@medplum/cdk 2.1.8 → 2.1.10

package/dist/types/backend.d.ts

@@ -45,3 +45,4 @@ export declare class BackEnd extends Construct {
      */
     private getContainerImage;
 }
+//# sourceMappingURL=backend.d.ts.map

package/dist/types/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAGL,OAAO,IAAI,GAAG,EACd,OAAO,IAAI,GAAG,EACd,eAAe,IAAI,WAAW,EAC9B,0BAA0B,IAAI,KAAK,EACnC,OAAO,IAAI,GAAG,EACd,QAAQ,IAAI,IAAI,EAChB,OAAO,IAAI,GAAG,EACd,WAAW,IAAI,OAAO,EAEtB,kBAAkB,IAAI,cAAc,EACpC,OAAO,IAAI,GAAG,EAEd,SAAS,IAAI,KAAK,EACnB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvC;;;;GAIG;AACH,qBAAa,OAAQ,SAAQ,SAAS;IACpC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC;IACd,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,GAAG,CAAC,eAAe,CAAC;IACjC,gBAAgB,EAAE,WAAW,CAAC,cAAc,CAAC;IAC7C,kBAAkB,EAAE,GAAG,CAAC,aAAa,CAAC;IACtC,aAAa,EAAE,cAAc,CAAC,OAAO,CAAC;IACtC,YAAY,EAAE,WAAW,CAAC,mBAAmB,CAAC;IAC9C,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC;IACrC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC;IACxB,gBAAgB,EAAE,GAAG,CAAC,cAAc,CAAC;IACrC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC;IACnB,cAAc,EAAE,GAAG,CAAC,qBAAqB,CAAC;IAC1C,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;IACzB,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC;IAC5B,gBAAgB,EAAE,GAAG,CAAC,mBAAmB,CAAC;IAC1C,oBAAoB,EAAE,GAAG,CAAC,aAAa,CAAC;IACxC,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC;IACnC,WAAW,EAAE,KAAK,CAAC,sBAAsB,CAAC;IAC1C,YAAY,EAAE,KAAK,CAAC,uBAAuB,CAAC;IAC5C,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC;IACrB,cAAc,EAAE,KAAK,CAAC,oBAAoB,CAAC;IAC3C,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC;IAC5B,eAAe,EAAE,GAAG,CAAC,eAAe,CAAC;IACrC,wBAAwB,EAAE,GAAG,CAAC,eAAe,CAAC;IAC9C,qBAAqB,EAAE,GAAG,CAAC,eAAe,CAAC;IAC3C,sBAAsB,EAAE,GAAG,CAAC,eAAe,CAAC;gBAEhC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB;IAmZxD;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;CAqB1B"}

package/dist/types/cloudtrail.d.ts

@@ -9,3 +9,4 @@ export declare class CloudTrailAlarms extends Construct {
     constructor(scope: Construct, config: MedplumInfraConfig);
     createMetricAlarm(name: string, filterPattern: string): void;
 }
+//# sourceMappingURL=cloudtrail.d.ts.map

package/dist/types/cloudtrail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudtrail.d.ts","sourceRoot":"","sources":["../../src/cloudtrail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EACL,cAAc,IAAI,UAAU,EAG5B,QAAQ,IAAI,IAAI,EAChB,OAAO,IAAI,GAAG,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,MAAM,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC;IAC9B,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC;gBAEZ,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB;IA2FxD,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;CA0B7D"}

