@medplum/cdk 2.1.17 → 2.1.19

package/src/storage.ts

@@ -1,157 +0,0 @@
-import { MedplumInfraConfig } from '@medplum/core';
-import {
-  aws_certificatemanager as acm,
-  aws_cloudfront as cloudfront,
-  Duration,
-  aws_iam as iam,
-  aws_cloudfront_origins as origins,
-  aws_route53 as route53,
-  aws_s3 as s3,
-  aws_route53_targets as targets,
-  aws_wafv2 as wafv2,
-} from 'aws-cdk-lib';
-import { ServerlessClamscan } from 'cdk-serverless-clamscan';
-import { Construct } from 'constructs';
-import { grantBucketAccessToOriginAccessIdentity } from './oai';
-import { awsManagedRules } from './waf';
-
-/**
- * Binary storage bucket and CloudFront distribution.
- */
-export class Storage extends Construct {
-  storageBucket: s3.IBucket;
-  keyGroup?: cloudfront.IKeyGroup;
-  responseHeadersPolicy?: cloudfront.IResponseHeadersPolicy;
-  waf?: wafv2.CfnWebACL;
-  originAccessIdentity?: cloudfront.OriginAccessIdentity;
-  originAccessPolicyStatement?: iam.PolicyStatement;
-  distribution?: cloudfront.IDistribution;
-  dnsRecord?: route53.IRecordSet;
-
-  constructor(parent: Construct, config: MedplumInfraConfig, region: string) {
-    super(parent, 'Storage');
-
-    if (region === config.region) {
-      // S3 bucket
-      this.storageBucket = new s3.Bucket(this, 'StorageBucket', {
-        bucketName: config.storageBucketName,
-        publicReadAccess: false,
-        blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
-        encryption: s3.BucketEncryption.S3_MANAGED,
-        enforceSSL: true,
-        versioned: true,
-      });
-
-      if (config.clamscanEnabled) {
-        // ClamAV serverless scan
-        const sc = new ServerlessClamscan(this, 'ServerlessClamscan', {
-          defsBucketAccessLogsConfig: {
-            logsBucket: s3.Bucket.fromBucketName(this, 'LoggingBucket', config.clamscanLoggingBucket),
-            logsPrefix: config.clamscanLoggingPrefix,
-          },
-        });
-        sc.addSourceBucket(this.storageBucket);
-      }
-    } else {
-      // Otherwise, reference the bucket by name and region
-      this.storageBucket = s3.Bucket.fromBucketAttributes(this, 'StorageBucket', {
-        bucketName: config.storageBucketName,
-        region: config.region,
-      });
-    }
-
-    if (region === 'us-east-1') {
-      // Public key in PEM format
-      let publicKey: cloudfront.IPublicKey;
-      if (config.signingKeyId) {
-        publicKey = cloudfront.PublicKey.fromPublicKeyId(this, 'StoragePublicKey', config.signingKeyId);
-      } else {
-        publicKey = new cloudfront.PublicKey(this, 'StoragePublicKey', {
-          encodedKey: config.storagePublicKey,
-        });
-      }
-
-      // Authorized key group for presigned URLs
-      this.keyGroup = new cloudfront.KeyGroup(this, 'StorageKeyGroup', {
-        items: [publicKey],
-      });
-
-      // HTTP response headers policy
-      this.responseHeadersPolicy = new cloudfront.ResponseHeadersPolicy(this, 'ResponseHeadersPolicy', {
