@mstuercke/pulumi-modules 0.0.1

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@mstuercke/pulumi-modules",
+  "version": "0.0.1",
+  "files": [
+    "src/**/!(*.test|*.fixture).ts",
+    "README.md"
+  ],
+  "main": "src/index.ts",
+  "scripts": {
+    "typeCheck": "tsc --noEmit",
+    "bump:major": "npm version major --git-tag-version false",
+    "bump:minor": "npm version minor --git-tag-version false",
+    "bump:patch": "npm version patch --git-tag-version false",
+    "release": "bun run --tsconfig-override ./tsconfig.scripts.json scripts/release.ts"
+  },
+  "dependencies": {
+    "@pulumi/archive": "^0.2.2",
+    "@pulumi/auth0": "^3.8.1",
+    "@pulumi/aws": "^6.56.1",
+    "@pulumi/mongodbatlas": "^3.20.2",
+    "@pulumi/pulumi": "^3.137.0",
+    "@pulumi/random": "^4.16.7",
+    "@pulumiverse/sentry": "^0.0.8",
+    "@types/mime": "^3.0.4",
+    "glob": "^11.0.0",
+    "mime": "^3.0.0"
+  },
+  "devDependencies": {
+    "@mstuercke/bun-utils": "7.0.6",
+    "@types/bun": "1.1.12",
+    "typescript": "5.6.3"
+  }
+}

package/src/auth0/Auth0.ts

@@ -0,0 +1,162 @@
+import {type CustomResourceOptions, type Output, Resource} from '@pulumi/pulumi'
+import {Client, ClientCredentials, Connection, ConnectionClient, Provider, Tenant, User} from '@pulumi/auth0'
+
+export type Auth0Domain = `${string}.auth0.com`
+export type Auth0URL = `http://${string}` | `https://${string}`
+
+export interface Auth0User {
+  name: string
+  email: string
+  password: string
+  emailVerified: boolean
+  appMetadata?: Record<string, unknown>
+}
+
+export interface Auth0Args {
+  projectId: string
+  environmentName: string
+  tenantDisplayName: string
+  clientDisplayName: string
+  domain: Auth0Domain
+  m2mClientId: string
+  allowedUrls: Auth0URL[]
+  allowedLoginCallbackUrls?: Auth0URL[]
+  allowedLogoutCallbackUrls?: Auth0URL[]
+  nativeAppId?: `com.${string}`
+  defaultUsers?: Auth0User[]
+  disableSignup?: boolean
+}
+
+export class Auth0 extends Resource {
+  domain: string
+  clientId: Output<string>
+
+  constructor(id: string, args: Auth0Args, opts?: CustomResourceOptions) {
+    super('mstuercke:auth0:Auth0', id, false, undefined, opts)
+
+    const {
+      projectId,
+      environmentName,
+      tenantDisplayName,
+      clientDisplayName,
+      domain,
+      m2mClientId,
+      allowedUrls,
+      allowedLoginCallbackUrls,
+      allowedLogoutCallbackUrls,
+      nativeAppId,
+      defaultUsers = [],
+      disableSignup = false,
+    } = args
+
+    new Provider('provider', {}, {parent: this})
+
+    new Tenant(
+      'tenant',
+      {
+        friendlyName: tenantDisplayName,
+        flags: {
+          enableClientConnections: false,
+        },
+      },
+      {parent: this},
+    )
+
+    const nativeAppCallbackUrls = nativeAppId
+      ? [
+          `${nativeAppId}.auth0://${domain}/ios/${nativeAppId}/callback`,
+          `${nativeAppId}.auth0://${domain}/android/${nativeAppId}/callback`,
+        ]
+      : []
+    const client = new Client(
+      'client',
+      {
+        name: clientDisplayName,
+        appType: 'spa',
+        callbacks: [...(allowedLoginCallbackUrls || allowedUrls), ...nativeAppCallbackUrls],
+        webOrigins: allowedUrls,
+        allowedLogoutUrls: [...(allowedLogoutCallbackUrls || allowedUrls), ...nativeAppCallbackUrls],
+        jwtConfiguration: {
+          alg: 'RS256',
+        },
+        addons: {},
+      },
+      {parent: this},
+    )
+
+    const connection = new Connection(
+      'password-authentication',
+      {
+        name: `${projectId}-${environmentName}`,
+        strategy: 'auth0',
+        options: {
+          disableSignup: disableSignup,
+          bruteForceProtection: true,
+        },
+      },
+      {parent: this},
+    )
+
+    const m2mClientConnection = new ConnectionClient(
+      'password-authentication-m2m-client',
+      {
+        clientId: m2mClientId,
+        connectionId: connection.id,
+      },
+      {parent: client},
+    )
+
+    const clientConnection = new ConnectionClient(
+      'password-authentication-client',
+      {
+        clientId: client.id,
+        connectionId: connection.id,
+      },
+      {parent: client},
+    )
+
+    // TODO: Implement disabling of google-oauth2 (If possible, also disable "Username-Password-Authentication")
+    // // disable google-oauth2 on all clients
+    // const googleOauth2Connection = output(getConnection({name: 'google-oauth2'}))
+    // new ConnectionClients(
+    //   'google-oauth2-clients',
+    //   {
+    //     connectionId: googleOauth2Connection.id,
+    //     enabledClients: [],
+    //   },
+    //   {parent: client, dependsOn: [client]},
+    // )
+
+    new ClientCredentials(
+      'credentials',
+      {
+        clientId: client.id,
+        authenticationMethod: 'none',
+      },
+      {parent: this},
+    )
+
+    for (const defaultUser of defaultUsers) {
+      const {name, email, emailVerified, password, appMetadata} = defaultUser
+
+      new User(
+        `default-user-${defaultUser.email}`,
+        {
+          connectionName: connection.name,
+          name: name,
+          email: email,
+          emailVerified: emailVerified,
+          password: password,
+          appMetadata: appMetadata ? JSON.stringify(appMetadata) : undefined,
+        },
+        {
+          dependsOn: [m2mClientConnection, clientConnection],
+          parent: connection,
+        },
+      )
+    }
+
+    this.domain = domain
+    this.clientId = client.id
+  }
+}