package/dist/types/config.d.ts

@@ -0,0 +1,18 @@
+import { ExternalSecret, ExternalSecretPrimitive, ExternalSecretPrimitiveType, MedplumInfraConfig, MedplumSourceInfraConfig } from '@medplum/core';
+export declare class InfraConfigNormalizer {
+    private config;
+    private clients;
+    constructor(config: MedplumSourceInfraConfig);
+    fetchParameterStoreSecret(key: string): Promise<string>;
+    fetchExternalSecret(externalSecret: ExternalSecret): Promise<ExternalSecretPrimitive>;
+    normalizeInfraConfigArray(currentVal: any[]): Promise<ExternalSecretPrimitive[] | Record<string, any>[]>;
+    normalizeValueForKey(obj: Record<string, any>, key: string): Promise<void>;
+    normalizeObjectInInfraConfig(obj: Record<string, any>): Promise<Record<string, any>>;
+    normalizeConfig(): Promise<MedplumInfraConfig>;
+}
+export declare function normalizeFetchedValue(key: string, rawValue: ExternalSecretPrimitive, expectedType: ExternalSecretPrimitiveType): ExternalSecretPrimitive;
+export declare function isExternalSecretLike(obj: Record<string, any>): obj is ExternalSecret;
+export declare function isExternalSecret(obj: Record<string, any>): obj is ExternalSecret;
+export declare function assertValidExternalSecret(obj: Record<string, any>): asserts obj is ExternalSecret;
+export declare function normalizeInfraConfig(config: MedplumSourceInfraConfig): Promise<MedplumInfraConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/types/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,2BAA2B,EAC3B,kBAAkB,EAClB,wBAAwB,EAIzB,MAAM,eAAe,CAAC;AAKvB,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,OAAO,CAAqB;gBACxB,MAAM,EAAE,wBAAwB;IAYtC,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA0BvD,mBAAmB,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAiBrF,yBAAyB,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,uBAAuB,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;IA0BxG,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqB1E,4BAA4B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IASpF,eAAe,IAAI,OAAO,CAAC,kBAAkB,CAAC;CAGrD;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,uBAAuB,EACjC,YAAY,EAAE,2BAA2B,GACxC,uBAAuB,CAiCzB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,IAAI,cAAc,CAOpF;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,IAAI,cAAc,CAOhF;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,IAAI,cAAc,CAMjG;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAExG"}

package/dist/types/frontend.d.ts

@@ -18,3 +18,4 @@ export declare class FrontEnd extends Construct {
     dnsRecord?: route53.IRecordSet;
     constructor(parent: Construct, config: MedplumInfraConfig, region: string);
 }
+//# sourceMappingURL=frontend.d.ts.map

package/dist/types/frontend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend.d.ts","sourceRoot":"","sources":["../../src/frontend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAEL,cAAc,IAAI,UAAU,EAE5B,OAAO,IAAI,GAAG,EAGd,WAAW,IAAI,OAAO,EACtB,MAAM,IAAI,EAAE,EAEZ,SAAS,IAAI,KAAK,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,SAAS;IACrC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC;IACtB,qBAAqB,CAAC,EAAE,UAAU,CAAC,sBAAsB,CAAC;IAC1D,GAAG,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACtB,oBAAoB,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC;IAC/C,oBAAoB,CAAC,EAAE,UAAU,CAAC,oBAAoB,CAAC;IACvD,2BAA2B,CAAC,EAAE,GAAG,CAAC,eAAe,CAAC;IAClD,YAAY,CAAC,EAAE,UAAU,CAAC,aAAa,CAAC;IACxC,SAAS,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC;gBAEnB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM;CA0J1E"}

package/dist/types/index.d.ts

@@ -5,3 +5,4 @@ export * from './stack';
 export * from './storage';
 export * from './waf';
 export declare function main(context?: Record<string, string>): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAOA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,OAAO,CAAC;AAEtB,wBAAgB,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAuB3D"}

package/dist/types/oai.d.ts

@@ -16,3 +16,4 @@ import { aws_cloudfront as cloudfront, aws_iam as iam, aws_s3 as s3 } from 'aws-
  * @returns The policy statement.
  */
 export declare function grantBucketAccessToOriginAccessIdentity(bucket: s3.IBucket, identity: cloudfront.OriginAccessIdentity): iam.PolicyStatement;
+//# sourceMappingURL=oai.d.ts.map

