimal permissions.
- * To that end, broad ALLOW permissions can pruned with narrower optional DENY permissions.
+ * To that end, broad ALLOW permissions can be pruned with narrower optional DENY permissions.
  *
  * `permission` is prefixed with `/developer-policy/` and postfixed with `/` to construct the path.  This will
  * be used for discovery and display.  It is restricted to the same character set as AWS `path`.
@@ -56,6 +58,6 @@ export type GuWorkloadPolicyProps = {
  * @experimental
  */
 export declare class GuDeveloperPolicyExperimental extends ManagedPolicy {
-    constructor(scope: GuStack, id: string, props: GuWorkloadPolicyProps);
+    constructor(scope: GuStack, id: string, props: GuDeveloperPolicyExperimentalProps);
 }
 //# sourceMappingURL=developer-policy.d.ts.map

package/lib/experimental/constructs/iam/policies/developer-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"developer-policy.d.ts","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/developer-policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAU,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAoB,aAAa,EAAuB,MAAM,qBAAqB,CAAC;AAE3F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAE3D,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IACxC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,6BAA8B,SAAQ,aAAa;gBAClD,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB;CAiBrE"}
+{"version":3,"file":"developer-policy.d.ts","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/developer-policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAA+B,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAoB,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAE3D,MAAM,MAAM,kCAAkC,GAAG;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC;IAC7D;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,6BAA8B,SAAQ,aAAa;gBAClD,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,kCAAkC;CAelF"}

package/lib/experimental/constructs/iam/policies/developer-policy.js

@@ -9,7 +9,7 @@ const aws_iam_2 = require("aws-cdk-lib/aws-iam");
  * resources which can then be used to create limited permission credentials for use with specific activities.
  *
  * The permission scope is not controlled.  This class should be used with care to create minimal permissions.
- * To that end, broad ALLOW permissions can pruned with narrower optional DENY permissions.
+ * To that end, broad ALLOW permissions can be pruned with narrower optional DENY permissions.
  *
  * `permission` is prefixed with `/developer-policy/` and postfixed with `/` to construct the path.  This will
  * be used for discovery and display.  It is restricted to the same character set as AWS `path`.
@@ -40,22 +40,36 @@ const aws_iam_2 = require("aws-cdk-lib/aws-iam");
 class GuDeveloperPolicyExperimental extends aws_iam_2.ManagedPolicy {
     constructor(scope, id, props) {
         super(scope, id, {
-            description: `${props.permission} developer policy`,
             ...props,
-            path: `/developer-policy/${props.permission}/`,
+            // Bear in mind that path has max length 512 chars
+            path: `/developer-policy/${scope.repositoryName}/${scope.stack}/${scope.stage}/${props.grantId}/`,
+            description: props.friendlyName,
         });
-        // Don't mind if it's missing, but if it's used it must not be empty
-        if (props.statements?.length == 0) {
-            throw new Error("Empty statements array passed to GuDeveloperPolicyExperimental");
-        }
+        aws_cdk_lib_1.Aspects.of(this).add(new GuDeveloperPolicyExperimentalRequiredChecker());
         if (!props.withoutPolicyChecks) {
             // Later, apply to the stack and check for specific errors
-            aws_cdk_lib_1.Aspects.of(this).add(new GuDeveloperPolicyExperimentalChecker());
+            aws_cdk_lib_1.Aspects.of(this).add(new GuDeveloperPolicyExperimentalOptionalChecker());
         }
     }
 }
 exports.GuDeveloperPolicyExperimental = GuDeveloperPolicyExperimental;
-class GuDeveloperPolicyExperimentalChecker {
+// Add checks here that we require and don't allow users to opt out of.
+class GuDeveloperPolicyExperimentalRequiredChecker {
+    visit(node) {
+        if (node instanceof aws_iam_2.CfnManagedPolicy) {
+            const description = node.description;
+            const maxLength = 60;
+            if (!description?.length) {
+                aws_cdk_lib_1.Annotations.of(node).addError("friendlyName must be filled in");
+            }
+            else if (description.length > maxLength) {
+                aws_cdk_lib_1.Annotations.of(node).addError(`friendlyName must be no more than ${maxLength} characters long, but was ${description.length} characters`);
+            }
+        }
+    }
+}
+// Add checks here that we recommend for most scenarios but don't require.
+class GuDeveloperPolicyExperimentalOptionalChecker {
     visit(node) {
         if (node instanceof aws_iam_2.CfnManagedPolicy) {
             const policyDocumentJson = node.policyDocument.toJSON();
@@ -66,7 +80,10 @@ class GuDeveloperPolicyExperimentalChecker {
             if (!("Statement" in policyDocumentJson)) {
                 return;
             }
-            if (!Array.isArray(policyDocumentJson.Statement) || policyDocumentJson.Statement.length == 0) {
+            if (!Array.isArray(policyDocumentJson.Statement)) {
+                return;
+            }
+            if (policyDocumentJson.Statement.length === 0) {
                 return;
             }
             // For the following conditions, we want to make a strong assertions: you cannot "Allow" with wildcards.
@@ -87,7 +104,7 @@ class GuDeveloperPolicyExperimentalChecker {
                     }
                     if (!("Resource" in statement)) {
                         // Typescript requires us to check this, because the data model doesn't guarantee it
-                        aws_cdk_lib_1.Annotations.of(node).addError("Statement is missing an Resource");
+                        aws_cdk_lib_1.Annotations.of(node).addError("Statement is missing a Resource");
                     }
                     else {
                         const resource = statement.Resource;
@@ -113,12 +130,13 @@ class GuDeveloperPolicyExperimentalChecker {
      *   arn:aws:dynamodb:us-east-2:account-ID-without-hyphens:table/*
      *   arn:aws:s3:::*
      *
-     * @param checkString resource or action
-     * @param node
+     * @param checkString Action or resource value to validate.
+     * @param checkType Label used in validation error messages (for example, Action or Resource).
+     * @param node Policy node used to attach validation annotations.
      * @private
      */
     check(checkString, checkType, node) {
-        if (checkString === "*" || checkString.indexOf(":*") || checkString.indexOf("/*") > 0) {
+        if (checkString === "*" || checkString.includes(":*") || checkString.includes("/*")) {
             aws_cdk_lib_1.Annotations.of(node).addError(`Statement ${checkType} is too broad: ${checkString}. If this is necessary and intended, use withoutPolicyChecks: true in properties to turn off this check`);
         }
     }

package/lib/experimental/constructs/iam/policies/developer-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"developer-policy.js","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/developer-policy.ts"],"names":[],"mappings":";;;AACA,6CAAmD;AACnD,iDAAmE;AACnE,iDAA2F;AA0B3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAa,6BAA8B,SAAQ,uBAAa;IAC9D,YAAY,KAAc,EAAE,EAAU,EAAE,KAA4B;QAClE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,WAAW,EAAE,GAAG,KAAK,CAAC,UAAU,mBAAmB;YACnD,GAAG,KAAK;YACR,IAAI,EAAE,qBAAqB,KAAK,CAAC,UAAU,GAAG;SAC/C,CAAC,CAAC;QAEH,oEAAoE;QACpE,IAAI,KAAK,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,EAAE;YACjC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;SACnF;QAED,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE;YAC9B,0DAA0D;YAC1D,qBAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,oCAAoC,EAAE,CAAC,CAAC;SAClE;IACH,CAAC;CACF;AAlBD,sEAkBC;AAED,MAAM,oCAAoC;IACjC,KAAK,CAAC,IAAgB;QAC3B,IAAI,IAAI,YAAY,0BAAgB,EAAE;YACpC,MAAM,kBAAkB,GAAa,IAAI,CAAC,cAAiC,CAAC,MAAM,EAAE,CAAC;YAErF,+GAA+G;YAC/G,IAAI,kBAAkB,KAAK,IAAI,IAAI,OAAO,kBAAkB,KAAK,QAAQ,EAAE;gBACzE,OAAO;aACR;YACD,IAAI,CAAC,CAAC,WAAW,IAAI,kBAAkB,CAAC,EAAE;gBACxC,OAAO;aACR;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE;gBAC5F,OAAO;aACR;YAED,wGAAwG;YACxG,KAAK,MAAM,SAAS,IAAI,kBAAkB,CAAC,SAAS,EAAE;gBACpD,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAK,SAAiC,CAAC,MAAM,KAAK,gBAAM,CAAC,KAAK,EAAE;oBAC1F,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,EAAE;wBAC5B,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;qBACjE;yBAAM;wBACL,MAAM,MAAM,GAAI,SAAiC,CAAC,MAAM,CAAC;wBAEzD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;4BAC9B,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;yBAChC;6BAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;4BAChC,MAAM,WAAW,GAAG,MAAkB,CAAC;4BACvC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;yBACjE;qBACF;oBAED,IAAI,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,EAAE;wBAC9B,oFAAoF;wBACpF,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC;qBACnE;yBAAM;wBACL,MAAM,QAAQ,GAAI,SAAmC,CAAC,QAAQ,CAAC;wBAE/D,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE;4BAChC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;yBACpC;6BAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;4BAClC,MAAM,aAAa,GAAG,QAAoB,CAAC;4BAC3C,aAAa,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;gCACjC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;4BACrC,CAAC,CAAC,CAAC;yBACJ;qBACF;iBACF;aACF;SACF;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,WAAmB,EAAE,SAAiB,EAAE,IAAsB;QAC1E,IAAI,WAAW,KAAK,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACrF,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAC3B,aAAa,SAAS,kBAAkB,WAAW,yGAAyG,CAC7J,CAAC;SACH;IACH,CAAC;IACO,WAAW,CAAC,WAAmB,EAAE,IAAsB;QAC7D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IACO,aAAa,CAAC,WAAmB,EAAE,IAAsB;QAC/D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;CACF","sourcesContent":["import type { IAspect } from \"aws-cdk-lib\";\nimport { Annotations, Aspects } from \"aws-cdk-lib\";\nimport { Effect, type PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { CfnManagedPolicy, ManagedPolicy, type PolicyDocument } from \"aws-cdk-lib/aws-iam\";\nimport type { IConstruct } from \"constructs\";\nimport type { GuStack } from \"../../../../constructs/core\";\n\nexport type GuWorkloadPolicyProps = {\n  /**\n   * Initial set of permissions to add to this policy document.\n   * You can also use `addPermission(statement)` to add permissions later.\n   *\n   * @default - No statements.\n   */\n  readonly statements?: PolicyStatement[];\n  /**\n   * The unique identifier of the policy, which will be displayed when creating credentials.\n   */\n  readonly permission: string;\n  /**\n   * An optional description of the policy which will be displayed if present.\n   */\n  readonly description?: string;\n  /**\n   * An optional marker which suppresses the check and warnings on overbroad permissions\n   */\n  readonly withoutPolicyChecks?: boolean;\n};\n\n/**\n * Creates a structured `AWS::IAM::ManagedPolicy` resource to manage arbitrary permissions on general account\n * resources which can then be used to create limited permission credentials for use with specific activities.\n *\n * The permission scope is not controlled.  This class should be used with care to create minimal permissions.