-        securityHeadersBehavior: {
-          contentSecurityPolicy: {
-            contentSecurityPolicy:
-              "default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors *.medplum.com;",
-            override: true,
-          },
-          contentTypeOptions: { override: true },
-          frameOptions: { frameOption: cloudfront.HeadersFrameOption.DENY, override: true },
-          referrerPolicy: { referrerPolicy: cloudfront.HeadersReferrerPolicy.NO_REFERRER, override: true },
-          strictTransportSecurity: {
-            accessControlMaxAge: Duration.seconds(63072000),
-            includeSubdomains: true,
-            override: true,
-          },
-          xssProtection: {
-            protection: true,
-            modeBlock: true,
-            override: true,
-          },
-        },
-      });
-
-      // WAF
-      this.waf = new wafv2.CfnWebACL(this, 'StorageWAF', {
-        defaultAction: { allow: {} },
-        scope: 'CLOUDFRONT',
-        name: `${config.stackName}-StorageWAF`,
-        rules: awsManagedRules,
-        visibilityConfig: {
-          cloudWatchMetricsEnabled: true,
-          metricName: `${config.stackName}-StorageWAF-Metric`,
-          sampledRequestsEnabled: false,
-        },
-      });
-
-      // Origin access identity
-      this.originAccessIdentity = new cloudfront.OriginAccessIdentity(this, 'OriginAccessIdentity', {});
-      this.originAccessPolicyStatement = grantBucketAccessToOriginAccessIdentity(
-        this.storageBucket,
-        this.originAccessIdentity
-      );
-
-      // CloudFront distribution
-      this.distribution = new cloudfront.Distribution(this, 'StorageDistribution', {
-        defaultBehavior: {
-          origin: new origins.S3Origin(this.storageBucket, {
-            originAccessIdentity: this.originAccessIdentity,
-          }),
-          responseHeadersPolicy: this.responseHeadersPolicy,
-          viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
-          trustedKeyGroups: [this.keyGroup],
-        },
-        certificate: acm.Certificate.fromCertificateArn(this, 'StorageCertificate', config.storageSslCertArn),
-        domainNames: [config.storageDomainName],
-        webAclId: this.waf.attrArn,
-        logBucket: config.storageLoggingBucket
-          ? s3.Bucket.fromBucketName(this, 'LoggingBucket', config.storageLoggingBucket)
-          : undefined,
-        logFilePrefix: config.storageLoggingPrefix,
-      });
-
-      // DNS
-      if (!config.skipDns) {
-        const zone = route53.HostedZone.fromLookup(this, 'Zone', {
-          domainName: config.domainName.split('.').slice(-2).join('.'),
-        });
-
-        // Route53 alias record for the CloudFront distribution
-        this.dnsRecord = new route53.ARecord(this, 'StorageAliasRecord', {
-          recordName: config.storageDomainName,
-          target: route53.RecordTarget.fromAlias(new targets.CloudFrontTarget(this.distribution)),
-          zone,
-        });
-      }
-    }
-  }
-}