package/dist/types/oai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oai.d.ts","sourceRoot":"","sources":["../../src/oai.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,IAAI,UAAU,EAAE,OAAO,IAAI,GAAG,EAAE,MAAM,IAAI,EAAE,EAAE,MAAM,aAAa,CAAC;AAEzF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uCAAuC,CACrD,MAAM,EAAE,EAAE,CAAC,OAAO,EAClB,QAAQ,EAAE,UAAU,CAAC,oBAAoB,GACxC,GAAG,CAAC,eAAe,CAUrB"}

package/dist/types/stack.d.ts

@@ -22,3 +22,4 @@ export declare class MedplumGlobalStack extends Stack {
     cloudTrail: CloudTrailAlarms;
     constructor(scope: App, config: MedplumInfraConfig);
 }
+//# sourceMappingURL=stack.d.ts.map

package/dist/types/stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack.d.ts","sourceRoot":"","sources":["../../src/stack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAQ,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,qBAAa,YAAY;IACvB,YAAY,EAAE,mBAAmB,CAAC;IAClC,WAAW,CAAC,EAAE,kBAAkB,CAAC;gBAErB,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB;CAWnD;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,gBAAgB,CAAC;gBAEjB,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB;CAcnD;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,gBAAgB,CAAC;gBAEjB,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB;CAanD"}

package/dist/types/storage.d.ts

@@ -15,3 +15,4 @@ export declare class Storage extends Construct {
     dnsRecord?: route53.IRecordSet;
     constructor(parent: Construct, config: MedplumInfraConfig, region: string);
 }
+//# sourceMappingURL=storage.d.ts.map

package/dist/types/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAEL,cAAc,IAAI,UAAU,EAE5B,OAAO,IAAI,GAAG,EAEd,WAAW,IAAI,OAAO,EACtB,MAAM,IAAI,EAAE,EAEZ,SAAS,IAAI,KAAK,EACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC;;GAEG;AACH,qBAAa,OAAQ,SAAQ,SAAS;IACpC,aAAa,EAAE,EAAE,CAAC,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC;IAChC,qBAAqB,CAAC,EAAE,UAAU,CAAC,sBAAsB,CAAC;IAC1D,GAAG,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACtB,oBAAoB,CAAC,EAAE,UAAU,CAAC,oBAAoB,CAAC;IACvD,2BAA2B,CAAC,EAAE,GAAG,CAAC,eAAe,CAAC;IAClD,YAAY,CAAC,EAAE,UAAU,CAAC,aAAa,CAAC;IACxC,SAAS,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC;gBAEnB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM;CA8H1E"}

package/dist/types/waf.d.ts

@@ -1,2 +1,3 @@
 import { aws_wafv2 as wafv2 } from 'aws-cdk-lib';
 export declare const awsManagedRules: wafv2.CfnWebACL.RuleProperty[];
+//# sourceMappingURL=waf.d.ts.map

package/dist/types/waf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waf.d.ts","sourceRoot":"","sources":["../../src/waf.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,aAAa,CAAC;AAEjD,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY,EAqHzD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@medplum/cdk",
-  "version": "2.1.8",
+  "version": "2.1.10",
   "description": "Medplum CDK Infra as Code",
   "author": "Medplum <hello@medplum.com>",
   "license": "Apache-2.0",

package/src/backend.ts

@@ -1,6 +1,7 @@
 import { MedplumInfraConfig } from '@medplum/core';
 import {
   Duration,
+  RemovalPolicy,
   aws_ec2 as ec2,
   aws_ecs as ecs,
   aws_elasticache as elasticache,
@@ -8,7 +9,6 @@ import {
   aws_iam as iam,
   aws_logs as logs,
   aws_rds as rds,
-  RemovalPolicy,
   aws_route53 as route53,
   aws_s3 as s3,
   aws_secretsmanager as secretsmanager,