package/src/auth0/index.ts

@@ -0,0 +1,7 @@
+import {Auth0} from './Auth0'
+
+export * from './Auth0'
+
+export const auth0 = {
+  Auth0,
+}

package/src/domain/getDomain.ts

@@ -0,0 +1,32 @@
+import {acm, type Provider, route53} from '@pulumi/aws'
+
+export interface DataDomainOptions {
+  usEast1Provider: Provider
+  name: `${string}.${string}`
+}
+
+export type DomainResult = {
+  name: string
+  zoneId: string
+  nameServers: string[]
+  usEast1CertificateArn: string
+  euCentral1CertificateArn: string
+}
+
+export const getDomain = async (options: DataDomainOptions): Promise<DomainResult> => {
+  const {usEast1Provider, name} = options
+
+  const zone = await route53.getZone({name})
+
+  const euCentral1Certificate = await acm.getCertificate({domain: name})
+
+  const usEast1Certificate = await acm.getCertificate({domain: name}, {provider: usEast1Provider})
+
+  return {
+    name: zone.name,
+    zoneId: zone.zoneId,
+    nameServers: zone.nameServers,
+    usEast1CertificateArn: usEast1Certificate.arn,
+    euCentral1CertificateArn: euCentral1Certificate.arn,
+  }
+}

package/src/domain/index.ts

@@ -0,0 +1,7 @@
+import {getDomain} from './getDomain'
+
+export * from './getDomain'
+
+export const domain = {
+  getDomain,
+}

