@mstuercke/pulumi-modules 0.0.7 → 0.0.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth0/Auth0.d.ts +29 -0
- package/dist/auth0/Auth0.js +81 -0
- package/dist/auth0/index.d.ts +5 -0
- package/dist/auth0/index.js +5 -0
- package/dist/domain/getDomain.d.ts +13 -0
- package/dist/domain/getDomain.js +14 -0
- package/dist/domain/index.d.ts +4 -0
- package/dist/domain/index.js +5 -0
- package/dist/iam/SimpleIamRolePolicy.d.ts +6 -0
- package/dist/iam/SimpleIamRolePolicy.js +115 -0
- package/dist/iam/SimpleIamRolePolicyConfig.d.ts +57 -0
- package/dist/iam/SimpleIamRolePolicyConfig.js +1 -0
- package/dist/iam/index.d.ts +6 -0
- package/dist/iam/index.js +6 -0
- package/dist/index.d.ts +40 -0
- package/dist/index.js +29 -0
- package/dist/lambda/NodeLambdaFunction.d.ts +20 -0
- package/dist/lambda/NodeLambdaFunction.js +71 -0
- package/dist/lambda/WithInputs.d.ts +4 -0
- package/dist/lambda/WithInputs.js +1 -0
- package/dist/lambda/index.d.ts +5 -0
- package/dist/lambda/index.js +5 -0
- package/dist/mongodb/MongoDB.d.ts +13 -0
- package/dist/mongodb/MongoDB.js +51 -0
- package/dist/mongodb/MongoDBCustomInstance.d.ts +12 -0
- package/dist/mongodb/MongoDBCustomInstance.js +32 -0
- package/dist/mongodb/MongoDBDefaultInstance.d.ts +12 -0
- package/dist/mongodb/MongoDBDefaultInstance.js +19 -0
- package/dist/mongodb/MongoDBUser.d.ts +12 -0
- package/dist/mongodb/MongoDBUser.js +28 -0
- package/dist/mongodb/index.d.ts +11 -0
- package/dist/mongodb/index.js +11 -0
- package/dist/rest/RestApi.d.ts +19 -0
- package/dist/rest/RestApi.js +129 -0
- package/dist/rest/index.d.ts +5 -0
- package/dist/rest/index.js +5 -0
- package/dist/s3/PublicS3Bucket.d.ts +11 -0
- package/dist/s3/PublicS3Bucket.js +48 -0
- package/dist/s3/index.d.ts +5 -0
- package/dist/s3/index.js +5 -0
- package/dist/website/StaticWebsite.d.ts +17 -0
- package/dist/website/StaticWebsite.js +129 -0
- package/dist/website/index.d.ts +5 -0
- package/dist/website/index.js +5 -0
- package/dist/website/readFilesRecursive.d.ts +8 -0
- package/dist/website/readFilesRecursive.js +23 -0
- package/dist/websocket/WebsocketApi.d.ts +22 -0
- package/dist/websocket/WebsocketApi.js +130 -0
- package/dist/websocket/index.d.ts +5 -0
- package/dist/websocket/index.js +5 -0
- package/package.json +2 -2
|
@@ -0,0 +1,29 @@
|
|
|
1
|
+
import { type CustomResourceOptions, type Output, Resource } from '@pulumi/pulumi';
|
|
2
|
+
export type Auth0Domain = `${string}.auth0.com`;
|
|
3
|
+
export type Auth0URL = `http://${string}` | `https://${string}`;
|
|
4
|
+
export interface Auth0User {
|
|
5
|
+
name: string;
|
|
6
|
+
email: string;
|
|
7
|
+
password: string;
|
|
8
|
+
emailVerified: boolean;
|
|
9
|
+
appMetadata?: Record<string, unknown>;
|
|
10
|
+
}
|
|
11
|
+
export interface Auth0Args {
|
|
12
|
+
projectId: string;
|
|
13
|
+
environmentName: string;
|
|
14
|
+
tenantDisplayName: string;
|
|
15
|
+
clientDisplayName: string;
|
|
16
|
+
domain: Auth0Domain;
|
|
17
|
+
m2mClientId: string;
|
|
18
|
+
allowedUrls: Auth0URL[];
|
|
19
|
+
allowedLoginCallbackUrls?: Auth0URL[];
|
|
20
|
+
allowedLogoutCallbackUrls?: Auth0URL[];
|
|
21
|
+
nativeAppId?: `com.${string}`;
|
|
22
|
+
defaultUsers?: Auth0User[];
|
|
23
|
+
disableSignup?: boolean;
|
|
24
|
+
}
|
|
25
|
+