package/src/config.test.ts

@@ -0,0 +1,487 @@
+import { GetParameterCommand, SSMClient } from '@aws-sdk/client-ssm';
+import { ExternalSecret, MedplumInfraConfig, MedplumSourceInfraConfig, OperationOutcomeError } from '@medplum/core';
+import { AwsClientStub, mockClient } from 'aws-sdk-client-mock';
+import 'aws-sdk-client-mock-jest';
+import {
+  InfraConfigNormalizer,
+  assertValidExternalSecret,
+  isExternalSecret,
+  normalizeFetchedValue,
+  normalizeInfraConfig,
+} from './config';
+
+const baseConfig = {
+  name: 'MyMedplumApp',
+  stackName: { system: 'aws_ssm_parameter_store', key: 'stackName', type: 'string' },
+  accountNumber: 'medplum123',
+  region: 'us-east-1',
+  domainName: 'foomedical.com',
+  vpcId: 'abc-321123',
+  apiPort: { system: 'aws_ssm_parameter_store', key: 'apiPort', type: 'number' },
+  apiDomainName: { system: 'aws_ssm_parameter_store', key: 'apiDomainName', type: 'string' },
+  apiSslCertArn: { system: 'aws_ssm_parameter_store', key: 'apiSslCertArn', type: 'string' },
+  apiInternetFacing: true,
+  appDomainName: 'app.foomedical.com',
+  appSslCertArn: 'arn:abc-123',
+  appApiProxy: { system: 'aws_ssm_parameter_store', key: 'appApiProxy', type: 'boolean' },
+  storageBucketName: { system: 'aws_ssm_parameter_store', key: 'storageBucketName', type: 'string' },
+  storageDomainName: 'storage.foomedical.com',
+  storageSslCertArn: 'arn:def-123',
+  signingKeyId: { system: 'aws_ssm_parameter_store', key: 'signingKeyId', type: 'string' },
+  storagePublicKey: { system: 'aws_ssm_parameter_store', key: 'storagePublicKey', type: 'string' },
+  baseUrl: 'foomedical.com',
+  maxAzs: { system: 'aws_ssm_parameter_store', key: 'maxAzs', type: 'number' },
+  rdsInstances: { system: 'aws_ssm_parameter_store', key: 'rdsInstances', type: 'number' },
+  rdsInstanceType: 'big',
+  desiredServerCount: { system: 'aws_ssm_parameter_store', key: 'desiredServerCount', type: 'number' },
+  serverImage: 'arn:our-image',
+  serverMemory: { system: 'aws_ssm_parameter_store', key: 'serverMemory', type: 'number' },
+  serverCpu: { system: 'aws_ssm_parameter_store', key: 'serverCpu', type: 'number' },
+  clamscanEnabled: false,
+  clamscanLoggingBucket: 'no_logging',
+  clamscanLoggingPrefix: 'foo_',
+  skipDns: true,
+} as const satisfies MedplumSourceInfraConfig;
+
+// TODO: Test throwing on missing region
+
+const additionalContainers = [
+  {
+    name: 'BIG IMAGE',
+    image: 'arn:big_image',
+    environment: {
+      FOO: 'BAR',
+      MED: { system: 'aws_ssm_parameter_store', key: 'MED', type: 'string' },
+    },
+  },
+] as const;
+
+const cloudTrailAlarms = {
+  logGroupName: { system: 'aws_ssm_parameter_store', key: 'logGroupName', type: 'string' },
+  logGroupCreate: { system: 'aws_ssm_parameter_store', key: 'logGroupCreate', type: 'boolean' },
+} as const;
+
+describe('Config', () => {
+  describe('normalizeInfraConfig', () => {
+    let mockSSMClient: AwsClientStub<SSMClient>;
+
+    beforeEach(() => {
+      mockSSMClient = mockClient(SSMClient);
+
+      mockSSMClient.on(GetParameterCommand).rejects();
+      mockSSMClient.on(GetParameterCommand, { Name: 'stackName' }).resolves({
+        Parameter: { Name: 'stackName', Value: 'MyFoomedicalStack' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'apiPort' }).resolves({
+        Parameter: { Name: 'apiPort', Value: '1337' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'apiDomainName' }).resolves({
+        Parameter: { Name: 'apiDomainName', Value: 'api.foomedical.com' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'apiSslCertArn' }).resolves({
+        Parameter: { Name: 'apiSslCertArn', Value: 'arn:foomedical_api_ssl_cert' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'appApiProxy' }).resolves({
