@quadnix/octo-aws-cdk 0.2.0 → 0.2.1

package/dist/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution/actions/add-aws-ecs-execution.overlay.action.js

@@ -4,13 +4,19 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-import { Action, DiffAction, Factory, MatchingResource, OverlayActionExceptionTransactionError, SubnetType, hasNodeName, } from '@quadnix/octo';
+import { Action, DiffAction, Factory, MatchingAnchor, MatchingResource, OverlayActionExceptionTransactionError, StringUtility, SubnetType, hasNodeName, } from '@quadnix/octo';
+import { AwsDynamoDBAnchorSchema } from '../../../../../../anchors/aws-dynamodb/aws-dynamodb.anchor.schema.js';
+import { AwsEfsAnchorSchema } from '../../../../../../anchors/aws-efs/aws-efs.anchor.schema.js';
+import { AwsS3StorageServiceAccessPrefixAnchorSchema } from '../../../../../../anchors/aws-s3-storage-service/aws-s3-storage-service-access-prefix.anchor.schema.js';
+import { AwsSubnetLocalFilesystemMountAnchorSchema } from '../../../../../../anchors/aws-subnet/aws-subnet-local-filesystem-mount.anchor.schema.js';
+import { DynamoDBSchema } from '../../../../../../resources/dynamodb/index.schema.js';
 import { EcrImageTagSchema } from '../../../../../../resources/ecr-image-tag/index.schema.js';
 import { EcsClusterSchema } from '../../../../../../resources/ecs-cluster/index.schema.js';
 import { EcsService } from '../../../../../../resources/ecs-service/index.js';
 import { EcsTaskDefinition } from '../../../../../../resources/ecs-task-definition/index.js';
 import { EfsSchema } from '../../../../../../resources/efs/index.schema.js';
-import { IamRoleSchema } from '../../../../../../resources/iam-role/index.schema.js';
+import { IamRole } from '../../../../../../resources/iam-role/index.js';
+import { S3StorageSchema } from '../../../../../../resources/s3-storage/index.schema.js';
 import { SecurityGroupSchema } from '../../../../../../resources/security-group/index.schema.js';
 import { SubnetSchema } from '../../../../../../resources/subnet/index.schema.js';
 import { EcrImageUriUtility } from '../../../../../../utilities/ecr-image-uri/ecr-image-uri.utility.js';
@@ -36,9 +42,8 @@ let AddAwsEcsExecutionOverlayAction = class AddAwsEcsExecutionOverlayAction {
         const properties = awsExecutionOverlay.properties;
         const subnet = actionInputs.inputs.subnet;
         const { awsAccountId, awsRegionId } = actionInputs.metadata;
-        const [matchingMainIamRoleAnchor, ecsExecutionAnchor, matchingEcsClusterAnchor, securityGroupAnchor, ...matchingSubnetLocalFilesystemMountAnchors] = awsExecutionOverlay.anchors;
+        const [ecsExecutionAnchor, matchingEcsClusterAnchor, securityGroupAnchor] = awsExecutionOverlay.anchors;
         const ecsClusterAnchorProperties = matchingEcsClusterAnchor.getSchemaInstance().properties;
-        const mainIamRoleProperties = matchingMainIamRoleAnchor.getSchemaInstance().properties;
         // Calculate final environment variables.
         const environmentVariables = Object.keys(ecsClusterAnchorProperties.environmentVariables).map((key) => ({
             name: key,
@@ -54,36 +59,114 @@ let AddAwsEcsExecutionOverlayAction = class AddAwsEcsExecutionOverlayAction {
                 environmentVariables.push({ name: key, value });
             }
         }
-        // Get matching main IAM role resource.
-        const [matchingMainIamRoleResource] = await awsExecutionOverlay.getResourcesMatchingSchema(IamRoleSchema, [
-            { key: 'awsAccountId', value: awsAccountId },
-            { key: 'rolename', value: mainIamRoleProperties.iamRoleName },
-        ]);
-        if (!matchingMainIamRoleResource) {
-            throw new OverlayActionExceptionTransactionError(`IamRole "${mainIamRoleProperties.iamRoleName}" not found in "${awsAccountId}"!`, diff, this.constructor.name);
+        // Create IAM Role.
+        const iamRole = new IamRole(`iam-role-${properties.iamRoleName}`, {
+            awsAccountId,
+            policies: [
+                {
+                    policy: 'ecs-tasks.amazonaws.com',
+                    policyId: 'AmazonECSTasksAssumeRolePolicy',
+                    policyType: 'assume-role-policy',
+                },
+                {
+                    policy: 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy',
+                    policyId: 'AmazonECSTaskExecutionRolePolicy',
+                    policyType: 'aws-policy',
+                },
+            ],
+            rolename: properties.iamRoleName,
+        });
+        // Grant the role each bucket prefix, and admit the role to each bucket. A bucket is found through
+        // the access prefix anchor this overlay joins.
+        for (const grant of properties.grants.s3) {
+            const [matchingAccessPrefixAnchor] = await awsExecutionOverlay.getAnchorsMatchingSchema(AwsS3StorageServiceAccessPrefixAnchorSchema, [
+                { key: 'accessPrefix', value: grant.accessPrefix },
+                { key: 'bucketName', value: grant.bucketName },
+            ], { searchBoundaryMembers: false });
+            const [matchingS3StorageResource] = matchingAccessPrefixAnchor
+                ? await matchingAccessPrefixAnchor
+                    .getActual()
+                    .getParent()
+                    .getResourcesMatchingSchema(S3StorageSchema, [], [], { searchBoundaryMembers: false })
+                : [];
+            if (!matchingS3StorageResource) {
+                throw new OverlayActionExceptionTransactionError(`Bucket "${grant.bucketName}" not found!`, diff, this.constructor.name);
+            }
+            const policyId = `${properties.iamRoleName}-${StringUtility.deterministicHash([grant.bucketName, grant.accessPrefix]).substring(0, 12)}`;
+            iamRole.addS3BucketPolicy(policyId, matchingS3StorageResource, grant.accessPrefix, {
+                allowRead: grant.allowRead,
+                allowWrite: grant.allowWrite,
+            });
+            const s3Storage = matchingS3StorageResource.getActual();
+            s3Storage.addPermission(new MatchingResource(iamRole), grant.accessPrefix, {
+                allowRead: grant.allowRead,
+                allowWrite: grant.allowWrite,
+                principalType: 'aws',
+            });
+            actionOutputs[s3Storage.resourceId] = s3Storage;
+        }
+        // Grant the role each table. A table is found through the table anchor this overlay joins.
+        for (const grant of properties.grants.dynamodb) {
+            const [matchingDynamoDBAnchor] = await awsExecutionOverlay.getAnchorsMatchingSchema(AwsDynamoDBAnchorSchema, [
+                { key: 'awsRegionId', value: grant.awsRegionId },
+                { key: 'TableName', value: grant.tableName },
+            ], { searchBoundaryMembers: false });
+            const [matchingDynamoDBResource] = matchingDynamoDBAnchor
+                ? await matchingDynamoDBAnchor
+                    .getActual()
+                    .getParent()
+                    .getResourcesMatchingSchema(DynamoDBSchema, [], [], { searchBoundaryMembers: false })
+                : [];
+            if (!matchingDynamoDBResource) {
+                throw new OverlayActionExceptionTransactionError(`Table "${grant.tableName}" not found in "${grant.awsRegionId}"!`, diff, this.constructor.name);
+            }
+            const policyId = `${properties.iamRoleName}-${StringUtility.deterministicHash([grant.awsRegionId, grant.tableName]).substring(0, 12)}`;
+            iamRole.addDynamoDBTablePolicy(policyId, matchingDynamoDBResource, {
+                allowRead: grant.allowRead,
+                allowWrite: grant.allowWrite,
+            });
+        }
+        // Grant the role the server's IAM statements, as written.
+        if (properties.grants.iamStatements.length > 0) {
+            iamRole.addIamStatementsPolicy(`${properties.iamRoleName}-iam-statements`, properties.grants.iamStatements);
         }
-        // Get matching EFS resources based on mounts of subnet.
+        // Get matching EFS resources, each through the mount anchor this overlay joins and the filesystem
+        // anchor that mount joins.
         const efsList = [];
-        for (const matchingSubnetLocalFilesystemMountAnchor of matchingSubnetLocalFilesystemMountAnchors) {
-            const subnetFilesystemMountAnchorProperties = matchingSubnetLocalFilesystemMountAnchor.getSchemaInstance().properties;