export declare class Auth0 extends Resource {
|
|
26
|
+
domain: string;
|
|
27
|
+
clientId: Output<string>;
|
|
28
|
+
constructor(id: string, args: Auth0Args, opts?: CustomResourceOptions);
|
|
29
|
+
}
|
|
@@ -0,0 +1,81 @@
|
|
|
1
|
+
import { Resource } from '@pulumi/pulumi';
|
|
2
|
+
import { Client, ClientCredentials, Connection, ConnectionClient, Provider, Tenant, User } from '@pulumi/auth0';
|
|
3
|
+
export class Auth0 extends Resource {
|
|
4
|
+
domain;
|
|
5
|
+
clientId;
|
|
6
|
+
constructor(id, args, opts) {
|
|
7
|
+
super('mstuercke:auth0:Auth0', id, false, undefined, opts);
|
|
8
|
+
const { projectId, environmentName, tenantDisplayName, clientDisplayName, domain, m2mClientId, allowedUrls, allowedLoginCallbackUrls, allowedLogoutCallbackUrls, nativeAppId, defaultUsers = [], disableSignup = false, } = args;
|
|
9
|
+
new Provider('provider', {}, { parent: this });
|
|
10
|
+
new Tenant('tenant', {
|
|
11
|
+
friendlyName: tenantDisplayName,
|
|
12
|
+
flags: {
|
|
13
|
+
enableClientConnections: false,
|
|
14
|
+
},
|
|
15
|
+
}, { parent: this });
|
|
16
|
+
const nativeAppCallbackUrls = nativeAppId
|
|
17
|
+
? [
|
|
18
|
+
`${nativeAppId}.auth0://${domain}/ios/${nativeAppId}/callback`,
|
|
19
|
+
`${nativeAppId}.auth0://${domain}/android/${nativeAppId}/callback`,
|
|
20
|
+
]
|
|
21
|
+
: [];
|
|
22
|
+
const client = new Client('client', {
|
|
23
|
+
name: clientDisplayName,
|
|
24
|
+
appType: 'spa',
|
|
25
|
+
callbacks: [...(allowedLoginCallbackUrls || allowedUrls), ...nativeAppCallbackUrls],
|
|
26
|
+
webOrigins: allowedUrls,
|
|
27
|
+
allowedLogoutUrls: [...(allowedLogoutCallbackUrls || allowedUrls), ...nativeAppCallbackUrls],
|
|
28
|
+
jwtConfiguration: {
|
|
29
|
+
alg: 'RS256',
|
|
30
|
+
},
|
|
31
|
+
addons: {},
|
|
32
|
+
}, { parent: this });
|
|
33
|
+
const connection = new Connection('password-authentication', {
|
|
34
|
+
name: `${projectId}-${environmentName}`,
|
|
35
|
+
strategy: 'auth0',
|
|
36
|
+
options: {
|
|
37
|
+
disableSignup: disableSignup,
|
|
38
|
+
bruteForceProtection: true,
|
|
39
|
+
},
|
|
40
|
+
}, { parent: this });
|
|
41
|
+
const m2mClientConnection = new ConnectionClient('password-authentication-m2m-client', {
|
|
42
|
+
clientId: m2mClientId,
|
|
43
|
+
connectionId: connection.id,
|
|
44
|
+
}, { parent: client });
|
|
45
|
+
const clientConnection = new ConnectionClient('password-authentication-client', {
|
|
46
|
+
clientId: client.id,
|
|
47
|
+
connectionId: connection.id,
|
|
48
|
+
}, { parent: client });
|
|
49
|
+
// TODO: Implement disabling of google-oauth2 (If possible, also disable "Username-Password-Authentication")
|
|
50
|
+
// // disable google-oauth2 on all clients
|
|
51
|
+
// const googleOauth2Connection = output(getConnection({name: 'google-oauth2'}))
|
|
52
|
+
// new ConnectionClients(
|
|
53
|
+
// 'google-oauth2-clien',
|
|
54
|
+
// {
|
|
55
|
+
// connectionId: googleOauth2Connection.id,
|
|
56
|
+
// enabledClients: [],
|
|
57
|
+
// },
|
|
58
|
+
// {parent: client, dependsOn: [client]},
|
|
59
|
+
// )
|
|
60
|
+
new ClientCredentials('credentials', {
|
|
61
|
+
clientId: client.id,
|
|
62
|
+
authenticationMethod: 'none',
|
|
63
|
+
}, { parent: this });
|
|
64
|
+
for (const defaultUser of defaultUsers) {
|
|
65
|
+