+        Parameter: { Name: 'appApiProxy', Value: 'true' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'signingKeyId' }).resolves({
+        Parameter: { Name: 'signingKeyId', Value: 'key-abc123' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'storageBucketName' }).resolves({
+        Parameter: { Name: 'storageBucketName', Value: 'foomedical_storage_bucket' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'storagePublicKey' }).resolves({
+        Parameter: { Name: 'storagePublicKey', Value: 'VERY_LONG_KEY' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'maxAzs' }).resolves({
+        Parameter: { Name: 'maxAzs', Value: '6' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'rdsInstances' }).resolves({
+        Parameter: { Name: 'rdsInstances', Value: '10' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'desiredServerCount' }).resolves({
+        Parameter: { Name: 'desiredServerCount', Value: '0' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'serverMemory' }).resolves({
+        Parameter: { Name: 'serverMemory', Value: '16384' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'serverCpu' }).resolves({
+        Parameter: { Name: 'serverCpu', Value: '4096' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'MED' }).resolves({
+        Parameter: { Name: 'MED', Value: 'PLUM' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'logGroupName' }).resolves({
+        Parameter: { Name: 'logGroupName', Value: 'FOOMEDICAL_PROD' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'logGroupCreate' }).resolves({
+        Parameter: { Name: 'logGroupCreate', Value: 'false' },
+      });
+    });
+
+    afterEach(() => {
+      mockSSMClient.restore();
+    });
+
+    test('Missing `region` in config', async () => {
+      // @ts-expect-error Region must be defined
+      await expect(normalizeInfraConfig({ ...baseConfig, region: undefined })).rejects.toBeInstanceOf(
+        OperationOutcomeError
+      );
+    });
+
+    test('Valid infra source config w/ external secrets', async () => {
+      const result = await normalizeInfraConfig(baseConfig);
+      expect(result).toEqual<MedplumInfraConfig>({
+        name: 'MyMedplumApp',
+        stackName: 'MyFoomedicalStack',
+        accountNumber: 'medplum123',
+        region: 'us-east-1',
+        domainName: 'foomedical.com',
+        vpcId: 'abc-321123',
+        apiPort: 1337,
+        apiDomainName: 'api.foomedical.com',
+        apiSslCertArn: 'arn:foomedical_api_ssl_cert',
+        apiInternetFacing: true,
+        appDomainName: 'app.foomedical.com',
+        appSslCertArn: 'arn:abc-123',
+        appApiProxy: true,
+        storageBucketName: 'foomedical_storage_bucket',
+        storageDomainName: 'storage.foomedical.com',
+        storageSslCertArn: 'arn:def-123',
+        signingKeyId: 'key-abc123',
+        storagePublicKey: 'VERY_LONG_KEY',
+        baseUrl: 'foomedical.com',
+        maxAzs: 6,
+        rdsInstances: 10,
+        rdsInstanceType: 'big',
+        desiredServerCount: 0,
+        serverImage: 'arn:our-image',
+        serverMemory: 16384,
+        serverCpu: 4096,
+        clamscanEnabled: false,
+        clamscanLoggingBucket: 'no_logging',
+        clamscanLoggingPrefix: 'foo_',
+        skipDns: true,
+      });
+    });
+
+    test('Valid source config w/ additional containers', async () => {
+      const result = await normalizeInfraConfig({ ...baseConfig, additionalContainers: [...additionalContainers] });
+      expect(result).toEqual<MedplumInfraConfig>({
+        name: 'MyMedplumApp',
+        stackName: 'MyFoomedicalStack',
+        accountNumber: 'medplum123',
+        region: 'us-east-1',
+        domainName: 'foomedical.com',
+        vpcId: 'abc-321123',
+        apiPort: 1337,
