@guardian/cdk 63.6.2 → 64.1.0

package/lib/patterns/ec2-app/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;AAAA,uGAAuG;AACvG,6CAA0D;AAE1D,iEAAsF;AACtF,yDAKiC;AAEjC,iDAAqD;AAErD,uFAA6F;AAC7F,uGAA2F;AAC3F,iDAA8D;AAC9D,uDAA+D;AAC/D,iDAAsD;AACtD,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAIqC;AAErC,gDAAkF;AAClF,8CAAsG;AAEtG,8CAAgF;AAChF,oDAA2D;AAC3D,kEAIwC;AAExC,uCAAwC;AAGxC,yDAAsE;AA2StE;;GAEG;AACH,SAAgB,oBAAoB,CAAC,MAAe;IAClD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAND,oDAMC;AAED;;;;;;GAMG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,iBAAiB,GAAG,IAAI,EACxB,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,EACzE,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EAAE,YAAY,EACtB,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EACnF,wBAAwB,EACxB,YAAY,EACZ,qBAAqB,EACrB,yBAAyB,EACzB,GAAG,GACJ,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,kBAAkB,CAAC,OAAO,IAAI,iBAAiB,CAAC,kBAAkB,EAAE;YACtE,MAAM,IAAI,KAAK,CACb,6GAA6G;gBAC3G,kGAAkG,CACrG,CAAC;SACH;QAED,MAAM,QAAQ,GAAG,YAAY,YAAY,kBAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QAEnH,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,WAAW;YACrC,CAAC,CAAC,IAAI,mBAAa,CAAC,KAAK,EAAE;gBACvB,GAAG;gBACH,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,YAAY,EAAE,gBAAgB,CAAC,YAAY;aAC5C,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,wBAAwB,GAC5B,QAAQ,YAAY,wBAAU,IAAI,QAAQ,CAAC,aAAa;YACtD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;YACxD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,IAAI,EAAE,CAAC;SAChG,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YAEpE,+DAA+D;YAC/D,YAAY,EAAE,8BAAY,CAAC,oBAAoB,CAAC;gBAC9C,eAAe,EAAE,CAAC,2CAAyB,CAAC,GAAG,CAAC;gBAChD,WAAW,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;aACjC,CAAC;YAEF,QAAQ,EAAE,QAAQ,YAAY,wBAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACvE,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;YACX,uBAAuB,EAAE,wBAAwB;YACjD,YAAY;YACZ,qBAAqB;YACrB,yBAAyB;SAC1B,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE;YAC9B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;SACH;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;YACD,iBAAiB;YACjB,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,IAAI,OAAO,WAAW,KAAK,WAAW;SAChF,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE;YACvC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;SACH;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAEtG,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,YAAY,EAAE;gBAChB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;aACJ;YACD,IAAI,uBAAuB,EAAE;gBAC3B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;aACJ;SACF;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;YAC7B,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;YAEvD,MAAM,EACJ,aAAa,GAAG,CAAC,4BAA4B,CAAC,EAC9C,uBAAuB,GAAG,EAAE,EAC5B,6BAA6B,GAAG,GAAG,MAAM,0BAA0B,GACpE,GAAG,KAAK,CAAC,UAAU,CAAC;YAErB,IAAI,uBAAuB,GAAG,EAAE,EAAE;gBAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;aACtE;YAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC5B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;aAC9D;YAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAAE;gBACrE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;aAClF;YAED,MAAM,oBAAoB,GAAG,yBAAe,CAAC,uBAAuB,CAClE,KAAK,EACL,mCAAmC,EACnC,qCAAyB,CAAC,oBAAoB,CAAC,IAAI,CACpD,CAAC;YAEF,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,gBAAgB,IAAI,MAAM,CAAC;YAErE,sEAAsE;YACtE,4BAA4B;YAC5B,yDAAyD;YACzD,MAAM,qBAAqB,GAAG,4BAA4B,oBAAoB,CAAC,WAAW,oBAAoB,gBAAgB,oBAAoB,CAAC;YAEnJ,8CAA8C;YAC9C,oDAAoD;YACpD,MAAM,UAAU,GAAG,IAAI,yBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE;gBAC5D,GAAG,EAAE,GAAG;gBACR,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,oBAAO,CAAC,eAAe;gBAChC,QAAQ,EAAE,UAAU,gBAAgB,kDAAkD;gBACtF,iBAAiB,EAAE,IAAI;gBACvB,qBAAqB,EAAE,IAAI;gBAC3B,cAAc,EAAE,qCAAyB,CAAC,8BAA8B,CAAC,IAAI;gBAC7E,YAAY,EAAE,yBAAY,CAAC,MAAM;gBACjC,WAAW,EAAE;oBACX,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;oBACvC,uBAAuB,EAAE,qBAAqB;iBAC/C;aACF,CAAC,CAAC;YAEH,kBAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAEzC,UAAU,CAAC,eAAe,CACxB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,KAAK;gBACpB,OAAO,EAAE,CAAC,uBAAuB,CAAC;gBAClC,SAAS,EAAE,CAAC,qBAAqB,CAAC;aACnC,CAAC,CACH,CAAC;YAEF,yEAAyE;YACzE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,IAAI,sBAAQ,CAAC,IAAI,EAAE,WAAW,EAAE;gBAC/C,cAAc,EAAE;oBACd,iBAAiB,EAAE,UAAU;oBAC7B,SAAS,EAAE,UAAU;iBACtB;aACF,CAAC,CAAC;YAEH,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAEhF,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE;oBACb,YAAY,EAAE,IAAA,iCAAuB,EAAC,YAAY,CAAC;iBACpD;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACtG,MAAM,YAAY,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;YAE9G,MAAM,WAAW,GAAG,IAAI,4CAA8B,CAAC,KAAK,EAAE,YAAY,EAAE;gBAC1E,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,iBAAiB,EAAE,YAAY;gBAC/B,gBAAgB,EAAE;oBAChB,KAAK,EAAE,+BAAiB,CAAC,YAAY;oBACrC,SAAS,EAAE,+BAAiB,CAAC,iBAAiB;oBAC9C,UAAU,EAAE,+BAAiB,CAAC,kBAAkB;oBAChD,cAAc,EAAE,+BAAiB,CAAC,cAAc;oBAChD,MAAM,EAAE;wBACN,IAAI,EAAE,+BAAiB,CAAC,WAAW;qBACpC;iBACF;gBACD,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;aACvC,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;gBACtD,0BAA0B,EAAE,CAAC,4CAA8B,CAAC,MAAM,CAAC;gBACnE,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,WAAW,KAAK,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC;iBACxE;gBAED,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,mEAAmE;gBACnE,cAAc;gBACd,eAAe,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,mBAAmB,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtC,oBAAoB,EAAE,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC;YAEH,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAE/C,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE;gBAChC,MAAM,EAAE,IAAI,8DAAyB,CAAC;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,cAAc,EAAE,cAAc;oBAC9B,cAAc,EAAE,cAAc;oBAC9B,IAAI,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;oBAC3C,cAAc,EAAE,sBAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC;iBAC1D,CAAC;aACH,CAAC,CAAC;YAEH,qEAAqE;YACrE,MAAM,sBAAsB,GAAG,IAAI,gCAA0B,CAAC,KAAK,EAAE,YAAY,EAAE;gBACjF,GAAG;gBACH,GAAG;aACJ,CAAC,CAAC;YAEH,YAAY,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;SACvD;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AA7UD,4BA6UC","sourcesContent":["/* eslint \"@guardian/tsdoc-required/tsdoc-required\": 2 -- to begin rolling this out for public APIs. */\nimport { Duration, SecretValue, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice, UpdatePolicy } from \"aws-cdk-lib/aws-autoscaling\";\nimport { AdditionalHealthCheckType, HealthChecks } from \"aws-cdk-lib/aws-autoscaling\";\nimport {\n  ProviderAttribute,\n  UserPool,\n  UserPoolClientIdentityProvider,\n  UserPoolIdentityProviderGoogle,\n} from \"aws-cdk-lib/aws-cognito\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { HealthCheck as ALBHealthCheck } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { ApplicationProtocol, ListenerAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { AuthenticateCognitoAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2-actions\";\nimport { Effect, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Architecture, Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http4xxAlarmProps, Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport {\n  GuAlb4xxPercentageAlarm,\n  GuAlb5xxPercentageAlarm,\n  GuUnhealthyInstancesAlarm,\n} from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuLoggingStreamNameParameter } from \"../../constructs/core\";\nimport { GuHttpsEgressSecurityGroup, GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport { GuLambdaFunction } from \"../../constructs/lambda\";\nimport {\n  GuApplicationLoadBalancer,\n  GuApplicationTargetGroup,\n  GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport type { WafProps } from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { getUserPoolDomainPrefix } from \"../../utils/cognito/cognito\";\n\n/**\n * To ship your application logs to ELK automatically, you must:\n *\n * 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n *\n * Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n */\nexport interface ApplicationLoggingProps {\n  /**\n   * Enables forwarding of application logs to the Guardian ELK stack.\n   *\n   * Note, to work, you will need to also do the following non-CDK things:\n   *\n   * 1. Include the `cdk-base` Amigo role in your AMI.\n   * 2. Log to `journald`. We recommend doing this by logging to `stdout` and\n   *    using `systemd` to start your app\n   * 3. Confirm that your [[`systemdUnitName`]] is configured properly.\n   *\n   * Unless you have explicitly opted-out, appropriate IAM permissions for\n   * logging to Kinesis will be configured automatically via the [[`GuEc2App`]]\n   * pattern.\n   *\n   * @see https://github.com/guardian/amigo/tree/main/roles/cdk-base\n   */\n  enabled: boolean;\n  /**\n   * This needs to match the name of your SystemD unit.\n   *\n   * If your systemd unit is not `<app>.service` set this value.\n   *\n   * @defaultValue `<app>.service`\n   */\n  systemdUnitName?: string;\n}\n\n/**\n * @privateRemarks we should rename this to AlarmsProps.\n */\nexport interface Alarms {\n  /**\n   * Name of the target (SNS Topic) for alarm notifications.\n   */\n  snsTopicName: string;\n  /**\n   * Enable the 5xx alarm with settings.\n   */\n  http5xxAlarm: false | Http5xxAlarmProps;\n  /**\n   * Enable the 4xx alarm with settings.\n   */\n  http4xxAlarm?: false | Http4xxAlarmProps;\n  /**\n   * Enable the unhealthy instances alarm.\n   */\n  unhealthyInstancesAlarm: boolean;\n  /**\n   * Internal flag - users of this library should ignore this setting.\n   */\n  noMonitoring?: false;\n}\n\nexport interface GuEc2AppProps extends AppIdentity {\n  /**\n   * User data for the autoscaling group.\n   */\n  userData: GuUserDataProps | UserData;\n  /**\n   * Network access restrictions for your load balancer.\n   *\n   * Note, this merely provides defence in depth; you should NOT rely on network access restrictions alone for\n   * restricting access. Use Google Auth for human access, or a suitable machine auth mechanism.\n   */\n  access: AppAccess;\n  /**\n   * The port your application runs on.\n   */\n  applicationPort: number;\n  /**\n   * Configure IAM roles for autoscaling group EC2 instances.\n   */\n  roleConfiguration?: GuInstanceRoleProps;\n  /**\n   * Enable and configure alarms.\n   */\n  monitoringConfiguration: Alarms | NoMonitoring;\n  /**\n   * EC2 instance type. Note, ensure your code is built for the same\n   * architecture family (arm64 - 'Graviton' instances - or x64).\n   */\n  instanceType: InstanceType;\n  /**\n   * Enable and configures application logs.\n   */\n  applicationLogging?: ApplicationLoggingProps;\n\n  /**\n   * Enable access logging for this load balancer.\n   * Access logs are written to an S3 bucket within your AWS account.\n   * The bucket is created by {@link https://github.com/guardian/aws-account-setup}.\n   * The logs are queryable via the `gucdk_access_logs` Athena database.\n   *\n   * @defaultValue true\n   */\n  withAccessLogging?: boolean;\n\n  /**\n   * Add block devices (additional storage).\n   */\n  blockDevices?: BlockDevice[];\n  /**\n   * Autoscaling group min and max sizes.\n   */\n  scaling: GuAsgCapacity;\n  /**\n   * Specify certificate for the load balancer.\n   */\n  certificateProps?: GuDomainName;\n\n  /**\n   * Configure AMIgo image recipe. This is only necessary if you are using GuCDK to generate your riff-raff.yaml file.\n   */\n  imageRecipe?: string | AmigoProps;\n  /**\n   * Specify the VPC to use.\n   *\n   * @see https://github.com/guardian/aws-account-setup\n   */\n  vpc?: IVpc;\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  privateSubnets?: ISubnet[];\n\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  publicSubnets?: ISubnet[];\n\n  /**\n   * Configure Google Auth.\n   */\n  googleAuth?: {\n    /**\n     * Enables Google Auth (via Cognito). **Additional MANUAL steps required -\n     * see below.**\n     *\n     * Limits access to members of the allowed Google groups.\n     *\n     * Note, this does not currently support simultaneous machine access, so\n     * only set to true if you only require staff access to your service, or are\n     * supporting machine access in some other way.\n     *\n     * MANUAL STEPS: to get this to work, we need a Google Project and\n     * associated credentials. Full instructions can be found here:\n     *\n     * https://docs.google.com/document/d/1_k1FSE52AZHXufWLTiKTI3xy5cGpziyHazSHTKrYfco/edit?usp=sharing\n     *\n     * DevX hope to automate this process in the near future.\n     */\n    enabled: true;\n    /**\n     * The domain users will access your service.\n     *\n     * Set this to the same as for certificateProps.\n     */\n    domain: string;\n    /**\n     * Groups used for membership checks.\n     *\n     * If specified, cannot be empty. Users must be a member of at least one\n     * group to gain access.\n     *\n     * WARNING: groups must be specified with the `guardian.co.uk` domain, even\n     * if that is the non-idiomatic choice for daily use.\n     *\n     * @defaultValue [`engineering@guardian.co.uk`]\n     */\n    allowedGroups?: string[];\n    /**\n     * The number of minutes before the session expires.\n     *\n     * Set this value to a safe period of time that revoked users\n     * sessions will continue to function.\n     *\n     * NOTE: This value cannot be larger than 60 minutes.\n     *\n     * @defaultValue 15\n     */\n    sessionTimeoutInMinutes?: number;\n    /**\n     * Secrets Manager path containing Google OAuth2 Client credentials.\n     *\n     * NOTE: you do not need to set this value, but you DO need to generate and\n     * store the associated credentials in Secrets Manager.\n     *\n     * Credentials should be stored in Secrets Manager as JSON:\n     *\n     * ```json\n     * {\n     *   \"clientId\": \"my-client-id\",\n     *   \"clientSecret\": \"my-client-secret\"\n     * }\n     * ```\n     *\n     * @see `googleAuth.enabled` for how to generate.\n     *\n     * @defaultValue /:STAGE/:stack/:app/google-auth-credentials\n     */\n    credentialsSecretsManagerPath?: string;\n\n    /**\n     * When using Auth in the ALB, which stage of cognito-lambda to use.\n     *\n     * For most applications this should always be PROD, even in the CODE environments.\n     *\n     * @defaultValue PROD\n     */\n    cognitoAuthStage?: string;\n  };\n\n  /**\n   * Specify custom healthcheck\n   */\n  healthcheck?: ALBHealthCheck;\n\n  /**\n   * Set http put response hop limit for the launch template.\n   * It can be necessary to raise this value from the default of 1\n   * for example when sharing the instance profile with a docker container running on the instance.\n   */\n  instanceMetadataHopLimit?: number;\n\n  /**\n   * Specify an update policy for the ASG created by this pattern.\n   *\n   * @see https://docs.aws.amazon.com/cdk/api/latest/docs/aws-autoscaling-readme.html#update-policy\n   *\n   * @defaultValue UpdatePolicy.none() - Cloudformation does not attempt to rotate instances in the ASG\n   * and must rely on riffraff to do so.\n   */\n  updatePolicy?: UpdatePolicy;\n\n  /**\n   * You can specify how long after an instance reaches the InService state it waits before contributing\n   * usage data to the aggregated metrics. This specified time is called the default instance warmup.\n   * This keeps dynamic scaling from being affected by metrics for individual instances that aren't yet\n   * handling application traffic and that might be experiencing temporarily high usage of compute resources.\n   *\n   * @see https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-default-instance-warmup.html\n   */\n  defaultInstanceWarmup?: Duration;\n\n  /**\n   * You can specify if the arn of this load balancer should be exposed for protection via WAF\n   *\n   * If this value changes, it is only picked up on WAF configuration redeploy.\n   *\n   * NB this parameter setting _alone_ is not sufficient to protect the application.\n   * You must also ensure that the application and stage combination is present in the WAF\n   * configuration.\n   *\n   * See https://github.com/guardian/waf/tree/main/lib\n   *\n   * There is a \"gotcha\" when migrating to this functionality.  You may not change only the Logical\n   * ID of an SSM Parameter (see https://docs.aws.amazon.com/cdk/v2/guide/identifiers.html) and the\n   * parameter name must be of the required form, meaning you cannot have an alternate name.\n   *\n   * You can either:\n   *\n   * Remove the old param and immediately redeploy with the new param (this does not affect\n   * protection unless and until the WAF configuration is redeployed)\n   *\n   *   OR\n   *\n   * Create an escape hatch by overriding the logical id (see \"ssm param escape hatch\" test for example)\n   **/\n  waf?: WafProps;\n\n  /**\n   * How often to send EC2 metrics, such as CPU usage.\n   * By default, AWS will produce `5Minute` granular metrics.\n   *\n   * It is recommended to produce `1Minute` granular metrics in production,\n   * especially when using ASG metrics to trigger horizontal scaling as it allows for earlier scaling.\n   *\n   * @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html\n   */\n  instanceMetricGranularity: \"1Minute\" | \"5Minute\";\n}\n\n/**\n * Use this to allow specific CIDR ranges to access a load balancer over HTTPS\n */\nexport function restrictedCidrRanges(ranges: IPeer[]) {\n  return ranges.map((range) => ({\n    range,\n    port: Port.tcp(443),\n    description: `Allow access on port 443 from ${range.uniqueId}`,\n  }));\n}\n\n/**\n * Pattern which creates the resources needed to run an application on EC2\n * behind a load balancer. For convenience, you may wish to use [[`GuPlayApp`]]\n * or [[`GuNodeApp`]], which extend this class.\n *\n * See props for further details.\n */\nexport class GuEc2App extends Construct {\n  /*\n   * These are public for now, as this allows users to\n   * modify these constructs as desired to fit their\n   * specific needs.\n   * In the future, we might build functionality to better enable users\n   * to access in-pattern constructs, but this would allow teams to be unblocked\n   * in the short term.\n   * */\n  public readonly vpc: IVpc;\n  public readonly certificate?: GuCertificate;\n  public readonly loadBalancer: GuApplicationLoadBalancer;\n  public readonly autoScalingGroup: GuAutoScalingGroup;\n  public readonly listener: GuHttpsApplicationListener;\n  public readonly targetGroup: GuApplicationTargetGroup;\n\n  constructor(scope: GuStack, props: GuEc2AppProps) {\n    const {\n      access,\n      withAccessLogging = true,\n      app,\n      // We should update this default once a significant number of apps have migrated to devx-logs\n      applicationLogging = { enabled: false },\n      applicationPort,\n      blockDevices,\n      certificateProps,\n      instanceType,\n      monitoringConfiguration,\n      roleConfiguration = { withoutLogShipping: false, additionalPolicies: [] },\n      scaling: { minimumInstances, maximumInstances = minimumInstances * 2 },\n      userData: userDataLike,\n      imageRecipe,\n      vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n      privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n      publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n      instanceMetadataHopLimit,\n      updatePolicy,\n      defaultInstanceWarmup,\n      instanceMetricGranularity,\n      waf,\n    } = props;\n\n    super(scope, app); // The assumption is `app` is unique\n\n    // We should really prevent users from doing this via the type system,\n    // but that requires a breaking change to the API\n    if (applicationLogging.enabled && roleConfiguration.withoutLogShipping) {\n      throw new Error(\n        \"Application logging has been enabled (via the `applicationLogging` prop) but your `roleConfiguration` sets \" +\n          \"`withoutLogShipping` to true. Please turn off application logging or remove `withoutLogShipping`\",\n      );\n    }\n\n    const userData = userDataLike instanceof UserData ? userDataLike : new GuUserData(scope, { ...userDataLike, app });\n\n    AppAccess.validate(access);\n\n    const certificate =\n      typeof certificateProps !== \"undefined\"\n        ? new GuCertificate(scope, {\n            app,\n            domainName: certificateProps.domainName,\n            hostedZoneId: certificateProps.hostedZoneId,\n          })\n        : undefined;\n\n    const maybePrivateConfigPolicy =\n      userData instanceof GuUserData && userData.configuration\n        ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n        : [];\n\n    const mergedRoleConfiguration: GuInstanceRoleProps = {\n      withoutLogShipping: roleConfiguration.withoutLogShipping,\n      additionalPolicies: maybePrivateConfigPolicy.concat(roleConfiguration.additionalPolicies ?? []),\n    };\n\n    const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n      app,\n      vpc,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n\n      // TODO should this be defaulted at pattern or construct level?