const { name, email, emailVerified, password, appMetadata } = defaultUser;
|
|
66
|
+
new User(`default-user-${defaultUser.email}`, {
|
|
67
|
+
connectionName: connection.name,
|
|
68
|
+
name: name,
|
|
69
|
+
email: email,
|
|
70
|
+
emailVerified: emailVerified,
|
|
71
|
+
password: password,
|
|
72
|
+
appMetadata: appMetadata ? JSON.stringify(appMetadata) : undefined,
|
|
73
|
+
}, {
|
|
74
|
+
dependsOn: [m2mClientConnection, clientConnection],
|
|
75
|
+
parent: connection,
|
|
76
|
+
});
|
|
77
|
+
}
|
|
78
|
+
this.domain = domain;
|
|
79
|
+
this.clientId = client.id;
|
|
80
|
+
}
|
|
81
|
+
}
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
import { type Provider } from '@pulumi/aws';
|
|
2
|
+
export interface DataDomainOptions {
|
|
3
|
+
usEast1Provider: Provider;
|
|
4
|
+
name: `${string}.${string}`;
|
|
5
|
+
}
|
|
6
|
+
export type DomainResult = {
|
|
7
|
+
name: string;
|
|
8
|
+
zoneId: string;
|
|
9
|
+
nameServers: string[];
|
|
10
|
+
usEast1CertificateArn: string;
|
|
11
|
+
euCentral1CertificateArn: string;
|
|
12
|
+
};
|
|
13
|
+
export declare const getDomain: (options: DataDomainOptions) => Promise<DomainResult>;
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
import { acm, route53 } from '@pulumi/aws';
|
|
2
|
+
export const getDomain = async (options) => {
|
|
3
|
+
const { usEast1Provider, name } = options;
|
|
4
|
+
const zone = await route53.getZone({ name });
|
|
5
|
+
const euCentral1Certificate = await acm.getCertificate({ domain: name });
|
|
6
|
+
const usEast1Certificate = await acm.getCertificate({ domain: name }, { provider: usEast1Provider });
|
|
7
|
+
return {
|
|
8
|
+
name: zone.name,
|
|
9
|
+
zoneId: zone.zoneId,
|
|
10
|
+
nameServers: zone.nameServers,
|
|
11
|
+
usEast1CertificateArn: usEast1Certificate.arn,
|
|
12
|
+
euCentral1CertificateArn: euCentral1Certificate.arn,
|
|
13
|
+
};
|
|
14
|
+
};
|
|
@@ -0,0 +1,6 @@
|
|
|
1
|
+
import { iam } from '@pulumi/aws';
|
|
2
|
+
import type { SimpleIamRolePolicyConfig } from './SimpleIamRolePolicyConfig.js';
|
|
3
|
+
import { type CustomResourceOptions } from '@pulumi/pulumi';
|
|
4
|
+
export declare class SimpleIamRolePolicy extends iam.RolePolicy {
|
|
5
|
+
constructor(iamRoleId: string, config: SimpleIamRolePolicyConfig, opts?: CustomResourceOptions);
|
|
6
|
+
}
|
|
@@ -0,0 +1,115 @@
|
|
|
1
|
+
import { iam } from '@pulumi/aws';
|
|
2
|
+
import { output } from '@pulumi/pulumi';
|
|
3
|
+
export class SimpleIamRolePolicy extends iam.RolePolicy {
|
|
4
|
+
constructor(iamRoleId, config, opts) {
|
|
5
|
+
switch (config.type) {
|
|
6
|
+
case 'custom':
|
|
7
|
+
super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, config.statements), opts);
|
|
8
|
+
break;
|
|
9
|
+
case 'dynamodb':
|
|
10
|
+
if (config.level !== 'full-access')
|
|
11
|
+
throw mapError(config);
|
|
12
|
+
super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
|
|
13
|
+
{
|
|
14
|
+
Action: ['dynamodb:*'],
|
|
15
|
+
Effect: 'Allow',
|
|
16
|
+
Resource: output(config.tableArn).apply((tableArn) => [`${tableArn}`, `${tableArn}/*`]),
|
|
17
|
+
},
|
|
18
|
+
]), opts);
|
|
19
|
+
break;
|
|
20
|
+
case 'timestream':
|
|
21
|
+
if (config.level !== 'full-access')
|
|
22
|
+
throw mapError(config);
|
|
23
|
+
