@ndlib/ndlib-cdk2 1.0.29 → 1.0.31

package/README.md

@@ -362,9 +362,9 @@ new SourceWatcher(stack, 'TestProject', {
 NOTE: `webhookResourceStackName` refers to a stack which will manage contains the backend for a CustomResource webhook. Prior to using this construct, an instance of [ndlib/aws-github-webhook](https://github.com/ndlib/aws-github-webhook) should be deployed to the AWS account. One stack can be used for any number of SourceWatcher constructs.
 
 
-## EC2 server with access to RDS
+## EC2 server with access rules
 
-The EC2withDatabase construct builds an EC2 server similar to those used in a large number of our services. The basic concept is to build the server with security group access to an AWS RDS database server. The server is built within an existing VPC. Parameters allow for AMI ID, instance type, root disk storage, IP address, networking, and security group rules for the server upon build. The server is created with the OS only; further configuration will need to be performed, often using ansible.
+The EC2withDatabase construct builds an EC2 server. The basic concept is to build the server with security group access to, possibly, several AWS RDS database servers. The server is built within an existing VPC. Parameters allow for AMI ID, instance type, root disk storage, networking, and security group rules for the server upon build. The server is created with the OS only; further configuration will need to be performed, often using ansible.
 
 Example usage:
 
@@ -380,22 +380,28 @@ new EC2withDatabase (app, 'StackName', {
   env: { account: 'AccountID', region: 'us-east-1' },
   amiId: "Valid AMI Id",
   availabilityZones: [ "us-east-1c" ],
+  backup: 'True',
   instanceClass: ec2.InstanceClass.T3A,
   instanceSize: ec2.InstanceSize.MEDIUM,
   instanceName: "InstanceName",
   keyName: "libnd",
   privateIpAddress: "IPAddress",
-  publicSubnetIds:  [ "ValidSubnet in VPC" ],
+  publicSubnetIds:  [ "ValidSubnet in VPC that matches up with AvailabilityZone" ],
   domainName: "Local domain name",
-  cnameList: [ Array of cnames/additional IPs to be added ],
+  CnameList: [ Array of cnames/additional IPs to be added ],
   volumeSize: Number (in GB),
   vpcId: "Valid VPC ID",
-  sg_ingress_db: 'Security Group of database for access',
-  sg_ingress_db_port: PortNumber,
-  sg_ingress_rules: [
+  SGDBAccessRules: [
+    {
+      "database": "sg-088a1b9d4918effb3",       // Security groups that provide access to an RDS database
+      "port": 3306,                             // Can be multiple or none at all
+      "description": "MySQL access from jumpbox"
+    },
+  ],
+  SGIngressRules: [
       {
-      "ipv4": "10.32.0.0/11",
-      "port": 22,
+      "ipv4": "10.32.0.0/11",                   // Additional access rules to allow connection to the server
+      "port": 22,                               // Can be multiple or none at all
       "description": "SSH access from campus"
       },
   ],

package/lib/ec2s/ec2-with-database.d.ts

@@ -1,6 +1,12 @@
-import { aws_ec2, Stack, StackProps } from 'aws-cdk-lib';
+import { Stack, StackProps } from 'aws-cdk-lib';
+import { InstanceClass, InstanceSize } from 'aws-cdk-lib/aws-ec2';
 import { Construct } from 'constructs';
-export interface IIngress_Rule {
+export interface AccessRule {
+    readonly database: string;
+    readonly port: number;
+    readonly description: string;
+}
+export interface IIngressRule {
     readonly ipv4: string;
     readonly port: number;
     readonly description: string;
@@ -8,17 +14,17 @@ export interface IIngress_Rule {
 export interface ServiceStackProps extends StackProps {
     readonly amiId: string;
     readonly availabilityZones: string[];
-    readonly instanceClass: aws_ec2.InstanceClass;
-    readonly instanceSize: aws_ec2.InstanceSize;
+    readonly backup?: string;
+    readonly backupAccountId?: string;
+    readonly instanceClass: InstanceClass;
+    readonly instanceSize: InstanceSize;
     readonly instanceName: string;
     readonly keyName: string;
-    readonly privateIpAddress: string;
     readonly publicSubnetIds: string[];
     readonly volumeSize: number;
     readonly vpcId: string;
-    readonly sg_ingress_rules: IIngress_Rule[];
-    readonly sg_ingress_db: string;
-    readonly sg_ingress_db_port: number;
+    readonly SGIngressRules?: IIngressRule[];
+    readonly SGDBAccessRules?: AccessRule[];
     readonly domainName: string;
     readonly privateDomainName: string;
     readonly CnameList: string[];