\n      healthChecks: HealthChecks.withAdditionalChecks({\n        additionalTypes: [AdditionalHealthCheckType.ELB],\n        gracePeriod: Duration.minutes(2),\n      }),\n\n      userData: userData instanceof GuUserData ? userData.userData : userData,\n      vpcSubnets: { subnets: privateSubnets },\n      ...(blockDevices && { blockDevices }),\n      imageRecipe,\n      httpPutResponseHopLimit: instanceMetadataHopLimit,\n      updatePolicy,\n      defaultInstanceWarmup,\n      instanceMetricGranularity,\n    });\n\n    // This allows automatic shipping of instance Cloud Init logs when using the\n    // `cdk-base` Amigo role on your AMI.\n    Tags.of(autoScalingGroup).add(\n      MetadataKeys.LOG_KINESIS_STREAM_NAME,\n      GuLoggingStreamNameParameter.getInstance(scope).valueAsString,\n    );\n\n    if (applicationLogging.enabled) {\n      // This allows automatic shipping of application logs when using the\n      // `cdk-base` Amigo role on your AMI.\n      Tags.of(autoScalingGroup).add(\n        MetadataKeys.SYSTEMD_UNIT,\n        applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`,\n      );\n    }\n\n    const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n      app,\n      vpc,\n      // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n      internetFacing: access.scope !== AccessScope.INTERNAL,\n      vpcSubnets: {\n        subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n      },\n      withAccessLogging,\n      waf,\n    });\n\n    const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n      app,\n      vpc,\n      protocol: ApplicationProtocol.HTTP,\n      targets: [autoScalingGroup],\n      port: applicationPort,\n      healthCheck: props.healthcheck,\n    });\n\n    const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n      app,\n      loadBalancer,\n      certificate,\n      targetGroup,\n      // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n      open: access.scope === AccessScope.PUBLIC && typeof certificate !== \"undefined\",\n    });\n\n    // Since AWS won't create a security group automatically when open=false, we need to add our own\n    if (access.scope !== AccessScope.PUBLIC) {\n      loadBalancer.addSecurityGroup(\n        new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n          app,\n          vpc,\n          description: \"Allow restricted ingress from CIDR ranges\",\n          allowAllOutbound: false,\n          ingresses: restrictedCidrRanges(access.cidrRanges),\n        }),\n      );\n    }\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const { http5xxAlarm, http4xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n      if (http4xxAlarm) {\n        new GuAlb4xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http4xxAlarm,\n        });\n      }\n      if (http5xxAlarm) {\n        new GuAlb5xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http5xxAlarm,\n        });\n      }\n      if (unhealthyInstancesAlarm) {\n        new GuUnhealthyInstancesAlarm(scope, {\n          app,\n          targetGroup,\n          snsTopicName,\n        });\n      }\n    }\n\n    if (props.googleAuth?.enabled) {\n      const prefix = `/${scope.stage}/${scope.stack}/${app}`;\n\n      const {\n        allowedGroups = [\"engineering@guardian.co.uk\"],\n        sessionTimeoutInMinutes = 15,\n        credentialsSecretsManagerPath = `${prefix}/google-auth-credentials`,\n      } = props.googleAuth;\n\n      if (sessionTimeoutInMinutes > 60) {\n        throw new Error(\"googleAuth.sessionTimeoutInMinutes must be <= 60!\");\n      }\n\n      if (allowedGroups.length < 1) {\n        throw new Error(\"googleAuth.allowedGroups cannot be empty!\");\n      }\n\n      if (allowedGroups.find((group) => !group.endsWith(\"@guardian.co.uk\"))) {\n        throw new Error(\"googleAuth.allowedGroups must use the @guardian.co.uk domain.\");\n      }\n\n      const deployToolsAccountId = StringParameter.fromStringParameterName(\n        scope,\n        \"deploy-tools-account-id-parameter\",\n        NAMED_SSM_PARAMETER_PATHS.DeployToolsAccountId.path,\n      );\n\n      const cognitoAuthStage = props.googleAuth.cognitoAuthStage ?? \"PROD\";\n\n      // See https://github.com/guardian/cognito-auth-lambdas for the source\n      // code here. ARN format is:\n      // arn:aws:lambda:aws-region:acct-id:function:helloworld.\n      const gatekeeperFunctionArn = `arn:aws:lambda:eu-west-1:${deployToolsAccountId.stringValue}:function:deploy-${cognitoAuthStage}-gatekeeper-lambda`;\n\n      // Note, handler and filename must match here:\n      // https://github.com/guardian/cognito-auth-lambdas.\n      const authLambda = new GuLambdaFunction(scope, \"auth-lambda\", {\n        app: app,\n        memorySize: 128,\n        handler: \"bootstrap\",\n        runtime: Runtime.PROVIDED_AL2023,\n        fileName: `deploy/${cognitoAuthStage}/cognito-lambda/devx-cognito-lambda-amd64-v2.zip`,\n        withoutFilePrefix: true,\n        withoutArtifactUpload: true,\n        bucketNamePath: NAMED_SSM_PARAMETER_PATHS.OrganisationDistributionBucket.path,\n        architecture: Architecture.X86_64,\n        environment: {\n          ALLOWED_GROUPS: allowedGroups.join(\",\"),\n          GATEKEEPER_FUNCTION_ARN: gatekeeperFunctionArn,\n        },\n      });\n\n      Tags.of(authLambda).add(\"Owner\", \"DevX\");\n\n      authLambda.addToRolePolicy(\n        new PolicyStatement({\n          effect: Effect.ALLOW,\n          actions: [\"lambda:InvokeFunction\"],\n          resources: [gatekeeperFunctionArn],\n        }),\n      );\n\n      // Cognito user pool. We require both lambdas: pre-sign-up runs the first\n      // time a user attempts to authenticate (before they exist in the User\n      // Pool); pre-auth runs in subsequent authentication flows.\n      const userPool = new UserPool(this, \"user-pool\", {\n        lambdaTriggers: {\n          preAuthentication: authLambda,\n          preSignUp: authLambda,\n        },\n      });\n\n      // These help ensure domain is deterministic but also unique. Key\n      // assumption is that app/stack/stage combo are unique within Guardian.\n      const domainPrefix = `com-gu-${app.toLowerCase()}-${scope.stage.toLowerCase()}`;\n\n      const userPoolDomain = userPool.addDomain(\"domain\", {\n        cognitoDomain: {\n          domainPrefix: getUserPoolDomainPrefix(domainPrefix),\n        },\n      });\n\n      const clientId = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientId\" });\n      const clientSecret = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientSecret\" });\n\n      const userPoolIdp = new UserPoolIdentityProviderGoogle(scope, \"google-idp\", {\n        userPool: userPool,\n        clientId: clientId.toString(),\n        clientSecretValue: clientSecret,\n        attributeMapping: {\n          email: ProviderAttribute.GOOGLE_EMAIL,\n          givenName: ProviderAttribute.GOOGLE_GIVEN_NAME,\n          familyName: ProviderAttribute.GOOGLE_FAMILY_NAME,\n          profilePicture: ProviderAttribute.GOOGLE_PICTURE,\n          custom: {\n            name: ProviderAttribute.GOOGLE_NAME,\n          },\n        },\n        scopes: [\"openid\", \"email\", \"profile\"],\n      });\n\n      const userPoolClient = userPool.addClient(\"alb-client\", {\n        supportedIdentityProviders: [UserPoolClientIdentityProvider.GOOGLE],\n        generateSecret: true,\n        oAuth: {\n          callbackUrls: [`https://${props.googleAuth.domain}/oauth2/idpresponse`],\n        },\n\n        // Note: id and access validity token validity cannot be less than one\n        // hour (this is the cognito cookie duration). To quickly invalidate\n        // credentials, disable the user in Cognito. It might be that we want to\n        // parameterise these going forward, but that would require Infosec\n        // discussion.\n        idTokenValidity: Duration.hours(1),\n        accessTokenValidity: Duration.hours(1),\n        refreshTokenValidity: Duration.days(7),\n      });\n\n      userPoolClient.node.addDependency(userPoolIdp);\n\n      listener.addAction(\"CognitoAuth\", {\n        action: new AuthenticateCognitoAction({\n          userPool: userPool,\n          userPoolClient: userPoolClient,\n          userPoolDomain: userPoolDomain,\n          next: ListenerAction.forward([targetGroup]),\n          sessionTimeout: Duration.minutes(sessionTimeoutInMinutes),\n        }),\n      });\n\n      // Need to give the ALB outbound access on 443 for the IdP endpoints.\n      const idpEgressSecurityGroup = new GuHttpsEgressSecurityGroup(scope, \"ldp-access\", {\n        app,\n        vpc,\n      });\n\n      loadBalancer.addSecurityGroup(idpEgressSecurityGroup);\n    }\n\n    this.vpc = vpc;\n    this.certificate = certificate;\n    this.loadBalancer = loadBalancer;\n    this.autoScalingGroup = autoScalingGroup;\n    this.listener = listener;\n    this.targetGroup = targetGroup;\n  }\n}\n"]}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/patterns/ec2-app/base.ts"],"names":[],"mappings":";;;AA4VA,oDAMC;AAlWD,uGAAuG;AACvG,6CAA0D;AAE1D,iEAAsF;AACtF,yDAKiC;AAEjC,iDAAqD;AAErD,uFAA6F;AAC7F,uGAA2F;AAC3F,iDAA8D;AAC9D,uDAA+D;AAC/D,iDAAsD;AACtD,2CAAuC;AACvC,+CAAuF;AACvF,8CAAqD;AAErD,8DAA8E;AAE9E,4DAIqC;AAErC,gDAAkF;AAClF,8CAAsG;AAEtG,8CAAgF;AAChF,oDAA2D;AAC3D,kEAIwC;AAExC,uCAAwC;AAGxC,yDAAsE;AA6StE;;GAEG;AACH,SAAgB,oBAAoB,CAAC,MAAe;IAClD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,KAAK;QACL,IAAI,EAAE,cAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,WAAW,EAAE,iCAAiC,KAAK,CAAC,QAAQ,EAAE;KAC/D,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAa,QAAS,SAAQ,sBAAS;IAgBrC,YAAY,KAAc,EAAE,KAAoB;QAC9C,MAAM,EACJ,MAAM,EACN,iBAAiB,GAAG,IAAI,EACxB,GAAG;QACH,6FAA6F;QAC7F,kBAAkB,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EACvC,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,kBAAkB,GAAG,EAAE,EACvB,OAAO,EAAE,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,EAAE,EACtE,QAAQ,EAAE,YAAY,EACtB,WAAW,EACX,GAAG,GAAG,WAAK,CAAC,eAAe,CAAC,KAAK,EAAE,kBAAW,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,EAC1E,cAAc,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EACrF,aAAa,GAAG,WAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EACnF,wBAAwB,EACxB,YAAY,EACZ,qBAAqB,EACrB,yBAAyB,EACzB,GAAG,GACJ,GAAG,KAAK,CAAC;QAEV,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,oCAAoC;QAEvD,MAAM,QAAQ,GAAG,YAAY,YAAY,kBAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QAEnH,iBAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,WAAW;YACrC,CAAC,CAAC,IAAI,mBAAa,CAAC,KAAK,EAAE;gBACvB,GAAG;gBACH,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,YAAY,EAAE,gBAAgB,CAAC,YAAY;aAC5C,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,wBAAwB,GAC5B,QAAQ,YAAY,wBAAU,IAAI,QAAQ,CAAC,aAAa;YACtD,CAAC,CAAC,CAAC,IAAI,8BAAwB,CAAC,KAAK,EAAE,8BAA8B,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;YAC/F,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,uBAAuB,GAAwB;YACnD,kBAAkB,EAAE,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,CAAC;SACxE,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,gCAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE;YACzE,GAAG;YACH,GAAG;YACH,YAAY;YACZ,gBAAgB;YAChB,gBAAgB;YAChB,IAAI,EAAE,IAAI,oBAAc,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;YAEpE,+DAA+D;YAC/D,YAAY,EAAE,8BAAY,CAAC,oBAAoB,CAAC;gBAC9C,eAAe,EAAE,CAAC,2CAAyB,CAAC,GAAG,CAAC;gBAChD,WAAW,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;aACjC,CAAC;YAEF,QAAQ,EAAE,QAAQ,YAAY,wBAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YACvE,UAAU,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;YACvC,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,WAAW;YACX,uBAAuB,EAAE,wBAAwB;YACjD,YAAY;YACZ,qBAAqB;YACrB,yBAAyB;SAC1B,CAAC,CAAC;QAEH,4EAA4E;QAC5E,qCAAqC;QACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,uBAAuB,EACpC,mCAA4B,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,CAC9D,CAAC;QAEF,IAAI,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAC/B,oEAAoE;YACpE,qCAAqC;YACrC,kBAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC3B,wBAAY,CAAC,YAAY,EACzB,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,eAAe,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CACxG,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,yCAAyB,CAAC,KAAK,EAAE,cAAc,EAAE;YACxE,GAAG;YACH,GAAG;YACH,sJAAsJ;YACtJ,cAAc,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ;YACrD,UAAU,EAAE;gBACV,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa;aAChF;YACD,iBAAiB;YACjB,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,wCAAwB,CAAC,KAAK,EAAE,aAAa,EAAE;YACrE,GAAG;YACH,GAAG;YACH,QAAQ,EAAE,gDAAmB,CAAC,IAAI;YAClC,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,0CAA0B,CAAC,KAAK,EAAE,UAAU,EAAE;YACjE,GAAG;YACH,YAAY;YACZ,WAAW;YACX,WAAW;YACX,+FAA+F;YAC/F,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,IAAI,OAAO,WAAW,KAAK,WAAW;SAChF,CAAC,CAAC;QAEH,gGAAgG;QAChG,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAW,CAAC,MAAM,EAAE,CAAC;YACxC,YAAY,CAAC,gBAAgB,CAC3B,IAAI,qBAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,sBAAsB,EAAE;gBAChE,GAAG;gBACH,GAAG;gBACH,WAAW,EAAE,2CAA2C;gBACxD,gBAAgB,EAAE,KAAK;gBACvB,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC;aACnD,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,CAAC;YAC1C,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,GAAG,uBAAuB,CAAC;YAEtG,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,oCAAuB,CAAC,KAAK,EAAE;oBACjC,GAAG;oBACH,YAAY;oBACZ,YAAY;oBACZ,GAAG,YAAY;iBAChB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,uBAAuB,EAAE,CAAC;gBAC5B,IAAI,sCAAyB,CAAC,KAAK,EAAE;oBACnC,GAAG;oBACH,WAAW;oBACX,YAAY;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;YAEvD,MAAM,EACJ,aAAa,GAAG,CAAC,4BAA4B,CAAC,EAC9C,uBAAuB,GAAG,EAAE,EAC5B,6BAA6B,GAAG,GAAG,MAAM,0BAA0B,GACpE,GAAG,KAAK,CAAC,UAAU,CAAC;YAErB,IAAI,uBAAuB,GAAG,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACnF,CAAC;YAED,MAAM,oBAAoB,GAAG,yBAAe,CAAC,uBAAuB,CAClE,KAAK,EACL,mCAAmC,EACnC,qCAAyB,CAAC,oBAAoB,CAAC,IAAI,CACpD,CAAC;YAEF,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,gBAAgB,IAAI,MAAM,CAAC;YAErE,sEAAsE;YACtE,4BAA4B;YAC5B,yDAAyD;YACzD,MAAM,qBAAqB,GAAG,4BAA4B,oBAAoB,CAAC,WAAW,oBAAoB,gBAAgB,oBAAoB,CAAC;YAEnJ,8CAA8C;YAC9C,oDAAoD;YACpD,MAAM,UAAU,GAAG,IAAI,yBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE;gBAC5D,GAAG,EAAE,GAAG;gBACR,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,oBAAO,CAAC,eAAe;gBAChC,QAAQ,EAAE,UAAU,gBAAgB,kDAAkD;gBACtF,iBAAiB,EAAE,IAAI;gBACvB,qBAAqB,EAAE,IAAI;gBAC3B,cAAc,EAAE,qCAAyB,CAAC,8BAA8B,CAAC,IAAI;gBAC7E,YAAY,EAAE,yBAAY,CAAC,MAAM;gBACjC,WAAW,EAAE;oBACX,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;oBACvC,uBAAuB,EAAE,qBAAqB;iBAC/C;aACF,CAAC,CAAC;YAEH,kBAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAEzC,UAAU,CAAC,eAAe,CACxB,IAAI,yBAAe,CAAC;gBAClB,MAAM,EAAE,gBAAM,CAAC,KAAK;gBACpB,OAAO,EAAE,CAAC,uBAAuB,CAAC;gBAClC,SAAS,EAAE,CAAC,qBAAqB,CAAC;aACnC,CAAC,CACH,CAAC;YAEF,yEAAyE;YACzE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,IAAI,sBAAQ,CAAC,IAAI,EAAE,WAAW,EAAE;gBAC/C,cAAc,EAAE;oBACd,iBAAiB,EAAE,UAAU;oBAC7B,SAAS,EAAE,UAAU;iBACtB;aACF,CAAC,CAAC;YAEH,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAEhF,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAClD,aAAa,EAAE;oBACb,YAAY,EAAE,IAAA,iCAAuB,EAAC,YAAY,CAAC;iBACpD;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YACtG,MAAM,YAAY,GAAG,yBAAW,CAAC,cAAc,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;YAE9G,MAAM,WAAW,GAAG,IAAI,4CAA8B,CAAC,KAAK,EAAE,YAAY,EAAE;gBAC1E,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,iBAAiB,EAAE,YAAY;gBAC/B,gBAAgB,EAAE;oBAChB,KAAK,EAAE,+BAAiB,CAAC,YAAY;oBACrC,SAAS,EAAE,+BAAiB,CAAC,iBAAiB;oBAC9C,UAAU,EAAE,+BAAiB,CAAC,kBAAkB;oBAChD,cAAc,EAAE,+BAAiB,CAAC,cAAc;oBAChD,MAAM,EAAE;wBACN,IAAI,EAAE,+BAAiB,CAAC,WAAW;qBACpC;iBACF;gBACD,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;aACvC,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;gBACtD,0BAA0B,EAAE,CAAC,4CAA8B,CAAC,MAAM,CAAC;gBACnE,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,WAAW,KAAK,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC;iBACxE;gBAED,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,mEAAmE;gBACnE,cAAc;gBACd,eAAe,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,mBAAmB,EAAE,sBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtC,oBAAoB,EAAE,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;aACvC,CAAC,CAAC;YAEH,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAE/C,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE;gBAChC,MAAM,EAAE,IAAI,8DAAyB,CAAC;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,cAAc,EAAE,cAAc;oBAC9B,cAAc,EAAE,cAAc;oBAC9B,IAAI,EAAE,2CAAc,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;oBAC3C,cAAc,EAAE,sBAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC;iBAC1D,CAAC;aACH,CAAC,CAAC;YAEH,qEAAqE;YACrE,MAAM,sBAAsB,GAAG,IAAI,gCAA0B,CAAC,KAAK,EAAE,YAAY,EAAE;gBACjF,GAAG;gBACH,GAAG;aACJ,CAAC,CAAC;YAEH,YAAY,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAnUD,4BAmUC","sourcesContent":["/* eslint \"@guardian/tsdoc-required/tsdoc-required\": 2 -- to begin rolling this out for public APIs. */\nimport { Duration, SecretValue, Tags } from \"aws-cdk-lib\";\nimport type { BlockDevice, UpdatePolicy } from \"aws-cdk-lib/aws-autoscaling\";\nimport { AdditionalHealthCheckType, HealthChecks } from \"aws-cdk-lib/aws-autoscaling\";\nimport {\n  ProviderAttribute,\n  UserPool,\n  UserPoolClientIdentityProvider,\n  UserPoolIdentityProviderGoogle,\n} from \"aws-cdk-lib/aws-cognito\";\nimport type { InstanceType, IPeer, ISubnet, IVpc } from \"aws-cdk-lib/aws-ec2\";\nimport { Port, UserData } from \"aws-cdk-lib/aws-ec2\";\nimport type { HealthCheck as ALBHealthCheck } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { ApplicationProtocol, ListenerAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2\";\nimport { AuthenticateCognitoAction } from \"aws-cdk-lib/aws-elasticloadbalancingv2-actions\";\nimport { Effect, PolicyStatement } from \"aws-cdk-lib/aws-iam\";\nimport { Architecture, Runtime } from \"aws-cdk-lib/aws-lambda\";\nimport { StringParameter } from \"aws-cdk-lib/aws-ssm\";\nimport { Construct } from \"constructs\";\nimport { AccessScope, MetadataKeys, NAMED_SSM_PARAMETER_PATHS } from \"../../constants\";\nimport { GuCertificate } from \"../../constructs/acm\";\nimport type { GuUserDataProps } from \"../../constructs/autoscaling\";\nimport { GuAutoScalingGroup, GuUserData } from \"../../constructs/autoscaling\";\nimport type { Http4xxAlarmProps, Http5xxAlarmProps, NoMonitoring } from \"../../constructs/cloudwatch\";\nimport {\n  GuAlb4xxPercentageAlarm,\n  GuAlb5xxPercentageAlarm,\n  GuUnhealthyInstancesAlarm,\n} from \"../../constructs/cloudwatch\";\nimport type { GuStack } from \"../../constructs/core\";\nimport { AppIdentity, GuLoggingStreamNameParameter } from \"../../constructs/core\";\nimport { GuHttpsEgressSecurityGroup, GuSecurityGroup, GuVpc, SubnetType } from \"../../constructs/ec2\";\nimport type { GuInstanceRoleProps, GuPolicy } from \"../../constructs/iam\";\nimport { GuGetPrivateConfigPolicy, GuInstanceRole } from \"../../constructs/iam\";\nimport { GuLambdaFunction } from \"../../constructs/lambda\";\nimport {\n  GuApplicationLoadBalancer,\n  GuApplicationTargetGroup,\n  GuHttpsApplicationListener,\n} from \"../../constructs/loadbalancing\";\nimport type { WafProps } from \"../../constructs/loadbalancing\";\nimport { AppAccess } from \"../../types\";\nimport type { GuAsgCapacity, GuDomainName } from \"../../types\";\nimport type { AmigoProps } from \"../../types/amigo\";\nimport { getUserPoolDomainPrefix } from \"../../utils/cognito/cognito\";\n\n/**\n * To ship your application logs to ELK automatically, you must:\n *\n * 1. Set the `enabled` flag to true\n * 2. Include the `cdk-base` Amigo role in your AMI\n * 3. Log to `journald`. We recommend doing this by logging to `stdout` and\n * using `systemd` to start your app\n * 4. Confirm that your [[`systemdUnitName`]] is configured properly.\n *\n * Unless you have explicitly opted-out, appropriate IAM permissions for logging\n * to Kinesis will be configured automatically via the [[`GuEc2App`]] pattern.\n */\nexport interface ApplicationLoggingProps {\n  /**\n   * Enables forwarding of application logs to the Guardian ELK stack.\n   *\n   * Note, to work, you will need to also do the following non-CDK things:\n   *\n   * 1. Include the `cdk-base` Amigo role in your AMI.\n   * 2. Log to `journald`. We recommend doing this by logging to `stdout` and\n   *    using `systemd` to start your app\n   * 3. Confirm that your [[`systemdUnitName`]] is configured properly.\n   *\n   * Unless you have explicitly opted-out, appropriate IAM permissions for\n   * logging to Kinesis will be configured automatically via the [[`GuEc2App`]]\n   * pattern.\n   *\n   * @see https://github.com/guardian/amigo/tree/main/roles/cdk-base\n   */\n  enabled: boolean;\n  /**\n   * This needs to match the name of your SystemD unit.\n   *\n   * If your systemd unit is not `<app>.service` set this value.