super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
|
|
24
|
+
{
|
|
25
|
+
Action: ['timestream:*'],
|
|
26
|
+
Effect: 'Allow',
|
|
27
|
+
Resource: [config.dbArn, config.tableArn],
|
|
28
|
+
},
|
|
29
|
+
{
|
|
30
|
+
Action: ['timestream:DescribeEndpoin'],
|
|
31
|
+
Effect: 'Allow',
|
|
32
|
+
Resource: ['*'],
|
|
33
|
+
},
|
|
34
|
+
]), opts);
|
|
35
|
+
break;
|
|
36
|
+
case 's3':
|
|
37
|
+
if (config.level !== 'full-access')
|
|
38
|
+
throw mapError(config);
|
|
39
|
+
super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
|
|
40
|
+
{
|
|
41
|
+
Action: ['s3:*'],
|
|
42
|
+
Effect: 'Allow',
|
|
43
|
+
Resource: output(config.bucketArn).apply((bucketArn) => [`${bucketArn}`, `${bucketArn}/*`]),
|
|
44
|
+
},
|
|
45
|
+
]), opts);
|
|
46
|
+
break;
|
|
47
|
+
case 'cognito':
|
|
48
|
+
if (config.level !== 'full-access')
|
|
49
|
+
throw mapError(config);
|
|
50
|
+
super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
|
|
51
|
+
{
|
|
52
|
+
Action: ['cognito-idp:*'],
|
|
53
|
+
Effect: 'Allow',
|
|
54
|
+
Resource: [config.userPoolArn],
|
|
55
|
+
},
|
|
56
|
+
]), opts);
|
|
57
|
+
break;
|
|
58
|
+
case 'websocket':
|
|
59
|
+
if (config.level !== 'full-access')
|
|
60
|
+
throw mapError(config);
|
|
61
|
+
super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
|
|
62
|
+
{
|
|
63
|
+
Effect: 'Allow',
|
|
64
|
+
Action: 'execute-api:*',
|
|
65
|
+
Resource: config.apiArn,
|
|
66
|
+
},
|
|
67
|
+
]), opts);
|
|
68
|
+
break;
|
|
69
|
+
case 'sns':
|
|
70
|
+
if (config.level !== 'publish-message')
|
|
71
|
+
throw mapError(config);
|
|
72
|
+
super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
|
|
73
|
+
{
|
|
74
|
+
Effect: 'Allow',
|
|
75
|
+
Action: 'sns:Publish',
|
|
76
|
+
Resource: config.snsTopicArn,
|
|
77
|
+
},
|
|
78
|
+
]), opts);
|
|
79
|
+
break;
|
|
80
|
+
case 'execute-lambda':
|
|
81
|
+
super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
|
|
82
|
+
{
|
|
83
|
+
Effect: 'Allow',
|
|
84
|
+
Action: 'lambda:InvokeFunction',
|
|
85
|
+
Resource: config.lambdaArn,
|
|
86
|
+
},
|
|
87
|
+
]), opts);
|
|
88
|
+
break;
|
|
89
|
+
case 'event-bridge':
|
|
90
|
+
super(config.name, mapIamRolePolicyConfig(iamRoleId, config.name, [
|
|
91
|
+
{
|
|
92
|
+
Effect: 'Allow',
|
|
93
|
+
Action: ['events:DescribeRule', 'events:DisableRule', 'events:EnableRule'],
|
|
94
|
+
Resource: config.ruleArn,
|
|
95
|
+
},
|
|
96
|
+
]), opts);
|
|
97
|
+
break;
|
|
98
|
+
default:
|
|
99
|
+
throw mapError(config);
|
|
100
|
+
}
|
|
101
|
+
}
|
|
102
|
+
}
|
|
103
|
+
function mapIamRolePolicyConfig(iamRoleId, name, statements) {
|
|
104
|
+
return {
|
|
105
|
+
role: iamRoleId,
|
|
106
|
+
name: name,
|
|
107
|
+
policy: {
|
|
108
|
+
Version: '2012-10-17',
|
|
109
|
+
Statement: statements,
|
|
110
|
+
},
|
|
111
|
+
};
|
|
112
|
+
}
|
|
113
|
+
function mapError(config) {
|
|
114
|
+
return new Error(`Unable to create policy with config: ${JSON.stringify(config)}`);
|
|
115
|
+
}
|
|
@@ -0,0 +1,57 @@
|
|
|
1
|
+
import type { Input } from '@pulumi/pulumi';
|
|
2
|
+
import type { PolicyStatement } from '@pulumi/aws/iam';
|
|
3
|
+
export type SimpleIamRolePolicyConfig = CustomPolicyConfig | DynamoDbPolicyConfig | TimestreamPolicyConfig | S3PolicyConfig | CognitoPolicyConfig | WebsocketPolicyConfig | ExecuteLambdaConfig | SnsPolicyConfig | EventBridgeConfig;
