@medplum/cdk 2.0.7

package/dist/cjs/index.cjs

@@ -0,0 +1,767 @@
+'use strict';
+
+var awsCdkLib = require('aws-cdk-lib');
+var fs = require('fs');
+var path = require('path');
+var awsEcr = require('aws-cdk-lib/aws-ecr');
+var constructs = require('constructs');
+var cdkServerlessClamscan = require('cdk-serverless-clamscan');
+
+// Based on https://gist.github.com/statik/f1ac9d6227d98d30c7a7cec0c83f4e64
+const awsManagedRules = [
+    // Common Rule Set aligns with major portions of OWASP Core Rule Set
+    // https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html
+    {
+        name: 'AWS-AWSManagedRulesCommonRuleSet',
+        priority: 10,
+        statement: {
+            managedRuleGroupStatement: {
+                vendorName: 'AWS',
+                name: 'AWSManagedRulesCommonRuleSet',
+                // Excluding generic RFI body rule for sns notifications
+                // https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-list.html
+                excludedRules: [
+                    { name: 'NoUserAgent_HEADER' },
+                    { name: 'UserAgent_BadBots_HEADER' },
+                    { name: 'SizeRestrictions_QUERYSTRING' },
+                    { name: 'SizeRestrictions_Cookie_HEADER' },
+                    { name: 'SizeRestrictions_BODY' },
+                    { name: 'SizeRestrictions_URIPATH' },
+                    { name: 'EC2MetaDataSSRF_BODY' },
+                    { name: 'EC2MetaDataSSRF_COOKIE' },
+                    { name: 'EC2MetaDataSSRF_URIPATH' },
+                    { name: 'EC2MetaDataSSRF_QUERYARGUMENTS' },
+                    { name: 'GenericLFI_QUERYARGUMENTS' },
+                    { name: 'GenericLFI_URIPATH' },
+                    { name: 'GenericLFI_BODY' },
+                    { name: 'RestrictedExtensions_URIPATH' },
+                    { name: 'RestrictedExtensions_QUERYARGUMENTS' },
+                    { name: 'GenericRFI_QUERYARGUMENTS' },
+                    { name: 'GenericRFI_BODY' },
+                    { name: 'GenericRFI_URIPATH' },
+                    { name: 'CrossSiteScripting_COOKIE' },
+                    { name: 'CrossSiteScripting_QUERYARGUMENTS' },
+                    { name: 'CrossSiteScripting_BODY' },
+                    { name: 'CrossSiteScripting_URIPATH' },
+                ],
+            },
+        },
+        overrideAction: {
+            count: {},
+        },
+        visibilityConfig: {
+            sampledRequestsEnabled: true,
+            cloudWatchMetricsEnabled: true,
+            metricName: 'AWS-AWSManagedRulesCommonRuleSet',
+        },
+    },
+    // AWS IP Reputation list includes known malicious actors/bots and is regularly updated
+    // https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-ip-rep.html
+    {
+        name: 'AWS-AWSManagedRulesAmazonIpReputationList',
+        priority: 20,
+        statement: {
+            managedRuleGroupStatement: {
+                vendorName: 'AWS',
+                name: 'AWSManagedRulesAmazonIpReputationList',
+                excludedRules: [{ name: 'AWSManagedIPReputationList' }, { name: 'AWSManagedReconnaissanceList' }],
+            },
+        },
+        overrideAction: {
+            count: {},
+        },
+        visibilityConfig: {
+            sampledRequestsEnabled: true,
+            cloudWatchMetricsEnabled: true,
+            metricName: 'AWSManagedRulesAmazonIpReputationList',
+        },
+    },
+    // Blocks common SQL Injection
+    // https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-use-case.html#aws-managed-rule-groups-use-case-sql-db
+    {
+        name: 'AWSManagedRulesSQLiRuleSet',
+        priority: 30,
+        visibilityConfig: {
+            sampledRequestsEnabled: true,
+            cloudWatchMetricsEnabled: true,
+            metricName: 'AWSManagedRulesSQLiRuleSet',
+        },
+        overrideAction: {
+            count: {},
+        },
+        statement: {
+            managedRuleGroupStatement: {
+                vendorName: 'AWS',
+                name: 'AWSManagedRulesSQLiRuleSet',
+                excludedRules: [
+                    { name: 'SQLi_QUERYARGUMENTS' },