\n   *\n   * @defaultValue `<app>.service`\n   */\n  systemdUnitName?: string;\n}\n\n/**\n * @privateRemarks we should rename this to AlarmsProps.\n */\nexport interface Alarms {\n  /**\n   * Name of the target (SNS Topic) for alarm notifications.\n   */\n  snsTopicName: string;\n  /**\n   * Enable the 5xx alarm with settings.\n   */\n  http5xxAlarm: false | Http5xxAlarmProps;\n  /**\n   * Enable the 4xx alarm with settings.\n   */\n  http4xxAlarm?: false | Http4xxAlarmProps;\n  /**\n   * Enable the unhealthy instances alarm.\n   */\n  unhealthyInstancesAlarm: boolean;\n  /**\n   * Internal flag - users of this library should ignore this setting.\n   */\n  noMonitoring?: false;\n}\n\nexport interface GuEc2AppProps extends AppIdentity {\n  /**\n   * User data for the autoscaling group.\n   */\n  userData: GuUserDataProps | UserData;\n  /**\n   * Network access restrictions for your load balancer.\n   *\n   * Note, this merely provides defence in depth; you should NOT rely on network access restrictions alone for\n   * restricting access. Use Google Auth for human access, or a suitable machine auth mechanism.\n   */\n  access: AppAccess;\n  /**\n   * The port your application runs on.\n   */\n  applicationPort: number;\n\n  /**\n   * Any additional permissions needed to run the application.\n   */\n  additionalPolicies?: GuPolicy[];\n\n  /**\n   * Enable and configure alarms.\n   */\n  monitoringConfiguration: Alarms | NoMonitoring;\n  /**\n   * EC2 instance type. Note, ensure your code is built for the same\n   * architecture family (arm64 - 'Graviton' instances - or x64).\n   */\n  instanceType: InstanceType;\n  /**\n   * Enable and configures application logs.\n   */\n  applicationLogging?: ApplicationLoggingProps;\n\n  /**\n   * Enable access logging for this load balancer.\n   * Access logs are written to an S3 bucket within your AWS account.\n   * The bucket is created by {@link https://github.com/guardian/aws-account-setup}.\n   * The logs are queryable via the `gucdk_access_logs` Athena database.\n   *\n   * @defaultValue true\n   */\n  withAccessLogging?: boolean;\n\n  /**\n   * Add block devices (additional storage).\n   */\n  blockDevices?: BlockDevice[];\n  /**\n   * Autoscaling group min and max sizes.\n   */\n  scaling: GuAsgCapacity;\n  /**\n   * Specify certificate for the load balancer.\n   */\n  certificateProps?: GuDomainName;\n\n  /**\n   * Configure AMIgo image recipe. This is only necessary if you are using GuCDK to generate your riff-raff.yaml file.\n   */\n  imageRecipe?: string | AmigoProps;\n  /**\n   * Specify the VPC to use.\n   *\n   * @see https://github.com/guardian/aws-account-setup\n   */\n  vpc?: IVpc;\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  privateSubnets?: ISubnet[];\n\n  /**\n   * Specify private subnets if using a non-default VPC or (generally\n   * discouraged) to limit to a subset of the available subnets.\n   */\n  publicSubnets?: ISubnet[];\n\n  /**\n   * Configure Google Auth.\n   */\n  googleAuth?: {\n    /**\n     * Enables Google Auth (via Cognito). **Additional MANUAL steps required -\n     * see below.**\n     *\n     * Limits access to members of the allowed Google groups.\n     *\n     * Note, this does not currently support simultaneous machine access, so\n     * only set to true if you only require staff access to your service, or are\n     * supporting machine access in some other way.\n     *\n     * MANUAL STEPS: to get this to work, we need a Google Project and\n     * associated credentials. Full instructions can be found here:\n     *\n     * https://docs.google.com/document/d/1_k1FSE52AZHXufWLTiKTI3xy5cGpziyHazSHTKrYfco/edit?usp=sharing\n     *\n     * DevX hope to automate this process in the near future.\n     */\n    enabled: true;\n    /**\n     * The domain users will access your service.\n     *\n     * Set this to the same as for certificateProps.\n     */\n    domain: string;\n    /**\n     * Groups used for membership checks.\n     *\n     * If specified, cannot be empty. Users must be a member of at least one\n     * group to gain access.\n     *\n     * WARNING: groups must be specified with the `guardian.co.uk` domain, even\n     * if that is the non-idiomatic choice for daily use.\n     *\n     * @defaultValue [`engineering@guardian.co.uk`]\n     */\n    allowedGroups?: string[];\n    /**\n     * The number of minutes before the session expires.\n     *\n     * Set this value to a safe period of time that revoked users\n     * sessions will continue to function.\n     *\n     * NOTE: This value cannot be larger than 60 minutes.\n     *\n     * @defaultValue 15\n     */\n    sessionTimeoutInMinutes?: number;\n    /**\n     * Secrets Manager path containing Google OAuth2 Client credentials.\n     *\n     * NOTE: you do not need to set this value, but you DO need to generate and\n     * store the associated credentials in Secrets Manager.\n     *\n     * Credentials should be stored in Secrets Manager as JSON:\n     *\n     * ```json\n     * {\n     *   \"clientId\": \"my-client-id\",\n     *   \"clientSecret\": \"my-client-secret\"\n     * }\n     * ```\n     *\n     * @see `googleAuth.enabled` for how to generate.\n     *\n     * @defaultValue /:STAGE/:stack/:app/google-auth-credentials\n     */\n    credentialsSecretsManagerPath?: string;\n\n    /**\n     * When using Auth in the ALB, which stage of cognito-lambda to use.\n     *\n     * For most applications this should always be PROD, even in the CODE environments.\n     *\n     * @defaultValue PROD\n     */\n    cognitoAuthStage?: string;\n  };\n\n  /**\n   * Specify custom healthcheck\n   */\n  healthcheck?: ALBHealthCheck;\n\n  /**\n   * Set http put response hop limit for the launch template.\n   * It can be necessary to raise this value from the default of 1\n   * for example when sharing the instance profile with a docker container running on the instance.\n   */\n  instanceMetadataHopLimit?: number;\n\n  /**\n   * Specify an update policy for the ASG created by this pattern.\n   *\n   * @see https://docs.aws.amazon.com/cdk/api/latest/docs/aws-autoscaling-readme.html#update-policy\n   *\n   * @defaultValue UpdatePolicy.none() - Cloudformation does not attempt to rotate instances in the ASG\n   * and must rely on riffraff to do so.\n   */\n  updatePolicy?: UpdatePolicy;\n\n  /**\n   * You can specify how long after an instance reaches the InService state it waits before contributing\n   * usage data to the aggregated metrics. This specified time is called the default instance warmup.\n   * This keeps dynamic scaling from being affected by metrics for individual instances that aren't yet\n   * handling application traffic and that might be experiencing temporarily high usage of compute resources.\n   *\n   * @see https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-default-instance-warmup.html\n   */\n  defaultInstanceWarmup?: Duration;\n\n  /**\n   * You can specify if the arn of this load balancer should be exposed for protection via WAF\n   *\n   * If this value changes, it is only picked up on WAF configuration redeploy.\n   *\n   * NB this parameter setting _alone_ is not sufficient to protect the application.\n   * You must also ensure that the application and stage combination is present in the WAF\n   * configuration.\n   *\n   * See https://github.com/guardian/waf/tree/main/lib\n   *\n   * There is a \"gotcha\" when migrating to this functionality.  You may not change only the Logical\n   * ID of an SSM Parameter (see https://docs.aws.amazon.com/cdk/v2/guide/identifiers.html) and the\n   * parameter name must be of the required form, meaning you cannot have an alternate name.\n   *\n   * You can either:\n   *\n   * Remove the old param and immediately redeploy with the new param (this does not affect\n   * protection unless and until the WAF configuration is redeployed)\n   *\n   *   OR\n   *\n   * Create an escape hatch by overriding the logical id (see \"ssm param escape hatch\" test for example)\n   **/\n  waf?: WafProps;\n\n  /**\n   * How often to send EC2 metrics, such as CPU usage.\n   * By default, AWS will produce `5Minute` granular metrics.\n   *\n   * It is recommended to produce `1Minute` granular metrics in production,\n   * especially when using ASG metrics to trigger horizontal scaling as it allows for earlier scaling.\n   *\n   * @see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/viewing_metrics_with_cloudwatch.html\n   */\n  instanceMetricGranularity: \"1Minute\" | \"5Minute\";\n}\n\n/**\n * Use this to allow specific CIDR ranges to access a load balancer over HTTPS\n */\nexport function restrictedCidrRanges(ranges: IPeer[]) {\n  return ranges.map((range) => ({\n    range,\n    port: Port.tcp(443),\n    description: `Allow access on port 443 from ${range.uniqueId}`,\n  }));\n}\n\n/**\n * Pattern which creates the resources needed to run an application on EC2\n * behind a load balancer. For convenience, you may wish to use [[`GuPlayApp`]]\n * or [[`GuNodeApp`]], which extend this class.\n *\n * See props for further details.\n */\nexport class GuEc2App extends Construct {\n  /*\n   * These are public for now, as this allows users to\n   * modify these constructs as desired to fit their\n   * specific needs.\n   * In the future, we might build functionality to better enable users\n   * to access in-pattern constructs, but this would allow teams to be unblocked\n   * in the short term.\n   * */\n  public readonly vpc: IVpc;\n  public readonly certificate?: GuCertificate;\n  public readonly loadBalancer: GuApplicationLoadBalancer;\n  public readonly autoScalingGroup: GuAutoScalingGroup;\n  public readonly listener: GuHttpsApplicationListener;\n  public readonly targetGroup: GuApplicationTargetGroup;\n\n  constructor(scope: GuStack, props: GuEc2AppProps) {\n    const {\n      access,\n      withAccessLogging = true,\n      app,\n      // We should update this default once a significant number of apps have migrated to devx-logs\n      applicationLogging = { enabled: false },\n      applicationPort,\n      blockDevices,\n      certificateProps,\n      instanceType,\n      monitoringConfiguration,\n      additionalPolicies = [],\n      scaling: { minimumInstances, maximumInstances = minimumInstances * 2 },\n      userData: userDataLike,\n      imageRecipe,\n      vpc = GuVpc.fromIdParameter(scope, AppIdentity.suffixText({ app }, \"VPC\")),\n      privateSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PRIVATE, app }),\n      publicSubnets = GuVpc.subnetsFromParameter(scope, { type: SubnetType.PUBLIC, app }),\n      instanceMetadataHopLimit,\n      updatePolicy,\n      defaultInstanceWarmup,\n      instanceMetricGranularity,\n      waf,\n    } = props;\n\n    super(scope, app); // The assumption is `app` is unique\n\n    const userData = userDataLike instanceof UserData ? userDataLike : new GuUserData(scope, { ...userDataLike, app });\n\n    AppAccess.validate(access);\n\n    const certificate =\n      typeof certificateProps !== \"undefined\"\n        ? new GuCertificate(scope, {\n            app,\n            domainName: certificateProps.domainName,\n            hostedZoneId: certificateProps.hostedZoneId,\n          })\n        : undefined;\n\n    const maybePrivateConfigPolicy =\n      userData instanceof GuUserData && userData.configuration\n        ? [new GuGetPrivateConfigPolicy(scope, \"GetPrivateConfigFromS3Policy\", userData.configuration)]\n        : [];\n\n    const mergedRoleConfiguration: GuInstanceRoleProps = {\n      additionalPolicies: maybePrivateConfigPolicy.concat(additionalPolicies),\n    };\n\n    const autoScalingGroup = new GuAutoScalingGroup(scope, \"AutoScalingGroup\", {\n      app,\n      vpc,\n      instanceType,\n      minimumInstances,\n      maximumInstances,\n      role: new GuInstanceRole(scope, { app, ...mergedRoleConfiguration }),\n\n      // TODO should this be defaulted at pattern or construct level?\n      healthChecks: HealthChecks.withAdditionalChecks({\n        additionalTypes: [AdditionalHealthCheckType.ELB],\n        gracePeriod: Duration.minutes(2),\n      }),\n\n      userData: userData instanceof GuUserData ? userData.userData : userData,\n      vpcSubnets: { subnets: privateSubnets },\n      ...(blockDevices && { blockDevices }),\n      imageRecipe,\n      httpPutResponseHopLimit: instanceMetadataHopLimit,\n      updatePolicy,\n      defaultInstanceWarmup,\n      instanceMetricGranularity,\n    });\n\n    // This allows automatic shipping of instance Cloud Init logs when using the\n    // `cdk-base` Amigo role on your AMI.\n    Tags.of(autoScalingGroup).add(\n      MetadataKeys.LOG_KINESIS_STREAM_NAME,\n      GuLoggingStreamNameParameter.getInstance(scope).valueAsString,\n    );\n\n    if (applicationLogging.enabled) {\n      // This allows automatic shipping of application logs when using the\n      // `cdk-base` Amigo role on your AMI.\n      Tags.of(autoScalingGroup).add(\n        MetadataKeys.SYSTEMD_UNIT,\n        applicationLogging.systemdUnitName ? `${applicationLogging.systemdUnitName}.service` : `${app}.service`,\n      );\n    }\n\n    const loadBalancer = new GuApplicationLoadBalancer(scope, \"LoadBalancer\", {\n      app,\n      vpc,\n      // Setting internetFacing to true does not necessarily allow public access to the load balancer itself. That is handled by the listener's `open` prop.\n      internetFacing: access.scope !== AccessScope.INTERNAL,\n      vpcSubnets: {\n        subnets: access.scope === AccessScope.INTERNAL ? privateSubnets : publicSubnets,\n      },\n      withAccessLogging,\n      waf,\n    });\n\n    const targetGroup = new GuApplicationTargetGroup(scope, \"TargetGroup\", {\n      app,\n      vpc,\n      protocol: ApplicationProtocol.HTTP,\n      targets: [autoScalingGroup],\n      port: applicationPort,\n      healthCheck: props.healthcheck,\n    });\n\n    const listener = new GuHttpsApplicationListener(scope, \"Listener\", {\n      app,\n      loadBalancer,\n      certificate,\n      targetGroup,\n      // When open=true, AWS will create a security group which allows all inbound traffic over HTTPS\n      open: access.scope === AccessScope.PUBLIC && typeof certificate !== \"undefined\",\n    });\n\n    // Since AWS won't create a security group automatically when open=false, we need to add our own\n    if (access.scope !== AccessScope.PUBLIC) {\n      loadBalancer.addSecurityGroup(\n        new GuSecurityGroup(scope, `${access.scope}IngressSecurityGroup`, {\n          app,\n          vpc,\n          description: \"Allow restricted ingress from CIDR ranges\",\n          allowAllOutbound: false,\n          ingresses: restrictedCidrRanges(access.cidrRanges),\n        }),\n      );\n    }\n\n    if (!monitoringConfiguration.noMonitoring) {\n      const { http5xxAlarm, http4xxAlarm, snsTopicName, unhealthyInstancesAlarm } = monitoringConfiguration;\n\n      if (http4xxAlarm) {\n        new GuAlb4xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http4xxAlarm,\n        });\n      }\n      if (http5xxAlarm) {\n        new GuAlb5xxPercentageAlarm(scope, {\n          app,\n          loadBalancer,\n          snsTopicName,\n          ...http5xxAlarm,\n        });\n      }\n      if (unhealthyInstancesAlarm) {\n        new GuUnhealthyInstancesAlarm(scope, {\n          app,\n          targetGroup,\n          snsTopicName,\n        });\n      }\n    }\n\n    if (props.googleAuth?.enabled) {\n      const prefix = `/${scope.stage}/${scope.stack}/${app}`;\n\n      const {\n        allowedGroups = [\"engineering@guardian.co.uk\"],\n        sessionTimeoutInMinutes = 15,\n        credentialsSecretsManagerPath = `${prefix}/google-auth-credentials`,\n      } = props.googleAuth;\n\n      if (sessionTimeoutInMinutes > 60) {\n        throw new Error(\"googleAuth.sessionTimeoutInMinutes must be <= 60!\");\n      }\n\n      if (allowedGroups.length < 1) {\n        throw new Error(\"googleAuth.allowedGroups cannot be empty!\");\n      }\n\n      if (allowedGroups.find((group) => !group.endsWith(\"@guardian.co.uk\"))) {\n        throw new Error(\"googleAuth.allowedGroups must use the @guardian.co.uk domain.\");\n      }\n\n      const deployToolsAccountId = StringParameter.fromStringParameterName(\n        scope,\n        \"deploy-tools-account-id-parameter\",\n        NAMED_SSM_PARAMETER_PATHS.DeployToolsAccountId.path,\n      );\n\n      const cognitoAuthStage = props.googleAuth.cognitoAuthStage ?? \"PROD\";\n\n      // See https://github.com/guardian/cognito-auth-lambdas for the source\n      // code here. ARN format is:\n      // arn:aws:lambda:aws-region:acct-id:function:helloworld.\n      const gatekeeperFunctionArn = `arn:aws:lambda:eu-west-1:${deployToolsAccountId.stringValue}:function:deploy-${cognitoAuthStage}-gatekeeper-lambda`;\n\n      // Note, handler and filename must match here:\n      // https://github.com/guardian/cognito-auth-lambdas.\n      const authLambda = new GuLambdaFunction(scope, \"auth-lambda\", {\n        app: app,\n        memorySize: 128,\n        handler: \"bootstrap\",\n        runtime: Runtime.PROVIDED_AL2023,\n        fileName: `deploy/${cognitoAuthStage}/cognito-lambda/devx-cognito-lambda-amd64-v2.zip`,\n        withoutFilePrefix: true,\n        withoutArtifactUpload: true,\n        bucketNamePath: NAMED_SSM_PARAMETER_PATHS.OrganisationDistributionBucket.path,\n        architecture: Architecture.X86_64,\n        environment: {\n          ALLOWED_GROUPS: allowedGroups.join(\",\"),\n          GATEKEEPER_FUNCTION_ARN: gatekeeperFunctionArn,\n        },\n      });\n\n      Tags.of(authLambda).add(\"Owner\", \"DevX\");\n\n      authLambda.addToRolePolicy(\n        new PolicyStatement({\n          effect: Effect.ALLOW,\n          actions: [\"lambda:InvokeFunction\"],\n          resources: [gatekeeperFunctionArn],\n        }),\n      );\n\n      // Cognito user pool. We require both lambdas: pre-sign-up runs the first\n      // time a user attempts to authenticate (before they exist in the User\n      // Pool); pre-auth runs in subsequent authentication flows.\n      const userPool = new UserPool(this, \"user-pool\", {\n        lambdaTriggers: {\n          preAuthentication: authLambda,\n          preSignUp: authLambda,\n        },\n      });\n\n      // These help ensure domain is deterministic but also unique. Key\n      // assumption is that app/stack/stage combo are unique within Guardian.\n      const domainPrefix = `com-gu-${app.toLowerCase()}-${scope.stage.toLowerCase()}`;\n\n      const userPoolDomain = userPool.addDomain(\"domain\", {\n        cognitoDomain: {\n          domainPrefix: getUserPoolDomainPrefix(domainPrefix),\n        },\n      });\n\n      const clientId = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientId\" });\n      const clientSecret = SecretValue.secretsManager(credentialsSecretsManagerPath, { jsonField: \"clientSecret\" });\n\n      const userPoolIdp = new UserPoolIdentityProviderGoogle(scope, \"google-idp\", {\n        userPool: userPool,\n        clientId: clientId.toString(),\n        clientSecretValue: clientSecret,\n        attributeMapping: {\n          email: ProviderAttribute.GOOGLE_EMAIL,\n          givenName: ProviderAttribute.GOOGLE_GIVEN_NAME,\n          familyName: ProviderAttribute.GOOGLE_FAMILY_NAME,\n          profilePicture: ProviderAttribute.GOOGLE_PICTURE,\n          custom: {\n            name: ProviderAttribute.GOOGLE_NAME,\n          },\n        },\n        scopes: [\"openid\", \"email\", \"profile\"],\n      });\n\n      const userPoolClient = userPool.addClient(\"alb-client\", {\n        supportedIdentityProviders: [UserPoolClientIdentityProvider.GOOGLE],\n        generateSecret: true,\n        oAuth: {\n          callbackUrls: [`https://${props.googleAuth.domain}/oauth2/idpresponse`],\n        },\n\n        // Note: id and access validity token validity cannot be less than one\n        // hour (this is the cognito cookie duration). To quickly invalidate\n        // credentials, disable the user in Cognito. It might be that we want to\n        // parameterise these going forward, but that would require Infosec\n        // discussion.\n        idTokenValidity: Duration.hours(1),\n        accessTokenValidity: Duration.hours(1),\n        refreshTokenValidity: Duration.days(7),\n      });\n\n      userPoolClient.node.addDependency(userPoolIdp);\n\n      listener.addAction(\"CognitoAuth\", {\n        action: new AuthenticateCognitoAction({\n          userPool: userPool,\n          userPoolClient: userPoolClient,\n          userPoolDomain: userPoolDomain,\n          next: ListenerAction.forward([targetGroup]),\n          sessionTimeout: Duration.minutes(sessionTimeoutInMinutes),\n        }),\n      });\n\n      // Need to give the ALB outbound access on 443 for the IdP endpoints.\n      const idpEgressSecurityGroup = new GuHttpsEgressSecurityGroup(scope, \"ldp-access\", {\n        app,\n        vpc,\n      });\n\n      loadBalancer.addSecurityGroup(idpEgressSecurityGroup);\n    }\n\n    this.vpc = vpc;\n    this.certificate = certificate;\n    this.loadBalancer = loadBalancer;\n    this.autoScalingGroup = autoScalingGroup;\n    this.listener = listener;\n    this.targetGroup = targetGroup;\n  }\n}\n"]}