|
|
4
|
+
interface CustomPolicyConfig {
|
|
5
|
+
type: 'custom';
|
|
6
|
+
name: string;
|
|
7
|
+
statements: PolicyStatement[];
|
|
8
|
+
}
|
|
9
|
+
interface DynamoDbPolicyConfig {
|
|
10
|
+
type: 'dynamodb';
|
|
11
|
+
level: 'full-access';
|
|
12
|
+
name: string;
|
|
13
|
+
tableArn: Input<string>;
|
|
14
|
+
}
|
|
15
|
+
interface TimestreamPolicyConfig {
|
|
16
|
+
type: 'timestream';
|
|
17
|
+
level: 'full-access';
|
|
18
|
+
name: string;
|
|
19
|
+
dbArn: Input<string>;
|
|
20
|
+
tableArn: Input<string>;
|
|
21
|
+
}
|
|
22
|
+
interface S3PolicyConfig {
|
|
23
|
+
type: 's3';
|
|
24
|
+
level: 'full-access';
|
|
25
|
+
name: string;
|
|
26
|
+
bucketArn: Input<string>;
|
|
27
|
+
}
|
|
28
|
+
interface CognitoPolicyConfig {
|
|
29
|
+
type: 'cognito';
|
|
30
|
+
level: 'full-access';
|
|
31
|
+
name: string;
|
|
32
|
+
userPoolArn: Input<string>;
|
|
33
|
+
}
|
|
34
|
+
interface WebsocketPolicyConfig {
|
|
35
|
+
type: 'websocket';
|
|
36
|
+
level: 'full-access';
|
|
37
|
+
name: string;
|
|
38
|
+
apiArn: '*';
|
|
39
|
+
}
|
|
40
|
+
interface SnsPolicyConfig {
|
|
41
|
+
type: 'sns';
|
|
42
|
+
level: 'publish-message';
|
|
43
|
+
name: string;
|
|
44
|
+
snsTopicArn: Input<string>;
|
|
45
|
+
}
|
|
46
|
+
interface ExecuteLambdaConfig {
|
|
47
|
+
type: 'execute-lambda';
|
|
48
|
+
name: string;
|
|
49
|
+
lambdaArn: Input<string>;
|
|
50
|
+
}
|
|
51
|
+
interface EventBridgeConfig {
|
|
52
|
+
type: 'event-bridge';
|
|
53
|
+
level: 'enable-disable-rule';
|
|
54
|
+
name: string;
|
|
55
|
+
ruleArn: Input<string>;
|
|
56
|
+
}
|
|
57
|
+
export {};
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export {};
|
package/dist/index.d.ts
ADDED
|
@@ -0,0 +1,40 @@
|
|
|
1
|
+
export * from './auth0';
|
|
2
|
+
export * from './domain';
|
|
3
|
+
export * from './iam';
|
|
4
|
+
export * from './lambda';
|
|
5
|
+
export * from './mongodb';
|
|
6
|
+
export * from './rest';
|
|
7
|
+
export * from './s3';
|
|
8
|
+
export * from './website';
|
|
9
|
+
export * from './websocket';
|
|
10
|
+
export declare const mstuercke: {
|
|
11
|
+
auth0: {
|
|
12
|
+
Auth0: typeof import("./auth0").Auth0;
|
|
13
|
+
};
|
|
14
|
+
domain: {
|
|
15
|
+
getDomain: (options: import("./domain").DataDomainOptions) => Promise<import("./domain").DomainResult>;
|
|
16
|
+
};
|
|
17
|
+
iam: {
|
|
18
|
+
SimpleIamRolePolicy: typeof import("./iam").SimpleIamRolePolicy;
|
|
19
|
+
};
|
|
20
|
+
lambda: {
|
|
21
|
+
NodeLambdaFunction: typeof import("./lambda").NodeLambdaFunction;
|
|
22
|
+
};
|
|
23
|
+
mongodb: {
|
|
24
|
+
MongoDBCustomInstance: typeof import("./mongodb").MongoDBCustomInstance;
|
|
25
|
+
MongoDBDefaultInstance: typeof import("./mongodb").MongoDBDefaultInstance;
|
|
26
|
+
MongoDBUser: typeof import("./mongodb").MongoDBUser;
|
|
27
|
+
};
|
|
28
|
+
rest: {
|
|
29
|
+
RestApi: typeof import("./rest").RestApi;
|
|
30
|
+
};
|
|
31
|
+
s3: {
|
|
32
|
+
PublicS3Bucket: typeof import("./s3").PublicS3Bucket;
|
|
33
|
+
};
|
|
34
|
+
website: {
|
|
35
|
+
StaticWebsite: typeof import("./website").StaticWebsite;
|
|
36
|
+
};
|
|
37
|
+
websocket: {
|
|
38
|
+
WebsocketApi: typeof import("./websocket").WebsocketApi;
|
|
39
|
+
};
|
|
40
|
+
};
|