+                    { name: 'SQLiExtendedPatterns_QUERYARGUMENTS' },
+                    { name: 'SQLi_BODY' },
+                    { name: 'SQLiExtendedPatterns_BODY' },
+                    { name: 'SQLi_COOKIE' },
+                    { name: 'SQLi_URIPATH' },
+                ],
+            },
+        },
+    },
+    // Blocks attacks targeting LFI(Local File Injection) for linux systems
+    // https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-use-case.html#aws-managed-rule-groups-use-case-linux-os
+    {
+        name: 'AWSManagedRuleLinux',
+        priority: 40,
+        visibilityConfig: {
+            sampledRequestsEnabled: true,
+            cloudWatchMetricsEnabled: true,
+            metricName: 'AWSManagedRuleLinux',
+        },
+        overrideAction: {
+            count: {},
+        },
+        statement: {
+            managedRuleGroupStatement: {
+                vendorName: 'AWS',
+                name: 'AWSManagedRulesLinuxRuleSet',
+                excludedRules: [{ name: 'LFI_URIPATH' }, { name: 'LFI_QUERYSTRING' }, { name: 'LFI_COOKIE' }],
+            },
+        },
+    },
+];
+
+/**
+ * Based on: https://github.com/aws-samples/http-api-aws-fargate-cdk/blob/master/cdk/singleAccount/lib/fargate-vpclink-stack.ts
+ *
+ * RDS config: https://docs.aws.amazon.com/cdk/api/latest/docs/aws-rds-readme.html
+ */
+class BackEnd extends constructs.Construct {
+    constructor(scope, config) {
+        super(scope, 'BackEnd');
+        const name = config.name;
+        // VPC
+        let vpc;
+        if (config.vpcId) {
+            // Lookup VPC by ARN
+            vpc = awsCdkLib.aws_ec2.Vpc.fromLookup(this, 'VPC', { vpcId: config.vpcId });
+        }
+        else {
+            // VPC Flow Logs
+            const vpcFlowLogs = new awsCdkLib.aws_logs.LogGroup(this, 'VpcFlowLogs', {
+                logGroupName: '/medplum/flowlogs/' + name,
+                removalPolicy: awsCdkLib.RemovalPolicy.DESTROY,
+            });
+            // Create VPC
+            vpc = new awsCdkLib.aws_ec2.Vpc(this, 'VPC', {
+                maxAzs: config.maxAzs,
+                flowLogs: {
+                    cloudwatch: {
+                        destination: awsCdkLib.aws_ec2.FlowLogDestination.toCloudWatchLogs(vpcFlowLogs),
+                        trafficType: awsCdkLib.aws_ec2.FlowLogTrafficType.ALL,
+                    },
+                },
+            });
+        }
+        // Bot Lambda Role
+        const botLambdaRole = new awsCdkLib.aws_iam.Role(this, 'BotLambdaRole', {
+            assumedBy: new awsCdkLib.aws_iam.ServicePrincipal('lambda.amazonaws.com'),
+        });
+        // RDS
+        let rdsCluster = undefined;
+        let rdsSecretsArn = config.rdsSecretsArn;
+        if (!rdsSecretsArn) {
+            rdsCluster = new awsCdkLib.aws_rds.DatabaseCluster(this, 'DatabaseCluster', {
+                engine: awsCdkLib.aws_rds.DatabaseClusterEngine.auroraPostgres({
+                    version: awsCdkLib.aws_rds.AuroraPostgresEngineVersion.VER_12_9,
+                }),
+                credentials: awsCdkLib.aws_rds.Credentials.fromGeneratedSecret('clusteradmin'),
+                defaultDatabaseName: 'medplum',
+                storageEncrypted: true,
+                instances: config.rdsInstances,
+                instanceProps: {
+                    vpc: vpc,
+                    vpcSubnets: {
+                        subnetType: awsCdkLib.aws_ec2.SubnetType.PRIVATE_WITH_EGRESS,
+                    },
+                    instanceType: config.rdsInstanceType ? new awsCdkLib.aws_ec2.InstanceType(config.rdsInstanceType) : undefined,
+                    enablePerformanceInsights: true,
+                },
+                backup: {
+                    retention: awsCdkLib.Duration.days(7),
+                },
+                cloudwatchLogsExports: ['postgresql'],
+                instanceUpdateBehaviour: awsCdkLib.aws_rds.InstanceUpdateBehaviour.ROLLING,
+            });
+            rdsSecretsArn = rdsCluster.secret.secretArn;
+        }
+        // Redis
+        // Important: For HIPAA compliance, you must specify TransitEncryptionEnabled as true, an AuthToken, and a CacheSubnetGroup.