package/lib/riff-raff-yaml-file/deployments/autoscaling.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.autoscalingDeployment = exports.uploadAutoscalingArtifact = void 0;
+exports.uploadAutoscalingArtifact = uploadAutoscalingArtifact;
+exports.autoscalingDeployment = autoscalingDeployment;
 function uploadAutoscalingArtifact(asg) {
     const { app } = asg;
     const { stack, region } = asg.stack;
@@ -20,7 +21,6 @@ function uploadAutoscalingArtifact(asg) {
         },
     };
 }
-exports.uploadAutoscalingArtifact = uploadAutoscalingArtifact;
 function autoscalingDeployment(asg, { name: cfnDeployName }) {
     const { app } = asg;
     const { stack, region } = asg.stack;
@@ -41,5 +41,4 @@ function autoscalingDeployment(asg, { name: cfnDeployName }) {
         },
     };
 }
-exports.autoscalingDeployment = autoscalingDeployment;
 //# sourceMappingURL=autoscaling.js.map

package/lib/riff-raff-yaml-file/deployments/autoscaling.js.map

@@ -1 +1 @@
-{"version":3,"file":"autoscaling.js","sourceRoot":"","sources":["../../../src/riff-raff-yaml-file/deployments/autoscaling.ts"],"names":[],"mappings":";;;AAIA,SAAgB,yBAAyB,CAAC,GAAuB;IAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;IACpB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAgB,CAAC;IAE/C,OAAO;QACL,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAClD,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,CAAC,iBAAiB,CAAC;YAC5B,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YACxB,GAAG;YACH,UAAU,EAAE;gBACV,eAAe,EAAE,IAAI;gBACrB,SAAS,EAAE,IAAI;aAChB;YACD,gBAAgB,EAAE,GAAG;SACtB;KACF,CAAC;AACJ,CAAC;AAnBD,8DAmBC;AAED,SAAgB,qBAAqB,CACnC,GAAuB,EACvB,EAAE,IAAI,EAAE,aAAa,EAAsB;IAE3C,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;IACpB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAgB,CAAC;IAE/C,OAAO;QACL,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAClD,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,CAAC,QAAQ,CAAC;YACnB,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YACxB,GAAG;YACH,UAAU,EAAE;gBACV,eAAe,EAAE,IAAI;gBACrB,SAAS,EAAE,IAAI;aAChB;YACD,YAAY,EAAE,CAAC,aAAa,CAAC;YAC7B,gBAAgB,EAAE,GAAG;SACtB;KACF,CAAC;AACJ,CAAC;AAvBD,sDAuBC","sourcesContent":["import type { GuAutoScalingGroup } from \"../../constructs/autoscaling\";\nimport type { GuStack } from \"../../constructs/core\";\nimport type { RiffRaffDeployment } from \"../types\";\n\nexport function uploadAutoscalingArtifact(asg: GuAutoScalingGroup): RiffRaffDeployment {\n  const { app } = asg;\n  const { stack, region } = asg.stack as GuStack;\n\n  return {\n    name: [\"asg-upload\", region, stack, app].join(\"-\"),\n    props: {\n      type: \"autoscaling\",\n      actions: [\"uploadArtifacts\"],\n      regions: new Set([region]),\n      stacks: new Set([stack]),\n      app,\n      parameters: {\n        bucketSsmLookup: true,\n        prefixApp: true,\n      },\n      contentDirectory: app,\n    },\n  };\n}\n\nexport function autoscalingDeployment(\n  asg: GuAutoScalingGroup,\n  { name: cfnDeployName }: RiffRaffDeployment,\n): RiffRaffDeployment {\n  const { app } = asg;\n  const { stack, region } = asg.stack as GuStack;\n\n  return {\n    name: [\"asg-update\", region, stack, app].join(\"-\"),\n    props: {\n      type: \"autoscaling\",\n      actions: [\"deploy\"],\n      regions: new Set([region]),\n      stacks: new Set([stack]),\n      app,\n      parameters: {\n        bucketSsmLookup: true,\n        prefixApp: true,\n      },\n      dependencies: [cfnDeployName],\n      contentDirectory: app,\n    },\n  };\n}\n"]}
+{"version":3,"file":"autoscaling.js","sourceRoot":"","sources":["../../../src/riff-raff-yaml-file/deployments/autoscaling.ts"],"names":[],"mappings":";;AAIA,8DAmBC;AAED,sDAuBC;AA5CD,SAAgB,yBAAyB,CAAC,GAAuB;IAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;IACpB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAgB,CAAC;IAE/C,OAAO;QACL,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAClD,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,CAAC,iBAAiB,CAAC;YAC5B,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YACxB,GAAG;YACH,UAAU,EAAE;gBACV,eAAe,EAAE,IAAI;gBACrB,SAAS,EAAE,IAAI;aAChB;YACD,gBAAgB,EAAE,GAAG;SACtB;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CACnC,GAAuB,EACvB,EAAE,IAAI,EAAE,aAAa,EAAsB;IAE3C,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;IACpB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAgB,CAAC;IAE/C,OAAO;QACL,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAClD,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,CAAC,QAAQ,CAAC;YACnB,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YACxB,GAAG;YACH,UAAU,EAAE;gBACV,eAAe,EAAE,IAAI;gBACrB,SAAS,EAAE,IAAI;aAChB;YACD,YAAY,EAAE,CAAC,aAAa,CAAC;YAC7B,gBAAgB,EAAE,GAAG;SACtB;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { GuAutoScalingGroup } from \"../../constructs/autoscaling\";\nimport type { GuStack } from \"../../constructs/core\";\nimport type { RiffRaffDeployment } from \"../types\";\n\nexport function uploadAutoscalingArtifact(asg: GuAutoScalingGroup): RiffRaffDeployment {\n  const { app } = asg;\n  const { stack, region } = asg.stack as GuStack;\n\n  return {\n    name: [\"asg-upload\", region, stack, app].join(\"-\"),\n    props: {\n      type: \"autoscaling\",\n      actions: [\"uploadArtifacts\"],\n      regions: new Set([region]),\n      stacks: new Set([stack]),\n      app,\n      parameters: {\n        bucketSsmLookup: true,\n        prefixApp: true,\n      },\n      contentDirectory: app,\n    },\n  };\n}\n\nexport function autoscalingDeployment(\n  asg: GuAutoScalingGroup,\n  { name: cfnDeployName }: RiffRaffDeployment,\n): RiffRaffDeployment {\n  const { app } = asg;\n  const { stack, region } = asg.stack as GuStack;\n\n  return {\n    name: [\"asg-update\", region, stack, app].join(\"-\"),\n    props: {\n      type: \"autoscaling\",\n      actions: [\"deploy\"],\n      regions: new Set([region]),\n      stacks: new Set([stack]),\n      app,\n      parameters: {\n        bucketSsmLookup: true,\n        prefixApp: true,\n      },\n      dependencies: [cfnDeployName],\n      contentDirectory: app,\n    },\n  };\n}\n"]}

package/lib/riff-raff-yaml-file/deployments/cloudformation.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getMinInstancesInServiceParameters = exports.getAmiParameters = exports.cloudFormationDeployment = void 0;
+exports.cloudFormationDeployment = cloudFormationDeployment;
+exports.getAmiParameters = getAmiParameters;
+exports.getMinInstancesInServiceParameters = getMinInstancesInServiceParameters;
 const string_1 = require("../../utils/string");
 function cloudFormationDeployment(cdkStacks, dependencies, contentDirectory) {
     // The stacks in `cdkStacks` only differ by stage, so we can just use the first item in the list for key information.
@@ -30,7 +32,6 @@ function cloudFormationDeployment(cdkStacks, dependencies, contentDirectory) {
         },
     };
 }
-exports.cloudFormationDeployment = cloudFormationDeployment;
 function getAmiParameters(autoScalingGroups) {
     return autoScalingGroups.reduce((acc, asg) => {
         const { imageRecipe, app, amiParameter } = asg;
@@ -52,7 +53,6 @@ function getAmiParameters(autoScalingGroups) {
         };
     }, {});
 }
-exports.getAmiParameters = getAmiParameters;
 function getMinInstancesInServiceParameters(cfnParameters) {
     const response = {};
     cfnParameters.forEach((cfnParam, cfnParamName) => {
@@ -61,5 +61,4 @@ function getMinInstancesInServiceParameters(cfnParameters) {
     });
     return response;
 }
-exports.getMinInstancesInServiceParameters = getMinInstancesInServiceParameters;
 //# sourceMappingURL=cloudformation.js.map

package/lib/riff-raff-yaml-file/deployments/cloudformation.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloudformation.js","sourceRoot":"","sources":["../../../src/riff-raff-yaml-file/deployments/cloudformation.ts"],"names":[],"mappings":";;;AAEA,+CAAiD;AAGjD,SAAgB,wBAAwB,CACtC,SAAwC,EACxC,YAAkC,EAClC,gBAAwB;IAExB,qHAAqH;IACrH,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAE7B,IAAI,CAAC,QAAQ,EAAE;QACb,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;KAC1F;IAED,MAAM,EACJ,MAAM,EACN,KAAK,EACL,WAAW,EAAE,EAAE,IAAI,EAAE,GACtB,GAAG,QAAQ,CAAC;IAEb,MAAM,cAAc,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IAEzC,MAAM,kBAAkB,GAAG,SAAS,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,GAAG,GAAG;QACN,CAAC,KAAK,CAAC,EAAE,YAAY;KACtB,CAAC,EACF,EAAE,CACH,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACtD,KAAK,EAAE;YACL,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YACxB,GAAG,EAAE,cAAc;YACnB,gBAAgB;YAChB,UAAU,EAAE;gBACV,kBAAkB;aACnB;YACD,yDAAyD;YACzD,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;SACvF;KACF,CAAC;AACJ,CAAC;AA3CD,4DA2CC;AAED,SAAgB,gBAAgB,CAAC,iBAAuC;IACtE,OAAO,iBAAiB,CAAC,MAAM,CAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC;QAE/C,IAAI,CAAC,WAAW,EAAE;YAChB,MAAM,IAAI,KAAK,CAAC,iFAAiF,GAAG,EAAE,CAAC,CAAC;SACzG;QAED,MAAM,MAAM,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;QAClF,MAAM,UAAU,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC;QAEjG,wGAAwG;QACxG,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAExG,OAAO;YACL,GAAG,GAAG;YACN,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;gBACtB,OAAO,EAAE,OAAO;gBAChB,UAAU;gBACV,MAAM;gBACN,SAAS;aACV;SACF,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC;AAxBD,4CAwBC;AAED,SAAgB,kCAAkC,CAChD,aAA2E;IAE3E,MAAM,QAAQ,GAAiC,EAAE,CAAC;IAElD,aAAa,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAC7B,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAXD,gFAWC","sourcesContent":["import type { GuAutoScalingGroup } from \"../../constructs/autoscaling\";\nimport type { GuAsgMinInstancesInServiceParameterExperimental } from \"../../experimental/patterns/ec2-app\";\nimport { toKebabCase } from \"../../utils/string\";\nimport type { CdkStacksDifferingOnlyByStage, RiffRaffDeployment, RiffRaffDeploymentParameters } from \"../types\";\n\nexport function cloudFormationDeployment(\n  cdkStacks: CdkStacksDifferingOnlyByStage,\n  dependencies: RiffRaffDeployment[],\n  contentDirectory: string,\n): RiffRaffDeployment {\n  // The stacks in `cdkStacks` only differ by stage, so we can just use the first item in the list for key information.\n  const [cdkStack] = cdkStacks;\n\n  if (!cdkStack) {\n    throw new Error(\"Unable to produce a working riff-raff.yaml file; there are no stacks!\");\n  }\n\n  const {\n    region,\n    stack,\n    constructor: { name },\n  } = cdkStack;\n\n  const kebabClassName = toKebabCase(name);\n\n  const templateStagePaths = cdkStacks.reduce(\n    (acc, { stage, templateFile }) => ({\n      ...acc,\n      [stage]: templateFile,\n    }),\n    {},\n  );\n\n  return {\n    name: [\"cfn\", region, stack, kebabClassName].join(\"-\"),\n    props: {\n      type: \"cloud-formation\",\n      regions: new Set([region]),\n      stacks: new Set([stack]),\n      app: kebabClassName,\n      contentDirectory,\n      parameters: {\n        templateStagePaths,\n      },\n      // only add the `dependencies` property if there are some\n      ...(dependencies.length > 0 && { dependencies: dependencies.map(({ name }) => name) }),\n    },\n  };\n}\n\nexport function getAmiParameters(autoScalingGroups: GuAutoScalingGroup[]): RiffRaffDeploymentParameters {\n  return autoScalingGroups.reduce<RiffRaffDeploymentParameters>((acc, asg) => {\n    const { imageRecipe, app, amiParameter } = asg;\n\n    if (!imageRecipe) {\n      throw new Error(`Unable to produce a working riff-raff.yaml file; imageRecipe missing from ASG ${app}`);\n    }\n\n    const Recipe = typeof imageRecipe === \"string\" ? imageRecipe : imageRecipe.Recipe;\n    const AmigoStage = typeof imageRecipe === \"string\" ? \"PROD\" : (imageRecipe.AmigoStage ?? \"PROD\");\n\n    // In YAML `true` is a Boolean. Riff-Raff expects a String here, so call `toString` to make it `'true'`.\n    const Encrypted = (typeof imageRecipe === \"string\" ? true : (imageRecipe.Encrypted ?? true)).toString();\n\n    return {\n      ...acc,\n      [amiParameter.node.id]: {\n        BuiltBy: \"amigo\",\n        AmigoStage,\n        Recipe,\n        Encrypted,\n      },\n    };\n  }, {});\n}\n\nexport function getMinInstancesInServiceParameters(\n  cfnParameters: Map<string, GuAsgMinInstancesInServiceParameterExperimental>,\n): RiffRaffDeploymentParameters {\n  const response: RiffRaffDeploymentParameters = {};\n\n  cfnParameters.forEach((cfnParam, cfnParamName) => {\n    const app = cfnParam.asg.app;\n    response[cfnParamName] = { App: app };\n  });\n\n  return response;\n}\n"]}
+{"version":3,"file":"cloudformation.js","sourceRoot":"","sources":["../../../src/riff-raff-yaml-file/deployments/cloudformation.ts"],"names":[],"mappings":";;AAKA,4DA2CC;AAED,4CAwBC;AAED,gFAWC;AArFD,+CAAiD;AAGjD,SAAgB,wBAAwB,CACtC,SAAwC,EACxC,YAAkC,EAClC,gBAAwB;IAExB,qHAAqH;IACrH,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAE7B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,EACJ,MAAM,EACN,KAAK,EACL,WAAW,EAAE,EAAE,IAAI,EAAE,GACtB,GAAG,QAAQ,CAAC;IAEb,MAAM,cAAc,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IAEzC,MAAM,kBAAkB,GAAG,SAAS,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,GAAG,GAAG;QACN,CAAC,KAAK,CAAC,EAAE,YAAY;KACtB,CAAC,EACF,EAAE,CACH,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACtD,KAAK,EAAE;YACL,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YACxB,GAAG,EAAE,cAAc;YACnB,gBAAgB;YAChB,UAAU,EAAE;gBACV,kBAAkB;aACnB;YACD,yDAAyD;YACzD,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;SACvF;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,iBAAuC;IACtE,OAAO,iBAAiB,CAAC,MAAM,CAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC;QAE/C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iFAAiF,GAAG,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;QAClF,MAAM,UAAU,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC;QAEjG,wGAAwG;QACxG,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAExG,OAAO;YACL,GAAG,GAAG;YACN,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;gBACtB,OAAO,EAAE,OAAO;gBAChB,UAAU;gBACV,MAAM;gBACN,SAAS;aACV;SACF,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC;AAED,SAAgB,kCAAkC,CAChD,aAA2E;IAE3E,MAAM,QAAQ,GAAiC,EAAE,CAAC;IAElD,aAAa,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAC7B,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import type { GuAutoScalingGroup } from \"../../constructs/autoscaling\";\nimport type { GuAsgMinInstancesInServiceParameterExperimental } from \"../../experimental/patterns/ec2-app\";\nimport { toKebabCase } from \"../../utils/string\";\nimport type { CdkStacksDifferingOnlyByStage, RiffRaffDeployment, RiffRaffDeploymentParameters } from \"../types\";\n\nexport function cloudFormationDeployment(\n  cdkStacks: CdkStacksDifferingOnlyByStage,\n  dependencies: RiffRaffDeployment[],\n  contentDirectory: string,\n): RiffRaffDeployment {\n  // The stacks in `cdkStacks` only differ by stage, so we can just use the first item in the list for key information.\n  const [cdkStack] = cdkStacks;\n\n  if (!cdkStack) {\n    throw new Error(\"Unable to produce a working riff-raff.yaml file; there are no stacks!\");\n  }\n\n  const {\n    region,\n    stack,\n    constructor: { name },\n  } = cdkStack;\n\n  const kebabClassName = toKebabCase(name);\n\n  const templateStagePaths = cdkStacks.reduce(\n    (acc, { stage, templateFile }) => ({\n      ...acc,\n      [stage]: templateFile,\n    }),\n    {},\n  );\n\n  return {\n    name: [\"cfn\", region, stack, kebabClassName].join(\"-\"),\n    props: {\n      type: \"cloud-formation\",\n      regions: new Set([region]),\n      stacks: new Set([stack]),\n      app: kebabClassName,\n      contentDirectory,\n      parameters: {\n        templateStagePaths,\n      },\n      // only add the `dependencies` property if there are some\n      ...(dependencies.length > 0 && { dependencies: dependencies.map(({ name }) => name) }),\n    },\n  };\n}\n\nexport function getAmiParameters(autoScalingGroups: GuAutoScalingGroup[]): RiffRaffDeploymentParameters {\n  return autoScalingGroups.reduce<RiffRaffDeploymentParameters>((acc, asg) => {\n    const { imageRecipe, app, amiParameter } = asg;\n\n    if (!imageRecipe) {\n      throw new Error(`Unable to produce a working riff-raff.yaml file; imageRecipe missing from ASG ${app}`);\n    }\n\n    const Recipe = typeof imageRecipe === \"string\" ? imageRecipe : imageRecipe.Recipe;\n    const AmigoStage = typeof imageRecipe === \"string\" ? \"PROD\" : (imageRecipe.AmigoStage ?? \"PROD\");\n\n    // In YAML `true` is a Boolean. Riff-Raff expects a String here, so call `toString` to make it `'true'`.\n    const Encrypted = (typeof imageRecipe === \"string\" ? true : (imageRecipe.Encrypted ?? true)).toString();\n\n    return {\n      ...acc,\n      [amiParameter.node.id]: {\n        BuiltBy: \"amigo\",\n        AmigoStage,\n        Recipe,\n        Encrypted,\n      },\n    };\n  }, {});\n}\n\nexport function getMinInstancesInServiceParameters(\n  cfnParameters: Map<string, GuAsgMinInstancesInServiceParameterExperimental>,\n): RiffRaffDeploymentParameters {\n  const response: RiffRaffDeploymentParameters = {};\n\n  cfnParameters.forEach((cfnParam, cfnParamName) => {\n    const app = cfnParam.asg.app;\n    response[cfnParamName] = { App: app };\n  });\n\n  return response;\n}\n"]}