package/dist/index.js
ADDED
|
@@ -0,0 +1,29 @@
|
|
|
1
|
+
import { auth0 } from './auth0';
|
|
2
|
+
import { domain } from './domain';
|
|
3
|
+
import { iam } from './iam';
|
|
4
|
+
import { rest } from './rest';
|
|
5
|
+
import { lambda } from './lambda';
|
|
6
|
+
import { mongodb } from './mongodb';
|
|
7
|
+
import { s3 } from './s3';
|
|
8
|
+
import { website } from './website';
|
|
9
|
+
import { websocket } from './websocket';
|
|
10
|
+
export * from './auth0';
|
|
11
|
+
export * from './domain';
|
|
12
|
+
export * from './iam';
|
|
13
|
+
export * from './lambda';
|
|
14
|
+
export * from './mongodb';
|
|
15
|
+
export * from './rest';
|
|
16
|
+
export * from './s3';
|
|
17
|
+
export * from './website';
|
|
18
|
+
export * from './websocket';
|
|
19
|
+
export const mstuercke = {
|
|
20
|
+
auth0,
|
|
21
|
+
domain,
|
|
22
|
+
iam,
|
|
23
|
+
lambda,
|
|
24
|
+
mongodb,
|
|
25
|
+
rest,
|
|
26
|
+
s3,
|
|
27
|
+
website,
|
|
28
|
+
websocket: websocket,
|
|
29
|
+
};
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
import { type CustomResourceOptions, type Output, Resource } from '@pulumi/pulumi';
|
|
2
|
+
import { type SimpleIamRolePolicyConfig } from '../iam';
|
|
3
|
+
import type { WithInputs } from './WithInputs.js';
|
|
4
|
+
export type NodeLambdaFunctionArgs<EnvironmentVariables> = {
|
|
5
|
+
name: string;
|
|
6
|
+
runtime?: string;
|
|
7
|
+
functionHandler?: string;
|
|
8
|
+
memorySize?: number;
|
|
9
|
+
timeoutSeconds?: number;
|
|
10
|
+
lambdaPath: string;
|
|
11
|
+
additionalIamRolePolicies?: SimpleIamRolePolicyConfig[];
|
|
12
|
+
environmentVariables?: WithInputs<EnvironmentVariables>;
|
|
13
|
+
projectId: string;
|
|
14
|
+
};
|
|
15
|
+
export declare class NodeLambdaFunction<EnvironmentVariables extends Record<string, string> = Record<string, string>> extends Resource {
|
|
16
|
+
name: string;
|
|
17
|
+
arn: Output<string>;
|
|
18
|
+
invokeArn: Output<string>;
|
|
19
|
+
constructor(args: NodeLambdaFunctionArgs<EnvironmentVariables>, opts?: CustomResourceOptions);
|
|
20
|
+
}
|
|
@@ -0,0 +1,71 @@
|
|
|
1
|
+
import { iam, lambda } from '@pulumi/aws';
|
|
2
|
+
import { getFile } from '@pulumi/archive';
|
|
3
|
+
import { asset, Resource } from '@pulumi/pulumi';
|
|
4
|
+
import { SimpleIamRolePolicy } from '../iam';
|
|
5
|
+
export class NodeLambdaFunction extends Resource {
|
|
6
|
+
name;
|
|
7
|
+
arn;
|
|
8
|
+
invokeArn;
|
|
9
|
+
constructor(args, opts) {
|
|
10
|
+
super('mstuercke:lambda:NodeLambdaFunction', args.name, false, undefined, opts);
|
|
11
|
+
const { name, additionalIamRolePolicies = [], environmentVariables = undefined, runtime = 'nodejs22.x', functionHandler = 'lambdaFunction.lambdaHandler', memorySize = 128, timeoutSeconds = 30, projectId, } = args;
|
|
12
|
+
const role = new iam.Role(name, {
|
|
13
|
+
name: `${name}-lambda`,
|
|
14
|
+
assumeRolePolicy: JSON.stringify({
|
|
15
|
+
Version: '2012-10-17',
|
|
16
|
+
Statement: [
|
|
17
|
+
{
|
|
18
|
+
Action: 'sts:AssumeRole',
|
|
19
|
+
Principal: { Service: 'lambda.amazonaws.com' },
|
|
20
|
+
Effect: 'Allow',
|
|
21
|
+
},
|
|
22
|
+
],
|
|
23
|
+
}),
|
|
24
|
+
tags: {
|
|
25
|
+
project: projectId,
|
|
26
|
+
},
|
|
27
|
+
}, { parent: this });
|
|
28
|
+
role.id.apply((roleId) => {
|
|