-            const [matchingEfsResource] = await awsExecutionOverlay.getResourcesMatchingSchema(EfsSchema, [
-                { key: 'awsRegionId', value: awsRegionId },
-                { key: 'filesystemName', value: subnetFilesystemMountAnchorProperties.filesystemName },
-            ], []);
+        for (const filesystemName of properties.filesystemNames) {
+            const [matchingMountAnchor] = await awsExecutionOverlay.getAnchorsMatchingSchema(AwsSubnetLocalFilesystemMountAnchorSchema, [{ key: 'filesystemName', value: filesystemName }], { searchBoundaryMembers: false });
+            const [matchingEfsAnchor] = matchingMountAnchor
+                ? await matchingMountAnchor
+                    .getActual()
+                    .getParent()
+                    .getAnchorsMatchingSchema(AwsEfsAnchorSchema, [], { searchBoundaryMembers: false })
+                : [];
+            const [matchingEfsResource] = matchingEfsAnchor
+                ? await matchingEfsAnchor
+                    .getActual()
+                    .getParent()
+                    .getResourcesMatchingSchema(EfsSchema, [], [], { searchBoundaryMembers: false })
+                : [];
             if (!matchingEfsResource) {
-                throw new OverlayActionExceptionTransactionError(`Filesystem "${subnetFilesystemMountAnchorProperties.filesystemName}" not found in "${awsRegionId}"!`, diff, this.constructor.name);
+                throw new OverlayActionExceptionTransactionError(`Filesystem "${filesystemName}" not found in "${awsRegionId}"!`, diff, this.constructor.name);
             }
             efsList.push(matchingEfsResource);
         }
         // Get the published images this task definition runs, so that none of them can be deleted while
-        // it still names them. An image octo did not publish has no resource to match, and is skipped.
+        // it still names them. A tag is found through the image it is published into, which the deployment
+        // links to, and must be published where the task runs. An image octo did not publish has no
+        // resource to match, and is skipped.
+        const imageModels = awsExecutionOverlay.anchors
+            .map((a) => (a instanceof MatchingAnchor ? a.getActual().getParent() : a.getParent()))
+            .filter((m) => hasNodeName(m, 'image'));
         const ecrImageTagList = [];
         for (const image of properties.deploymentContainerProperties.images) {
             const imageReference = EcrImageUriUtility.parse(image.uri);
             if (!imageReference) {
                 continue;
             }
-            const [matchingEcrImageTagResource] = await awsExecutionOverlay.getResourcesMatchingSchema(EcrImageTagSchema, [
+            const linkedImage = imageModels.find((m) => m.imageId === imageReference.imageId);
+            const [matchingEcrImageTagResource] = await (linkedImage ?? awsExecutionOverlay).getResourcesMatchingSchema(EcrImageTagSchema, [
                 { key: 'awsAccountId', value: imageReference.awsAccountId },
                 { key: 'awsRegionId', value: imageReference.awsRegionId },
                 { key: 'imageId', value: imageReference.imageId },
@@ -92,43 +175,50 @@ let AddAwsEcsExecutionOverlayAction = class AddAwsEcsExecutionOverlayAction {
             if (matchingEcrImageTagResource) {
                 ecrImageTagList.push(matchingEcrImageTagResource);
             }
+            else if (linkedImage) {
+                throw new OverlayActionExceptionTransactionError(`Image "${imageReference.imageId}:${imageReference.imageTag}" is not published in "${imageReference.awsRegionId}"!`, diff, this.constructor.name);
+            }
+        }
+        // Run the task on the processor its published images were built for. An image octo did not
+        // publish carries no processor, and leaves ECS's default.
+        const architectures = [...new Set(ecrImageTagList.map((t) => t.getSchemaInstance().properties.architecture))];
+        if (architectures.length > 1) {
+            throw new OverlayActionExceptionTransactionError(`Images of execution "${properties.executionId}" are built for different processors!`, diff, this.constructor.name);
         }
         // Create ECS Task Definition.
         const ecsTaskDefinition = new EcsTaskDefinition(`ecs-task-definition-${properties.executionId}`, {
+            architecture: architectures[0] ?? 'x86_64',
             awsAccountId,
             awsRegionId,
             cpu: properties.deploymentContainerProperties.cpu,
             deploymentTag: properties.deploymentTag,
             environmentVariables,
-            family: `${properties.environmentName}-${properties.subnetId}-${properties.serverKey}`,
+            family: properties.executionId,
             images: properties.deploymentContainerProperties.images,
             memory: properties.deploymentContainerProperties.memory,
-        }, [matchingMainIamRoleResource, ...ecrImageTagList, ...efsList]);
-        // Get matching ECS Cluster resource.
-        const [matchingEcsClusterResource] = await awsExecutionOverlay.getResourcesMatchingSchema(EcsClusterSchema, [
-            { key: 'awsAccountId', value: awsAccountId },
-            { key: 'awsRegionId', value: awsRegionId },
-            { key: 'clusterName', value: ecsClusterAnchorProperties.clusterName },
-        ]);
+        }, [new MatchingResource(iamRole), ...ecrImageTagList, ...efsList]);
+        // Get matching ECS Cluster resource, from the environment the cluster anchor belongs to.
+        const [matchingEcsClusterResource] = await matchingEcsClusterAnchor
+            .getActual()
+            .getParent()
+            .getResourcesMatchingSchema(EcsClusterSchema, [], [], { searchBoundaryMembers: false });
         if (!matchingEcsClusterResource) {
             throw new OverlayActionExceptionTransactionError(`ECS Cluster "${ecsClusterAnchorProperties.clusterName}" not found!`, diff, this.constructor.name);
         }
-        // Get matching Subnet resource.
-        const [matchingSubnetResource] = await awsExecutionOverlay.getResourcesMatchingSchema(SubnetSchema, [
-            { key: 'awsAccountId', value: awsAccountId },
-            { key: 'awsRegionId', value: awsRegionId },
-            { key: 'subnetName', value: subnet.subnetName },
-        ]);
+        // Get matching Subnet resource, from the subnet itself.
+        const [matchingSubnetResource] = await subnet.getResourcesMatchingSchema(SubnetSchema, [], [], {
+            searchBoundaryMembers: false,
+        });
         if (!matchingSubnetResource) {
             throw new OverlayActionExceptionTransactionError(`Subnet "${subnet.subnetName}" not found!`, diff, this.constructor.name);
         }
-        // Get matching execution's SecurityGroup resources - server, sidecar server, and execution SGs.
+        // Get matching execution's SecurityGroup resource, holding the rules of every server it runs.
         const execution = securityGroupAnchor.getParent();
-        const matchingExecutionSGResources = await execution.getResourcesMatchingSchema(SecurityGroupSchema, [], [], {
+        const [matchingExecutionSGResource] = await execution.getResourcesMatchingSchema(SecurityGroupSchema, [], [], {
             searchBoundaryMembers: false,
         });
-        if (matchingExecutionSGResources.length !== 2 + actionInputs.inputs.deployments.sidecars.length) {
-            throw new OverlayActionExceptionTransactionError('One or more security groups from main server, sidecar server, and/or execution not found!', diff, this.constructor.name);
+        if (!matchingExecutionSGResource) {
+            throw new OverlayActionExceptionTransactionError(`Security group of execution "${properties.executionId}" not found!`, diff, this.constructor.name);
         }
         // Create ECS Service.
         const ecsService = new EcsService(`ecs-service-${properties.executionId}`, {
@@ -142,8 +232,9 @@ let AddAwsEcsExecutionOverlayAction = class AddAwsEcsExecutionOverlayAction {
             matchingEcsClusterResource,
             new MatchingResource(ecsTaskDefinition),
             matchingSubnetResource,
-            ...matchingExecutionSGResources,
+            matchingExecutionSGResource,
         ]);
+        actionOutputs[iamRole.resourceId] = iamRole;
         actionOutputs[ecsTaskDefinition.resourceId] = ecsTaskDefinition;
         actionOutputs[ecsService.resourceId] = ecsService;
         return actionOutputs;