package/lib/riff-raff-yaml-file/deployments/lambda.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.updateLambdaDeployment = exports.uploadLambdaArtifact = void 0;
+exports.uploadLambdaArtifact = uploadLambdaArtifact;
+exports.updateLambdaDeployment = updateLambdaDeployment;
 const locationProps = (lambda) => {
     const bucketProp = lambda.bucketNamePath === undefined
         ? {
@@ -46,7 +47,6 @@ function uploadLambdaArtifact(lambda) {
         },
     };
 }
-exports.uploadLambdaArtifact = uploadLambdaArtifact;
 function updateLambdaDeployment(lambda, { name: cfnDeployName }) {
     const { app, fileName } = lambda;
     const { stack, region } = lambda.stack;
@@ -68,5 +68,4 @@ function updateLambdaDeployment(lambda, { name: cfnDeployName }) {
         },
     };
 }
-exports.updateLambdaDeployment = updateLambdaDeployment;
 //# sourceMappingURL=lambda.js.map

package/lib/riff-raff-yaml-file/deployments/lambda.js.map

@@ -1 +1 @@
-{"version":3,"file":"lambda.js","sourceRoot":"","sources":["../../../src/riff-raff-yaml-file/deployments/lambda.ts"],"names":[],"mappings":";;;AAYA,MAAM,aAAa,GAAG,CAAC,MAAwB,EAAmB,EAAE;IAClE,MAAM,UAAU,GACd,MAAM,CAAC,cAAc,KAAK,SAAS;QACjC,CAAC,CAAC;YACE,eAAe,EAAE,IAAI;SACtB;QACH,CAAC,CAAC;YACE,YAAY,EAAE,MAAM,CAAC,cAAc;SACpC,CAAC;IAER;;;;OAIG;IACH,MAAM,WAAW,GAAG,MAAM,CAAC,iBAAiB;QAC1C,CAAC,CAAC;YACE,gBAAgB,EAAE,KAAK;YACvB,cAAc,EAAE,KAAK;YACrB,gBAAgB,EAAE,KAAK;SACxB;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,GAAG,UAAU;QACb,GAAG,WAAW;KACf,CAAC;AACJ,CAAC,CAAC;AAEF,SAAgB,oBAAoB,CAAC,MAAwB;IAC3D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACjC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAgB,CAAC;IAElD,OAAO;QACL,IAAI,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACrD,KAAK,EAAE;YACL,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YACxB,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1B,GAAG;YACH,gBAAgB,EAAE,GAAG;YACrB,UAAU,EAAE;gBACV,GAAG,aAAa,CAAC,MAAM,CAAC;gBACxB,YAAY,EAAE,IAAI;gBAClB,QAAQ;aACT;YACD,OAAO,EAAE,CAAC,cAAc,CAAC;SAC1B;KACF,CAAC;AACJ,CAAC;AApBD,oDAoBC;AAED,SAAgB,sBAAsB,CACpC,MAAwB,EACxB,EAAE,IAAI,EAAE,aAAa,EAAsB;IAE3C,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACjC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAgB,CAAC;IAElD,OAAO;QACL,IAAI,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACrD,KAAK,EAAE;YACL,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YACxB,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1B,GAAG;YACH,gBAAgB,EAAE,GAAG;YACrB,UAAU,EAAE;gBACV,GAAG,aAAa,CAAC,MAAM,CAAC;gBACxB,YAAY,EAAE,IAAI;gBAClB,QAAQ;aACT;YACD,OAAO,EAAE,CAAC,cAAc,CAAC;YACzB,YAAY,EAAE,CAAC,aAAa,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAxBD,wDAwBC","sourcesContent":["import type { GuStack } from \"../../constructs/core\";\nimport type { GuLambdaFunction } from \"../../constructs/lambda\";\nimport type { RiffRaffDeployment } from \"../types\";\n\ninterface S3LocationProps {\n  bucketSsmLookup?: boolean;\n  bucketSsmKey?: string;\n  prefixStackToKey?: boolean;\n  prefixAppToKey?: boolean;\n  prefixStageToKey?: boolean;\n}\n\nconst locationProps = (lambda: GuLambdaFunction): S3LocationProps => {\n  const bucketProp =\n    lambda.bucketNamePath === undefined\n      ? {\n          bucketSsmLookup: true,\n        }\n      : {\n          bucketSsmKey: lambda.bucketNamePath,\n        };\n\n  /**\n   * If the lambda has a file prefix, we don't want to prefix the key with the stack, app or stage.\n   * The default value for these properties is `true`, so we don't need to set them explicitly if\n   * we *do* want to add the prefixes (and RiffRaff will complain if we add them).\n   */\n  const prefixProps = lambda.withoutFilePrefix\n    ? {\n        prefixStackToKey: false,\n        prefixAppToKey: false,\n        prefixStageToKey: false,\n      }\n    : {};\n\n  return {\n    ...bucketProp,\n    ...prefixProps,\n  };\n};\n\nexport function uploadLambdaArtifact(lambda: GuLambdaFunction): RiffRaffDeployment {\n  const { app, fileName } = lambda;\n  const { stack, region } = lambda.stack as GuStack;\n\n  return {\n    name: [\"lambda-upload\", region, stack, app].join(\"-\"),\n    props: {\n      type: \"aws-lambda\",\n      stacks: new Set([stack]),\n      regions: new Set([region]),\n      app,\n      contentDirectory: app,\n      parameters: {\n        ...locationProps(lambda),\n        lookupByTags: true,\n        fileName,\n      },\n      actions: [\"uploadLambda\"],\n    },\n  };\n}\n\nexport function updateLambdaDeployment(\n  lambda: GuLambdaFunction,\n  { name: cfnDeployName }: RiffRaffDeployment,\n): RiffRaffDeployment {\n  const { app, fileName } = lambda;\n  const { stack, region } = lambda.stack as GuStack;\n\n  return {\n    name: [\"lambda-update\", region, stack, app].join(\"-\"),\n    props: {\n      type: \"aws-lambda\",\n      stacks: new Set([stack]),\n      regions: new Set([region]),\n      app,\n      contentDirectory: app,\n      parameters: {\n        ...locationProps(lambda),\n        lookupByTags: true,\n        fileName,\n      },\n      actions: [\"updateLambda\"],\n      dependencies: [cfnDeployName],\n    },\n  };\n}\n"]}
+{"version":3,"file":"lambda.js","sourceRoot":"","sources":["../../../src/riff-raff-yaml-file/deployments/lambda.ts"],"names":[],"mappings":";;AAyCA,oDAoBC;AAED,wDAwBC;AA3ED,MAAM,aAAa,GAAG,CAAC,MAAwB,EAAmB,EAAE;IAClE,MAAM,UAAU,GACd,MAAM,CAAC,cAAc,KAAK,SAAS;QACjC,CAAC,CAAC;YACE,eAAe,EAAE,IAAI;SACtB;QACH,CAAC,CAAC;YACE,YAAY,EAAE,MAAM,CAAC,cAAc;SACpC,CAAC;IAER;;;;OAIG;IACH,MAAM,WAAW,GAAG,MAAM,CAAC,iBAAiB;QAC1C,CAAC,CAAC;YACE,gBAAgB,EAAE,KAAK;YACvB,cAAc,EAAE,KAAK;YACrB,gBAAgB,EAAE,KAAK;SACxB;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,GAAG,UAAU;QACb,GAAG,WAAW;KACf,CAAC;AACJ,CAAC,CAAC;AAEF,SAAgB,oBAAoB,CAAC,MAAwB;IAC3D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACjC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAgB,CAAC;IAElD,OAAO;QACL,IAAI,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACrD,KAAK,EAAE;YACL,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YACxB,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1B,GAAG;YACH,gBAAgB,EAAE,GAAG;YACrB,UAAU,EAAE;gBACV,GAAG,aAAa,CAAC,MAAM,CAAC;gBACxB,YAAY,EAAE,IAAI;gBAClB,QAAQ;aACT;YACD,OAAO,EAAE,CAAC,cAAc,CAAC;SAC1B;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CACpC,MAAwB,EACxB,EAAE,IAAI,EAAE,aAAa,EAAsB;IAE3C,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACjC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAgB,CAAC;IAElD,OAAO;QACL,IAAI,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACrD,KAAK,EAAE;YACL,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YACxB,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1B,GAAG;YACH,gBAAgB,EAAE,GAAG;YACrB,UAAU,EAAE;gBACV,GAAG,aAAa,CAAC,MAAM,CAAC;gBACxB,YAAY,EAAE,IAAI;gBAClB,QAAQ;aACT;YACD,OAAO,EAAE,CAAC,cAAc,CAAC;YACzB,YAAY,EAAE,CAAC,aAAa,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { GuStack } from \"../../constructs/core\";\nimport type { GuLambdaFunction } from \"../../constructs/lambda\";\nimport type { RiffRaffDeployment } from \"../types\";\n\ninterface S3LocationProps {\n  bucketSsmLookup?: boolean;\n  bucketSsmKey?: string;\n  prefixStackToKey?: boolean;\n  prefixAppToKey?: boolean;\n  prefixStageToKey?: boolean;\n}\n\nconst locationProps = (lambda: GuLambdaFunction): S3LocationProps => {\n  const bucketProp =\n    lambda.bucketNamePath === undefined\n      ? {\n          bucketSsmLookup: true,\n        }\n      : {\n          bucketSsmKey: lambda.bucketNamePath,\n        };\n\n  /**\n   * If the lambda has a file prefix, we don't want to prefix the key with the stack, app or stage.\n   * The default value for these properties is `true`, so we don't need to set them explicitly if\n   * we *do* want to add the prefixes (and RiffRaff will complain if we add them).\n   */\n  const prefixProps = lambda.withoutFilePrefix\n    ? {\n        prefixStackToKey: false,\n        prefixAppToKey: false,\n        prefixStageToKey: false,\n      }\n    : {};\n\n  return {\n    ...bucketProp,\n    ...prefixProps,\n  };\n};\n\nexport function uploadLambdaArtifact(lambda: GuLambdaFunction): RiffRaffDeployment {\n  const { app, fileName } = lambda;\n  const { stack, region } = lambda.stack as GuStack;\n\n  return {\n    name: [\"lambda-upload\", region, stack, app].join(\"-\"),\n    props: {\n      type: \"aws-lambda\",\n      stacks: new Set([stack]),\n      regions: new Set([region]),\n      app,\n      contentDirectory: app,\n      parameters: {\n        ...locationProps(lambda),\n        lookupByTags: true,\n        fileName,\n      },\n      actions: [\"uploadLambda\"],\n    },\n  };\n}\n\nexport function updateLambdaDeployment(\n  lambda: GuLambdaFunction,\n  { name: cfnDeployName }: RiffRaffDeployment,\n): RiffRaffDeployment {\n  const { app, fileName } = lambda;\n  const { stack, region } = lambda.stack as GuStack;\n\n  return {\n    name: [\"lambda-update\", region, stack, app].join(\"-\"),\n    props: {\n      type: \"aws-lambda\",\n      stacks: new Set([stack]),\n      regions: new Set([region]),\n      app,\n      contentDirectory: app,\n      parameters: {\n        ...locationProps(lambda),\n        lookupByTags: true,\n        fileName,\n      },\n      actions: [\"updateLambda\"],\n      dependencies: [cfnDeployName],\n    },\n  };\n}\n"]}

package/lib/riff-raff-yaml-file/deployments/update-parameters.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.updateDeploymentParameters = void 0;
+exports.updateDeploymentParameters = updateDeploymentParameters;
 function updateDeploymentParameters(allDeployments, deploymentToUpdate, additionalParametersToApply) {
     const currentDeployment = allDeployments.get(deploymentToUpdate.name);
     if (!currentDeployment) {
@@ -14,5 +14,4 @@ function updateDeploymentParameters(allDeployments, deploymentToUpdate, addition
         },
     });
 }
-exports.updateDeploymentParameters = updateDeploymentParameters;
 //# sourceMappingURL=update-parameters.js.map

package/lib/riff-raff-yaml-file/deployments/update-parameters.js.map

@@ -1 +1 @@
-{"version":3,"file":"update-parameters.js","sourceRoot":"","sources":["../../../src/riff-raff-yaml-file/deployments/update-parameters.ts"],"names":[],"mappings":";;;AAEA,SAAgB,0BAA0B,CACxC,cAAmC,EACnC,kBAAsC,EACtC,2BAAyD;IAEzD,MAAM,iBAAiB,GAAG,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,iBAAiB,EAAE;QACtB,MAAM,IAAI,KAAK,CAAC,6BAA6B,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC;KACzE;IAED,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE;QAC1C,GAAG,iBAAiB;QACpB,UAAU,EAAE;YACV,GAAG,iBAAiB,CAAC,UAAU;YAC/B,GAAG,2BAA2B;SAC/B;KACF,CAAC,CAAC;AACL,CAAC;AAjBD,gEAiBC","sourcesContent":["import type { RiffRaffDeployment, RiffRaffDeploymentParameters, RiffRaffDeployments } from \"../types\";\n\nexport function updateDeploymentParameters(\n  allDeployments: RiffRaffDeployments,\n  deploymentToUpdate: RiffRaffDeployment,\n  additionalParametersToApply: RiffRaffDeploymentParameters,\n) {\n  const currentDeployment = allDeployments.get(deploymentToUpdate.name);\n  if (!currentDeployment) {\n    throw new Error(`Unable to find deployment ${deploymentToUpdate.name}`);\n  }\n\n  allDeployments.set(deploymentToUpdate.name, {\n    ...currentDeployment,\n    parameters: {\n      ...currentDeployment.parameters,\n      ...additionalParametersToApply,\n    },\n  });\n}\n"]}
+{"version":3,"file":"update-parameters.js","sourceRoot":"","sources":["../../../src/riff-raff-yaml-file/deployments/update-parameters.ts"],"names":[],"mappings":";;AAEA,gEAiBC;AAjBD,SAAgB,0BAA0B,CACxC,cAAmC,EACnC,kBAAsC,EACtC,2BAAyD;IAEzD,MAAM,iBAAiB,GAAG,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6BAA6B,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE;QAC1C,GAAG,iBAAiB;QACpB,UAAU,EAAE;YACV,GAAG,iBAAiB,CAAC,UAAU;YAC/B,GAAG,2BAA2B;SAC/B;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { RiffRaffDeployment, RiffRaffDeploymentParameters, RiffRaffDeployments } from \"../types\";\n\nexport function updateDeploymentParameters(\n  allDeployments: RiffRaffDeployments,\n  deploymentToUpdate: RiffRaffDeployment,\n  additionalParametersToApply: RiffRaffDeploymentParameters,\n) {\n  const currentDeployment = allDeployments.get(deploymentToUpdate.name);\n  if (!currentDeployment) {\n    throw new Error(`Unable to find deployment ${deploymentToUpdate.name}`);\n  }\n\n  allDeployments.set(deploymentToUpdate.name, {\n    ...currentDeployment,\n    parameters: {\n      ...currentDeployment.parameters,\n      ...additionalParametersToApply,\n    },\n  });\n}\n"]}

package/lib/riff-raff-yaml-file/group-by.js

@@ -1,26 +1,25 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.groupByRiffRaffProjectName = exports.groupByRegion = exports.groupByStageTag = exports.groupByStackTag = exports.groupByClassName = void 0;
+exports.groupByClassName = groupByClassName;
+exports.groupByStackTag = groupByStackTag;
+exports.groupByStageTag = groupByStageTag;
+exports.groupByRegion = groupByRegion;
+exports.groupByRiffRaffProjectName = groupByRiffRaffProjectName;
 const array_1 = require("../utils/array");
 const types_1 = require("./types");
 function groupByClassName(cdkStacks) {
     return (0, array_1.groupBy)(cdkStacks, (stack) => stack.constructor.name);
 }
-exports.groupByClassName = groupByClassName;
 function groupByStackTag(cdkStacks) {
     return (0, array_1.groupBy)(cdkStacks, ({ stack }) => stack);
 }
-exports.groupByStackTag = groupByStackTag;
 function groupByStageTag(cdkStacks) {
     return (0, array_1.groupBy)(cdkStacks, ({ stage }) => stage);
 }
-exports.groupByStageTag = groupByStageTag;
 function groupByRegion(cdkStacks) {
     return (0, array_1.groupBy)(cdkStacks, ({ region }) => region);
 }
-exports.groupByRegion = groupByRegion;
 function groupByRiffRaffProjectName(cdkStacks) {
     return (0, array_1.groupBy)(cdkStacks, (_) => _.riffRaffProjectName ?? types_1.UnknownRiffRaffProjectName);
 }
-exports.groupByRiffRaffProjectName = groupByRiffRaffProjectName;
 //# sourceMappingURL=group-by.js.map