+        const redisSubnetGroup = new awsCdkLib.aws_elasticache.CfnSubnetGroup(this, 'RedisSubnetGroup', {
+            description: 'Redis Subnet Group',
+            subnetIds: vpc.privateSubnets.map((subnet) => subnet.subnetId),
+        });
+        const redisSecurityGroup = new awsCdkLib.aws_ec2.SecurityGroup(this, 'RedisSecurityGroup', {
+            vpc,
+            description: 'Redis Security Group',
+            allowAllOutbound: false,
+        });
+        const redisPassword = new awsCdkLib.aws_secretsmanager.Secret(this, 'RedisPassword', {
+            generateSecretString: {
+                secretStringTemplate: '{}',
+                generateStringKey: 'password',
+                excludeCharacters: '@%*()_+=`~{}|[]\\:";\'?,./',
+            },
+        });
+        const redisCluster = new awsCdkLib.aws_elasticache.CfnReplicationGroup(this, 'RedisCluster', {
+            engine: 'Redis',
+            engineVersion: '6.x',
+            cacheNodeType: 'cache.t2.medium',
+            replicationGroupDescription: 'RedisReplicationGroup',
+            authToken: redisPassword.secretValueFromJson('password').toString(),
+            transitEncryptionEnabled: true,
+            atRestEncryptionEnabled: true,
+            multiAzEnabled: true,
+            cacheSubnetGroupName: redisSubnetGroup.ref,
+            numNodeGroups: 1,
+            replicasPerNodeGroup: 1,
+            securityGroupIds: [redisSecurityGroup.securityGroupId],
+        });
+        redisCluster.node.addDependency(redisPassword);
+        const redisSecrets = new awsCdkLib.aws_secretsmanager.Secret(this, 'RedisSecrets', {
+            generateSecretString: {
+                secretStringTemplate: JSON.stringify({
+                    host: redisCluster.attrPrimaryEndPointAddress,
+                    port: redisCluster.attrPrimaryEndPointPort,
+                    password: redisPassword.secretValueFromJson('password').toString(),
+                    tls: {},
+                }),
+                generateStringKey: 'unused',
+            },
+        });
+        redisSecrets.node.addDependency(redisPassword);
+        redisSecrets.node.addDependency(redisCluster);
+        // ECS Cluster
+        const cluster = new awsCdkLib.aws_ecs.Cluster(this, 'Cluster', {
+            vpc: vpc,
+        });
+        // Task Policies
+        const taskRolePolicies = new awsCdkLib.aws_iam.PolicyDocument({
+            statements: [
+                // CloudWatch Logs: Create streams and put events
+                new awsCdkLib.aws_iam.PolicyStatement({
+                    effect: awsCdkLib.aws_iam.Effect.ALLOW,
+                    actions: ['logs:CreateLogStream', 'logs:PutLogEvents'],
+                    resources: ['arn:aws:logs:*'],
+                }),
+                // Secrets Manager: Read only access to secrets
+                // https://docs.aws.amazon.com/mediaconnect/latest/ug/iam-policy-examples-asm-secrets.html
+                new awsCdkLib.aws_iam.PolicyStatement({
+                    effect: awsCdkLib.aws_iam.Effect.ALLOW,
+                    actions: [
+                        'secretsmanager:GetResourcePolicy',
+                        'secretsmanager:GetSecretValue',
+                        'secretsmanager:DescribeSecret',
+                        'secretsmanager:ListSecrets',
+                        'secretsmanager:ListSecretVersionIds',
+                    ],
+                    resources: ['arn:aws:secretsmanager:*'],
+                }),
+                // Parameter Store: Read only access
+                // https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-access.html
+                new awsCdkLib.aws_iam.PolicyStatement({
+                    effect: awsCdkLib.aws_iam.Effect.ALLOW,
+                    actions: ['ssm:GetParametersByPath', 'ssm:GetParameters', 'ssm:GetParameter', 'ssm:DescribeParameters'],
+                    resources: ['arn:aws:ssm:*'],
+                }),
+                // SES: Send emails
+                // https://docs.aws.amazon.com/ses/latest/dg/sending-authorization-policy-examples.html
+                new awsCdkLib.aws_iam.PolicyStatement({
+                    effect: awsCdkLib.aws_iam.Effect.ALLOW,
+                    actions: ['ses:SendEmail', 'ses:SendRawEmail'],
+                    resources: ['arn:aws:ses:*'],
+                }),
+                // S3: Read and write access to buckets
+                // https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html
+                new awsCdkLib.aws_iam.PolicyStatement({
+                    effect: awsCdkLib.aws_iam.Effect.ALLOW,
+                    actions: ['s3:ListBucket', 's3:GetObject', 's3:PutObject', 's3:DeleteObject'],
+                    resources: ['arn:aws:s3:::*'],