package/dist/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution/actions/add-aws-ecs-execution.overlay.action.js.map

@@ -1 +1 @@
-{"version":3,"file":"add-aws-ecs-execution.overlay.action.js","sourceRoot":"","sources":["../../../../../../../src/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution/actions/add-aws-ecs-execution.overlay.action.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EACL,MAAM,EAGN,UAAU,EAGV,OAAO,EAEP,gBAAgB,EAChB,sCAAsC,EACtC,UAAU,EACV,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,2DAA2D,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,kDAAkD,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,iDAAiD,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,oDAAoD,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oEAAoE,CAAC;AAExG,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;GAEG;AAEI,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAC1C;;OAEG;IACH,MAAM,CAAC,IAAU;QACf,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG;YAC9B,IAAI,CAAC,IAAI,YAAY,sBAAsB;YAC3C,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,2BAA2B,CAAC;YACnD,IAAI,CAAC,KAAK,KAAK,WAAW,CAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,IAAkC,EAClC,YAAyD,EACzD,aAA4B;QAE5B,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC;QACtC,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC;QAElD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1C,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;QAE5D,MAAM,CACJ,yBAAyB,EACzB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,GAAG,yCAAyC,CAC7C,GAAG,mBAAmB,CAAC,OAAO,CAAC;QAEhC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;QAC3F,MAAM,qBAAqB,GAAG,yBAAyB,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;QAEvF,yCAAyC;QACzC,MAAM,oBAAoB,GAAsC,MAAM,CAAC,IAAI,CACzE,0BAA0B,CAAC,oBAAoB,CAChD,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACd,IAAI,EAAE,GAAG;YACT,KAAK,EAAE,0BAA0B,CAAC,oBAAoB,CAAC,GAAG,CAAC;SAC5D,CAAC,CAAC,CAAC;QACJ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAClF,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;YACvE,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpB,oBAAoB,CAAC,QAAQ,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,uCAAuC;QACvC,MAAM,CAAC,2BAA2B,CAAC,GAAG,MAAM,mBAAmB,CAAC,0BAA0B,CAAC,aAAa,EAAE;YACxG,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE;YAC5C,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,qBAAqB,CAAC,WAAW,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACjC,MAAM,IAAI,sCAAsC,CAC9C,YAAY,qBAAqB,CAAC,WAAW,mBAAmB,YAAY,IAAI,EAChF,IAAI,EACJ,IAAI,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC;QACJ,CAAC;QAED,wDAAwD;QACxD,MAAM,OAAO,GAAkC,EAAE,CAAC;QAClD,KAAK,MAAM,wCAAwC,IAAI,yCAAyC,EAAE,CAAC;YACjG,MAAM,qCAAqC,GACzC,wCAAwC,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;YAC1E,MAAM,CAAC,mBAAmB,CAAC,GAAG,MAAM,mBAAmB,CAAC,0BAA0B,CAChF,SAAS,EACT;gBACE,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE;gBAC1C,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,qCAAqC,CAAC,cAAc,EAAE;aACvF,EACD,EAAE,CACH,CAAC;YACF,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,IAAI,sCAAsC,CAC9C,eAAe,qCAAqC,CAAC,cAAc,mBAAmB,WAAW,IAAI,EACrG,IAAI,EACJ,IAAI,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACpC,CAAC;QAED,gGAAgG;QAChG,+FAA+F;QAC/F,MAAM,eAAe,GAA0C,EAAE,CAAC;QAClE,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,6BAA6B,CAAC,MAAM,EAAE,CAAC;YACpE,MAAM,cAAc,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,MAAM,CAAC,2BAA2B,CAAC,GAAG,MAAM,mBAAmB,CAAC,0BAA0B,CAAC,iBAAiB,EAAE;gBAC5G,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,CAAC,YAAY,EAAE;gBAC3D,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,CAAC,WAAW,EAAE;gBACzD,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,OAAO,EAAE;gBACjD,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,CAAC,QAAQ,EAAE;aACpD,CAAC,CAAC;YACH,IAAI,2BAA2B,EAAE,CAAC;gBAChC,eAAe,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAC7C,uBAAuB,UAAU,CAAC,WAAW,EAAE,EAC/C;YACE,YAAY;YACZ,WAAW;YACX,GAAG,EAAE,UAAU,CAAC,6BAA6B,CAAC,GAAG;YACjD,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,oBAAoB;YACpB,MAAM,EAAE,GAAG,UAAU,CAAC,eAAe,IAAI,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE;YACtF,MAAM,EAAE,UAAU,CAAC,6BAA6B,CAAC,MAAM;YACvD,MAAM,EAAE,UAAU,CAAC,6BAA6B,CAAC,MAAM;SACxD,EACD,CAAC,2BAA2B,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,CAC9D,CAAC;QAEF,qCAAqC;QACrC,MAAM,CAAC,0BAA0B,CAAC,GAAG,MAAM,mBAAmB,CAAC,0BAA0B,CAAC,gBAAgB,EAAE;YAC1G,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE;YAC5C,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE;YAC1C,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,0BAA0B,CAAC,WAAW,EAAE;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAChC,MAAM,IAAI,sCAAsC,CAC9C,gBAAgB,0BAA0B,CAAC,WAAW,cAAc,EACpE,IAAI,EACJ,IAAI,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,MAAM,CAAC,sBAAsB,CAAC,GAAG,MAAM,mBAAmB,CAAC,0BAA0B,CAAC,YAAY,EAAE;YAClG,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE;YAC5C,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE;YAC1C,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,MAAM,IAAI,sCAAsC,CAC9C,WAAW,MAAM,CAAC,UAAU,cAAc,EAC1C,IAAI,EACJ,IAAI,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC;QACJ,CAAC;QAED,gGAAgG;QAChG,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAe,CAAC;QAC/D,MAAM,4BAA4B,GAAG,MAAM,SAAS,CAAC,0BAA0B,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,EAAE;YAC3G,qBAAqB,EAAE,KAAK;SAC7B,CAAC,CAAC;QACH,IAAI,4BAA4B,CAAC,MAAM,KAAK,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChG,MAAM,IAAI,sCAAsC,CAC9C,2FAA2F,EAC3F,IAAI,EACJ,IAAI,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,eAAe,UAAU,CAAC,WAAW,EAAE,EACvC;YACE,cAAc,EAAE,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YACpF,YAAY;YACZ,WAAW;YACX,YAAY,EAAE,kBAAkB,CAAC,UAAU,CAAC,YAAY;YACxD,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACxD,EACD;YACE,0BAA0B;YAC1B,IAAI,gBAAgB,CAAC,iBAAiB,CAAC;YACvC,sBAAsB;YACtB,GAAG,4BAA4B;SAChC,CACF,CAAC;QAEF,aAAa,CAAC,iBAAiB,CAAC,UAAU,CAAC,GAAG,iBAAiB,CAAC;QAEhE,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC;QAElD,OAAO,aAAa,CAAC;IACvB,CAAC;CACF,CAAA;AAlMY,+BAA+B;IAD3C,MAAM,CAAC,sBAAsB,CAAC;GAClB,+BAA+B,CAkM3C;;AAED;;GAEG;AAEI,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAGjD;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM;QACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,+BAA+B,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF,CAAA;AAZY,sCAAsC;IADlD,OAAO,CAAkC,+BAA+B,CAAC;GAC7D,sCAAsC,CAYlD"}
+{"version":3,"file":"add-aws-ecs-execution.overlay.action.js","sourceRoot":"","sources":["../../../../../../../src/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution/actions/add-aws-ecs-execution.overlay.action.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EACL,MAAM,EAGN,UAAU,EAGV,OAAO,EAGP,cAAc,EACd,gBAAgB,EAChB,sCAAsC,EACtC,aAAa,EACb,UAAU,EACV,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,kBAAkB,EAAE,MAAM,4DAA4D,CAAC;AAChG,OAAO,EAAE,2CAA2C,EAAE,MAAM,wGAAwG,CAAC;AACrK,OAAO,EAAE,yCAAyC,EAAE,MAAM,yFAAyF,CAAC;AACpJ,OAAO,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2DAA2D,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,kDAAkD,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,iDAAiD,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,+CAA+C,CAAC;AAExE,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,oDAAoD,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oEAAoE,CAAC;AAExG,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;GAEG;AAEI,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAC1C;;OAEG;IACH,MAAM,CAAC,IAAU;QACf,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG;YAC9B,IAAI,CAAC,IAAI,YAAY,sBAAsB;YAC3C,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,2BAA2B,CAAC;YACnD,IAAI,CAAC,KAAK,KAAK,WAAW,CAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,IAAkC,EAClC,YAAyD,EACzD,aAA4B;QAE5B,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC;QACtC,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC;QAElD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1C,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;QAE5D,MAAM,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,mBAAmB,CAAC,GAAG,mBAAmB,CAAC,OAAO,CAAC;QAExG,MAAM,0BAA0B,GAAG,wBAAwB,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC;QAE3F,yCAAyC;QACzC,MAAM,oBAAoB,GAAsC,MAAM,CAAC,IAAI,CACzE,0BAA0B,CAAC,oBAAoB,CAChD,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACd,IAAI,EAAE,GAAG;YACT,KAAK,EAAE,0BAA0B,CAAC,oBAAoB,CAAC,GAAG,CAAC;SAC5D,CAAC,CAAC,CAAC;QACJ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAClF,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;YACvE,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpB,oBAAoB,CAAC,QAAQ,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,YAAY,UAAU,CAAC,WAAW,EAAE,EAAE;YAChE,YAAY;YACZ,QAAQ,EAAE;gBACR;oBACE,MAAM,EAAE,yBAAyB;oBACjC,QAAQ,EAAE,gCAAgC;oBAC1C,UAAU,EAAE,oBAAoB;iBACjC;gBACD;oBACE,MAAM,EAAE,uEAAuE;oBAC/E,QAAQ,EAAE,kCAAkC;oBAC5C,UAAU,EAAE,YAAY;iBACzB;aACF;YACD,QAAQ,EAAE,UAAU,CAAC,WAAW;SACjC,CAAC,CAAC;QAEH,kGAAkG;QAClG,+CAA+C;QAC/C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,0BAA0B,CAAC,GAAG,MAAM,mBAAmB,CAAC,wBAAwB,CACrF,2CAA2C,EAC3C;gBACE,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE;gBAClD,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;aAC/C,EACD,EAAE,qBAAqB,EAAE,KAAK,EAAE,CACjC,CAAC;YACF,MAAM,CAAC,yBAAyB,CAAC,GAAG,0BAA0B;gBAC5D,CAAC,CAAC,MAAM,0BAA0B;qBAC7B,SAAS,EAAE;qBACX,SAAS,EAAE;qBACX,0BAA0B,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;gBAC1F,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBAC/B,MAAM,IAAI,sCAAsC,CAC9C,WAAW,KAAK,CAAC,UAAU,cAAc,EACzC,IAAI,EACJ,IAAI,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,GAAG,UAAU,CAAC,WAAW,IAAI,aAAa,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACzI,OAAO,CAAC,iBAAiB,CAAC,QAAQ,EAAE,yBAAyB,EAAE,KAAK,CAAC,YAAY,EAAE;gBACjF,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,yBAAyB,CAAC,SAAS,EAAe,CAAC;YACrE,SAAS,CAAC,aAAa,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,YAAY,EAAE;gBACzE,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,aAAa,EAAE,KAAK;aACrB,CAAC,CAAC;YACH,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;QAClD,CAAC;QAED,2FAA2F;QAC3F,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC/C,MAAM,CAAC,sBAAsB,CAAC,GAAG,MAAM,mBAAmB,CAAC,wBAAwB,CACjF,uBAAuB,EACvB;gBACE,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;gBAChD,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE;aAC7C,EACD,EAAE,qBAAqB,EAAE,KAAK,EAAE,CACjC,CAAC;YACF,MAAM,CAAC,wBAAwB,CAAC,GAAG,sBAAsB;gBACvD,CAAC,CAAC,MAAM,sBAAsB;qBACzB,SAAS,EAAE;qBACX,SAAS,EAAE;qBACX,0BAA0B,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;gBACzF,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,wBAAwB,EAAE,CAAC;gBAC9B,MAAM,IAAI,sCAAsC,CAC9C,UAAU,KAAK,CAAC,SAAS,mBAAmB,KAAK,CAAC,WAAW,IAAI,EACjE,IAAI,EACJ,IAAI,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,GAAG,UAAU,CAAC,WAAW,IAAI,aAAa,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACvI,OAAO,CAAC,sBAAsB,CAAC,QAAQ,EAAE,wBAAwB,EAAE;gBACjE,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,0DAA0D;QAC1D,IAAI,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,sBAAsB,CAAC,GAAG,UAAU,CAAC,WAAW,iBAAiB,EAAE,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9G,CAAC;QAED,kGAAkG;QAClG,2BAA2B;QAC3B,MAAM,OAAO,GAAkC,EAAE,CAAC;QAClD,KAAK,MAAM,cAAc,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;YACxD,MAAM,CAAC,mBAAmB,CAAC,GAAG,MAAM,mBAAmB,CAAC,wBAAwB,CAC9E,yCAAyC,EACzC,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAClD,EAAE,qBAAqB,EAAE,KAAK,EAAE,CACjC,CAAC;YACF,MAAM,CAAC,iBAAiB,CAAC,GAAG,mBAAmB;gBAC7C,CAAC,CAAC,MAAM,mBAAmB;qBACtB,SAAS,EAAE;qBACX,SAAS,EAAE;qBACX,wBAAwB,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;gBACvF,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,CAAC,mBAAmB,CAAC,GAAG,iBAAiB;gBAC7C,CAAC,CAAC,MAAM,iBAAiB;qBACpB,SAAS,EAAE;qBACX,SAAS,EAAE;qBACX,0BAA0B,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;gBACpF,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,IAAI,sCAAsC,CAC9C,eAAe,cAAc,mBAAmB,WAAW,IAAI,EAC/D,IAAI,EACJ,IAAI,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACpC,CAAC;QAED,gGAAgG;QAChG,mGAAmG;QACnG,4FAA4F;QAC5F,qCAAqC;QACrC,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO;aAC5C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;aACrF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAY,CAAC;QACrD,MAAM,eAAe,GAA0C,EAAE,CAAC;QAClE,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,6BAA6B,CAAC,MAAM,EAAE,CAAC;YACpE,MAAM,cAAc,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,cAAc,CAAC,OAAO,CAAC,CAAC;YAClF,MAAM,CAAC,2BAA2B,CAAC,GAAG,MAAM,CAAC,WAAW,IAAI,mBAAmB,CAAC,CAAC,0BAA0B,CACzG,iBAAiB,EACjB;gBACE,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,CAAC,YAAY,EAAE;gBAC3D,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,CAAC,WAAW,EAAE;gBACzD,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,OAAO,EAAE;gBACjD,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,CAAC,QAAQ,EAAE;aACpD,CACF,CAAC;YACF,IAAI,2BAA2B,EAAE,CAAC;gBAChC,eAAe,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YACpD,CAAC;iBAAM,IAAI,WAAW,EAAE,CAAC;gBACvB,MAAM,IAAI,sCAAsC,CAC9C,UAAU,cAAc,CAAC,OAAO,IAAI,cAAc,CAAC,QAAQ,0BAA0B,cAAc,CAAC,WAAW,IAAI,EACnH,IAAI,EACJ,IAAI,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2FAA2F;QAC3F,0DAA0D;QAC1D,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9G,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,sCAAsC,CAC9C,wBAAwB,UAAU,CAAC,WAAW,uCAAuC,EACrF,IAAI,EACJ,IAAI,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAC7C,uBAAuB,UAAU,CAAC,WAAW,EAAE,EAC/C;YACE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,QAAQ;YAC1C,YAAY;YACZ,WAAW;YACX,GAAG,EAAE,UAAU,CAAC,6BAA6B,CAAC,GAAG;YACjD,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,oBAAoB;YACpB,MAAM,EAAE,UAAU,CAAC,WAAW;YAC9B,MAAM,EAAE,UAAU,CAAC,6BAA6B,CAAC,MAAM;YACvD,MAAM,EAAE,UAAU,CAAC,6BAA6B,CAAC,MAAM;SACxD,EACD,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,CAChE,CAAC;QAEF,yFAAyF;QACzF,MAAM,CAAC,0BAA0B,CAAC,GAAG,MAAM,wBAAwB;aAChE,SAAS,EAAE;aACX,SAAS,EAAE;aACX,0BAA0B,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAChC,MAAM,IAAI,sCAAsC,CAC9C,gBAAgB,0BAA0B,CAAC,WAAW,cAAc,EACpE,IAAI,EACJ,IAAI,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC;QACJ,CAAC;QAED,wDAAwD;QACxD,MAAM,CAAC,sBAAsB,CAAC,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE;YAC7F,qBAAqB,EAAE,KAAK;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,MAAM,IAAI,sCAAsC,CAC9C,WAAW,MAAM,CAAC,UAAU,cAAc,EAC1C,IAAI,EACJ,IAAI,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAe,CAAC;QAC/D,MAAM,CAAC,2BAA2B,CAAC,GAAG,MAAM,SAAS,CAAC,0BAA0B,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,EAAE;YAC5G,qBAAqB,EAAE,KAAK;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACjC,MAAM,IAAI,sCAAsC,CAC9C,gCAAgC,UAAU,CAAC,WAAW,cAAc,EACpE,IAAI,EACJ,IAAI,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,eAAe,UAAU,CAAC,WAAW,EAAE,EACvC;YACE,cAAc,EAAE,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YACpF,YAAY;YACZ,WAAW;YACX,YAAY,EAAE,kBAAkB,CAAC,UAAU,CAAC,YAAY;YACxD,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACxD,EACD;YACE,0BAA0B;YAC1B,IAAI,gBAAgB,CAAC,iBAAiB,CAAC;YACvC,sBAAsB;YACtB,2BAA2B;SAC5B,CACF,CAAC;QAEF,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC;QAE5C,aAAa,CAAC,iBAAiB,CAAC,UAAU,CAAC,GAAG,iBAAiB,CAAC;QAEhE,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC;QAElD,OAAO,aAAa,CAAC;IACvB,CAAC;CACF,CAAA;AA9SY,+BAA+B;IAD3C,MAAM,CAAC,sBAAsB,CAAC;GAClB,+BAA+B,CA8S3C;;AAED;;GAEG;AAEI,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAGjD;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM;QACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,+BAA+B,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF,CAAA;AAZY,sCAAsC;IADlD,OAAO,CAAkC,+BAA+B,CAAC;GAC7D,sCAAsC,CAYlD"}