\n * To that end, broad ALLOW permissions can pruned with narrower optional DENY permissions.\n *\n * `permission` is prefixed with `/developer-policy/` and postfixed with `/` to construct the path.  This will\n * be used for discovery and display.  It is restricted to the same character set as AWS `path`.\n *\n * `description` is optionally used to construct the AWS Managed Policy description and used for display.\n *\n * ```yaml\n *  TestingECAE2E87:\n *     Type: AWS::IAM::ManagedPolicy\n *     Properties:\n *       Description: This is testing stuff\n *       Path: /developer-policy/read-from-mybucket-under-mypath/\n *       PolicyDocument:\n *         Statement:\n *           - Action: s3:GetObject\n *             Effect: Allow\n *             Resource: arn:aws:s3:::mybucket/mypath\n *           - Action: s3:GetObject\n *             Effect: Deny\n *             Resource: arn:aws:s3:::mybucket/mypath/butnotthispath\n *         Version: \"2012-10-17\"\n *     Metadata:\n *       aws:cdk:path: janus-resources-for-testing-managed-policy-tagging/justin-testing/Resource* ```\n * ```\n *\n * @experimental\n */\nexport class GuDeveloperPolicyExperimental extends ManagedPolicy {\n  constructor(scope: GuStack, id: string, props: GuWorkloadPolicyProps) {\n    super(scope, id, {\n      description: `${props.permission} developer policy`,\n      ...props,\n      path: `/developer-policy/${props.permission}/`,\n    });\n\n    // Don't mind if it's missing, but if it's used it must not be empty\n    if (props.statements?.length == 0) {\n      throw new Error(\"Empty statements array passed to GuDeveloperPolicyExperimental\");\n    }\n\n    if (!props.withoutPolicyChecks) {\n      // Later, apply to the stack and check for specific errors\n      Aspects.of(this).add(new GuDeveloperPolicyExperimentalChecker());\n    }\n  }\n}\n\nclass GuDeveloperPolicyExperimentalChecker implements IAspect {\n  public visit(node: IConstruct): void {\n    if (node instanceof CfnManagedPolicy) {\n      const policyDocumentJson: unknown = (node.policyDocument as PolicyDocument).toJSON();\n\n      // These conditions will result in failures from the AWS classes themselves, so we don't need to validate them.\n      if (policyDocumentJson === null || typeof policyDocumentJson !== \"object\") {\n        return;\n      }\n      if (!(\"Statement\" in policyDocumentJson)) {\n        return;\n      }\n      if (!Array.isArray(policyDocumentJson.Statement) || policyDocumentJson.Statement.length == 0) {\n        return;\n      }\n\n      // For the following conditions, we want to make a strong assertions: you cannot \"Allow\" with wildcards.\n      for (const statement of policyDocumentJson.Statement) {\n        if (!(\"Effect\" in statement) || (statement as { Effect: unknown }).Effect === Effect.ALLOW) {\n          if (!(\"Action\" in statement)) {\n            Annotations.of(node).addError(\"Statement is missing an Action\");\n          } else {\n            const action = (statement as { Action: unknown }).Action;\n\n            if (typeof action === \"string\") {\n              this.checkAction(action, node);\n            } else if (Array.isArray(action)) {\n              const actionArray = action as string[];\n              actionArray.forEach((action) => this.checkAction(action, node));\n            }\n          }\n\n          if (!(\"Resource\" in statement)) {\n            // Typescript requires us to check this, because the data model doesn't guarantee it\n            Annotations.of(node).addError(\"Statement is missing an Resource\");\n          } else {\n            const resource = (statement as { Resource: unknown }).Resource;\n\n            if (typeof resource === \"string\") {\n              this.checkResource(resource, node);\n            } else if (Array.isArray(resource)) {\n              const resourceArray = resource as string[];\n              resourceArray.forEach((resource) => {\n                this.checkResource(resource, node);\n              });\n            }\n          }\n        }\n      }\n    }\n  }\n\n  /**\n   * Ensure that we don't have either actions or resources of the following forms:\n   *\n   *   *\n   *   s3:*\n   *   arn:aws:dynamodb:us-east-2:account-ID-without-hyphens:table/*\n   *   arn:aws:s3:::*\n   *\n   * @param checkString resource or action\n   * @param node\n   * @private\n   */\n  private check(checkString: string, checkType: string, node: CfnManagedPolicy) {\n    if (checkString === \"*\" || checkString.indexOf(\":*\") || checkString.indexOf(\"/*\") > 0) {\n      Annotations.of(node).addError(\n        `Statement ${checkType} is too broad: ${checkString}. If this is necessary and intended, use withoutPolicyChecks: true in properties to turn off this check`,\n      );\n    }\n  }\n  private checkAction(checkString: string, node: CfnManagedPolicy) {\n    this.check(checkString, \"Action\", node);\n  }\n  private checkResource(checkString: string, node: CfnManagedPolicy) {\n    this.check(checkString, \"Resource\", node);\n  }\n}\n"]}
+{"version":3,"file":"developer-policy.js","sourceRoot":"","sources":["../../../../../src/experimental/constructs/iam/policies/developer-policy.ts"],"names":[],"mappings":";;;AACA,6CAAmD;AACnD,iDAAwF;AACxF,iDAAsE;AA4BtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAa,6BAA8B,SAAQ,uBAAa;IAC9D,YAAY,KAAc,EAAE,EAAU,EAAE,KAAyC;QAC/E,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE;YACf,GAAG,KAAK;YACR,kDAAkD;YAClD,IAAI,EAAE,qBAAqB,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG;YACjG,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC,CAAC;QAEH,qBAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,4CAA4C,EAAE,CAAC,CAAC;QAEzE,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE;YAC9B,0DAA0D;YAC1D,qBAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,4CAA4C,EAAE,CAAC,CAAC;SAC1E;IACH,CAAC;CACF;AAhBD,sEAgBC;AAED,uEAAuE;AACvE,MAAM,4CAA4C;IACzC,KAAK,CAAC,IAAgB;QAC3B,IAAI,IAAI,YAAY,0BAAgB,EAAE;YACpC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;YACrC,MAAM,SAAS,GAAG,EAAE,CAAC;YAErB,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE;gBACxB,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;aACjE;iBAAM,IAAI,WAAW,CAAC,MAAM,GAAG,SAAS,EAAE;gBACzC,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAC3B,qCAAqC,SAAS,6BAA6B,WAAW,CAAC,MAAM,aAAa,CAC3G,CAAC;aACH;SACF;IACH,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,4CAA4C;IACzC,KAAK,CAAC,IAAgB;QAC3B,IAAI,IAAI,YAAY,0BAAgB,EAAE;YACpC,MAAM,kBAAkB,GAAa,IAAI,CAAC,cAAiC,CAAC,MAAM,EAAE,CAAC;YAErF,+GAA+G;YAC/G,IAAI,kBAAkB,KAAK,IAAI,IAAI,OAAO,kBAAkB,KAAK,QAAQ,EAAE;gBACzE,OAAO;aACR;YACD,IAAI,CAAC,CAAC,WAAW,IAAI,kBAAkB,CAAC,EAAE;gBACxC,OAAO;aACR;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE;gBAChD,OAAO;aACR;YACD,IAAI,kBAAkB,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE;gBAC7C,OAAO;aACR;YAED,wGAAwG;YACxG,KAAK,MAAM,SAAS,IAAI,kBAAkB,CAAC,SAAS,EAAE;gBACpD,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAK,SAAiC,CAAC,MAAM,KAAK,gBAAM,CAAC,KAAK,EAAE;oBAC1F,IAAI,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,EAAE;wBAC5B,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;qBACjE;yBAAM;wBACL,MAAM,MAAM,GAAI,SAAiC,CAAC,MAAM,CAAC;wBAEzD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;4BAC9B,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;yBAChC;6BAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;4BAChC,MAAM,WAAW,GAAG,MAAkB,CAAC;4BACvC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;yBACjE;qBACF;oBAED,IAAI,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,EAAE;wBAC9B,oFAAoF;wBACpF,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;qBAClE;yBAAM;wBACL,MAAM,QAAQ,GAAI,SAAmC,CAAC,QAAQ,CAAC;wBAE/D,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE;4BAChC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;yBACpC;6BAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;4BAClC,MAAM,aAAa,GAAG,QAAoB,CAAC;4BAC3C,aAAa,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;gCACjC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;4BACrC,CAAC,CAAC,CAAC;yBACJ;qBACF;iBACF;aACF;SACF;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,WAAmB,EAAE,SAAiB,EAAE,IAAsB;QAC1E,IAAI,WAAW,KAAK,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACnF,yBAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAC3B,aAAa,SAAS,kBAAkB,WAAW,yGAAyG,CAC7J,CAAC;SACH;IACH,CAAC;IACO,WAAW,CAAC,WAAmB,EAAE,IAAsB;QAC7D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IACO,aAAa,CAAC,WAAmB,EAAE,IAAsB;QAC/D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;CACF","sourcesContent":["import type { IAspect } from \"aws-cdk-lib\";\nimport { Annotations, Aspects } from \"aws-cdk-lib\";\nimport { Effect, type PolicyDocument, type PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { CfnManagedPolicy, ManagedPolicy } from \"aws-cdk-lib/aws-iam\";\nimport type { IConstruct } from \"constructs\";\nimport type { GuStack } from \"../../../../constructs/core\";\n\nexport type GuDeveloperPolicyExperimentalProps = {\n  /**\n   * IAM policy statements to include in the developer policy.\n   *\n   * At least one statement is required.\n   */\n  readonly statements: [PolicyStatement, ...PolicyStatement[]];\n  /**\n   * Unique identifier of the developer policy grant.\n   * This must match the grant ID used in Janus DeveloperPolicyGrant!\n   */\n  readonly grantId: string;\n  /**\n   * A brief description to help choose the correct developer policy in Janus or elsewhere.\n   *\n   * In AWS this will appear as the managed policy description.\n   */\n  readonly friendlyName: string;\n  /**\n   * An optional marker which suppresses the check and warnings on overbroad permissions\n   */\n  readonly withoutPolicyChecks?: boolean;\n};\n\n/**\n * Creates a structured `AWS::IAM::ManagedPolicy` resource to manage arbitrary permissions on general account\n * resources which can then be used to create limited permission credentials for use with specific activities.\n *\n * The permission scope is not controlled.  This class should be used with care to create minimal permissions.\n * To that end, broad ALLOW permissions can be pruned with narrower optional DENY permissions.\n *\n * `permission` is prefixed with `/developer-policy/` and postfixed with `/` to construct the path.  This will\n * be used for discovery and display.  It is restricted to the same character set as AWS `path`.\n *\n * `description` is optionally used to construct the AWS Managed Policy description and used for display.\n *\n * ```yaml\n *  TestingECAE2E87:\n *     Type: AWS::IAM::ManagedPolicy\n *     Properties:\n *       Description: This is testing stuff\n *       Path: /developer-policy/read-from-mybucket-under-mypath/\n *       PolicyDocument:\n *         Statement:\n *           - Action: s3:GetObject\n *             Effect: Allow\n *             Resource: arn:aws:s3:::mybucket/mypath\n *           - Action: s3:GetObject\n *             Effect: Deny\n *             Resource: arn:aws:s3:::mybucket/mypath/butnotthispath\n *         Version: \"2012-10-17\"\n *     Metadata:\n *       aws:cdk:path: janus-resources-for-testing-managed-policy-tagging/justin-testing/Resource* ```\n * ```\n *\n * @experimental\n */\nexport class GuDeveloperPolicyExperimental extends ManagedPolicy {\n  constructor(scope: GuStack, id: string, props: GuDeveloperPolicyExperimentalProps) {\n    super(scope, id, {\n      ...props,\n      // Bear in mind that path has max length 512 chars\n      path: `/developer-policy/${scope.repositoryName}/${scope.stack}/${scope.stage}/${props.grantId}/`,\n      description: props.friendlyName,\n    });\n\n    Aspects.of(this).add(new GuDeveloperPolicyExperimentalRequiredChecker());\n\n    if (!props.withoutPolicyChecks) {\n      // Later, apply to the stack and check for specific errors\n      Aspects.of(this).add(new GuDeveloperPolicyExperimentalOptionalChecker());\n    }\n  }\n}\n\n// Add checks here that we require and don't allow users to opt out of.