+                }),
+                // IAM: Pass role to innvoke lambda functions
+                // https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html
+                new awsCdkLib.aws_iam.PolicyStatement({
+                    effect: awsCdkLib.aws_iam.Effect.ALLOW,
+                    actions: ['iam:ListRoles', 'iam:GetRole', 'iam:PassRole'],
+                    resources: [botLambdaRole.roleArn],
+                }),
+                // Lambda: Create, read, update, delete, and invoke functions
+                // https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html
+                new awsCdkLib.aws_iam.PolicyStatement({
+                    effect: awsCdkLib.aws_iam.Effect.ALLOW,
+                    actions: [
+                        'lambda:CreateFunction',
+                        'lambda:GetFunction',
+                        'lambda:GetFunctionConfiguration',
+                        'lambda:UpdateFunctionCode',
+                        'lambda:UpdateFunctionConfiguration',
+                        'lambda:ListLayerVersions',
+                        'lambda:GetLayerVersion',
+                        'lambda:InvokeFunction',
+                    ],
+                    resources: ['arn:aws:lambda:*'],
+                }),
+            ],
+        });
+        // Task Role
+        const taskRole = new awsCdkLib.aws_iam.Role(this, 'TaskExecutionRole', {
+            assumedBy: new awsCdkLib.aws_iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
+            description: 'Medplum Server Task Execution Role',
+            inlinePolicies: {
+                TaskExecutionPolicies: taskRolePolicies,
+            },
+        });
+        // Task Definitions
+        const taskDefinition = new awsCdkLib.aws_ecs.FargateTaskDefinition(this, 'TaskDefinition', {
+            memoryLimitMiB: config.serverMemory,
+            cpu: config.serverCpu,
+            taskRole: taskRole,
+        });
+        // Log Groups
+        const logGroup = new awsCdkLib.aws_logs.LogGroup(this, 'LogGroup', {
+            logGroupName: '/ecs/medplum/' + name,
+            removalPolicy: awsCdkLib.RemovalPolicy.DESTROY,
+        });
+        const logDriver = new awsCdkLib.aws_ecs.AwsLogDriver({
+            logGroup: logGroup,
+            streamPrefix: 'Medplum',
+        });
+        // Task Containers
+        let serverImage = undefined;
+        // Pull out the image name and tag from the image URI if it's an ECR image
+        const ecrImageUriRegex = new RegExp(`^${config.accountNumber}\\.dkr\\.ecr\\.${config.region}\\.amazonaws\\.com/(.*)[:@](.*)$`);
+        const nameTagMatches = config.serverImage.match(ecrImageUriRegex);
+        const serverImageName = nameTagMatches?.[1];
+        const serverImageTag = nameTagMatches?.[2];
+        if (serverImageName && serverImageTag) {
+            // Creating an ecr repository image will automatically grant fine-grained permissions to ecs to access the image
+            const ecrRepo = awsEcr.Repository.fromRepositoryArn(this, 'ServerImageRepo', `arn:aws:ecr:${config.region}:${config.accountNumber}:repository/${serverImageName}`);
+            serverImage = awsCdkLib.aws_ecs.ContainerImage.fromEcrRepository(ecrRepo, serverImageTag);
+        }
+        else {
+            // Otherwise, use the standard container image
+            serverImage = awsCdkLib.aws_ecs.ContainerImage.fromRegistry(config.serverImage);
+        }
+        const serviceContainer = taskDefinition.addContainer('MedplumTaskDefinition', {
+            image: serverImage,
+            command: [config.region === 'us-east-1' ? `aws:/medplum/${name}/` : `aws:${config.region}:/medplum/${name}/`],
+            logging: logDriver,
+        });
+        serviceContainer.addPortMappings({
+            containerPort: config.apiPort,
+            hostPort: config.apiPort,
+        });
+        // Security Groups
+        const fargateSecurityGroup = new awsCdkLib.aws_ec2.SecurityGroup(this, 'ServiceSecurityGroup', {
+            allowAllOutbound: true,
+            securityGroupName: 'MedplumSecurityGroup',
+            vpc: vpc,
+        });
+        // Fargate Services
+        const fargateService = new awsCdkLib.aws_ecs.FargateService(this, 'FargateService', {
+            cluster: cluster,
+            taskDefinition: taskDefinition,
+            assignPublicIp: false,
+            vpcSubnets: {
+                subnetType: awsCdkLib.aws_ec2.SubnetType.PRIVATE_WITH_EGRESS,
+            },
+            desiredCount: config.desiredServerCount,
+            securityGroups: [fargateSecurityGroup],
+        });
+        // Load Balancer Target Group
+        const targetGroup = new awsCdkLib.aws_elasticloadbalancingv2.ApplicationTargetGroup(this, 'TargetGroup', {
+            vpc: vpc,