package/lib/ec2s/ec2-with-database.js

@@ -4,11 +4,26 @@ exports.EC2withDatabase = void 0;
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const aws_cdk_lib_2 = require("aws-cdk-lib");
 const ssm = require("aws-cdk-lib/aws-ssm");
+const aws_kms_1 = require("aws-cdk-lib/aws-kms");
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
 const aws_route53_1 = require("aws-cdk-lib/aws-route53");
 class EC2withDatabase extends aws_cdk_lib_1.Stack {
     constructor(scope, id, props) {
+        var _a, _b, _c, _d;
         super(scope, id, props);
-        // Determine the VPC from the availability zones and subnets passed in
+        /*
+        *  Security Group setup and usage are optional parameters
+        *  SGDBAccessRules = RDS database Access group rules (can be multiple)
+        *  SGIngressRules = Ingress rules for additional access (can be multiple)
+        */
+        props = {
+            ...props,
+            backup: (_a = props.backup) !== null && _a !== void 0 ? _a : 'False',
+            backupAccountId: (_b = props.backupAccountId) !== null && _b !== void 0 ? _b : '140023380087',
+            SGDBAccessRules: (_c = props.SGDBAccessRules) !== null && _c !== void 0 ? _c : [],
+            SGIngressRules: (_d = props.SGIngressRules) !== null && _d !== void 0 ? _d : [],
+        };
+        // Determine the VPC from the availability zone and subnet passed in. These are expected to align within the VPC
         const vpc = aws_cdk_lib_1.aws_ec2.Vpc.fromVpcAttributes(this, 'Vpc', {
             vpcId: props.vpcId,
             availabilityZones: props.availabilityZones,
@@ -18,23 +33,78 @@ class EC2withDatabase extends aws_cdk_lib_1.Stack {
         const linux_build = aws_cdk_lib_1.aws_ec2.MachineImage.genericLinux({
             'us-east-1': props.amiId,
         });
-        // Need to look up the role name and then get the ARN value
+        // Need to look up the basic role name and then get the ARN value
         const basic_role = ssm.StringParameter.valueFromLookup(this, '/esu/ec2/basic_role_name');
         const roleName = `arn:aws:iam::${this.account}:${basic_role}`;
         const ec2role = aws_cdk_lib_1.aws_iam.Role.fromRoleArn(this, 'Role', roleName);
-        // Create a security group for this specific server using rules passed in
+        /*
+         * Create a security group for this specific server and then add the SGIngressRules passed in
+        */
         const ec2SecurityGroup = new aws_cdk_lib_1.aws_ec2.SecurityGroup(this, props.instanceName, {
             description: 'Security Group for $(props.instanceName)',
             allowAllOutbound: true,
             vpc: vpc,
         });
-        // Add connections from the new security group to the RDS which will be used by this server    
-        const db_connect_SG = aws_cdk_lib_1.aws_ec2.SecurityGroup.fromSecurityGroupId(this, 'SG', props.sg_ingress_db);
-        ec2SecurityGroup.connections.allowFrom(db_connect_SG, aws_cdk_lib_1.aws_ec2.Port.tcp(props.sg_ingress_db_port), 'Database SG Access');
-        ec2SecurityGroup.connections.allowTo(db_connect_SG, aws_cdk_lib_1.aws_ec2.Port.tcp(props.sg_ingress_db_port), 'Database SG Access');
-        props.sg_ingress_rules.forEach((rule) => {
-            ec2SecurityGroup.addIngressRule(aws_cdk_lib_1.aws_ec2.Peer.ipv4(rule.ipv4), aws_cdk_lib_1.aws_ec2.Port.tcp(rule.port), rule.description);
+        if (props.SGIngressRules) {
+            props.SGIngressRules.forEach((rule) => {
+                ec2SecurityGroup.addIngressRule(aws_cdk_lib_1.aws_ec2.Peer.ipv4(rule.ipv4), aws_cdk_lib_1.aws_ec2.Port.tcp(rule.port), rule.description);
+            });
+        }
+        // Create a key to allow volume and instance to be backed up
+        const backupKey = new aws_kms_1.Key(this, 'BackupKey', {
+            enableKeyRotation: true,
+            alias: props.instanceName,
+        });
+        const backupAccountId = props.backupAccountId; // Our backup account ID
+        const currentAccountId = this.account; // Current account ID
+        const policyStatement = new aws_iam_1.PolicyStatement({
+            actions: [
+                'kms:CreateGrant',
+                'kms:ListGrants',
+                'kms:RevokeGrant',
+                'kms:Encrypt',
+                'kms:Decrypt',
+                'kms:ReEncrypt*',
+                'kms:GenerateDataKey',
+                'kms:GenerateDataKeyPair',
+                'kms:DescribeKey',
+                'kms:GenerateDataKeyWithoutPlaintext',
+                'kms:GenerateDataKeyPairWithoutPlaintext',
+            ],
+            principals: [
+                new aws_iam_1.AccountPrincipal(backupAccountId),
+                new aws_iam_1.AccountPrincipal(currentAccountId),
+            ],
+            resources: ['*'],
         });
+        backupKey.addToResourcePolicy(policyStatement);
+        // Allow attachment of persistent resources for cross-account backup
+        backupKey.addToResourcePolicy(new aws_iam_1.PolicyStatement({
+            sid: 'Allow attachment of persistent resources',
+            principals: [
+                new aws_iam_1.AccountPrincipal(`${backupAccountId}`),
+                new aws_iam_1.AccountPrincipal(`${currentAccountId}`),