package/dist/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution/aws-ecs-execution.overlay.d.ts

@@ -1,31 +1,35 @@
 import { AOverlay, type Diff, type MatchingAnchor } from '@quadnix/octo';
+import type { AwsDynamoDBAnchorSchema } from '../../../../../anchors/aws-dynamodb/aws-dynamodb.anchor.schema.js';
+import type { AwsEcrImageAnchorSchema } from '../../../../../anchors/aws-ecr/aws-ecr-image.anchor.schema.js';
 import type { AwsEcsClusterAnchorSchema } from '../../../../../anchors/aws-ecs/aws-ecs-cluster.anchor.schema.js';
 import type { AwsEcsExecutionAnchor } from '../../../../../anchors/aws-ecs/aws-ecs-execution.anchor.js';
-import type { AwsIamRoleAnchorSchema } from '../../../../../anchors/aws-iam/aws-iam-role.anchor.schema.js';
+import type { AwsS3StorageServiceAccessPrefixAnchorSchema } from '../../../../../anchors/aws-s3-storage-service/aws-s3-storage-service-access-prefix.anchor.schema.js';
 import type { AwsSecurityGroupAnchor } from '../../../../../anchors/aws-security-group/aws-security-group.anchor.js';
 import type { AwsSubnetLocalFilesystemMountAnchorSchema } from '../../../../../anchors/aws-subnet/aws-subnet-local-filesystem-mount.anchor.schema.js';
 import { AwsEcsExecutionOverlaySchema } from './aws-ecs-execution.schema.js';
 /**
+ * Joins an execution to its cluster and security group, and to every filesystem mount, granted bucket
+ * prefix and table, and published image it uses. Its action creates the IAM role, the task definition,
+ * and the service.
+ *
  * @internal
  */
 export declare class AwsEcsExecutionOverlay extends AOverlay<AwsEcsExecutionOverlaySchema, AwsEcsExecutionOverlay> {
     anchors: [
-        MatchingAnchor<AwsIamRoleAnchorSchema>,
         AwsEcsExecutionAnchor,
         MatchingAnchor<AwsEcsClusterAnchorSchema>,
         AwsSecurityGroupAnchor,
-        ...MatchingAnchor<AwsSubnetLocalFilesystemMountAnchorSchema>[]
+        ...(MatchingAnchor<AwsSubnetLocalFilesystemMountAnchorSchema> | MatchingAnchor<AwsS3StorageServiceAccessPrefixAnchorSchema> | MatchingAnchor<AwsDynamoDBAnchorSchema> | MatchingAnchor<AwsEcrImageAnchorSchema>)[]
     ];
     properties: AwsEcsExecutionOverlaySchema['properties'];
     /**
      * @internal
      */
     constructor(overlayId: string, properties: AwsEcsExecutionOverlaySchema['properties'], anchors: [
-        MatchingAnchor<AwsIamRoleAnchorSchema>,
         AwsEcsExecutionAnchor,
         MatchingAnchor<AwsEcsClusterAnchorSchema>,
         AwsSecurityGroupAnchor,
-        ...MatchingAnchor<AwsSubnetLocalFilesystemMountAnchorSchema>[]
+        ...(MatchingAnchor<AwsSubnetLocalFilesystemMountAnchorSchema> | MatchingAnchor<AwsS3StorageServiceAccessPrefixAnchorSchema> | MatchingAnchor<AwsDynamoDBAnchorSchema> | MatchingAnchor<AwsEcrImageAnchorSchema>)[]
     ]);
     /**
      * @internal