+            port: config.apiPort,
+            protocol: awsCdkLib.aws_elasticloadbalancingv2.ApplicationProtocol.HTTP,
+            healthCheck: {
+                path: '/healthcheck',
+                interval: awsCdkLib.Duration.seconds(30),
+                timeout: awsCdkLib.Duration.seconds(3),
+                healthyThresholdCount: 2,
+                unhealthyThresholdCount: 5,
+            },
+            targets: [fargateService],
+        });
+        // Load Balancer
+        const loadBalancer = new awsCdkLib.aws_elasticloadbalancingv2.ApplicationLoadBalancer(this, 'LoadBalancer', {
+            vpc: vpc,
+            internetFacing: true,
+            http2Enabled: true,
+        });
+        if (config.loadBalancerLoggingEnabled) {
+            // Load Balancer logging
+            loadBalancer.logAccessLogs(awsCdkLib.aws_s3.Bucket.fromBucketName(this, 'LoggingBucket', config.loadBalancerLoggingBucket), config.loadBalancerLoggingPrefix);
+        }
+        // HTTPS Listener
+        // Forward to the target group
+        loadBalancer.addListener('HttpsListener', {
+            port: 443,
+            certificates: [
+                {
+                    certificateArn: config.apiSslCertArn,
+                },
+            ],
+            sslPolicy: awsCdkLib.aws_elasticloadbalancingv2.SslPolicy.FORWARD_SECRECY_TLS12_RES_GCM,
+            defaultAction: awsCdkLib.aws_elasticloadbalancingv2.ListenerAction.forward([targetGroup]),
+        });
+        // WAF
+        const waf = new awsCdkLib.aws_wafv2.CfnWebACL(this, 'BackEndWAF', {
+            defaultAction: { allow: {} },
+            scope: 'REGIONAL',
+            name: `${config.stackName}-BackEndWAF`,
+            rules: awsManagedRules,
+            visibilityConfig: {
+                cloudWatchMetricsEnabled: true,
+                metricName: `${config.stackName}-BackEndWAF-Metric`,
+                sampledRequestsEnabled: false,
+            },
+        });
+        // Create an association between the load balancer and the WAF
+        const wafAssociation = new awsCdkLib.aws_wafv2.CfnWebACLAssociation(this, 'LoadBalancerAssociation', {
+            resourceArn: loadBalancer.loadBalancerArn,
+            webAclArn: waf.attrArn,
+        });
+        // Grant RDS access to the fargate group
+        if (rdsCluster) {
+            rdsCluster.connections.allowDefaultPortFrom(fargateSecurityGroup);
+        }
+        // Grant Redis access to the fargate group
+        redisSecurityGroup.addIngressRule(fargateSecurityGroup, awsCdkLib.aws_ec2.Port.tcp(6379));
+        // Route 53
+        const zone = awsCdkLib.aws_route53.HostedZone.fromLookup(this, 'Zone', {
+            domainName: config.domainName.split('.').slice(-2).join('.'),
+        });
+        // Route53 alias record for the load balancer
+        const record = new awsCdkLib.aws_route53.ARecord(this, 'LoadBalancerAliasRecord', {
+            recordName: config.apiDomainName,
+            target: awsCdkLib.aws_route53.RecordTarget.fromAlias(new awsCdkLib.aws_route53_targets.LoadBalancerTarget(loadBalancer)),
+            zone: zone,
+        });
+        // SSM Parameters
+        const databaseSecrets = new awsCdkLib.aws_ssm.StringParameter(this, 'DatabaseSecretsParameter', {
+            tier: awsCdkLib.aws_ssm.ParameterTier.STANDARD,
+            parameterName: `/medplum/${name}/DatabaseSecrets`,
+            description: 'Database secrets ARN',
+            stringValue: rdsSecretsArn,
+        });
+        const redisSecretsParameter = new awsCdkLib.aws_ssm.StringParameter(this, 'RedisSecretsParameter', {
+            tier: awsCdkLib.aws_ssm.ParameterTier.STANDARD,
+            parameterName: `/medplum/${name}/RedisSecrets`,
+            description: 'Redis secrets ARN',
+            stringValue: redisSecrets.secretArn,
+        });
+        const botLambdaRoleParameter = new awsCdkLib.aws_ssm.StringParameter(this, 'BotLambdaRoleParameter', {
+            tier: awsCdkLib.aws_ssm.ParameterTier.STANDARD,
+            parameterName: `/medplum/${name}/botLambdaRoleArn`,
+            description: 'Bot lambda execution role ARN',
+            stringValue: botLambdaRole.roleArn,
+        });
+        // Debug
+        console.log('ARecord', record.domainName);
+        console.log('DatabaseSecretsParameter', databaseSecrets.parameterArn);
+        console.log('RedisSecretsParameter', redisSecretsParameter.parameterArn);
+        console.log('RedisCluster', redisCluster.attrPrimaryEndPointAddress);
+        console.log('BotLambdaRole', botLambdaRoleParameter.stringValue);
+        console.log('WAF', waf.attrArn);
+        console.log('WAF Association', wafAssociation.node.id);
+    }
+}
+
+/**
+ * Static app infrastructure, which deploys app content to an S3 bucket.