29
|
+
new SimpleIamRolePolicy(roleId, {
|
|
30
|
+
type: 'custom',
|
|
31
|
+
name: 'logging',
|
|
32
|
+
statements: [
|
|
33
|
+
{
|
|
34
|
+
Effect: 'Allow',
|
|
35
|
+
Action: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEven'],
|
|
36
|
+
Resource: '*',
|
|
37
|
+
},
|
|
38
|
+
],
|
|
39
|
+
}, { parent: this });
|
|
40
|
+
for (const config of additionalIamRolePolicies) {
|
|
41
|
+
new SimpleIamRolePolicy(roleId, config, { parent: this });
|
|
42
|
+
}
|
|
43
|
+
});
|
|
44
|
+
const lambdaZip = getFile({
|
|
45
|
+
type: 'zip',
|
|
46
|
+
sourceDir: args.lambdaPath,
|
|
47
|
+
outputPath: `dist/lambda/${name}.zip`,
|
|
48
|
+
});
|
|
49
|
+
const lambdaFunction = new lambda.Function(name, {
|
|
50
|
+
name: name,
|
|
51
|
+
handler: functionHandler,
|
|
52
|
+
runtime: runtime,
|
|
53
|
+
memorySize: memorySize,
|
|
54
|
+
timeout: timeoutSeconds,
|
|
55
|
+
code: new asset.FileArchive(lambdaZip.then((lambdaZip) => lambdaZip.outputPath)),
|
|
56
|
+
sourceCodeHash: lambdaZip.then((lambdaZip) => lambdaZip.outputBase64sha256),
|
|
57
|
+
role: role.arn,
|
|
58
|
+
environment: {
|
|
59
|
+
variables: {
|
|
60
|
+
...environmentVariables,
|
|
61
|
+
},
|
|
62
|
+
},
|
|
63
|
+
tags: {
|
|
64
|
+
project: projectId,
|
|
65
|
+
},
|
|
66
|
+
}, { parent: this });
|
|
67
|
+
this.name = name;
|
|
68
|
+
this.arn = lambdaFunction.arn;
|
|
69
|
+
this.invokeArn = lambdaFunction.invokeArn;
|
|
70
|
+
}
|
|
71
|
+
}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export {};
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
import { type CustomResourceOptions, type Output, Resource } from '@pulumi/pulumi';
|
|
2
|
+
export type MongoDBArgs = {
|
|
3
|
+
organizationId: string;
|
|
4
|
+
projectId: string;
|
|
5
|
+
environmentName: string;
|
|
6
|
+
};
|
|
7
|
+
export declare class MongoDB extends Resource {
|
|
8
|
+
readonly connectionString: Output<string>;
|
|
9
|
+
readonly databaseName: string;
|
|
10
|
+
readonly username: string;
|
|
11
|
+
readonly password: Output<string>;
|
|
12
|
+
constructor(args: MongoDBArgs, opts?: CustomResourceOptions);
|
|
13
|
+
}
|
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
import { Resource } from '@pulumi/pulumi';
|
|
2
|
+
import { RandomPassword } from '@pulumi/random';
|
|
3
|
+
import { DatabaseUser, Project, ProjectIpAccessList, Provider, ServerlessInstance } from '@pulumi/mongodbatlas';
|
|
4
|
+
export class MongoDB extends Resource {
|
|
5
|
+
connectionString;
|
|
6
|
+
databaseName;
|
|
7
|
+
username;
|
|
8
|
+
password;
|
|
9
|
+
constructor(args, opts) {
|
|
10
|
+
const { organizationId, projectId, environmentName } = args;
|
|
11
|
+
super('mstuercke:mongodb:MongoDB', organizationId, false, undefined, opts);
|
|
12
|
+
new Provider('provider', {}, { parent: this });
|
|
13
|
+
const mongoProject = new Project('project', {
|
|
14
|
+
orgId: organizationId,
|
|
15
|
+
name: `${projectId}-${environmentName}`,
|
|
16
|
+
tags: {
|
|
17
|
+
project: projectId,
|
|
18
|
+
},
|
|
19
|
+
}, { parent: this });
|
|
20
|
+
new ProjectIpAccessList('network-access', {
|
|
21
|
+
projectId: mongoProject.id,
|
|
22
|
+
cidrBlock: '0.0.0.0/0',
|
|
23
|
+
}, { parent: mongoProject });
|
|
24
|
+
const mongoInstance = new ServerlessInstance('database', {