\nclass GuDeveloperPolicyExperimentalRequiredChecker implements IAspect {\n  public visit(node: IConstruct): void {\n    if (node instanceof CfnManagedPolicy) {\n      const description = node.description;\n      const maxLength = 60;\n\n      if (!description?.length) {\n        Annotations.of(node).addError(\"friendlyName must be filled in\");\n      } else if (description.length > maxLength) {\n        Annotations.of(node).addError(\n          `friendlyName must be no more than ${maxLength} characters long, but was ${description.length} characters`,\n        );\n      }\n    }\n  }\n}\n\n// Add checks here that we recommend for most scenarios but don't require.\nclass GuDeveloperPolicyExperimentalOptionalChecker implements IAspect {\n  public visit(node: IConstruct): void {\n    if (node instanceof CfnManagedPolicy) {\n      const policyDocumentJson: unknown = (node.policyDocument as PolicyDocument).toJSON();\n\n      // These conditions will result in failures from the AWS classes themselves, so we don't need to validate them.\n      if (policyDocumentJson === null || typeof policyDocumentJson !== \"object\") {\n        return;\n      }\n      if (!(\"Statement\" in policyDocumentJson)) {\n        return;\n      }\n      if (!Array.isArray(policyDocumentJson.Statement)) {\n        return;\n      }\n      if (policyDocumentJson.Statement.length === 0) {\n        return;\n      }\n\n      // For the following conditions, we want to make a strong assertions: you cannot \"Allow\" with wildcards.\n      for (const statement of policyDocumentJson.Statement) {\n        if (!(\"Effect\" in statement) || (statement as { Effect: unknown }).Effect === Effect.ALLOW) {\n          if (!(\"Action\" in statement)) {\n            Annotations.of(node).addError(\"Statement is missing an Action\");\n          } else {\n            const action = (statement as { Action: unknown }).Action;\n\n            if (typeof action === \"string\") {\n              this.checkAction(action, node);\n            } else if (Array.isArray(action)) {\n              const actionArray = action as string[];\n              actionArray.forEach((action) => this.checkAction(action, node));\n            }\n          }\n\n          if (!(\"Resource\" in statement)) {\n            // Typescript requires us to check this, because the data model doesn't guarantee it\n            Annotations.of(node).addError(\"Statement is missing a Resource\");\n          } else {\n            const resource = (statement as { Resource: unknown }).Resource;\n\n            if (typeof resource === \"string\") {\n              this.checkResource(resource, node);\n            } else if (Array.isArray(resource)) {\n              const resourceArray = resource as string[];\n              resourceArray.forEach((resource) => {\n                this.checkResource(resource, node);\n              });\n            }\n          }\n        }\n      }\n    }\n  }\n\n  /**\n   * Ensure that we don't have either actions or resources of the following forms:\n   *\n   *   *\n   *   s3:*\n   *   arn:aws:dynamodb:us-east-2:account-ID-without-hyphens:table/*\n   *   arn:aws:s3:::*\n   *\n   * @param checkString Action or resource value to validate.\n   * @param checkType Label used in validation error messages (for example, Action or Resource).\n   * @param node Policy node used to attach validation annotations.\n   * @private\n   */\n  private check(checkString: string, checkType: string, node: CfnManagedPolicy) {\n    if (checkString === \"*\" || checkString.includes(\":*\") || checkString.includes(\"/*\")) {\n      Annotations.of(node).addError(\n        `Statement ${checkType} is too broad: ${checkString}. If this is necessary and intended, use withoutPolicyChecks: true in properties to turn off this check`,\n      );\n    }\n  }\n  private checkAction(checkString: string, node: CfnManagedPolicy) {\n    this.check(checkString, \"Action\", node);\n  }\n  private checkResource(checkString: string, node: CfnManagedPolicy) {\n    this.check(checkString, \"Resource\", node);\n  }\n}\n"]}

package/lib/patterns/ec2-app/base.js

@@ -181,7 +181,7 @@ class GuEc2App extends constructs_1.Construct {
                 app: app,
                 memorySize: 128,
                 handler: "bootstrap",
-                runtime: aws_lambda_1.Runtime.PROVIDED_AL2,
+                runtime: aws_lambda_1.Runtime.PROVIDED_AL2023,
                 fileName: `deploy/${cognitoAuthStage}/cognito-lambda/devx-cognito-lambda-amd64-v2.zip`,
                 withoutFilePrefix: true,
                 withoutArtifactUpload: true,

package/lib/patterns/ec2-app/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;AAAA,uGAAuG;AACvG,6CAA0D;AAE1D,iEAAsF;AACtF,yDAKiC;AAEjC,iDAAqD;AAErD,uFAA6F;AAC7F,uGAA2F;AAC3F,iDAA8D;AAC9D,uDAA+D;AAC/D,iDAAsD;AACtD,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAIqC;AAErC,gDAAkF;AAClF,8CAAsG;AAEtG,8CAAgF;AAChF,oDAA2D;AAC3D,kEAIwC;AAExC,uCAAwC;AAGxC,yDAAsE;AA4StE,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,iBAAiB,GAAG,IAAI,EACxB,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EAAE,YAAY,EACtB,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EACnF,wBAAwB,EACxB,YAAY,EACZ,qBAAqB,EACrB,yBAAyB,EACzB,GAAG,GACJ,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,MAAM,QAAQ,GAAG,YAAY,YAAY,kBAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QAEnH,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,WAAW;YACrC,CAAC,CAAC,IAAI,mBAAa,CAAC,KAAK,EAAE;gBACvB,GAAG;gBACH,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,YAAY,EAAE,gBAAgB,CAAC,YAAY;aAC5C,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,wBAAwB,GAC5B,QAAQ,YAAY,wBAAU,IAAI,QAAQ,CAAC,aAAa;YACtD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YAEpE,+DAA+D;YAC/D,YAAY,EAAE,8BAAY,CAAC,oBAAoB,CAAC;gBAC9C,eAAe,EAAE,CAAC,2CAAyB,CAAC,GAAG,CAAC;gBAChD,WAAW,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;aACjC,CAAC;YAEF,QAAQ,EAAE,QAAQ,YAAY,wBAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACvE,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;YACX,uBAAuB,EAAE,wBAAwB;YACjD,YAAY;YACZ,qBAAqB;YACrB,yBAAyB;SAC1B,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;YACD,iBAAiB;YACjB,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,IAAI,OAAO,WAAW,KAAK,WAAW;SAChF,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAEtG,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;YAC7B,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;YAEvD,MAAM,EACJ,aAAa,GAAG,CAAC,4BAA4B,CAAC,EAC9C,uBAAuB,GAAG,EAAE,EAC5B,6BAA6B,GAAG,GAAG,MAAM,0BAA0B,GACpE,GAAG,KAAK,CAAC,UAAU,CAAC;YAErB,IAAI,uBAAuB,GAAG,EAAE,EAAE;gBAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;aACtE;YAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC5B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;aAC9D;YAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAAE;gBACrE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;aAClF;YAED,MAAM,oBAAoB,GAAG,yBAAe,CAAC,uBAAuB,CAClE,KAAK,EACL,mCAAmC,EACnC,qCAAyB,CAAC,oBAAoB,CAAC,IAAI,CACpD,CAAC;YAEF,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,gBAAgB,IAAI,MAAM,CAAC;YAErE,sEAAsE;YACtE,4BAA4B;YAC5B,yDAAyD;YACzD,MAAM,qBAAqB,GAAG,4BAA4B,oBAAoB,CAAC,WAAW,oBAAoB,gBAAgB,oBAAoB,CAAC;YAEnJ,8CAA8C;YAC9C,oDAAoD;YACpD,MAAM,UAAU,GAAG,IAAI,yBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE;gBAC5D,GAAG,EAAE,GAAG;gBACR,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,oBAAO,CAAC,YAAY;gBAC7B,QAAQ,EAAE,UAAU,gBAAgB,kDAAkD;gBACtF,iBAAiB,EAAE,IAAI;gBACvB,qBAAqB,EAAE,IAAI;gBAC3B,cAAc,EAAE,qCAAyB,CAAC,8BAA8B,CAAC,IAAI;gBAC7E,YAAY,EAAE,yBAAY,CAAC,MAAM;gBACjC,WAAW,EAAE;oBACX,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;oBACvC,uBAAuB,EAAE,qBAAqB;iBAC/C;aACF,CAAC,CAAC;YAEH,kBAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAEzC,UAAU,CAAC,eAAe,CACxB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,KAAK;gBACpB,OAAO,EAAE,CAAC,uBAAuB,CAAC;gBAClC,SAAS,EAAE,CAAC,qBAAqB,CAAC;aACnC,CAAC,CACH,CAAC;YAEF,yEAAyE;YACzE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,IAAI,sBAAQ,CAAC,IAAI,EAAE,WAAW,EAAE;gBAC/C,cAAc,EAAE;oBACd,iBAAiB,EAAE,UAAU;oBAC7B,SAAS,EAAE,UAAU;iBACtB;aACF,CAAC,CAAC;YAEH,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAEhF,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE;oBACb,YAAY,EAAE,IAAA,iCAAuB,EAAC,YAAY,CAAC;iBACpD;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACtG,MAAM,YAAY,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;YAE9G,MAAM,WAAW,GAAG,IAAI,4CAA8B,CAAC,KAAK,EAAE,YAAY,EAAE;gBAC1E,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,iBAAiB,EAAE,YAAY;gBAC/B,gBAAgB,EAAE;oBAChB,KAAK,EAAE,+BAAiB,CAAC,YAAY;oBACrC,SAAS,EAAE,+BAAiB,CAAC,iBAAiB;oBAC9C,UAAU,EAAE,+BAAiB,CAAC,kBAAkB;oBAChD,cAAc,EAAE,+BAAiB,CAAC,cAAc;oBAChD,MAAM,EAAE;wBACN,IAAI,EAAE,+BAAiB,CAAC,WAAW;qBACpC;iBACF;gBACD,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;aACvC,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;gBACtD,0BAA0B,EAAE,CAAC,4CAA8B,CAAC,MAAM,CAAC;gBACnE,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,WAAW,KAAK,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC;iBACxE;gBAED,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,mEAAmE;gBACnE,cAAc;gBACd,eAAe,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,mBAAmB,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtC,oBAAoB,EAAE,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC;YAEH,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAE/C,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE;gBAChC,MAAM,EAAE,IAAI,8DAAyB,CAAC;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,cAAc,EAAE,cAAc;oBAC9B,cAAc,EAAE,cAAc;oBAC9B,IAAI,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;oBAC3C,cAAc,EAAE,sBAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC;iBAC1D,CAAC;aACH,CAAC,CAAC;YAEH,qEAAqE;YACrE,MAAM,sBAAsB,GAAG,IAAI,gCAA0B,CAAC,KAAK,EAAE,YAAY,EAAE;gBACjF,GAAG;gBACH,GAAG;aACJ,CAAC,CAAC;YAEH,YAAY,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;SACvD;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AA7UD,4BA6UC","sourcesContent":["/* eslint \"@guardian/tsdoc-required/tsdoc-required\": 2 -- to begin rolling this out for public APIs. */\nimport { Duration, SecretValue, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice, UpdatePolicy } from \"aws-cdk-lib/aws-autoscaling\";\nimport { AdditionalHealthCheckType, HealthChecks } from \"aws-cdk-lib/aws-autoscaling\";\nimport {\n  ProviderAttribute,\n  UserPool,\n  UserPoolClientIdentityProvider,\n  UserPoolIdentityProviderGoogle,\n} from \"aws-cdk-lib/aws-cognito\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { HealthCheck as ALBHealthCheck } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { ApplicationProtocol, ListenerAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { AuthenticateCognitoAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2-actions\";\nimport { Effect, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Architecture, Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http4xxAlarmProps, Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport {\n  GuAlb4xxPercentageAlarm,\n  GuAlb5xxPercentageAlarm,\n  GuUnhealthyInstancesAlarm,\n} from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuLoggingStreamNameParameter } from \"../../constructs/core\";\nimport { GuHttpsEgressSecurityGroup, GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport { GuLambdaFunction } from \"../../constructs/lambda\";\nimport {\n  GuApplicationLoadBalancer,\n  GuApplicationTargetGroup,\n  GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport type { WafProps } from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { getUserPoolDomainPrefix } from \"../../utils/cognito/cognito\";\n\n/**\n * To ship your application logs to ELK automatically, you must:\n *\n * 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n *\n * Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n */\nexport interface ApplicationLoggingProps {\n  /**\n   * Enables forwarding of application logs to the Guardian ELK stack.