+        apiDomainName: 'api.foomedical.com',
+        apiSslCertArn: 'arn:foomedical_api_ssl_cert',
+        apiInternetFacing: true,
+        appDomainName: 'app.foomedical.com',
+        appSslCertArn: 'arn:abc-123',
+        appApiProxy: true,
+        storageBucketName: 'foomedical_storage_bucket',
+        storageDomainName: 'storage.foomedical.com',
+        storageSslCertArn: 'arn:def-123',
+        signingKeyId: 'key-abc123',
+        storagePublicKey: 'VERY_LONG_KEY',
+        baseUrl: 'foomedical.com',
+        maxAzs: 6,
+        rdsInstances: 10,
+        rdsInstanceType: 'big',
+        desiredServerCount: 0,
+        serverImage: 'arn:our-image',
+        serverMemory: 16384,
+        serverCpu: 4096,
+        clamscanEnabled: false,
+        clamscanLoggingBucket: 'no_logging',
+        clamscanLoggingPrefix: 'foo_',
+        skipDns: true,
+        additionalContainers: [
+          {
+            name: 'BIG IMAGE',
+            image: 'arn:big_image',
+            environment: {
+              FOO: 'BAR',
+              MED: 'PLUM',
+            },
+          },
+        ],
+      });
+    });
+
+    test('Valid source config w/ `cloudTrailAlarms`', async () => {
+      const result = await normalizeInfraConfig({ ...baseConfig, cloudTrailAlarms: { ...cloudTrailAlarms } });
+      expect(result).toEqual<MedplumInfraConfig>({
+        name: 'MyMedplumApp',
+        stackName: 'MyFoomedicalStack',
+        accountNumber: 'medplum123',
+        region: 'us-east-1',
+        domainName: 'foomedical.com',
+        vpcId: 'abc-321123',
+        apiPort: 1337,
+        apiDomainName: 'api.foomedical.com',
+        apiSslCertArn: 'arn:foomedical_api_ssl_cert',
+        apiInternetFacing: true,
+        appDomainName: 'app.foomedical.com',
+        appSslCertArn: 'arn:abc-123',
+        appApiProxy: true,
+        storageBucketName: 'foomedical_storage_bucket',
+        storageDomainName: 'storage.foomedical.com',
+        storageSslCertArn: 'arn:def-123',
+        signingKeyId: 'key-abc123',
+        storagePublicKey: 'VERY_LONG_KEY',
+        baseUrl: 'foomedical.com',
+        maxAzs: 6,
+        rdsInstances: 10,
+        rdsInstanceType: 'big',
+        desiredServerCount: 0,
+        serverImage: 'arn:our-image',
+        serverMemory: 16384,
+        serverCpu: 4096,
+        clamscanEnabled: false,
+        clamscanLoggingBucket: 'no_logging',
+        clamscanLoggingPrefix: 'foo_',
+        skipDns: true,
+        cloudTrailAlarms: {
+          logGroupName: 'FOOMEDICAL_PROD',
+          logGroupCreate: false,
+        },
+      });
+    });
+
+    test('Invalid system', async () => {
+      await expect(
+        // @ts-expect-error System is not valid
+        normalizeInfraConfig({ ...baseConfig, apiPort: { system: 'google_drive', key: 'abc', type: 'number' } })
+      ).rejects.toBeInstanceOf(OperationOutcomeError);
+    });
+
+    test('Invalid AWS Param Store key', async () => {
+      await expect(
+        normalizeInfraConfig({
+          ...baseConfig,
+          apiPort: { system: 'aws_ssm_parameter_store', key: 'abc', type: 'number' },
+        })
+      ).rejects.toBeInstanceOf(Error);
+    });
+
+    test('Invalid type specified', async () => {
+      await expect(
+        normalizeInfraConfig({
+          ...baseConfig,
+          // @ts-expect-error Type 'plum' not a valid type
+          apiPort: { system: 'aws_ssm_parameter_store', key: 'abc', type: 'plum' },
+        })
+      ).rejects.toBeInstanceOf(OperationOutcomeError);
+    });
+
+    test('Mismatched type specified', async () => {
+      await expect(
+        normalizeInfraConfig({
+          ...baseConfig,
+          // @ts-expect-error Type 'boolean' is not the proper type for `apiPort`