|
|
25
|
+
projectId: mongoProject.id,
|
|
26
|
+
name: `${projectId}-${environmentName}`,
|
|
27
|
+
providerSettingsBackingProviderName: 'AWS',
|
|
28
|
+
providerSettingsProviderName: 'SERVERLESS',
|
|
29
|
+
providerSettingsRegionName: 'EU_WEST_1', // Ireland
|
|
30
|
+
}, { parent: mongoProject });
|
|
31
|
+
const username = `${projectId}-${environmentName}`;
|
|
32
|
+
const password = new RandomPassword('password', {
|
|
33
|
+
length: 32,
|
|
34
|
+
}, { parent: mongoProject });
|
|
35
|
+
const databaseName = projectId;
|
|
36
|
+
new DatabaseUser('user', {
|
|
37
|
+
projectId: mongoProject.id,
|
|
38
|
+
username,
|
|
39
|
+
password: password.result,
|
|
40
|
+
authDatabaseName: 'admin',
|
|
41
|
+
roles: [
|
|
42
|
+
{ roleName: 'dbAdmin', databaseName },
|
|
43
|
+
{ roleName: 'readWrite', databaseName },
|
|
44
|
+
],
|
|
45
|
+
}, { parent: mongoProject });
|
|
46
|
+
this.connectionString = mongoInstance.connectionStringsStandardSrv;
|
|
47
|
+
this.databaseName = databaseName;
|
|
48
|
+
this.username = username;
|
|
49
|
+
this.password = password.result;
|
|
50
|
+
}
|
|
51
|
+
}
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
import { type CustomResourceOptions, type Output, Resource } from '@pulumi/pulumi';
|
|
2
|
+
export type MongoDBCustomInstanceArgs = {
|
|
3
|
+
organizationId: string;
|
|
4
|
+
projectId: string;
|
|
5
|
+
environmentName: string;
|
|
6
|
+
};
|
|
7
|
+
export declare class MongoDBCustomInstance extends Resource {
|
|
8
|
+
readonly mongoProjectId: Output<string>;
|
|
9
|
+
readonly connectionString: Output<string>;
|
|
10
|
+
readonly databaseName: string;
|
|
11
|
+
constructor(args: MongoDBCustomInstanceArgs, opts?: CustomResourceOptions);
|
|
12
|
+
}
|
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
import { Resource } from '@pulumi/pulumi';
|
|
2
|
+
import { Project, ProjectIpAccessList, ServerlessInstance } from '@pulumi/mongodbatlas';
|
|
3
|
+
export class MongoDBCustomInstance extends Resource {
|
|
4
|
+
mongoProjectId;
|
|
5
|
+
connectionString;
|
|
6
|
+
databaseName;
|
|
7
|
+
constructor(args, opts) {
|
|
8
|
+
const { organizationId, projectId, environmentName } = args;
|
|
9
|
+
super('mstuercke:mongodb:MongoDBCustomInstance', organizationId, false, undefined, opts);
|
|
10
|
+
const mongoProject = new Project('project', {
|
|
11
|
+
orgId: organizationId,
|
|
12
|
+
name: `${projectId}-${environmentName}`,
|
|
13
|
+
tags: {
|
|
14
|
+
project: projectId,
|
|
15
|
+
},
|
|
16
|
+
}, { parent: this });
|
|
17
|
+
new ProjectIpAccessList('network-access', {
|
|
18
|
+
projectId: mongoProject.id,
|
|
19
|
+
cidrBlock: '0.0.0.0/0',
|
|
20
|
+
}, { parent: this });
|
|
21
|
+
const mongoInstance = new ServerlessInstance('database', {
|
|
22
|
+
projectId: mongoProject.id,
|
|
23
|
+
name: `${projectId}-${environmentName}`,
|
|
24
|
+
providerSettingsBackingProviderName: 'AWS',
|
|
25
|
+
providerSettingsProviderName: 'SERVERLESS',
|
|
26
|
+
providerSettingsRegionName: 'EU_WEST_1', // Ireland
|
|
27
|
+
}, { parent: this });
|
|
28
|
+
this.mongoProjectId = mongoProject.id;
|
|
29
|
+
this.connectionString = mongoInstance.connectionStringsStandardSrv;
|
|
30
|
+
this.databaseName = `${projectId}-${environmentName}`;
|
|
31
|
+
}
|
|
32
|
+
}
|