+ *
+ * The app redirects from HTTP to HTTPS, using a CloudFront distribution,
+ * Route53 alias record, and ACM certificate.
+ */
+class FrontEnd extends constructs.Construct {
+    constructor(parent, config, region) {
+        super(parent, 'FrontEnd');
+        let appBucket;
+        if (region === config.region) {
+            // S3 bucket
+            appBucket = new awsCdkLib.aws_s3.Bucket(this, 'AppBucket', {
+                bucketName: config.appDomainName,
+                publicReadAccess: false,
+                blockPublicAccess: awsCdkLib.aws_s3.BlockPublicAccess.BLOCK_ALL,
+                removalPolicy: awsCdkLib.RemovalPolicy.DESTROY,
+                encryption: awsCdkLib.aws_s3.BucketEncryption.S3_MANAGED,
+                enforceSSL: true,
+                versioned: false,
+            });
+        }
+        else {
+            // Otherwise, reference the bucket by name and region
+            appBucket = awsCdkLib.aws_s3.Bucket.fromBucketAttributes(this, 'AppBucket', {
+                bucketName: config.appDomainName,
+                region: config.region,
+            });
+        }
+        if (region === 'us-east-1') {
+            // HTTP response headers policy
+            const responseHeadersPolicy = new awsCdkLib.aws_cloudfront.ResponseHeadersPolicy(this, 'ResponseHeadersPolicy', {
+                securityHeadersBehavior: {
+                    contentSecurityPolicy: {
+                        contentSecurityPolicy: [
+                            `default-src 'none'`,
+                            `base-uri 'self'`,
+                            `child-src 'self'`,
+                            `connect-src 'self' ${config.apiDomainName} *.google.com`,
+                            `font-src 'self' fonts.gstatic.com`,
+                            `form-action 'self' *.gstatic.com *.google.com`,
+                            `frame-ancestors 'none'`,
+                            `frame-src 'self' *.medplum.com *.gstatic.com *.google.com`,
+                            `img-src 'self' data: ${config.storageDomainName} *.gstatic.com *.google.com *.googleapis.com`,
+                            `manifest-src 'self'`,
+                            `media-src 'self' ${config.storageDomainName}`,
+                            `script-src 'self' *.medplum.com *.gstatic.com *.google.com`,
+                            `style-src 'self' 'unsafe-inline' *.medplum.com *.gstatic.com *.google.com`,
+                            `worker-src 'self' blob: *.gstatic.com *.google.com`,
+                            `upgrade-insecure-requests`,
+                        ].join('; '),
+                        override: true,
+                    },
+                    contentTypeOptions: { override: true },
+                    frameOptions: { frameOption: awsCdkLib.aws_cloudfront.HeadersFrameOption.DENY, override: true },
+                    strictTransportSecurity: {
+                        accessControlMaxAge: awsCdkLib.Duration.seconds(63072000),
+                        includeSubdomains: true,
+                        override: true,
+                    },
+                    xssProtection: {
+                        protection: true,
+                        modeBlock: true,
+                        override: true,
+                    },
+                },
+            });
+            // WAF
+            const waf = new awsCdkLib.aws_wafv2.CfnWebACL(this, 'FrontEndWAF', {
+                defaultAction: { allow: {} },
+                scope: 'CLOUDFRONT',
+                name: `${config.stackName}-FrontEndWAF`,
+                rules: awsManagedRules,
+                visibilityConfig: {
+                    cloudWatchMetricsEnabled: true,
+                    metricName: `${config.stackName}-FrontEndWAF-Metric`,
+                    sampledRequestsEnabled: false,
+                },
+            });
+            // API Origin Cache Policy
+            const apiOriginCachePolicy = new awsCdkLib.aws_cloudfront.CachePolicy(this, 'ApiOriginCachePolicy', {
+                cachePolicyName: `${config.stackName}-ApiOriginCachePolicy`,
+                cookieBehavior: awsCdkLib.aws_cloudfront.CacheCookieBehavior.all(),
+                headerBehavior: awsCdkLib.aws_cloudfront.CacheHeaderBehavior.allowList('Authorization', 'Content-Encoding', 'Content-Type', 'If-None-Match', 'Origin', 'Referer', 'User-Agent', 'X-Medplum'),
+                queryStringBehavior: awsCdkLib.aws_cloudfront.CacheQueryStringBehavior.all(),
+            });
+            // Origin access identity
+            const originAccessIdentity = new awsCdkLib.aws_cloudfront.OriginAccessIdentity(this, 'OriginAccessIdentity', {});
+            appBucket.grantRead(originAccessIdentity);
+            // CloudFront distribution
+            const distribution = new awsCdkLib.aws_cloudfront.Distribution(this, 'AppDistribution', {