package/src/iam/SimpleIamRolePolicy.ts

@@ -0,0 +1,165 @@
+import {iam} from '@pulumi/aws'
+import type {SimpleIamRolePolicyConfig} from './SimpleIamRolePolicyConfig'
+import type {CustomResourceOptions, Input} from '@pulumi/pulumi'
+import type {RolePolicyArgs} from '@pulumi/aws/iam'
+import type {PolicyStatement} from '@pulumi/aws/iam/documents'
+
+export class SimpleIamRolePolicy extends iam.RolePolicy {
+  constructor(iamRoleId: string, config: SimpleIamRolePolicyConfig, opts?: CustomResourceOptions) {
+    switch (config.type) {
+      case 'custom':
+        super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, config.statements), opts)
+        break
+
+      case 'dynamodb':
+        if (config.level !== 'full-access') throw mapError(config)
+        super(
+          config.name,
+          mapIamRolePolicyConfig(iamRoleId, config.name, [
+            {
+              Action: ['dynamodb:*'],
+              Effect: 'Allow',
+              Resource: [`${config.tableArn}`, `${config.tableArn}/*`],
+            },
+          ]),
+          opts,
+        )
+        break
+
+      case 'timestream':
+        if (config.level !== 'full-access') throw mapError(config)
+
+        super(
+          config.name,
+          mapIamRolePolicyConfig(iamRoleId, config.name, [
+            {
+              Action: ['timestream:*'],
+              Effect: 'Allow',
+              Resource: [config.dbArn, config.tableArn],
+            },
+            {
+              Action: ['timestream:DescribeEndpoints'],
+              Effect: 'Allow',
+              Resource: ['*'],
+            },
+          ]),
+          opts,
+        )
+        break
+
+      case 's3':
+        if (config.level !== 'full-access') throw mapError(config)
+
+        super(
+          config.name,
+          mapIamRolePolicyConfig(iamRoleId, config.name, [
+            {
+              Action: ['s3:*'],
+              Effect: 'Allow',
+              Resource: [`${config.bucketArn}`, `${config.bucketArn}/*`],
+            },
+          ]),
+          opts,
+        )
+        break
+
+      case 'cognito':
+        if (config.level !== 'full-access') throw mapError(config)
+
+        super(
+          config.name,
+          mapIamRolePolicyConfig(iamRoleId, config.name, [
+            {
+              Action: ['cognito-idp:*'],
+              Effect: 'Allow',
+              Resource: [config.userPoolArn],
+            },
+          ]),
+          opts,
+        )
+        break
+
+      case 'websocket':
+        if (config.level !== 'full-access') throw mapError(config)
+
+        super(
+          config.name,
+          mapIamRolePolicyConfig(iamRoleId, config.name, [
+            {
+              Effect: 'Allow',
+              Action: 'execute-api:*',
+              Resource: config.apiArn,
+            },
+          ]),
+          opts,
+        )
+        break
+
+      case 'sns':
+        if (config.level !== 'publish-message') throw mapError(config)
+
+        super(
+          config.name,
+          mapIamRolePolicyConfig(iamRoleId, config.name, [
+            {
+              Effect: 'Allow',
+              Action: 'sns:Publish',
+              Resource: config.snsTopicArn,
+            },
+          ]),
+          opts,
+        )
+        break
+
+      case 'execute-lambda':
+        super(
+          config.name,
+          mapIamRolePolicyConfig(iamRoleId, config.name, [
+            {
+              Effect: 'Allow',
+              Action: 'lambda:InvokeFunction',
+              Resource: config.lambdaArn,
+            },
+          ]),
+          opts,
+        )
+        break
+
+      case 'event-bridge':
+        super(
+          config.name,
+          mapIamRolePolicyConfig(iamRoleId, config.name, [
+            {
+              Effect: 'Allow',
+              Action: ['events:DescribeRule', 'events:DisableRule', 'events:EnableRule'],
+              Resource: config.ruleArn,
+            },
+          ]),
+          opts,
+        )
+        break
+
+      default:
+        throw mapError(config)
+    }
+  }
+}
+
+function mapIamRolePolicyConfig(
+  iamRoleId: Input<string>,
+  name: string,
+  statements: Input<Input<PolicyStatement>[]>,
+): RolePolicyArgs {
+  return {
+    role: iamRoleId,
+    name: name,
+    policy: {
+      Version: '2012-10-17',
+      Statement: statements,
+    },
+  }
+}
+
+function mapError(config: SimpleIamRolePolicyConfig): Error {
+  return new Error(`Unable to create policy with config: ${JSON.stringify(config)}`)
+}