\n   *\n   * Note, to work, you will need to also do the following non-CDK things:\n   *\n   * 1. Include the `cdk-base` Amigo role in your AMI.\n   * 2. Log to `journald`. We recommend doing this by logging to `stdout` and\n   *    using `systemd` to start your app\n   * 3. Confirm that your [[`systemdUnitName`]] is configured properly.\n   *\n   * Unless you have explicitly opted-out, appropriate IAM permissions for\n   * logging to Kinesis will be configured automatically via the [[`GuEc2App`]]\n   * pattern.\n   *\n   * @see https://github.com/guardian/amigo/tree/main/roles/cdk-base\n   */\n  enabled: boolean;\n  /**\n   * This needs to match the name of your SystemD unit.\n   *\n   * If your systemd unit is not `<app>.service` set this value.\n   *\n   * @defaultValue `<app>.service`\n   */\n  systemdUnitName?: string;\n}\n\n/**\n * @privateRemarks we should rename this to AlarmsProps.\n */\nexport interface Alarms {\n  /**\n   * Name of the target (SNS Topic) for alarm notifications.\n   */\n  snsTopicName: string;\n  /**\n   * Enable the 5xx alarm with settings.\n   */\n  http5xxAlarm: false | Http5xxAlarmProps;\n  /**\n   * Enable the 4xx alarm with settings.\n   */\n  http4xxAlarm?: false | Http4xxAlarmProps;\n  /**\n   * Enable the unhealthy instances alarm.\n   */\n  unhealthyInstancesAlarm: boolean;\n  /**\n   * Internal flag - users of this library should ignore this setting.\n   */\n  noMonitoring?: false;\n}\n\nexport interface GuEc2AppProps extends AppIdentity {\n  /**\n   * User data for the autoscaling group.\n   */\n  userData: GuUserDataProps | UserData;\n  /**\n   * Network access restrictions for your load balancer.\n   *\n   * Note, this merely provides defence in depth; you should, for example, limit\n   * access to the VPN and then treat that as sufficient. Instead, use Google\n   * Auth for human access, or a suitable machine auth mechanism.\n   */\n  access: AppAccess;\n  /**\n   * The port your application runs on.\n   */\n  applicationPort: number;\n  /**\n   * Configure IAM roles for autoscaling group EC2 instances.\n   */\n  roleConfiguration?: GuInstanceRoleProps;\n  /**\n   * Enable and configure alarms.\n   */\n  monitoringConfiguration: Alarms | NoMonitoring;\n  /**\n   * EC2 instance type. Note, ensure your code is built for the same\n   * architecture family (arm64 - 'Graviton' instances - or x64).\n   */\n  instanceType: InstanceType;\n  /**\n   * Enable and configures application logs.\n   */\n  applicationLogging?: ApplicationLoggingProps;\n\n  /**\n   * Enable access logging for this load balancer.\n   * Access logs are written to an S3 bucket within your AWS account.\n   * The bucket is created by {@link https://github.com/guardian/aws-account-setup}.\n   * The logs are queryable via the `gucdk_access_logs` Athena database.\n   *\n   * @defaultValue true\n   */\n  withAccessLogging?: boolean;\n\n  /**\n   * Add block devices (additional storage).\n   */\n  blockDevices?: BlockDevice[];\n  /**\n   * Autoscaling group min and max sizes.\n   */\n  scaling: GuAsgCapacity;\n  /**\n   * Specify certificate for the load balancer.\n   */\n  certificateProps?: GuDomainName;\n\n  /**\n   * Configure AMIgo image recipe. This is only necessary if you are using GuCDK to generate your riff-raff.yaml file.\n   */\n  imageRecipe?: string | AmigoProps;\n  /**\n   * Specify the VPC to use.\n   *\n   * @see https://github.com/guardian/aws-account-setup\n   */\n  vpc?: IVpc;\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  privateSubnets?: ISubnet[];\n\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  publicSubnets?: ISubnet[];\n\n  /**\n   * Configure Google Auth.\n   */\n  googleAuth?: {\n    /**\n     * Enables Google Auth (via Cognito). **Additional MANUAL steps required -\n     * see below.**\n     *\n     * Limits access to members of the allowed Google groups.\n     *\n     * Note, this does not currently support simultaneous machine access, so\n     * only set to true if you only require staff access to your service, or are\n     * supporting machine access in some other way.\n     *\n     * MANUAL STEPS: to get this to work, we need a Google Project and\n     * associated credentials. Full instructions can be found here:\n     *\n     * https://docs.google.com/document/d/1_k1FSE52AZHXufWLTiKTI3xy5cGpziyHazSHTKrYfco/edit?usp=sharing\n     *\n     * DevX hope to automate this process in the near future.\n     */\n    enabled: true;\n    /**\n     * The domain users will access your service.\n     *\n     * Set this to the same as for certificateProps.\n     */\n    domain: string;\n    /**\n     * Groups used for membership checks.\n     *\n     * If specified, cannot be empty. Users must be a member of at least one\n     * group to gain access.\n     *\n     * WARNING: groups must be specified with the `guardian.co.uk` domain, even\n     * if that is the non-idiomatic choice for daily use.\n     *\n     * @defaultValue [`engineering@guardian.co.uk`]\n     */\n    allowedGroups?: string[];\n    /**\n     * The number of minutes before the session expires.\n     *\n     * Set this value to a safe period of time that revoked users\n     * sessions will continue to function.\n     *\n     * NOTE: This value cannot be larger than 60 minutes.\n     *\n     * @defaultValue 15\n     */\n    sessionTimeoutInMinutes?: number;\n    /**\n     * Secrets Manager path containing Google OAuth2 Client credentials.\n     *\n     * NOTE: you do not need to set this value, but you DO need to generate and\n     * store the associated credentials in Secrets Manager.\n     *\n     * Credentials should be stored in Secrets Manager as JSON:\n     *\n     * ```json\n     * {\n     *   \"clientId\": \"my-client-id\",\n     *   \"clientSecret\": \"my-client-secret\"\n     * }\n     * ```\n     *\n     * @see `googleAuth.enabled` for how to generate.\n     *\n     * @defaultValue /:STAGE/:stack/:app/google-auth-credentials\n     */\n    credentialsSecretsManagerPath?: string;\n\n    /**\n     * When using Auth in the ALB, which stage of cognito-lambda to use.\n     *\n     * For most applications this should always be PROD, even in the CODE environments.\n     *\n     * @defaultValue PROD\n     */\n    cognitoAuthStage?: string;\n  };\n\n  /**\n   * Specify custom healthcheck\n   */\n  healthcheck?: ALBHealthCheck;\n\n  /**\n   * Set http put response hop limit for the launch template.\n   * It can be necessary to raise this value from the default of 1\n   * for example when sharing the instance profile with a docker container running on the instance.\n   */\n  instanceMetadataHopLimit?: number;\n\n  /**\n   * Specify an update policy for the ASG created by this pattern.\n   *\n   * @see https://docs.aws.amazon.com/cdk/api/latest/docs/aws-autoscaling-readme.html#update-policy\n   *\n   * @defaultValue UpdatePolicy.none() - Cloudformation does not attempt to rotate instances in the ASG\n   * and must rely on riffraff to do so.\n   */\n  updatePolicy?: UpdatePolicy;\n\n  /**\n   * You can specify how long after an instance reaches the InService state it waits before contributing\n   * usage data to the aggregated metrics. This specified time is called the default instance warmup.\n   * This keeps dynamic scaling from being affected by metrics for individual instances that aren't yet\n   * handling application traffic and that might be experiencing temporarily high usage of compute resources.\n   *\n   * @see https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-default-instance-warmup.html\n   */\n  defaultInstanceWarmup?: Duration;\n\n  /**\n   * You can specify if the arn of this load balancer should be exposed for protection via WAF\n   *\n   * If this value changes, it is only picked up on WAF configuration redeploy.\n   *\n   * NB this parameter setting _alone_ is not sufficient to protect the application.\n   * You must also ensure that the application and stage combination is present in the WAF\n   * configuration.\n   *\n   * See https://github.com/guardian/waf/tree/main/lib\n   *\n   * There is a \"gotcha\" when migrating to this functionality.  You may not change only the Logical\n   * ID of an SSM Parameter (see https://docs.aws.amazon.com/cdk/v2/guide/identifiers.html) and the\n   * parameter name must be of the required form, meaning you cannot have an alternate name.\n   *\n   * You can either:\n   *\n   * Remove the old param and immediately redeploy with the new param (this does not affect\n   * protection unless and until the WAF configuration is redeployed)\n   *\n   *   OR\n   *\n   * Create an escape hatch by overriding the logical id (see \"ssm param escape hatch\" test for example)\n   **/\n  waf?: WafProps;\n\n  /**\n   * How often to send EC2 metrics, such as CPU usage.\n   * By default, AWS will produce `5Minute` granular metrics.\n   *\n   * It is recommended to produce `1Minute` granular metrics in production,\n   * especially when using ASG metrics to trigger horizontal scaling as it allows for earlier scaling.\n   *\n   * @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html\n   */\n  instanceMetricGranularity: \"1Minute\" | \"5Minute\";\n}\n\nfunction restrictedCidrRanges(ranges: IPeer[]) {\n  return ranges.map((range) => ({\n    range,\n    port: Port.tcp(443),\n    description: `Allow access on port 443 from ${range.uniqueId}`,\n  }));\n}\n\n/**\n * Pattern which creates the resources needed to run an application on EC2\n * behind a load balancer. For convenience, you may wish to use [[`GuPlayApp`]]\n * or [[`GuNodeApp`]], which extend this class.\n *\n * See props for further details.\n */\nexport class GuEc2App extends Construct {\n  /*\n   * These are public for now, as this allows users to\n   * modify these constructs as desired to fit their\n   * specific needs.\n   * In the future, we might build functionality to better enable users\n   * to access in-pattern constructs, but this would allow teams to be unblocked\n   * in the short term.