+          apiPort: { system: 'aws_ssm_parameter_store', key: 'apiPort', type: 'boolean' },
+        })
+      ).rejects.toBeInstanceOf(OperationOutcomeError);
+    });
+  });
+
+  describe('normalizeFetchedValue', () => {
+    // Test [object, string] => throws
+    test('Provided object, expected string => throws', () => {
+      // @ts-expect-error rawValue must be a valid primitive, string | boolean | number
+      expect(() => normalizeFetchedValue('medplumString', { med: 'plum' }, 'string')).toThrowError(
+        OperationOutcomeError
+      );
+    });
+    // Test [string, string] => return raw
+    test('Provided string, expected string => rawValue', () => {
+      expect(normalizeFetchedValue('medplumString', 'medplum', 'string')).toEqual('medplum');
+    });
+    // Test [string, number] => number
+    test('Provided string, expected number => parseInt(string)', () => {
+      expect(normalizeFetchedValue('medplumNumber', '20', 'number')).toEqual(20);
+    });
+    // Test [number, number] => rawValue
+    test('Provided number, expected number => rawValue', () => {
+      expect(normalizeFetchedValue('medplumNumber', 20, 'number')).toEqual(20);
+    });
+    // Test [invalidNumStr, number] => throws
+    test('Provided non-numeric string, expected number => throws', () => {
+      expect(() => normalizeFetchedValue('medplumNumber', 'medplum', 'number')).toThrowError(OperationOutcomeError);
+    });
+    // Test [string, boolean] => boolean
+    test('Provided string, expected boolean => parsedBoolean', () => {
+      expect(normalizeFetchedValue('medplumBool', 'TRUE', 'boolean')).toEqual(true);
+      expect(normalizeFetchedValue('medplumBool', 'false', 'boolean')).toEqual(false);
+      expect(normalizeFetchedValue('medplumBool', 'TrUe', 'boolean')).toEqual(true);
+      expect(normalizeFetchedValue('medplumBool', 'FALSE', 'boolean')).toEqual(false);
+    });
+    // Test [invalidStr, boolean] => throws
+    test('Provided string, expected boolean => parsedBoolean', () => {
+      expect(() => normalizeFetchedValue('medplumBool', 'TRUEE', 'boolean')).toThrowError(OperationOutcomeError);
+      expect(() => normalizeFetchedValue('medplumBool', '10', 'boolean')).toThrowError(OperationOutcomeError);
+      expect(() => normalizeFetchedValue('medplumBool', '0', 'boolean')).toThrowError(OperationOutcomeError);
+    });
+    // Test [bool, number] => throws
+    test('Provided boolean, expected number => throws', () => {
+      expect(() => normalizeFetchedValue('medplumNumber', true, 'number')).toThrowError(OperationOutcomeError);
+    });
+    // Test [string, invalid_type] => throws
+    test('Provided string, expected {invalidType} => throws', () => {
+      // @ts-expect-error Plum is not a valid expectedType
+      expect(() => normalizeFetchedValue('medplum???', 'medplum', 'plum')).toThrowError(OperationOutcomeError);
+    });
+  });
+
+  describe('fetchParameterStoreSecret', () => {
+    let mockSSMClient: AwsClientStub<SSMClient>;
+    let configNormalizer: InfraConfigNormalizer;
+
+    beforeEach(() => {
+      mockSSMClient = mockClient(SSMClient);
+
+      mockSSMClient.on(GetParameterCommand).rejects();
+      mockSSMClient.on(GetParameterCommand, { Name: 'stackName' }).resolves({
+        Parameter: { Name: 'stackName', Value: 'MyFoomedicalStack' },
+      });
+      mockSSMClient.on(GetParameterCommand, { Name: 'emptyValue' }).resolves({
+        Parameter: { Name: 'emptyValue' },
+      });
+
+      configNormalizer = new InfraConfigNormalizer(baseConfig);
+    });
+
+    afterEach(() => {
+      mockSSMClient.restore();
+    });
+
+    test('Valid key in param store', async () => {
+      await expect(configNormalizer.fetchParameterStoreSecret('stackName')).resolves.toEqual('MyFoomedicalStack');