package/src/iam/SimpleIamRolePolicyConfig.ts

@@ -0,0 +1,75 @@
+import type {Input} from '@pulumi/pulumi'
+import type {PolicyStatement} from '@pulumi/aws/iam/documents'
+
+export type SimpleIamRolePolicyConfig =
+  | CustomPolicyConfig
+  | DynamoDbPolicyConfig
+  | TimestreamPolicyConfig
+  | S3PolicyConfig
+  | CognitoPolicyConfig
+  | WebsocketPolicyConfig
+  | ExecuteLambdaConfig
+  | SnsPolicyConfig
+  | EventBridgeConfig
+
+interface CustomPolicyConfig {
+  type: 'custom'
+  name: string
+  statements: PolicyStatement[]
+}
+
+interface DynamoDbPolicyConfig {
+  type: 'dynamodb'
+  level: 'full-access'
+  name: string
+  tableArn: Input<string>
+}
+
+interface TimestreamPolicyConfig {
+  type: 'timestream'
+  level: 'full-access'
+  name: string
+  dbArn: Input<string>
+  tableArn: Input<string>
+}
+
+interface S3PolicyConfig {
+  type: 's3'
+  level: 'full-access'
+  name: string
+  bucketArn: Input<string>
+}
+
+interface CognitoPolicyConfig {
+  type: 'cognito'
+  level: 'full-access'
+  name: string
+  userPoolArn: Input<string>
+}
+
+interface WebsocketPolicyConfig {
+  type: 'websocket'
+  level: 'full-access'
+  name: string
+  apiArn: '*'
+}
+
+interface SnsPolicyConfig {
+  type: 'sns'
+  level: 'publish-message'
+  name: string
+  snsTopicArn: Input<string>
+}
+
+interface ExecuteLambdaConfig {
+  type: 'execute-lambda'
+  name: string
+  lambdaArn: Input<string>
+}
+
+interface EventBridgeConfig {
+  type: 'event-bridge'
+  level: 'enable-disable-rule'
+  name: string
+  ruleArn: Input<string>
+}

package/src/iam/index.ts

@@ -0,0 +1,8 @@
+import {SimpleIamRolePolicy} from './SimpleIamRolePolicy'
+
+export * from './SimpleIamRolePolicy'
+export * from './SimpleIamRolePolicyConfig'
+
+export const iam = {
+  SimpleIamRolePolicy,
+}

package/src/index.ts

@@ -0,0 +1,31 @@
+import {auth0} from './auth0'
+import {domain} from './domain'
+import {iam} from './iam'
+import {rest} from './rest'
+import {lambda} from './lambda'
+import {mongodb} from './mongodb'
+import {s3} from './s3'
+import {website} from './website'
+import {websocket} from './websocket'
+
+export * from './auth0'
+export * from './domain'
+export * from './iam'
+export * from './lambda'
+export * from './mongodb'
+export * from './rest'
+export * from './s3'
+export * from './website'
+export * from './websocket'
+
+export const mstuercke = {
+  auth0,
+  domain,
+  iam,
+  lambda,
+  mongodb,
+  rest,
+  s3,
+  website,
+  websocket,
+}