\n   * */\n  public readonly vpc: IVpc;\n  public readonly certificate?: GuCertificate;\n  public readonly loadBalancer: GuApplicationLoadBalancer;\n  public readonly autoScalingGroup: GuAutoScalingGroup;\n  public readonly listener: GuHttpsApplicationListener;\n  public readonly targetGroup: GuApplicationTargetGroup;\n\n  constructor(scope: GuStack, props: GuEc2AppProps) {\n    const {\n      access,\n      withAccessLogging = true,\n      app,\n      // We should update this default once a significant number of apps have migrated to devx-logs\n      applicationLogging = { enabled: false },\n      applicationPort,\n      blockDevices,\n      certificateProps,\n      instanceType,\n      monitoringConfiguration,\n      roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n      scaling: { minimumInstances, maximumInstances = minimumInstances * 2 },\n      userData: userDataLike,\n      imageRecipe,\n      vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n      privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n      publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n      instanceMetadataHopLimit,\n      updatePolicy,\n      defaultInstanceWarmup,\n      instanceMetricGranularity,\n      waf,\n    } = props;\n\n    super(scope, app); // The assumption is `app` is unique\n\n    // We should really prevent users from doing this via the type system,\n    // but that requires a breaking change to the API\n    if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n      throw new Error(\n        \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n          \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\",\n      );\n    }\n\n    const userData = userDataLike instanceof UserData ? userDataLike : new GuUserData(scope, { ...userDataLike, app });\n\n    AppAccess.validate(access);\n\n    const certificate =\n      typeof certificateProps !== \"undefined\"\n        ? new GuCertificate(scope, {\n            app,\n            domainName: certificateProps.domainName,\n            hostedZoneId: certificateProps.hostedZoneId,\n          })\n        : undefined;\n\n    const maybePrivateConfigPolicy =\n      userData instanceof GuUserData && userData.configuration\n        ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n        : [];\n\n    const mergedRoleConfiguration: GuInstanceRoleProps = {\n      withoutLogShipping: roleConfiguration.withoutLogShipping,\n      additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n    };\n\n    const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n      app,\n      vpc,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n\n      // TODO should this be defaulted at pattern or construct level?\n      healthChecks: HealthChecks.withAdditionalChecks({\n        additionalTypes: [AdditionalHealthCheckType.ELB],\n        gracePeriod: Duration.minutes(2),\n      }),\n\n      userData: userData instanceof GuUserData ? userData.userData : userData,\n      vpcSubnets: { subnets: privateSubnets },\n      ...(blockDevices && { blockDevices }),\n      imageRecipe,\n      httpPutResponseHopLimit: instanceMetadataHopLimit,\n      updatePolicy,\n      defaultInstanceWarmup,\n      instanceMetricGranularity,\n    });\n\n    // This allows automatic shipping of instance Cloud Init logs when using the\n    // `cdk-base` Amigo role on your AMI.\n    Tags.of(autoScalingGroup).add(\n      MetadataKeys.LOG_KINESIS_STREAM_NAME,\n      GuLoggingStreamNameParameter.getInstance(scope).valueAsString,\n    );\n\n    if (applicationLogging.enabled) {\n      // This allows automatic shipping of application logs when using the\n      // `cdk-base` Amigo role on your AMI.\n      Tags.of(autoScalingGroup).add(\n        MetadataKeys.SYSTEMD_UNIT,\n        applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`,\n      );\n    }\n\n    const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n      app,\n      vpc,\n      // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n      internetFacing: access.scope !== AccessScope.INTERNAL,\n      vpcSubnets: {\n        subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n      },\n      withAccessLogging,\n      waf,\n    });\n\n    const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n      app,\n      vpc,\n      protocol: ApplicationProtocol.HTTP,\n      targets: [autoScalingGroup],\n      port: applicationPort,\n      healthCheck: props.healthcheck,\n    });\n\n    const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n      app,\n      loadBalancer,\n      certificate,\n      targetGroup,\n      // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n      open: access.scope === AccessScope.PUBLIC && typeof certificate !== \"undefined\",\n    });\n\n    // Since AWS won't create a security group automatically when open=false, we need to add our own\n    if (access.scope !== AccessScope.PUBLIC) {\n      loadBalancer.addSecurityGroup(\n        new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n          app,\n          vpc,\n          description: \"Allow restricted ingress from CIDR ranges\",\n          allowAllOutbound: false,\n          ingresses: restrictedCidrRanges(access.cidrRanges),\n        }),\n      );\n    }\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const { http5xxAlarm, http4xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n      if (http4xxAlarm) {\n        new GuAlb4xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http4xxAlarm,\n        });\n      }\n      if (http5xxAlarm) {\n        new GuAlb5xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http5xxAlarm,\n        });\n      }\n      if (unhealthyInstancesAlarm) {\n        new GuUnhealthyInstancesAlarm(scope, {\n          app,\n          targetGroup,\n          snsTopicName,\n        });\n      }\n    }\n\n    if (props.googleAuth?.enabled) {\n      const prefix = `/${scope.stage}/${scope.stack}/${app}`;\n\n      const {\n        allowedGroups = [\"engineering@guardian.co.uk\"],\n        sessionTimeoutInMinutes = 15,\n        credentialsSecretsManagerPath = `${prefix}/google-auth-credentials`,\n      } = props.googleAuth;\n\n      if (sessionTimeoutInMinutes > 60) {\n        throw new Error(\"googleAuth.sessionTimeoutInMinutes must be <= 60!\");\n      }\n\n      if (allowedGroups.length < 1) {\n        throw new Error(\"googleAuth.allowedGroups cannot be empty!\");\n      }\n\n      if (allowedGroups.find((group) => !group.endsWith(\"@guardian.co.uk\"))) {\n        throw new Error(\"googleAuth.allowedGroups must use the @guardian.co.uk domain.\");\n      }\n\n      const deployToolsAccountId = StringParameter.fromStringParameterName(\n        scope,\n        \"deploy-tools-account-id-parameter\",\n        NAMED_SSM_PARAMETER_PATHS.DeployToolsAccountId.path,\n      );\n\n      const cognitoAuthStage = props.googleAuth.cognitoAuthStage ?? \"PROD\";\n\n      // See https://github.com/guardian/cognito-auth-lambdas for the source\n      // code here. ARN format is:\n      // arn:aws:lambda:aws-region:acct-id:function:helloworld.\n      const gatekeeperFunctionArn = `arn:aws:lambda:eu-west-1:${deployToolsAccountId.stringValue}:function:deploy-${cognitoAuthStage}-gatekeeper-lambda`;\n\n      // Note, handler and filename must match here:\n      // https://github.com/guardian/cognito-auth-lambdas.\n      const authLambda = new GuLambdaFunction(scope, \"auth-lambda\", {\n        app: app,\n        memorySize: 128,\n        handler: \"bootstrap\",\n        runtime: Runtime.PROVIDED_AL2,\n        fileName: `deploy/${cognitoAuthStage}/cognito-lambda/devx-cognito-lambda-amd64-v2.zip`,\n        withoutFilePrefix: true,\n        withoutArtifactUpload: true,\n        bucketNamePath: NAMED_SSM_PARAMETER_PATHS.OrganisationDistributionBucket.path,\n        architecture: Architecture.X86_64,\n        environment: {\n          ALLOWED_GROUPS: allowedGroups.join(\",\"),\n          GATEKEEPER_FUNCTION_ARN: gatekeeperFunctionArn,\n        },\n      });\n\n      Tags.of(authLambda).add(\"Owner\", \"DevX\");\n\n      authLambda.addToRolePolicy(\n        new PolicyStatement({\n          effect: Effect.ALLOW,\n          actions: [\"lambda:InvokeFunction\"],\n          resources: [gatekeeperFunctionArn],\n        }),\n      );\n\n      // Cognito user pool. We require both lambdas: pre-sign-up runs the first\n      // time a user attempts to authenticate (before they exist in the User\n      // Pool); pre-auth runs in subsequent authentication flows.\n      const userPool = new UserPool(this, \"user-pool\", {\n        lambdaTriggers: {\n          preAuthentication: authLambda,\n          preSignUp: authLambda,\n        },\n      });\n\n      // These help ensure domain is deterministic but also unique. Key\n      // assumption is that app/stack/stage combo are unique within Guardian.\n      const domainPrefix = `com-gu-${app.toLowerCase()}-${scope.stage.toLowerCase()}`;\n\n      const userPoolDomain = userPool.addDomain(\"domain\", {\n        cognitoDomain: {\n          domainPrefix: getUserPoolDomainPrefix(domainPrefix),\n        },\n      });\n\n      const clientId = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientId\" });\n      const clientSecret = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientSecret\" });\n\n      const userPoolIdp = new UserPoolIdentityProviderGoogle(scope, \"google-idp\", {\n        userPool: userPool,\n        clientId: clientId.toString(),\n        clientSecretValue: clientSecret,\n        attributeMapping: {\n          email: ProviderAttribute.GOOGLE_EMAIL,\n          givenName: ProviderAttribute.GOOGLE_GIVEN_NAME,\n          familyName: ProviderAttribute.GOOGLE_FAMILY_NAME,\n          profilePicture: ProviderAttribute.GOOGLE_PICTURE,\n          custom: {\n            name: ProviderAttribute.GOOGLE_NAME,\n          },\n        },\n        scopes: [\"openid\", \"email\", \"profile\"],\n      });\n\n      const userPoolClient = userPool.addClient(\"alb-client\", {\n        supportedIdentityProviders: [UserPoolClientIdentityProvider.GOOGLE],\n        generateSecret: true,\n        oAuth: {\n          callbackUrls: [`https://${props.googleAuth.domain}/oauth2/idpresponse`],\n        },\n\n        // Note: id and access validity token validity cannot be less than one\n        // hour (this is the cognito cookie duration). To quickly invalidate\n        // credentials, disable the user in Cognito. It might be that we want to\n        // parameterise these going forward, but that would require Infosec\n        // discussion.\n        idTokenValidity: Duration.hours(1),\n        accessTokenValidity: Duration.hours(1),\n        refreshTokenValidity: Duration.days(7),\n      });\n\n      userPoolClient.node.addDependency(userPoolIdp);\n\n      listener.addAction(\"CognitoAuth\", {\n        action: new AuthenticateCognitoAction({\n          userPool: userPool,\n          userPoolClient: userPoolClient,\n          userPoolDomain: userPoolDomain,\n          next: ListenerAction.forward([targetGroup]),\n          sessionTimeout: Duration.minutes(sessionTimeoutInMinutes),\n        }),\n      });\n\n      // Need to give the ALB outbound access on 443 for the IdP endpoints.