package/lib/riff-raff-yaml-file/group-by.js.map

@@ -1 +1 @@
-{"version":3,"file":"group-by.js","sourceRoot":"","sources":["../../src/riff-raff-yaml-file/group-by.ts"],"names":[],"mappings":";;;AACA,0CAAyC;AAEzC,mCAAqD;AAErD,SAAgB,gBAAgB,CAAC,SAAoB;IACnD,OAAO,IAAA,eAAO,EAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAFD,4CAEC;AAED,SAAgB,eAAe,CAAC,SAAoB;IAClD,OAAO,IAAA,eAAO,EAAC,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAFD,0CAEC;AAED,SAAgB,eAAe,CAAC,SAAoB;IAClD,OAAO,IAAA,eAAO,EAAC,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAFD,0CAEC;AAED,SAAgB,aAAa,CAAC,SAAoB;IAChD,OAAO,IAAA,eAAO,EAAC,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;AACpD,CAAC;AAFD,sCAEC;AAED,SAAgB,0BAA0B,CAAC,SAAoB;IAC7D,OAAO,IAAA,eAAO,EAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,IAAI,kCAA0B,CAAC,CAAC;AACxF,CAAC;AAFD,gEAEC","sourcesContent":["import type { GuStack } from \"../constructs/core\";\nimport { groupBy } from \"../utils/array\";\nimport type { ClassName, Region, RiffRaffProjectName, StackTag, StageTag } from \"./types\";\nimport { UnknownRiffRaffProjectName } from \"./types\";\n\nexport function groupByClassName(cdkStacks: GuStack[]): Record<ClassName, GuStack[]> {\n  return groupBy(cdkStacks, (stack) => stack.constructor.name);\n}\n\nexport function groupByStackTag(cdkStacks: GuStack[]): Record<StackTag, GuStack[]> {\n  return groupBy(cdkStacks, ({ stack }) => stack);\n}\n\nexport function groupByStageTag(cdkStacks: GuStack[]): Record<StageTag, GuStack[]> {\n  return groupBy(cdkStacks, ({ stage }) => stage);\n}\n\nexport function groupByRegion(cdkStacks: GuStack[]): Record<Region, GuStack[]> {\n  return groupBy(cdkStacks, ({ region }) => region);\n}\n\nexport function groupByRiffRaffProjectName(cdkStacks: GuStack[]): Record<RiffRaffProjectName, GuStack[]> {\n  return groupBy(cdkStacks, (_) => _.riffRaffProjectName ?? UnknownRiffRaffProjectName);\n}\n"]}
+{"version":3,"file":"group-by.js","sourceRoot":"","sources":["../../src/riff-raff-yaml-file/group-by.ts"],"names":[],"mappings":";;AAKA,4CAEC;AAED,0CAEC;AAED,0CAEC;AAED,sCAEC;AAED,gEAEC;AAtBD,0CAAyC;AAEzC,mCAAqD;AAErD,SAAgB,gBAAgB,CAAC,SAAoB;IACnD,OAAO,IAAA,eAAO,EAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,SAAgB,eAAe,CAAC,SAAoB;IAClD,OAAO,IAAA,eAAO,EAAC,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,eAAe,CAAC,SAAoB;IAClD,OAAO,IAAA,eAAO,EAAC,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,aAAa,CAAC,SAAoB;IAChD,OAAO,IAAA,eAAO,EAAC,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,SAAgB,0BAA0B,CAAC,SAAoB;IAC7D,OAAO,IAAA,eAAO,EAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,IAAI,kCAA0B,CAAC,CAAC;AACxF,CAAC","sourcesContent":["import type { GuStack } from \"../constructs/core\";\nimport { groupBy } from \"../utils/array\";\nimport type { ClassName, Region, RiffRaffProjectName, StackTag, StageTag } from \"./types\";\nimport { UnknownRiffRaffProjectName } from \"./types\";\n\nexport function groupByClassName(cdkStacks: GuStack[]): Record<ClassName, GuStack[]> {\n  return groupBy(cdkStacks, (stack) => stack.constructor.name);\n}\n\nexport function groupByStackTag(cdkStacks: GuStack[]): Record<StackTag, GuStack[]> {\n  return groupBy(cdkStacks, ({ stack }) => stack);\n}\n\nexport function groupByStageTag(cdkStacks: GuStack[]): Record<StageTag, GuStack[]> {\n  return groupBy(cdkStacks, ({ stage }) => stage);\n}\n\nexport function groupByRegion(cdkStacks: GuStack[]): Record<Region, GuStack[]> {\n  return groupBy(cdkStacks, ({ region }) => region);\n}\n\nexport function groupByRiffRaffProjectName(cdkStacks: GuStack[]): Record<RiffRaffProjectName, GuStack[]> {\n  return groupBy(cdkStacks, (_) => _.riffRaffProjectName ?? UnknownRiffRaffProjectName);\n}\n"]}

package/lib/riff-raff-yaml-file/index.js

@@ -3,7 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateRiffRaffYamlDirectory = exports.RiffRaffYamlFile = void 0;
+exports.RiffRaffYamlFile = void 0;
+exports.validateRiffRaffYamlDirectory = validateRiffRaffYamlDirectory;
 const fs_1 = require("fs");
 const path_1 = __importDefault(require("path"));
 const aws_cdk_lib_1 = require("aws-cdk-lib");
@@ -240,5 +241,4 @@ function validateRiffRaffYamlDirectory(basePath, riffRaffProjectName) {
     }
     return resolvedPath;
 }
-exports.validateRiffRaffYamlDirectory = validateRiffRaffYamlDirectory;
 //# sourceMappingURL=index.js.map