package/src/lambda/NodeLambdaFunction.ts

@@ -0,0 +1,120 @@
+import {iam, lambda} from '@pulumi/aws'
+import {getFile} from '@pulumi/archive'
+import {asset, type CustomResourceOptions, type Output, Resource} from '@pulumi/pulumi'
+
+import type {SimpleIamRolePolicyConfig} from '../iam'
+import type {WithInputs} from './WithInputs'
+import {mstuercke} from '../index'
+
+export type NodeLambdaFunctionArgs<EnvironmentVariables> = {
+  name: string
+  runtime?: string
+  functionHandler?: string
+  memorySize?: number
+  timeoutSeconds?: number
+  lambdaPath: string
+  additionalIamRolePolicies?: SimpleIamRolePolicyConfig[]
+  environmentVariables?: WithInputs<EnvironmentVariables>
+  projectId: string
+}
+
+export class NodeLambdaFunction<
+  EnvironmentVariables extends Record<string, string> = Record<string, string>,
+> extends Resource {
+  name: string
+  arn: Output<string>
+  invokeArn: Output<string>
+
+  constructor(args: NodeLambdaFunctionArgs<EnvironmentVariables>, opts?: CustomResourceOptions) {
+    super('mstuercke:lambda:NodeLambdaFunction', args.name, false, undefined, opts)
+    const {
+      name,
+      additionalIamRolePolicies = [],
+      environmentVariables = undefined,
+      runtime = 'nodejs20.x',
+      functionHandler = 'lambdaFunction.lambdaHandler',
+      memorySize = 128,
+      timeoutSeconds = 30,
+      projectId,
+    } = args
+
+    const role = new iam.Role(
+      name,
+      {
+        name: `${name}-lambda`,
+        assumeRolePolicy: JSON.stringify({
+          Version: '2012-10-17',
+          Statement: [
+            {
+              Action: 'sts:AssumeRole',
+              Principal: {Service: 'lambda.amazonaws.com'},
+              Effect: 'Allow',
+            },
+          ],
+        }),
+        tags: {
+          project: projectId,
+        },
+      },
+      {parent: this},
+    )
+
+    role.id.apply((roleId) => {
+      new mstuercke.iam.SimpleIamRolePolicy(
+        roleId,
+        {
+          type: 'custom',
+          name: 'logging',
+          statements: [
+            {
+              Effect: 'Allow',
+              Action: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents'],
+              Resource: '*',
+            },
+          ],
+        },
+        {parent: this},
+      )
+
+      for (const config of additionalIamRolePolicies) {
+        new mstuercke.iam.SimpleIamRolePolicy(roleId, config, {parent: this})
+      }
+    })
+
+    const lambdaZip = getFile({
+      type: 'zip',
+      sourceDir: args.lambdaPath,
+      outputPath: `dist/lambda/${name}.zip`,
+    })
+
+    const lambdaFunction = new lambda.Function(
+      name,
+      {
+        name: name,
+        handler: functionHandler,
+        runtime: runtime,
+        memorySize: memorySize,
+        timeout: timeoutSeconds,
+
+        code: new asset.FileArchive(lambdaZip.then((lambdaZip) => lambdaZip.outputPath)),
+        sourceCodeHash: lambdaZip.then((lambdaZip) => lambdaZip.outputBase64sha256),
+
+        role: role.arn,
+
+        environment: {
+          variables: {
+            ...environmentVariables,
+          },
+        },
+        tags: {
+          project: projectId,
+        },
+      },
+      {parent: this},
+    )
+
+    this.name = name
+    this.arn = lambdaFunction.arn
+    this.invokeArn = lambdaFunction.invokeArn
+  }
+}

package/src/lambda/WithInputs.ts

@@ -0,0 +1,5 @@
+import type {Input} from '@pulumi/pulumi'
+
+export type WithInputs<T> = {
+  [key in keyof T]: Input<T[key]>
+}

package/src/lambda/index.ts

@@ -0,0 +1,7 @@
+import {NodeLambdaFunction} from './NodeLambdaFunction'
+
+export * from './NodeLambdaFunction'
+
+export const lambda = {
+  NodeLambdaFunction,
+}