\n      const idpEgressSecurityGroup = new GuHttpsEgressSecurityGroup(scope, \"ldp-access\", {\n        app,\n        vpc,\n      });\n\n      loadBalancer.addSecurityGroup(idpEgressSecurityGroup);\n    }\n\n    this.vpc = vpc;\n    this.certificate = certificate;\n    this.loadBalancer = loadBalancer;\n    this.autoScalingGroup = autoScalingGroup;\n    this.listener = listener;\n    this.targetGroup = targetGroup;\n  }\n}\n"]}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;AAAA,uGAAuG;AACvG,6CAA0D;AAE1D,iEAAsF;AACtF,yDAKiC;AAEjC,iDAAqD;AAErD,uFAA6F;AAC7F,uGAA2F;AAC3F,iDAA8D;AAC9D,uDAA+D;AAC/D,iDAAsD;AACtD,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAIqC;AAErC,gDAAkF;AAClF,8CAAsG;AAEtG,8CAAgF;AAChF,oDAA2D;AAC3D,kEAIwC;AAExC,uCAAwC;AAGxC,yDAAsE;AA4StE,SAAS,oBAAoB,CAAC,MAAe;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,iBAAiB,GAAG,IAAI,EACxB,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EAAE,YAAY,EACtB,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EACnF,wBAAwB,EACxB,YAAY,EACZ,qBAAqB,EACrB,yBAAyB,EACzB,GAAG,GACJ,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,MAAM,QAAQ,GAAG,YAAY,YAAY,kBAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QAEnH,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,WAAW;YACrC,CAAC,CAAC,IAAI,mBAAa,CAAC,KAAK,EAAE;gBACvB,GAAG;gBACH,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,YAAY,EAAE,gBAAgB,CAAC,YAAY;aAC5C,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,wBAAwB,GAC5B,QAAQ,YAAY,wBAAU,IAAI,QAAQ,CAAC,aAAa;YACtD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YAEpE,+DAA+D;YAC/D,YAAY,EAAE,8BAAY,CAAC,oBAAoB,CAAC;gBAC9C,eAAe,EAAE,CAAC,2CAAyB,CAAC,GAAG,CAAC;gBAChD,WAAW,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;aACjC,CAAC;YAEF,QAAQ,EAAE,QAAQ,YAAY,wBAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACvE,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;YACX,uBAAuB,EAAE,wBAAwB;YACjD,YAAY;YACZ,qBAAqB;YACrB,yBAAyB;SAC1B,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;YACD,iBAAiB;YACjB,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,IAAI,OAAO,WAAW,KAAK,WAAW;SAChF,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAEtG,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;YAC7B,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;YAEvD,MAAM,EACJ,aAAa,GAAG,CAAC,4BAA4B,CAAC,EAC9C,uBAAuB,GAAG,EAAE,EAC5B,6BAA6B,GAAG,GAAG,MAAM,0BAA0B,GACpE,GAAG,KAAK,CAAC,UAAU,CAAC;YAErB,IAAI,uBAAuB,GAAG,EAAE,EAAE;gBAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;aACtE;YAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC5B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;aAC9D;YAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAAE;gBACrE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;aAClF;YAED,MAAM,oBAAoB,GAAG,yBAAe,CAAC,uBAAuB,CAClE,KAAK,EACL,mCAAmC,EACnC,qCAAyB,CAAC,oBAAoB,CAAC,IAAI,CACpD,CAAC;YAEF,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,gBAAgB,IAAI,MAAM,CAAC;YAErE,sEAAsE;YACtE,4BAA4B;YAC5B,yDAAyD;YACzD,MAAM,qBAAqB,GAAG,4BAA4B,oBAAoB,CAAC,WAAW,oBAAoB,gBAAgB,oBAAoB,CAAC;YAEnJ,8CAA8C;YAC9C,oDAAoD;YACpD,MAAM,UAAU,GAAG,IAAI,yBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE;gBAC5D,GAAG,EAAE,GAAG;gBACR,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,oBAAO,CAAC,eAAe;gBAChC,QAAQ,EAAE,UAAU,gBAAgB,kDAAkD;gBACtF,iBAAiB,EAAE,IAAI;gBACvB,qBAAqB,EAAE,IAAI;gBAC3B,cAAc,EAAE,qCAAyB,CAAC,8BAA8B,CAAC,IAAI;gBAC7E,YAAY,EAAE,yBAAY,CAAC,MAAM;gBACjC,WAAW,EAAE;oBACX,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;oBACvC,uBAAuB,EAAE,qBAAqB;iBAC/C;aACF,CAAC,CAAC;YAEH,kBAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAEzC,UAAU,CAAC,eAAe,CACxB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,KAAK;gBACpB,OAAO,EAAE,CAAC,uBAAuB,CAAC;gBAClC,SAAS,EAAE,CAAC,qBAAqB,CAAC;aACnC,CAAC,CACH,CAAC;YAEF,yEAAyE;YACzE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,IAAI,sBAAQ,CAAC,IAAI,EAAE,WAAW,EAAE;gBAC/C,cAAc,EAAE;oBACd,iBAAiB,EAAE,UAAU;oBAC7B,SAAS,EAAE,UAAU;iBACtB;aACF,CAAC,CAAC;YAEH,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAEhF,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE;oBACb,YAAY,EAAE,IAAA,iCAAuB,EAAC,YAAY,CAAC;iBACpD;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACtG,MAAM,YAAY,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;YAE9G,MAAM,WAAW,GAAG,IAAI,4CAA8B,CAAC,KAAK,EAAE,YAAY,EAAE;gBAC1E,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,iBAAiB,EAAE,YAAY;gBAC/B,gBAAgB,EAAE;oBAChB,KAAK,EAAE,+BAAiB,CAAC,YAAY;oBACrC,SAAS,EAAE,+BAAiB,CAAC,iBAAiB;oBAC9C,UAAU,EAAE,+BAAiB,CAAC,kBAAkB;oBAChD,cAAc,EAAE,+BAAiB,CAAC,cAAc;oBAChD,MAAM,EAAE;wBACN,IAAI,EAAE,+BAAiB,CAAC,WAAW;qBACpC;iBACF;gBACD,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;aACvC,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;gBACtD,0BAA0B,EAAE,CAAC,4CAA8B,CAAC,MAAM,CAAC;gBACnE,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,WAAW,KAAK,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC;iBACxE;gBAED,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,mEAAmE;gBACnE,cAAc;gBACd,eAAe,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,mBAAmB,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtC,oBAAoB,EAAE,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC;YAEH,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAE/C,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE;gBAChC,MAAM,EAAE,IAAI,8DAAyB,CAAC;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,cAAc,EAAE,cAAc;oBAC9B,cAAc,EAAE,cAAc;oBAC9B,IAAI,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;oBAC3C,cAAc,EAAE,sBAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC;iBAC1D,CAAC;aACH,CAAC,CAAC;YAEH,qEAAqE;YACrE,MAAM,sBAAsB,GAAG,IAAI,gCAA0B,CAAC,KAAK,EAAE,YAAY,EAAE;gBACjF,GAAG;gBACH,GAAG;aACJ,CAAC,CAAC;YAEH,YAAY,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;SACvD;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AA7UD,4BA6UC","sourcesContent":["/* eslint \"@guardian/tsdoc-required/tsdoc-required\": 2 -- to begin rolling this out for public APIs. */\nimport { Duration, SecretValue, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice, UpdatePolicy } from \"aws-cdk-lib/aws-autoscaling\";\nimport { AdditionalHealthCheckType, HealthChecks } from \"aws-cdk-lib/aws-autoscaling\";\nimport {\n  ProviderAttribute,\n  UserPool,\n  UserPoolClientIdentityProvider,\n  UserPoolIdentityProviderGoogle,\n} from \"aws-cdk-lib/aws-cognito\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { HealthCheck as ALBHealthCheck } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { ApplicationProtocol, ListenerAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { AuthenticateCognitoAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2-actions\";\nimport { Effect, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Architecture, Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http4xxAlarmProps, Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport {\n  GuAlb4xxPercentageAlarm,\n  GuAlb5xxPercentageAlarm,\n  GuUnhealthyInstancesAlarm,\n} from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuLoggingStreamNameParameter } from \"../../constructs/core\";\nimport { GuHttpsEgressSecurityGroup, GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport { GuLambdaFunction } from \"../../constructs/lambda\";\nimport {\n  GuApplicationLoadBalancer,\n  GuApplicationTargetGroup,\n  GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport type { WafProps } from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { getUserPoolDomainPrefix } from \"../../utils/cognito/cognito\";\n\n/**\n * To ship your application logs to ELK automatically, you must:\n *\n * 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n *\n * Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n */\nexport interface ApplicationLoggingProps {\n  /**\n   * Enables forwarding of application logs to the Guardian ELK stack.\n   *\n   * Note, to work, you will need to also do the following non-CDK things:\n   *\n   * 1. Include the `cdk-base` Amigo role in your AMI.\n   * 2. Log to `journald`. We recommend doing this by logging to `stdout` and\n   *    using `systemd` to start your app\n   * 3. Confirm that your [[`systemdUnitName`]] is configured properly.\n   *\n   * Unless you have explicitly opted-out, appropriate IAM permissions for\n   * logging to Kinesis will be configured automatically via the [[`GuEc2App`]]\n   * pattern.\n   *\n   * @see https://github.com/guardian/amigo/tree/main/roles/cdk-base\n   */\n  enabled: boolean;\n  /**\n   * This needs to match the name of your SystemD unit.\n   *\n   * If your systemd unit is not `<app>.service` set this value.\n   *\n   * @defaultValue `<app>.service`\n   */\n  systemdUnitName?: string;\n}\n\n/**\n * @privateRemarks we should rename this to AlarmsProps.\n */\nexport interface Alarms {\n  /**\n   * Name of the target (SNS Topic) for alarm notifications.\n   */\n  snsTopicName: string;\n  /**\n   * Enable the 5xx alarm with settings.\n   */\n  http5xxAlarm: false | Http5xxAlarmProps;\n  /**\n   * Enable the 4xx alarm with settings.\n   */\n  http4xxAlarm?: false | Http4xxAlarmProps;\n  /**\n   * Enable the unhealthy instances alarm.\n   */\n  unhealthyInstancesAlarm: boolean;\n  /**\n   * Internal flag - users of this library should ignore this setting.\n   */\n  noMonitoring?: false;\n}\n\nexport interface GuEc2AppProps extends AppIdentity {\n  /**\n   * User data for the autoscaling group.\n   */\n  userData: GuUserDataProps | UserData;\n  /**\n   * Network access restrictions for your load balancer.\n   *\n   * Note, this merely provides defence in depth; you should, for example, limit\n   * access to the VPN and then treat that as sufficient. Instead, use Google\n   * Auth for human access, or a suitable machine auth mechanism.\n   */\n  access: AppAccess;\n  /**\n   * The port your application runs on.\n   */\n  applicationPort: number;\n  /**\n   * Configure IAM roles for autoscaling group EC2 instances.\n   */\n  roleConfiguration?: GuInstanceRoleProps;\n  /**\n   * Enable and configure alarms.\n   */\n  monitoringConfiguration: Alarms | NoMonitoring;\n  /**\n   * EC2 instance type. Note, ensure your code is built for the same\n   * architecture family (arm64 - 'Graviton' instances - or x64).\n   */\n  instanceType: InstanceType;\n  /**\n   * Enable and configures application logs.\n   */\n  applicationLogging?: ApplicationLoggingProps;\n\n  /**\n   * Enable access logging for this load balancer.\n   * Access logs are written to an S3 bucket within your AWS account.\n   * The bucket is created by {@link https://github.com/guardian/aws-account-setup}.\n   * The logs are queryable via the `gucdk_access_logs` Athena database.\n   *\n   * @defaultValue true\n   */\n  withAccessLogging?: boolean;\n\n  /**\n   * Add block devices (additional storage).\n   */\n  blockDevices?: BlockDevice[];\n  /**\n   * Autoscaling group min and max sizes.\n   */\n  scaling: GuAsgCapacity;\n  /**\n   * Specify certificate for the load balancer.\n   */\n  certificateProps?: GuDomainName;\n\n  /**\n   * Configure AMIgo image recipe. This is only necessary if you are using GuCDK to generate your riff-raff.yaml file.\n   */\n  imageRecipe?: string | AmigoProps;\n  /**\n   * Specify the VPC to use.\n   *\n   * @see https://github.com/guardian/aws-account-setup\n   */\n  vpc?: IVpc;\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  privateSubnets?: ISubnet[];\n\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  publicSubnets?: ISubnet[];\n\n  /**\n   * Configure Google Auth.\n   */\n  googleAuth?: {\n    /**\n     * Enables Google Auth (via Cognito). **Additional MANUAL steps required -\n     * see below.**\n     *\n     * Limits access to members of the allowed Google groups.\n     *\n     * Note, this does not currently support simultaneous machine access, so\n     * only set to true if you only require staff access to your service, or are\n     * supporting machine access in some other way.\n     *\n     * MANUAL STEPS: to get this to work, we need a Google Project and\n     * associated credentials. Full instructions can be found here:\n     *\n     * https://docs.google.com/document/d/1_k1FSE52AZHXufWLTiKTI3xy5cGpziyHazSHTKrYfco/edit?usp=sharing\n     *\n     * DevX hope to automate this process in the near future.\n     */\n    enabled: true;\n    /**\n     * The domain users will access your service.\n     *\n     * Set this to the same as for certificateProps.\n     */\n    domain: string;\n    /**\n     * Groups used for membership checks.\n     *\n     * If specified, cannot be empty. Users must be a member of at least one\n     * group to gain access.\n     *\n     * WARNING: groups must be specified with the `guardian.co.uk` domain, even\n     * if that is the non-idiomatic choice for daily use.\n     *\n     * @defaultValue [`engineering@guardian.co.uk`]\n     */\n    allowedGroups?: string[];\n    /**\n     * The number of minutes before the session expires.