package/lib/riff-raff-yaml-file/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/riff-raff-yaml-file/index.ts"],"names":[],"mappings":";;;;;;AAAA,2BAA0D;AAC1D,gDAAwB;AAExB,6CAAoC;AAEpC,qCAA+B;AAC/B,2DAA+D;AAC/D,6CAA6C;AAC7C,iDAAwD;AACxD,8DAAmG;AACnG,2DAA6F;AAC7F,iEAIsC;AACtC,iDAAoF;AACpF,uEAA6E;AAC7E,yCAMoB;AAYpB,mCAAqD;AAErD,SAAS,6BAA6B,CAAC,OAAiB;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAE1E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE;QAC3B,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;KACjH;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAAiB;IACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,yBAAgB,CAAuB,CAAC;AACpG,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAiB;IAC7C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,gCAAkB,CAAyB,CAAC;AACxG,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAiB;IAC/C,OAAO,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,cAAO,CAAc,CAAC;AAChF,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAa,gBAAgB;IAa3B,8GAA8G;IAC9G,YAAY,GAAQ;QAClB,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,cAAO,CAAc,CAAC;QACzF,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAE1E,6BAA6B,CAAC,UAAU,CAAC,CAAC;QAE1C,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAqC,CAAC;QACnE,MAAM,aAAa,GAAmB,EAAE,CAAC;QAEzC,MAAM,CAAC,OAAO,CAAC,IAAA,qCAA0B,EAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAC9D,CAAC,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,EAAE,EAAE;YACxD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAClF,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmD,CAAC;YAE/E,MAAM,CAAC,OAAO,CAAC,IAAA,2BAAgB,EAAC,8BAA8B,CAAC,CAAC,CAAC,OAAO,CACtE,CAAC,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAAE,EAAE;gBACxC,MAAM,CAAC,OAAO,CAAC,IAAA,0BAAe,EAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,uBAAuB,CAAC,EAAE,EAAE;oBACxG,MAAM,CAAC,OAAO,CAAC,IAAA,wBAAa,EAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAAE,EAAE;wBACjG,MAAM,MAAM,GAAc,MAAM,CAAC,MAAM,CAAC,IAAA,0BAAe,EAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;wBAEvF,cAAc,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE;4BACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,aAAa,CAAC,EAAE;gCACxD,aAAa,CAAC,IAAI,CAAC;oCACjB,mBAAmB;oCACnB,SAAS;oCACT,MAAM;oCACN,KAAK,EAAE,QAAQ;oCACf,KAAK,EAAE,aAAa;iCACrB,CAAC,CAAC;6BACJ;wBACH,CAAC,CAAC,CAAC;wBAEH,6FAA6F;wBAC7F,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;wBAEvB,IAAI,CAAC,KAAK,EAAE;4BACV,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;yBAC1F;wBAED,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;wBAClC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;wBAEtD,MAAM,eAAe,GAAyB;4BAC5C,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,6BAAoB,CAAC;4BACzE,iBAAiB,CAAC,GAAG,CAAC,uCAAyB,CAAC;yBACjD,CAAC,IAAI,EAAE,CAAC;wBACT,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;wBAE3E,MAAM,YAAY,GAAyB,sBAAsB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjF,IAAA,yCAAwB,EAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAC/C,CAAC;wBAEF,MAAM,aAAa,GAAG,IAAA,yCAAwB,EAC5C,MAAM,EACN,CAAC,GAAG,eAAe,EAAE,GAAG,YAAY,CAAC,EACrC,IAAI,CAAC,MAAM,CACZ,CAAC;wBACF,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;wBAEzD,MAAM,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;wBACrF,2GAA2G;wBAC3G,oDAAoD;wBACpD,qBAAqB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;4BACvC,MAAM,gBAAgB,GAAG,IAAA,+BAAsB,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC;4BACvE,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;wBACjE,CAAC,CAAC,CAAC;wBAEH;;;0BAGE;wBACF,MAAM,uBAAuB,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC/D,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,YAAmC,CAAC;4BACpE,MAAM,EAAE,YAAY,EAAE,GAAG,UAAU,CAAC;4BACpC,OAAO,YAAY,EAAE,wBAAwB,KAAK,SAAS,CAAC;wBAC9D,CAAC,CAAC,CAAC;wBAEH,uBAAuB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;4BACtC,MAAM,aAAa,GAAG,IAAA,mCAAqB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;4BAChE,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;wBAC3D,CAAC,CAAC,CAAC;wBAEH,kFAAkF;wBAClF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE;4BAChC,IAAA,8CAA0B,EAAC,WAAW,EAAE,aAAa,EAAE;gCACrD,mBAAmB,EAAE,IAAA,iCAAgB,EAAC,iBAAiB,CAAC;6BACzD,CAAC,CAAC;yBACJ;wBAED;;;;;2BAKG;wBACH,MAAM,+BAA+B,GACnC,MAAM;6BACH,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;6BACnD,MAAM,CACL,CAAC,CAAC,EAAwD,EAAE,CAC1D,CAAC,YAAY,yDAA+C,CAC/D;6BACA,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;4BACpB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;gCAC1B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;6BAC7B;4BACD,OAAO,GAAG,CAAC;wBACb,CAAC,EAAE,IAAI,GAAG,EAA2D,CAAC,CAAC;wBAE3E;;2BAEG;wBACH,IAAI,+BAA+B,CAAC,IAAI,GAAG,CAAC,EAAE;4BAC5C,IAAA,8CAA0B,EAAC,WAAW,EAAE,aAAa,EAAE;gCACrD,+BAA+B,EAAE,IAAA,mDAAkC,EACjE,+BAA+B,CAChC;6BACF,CAAC,CAAC;yBACJ;oBACH,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YAEF,aAAa,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,CAAC,CACF,CAAC;QAEF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;YAC5B,MAAM,OAAO,GAAG,4DAA4D,aAAa,CAAC,MAAM,cAAc,CAAC;YAC/G,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,kBAAkB,CAAC,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAE7B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;SAC1B;QAED,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,sBAA2C,kCAA0B;QAC1E,qFAAqF;QACrF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,KAAc,EAAE,EAAE;YAChD,IAAI,KAAK,YAAY,GAAG,EAAE;gBACxB,iGAAiG;gBACjG,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aAC1B;YACD,IAAI,KAAK,YAAY,GAAG,EAAE;gBACxB,iGAAiG;gBACjG,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;aAClC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAE5D,IAAI,CAAC,OAAO,EAAE;YACZ,MAAM,IAAI,KAAK,CAAC,yCAAyC,mBAAmB,EAAE,CAAC,CAAC;SACjF;QAED,MAAM,IAAI,GAAG,IAAA,cAAI,EAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEzC,MAAM,QAAQ,GAAG;YACf,oEAAoE;YACpE,uFAAuF;SACxF;aACE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;aAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,EAAE;YACpD,MAAM,eAAe,GACnB,mBAAmB,KAAK,kCAA0B;gBAChD,CAAC,CAAC,IAAI,CAAC,MAAM;gBACb,CAAC,CAAC,6BAA6B,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;YAEtE,IAAI,CAAC,IAAA,eAAU,EAAC,eAAe,CAAC,EAAE;gBAChC,IAAA,cAAS,EAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;aACjD;YAED,MAAM,OAAO,GAAG,cAAI,CAAC,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;YAC7D,IAAA,kBAAa,EAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAnND,4CAmNC;AAED,SAAgB,6BAA6B,CAAC,QAAgB,EAAE,mBAAwC;IACtG,MAAM,YAAY,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,cAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,cAAI,CAAC,GAAG,EAAE,CAAC,IAAI,cAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAErH,IAAI,SAAS,EAAE;QACb,MAAM,IAAI,KAAK,CACb,kCAAkC,mBAAmB,yCAAyC,QAAQ,yBAAyB,mBAAmB,mBAAmB,YAAY,oBAAoB,YAAY,IAAI,CACtN,CAAC;KACH;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAbD,sEAaC","sourcesContent":["import { existsSync, mkdirSync, writeFileSync } from \"fs\";\nimport path from \"path\";\nimport type { App } from \"aws-cdk-lib\";\nimport { Token } from \"aws-cdk-lib\";\nimport type { CfnAutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport { dump } from \"js-yaml\";\nimport { GuAutoScalingGroup } from \"../constructs/autoscaling\";\nimport { GuStack } from \"../constructs/core\";\nimport { GuLambdaFunction } from \"../constructs/lambda\";\nimport { GuAsgMinInstancesInServiceParameterExperimental } from \"../experimental/patterns/ec2-app\";\nimport { autoscalingDeployment, uploadAutoscalingArtifact } from \"./deployments/autoscaling\";\nimport {\n  cloudFormationDeployment,\n  getAmiParameters,\n  getMinInstancesInServiceParameters,\n} from \"./deployments/cloudformation\";\nimport { updateLambdaDeployment, uploadLambdaArtifact } from \"./deployments/lambda\";\nimport { updateDeploymentParameters } from \"./deployments/update-parameters\";\nimport {\n  groupByClassName,\n  groupByRegion,\n  groupByRiffRaffProjectName,\n  groupByStackTag,\n  groupByStageTag,\n} from \"./group-by\";\nimport type {\n  ClassName,\n  Region,\n  RiffRaffDeployment,\n  RiffRaffDeploymentName,\n  RiffRaffDeploymentProps,\n  RiffRaffProjectName,\n  RiffRaffYaml,\n  StackTag,\n  StageTag,\n} from \"./types\";\nimport { UnknownRiffRaffProjectName } from \"./types\";\n\nfunction validateAllRegionsAreResolved(regions: Region[]): void {\n  const unresolved = regions.filter((region) => Token.isUnresolved(region));\n\n  if (unresolved.length !== 0) {\n    throw new Error(`Unable to produce a working riff-raff.yaml file; all stacks must have an explicit region set`);\n  }\n}\n\nfunction getLambdas(cdkStack: GuStack): GuLambdaFunction[] {\n  return cdkStack.node.findAll().filter((_) => _ instanceof GuLambdaFunction) as GuLambdaFunction[];\n}\n\nfunction getAutoScalingGroups(cdkStack: GuStack): GuAutoScalingGroup[] {\n  return cdkStack.node.findAll().filter((_) => _ instanceof GuAutoScalingGroup) as GuAutoScalingGroup[];\n}\n\nfunction getGuStackDependencies(cdkStack: GuStack): GuStack[] {\n  return cdkStack.dependencies.filter((_) => _ instanceof GuStack) as GuStack[];\n}\n\ninterface MissingStack {\n  riffRaffProjectName: RiffRaffProjectName;\n  className: ClassName;\n  stack: StackTag;\n  stage: StageTag;\n  region: Region;\n}\n\n/**\n * A class that creates a `riff-raff.yaml` file.\n *\n * Rather than using this directly, prefer to use [[`GuRoot`]] instead.\n *\n * Supports:\n *   - Multiple CloudFormation stacks\n *   - Multiple regions\n *   - Lambda applications\n *   - EC2 (autoscaling) applications\n *\n * For lambda applications, 3 deployments will be defined:\n *   1. Lambda upload (`aws-lambda`, `action: [uploadLambda]`)\n *   2. CloudFormation deploy (`cloud-formation`)\n *   3. Lambda update (`aws-lambda`, `action: [updateLambda]`)\n *\n * For EC2 applications, 3 deployments will be defined:\n *   1. Artifact upload (`autoscaling`, `action: [uploadArtifacts]`)\n *  2. CloudFormation deploy (`cloud-formation`)\n *   3. Autoscaling deploy (`autoscaling`, `action: [deploy]`)\n *\n * It assumes a Riff-Raff bundle structure as follows:\n *\n * ```\n * .\n * ├── cdk.out\n * │   └── MyApplication.template.json\n * ├── my-application\n * │   └── my-application.deb\n * └── my-lambda\n *     └── my-lambda.zip\n * ```\n *\n * That is, all CloudFormation templates are in a `cdk.out` directory, and there is a directory per app.\n * Application artifact(s) are in the app directory.\n *\n * NOTE: The file extension is decided by you, the above file tree is used for illustration purposes.\n *\n * NOTE: Resources will be looked up by tags (Stack, Stage, App). Ensure your CFN stack is tagged appropriately!\n *\n * @see https://riffraff.gutools.co.uk/docs/reference/riff-raff.yaml.md\n * @see https://riffraff.gutools.co.uk/docs/magenta-lib/types\n */\nexport class RiffRaffYamlFile {\n  private readonly outdir: string;\n\n  /**\n   * A mapping between a Riff-Raff project and `riff-raff.yaml` content as an object.\n   *\n   * It is useful for specifying additional deployment types that GuCDK does not support.\n   * Consider raising an issue or pull request if you think it should be supported.\n   *\n   * @see https://riffraff.gutools.co.uk/docs/magenta-lib/types\n   */\n  public readonly configuration: Map<RiffRaffProjectName, RiffRaffYaml>;\n\n  // eslint-disable-next-line custom-rules/valid-constructors -- this needs to sit above GuStack on the cdk tree\n  constructor(app: App) {\n    const allCdkStacks = app.node.findAll().filter((_) => _ instanceof GuStack) as GuStack[];\n    const allRegions = Array.from(new Set(allCdkStacks.map((_) => _.region)));\n\n    validateAllRegionsAreResolved(allRegions);\n\n    this.outdir = app.outdir;\n    const configuration = new Map<RiffRaffProjectName, RiffRaffYaml>();\n    const missingStacks: MissingStack[] = [];\n\n    Object.entries(groupByRiffRaffProjectName(allCdkStacks)).forEach(\n      ([riffRaffProjectName, stacksGroupedByRiffRaffProject]) => {\n        const allowedStages = new Set(stacksGroupedByRiffRaffProject.map((_) => _.stage));\n        const requiredStages = Array.from(allowedStages);\n        const deployments = new Map<RiffRaffDeploymentName, RiffRaffDeploymentProps>();\n\n        Object.entries(groupByClassName(stacksGroupedByRiffRaffProject)).forEach(\n          ([className, stacksGroupedByClassName]) => {\n            Object.entries(groupByStackTag(stacksGroupedByClassName)).forEach(([stackTag, stacksGroupedByStackTag]) => {\n              Object.entries(groupByRegion(stacksGroupedByStackTag)).forEach(([region, stacksGroupedByRegion]) => {\n                const stacks: GuStack[] = Object.values(groupByStageTag(stacksGroupedByRegion)).flat();\n\n                requiredStages.forEach((requiredStage) => {\n                  if (!stacks.find(({ stage }) => stage === requiredStage)) {\n                    missingStacks.push({\n                      riffRaffProjectName,\n                      className,\n                      region,\n                      stack: stackTag,\n                      stage: requiredStage,\n                    });\n                  }\n                });\n\n                // The items in `stacks` only differ by stage, so we can just use the first item in the list.\n                const [stack] = stacks;\n\n                if (!stack) {\n                  throw new Error(\"Unable to produce a working riff-raff.yaml file; there are no stacks!\");\n                }\n\n                const lambdas = getLambdas(stack);\n                const autoscalingGroups = getAutoScalingGroups(stack);\n\n                const artifactUploads: RiffRaffDeployment[] = [\n                  lambdas.filter((_) => !_.withoutArtifactUpload).map(uploadLambdaArtifact),\n                  autoscalingGroups.map(uploadAutoscalingArtifact),\n                ].flat();\n                artifactUploads.forEach(({ name, props }) => deployments.set(name, props));\n\n                const parentStacks: RiffRaffDeployment[] = getGuStackDependencies(stack).map((x) =>\n                  cloudFormationDeployment([x], [], this.outdir),\n                );\n\n                const cfnDeployment = cloudFormationDeployment(\n                  stacks,\n                  [...artifactUploads, ...parentStacks],\n                  this.outdir,\n                );\n                deployments.set(cfnDeployment.name, cfnDeployment.props);\n\n                const lambdasWithoutAnAlias = lambdas.filter((lambda) => lambda.alias === undefined);\n                // If the Lambda has an alias it is using versioning. When using versioning, there is no need for Riff-Raff\n                // to modify the unpublished version of the function\n                lambdasWithoutAnAlias.forEach((lambda) => {\n                  const lambdaDeployment = updateLambdaDeployment(lambda, cfnDeployment);\n                  deployments.set(lambdaDeployment.name, lambdaDeployment.props);\n                });\n\n                /*\n                Instances in an ASG with an `AutoScalingRollingUpdate` update policy are rotated via CloudFormation.\n                Therefore, they do not need to also perform an `autoscaling` deployment via Riff-Raff.\n                */\n                const legacyAutoscalingGroups = autoscalingGroups.filter((asg) => {\n                  const { cfnOptions } = asg.node.defaultChild as CfnAutoScalingGroup;\n                  const { updatePolicy } = cfnOptions;\n                  return updatePolicy?.autoScalingRollingUpdate === undefined;\n                });\n\n                legacyAutoscalingGroups.forEach((asg) => {\n                  const asgDeployment = autoscalingDeployment(asg, cfnDeployment);\n                  deployments.set(asgDeployment.name, asgDeployment.props);\n                });\n\n                // only add the `amiParametersToTags` property if there are some ASGs in the stack\n                if (autoscalingGroups.length > 0) {\n                  updateDeploymentParameters(deployments, cfnDeployment, {\n                    amiParametersToTags: getAmiParameters(autoscalingGroups),\n                  });\n                }\n\n                /*\n                At this point, `stacks` is a collection of similar `GuStack`s that differ only by their `stage`.\n                We're about to add `minInstancesInServiceParameters` to assist Riff-Raff when deploying ASGs with scaling policies.\n                This is driven by the presence of conditionally added CFN Parameters.\n                To support the possibility of there being a scaling policy in PROD but not CODE, look at all the CFN Parameters in `stacks`.\n                 */\n                const minInstancesInServiceParameters: Map<string, GuAsgMinInstancesInServiceParameterExperimental> =\n                  stacks\n                    .flatMap((stack) => Object.values(stack.parameters))\n                    .filter(\n                      (_): _ is GuAsgMinInstancesInServiceParameterExperimental =>\n                        _ instanceof GuAsgMinInstancesInServiceParameterExperimental,\n                    )\n                    .reduce((acc, item) => {\n                      if (!acc.has(item.node.id)) {\n                        acc.set(item.node.id, item);\n                      }\n                      return acc;\n                    }, new Map<string, GuAsgMinInstancesInServiceParameterExperimental>());\n\n                /**\n                 * Only add the `minInstancesInServiceParameters` property if there are some ASGs affected by {@link GuHorizontallyScalingDeploymentPropertiesExperimental}.\n                 */\n                if (minInstancesInServiceParameters.size > 0) {\n                  updateDeploymentParameters(deployments, cfnDeployment, {\n                    minInstancesInServiceParameters: getMinInstancesInServiceParameters(\n                      minInstancesInServiceParameters,\n                    ),\n                  });\n                }\n              });\n            });\n          },\n        );\n\n        configuration.set(riffRaffProjectName, { allowedStages, deployments });\n      },\n    );\n\n    if (missingStacks.length > 0) {\n      const message = `Unable to produce a working riff-raff.yaml file; missing ${missingStacks.length} definitions`;\n      console.log(`${message} (details below)`);\n      console.table(missingStacks);\n\n      throw new Error(message);\n    }\n\n    this.configuration = configuration;\n  }\n\n  /**\n   * A `riff-raff.yaml` file as a string.\n   * Useful for testing.\n   *\n   * @param riffRaffProjectName which project to convert to YAML. Defaults to {@link UnknownRiffRaffProjectName} - any {@link GuStack} without an explicit `riffRaffProjectName` property.\n   */\n  toYAML(riffRaffProjectName: RiffRaffProjectName = UnknownRiffRaffProjectName): string {\n    // Add support for ES6 Set and Map. See https://github.com/nodeca/js-yaml/issues/436.\n    const replacer = (_key: string, value: unknown) => {\n      if (value instanceof Set) {\n        // eslint-disable-next-line @typescript-eslint/no-unsafe-return -- this is how `js-yaml` is typed\n        return Array.from(value);\n      }\n      if (value instanceof Map) {\n        // eslint-disable-next-line @typescript-eslint/no-unsafe-return -- this is how `js-yaml` is typed\n        return Object.fromEntries(value);\n      }\n      return value;\n    };\n\n    const content = this.configuration.get(riffRaffProjectName);\n\n    if (!content) {\n      throw new Error(`No Riff-Raff project found with name: ${riffRaffProjectName}`);\n    }\n\n    const yaml = dump(content, { replacer });\n\n    const comments = [\n      \"This file was generated by @guardian/cdk, do not edit it directly.\",\n      \"See also https://github.com/guardian/cdk/blob/main/src/riff-raff-yaml-file/README.md.\",\n    ]\n      .map((line) => `# ${line}`)\n      .join(\"\\n\");\n\n    return [comments, yaml].join(\"\\n\");\n  }\n\n  /**\n   * Write the `riff-raff.yaml` file(s) to disk, located in the same directory as the CFN JSON templates generated by `cdk synth`.\n   */\n  synth(): void {\n    this.configuration.forEach((_, riffRaffProjectName) => {\n      const targetDirectory =\n        riffRaffProjectName === UnknownRiffRaffProjectName\n          ? this.outdir\n          : validateRiffRaffYamlDirectory(this.outdir, riffRaffProjectName);\n\n      if (!existsSync(targetDirectory)) {\n        mkdirSync(targetDirectory, { recursive: true });\n      }\n\n      const outPath = path.join(targetDirectory, \"riff-raff.yaml\");\n      writeFileSync(outPath, this.toYAML(riffRaffProjectName));\n    });\n  }\n}\n\nexport function validateRiffRaffYamlDirectory(basePath: string, riffRaffProjectName: RiffRaffProjectName): string {\n  const resolvedBase = path.resolve(basePath);\n  const resolvedPath = path.resolve(basePath, riffRaffProjectName);\n  const relativePath = path.relative(resolvedBase, resolvedPath);\n  const isOutside = relativePath === \"..\" || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath);\n\n  if (isOutside) {\n    throw new Error(\n      `Directory traversal detected: '${riffRaffProjectName}' would create a directory outside of ${basePath} (riffRaffProjectName=${riffRaffProjectName}, resolvedPath='${resolvedPath}', resolvedBase='${resolvedBase}')`,\n    );\n  }\n\n  return resolvedPath;\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/riff-raff-yaml-file/index.ts"],"names":[],"mappings":";;;;;;AAkUA,sEAaC;AA/UD,2BAA0D;AAC1D,gDAAwB;AAExB,6CAAoC;AAEpC,qCAA+B;AAC/B,2DAA+D;AAC/D,6CAA6C;AAC7C,iDAAwD;AACxD,8DAAmG;AACnG,2DAA6F;AAC7F,iEAIsC;AACtC,iDAAoF;AACpF,uEAA6E;AAC7E,yCAMoB;AAYpB,mCAAqD;AAErD,SAAS,6BAA6B,CAAC,OAAiB;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAE1E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAClH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAAiB;IACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,yBAAgB,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAiB;IAC7C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,gCAAkB,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAiB;IAC/C,OAAO,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,cAAO,CAAC,CAAC;AACnE,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAa,gBAAgB;IAa3B,8GAA8G;IAC9G,YAAY,GAAQ;QAClB,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,cAAO,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAE1E,6BAA6B,CAAC,UAAU,CAAC,CAAC;QAE1C,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACzB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAqC,CAAC;QACnE,MAAM,aAAa,GAAmB,EAAE,CAAC;QAEzC,MAAM,CAAC,OAAO,CAAC,IAAA,qCAA0B,EAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAC9D,CAAC,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,EAAE,EAAE;YACxD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAClF,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmD,CAAC;YAE/E,MAAM,CAAC,OAAO,CAAC,IAAA,2BAAgB,EAAC,8BAA8B,CAAC,CAAC,CAAC,OAAO,CACtE,CAAC,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAAE,EAAE;gBACxC,MAAM,CAAC,OAAO,CAAC,IAAA,0BAAe,EAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,uBAAuB,CAAC,EAAE,EAAE;oBACxG,MAAM,CAAC,OAAO,CAAC,IAAA,wBAAa,EAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAAE,EAAE;wBACjG,MAAM,MAAM,GAAc,MAAM,CAAC,MAAM,CAAC,IAAA,0BAAe,EAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;wBAEvF,cAAc,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE;4BACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,aAAa,CAAC,EAAE,CAAC;gCACzD,aAAa,CAAC,IAAI,CAAC;oCACjB,mBAAmB;oCACnB,SAAS;oCACT,MAAM;oCACN,KAAK,EAAE,QAAQ;oCACf,KAAK,EAAE,aAAa;iCACrB,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC,CAAC,CAAC;wBAEH,6FAA6F;wBAC7F,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;wBAEvB,IAAI,CAAC,KAAK,EAAE,CAAC;4BACX,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;wBAC3F,CAAC;wBAED,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;wBAClC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;wBAEtD,MAAM,eAAe,GAAyB;4BAC5C,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,6BAAoB,CAAC;4BACzE,iBAAiB,CAAC,GAAG,CAAC,uCAAyB,CAAC;yBACjD,CAAC,IAAI,EAAE,CAAC;wBACT,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;wBAE3E,MAAM,YAAY,GAAyB,sBAAsB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjF,IAAA,yCAAwB,EAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAC/C,CAAC;wBAEF,MAAM,aAAa,GAAG,IAAA,yCAAwB,EAC5C,MAAM,EACN,CAAC,GAAG,eAAe,EAAE,GAAG,YAAY,CAAC,EACrC,IAAI,CAAC,MAAM,CACZ,CAAC;wBACF,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;wBAEzD,MAAM,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;wBACrF,2GAA2G;wBAC3G,oDAAoD;wBACpD,qBAAqB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;4BACvC,MAAM,gBAAgB,GAAG,IAAA,+BAAsB,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC;4BACvE,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;wBACjE,CAAC,CAAC,CAAC;wBAEH;;;0BAGE;wBACF,MAAM,uBAAuB,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;4BAC/D,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,YAAmC,CAAC;4BACpE,MAAM,EAAE,YAAY,EAAE,GAAG,UAAU,CAAC;4BACpC,OAAO,YAAY,EAAE,wBAAwB,KAAK,SAAS,CAAC;wBAC9D,CAAC,CAAC,CAAC;wBAEH,uBAAuB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;4BACtC,MAAM,aAAa,GAAG,IAAA,mCAAqB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;4BAChE,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;wBAC3D,CAAC,CAAC,CAAC;wBAEH,kFAAkF;wBAClF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACjC,IAAA,8CAA0B,EAAC,WAAW,EAAE,aAAa,EAAE;gCACrD,mBAAmB,EAAE,IAAA,iCAAgB,EAAC,iBAAiB,CAAC;6BACzD,CAAC,CAAC;wBACL,CAAC;wBAED;;;;;2BAKG;wBACH,MAAM,+BAA+B,GACnC,MAAM;6BACH,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;6BACnD,MAAM,CACL,CAAC,CAAC,EAAwD,EAAE,CAC1D,CAAC,YAAY,yDAA+C,CAC/D;6BACA,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;4BACpB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gCAC3B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;4BAC9B,CAAC;4BACD,OAAO,GAAG,CAAC;wBACb,CAAC,EAAE,IAAI,GAAG,EAA2D,CAAC,CAAC;wBAE3E;;2BAEG;wBACH,IAAI,+BAA+B,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;4BAC7C,IAAA,8CAA0B,EAAC,WAAW,EAAE,aAAa,EAAE;gCACrD,+BAA+B,EAAE,IAAA,mDAAkC,EACjE,+BAA+B,CAChC;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YAEF,aAAa,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,CAAC,CACF,CAAC;QAEF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,4DAA4D,aAAa,CAAC,MAAM,cAAc,CAAC;YAC/G,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,kBAAkB,CAAC,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAE7B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,sBAA2C,kCAA0B;QAC1E,qFAAqF;QACrF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,KAAc,EAAE,EAAE;YAChD,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;gBACzB,iGAAiG;gBACjG,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;gBACzB,iGAAiG;gBACjG,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAE5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,yCAAyC,mBAAmB,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,cAAI,EAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEzC,MAAM,QAAQ,GAAG;YACf,oEAAoE;YACpE,uFAAuF;SACxF;aACE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;aAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,EAAE;YACpD,MAAM,eAAe,GACnB,mBAAmB,KAAK,kCAA0B;gBAChD,CAAC,CAAC,IAAI,CAAC,MAAM;gBACb,CAAC,CAAC,6BAA6B,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;YAEtE,IAAI,CAAC,IAAA,eAAU,EAAC,eAAe,CAAC,EAAE,CAAC;gBACjC,IAAA,cAAS,EAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;YAED,MAAM,OAAO,GAAG,cAAI,CAAC,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;YAC7D,IAAA,kBAAa,EAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAnND,4CAmNC;AAED,SAAgB,6BAA6B,CAAC,QAAgB,EAAE,mBAAwC;IACtG,MAAM,YAAY,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,cAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,cAAI,CAAC,GAAG,EAAE,CAAC,IAAI,cAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAErH,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,kCAAkC,mBAAmB,yCAAyC,QAAQ,yBAAyB,mBAAmB,mBAAmB,YAAY,oBAAoB,YAAY,IAAI,CACtN,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC","sourcesContent":["import { existsSync, mkdirSync, writeFileSync } from \"fs\";\nimport path from \"path\";\nimport type { App } from \"aws-cdk-lib\";\nimport { Token } from \"aws-cdk-lib\";\nimport type { CfnAutoScalingGroup } from \"aws-cdk-lib/aws-autoscaling\";\nimport { dump } from \"js-yaml\";\nimport { GuAutoScalingGroup } from \"../constructs/autoscaling\";\nimport { GuStack } from \"../constructs/core\";\nimport { GuLambdaFunction } from \"../constructs/lambda\";\nimport { GuAsgMinInstancesInServiceParameterExperimental } from \"../experimental/patterns/ec2-app\";\nimport { autoscalingDeployment, uploadAutoscalingArtifact } from \"./deployments/autoscaling\";\nimport {\n  cloudFormationDeployment,\n  getAmiParameters,\n  getMinInstancesInServiceParameters,\n} from \"./deployments/cloudformation\";\nimport { updateLambdaDeployment, uploadLambdaArtifact } from \"./deployments/lambda\";\nimport { updateDeploymentParameters } from \"./deployments/update-parameters\";\nimport {\n  groupByClassName,\n  groupByRegion,\n  groupByRiffRaffProjectName,\n  groupByStackTag,\n  groupByStageTag,\n} from \"./group-by\";\nimport type {\n  ClassName,\n  Region,\n  RiffRaffDeployment,\n  RiffRaffDeploymentName,\n  RiffRaffDeploymentProps,\n  RiffRaffProjectName,\n  RiffRaffYaml,\n  StackTag,\n  StageTag,\n} from \"./types\";\nimport { UnknownRiffRaffProjectName } from \"./types\";\n\nfunction validateAllRegionsAreResolved(regions: Region[]): void {\n  const unresolved = regions.filter((region) => Token.isUnresolved(region));\n\n  if (unresolved.length !== 0) {\n    throw new Error(`Unable to produce a working riff-raff.yaml file; all stacks must have an explicit region set`);\n  }\n}\n\nfunction getLambdas(cdkStack: GuStack): GuLambdaFunction[] {\n  return cdkStack.node.findAll().filter((_) => _ instanceof GuLambdaFunction);\n}\n\nfunction getAutoScalingGroups(cdkStack: GuStack): GuAutoScalingGroup[] {\n  return cdkStack.node.findAll().filter((_) => _ instanceof GuAutoScalingGroup);\n}\n\nfunction getGuStackDependencies(cdkStack: GuStack): GuStack[] {\n  return cdkStack.dependencies.filter((_) => _ instanceof GuStack);\n}\n\ninterface MissingStack {\n  riffRaffProjectName: RiffRaffProjectName;\n  className: ClassName;\n  stack: StackTag;\n  stage: StageTag;\n  region: Region;\n}\n\n/**\n * A class that creates a `riff-raff.yaml` file.\n *\n * Rather than using this directly, prefer to use [[`GuRoot`]] instead.\n *\n * Supports:\n *   - Multiple CloudFormation stacks\n *   - Multiple regions\n *   - Lambda applications\n *   - EC2 (autoscaling) applications\n *\n * For lambda applications, 3 deployments will be defined:\n *   1. Lambda upload (`aws-lambda`, `action: [uploadLambda]`)\n *   2. CloudFormation deploy (`cloud-formation`)\n *   3. Lambda update (`aws-lambda`, `action: [updateLambda]`)\n *\n * For EC2 applications, 3 deployments will be defined:\n *   1. Artifact upload (`autoscaling`, `action: [uploadArtifacts]`)\n *  2. CloudFormation deploy (`cloud-formation`)\n *   3. Autoscaling deploy (`autoscaling`, `action: [deploy]`)\n *\n * It assumes a Riff-Raff bundle structure as follows:\n *\n * ```\n * .\n * ├── cdk.out\n * │   └── MyApplication.template.json\n * ├── my-application\n * │   └── my-application.deb\n * └── my-lambda\n *     └── my-lambda.zip\n * ```\n *\n * That is, all CloudFormation templates are in a `cdk.out` directory, and there is a directory per app.\n * Application artifact(s) are in the app directory.\n *\n * NOTE: The file extension is decided by you, the above file tree is used for illustration purposes.\n *\n * NOTE: Resources will be looked up by tags (Stack, Stage, App). Ensure your CFN stack is tagged appropriately!\n *\n * @see https://riffraff.gutools.co.uk/docs/reference/riff-raff.yaml.md\n * @see https://riffraff.gutools.co.uk/docs/magenta-lib/types\n */\nexport class RiffRaffYamlFile {\n  private readonly outdir: string;\n\n  /**\n   * A mapping between a Riff-Raff project and `riff-raff.yaml` content as an object.\n   *\n   * It is useful for specifying additional deployment types that GuCDK does not support.\n   * Consider raising an issue or pull request if you think it should be supported.\n   *\n   * @see https://riffraff.gutools.co.uk/docs/magenta-lib/types\n   */\n  public readonly configuration: Map<RiffRaffProjectName, RiffRaffYaml>;\n\n  // eslint-disable-next-line custom-rules/valid-constructors -- this needs to sit above GuStack on the cdk tree\n  constructor(app: App) {\n    const allCdkStacks = app.node.findAll().filter((_) => _ instanceof GuStack);\n    const allRegions = Array.from(new Set(allCdkStacks.map((_) => _.region)));\n\n    validateAllRegionsAreResolved(allRegions);\n\n    this.outdir = app.outdir;\n    const configuration = new Map<RiffRaffProjectName, RiffRaffYaml>();\n    const missingStacks: MissingStack[] = [];\n\n    Object.entries(groupByRiffRaffProjectName(allCdkStacks)).forEach(\n      ([riffRaffProjectName, stacksGroupedByRiffRaffProject]) => {\n        const allowedStages = new Set(stacksGroupedByRiffRaffProject.map((_) => _.stage));\n        const requiredStages = Array.from(allowedStages);\n        const deployments = new Map<RiffRaffDeploymentName, RiffRaffDeploymentProps>();\n\n        Object.entries(groupByClassName(stacksGroupedByRiffRaffProject)).forEach(\n          ([className, stacksGroupedByClassName]) => {\n            Object.entries(groupByStackTag(stacksGroupedByClassName)).forEach(([stackTag, stacksGroupedByStackTag]) => {\n              Object.entries(groupByRegion(stacksGroupedByStackTag)).forEach(([region, stacksGroupedByRegion]) => {\n                const stacks: GuStack[] = Object.values(groupByStageTag(stacksGroupedByRegion)).flat();\n\n                requiredStages.forEach((requiredStage) => {\n                  if (!stacks.find(({ stage }) => stage === requiredStage)) {\n                    missingStacks.push({\n                      riffRaffProjectName,\n                      className,\n                      region,\n                      stack: stackTag,\n                      stage: requiredStage,\n                    });\n                  }\n                });\n\n                // The items in `stacks` only differ by stage, so we can just use the first item in the list.\n                const [stack] = stacks;\n\n                if (!stack) {\n                  throw new Error(\"Unable to produce a working riff-raff.yaml file; there are no stacks!\");\n                }\n\n                const lambdas = getLambdas(stack);\n                const autoscalingGroups = getAutoScalingGroups(stack);\n\n                const artifactUploads: RiffRaffDeployment[] = [\n                  lambdas.filter((_) => !_.withoutArtifactUpload).map(uploadLambdaArtifact),\n                  autoscalingGroups.map(uploadAutoscalingArtifact),\n                ].flat();\n                artifactUploads.forEach(({ name, props }) => deployments.set(name, props));\n\n                const parentStacks: RiffRaffDeployment[] = getGuStackDependencies(stack).map((x) =>\n                  cloudFormationDeployment([x], [], this.outdir),\n                );\n\n                const cfnDeployment = cloudFormationDeployment(\n                  stacks,\n                  [...artifactUploads, ...parentStacks],\n                  this.outdir,\n                );\n                deployments.set(cfnDeployment.name, cfnDeployment.props);\n\n                const lambdasWithoutAnAlias = lambdas.filter((lambda) => lambda.alias === undefined);\n                // If the Lambda has an alias it is using versioning. When using versioning, there is no need for Riff-Raff\n                // to modify the unpublished version of the function\n                lambdasWithoutAnAlias.forEach((lambda) => {\n                  const lambdaDeployment = updateLambdaDeployment(lambda, cfnDeployment);\n                  deployments.set(lambdaDeployment.name, lambdaDeployment.props);\n                });\n\n                /*\n                Instances in an ASG with an `AutoScalingRollingUpdate` update policy are rotated via CloudFormation.\n                Therefore, they do not need to also perform an `autoscaling` deployment via Riff-Raff.\n                */\n                const legacyAutoscalingGroups = autoscalingGroups.filter((asg) => {\n                  const { cfnOptions } = asg.node.defaultChild as CfnAutoScalingGroup;\n                  const { updatePolicy } = cfnOptions;\n                  return updatePolicy?.autoScalingRollingUpdate === undefined;\n                });\n\n                legacyAutoscalingGroups.forEach((asg) => {\n                  const asgDeployment = autoscalingDeployment(asg, cfnDeployment);\n                  deployments.set(asgDeployment.name, asgDeployment.props);\n                });\n\n                // only add the `amiParametersToTags` property if there are some ASGs in the stack\n                if (autoscalingGroups.length > 0) {\n                  updateDeploymentParameters(deployments, cfnDeployment, {\n                    amiParametersToTags: getAmiParameters(autoscalingGroups),\n                  });\n                }\n\n                /*\n                At this point, `stacks` is a collection of similar `GuStack`s that differ only by their `stage`.\n                We're about to add `minInstancesInServiceParameters` to assist Riff-Raff when deploying ASGs with scaling policies.\n                This is driven by the presence of conditionally added CFN Parameters.\n                To support the possibility of there being a scaling policy in PROD but not CODE, look at all the CFN Parameters in `stacks`.\n                 */\n                const minInstancesInServiceParameters: Map<string, GuAsgMinInstancesInServiceParameterExperimental> =\n                  stacks\n                    .flatMap((stack) => Object.values(stack.parameters))\n                    .filter(\n                      (_): _ is GuAsgMinInstancesInServiceParameterExperimental =>\n                        _ instanceof GuAsgMinInstancesInServiceParameterExperimental,\n                    )\n                    .reduce((acc, item) => {\n                      if (!acc.has(item.node.id)) {\n                        acc.set(item.node.id, item);\n                      }\n                      return acc;\n                    }, new Map<string, GuAsgMinInstancesInServiceParameterExperimental>());\n\n                /**\n                 * Only add the `minInstancesInServiceParameters` property if there are some ASGs affected by {@link GuHorizontallyScalingDeploymentPropertiesExperimental}.\n                 */\n                if (minInstancesInServiceParameters.size > 0) {\n                  updateDeploymentParameters(deployments, cfnDeployment, {\n                    minInstancesInServiceParameters: getMinInstancesInServiceParameters(\n                      minInstancesInServiceParameters,\n                    ),\n                  });\n                }\n              });\n            });\n          },\n        );\n\n        configuration.set(riffRaffProjectName, { allowedStages, deployments });\n      },\n    );\n\n    if (missingStacks.length > 0) {\n      const message = `Unable to produce a working riff-raff.yaml file; missing ${missingStacks.length} definitions`;\n      console.log(`${message} (details below)`);\n      console.table(missingStacks);\n\n      throw new Error(message);\n    }\n\n    this.configuration = configuration;\n  }\n\n  /**\n   * A `riff-raff.yaml` file as a string.\n   * Useful for testing.\n   *\n   * @param riffRaffProjectName which project to convert to YAML. Defaults to {@link UnknownRiffRaffProjectName} - any {@link GuStack} without an explicit `riffRaffProjectName` property.\n   */\n  toYAML(riffRaffProjectName: RiffRaffProjectName = UnknownRiffRaffProjectName): string {\n    // Add support for ES6 Set and Map. See https://github.com/nodeca/js-yaml/issues/436.\n    const replacer = (_key: string, value: unknown) => {\n      if (value instanceof Set) {\n        // eslint-disable-next-line @typescript-eslint/no-unsafe-return -- this is how `js-yaml` is typed\n        return Array.from(value);\n      }\n      if (value instanceof Map) {\n        // eslint-disable-next-line @typescript-eslint/no-unsafe-return -- this is how `js-yaml` is typed\n        return Object.fromEntries(value);\n      }\n      return value;\n    };\n\n    const content = this.configuration.get(riffRaffProjectName);\n\n    if (!content) {\n      throw new Error(`No Riff-Raff project found with name: ${riffRaffProjectName}`);\n    }\n\n    const yaml = dump(content, { replacer });\n\n    const comments = [\n      \"This file was generated by @guardian/cdk, do not edit it directly.\",\n      \"See also https://github.com/guardian/cdk/blob/main/src/riff-raff-yaml-file/README.md.\",\n    ]\n      .map((line) => `# ${line}`)\n      .join(\"\\n\");\n\n    return [comments, yaml].join(\"\\n\");\n  }\n\n  /**\n   * Write the `riff-raff.yaml` file(s) to disk, located in the same directory as the CFN JSON templates generated by `cdk synth`.\n   */\n  synth(): void {\n    this.configuration.forEach((_, riffRaffProjectName) => {\n      const targetDirectory =\n        riffRaffProjectName === UnknownRiffRaffProjectName\n          ? this.outdir\n          : validateRiffRaffYamlDirectory(this.outdir, riffRaffProjectName);\n\n      if (!existsSync(targetDirectory)) {\n        mkdirSync(targetDirectory, { recursive: true });\n      }\n\n      const outPath = path.join(targetDirectory, \"riff-raff.yaml\");\n      writeFileSync(outPath, this.toYAML(riffRaffProjectName));\n    });\n  }\n}\n\nexport function validateRiffRaffYamlDirectory(basePath: string, riffRaffProjectName: RiffRaffProjectName): string {\n  const resolvedBase = path.resolve(basePath);\n  const resolvedPath = path.resolve(basePath, riffRaffProjectName);\n  const relativePath = path.relative(resolvedBase, resolvedPath);\n  const isOutside = relativePath === \"..\" || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath);\n\n  if (isOutside) {\n    throw new Error(\n      `Directory traversal detected: '${riffRaffProjectName}' would create a directory outside of ${basePath} (riffRaffProjectName=${riffRaffProjectName}, resolvedPath='${resolvedPath}', resolvedBase='${resolvedBase}')`,\n    );\n  }\n\n  return resolvedPath;\n}\n"]}