+            ],
+            actions: [
+                'kms:CreateGrant',
+                'kms:ListGrants',
+                'kms:RevokeGrant',
+            ],
+            effect: aws_iam_1.Effect.ALLOW,
+            resources: ['*'],
+            conditions: { 'Bool': { 'kms:GrantIsForAWSResource': 'true' } },
+        }));
+        /*
+         * Add connections from the new security group to the RDS which will be used by this server using
+         * SGDBAccessRules passed in
+        */
+        if (props.SGDBAccessRules) {
+            props.SGDBAccessRules.forEach((rule) => {
+                const db_connect_SG = aws_cdk_lib_1.aws_ec2.SecurityGroup.fromSecurityGroupId(this, `SGAccess${rule.database}`, rule.database);
+                ec2SecurityGroup.connections.allowFrom(db_connect_SG, aws_cdk_lib_1.aws_ec2.Port.tcp(rule.port), rule.description);
+                ec2SecurityGroup.connections.allowTo(db_connect_SG, aws_cdk_lib_1.aws_ec2.Port.tcp(rule.port), rule.description);
+            });
+        }
         // With all of the information gathered, as well as values passed in, create the server
         const ec2_server = new aws_cdk_lib_1.aws_ec2.Instance(this, 'ec2-server', {
             blockDevices: [{
@@ -43,6 +113,7 @@ class EC2withDatabase extends aws_cdk_lib_1.Stack {
                         ebsDevice: {
                             volumeSize: props.volumeSize,
                             encrypted: true,
+                            kmsKey: backupKey,
                         },
                     },
                 }],
@@ -50,24 +121,33 @@ class EC2withDatabase extends aws_cdk_lib_1.Stack {
             role: ec2role,
             securityGroup: ec2SecurityGroup,
             machineImage: linux_build,
-            // keyName: props.keyName, // deprecated, replaced with keyPair below.
+            propagateTagsToVolumeOnCreation: true,
             keyPair: aws_cdk_lib_1.aws_ec2.KeyPair.fromKeyPairName(this, 'KeyPair', props.keyName),
             instanceType: aws_cdk_lib_1.aws_ec2.InstanceType.of(props.instanceClass, props.instanceSize),
             instanceName: props.instanceName,
-            privateIpAddress: props.privateIpAddress,
         });
         // Add an Elastic IP Address to the server
         const IPAddr = new aws_cdk_lib_1.aws_ec2.CfnEIP(this, 'Ip', {
             instanceId: ec2_server.instanceId,
         });
-        // Then tag the EIP
+        // Tag the server and the EIP with the instance name and FQDN
+        const FQDN = `${props.instanceName}.${props.domainName}`;
+        const schedule = '*'; // Initially the schedule is always up
+        const service = props.instanceName; // Initially the service is the instance name
+        // Then tag the EIP and the server
         aws_cdk_lib_1.Tags.of(IPAddr).add('Name', props.instanceName);
+        aws_cdk_lib_1.Tags.of(ec2_server).add('FQDN', FQDN);
+        aws_cdk_lib_1.Tags.of(ec2_server).add('Schedule', schedule);
+        aws_cdk_lib_1.Tags.of(ec2_server).add('Service', service);
+        if (props.backup) {
+            aws_cdk_lib_1.Tags.of(ec2_server).add('Backup', props.backup);
+        }
         // Create DNS for libnd.nd.edu connection
         const privateZoneId = ssm.StringParameter.fromStringParameterAttributes(this, 'PrivateZoneId', {
             parameterName: `/all/dns/${props.keyName}/private/zoneId`,
         }).stringValue;
         new aws_route53_1.ARecord(this, 'PrivateARec', {
-            target: aws_route53_1.RecordTarget.fromIpAddresses(props.privateIpAddress),
+            target: aws_route53_1.RecordTarget.fromIpAddresses(ec2_server.instancePrivateIp),
             recordName: props.instanceName,
             zone: aws_route53_1.HostedZone.fromHostedZoneAttributes(this, 'PrivateHostedZone', {
                 hostedZoneId: privateZoneId,
@@ -109,7 +189,7 @@ class EC2withDatabase extends aws_cdk_lib_1.Stack {
                 parameterName: `/all/dns/${props.domainName}/${direction}/zoneId`,
             }).stringValue;
             new aws_route53_1.ARecord(this, `${direction}ServiceARec`, {
-                target: aws_route53_1.RecordTarget.fromIpAddresses(props.privateIpAddress),
+                target: aws_route53_1.RecordTarget.fromIpAddresses(ec2_server.instancePrivateIp),
                 recordName: props.instanceName,
                 zone: aws_route53_1.HostedZone.fromHostedZoneAttributes(this, `${direction}ImportedHostedZone`, {
                     hostedZoneId: hostedZoneId,
@@ -120,7 +200,7 @@ class EC2withDatabase extends aws_cdk_lib_1.Stack {
             if (props.CnameList.length != 0) {
                 props.CnameList.forEach(cname => {
                     new aws_route53_1.ARecord(this, `${direction}${cname}`, {
-                        target: aws_route53_1.RecordTarget.fromIpAddresses(props.privateIpAddress),
+                        target: aws_route53_1.RecordTarget.fromIpAddresses(ec2_server.instancePrivateIp),
                         recordName: cname,
                         zone: aws_route53_1.HostedZone.fromHostedZoneAttributes(this, `${direction}${cname}HostedZone`, {
                             hostedZoneId: hostedZoneId,

package/lib/rds/postgres-stack.js

@@ -37,7 +37,7 @@ class PostgresRDSConstruct extends constructs_1.Construct {
             },
         });
         const parameterGroupDescription = `Parameter Group for ${props.dbClusterIdentifier}`;
-        let auroraParameters = {};
+        const auroraParameters = {};
         auroraParameters['timezone'] = 'US/Eastern';
         auroraParameters['idle_session_timeout'] = '60000'; // 1 minute idle timeout for any given session
         const libParameterGroup = new aws_rds_1.ParameterGroup(this, 'LibParameterGroup', {
@@ -87,6 +87,7 @@ class PostgresRDSConstruct extends constructs_1.Construct {
             storageEncrypted: true,
             parameterGroup: libParameterGroup,
             vpc: vpc,
+            enableDataApi: true,
             storageType: aws_rds_1.DBClusterStorageType.AURORA_IOPT1,
             deletionProtection: true,
             writer: aws_rds_1.ClusterInstance.serverlessV2('writer'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ndlib/ndlib-cdk2",
-  "version": "1.0.29",
+  "version": "1.0.31",
   "description": "Reusable CDK2 modules used within Hesburgh Libraries of Notre Dame",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -41,20 +41,20 @@
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",
-    "@types/node": "^22.10.0",
-    "@typescript-eslint/eslint-plugin": "^8.16.0",
-    "@typescript-eslint/parser": "^8.16.0",
+    "@types/node": "^22.10.2",
+    "@typescript-eslint/eslint-plugin": "^8.18.1",
+    "@typescript-eslint/parser": "^8.18.1",
     "aws-sdk-client-mock": "^4.1.0",
-    "eslint": "^9.15.0",
+    "eslint": "^9.17.0",
     "eslint-plugin-import": "^2.31.0",
     "eslint-plugin-jest": "^28.9.0",
-    "eslint-plugin-n": "^17.14.0",
+    "eslint-plugin-n": "^17.15.0",
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-promise": "^7.2.1",
     "github-changes": "^2.0.3",
     "jest": "^29.7.0",
     "jest-mock": "^29.7.0",
-    "prettier": "^3.4.1",
+    "prettier": "^3.4.2",
     "subpackage": "^1.1.0",
     "ts-jest": "^29.2.5",
     "tsc-watch": "^6.2.1",
@@ -64,7 +64,7 @@
     "lib/**/*"
   ],
   "dependencies": {
-    "aws-cdk-lib": "^2.171.0",
+    "aws-cdk-lib": "^2.173.2",
     "constructs": "^10.4.2",
     "node-fetch": "^3.3.2"
   },