+                defaultRootObject: 'index.html',
+                defaultBehavior: {
+                    origin: new awsCdkLib.aws_cloudfront_origins.S3Origin(appBucket, { originAccessIdentity }),
+                    responseHeadersPolicy,
+                    viewerProtocolPolicy: awsCdkLib.aws_cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+                },
+                additionalBehaviors: {
+                    '/api/*': {
+                        origin: new awsCdkLib.aws_cloudfront_origins.HttpOrigin(config.apiDomainName),
+                        allowedMethods: awsCdkLib.aws_cloudfront.AllowedMethods.ALLOW_ALL,
+                        cachePolicy: apiOriginCachePolicy,
+                        viewerProtocolPolicy: awsCdkLib.aws_cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+                    },
+                },
+                certificate: awsCdkLib.aws_certificatemanager.Certificate.fromCertificateArn(this, 'AppCertificate', config.appSslCertArn),
+                domainNames: [config.appDomainName],
+                errorResponses: [
+                    {
+                        httpStatus: 403,
+                        responseHttpStatus: 200,
+                        responsePagePath: '/index.html',
+                    },
+                    {
+                        httpStatus: 404,
+                        responseHttpStatus: 200,
+                        responsePagePath: '/index.html',
+                    },
+                ],
+                webAclId: waf.attrArn,
+            });
+            const zone = awsCdkLib.aws_route53.HostedZone.fromLookup(this, 'Zone', {
+                domainName: config.domainName.split('.').slice(-2).join('.'),
+            });
+            // Route53 alias record for the CloudFront distribution
+            const record = new awsCdkLib.aws_route53.ARecord(this, 'AppAliasRecord', {
+                recordName: config.appDomainName,
+                target: awsCdkLib.aws_route53.RecordTarget.fromAlias(new awsCdkLib.aws_route53_targets.CloudFrontTarget(distribution)),
+                zone,
+            });
+            // Debug
+            console.log('ARecord', record.domainName);
+        }
+    }
+}
+
+/**
+ * Binary storage bucket and CloudFront distribution.
+ */
+class Storage extends constructs.Construct {
+    constructor(parent, config, region) {
+        super(parent, 'Storage');
+        let storageBucket;
+        if (region === config.region) {
+            // S3 bucket
+            storageBucket = new awsCdkLib.aws_s3.Bucket(this, 'StorageBucket', {
+                bucketName: config.storageBucketName,
+                publicReadAccess: false,
+                blockPublicAccess: awsCdkLib.aws_s3.BlockPublicAccess.BLOCK_ALL,
+                encryption: awsCdkLib.aws_s3.BucketEncryption.S3_MANAGED,
+                enforceSSL: true,
+                versioned: false,
+            });
+            if (config.clamscanEnabled) {
+                // ClamAV serverless scan
+                const sc = new cdkServerlessClamscan.ServerlessClamscan(this, 'ServerlessClamscan', {
+                    defsBucketAccessLogsConfig: {
+                        logsBucket: awsCdkLib.aws_s3.Bucket.fromBucketName(this, 'LoggingBucket', config.clamscanLoggingBucket),
+                        logsPrefix: config.clamscanLoggingPrefix,
+                    },
+                });
+                sc.addSourceBucket(storageBucket);
+            }
+        }
+        else {
+            // Otherwise, reference the bucket by name
+            storageBucket = awsCdkLib.aws_s3.Bucket.fromBucketAttributes(this, 'StorageBucket', {
+                bucketName: config.storageBucketName,
+                region: config.region,
+            });
+        }
+        if (region === 'us-east-1') {
+            // Public key in PEM format
+            const publicKey = new awsCdkLib.aws_cloudfront.PublicKey(this, 'StoragePublicKey', {
+                encodedKey: config.storagePublicKey,
+            });
+            // Authorized key group for presigned URLs
+            const keyGroup = new awsCdkLib.aws_cloudfront.KeyGroup(this, 'StorageKeyGroup', {
+                items: [publicKey],
+            });
+            // HTTP response headers policy
+            const responseHeadersPolicy = new awsCdkLib.aws_cloudfront.ResponseHeadersPolicy(this, 'ResponseHeadersPolicy', {
+                securityHeadersBehavior: {
+                    contentSecurityPolicy: {
+                        contentSecurityPolicy: "default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors *.medplum.com;",
+                        override: true,
+                    },
+                    contentTypeOptions: { override: true },
+                    frameOptions: { frameOption: awsCdkLib.aws_cloudfront.HeadersFrameOption.DENY, override: true },