+    });
+
+    test('Invalid key in param store', async () => {
+      await expect(configNormalizer.fetchParameterStoreSecret('medplum')).rejects.toBeInstanceOf(Error);
+    });
+
+    test('Valid key with no value', async () => {
+      await expect(configNormalizer.fetchParameterStoreSecret('emptyValue')).rejects.toBeInstanceOf(
+        OperationOutcomeError
+      );
+    });
+  });
+
+  describe('normalizeObjectInInfraConfig', () => {
+    let mockSSMClient: AwsClientStub<SSMClient>;
+    let configNormalizer: InfraConfigNormalizer;
+
+    beforeEach(() => {
+      mockSSMClient = mockClient(SSMClient);
+
+      mockSSMClient.on(GetParameterCommand).rejects();
+      mockSSMClient.on(GetParameterCommand, { Name: 'medplumSecret' }).resolves({
+        Parameter: { Name: 'medplumSecret', Value: 'MyMedplumSecret' },
+      });
+
+      configNormalizer = new InfraConfigNormalizer(baseConfig);
+    });
+
+    afterEach(() => {
+      mockSSMClient.restore();
+    });
+
+    test('Array of primitives or secrets', async () => {
+      expect(
+        await configNormalizer.normalizeObjectInInfraConfig({
+          medplumStuff: [
+            'medplum',
+            {
+              system: 'aws_ssm_parameter_store',
+              key: 'medplumSecret',
+              type: 'string',
+            } satisfies ExternalSecret<'string'>,
+          ],
+        })
+      ).toEqual({ medplumStuff: ['medplum', 'MyMedplumSecret'] });
+      expect(
+        await configNormalizer.normalizeObjectInInfraConfig({
+          medplumStuff: [
+            {
+              system: 'aws_ssm_parameter_store',
+              key: 'medplumSecret',
+              type: 'string',
+            } satisfies ExternalSecret<'string'>,
+            'medplum',
+          ],
+        })
+      ).toEqual({ medplumStuff: ['MyMedplumSecret', 'medplum'] });
+    });
+  });
+
+  describe('assertValidExternalSecret', () => {
+    // Test perfectly valid secret
+    test('Valid ExternalSecret', () => {
+      expect(() =>
+        assertValidExternalSecret({
+          system: 'aws_ssm_parameter_store',
+          key: 'medplumString',
+          type: 'string',
+        } satisfies ExternalSecret<'string'>)
+      ).not.toThrow();
+    });
+    // Test secret with shape but invalid type
+    test('Almost valid ExternalSecret, invalid type value', () => {
+      expect(() =>
+        assertValidExternalSecret({
+          system: 'aws_ssm_parameter_store',
+          key: 'medplumString',
+          type: 'plum',
+        })
+      ).toThrowError(OperationOutcomeError);
+    });
+    // Test completely invalid secret
+    test('Invalid ExternalSecret', () => {
+      expect(() =>
+        assertValidExternalSecret({
+          key: 10,
+          type: true,
+        })
+      ).toThrowError(OperationOutcomeError);
+    });
+  });
+
+  describe('isExternalSecret', () => {
+    // Test perfectly valid secret
+    test('Valid ExternalSecret', () => {
+      expect(
+        isExternalSecret({
+          system: 'aws_ssm_parameter_store',
+          key: 'medplumString',
+          type: 'string',
+        } satisfies ExternalSecret<'string'>)
+      ).toEqual(true);
+    });
+    // Test secret with shape but invalid type
+    test('Almost valid ExternalSecret, invalid type value', () => {
+      expect(
+        isExternalSecret({
+          system: 'aws_ssm_parameter_store',
+          key: 'medplumString',
+          type: 'plum',
+        })
+      ).toEqual(false);
+    });
+    // Test completely invalid secret
+    test('Invalid ExternalSecret', () => {
+      expect(
+        isExternalSecret({
+          key: 10,
+          type: true,
+        })
+      ).toEqual(false);
+    });
+  });
+});