package/src/waf.ts

@@ -1,122 +0,0 @@
-// Based on https://gist.github.com/statik/f1ac9d6227d98d30c7a7cec0c83f4e64
-
-import { aws_wafv2 as wafv2 } from 'aws-cdk-lib';
-
-export const awsManagedRules: wafv2.CfnWebACL.RuleProperty[] = [
-  // Common Rule Set aligns with major portions of OWASP Core Rule Set
-  // https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html
-  {
-    name: 'AWS-AWSManagedRulesCommonRuleSet',
-    priority: 10,
-    statement: {
-      managedRuleGroupStatement: {
-        vendorName: 'AWS',
-        name: 'AWSManagedRulesCommonRuleSet',
-        // Excluding generic RFI body rule for sns notifications
-        // https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-list.html
-        excludedRules: [
-          { name: 'NoUserAgent_HEADER' },
-          { name: 'UserAgent_BadBots_HEADER' },
-          { name: 'SizeRestrictions_QUERYSTRING' },
-          { name: 'SizeRestrictions_Cookie_HEADER' },
-          { name: 'SizeRestrictions_BODY' },
-          { name: 'SizeRestrictions_URIPATH' },
-          { name: 'EC2MetaDataSSRF_BODY' },
-          { name: 'EC2MetaDataSSRF_COOKIE' },
-          { name: 'EC2MetaDataSSRF_URIPATH' },
-          { name: 'EC2MetaDataSSRF_QUERYARGUMENTS' },
-          { name: 'GenericLFI_QUERYARGUMENTS' },
-          { name: 'GenericLFI_URIPATH' },
-          { name: 'GenericLFI_BODY' },
-          { name: 'RestrictedExtensions_URIPATH' },
-          { name: 'RestrictedExtensions_QUERYARGUMENTS' },
-          { name: 'GenericRFI_QUERYARGUMENTS' },
-          { name: 'GenericRFI_BODY' },
-          { name: 'GenericRFI_URIPATH' },
-          { name: 'CrossSiteScripting_COOKIE' },
-          { name: 'CrossSiteScripting_QUERYARGUMENTS' },
-          { name: 'CrossSiteScripting_BODY' },
-          { name: 'CrossSiteScripting_URIPATH' },
-        ],
-      },
-    },
-    overrideAction: {
-      count: {},
-    },
-    visibilityConfig: {
-      sampledRequestsEnabled: true,
-      cloudWatchMetricsEnabled: true,
-      metricName: 'AWS-AWSManagedRulesCommonRuleSet',
-    },
-  },
-  // AWS IP Reputation list includes known malicious actors/bots and is regularly updated
-  // https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-ip-rep.html
-  {
-    name: 'AWS-AWSManagedRulesAmazonIpReputationList',
-    priority: 20,
-    statement: {
-      managedRuleGroupStatement: {
-        vendorName: 'AWS',
-        name: 'AWSManagedRulesAmazonIpReputationList',
-        excludedRules: [{ name: 'AWSManagedIPReputationList' }, { name: 'AWSManagedReconnaissanceList' }],
-      },
-    },
-    overrideAction: {
-      count: {},
-    },
-    visibilityConfig: {
-      sampledRequestsEnabled: true,
-      cloudWatchMetricsEnabled: true,
-      metricName: 'AWSManagedRulesAmazonIpReputationList',
-    },
-  },
-  // Blocks common SQL Injection
-  // https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-use-case.html#aws-managed-rule-groups-use-case-sql-db
-  {
-    name: 'AWSManagedRulesSQLiRuleSet',
-    priority: 30,
-    visibilityConfig: {
-      sampledRequestsEnabled: true,
-      cloudWatchMetricsEnabled: true,
-      metricName: 'AWSManagedRulesSQLiRuleSet',
-    },
-    overrideAction: {
-      count: {},
-    },
-    statement: {
-      managedRuleGroupStatement: {
-        vendorName: 'AWS',
-        name: 'AWSManagedRulesSQLiRuleSet',
-        excludedRules: [
-          { name: 'SQLi_QUERYARGUMENTS' },
-          { name: 'SQLiExtendedPatterns_QUERYARGUMENTS' },
-          { name: 'SQLi_BODY' },
-          { name: 'SQLiExtendedPatterns_BODY' },
-          { name: 'SQLi_COOKIE' },
-          { name: 'SQLi_URIPATH' },
-        ],
-      },
-    },
-  },
-  // Blocks attacks targeting LFI(Local File Injection) for linux systems
-  // https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-use-case.html#aws-managed-rule-groups-use-case-linux-os
-  {
-    name: 'AWSManagedRuleLinux',
-    priority: 40,
-    visibilityConfig: {
-      sampledRequestsEnabled: true,
-      cloudWatchMetricsEnabled: true,
-      metricName: 'AWSManagedRuleLinux',
-    },
-    overrideAction: {
-      count: {},
-    },
-    statement: {
-      managedRuleGroupStatement: {
-        vendorName: 'AWS',
-        name: 'AWSManagedRulesLinuxRuleSet',
-        excludedRules: [{ name: 'LFI_URIPATH' }, { name: 'LFI_QUERYSTRING' }, { name: 'LFI_COOKIE' }],
-      },
-    },
-  },
-];

package/tsconfig.build.json

@@ -1,9 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "outDir": "dist/types",
-    "noEmit": false,
-    "emitDeclarationOnly": true
-  },
-  "exclude": ["**/*.test.ts"]
-}

package/tsconfig.json

@@ -1,8 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": {
-    "outDir": "dist",
-    "lib": ["esnext"]
-  },
-  "include": ["src/**/*.ts"]
-}