package/dist/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution/aws-ecs-execution.overlay.js

@@ -10,6 +10,10 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 import { AOverlay, Overlay } from '@quadnix/octo';
 import { AwsEcsExecutionOverlaySchema } from './aws-ecs-execution.schema.js';
 /**
+ * Joins an execution to its cluster and security group, and to every filesystem mount, granted bucket
+ * prefix and table, and published image it uses. Its action creates the IAM role, the task definition,
+ * and the service.
+ *
  * @internal
  */
 let AwsEcsExecutionOverlay = class AwsEcsExecutionOverlay extends AOverlay {

package/dist/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution/aws-ecs-execution.overlay.js.map

@@ -1 +1 @@
-{"version":3,"file":"aws-ecs-execution.overlay.js","sourceRoot":"","sources":["../../../../../../src/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution/aws-ecs-execution.overlay.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAkC,OAAO,EAAE,MAAM,eAAe,CAAC;AAMlF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAE7E;;GAEG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,QAA8D;IAUxG;;OAEG;IACH,YACE,SAAiB,EACjB,UAAsD,EACtD,OAMC;QAED,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,WAAW;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAA;AAjCY,sBAAsB;IADlC,OAAO,CAAC,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,CAAC;;GAC/D,sBAAsB,CAiClC"}
+{"version":3,"file":"aws-ecs-execution.overlay.js","sourceRoot":"","sources":["../../../../../../src/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution/aws-ecs-execution.overlay.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAkC,OAAO,EAAE,MAAM,eAAe,CAAC;AAQlF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAE7E;;;;;;GAMG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,QAA8D;IAcxG;;OAEG;IACH,YACE,SAAiB,EACjB,UAAsD,EACtD,OAUC;QAED,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,WAAW;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAA;AAzCY,sBAAsB;IADlC,OAAO,CAAC,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,CAAC;;GAC/D,sBAAsB,CAyClC"}

package/dist/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution/aws-ecs-execution.schema.d.ts

@@ -9,6 +9,26 @@ export declare class AwsEcsExecutionOverlaySchema extends BaseOverlaySchema {
         deploymentTag: string;
         environmentName: string;
         executionId: string;
+        filesystemNames: string[];
+        grants: {
+            dynamodb: {
+                allowRead: boolean;
+                allowWrite: boolean;
+                awsRegionId: string;
+                tableName: string;
+            }[];
+            iamStatements: {
+                actions: string[];
+                resources: string[];
+            }[];
+            s3: {
+                accessPrefix: string;
+                allowRead: boolean;
+                allowWrite: boolean;
+                bucketName: string;
+            }[];
+        };
+        iamRoleName: string;
         regionId: string;
         serverKey: string;
         subnetId: string;

package/dist/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution/aws-ecs-execution.schema.js