\n     *\n     * Set this value to a safe period of time that revoked users\n     * sessions will continue to function.\n     *\n     * NOTE: This value cannot be larger than 60 minutes.\n     *\n     * @defaultValue 15\n     */\n    sessionTimeoutInMinutes?: number;\n    /**\n     * Secrets Manager path containing Google OAuth2 Client credentials.\n     *\n     * NOTE: you do not need to set this value, but you DO need to generate and\n     * store the associated credentials in Secrets Manager.\n     *\n     * Credentials should be stored in Secrets Manager as JSON:\n     *\n     * ```json\n     * {\n     *   \"clientId\": \"my-client-id\",\n     *   \"clientSecret\": \"my-client-secret\"\n     * }\n     * ```\n     *\n     * @see `googleAuth.enabled` for how to generate.\n     *\n     * @defaultValue /:STAGE/:stack/:app/google-auth-credentials\n     */\n    credentialsSecretsManagerPath?: string;\n\n    /**\n     * When using Auth in the ALB, which stage of cognito-lambda to use.\n     *\n     * For most applications this should always be PROD, even in the CODE environments.\n     *\n     * @defaultValue PROD\n     */\n    cognitoAuthStage?: string;\n  };\n\n  /**\n   * Specify custom healthcheck\n   */\n  healthcheck?: ALBHealthCheck;\n\n  /**\n   * Set http put response hop limit for the launch template.\n   * It can be necessary to raise this value from the default of 1\n   * for example when sharing the instance profile with a docker container running on the instance.\n   */\n  instanceMetadataHopLimit?: number;\n\n  /**\n   * Specify an update policy for the ASG created by this pattern.\n   *\n   * @see https://docs.aws.amazon.com/cdk/api/latest/docs/aws-autoscaling-readme.html#update-policy\n   *\n   * @defaultValue UpdatePolicy.none() - Cloudformation does not attempt to rotate instances in the ASG\n   * and must rely on riffraff to do so.\n   */\n  updatePolicy?: UpdatePolicy;\n\n  /**\n   * You can specify how long after an instance reaches the InService state it waits before contributing\n   * usage data to the aggregated metrics. This specified time is called the default instance warmup.\n   * This keeps dynamic scaling from being affected by metrics for individual instances that aren't yet\n   * handling application traffic and that might be experiencing temporarily high usage of compute resources.\n   *\n   * @see https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-default-instance-warmup.html\n   */\n  defaultInstanceWarmup?: Duration;\n\n  /**\n   * You can specify if the arn of this load balancer should be exposed for protection via WAF\n   *\n   * If this value changes, it is only picked up on WAF configuration redeploy.\n   *\n   * NB this parameter setting _alone_ is not sufficient to protect the application.\n   * You must also ensure that the application and stage combination is present in the WAF\n   * configuration.\n   *\n   * See https://github.com/guardian/waf/tree/main/lib\n   *\n   * There is a \"gotcha\" when migrating to this functionality.  You may not change only the Logical\n   * ID of an SSM Parameter (see https://docs.aws.amazon.com/cdk/v2/guide/identifiers.html) and the\n   * parameter name must be of the required form, meaning you cannot have an alternate name.\n   *\n   * You can either:\n   *\n   * Remove the old param and immediately redeploy with the new param (this does not affect\n   * protection unless and until the WAF configuration is redeployed)\n   *\n   *   OR\n   *\n   * Create an escape hatch by overriding the logical id (see \"ssm param escape hatch\" test for example)\n   **/\n  waf?: WafProps;\n\n  /**\n   * How often to send EC2 metrics, such as CPU usage.\n   * By default, AWS will produce `5Minute` granular metrics.\n   *\n   * It is recommended to produce `1Minute` granular metrics in production,\n   * especially when using ASG metrics to trigger horizontal scaling as it allows for earlier scaling.\n   *\n   * @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html\n   */\n  instanceMetricGranularity: \"1Minute\" | \"5Minute\";\n}\n\nfunction restrictedCidrRanges(ranges: IPeer[]) {\n  return ranges.map((range) => ({\n    range,\n    port: Port.tcp(443),\n    description: `Allow access on port 443 from ${range.uniqueId}`,\n  }));\n}\n\n/**\n * Pattern which creates the resources needed to run an application on EC2\n * behind a load balancer. For convenience, you may wish to use [[`GuPlayApp`]]\n * or [[`GuNodeApp`]], which extend this class.\n *\n * See props for further details.\n */\nexport class GuEc2App extends Construct {\n  /*\n   * These are public for now, as this allows users to\n   * modify these constructs as desired to fit their\n   * specific needs.\n   * In the future, we might build functionality to better enable users\n   * to access in-pattern constructs, but this would allow teams to be unblocked\n   * in the short term.\n   * */\n  public readonly vpc: IVpc;\n  public readonly certificate?: GuCertificate;\n  public readonly loadBalancer: GuApplicationLoadBalancer;\n  public readonly autoScalingGroup: GuAutoScalingGroup;\n  public readonly listener: GuHttpsApplicationListener;\n  public readonly targetGroup: GuApplicationTargetGroup;\n\n  constructor(scope: GuStack, props: GuEc2AppProps) {\n    const {\n      access,\n      withAccessLogging = true,\n      app,\n      // We should update this default once a significant number of apps have migrated to devx-logs\n      applicationLogging = { enabled: false },\n      applicationPort,\n      blockDevices,\n      certificateProps,\n      instanceType,\n      monitoringConfiguration,\n      roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n      scaling: { minimumInstances, maximumInstances = minimumInstances * 2 },\n      userData: userDataLike,\n      imageRecipe,\n      vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n      privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n      publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n      instanceMetadataHopLimit,\n      updatePolicy,\n      defaultInstanceWarmup,\n      instanceMetricGranularity,\n      waf,\n    } = props;\n\n    super(scope, app); // The assumption is `app` is unique\n\n    // We should really prevent users from doing this via the type system,\n    // but that requires a breaking change to the API\n    if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n      throw new Error(\n        \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n          \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\",\n      );\n    }\n\n    const userData = userDataLike instanceof UserData ? userDataLike : new GuUserData(scope, { ...userDataLike, app });\n\n    AppAccess.validate(access);\n\n    const certificate =\n      typeof certificateProps !== \"undefined\"\n        ? new GuCertificate(scope, {\n            app,\n            domainName: certificateProps.domainName,\n            hostedZoneId: certificateProps.hostedZoneId,\n          })\n        : undefined;\n\n    const maybePrivateConfigPolicy =\n      userData instanceof GuUserData && userData.configuration\n        ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n        : [];\n\n    const mergedRoleConfiguration: GuInstanceRoleProps = {\n      withoutLogShipping: roleConfiguration.withoutLogShipping,\n      additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n    };\n\n    const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n      app,\n      vpc,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n\n      // TODO should this be defaulted at pattern or construct level?\n      healthChecks: HealthChecks.withAdditionalChecks({\n        additionalTypes: [AdditionalHealthCheckType.ELB],\n        gracePeriod: Duration.minutes(2),\n      }),\n\n      userData: userData instanceof GuUserData ? userData.userData : userData,\n      vpcSubnets: { subnets: privateSubnets },\n      ...(blockDevices && { blockDevices }),\n      imageRecipe,\n      httpPutResponseHopLimit: instanceMetadataHopLimit,\n      updatePolicy,\n      defaultInstanceWarmup,\n      instanceMetricGranularity,\n    });\n\n    // This allows automatic shipping of instance Cloud Init logs when using the\n    // `cdk-base` Amigo role on your AMI.\n    Tags.of(autoScalingGroup).add(\n      MetadataKeys.LOG_KINESIS_STREAM_NAME,\n      GuLoggingStreamNameParameter.getInstance(scope).valueAsString,\n    );\n\n    if (applicationLogging.enabled) {\n      // This allows automatic shipping of application logs when using the\n      // `cdk-base` Amigo role on your AMI.\n      Tags.of(autoScalingGroup).add(\n        MetadataKeys.SYSTEMD_UNIT,\n        applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`,\n      );\n    }\n\n    const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n      app,\n      vpc,\n      // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n      internetFacing: access.scope !== AccessScope.INTERNAL,\n      vpcSubnets: {\n        subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n      },\n      withAccessLogging,\n      waf,\n    });\n\n    const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n      app,\n      vpc,\n      protocol: ApplicationProtocol.HTTP,\n      targets: [autoScalingGroup],\n      port: applicationPort,\n      healthCheck: props.healthcheck,\n    });\n\n    const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n      app,\n      loadBalancer,\n      certificate,\n      targetGroup,\n      // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n      open: access.scope === AccessScope.PUBLIC && typeof certificate !== \"undefined\",\n    });\n\n    // Since AWS won't create a security group automatically when open=false, we need to add our own\n    if (access.scope !== AccessScope.PUBLIC) {\n      loadBalancer.addSecurityGroup(\n        new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n          app,\n          vpc,\n          description: \"Allow restricted ingress from CIDR ranges\",\n          allowAllOutbound: false,\n          ingresses: restrictedCidrRanges(access.cidrRanges),\n        }),\n      );\n    }\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const { http5xxAlarm, http4xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n      if (http4xxAlarm) {\n        new GuAlb4xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http4xxAlarm,\n        });\n      }\n      if (http5xxAlarm) {\n        new GuAlb5xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http5xxAlarm,\n        });\n      }\n      if (unhealthyInstancesAlarm) {\n        new GuUnhealthyInstancesAlarm(scope, {\n          app,\n          targetGroup,\n          snsTopicName,\n        });\n      }\n    }\n\n    if (props.googleAuth?.enabled) {\n      const prefix = `/${scope.stage}/${scope.stack}/${app}`;\n\n      const {\n        allowedGroups = [\"engineering@guardian.co.uk\"],\n        sessionTimeoutInMinutes = 15,\n        credentialsSecretsManagerPath = `${prefix}/google-auth-credentials`,\n      } = props.googleAuth;\n\n      if (sessionTimeoutInMinutes > 60) {\n        throw new Error(\"googleAuth.sessionTimeoutInMinutes must be <= 60!\");\n      }\n\n      if (allowedGroups.length < 1) {\n        throw new Error(\"googleAuth.allowedGroups cannot be empty!\");\n      }\n\n      if (allowedGroups.find((group) => !group.endsWith(\"@guardian.co.uk\"))) {\n        throw new Error(\"googleAuth.allowedGroups must use the @guardian.co.uk domain.