package/lib/types/access.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/types/access.ts"],"names":[],"mappings":";;;AACA,iDAA2C;AAC3C,4CAA2C;AA0D9B,QAAA,SAAS,GAAG;IACvB;;;;;;;;OAQG;IACH,QAAQ,EAAE,CAAC,MAAiB,EAAE,EAAE;QAC9B,QAAQ,MAAM,CAAC,KAAK,EAAE;YACpB,KAAK,uBAAW,CAAC,UAAU,CAAC,CAAC;gBAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACxD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEvC,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE;oBACxF,MAAM,IAAI,KAAK,CACb,GAAG,uBAAW,CAAC,UAAU,4DAA4D,YAAY,YAAY,uBAAW,CAAC,MAAM,GAAG,CACnI,CAAC;iBACH;gBACD,MAAM;aACP;YAED,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACxD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEvC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE;oBACpD,MAAM,IAAI,KAAK,CACb,GAAG,uBAAW,CAAC,QAAQ,sEAAsE,YAAY,YAAY,uBAAW,CAAC,UAAU,GAAG,CAC/I,CAAC;iBACH;gBACD,MAAM;aACP;YACD;gBACE,MAAM;SACT;IACH,CAAC;CACF,CAAC","sourcesContent":["import type { IPeer } from \"aws-cdk-lib/aws-ec2\";\nimport { Peer } from \"aws-cdk-lib/aws-ec2\";\nimport { AccessScope } from \"../constants\";\n\nexport interface Access {\n  scope: AccessScope;\n}\n\n/**\n * For when you want your application to be accessible to the world (0.0.0.0/0).\n * Your application load balancer will have a public IP address that can be reached by anyone,\n * so only use if you are aware and happy with the consequences!\n *\n * Example usage:\n * ```typescript\n * { scope: AccessScope.PUBLIC }\n * ```\n */\nexport interface PublicAccess extends Access {\n  scope: AccessScope.PUBLIC;\n}\n\n/**\n * For when you want to restrict your application's access to a list of CIDR ranges. For example,\n * if you want limit access to users connecting from Guardian offices only.\n *\n * Example usage:\n * ```typescript\n * {\n *   scope: AccessScope.RESTRICTED,\n *   cidrRanges: [Peer.ipv4(\"192.168.1.1/32\"), Peer.ipv4(\"8.8.8.8/32\")]\n * }\n * ```\n */\nexport interface RestrictedAccess extends Access {\n  scope: AccessScope.RESTRICTED;\n  cidrRanges: IPeer[];\n}\n\n/**\n * For when you want to restrict your application's access to services running inside your VPC.\n *\n * Note that if your account uses Direct Connect or VPC Peering, then incoming traffic from these sources\n * can also be allowed.\n *\n * Example usage:\n * ```typescript\n * {\n *   scope: AccessScope.INTERNAL,\n *   cidrRanges: [Peer.ipv4(\"10.0.0.0/8\")]\n * }\n * ```\n */\nexport interface InternalAccess extends Access {\n  scope: AccessScope.INTERNAL;\n  cidrRanges: IPeer[];\n}\n\nexport type AppAccess = PublicAccess | RestrictedAccess | InternalAccess;\n\nexport const AppAccess = {\n  /**\n   * Validate the CIDR rules for AppAccess.\n   *\n   * Public - always valid. No CIDR rules are needed here, and the type-system enforces this\n   * Restricted - Must not include global CIDR ranges as doing so makes other listed CIDR ranges redundant\n   * Internal - All CIDR ranges must start `10.`\n   *\n   * @throws `Error` when CIDR rules are invalid\n   */\n  validate: (access: AppAccess) => {\n    switch (access.scope) {\n      case AccessScope.RESTRICTED: {\n        const ranges = access.cidrRanges.map((_) => _.uniqueId);\n        const rangesString = ranges.join(\", \");\n\n        if (ranges.includes(Peer.anyIpv4().uniqueId) || ranges.includes(Peer.anyIpv6().uniqueId)) {\n          throw new Error(\n            `${AccessScope.RESTRICTED} apps cannot be globally accessible. Adjust CIDR ranges (${rangesString}) or use ${AccessScope.PUBLIC}.`,\n          );\n        }\n        break;\n      }\n\n      case AccessScope.INTERNAL: {\n        const ranges = access.cidrRanges.map((_) => _.uniqueId);\n        const rangesString = ranges.join(\", \");\n\n        if (ranges.some((range) => !range.startsWith(\"10.\"))) {\n          throw new Error(\n            `${AccessScope.INTERNAL} apps should only be accessible on 10. ranges. Adjust CIDR ranges (${rangesString}) or use ${AccessScope.RESTRICTED}.`,\n          );\n        }\n        break;\n      }\n      default:\n        break;\n    }\n  },\n};\n"]}
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/types/access.ts"],"names":[],"mappings":";;;AACA,iDAA2C;AAC3C,4CAA2C;AA0D9B,QAAA,SAAS,GAAG;IACvB;;;;;;;;OAQG;IACH,QAAQ,EAAE,CAAC,MAAiB,EAAE,EAAE;QAC9B,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,KAAK,uBAAW,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACxD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEvC,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzF,MAAM,IAAI,KAAK,CACb,GAAG,uBAAW,CAAC,UAAU,4DAA4D,YAAY,YAAY,uBAAW,CAAC,MAAM,GAAG,CACnI,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,uBAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACxD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEvC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CACb,GAAG,uBAAW,CAAC,QAAQ,sEAAsE,YAAY,YAAY,uBAAW,CAAC,UAAU,GAAG,CAC/I,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YACD;gBACE,MAAM;QACV,CAAC;IACH,CAAC;CACF,CAAC","sourcesContent":["import type { IPeer } from \"aws-cdk-lib/aws-ec2\";\nimport { Peer } from \"aws-cdk-lib/aws-ec2\";\nimport { AccessScope } from \"../constants\";\n\nexport interface Access {\n  scope: AccessScope;\n}\n\n/**\n * For when you want your application to be accessible to the world (0.0.0.0/0).\n * Your application load balancer will have a public IP address that can be reached by anyone,\n * so only use if you are aware and happy with the consequences!\n *\n * Example usage:\n * ```typescript\n * { scope: AccessScope.PUBLIC }\n * ```\n */\nexport interface PublicAccess extends Access {\n  scope: AccessScope.PUBLIC;\n}\n\n/**\n * For when you want to restrict your application's access to a list of CIDR ranges. For example,\n * if you want limit access to users connecting from Guardian offices only.\n *\n * Example usage:\n * ```typescript\n * {\n *   scope: AccessScope.RESTRICTED,\n *   cidrRanges: [Peer.ipv4(\"192.168.1.1/32\"), Peer.ipv4(\"8.8.8.8/32\")]\n * }\n * ```\n */\nexport interface RestrictedAccess extends Access {\n  scope: AccessScope.RESTRICTED;\n  cidrRanges: IPeer[];\n}\n\n/**\n * For when you want to restrict your application's access to services running inside your VPC.\n *\n * Note that if your account uses Direct Connect or VPC Peering, then incoming traffic from these sources\n * can also be allowed.\n *\n * Example usage:\n * ```typescript\n * {\n *   scope: AccessScope.INTERNAL,\n *   cidrRanges: [Peer.ipv4(\"10.0.0.0/8\")]\n * }\n * ```\n */\nexport interface InternalAccess extends Access {\n  scope: AccessScope.INTERNAL;\n  cidrRanges: IPeer[];\n}\n\nexport type AppAccess = PublicAccess | RestrictedAccess | InternalAccess;\n\nexport const AppAccess = {\n  /**\n   * Validate the CIDR rules for AppAccess.\n   *\n   * Public - always valid. No CIDR rules are needed here, and the type-system enforces this\n   * Restricted - Must not include global CIDR ranges as doing so makes other listed CIDR ranges redundant\n   * Internal - All CIDR ranges must start `10.`\n   *\n   * @throws `Error` when CIDR rules are invalid\n   */\n  validate: (access: AppAccess) => {\n    switch (access.scope) {\n      case AccessScope.RESTRICTED: {\n        const ranges = access.cidrRanges.map((_) => _.uniqueId);\n        const rangesString = ranges.join(\", \");\n\n        if (ranges.includes(Peer.anyIpv4().uniqueId) || ranges.includes(Peer.anyIpv6().uniqueId)) {\n          throw new Error(\n            `${AccessScope.RESTRICTED} apps cannot be globally accessible. Adjust CIDR ranges (${rangesString}) or use ${AccessScope.PUBLIC}.`,\n          );\n        }\n        break;\n      }\n\n      case AccessScope.INTERNAL: {\n        const ranges = access.cidrRanges.map((_) => _.uniqueId);\n        const rangesString = ranges.join(\", \");\n\n        if (ranges.some((range) => !range.startsWith(\"10.\"))) {\n          throw new Error(\n            `${AccessScope.INTERNAL} apps should only be accessible on 10. ranges. Adjust CIDR ranges (${rangesString}) or use ${AccessScope.RESTRICTED}.`,\n          );\n        }\n        break;\n      }\n      default:\n        break;\n    }\n  },\n};\n"]}

package/lib/utils/array.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.groupBy = void 0;
+exports.groupBy = groupBy;
 /**
  * Group an array of T by a field in T.
  * @param input what to group
@@ -16,5 +16,4 @@ function groupBy(input, keyFn) {
         };
     }, {});
 }
-exports.groupBy = groupBy;
 //# sourceMappingURL=array.js.map

package/lib/utils/array.js.map

@@ -1 +1 @@
-{"version":3,"file":"array.js","sourceRoot":"","sources":["../../src/utils/array.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,SAAgB,OAAO,CAAI,KAAU,EAAE,KAAuB;IAC5D,OAAO,KAAK,CAAC,MAAM,CAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO;YACL,GAAG,GAAG;YACN,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC;SAC7B,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC;AATD,0BASC","sourcesContent":["/**\n * Group an array of T by a field in T.\n * @param input what to group\n * @param keyFn which field to group on\n */\nexport function groupBy<T>(input: T[], keyFn: (i: T) => string): Record<string, T[]> {\n  return input.reduce<Record<string, T[]>>((acc, element) => {\n    const key = keyFn(element);\n    const current = acc[key] ?? [];\n    return {\n      ...acc,\n      [key]: [...current, element],\n    };\n  }, {});\n}\n"]}
+{"version":3,"file":"array.js","sourceRoot":"","sources":["../../src/utils/array.ts"],"names":[],"mappings":";;AAKA,0BASC;AAdD;;;;GAIG;AACH,SAAgB,OAAO,CAAI,KAAU,EAAE,KAAuB;IAC5D,OAAO,KAAK,CAAC,MAAM,CAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO;YACL,GAAG,GAAG;YACN,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC;SAC7B,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC","sourcesContent":["/**\n * Group an array of T by a field in T.\n * @param input what to group\n * @param keyFn which field to group on\n */\nexport function groupBy<T>(input: T[], keyFn: (i: T) => string): Record<string, T[]> {\n  return input.reduce<Record<string, T[]>>((acc, element) => {\n    const key = keyFn(element);\n    const current = acc[key] ?? [];\n    return {\n      ...acc,\n      [key]: [...current, element],\n    };\n  }, {});\n}\n"]}

package/lib/utils/cli/vpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vpc.d.ts","sourceRoot":"","sources":["../../../src/utils/cli/vpc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA6C,GAAG,EAAe,MAAM,qBAAqB,CAAC;AACvG,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGnD,eAAO,MAAM,2BAA2B,EAAE,MAAM,EAE/C,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAGvC,CAAC;AAWH,eAAO,MAAM,sBAAsB,cAAqB,GAAG,KAAG,QAAQ,SAAS,EAAE,CAWhF,CAAC;AA2CF,eAAO,MAAM,eAAe,cAAqB,GAAG,KAAG,QAAQ,WAAW,EAAE,CAgB3E,CAAC"}
+{"version":3,"file":"vpc.d.ts","sourceRoot":"","sources":["../../../src/utils/cli/vpc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA6C,GAAG,EAAe,MAAM,qBAAqB,CAAC;AACvG,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGnD,eAAO,MAAM,2BAA2B,EAAE,MAAM,EAE/C,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAGvC,CAAC;AAWH,eAAO,MAAM,sBAAsB,GAAU,WAAW,GAAG,KAAG,OAAO,CAAC,SAAS,EAAE,CAWhF,CAAC;AA2CF,eAAO,MAAM,eAAe,GAAU,WAAW,GAAG,KAAG,OAAO,CAAC,WAAW,EAAE,CAgB3E,CAAC"}