+                    referrerPolicy: { referrerPolicy: awsCdkLib.aws_cloudfront.HeadersReferrerPolicy.NO_REFERRER, override: true },
+                    strictTransportSecurity: {
+                        accessControlMaxAge: awsCdkLib.Duration.seconds(63072000),
+                        includeSubdomains: true,
+                        override: true,
+                    },
+                    xssProtection: {
+                        protection: true,
+                        modeBlock: true,
+                        override: true,
+                    },
+                },
+            });
+            // WAF
+            const waf = new awsCdkLib.aws_wafv2.CfnWebACL(this, 'StorageWAF', {
+                defaultAction: { allow: {} },
+                scope: 'CLOUDFRONT',
+                name: `${config.stackName}-StorageWAF`,
+                rules: awsManagedRules,
+                visibilityConfig: {
+                    cloudWatchMetricsEnabled: true,
+                    metricName: `${config.stackName}-StorageWAF-Metric`,
+                    sampledRequestsEnabled: false,
+                },
+            });
+            // Origin access identity
+            const originAccessIdentity = new awsCdkLib.aws_cloudfront.OriginAccessIdentity(this, 'OriginAccessIdentity', {});
+            storageBucket.grantRead(originAccessIdentity);
+            // CloudFront distribution
+            const distribution = new awsCdkLib.aws_cloudfront.Distribution(this, 'StorageDistribution', {
+                defaultBehavior: {
+                    origin: new awsCdkLib.aws_cloudfront_origins.S3Origin(storageBucket, { originAccessIdentity }),
+                    responseHeadersPolicy,
+                    viewerProtocolPolicy: awsCdkLib.aws_cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+                    trustedKeyGroups: [keyGroup],
+                },
+                certificate: awsCdkLib.aws_certificatemanager.Certificate.fromCertificateArn(this, 'StorageCertificate', config.storageSslCertArn),
+                domainNames: [config.storageDomainName],
+                webAclId: waf.attrArn,
+            });
+            const zone = awsCdkLib.aws_route53.HostedZone.fromLookup(this, 'Zone', {
+                domainName: config.domainName.split('.').slice(-2).join('.'),
+            });
+            // Route53 alias record for the CloudFront distribution
+            const record = new awsCdkLib.aws_route53.ARecord(this, 'StorageAliasRecord', {
+                recordName: config.storageDomainName,
+                target: awsCdkLib.aws_route53.RecordTarget.fromAlias(new awsCdkLib.aws_route53_targets.CloudFrontTarget(distribution)),
+                zone,
+            });
+            // Debug
+            console.log('ARecord', record.domainName);
+        }
+    }
+}
+
+class MedplumStack {
+    constructor(scope, config) {
+        this.primaryStack = new awsCdkLib.Stack(scope, config.stackName, {
+            env: {
+                region: config.region,
+                account: config.accountNumber,
+            },
+        });
+        this.backEnd = new BackEnd(this.primaryStack, config);
+        this.frontEnd = new FrontEnd(this.primaryStack, config, config.region);
+        this.storage = new Storage(this.primaryStack, config, config.region);
+        if (config.region !== 'us-east-1') {
+            // Some resources must be created in us-east-1
+            // For example, CloudFront distributions and ACM certificates
+            // If the primary region is not us-east-1, create these resources in us-east-1
+            const usEast1Stack = new awsCdkLib.Stack(scope, config.stackName + '-us-east-1', {
+                env: {
+                    region: 'us-east-1',
+                    account: config.accountNumber,
+                },
+            });
+            this.frontEnd = new FrontEnd(usEast1Stack, config, 'us-east-1');
+            this.storage = new Storage(usEast1Stack, config, 'us-east-1');
+        }
+    }
+}
+function main(context) {
+    const app = new awsCdkLib.App({ context });
+    const configFileName = app.node.tryGetContext('config');
+    if (!configFileName) {
+        console.log('Missing "config" context variable');
+        console.log('Usage: cdk deploy -c config=my-config.json');
+        return;
+    }
+    const config = JSON.parse(fs.readFileSync(path.resolve(configFileName), 'utf-8'));
+    const stack = new MedplumStack(app, config);
+    console.log('Stack', stack.primaryStack.stackId);
+    console.log('BackEnd', stack.backEnd.node.id);
+    console.log('FrontEnd', stack.frontEnd.node.id);
+    console.log('Storage', stack.storage.node.id);
+    app.synth();
+}
+if (require.main === module) {
+    main();
+}
+
+exports.main = main;
+//# sourceMappingURL=index.cjs.map