\");\n      }\n\n      const deployToolsAccountId = StringParameter.fromStringParameterName(\n        scope,\n        \"deploy-tools-account-id-parameter\",\n        NAMED_SSM_PARAMETER_PATHS.DeployToolsAccountId.path,\n      );\n\n      const cognitoAuthStage = props.googleAuth.cognitoAuthStage ?? \"PROD\";\n\n      // See https://github.com/guardian/cognito-auth-lambdas for the source\n      // code here. ARN format is:\n      // arn:aws:lambda:aws-region:acct-id:function:helloworld.\n      const gatekeeperFunctionArn = `arn:aws:lambda:eu-west-1:${deployToolsAccountId.stringValue}:function:deploy-${cognitoAuthStage}-gatekeeper-lambda`;\n\n      // Note, handler and filename must match here:\n      // https://github.com/guardian/cognito-auth-lambdas.\n      const authLambda = new GuLambdaFunction(scope, \"auth-lambda\", {\n        app: app,\n        memorySize: 128,\n        handler: \"bootstrap\",\n        runtime: Runtime.PROVIDED_AL2023,\n        fileName: `deploy/${cognitoAuthStage}/cognito-lambda/devx-cognito-lambda-amd64-v2.zip`,\n        withoutFilePrefix: true,\n        withoutArtifactUpload: true,\n        bucketNamePath: NAMED_SSM_PARAMETER_PATHS.OrganisationDistributionBucket.path,\n        architecture: Architecture.X86_64,\n        environment: {\n          ALLOWED_GROUPS: allowedGroups.join(\",\"),\n          GATEKEEPER_FUNCTION_ARN: gatekeeperFunctionArn,\n        },\n      });\n\n      Tags.of(authLambda).add(\"Owner\", \"DevX\");\n\n      authLambda.addToRolePolicy(\n        new PolicyStatement({\n          effect: Effect.ALLOW,\n          actions: [\"lambda:InvokeFunction\"],\n          resources: [gatekeeperFunctionArn],\n        }),\n      );\n\n      // Cognito user pool. We require both lambdas: pre-sign-up runs the first\n      // time a user attempts to authenticate (before they exist in the User\n      // Pool); pre-auth runs in subsequent authentication flows.\n      const userPool = new UserPool(this, \"user-pool\", {\n        lambdaTriggers: {\n          preAuthentication: authLambda,\n          preSignUp: authLambda,\n        },\n      });\n\n      // These help ensure domain is deterministic but also unique. Key\n      // assumption is that app/stack/stage combo are unique within Guardian.\n      const domainPrefix = `com-gu-${app.toLowerCase()}-${scope.stage.toLowerCase()}`;\n\n      const userPoolDomain = userPool.addDomain(\"domain\", {\n        cognitoDomain: {\n          domainPrefix: getUserPoolDomainPrefix(domainPrefix),\n        },\n      });\n\n      const clientId = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientId\" });\n      const clientSecret = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientSecret\" });\n\n      const userPoolIdp = new UserPoolIdentityProviderGoogle(scope, \"google-idp\", {\n        userPool: userPool,\n        clientId: clientId.toString(),\n        clientSecretValue: clientSecret,\n        attributeMapping: {\n          email: ProviderAttribute.GOOGLE_EMAIL,\n          givenName: ProviderAttribute.GOOGLE_GIVEN_NAME,\n          familyName: ProviderAttribute.GOOGLE_FAMILY_NAME,\n          profilePicture: ProviderAttribute.GOOGLE_PICTURE,\n          custom: {\n            name: ProviderAttribute.GOOGLE_NAME,\n          },\n        },\n        scopes: [\"openid\", \"email\", \"profile\"],\n      });\n\n      const userPoolClient = userPool.addClient(\"alb-client\", {\n        supportedIdentityProviders: [UserPoolClientIdentityProvider.GOOGLE],\n        generateSecret: true,\n        oAuth: {\n          callbackUrls: [`https://${props.googleAuth.domain}/oauth2/idpresponse`],\n        },\n\n        // Note: id and access validity token validity cannot be less than one\n        // hour (this is the cognito cookie duration). To quickly invalidate\n        // credentials, disable the user in Cognito. It might be that we want to\n        // parameterise these going forward, but that would require Infosec\n        // discussion.\n        idTokenValidity: Duration.hours(1),\n        accessTokenValidity: Duration.hours(1),\n        refreshTokenValidity: Duration.days(7),\n      });\n\n      userPoolClient.node.addDependency(userPoolIdp);\n\n      listener.addAction(\"CognitoAuth\", {\n        action: new AuthenticateCognitoAction({\n          userPool: userPool,\n          userPoolClient: userPoolClient,\n          userPoolDomain: userPoolDomain,\n          next: ListenerAction.forward([targetGroup]),\n          sessionTimeout: Duration.minutes(sessionTimeoutInMinutes),\n        }),\n      });\n\n      // Need to give the ALB outbound access on 443 for the IdP endpoints.\n      const idpEgressSecurityGroup = new GuHttpsEgressSecurityGroup(scope, \"ldp-access\", {\n        app,\n        vpc,\n      });\n\n      loadBalancer.addSecurityGroup(idpEgressSecurityGroup);\n    }\n\n    this.vpc = vpc;\n    this.certificate = certificate;\n    this.loadBalancer = loadBalancer;\n    this.autoScalingGroup = autoScalingGroup;\n    this.listener = listener;\n    this.targetGroup = targetGroup;\n  }\n}\n"]}

package/lib/utils/exec.js

@@ -9,7 +9,7 @@ const child_process_1 = __importDefault(require("child_process"));
 async function execute(cmd, args, { cwd }) {
     const child = child_process_1.default.spawn(cmd, args, {
         cwd,
-        shell: true,
+        shell: false,
         stdio: ["ignore", "pipe", "inherit"],
     });
     let stdout = "";
@@ -32,7 +32,7 @@ exports.execute = execute;
 function executeSync(cmd, args, { cwd }) {
     const { stdout, status } = child_process_1.default.spawnSync(cmd, args, {
         cwd,
-        shell: true,
+        shell: false,
         stdio: ["ignore", "pipe", "inherit"],
     });
     if (status === 0) {

package/lib/utils/exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/utils/exec.ts"],"names":[],"mappings":";;;;;;AAAA,kEAAyC;AAEzC,kIAAkI;AAC3H,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,IAAc,EAAE,EAAE,GAAG,EAAmB;IACjF,MAAM,KAAK,GAAG,uBAAY,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QAC1C,GAAG;QACH,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;KACrC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,gHAAgH;IAChH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAEjE,OAAO,IAAI,OAAO,CAAS,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE;QACtC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;YAC5B,IAAI,MAAM,KAAK,CAAC,EAAE;gBAChB,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;aAC1B;iBAAM;gBACL,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,uBAAuB,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;aAC5E;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAvBD,0BAuBC;AAED,SAAgB,WAAW,CAAC,GAAW,EAAE,IAAc,EAAE,EAAE,GAAG,EAAmB;IAC/E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,uBAAY,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;QAC3D,GAAG;QACH,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;KACrC,CAAC,CAAC;IAEH,IAAI,MAAM,KAAK,CAAC,EAAE;QAChB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;KACjC;SAAM;QACL,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,uBAAuB,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;KACrE;AACH,CAAC;AAbD,kCAaC","sourcesContent":["import childProcess from \"child_process\";\n\n// copied from https://github.com/aws/aws-cdk/blob/eda1640fcaf6375d7edc5f8edcb5d69c82d130a1/packages/aws-cdk/lib/init.ts#L381-L404\nexport async function execute(cmd: string, args: string[], { cwd }: { cwd: string }): Promise<string> {\n  const child = childProcess.spawn(cmd, args, {\n    cwd,\n    shell: true,\n    stdio: [\"ignore\", \"pipe\", \"inherit\"],\n  });\n\n  let stdout = \"\";\n\n  // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-member-access -- ???\n  child.stdout.on(\"data\", (chunk) => (stdout += chunk.toString()));\n\n  return new Promise<string>((ok, fail) => {\n    child.once(\"error\", (err) => fail(err));\n    child.once(\"exit\", (status) => {\n      if (status === 0) {\n        return ok(stdout.trim());\n      } else {\n        process.stderr.write(stdout);\n        return fail(new Error(`${cmd} exited with status ${status ?? \"unknown\"}`));\n      }\n    });\n  });\n}\n\nexport function executeSync(cmd: string, args: string[], { cwd }: { cwd: string }): string {\n  const { stdout, status } = childProcess.spawnSync(cmd, args, {\n    cwd,\n    shell: true,\n    stdio: [\"ignore\", \"pipe\", \"inherit\"],\n  });\n\n  if (status === 0) {\n    return stdout.toString().trim();\n  } else {\n    process.stderr.write(stdout);\n    throw new Error(`${cmd} exited with status ${status ?? \"unknown\"}`);\n  }\n}\n"]}
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/utils/exec.ts"],"names":[],"mappings":";;;;;;AAAA,kEAAyC;AAEzC,kIAAkI;AAC3H,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,IAAc,EAAE,EAAE,GAAG,EAAmB;IACjF,MAAM,KAAK,GAAG,uBAAY,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QAC1C,GAAG;QACH,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;KACrC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,gHAAgH;IAChH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAEjE,OAAO,IAAI,OAAO,CAAS,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE;QACtC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;YAC5B,IAAI,MAAM,KAAK,CAAC,EAAE;gBAChB,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;aAC1B;iBAAM;gBACL,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,uBAAuB,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;aAC5E;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAvBD,0BAuBC;AAED,SAAgB,WAAW,CAAC,GAAW,EAAE,IAAc,EAAE,EAAE,GAAG,EAAmB;IAC/E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,uBAAY,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;QAC3D,GAAG;QACH,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;KACrC,CAAC,CAAC;IAEH,IAAI,MAAM,KAAK,CAAC,EAAE;QAChB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;KACjC;SAAM;QACL,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,uBAAuB,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;KACrE;AACH,CAAC;AAbD,kCAaC","sourcesContent":["import childProcess from \"child_process\";\n\n// copied from https://github.com/aws/aws-cdk/blob/eda1640fcaf6375d7edc5f8edcb5d69c82d130a1/packages/aws-cdk/lib/init.ts#L381-L404\nexport async function execute(cmd: string, args: string[], { cwd }: { cwd: string }): Promise<string> {\n  const child = childProcess.spawn(cmd, args, {\n    cwd,\n    shell: false,\n    stdio: [\"ignore\", \"pipe\", \"inherit\"],\n  });\n\n  let stdout = \"\";\n\n  // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-member-access -- ???\n  child.stdout.on(\"data\", (chunk) => (stdout += chunk.toString()));\n\n  return new Promise<string>((ok, fail) => {\n    child.once(\"error\", (err) => fail(err));\n    child.once(\"exit\", (status) => {\n      if (status === 0) {\n        return ok(stdout.trim());\n      } else {\n        process.stderr.write(stdout);\n        return fail(new Error(`${cmd} exited with status ${status ?? \"unknown\"}`));\n      }\n    });\n  });\n}\n\nexport function executeSync(cmd: string, args: string[], { cwd }: { cwd: string }): string {\n  const { stdout, status } = childProcess.spawnSync(cmd, args, {\n    cwd,\n    shell: false,\n    stdio: [\"ignore\", \"pipe\", \"inherit\"],\n  });\n\n  if (status === 0) {\n    return stdout.toString().trim();\n  } else {\n    process.stderr.write(stdout);\n    throw new Error(`${cmd} exited with status ${status ?? \"unknown\"}`);\n  }\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@guardian/cdk",
   "description": "Generic Guardian flavoured AWS CDK components",
-  "version": "63.0.1",
+  "version": "63.2.0",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "files": [