@@ -31,6 +31,11 @@ __decorate([
                 value.deploymentTag,
                 value.environmentName,
                 value.executionId,
+                ...value.filesystemNames,
+                ...value.grants.dynamodb.flatMap((g) => [g.awsRegionId, g.tableName]),
+                ...value.grants.iamStatements.flatMap((g) => [...g.actions, ...g.resources]),
+                ...value.grants.s3.map((g) => g.bucketName),
+                value.iamRoleName,
                 value.regionId,
                 value.serverKey,
                 value.subnetId,

package/dist/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution/aws-ecs-execution.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"aws-ecs-execution.schema.js","sourceRoot":"","sources":["../../../../../../src/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution/aws-ecs-execution.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAmB,QAAQ,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,8DAA8D,CAAC;AAEtE;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,iBAAiB;IAAnE;;QAsBW,eAAU,GAAG,MAAM,EASxB,CAAC;IACP,CAAC;CAAA;AAVU;IArBR,QAAQ,CAAU;QACjB;YACE,QAAQ,EAAE,CAAC,KAAiD,EAAkC,EAAE,CAC9F,KAAK,CAAC,6BAA6B,CAAC,MAAM;YAC5C,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,EAAE;SAChE;QACD;YACE,QAAQ,EAAE,CAAC,KAAiD,EAAY,EAAE,CAAC;gBACzE,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,GAAG,CAAC;gBAC/C,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,MAAM,CAAC;gBAClD,KAAK,CAAC,aAAa;gBACnB,KAAK,CAAC,eAAe;gBACrB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,UAAU;aACjB;YACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;SAC1B;KACF,CAAC;;gEAUG"}
+{"version":3,"file":"aws-ecs-execution.schema.js","sourceRoot":"","sources":["../../../../../../src/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution/aws-ecs-execution.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAmB,QAAQ,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,8DAA8D,CAAC;AAEtE;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,iBAAiB;IAAnE;;QA2BW,eAAU,GAAG,MAAM,EAgBxB,CAAC;IACP,CAAC;CAAA;AAjBU;IA1BR,QAAQ,CAAU;QACjB;YACE,QAAQ,EAAE,CAAC,KAAiD,EAAkC,EAAE,CAC9F,KAAK,CAAC,6BAA6B,CAAC,MAAM;YAC5C,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,EAAE;SAChE;QACD;YACE,QAAQ,EAAE,CAAC,KAAiD,EAAY,EAAE,CAAC;gBACzE,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,GAAG,CAAC;gBAC/C,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,MAAM,CAAC;gBAClD,KAAK,CAAC,aAAa;gBACnB,KAAK,CAAC,eAAe;gBACrB,KAAK,CAAC,WAAW;gBACjB,GAAG,KAAK,CAAC,eAAe;gBACxB,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;gBACrE,GAAG,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC5E,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC3C,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,UAAU;aACjB;YACD,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;SAC1B;KACF,CAAC;;gEAiBG"}

package/dist/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution-server-security-group/actions/add-aws-ecs-execution-server-security-group.overlay.action.js

@@ -4,7 +4,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-import { Action, DiffAction, Factory, MatchingAnchor, hasNodeName, } from '@quadnix/octo';
+import { Action, DiffAction, Factory, hasNodeName, } from '@quadnix/octo';
 import { SecurityGroup } from '../../../../../../resources/security-group/index.js';
 import { VpcSchema } from '../../../../../../resources/vpc/index.schema.js';
 import { AwsEcsExecutionServerSecurityGroupOverlay } from '../aws-ecs-execution-server-security-group.overlay.js';
@@ -26,27 +26,39 @@ let AddAwsEcsExecutionServerSecurityGroupOverlayAction = class AddAwsEcsExecutio
      */
     async handle(diff, actionInputs, actionOutputs) {
         const securityGroupOverlay = diff.node;
-        const anchors = securityGroupOverlay.anchors;
+        const [executionSecurityGroupAnchor, ...serverSecurityGroupAnchors] = securityGroupOverlay.anchors;
         const { awsAccountId, awsRegionId } = actionInputs.metadata;
-        const [matchingVpcResource] = await securityGroupOverlay.getResourcesMatchingSchema(VpcSchema, [
-            { key: 'awsAccountId', value: awsAccountId },
-            { key: 'awsRegionId', value: awsRegionId },
-        ]);
-        for (const anchor of anchors) {
-            const anchorProperties = (anchor instanceof MatchingAnchor ? anchor.getSchemaInstance() : anchor).properties;
-            const securityGroup = new SecurityGroup(`sec-grp-${anchorProperties.securityGroupName}`, {
-                awsAccountId,
-                awsRegionId,
-                rules: anchorProperties.rules.map((rule) => ({
-                    CidrBlock: rule.CidrBlock,
-                    Egress: rule.Egress,
-                    FromPort: rule.FromPort,
-                    IpProtocol: rule.IpProtocol,
-                    ToPort: rule.ToPort,
-                })),
-            }, [matchingVpcResource]);
-            actionOutputs[securityGroup.resourceId] = securityGroup;
+        // Get the VPC from the region of the execution's subnet.
+        const region = actionInputs.inputs.subnet.getParents()['region'][0].to;
+        const [matchingVpcResource] = await region.getResourcesMatchingSchema(VpcSchema, [], [], {
+            searchBoundaryMembers: false,
+        });
+        // Collect the rules of the execution and of each server it runs, once each.
+        const rules = [];
+        for (const anchorRules of [
+            executionSecurityGroupAnchor.properties.rules,
+            ...serverSecurityGroupAnchors.map((a) => a.getSchemaInstance().properties.rules),
+        ]) {
+            for (const rule of anchorRules) {
+                const existingRule = rules.find((r) => r.CidrBlock === rule.CidrBlock &&
+                    r.Egress === rule.Egress &&
+                    r.FromPort === rule.FromPort &&
+                    r.IpProtocol === rule.IpProtocol &&
+                    r.ToPort === rule.ToPort);
+                if (!existingRule) {
+                    rules.push({
+                        CidrBlock: rule.CidrBlock,
+                        Egress: rule.Egress,
+                        FromPort: rule.FromPort,
+                        IpProtocol: rule.IpProtocol,
+                        ToPort: rule.ToPort,
+                    });
+                }
+            }
         }
+        // Create the execution's one security group.
+        const securityGroup = new SecurityGroup(`sec-grp-${executionSecurityGroupAnchor.properties.securityGroupName}`, { awsAccountId, awsRegionId, rules }, [matchingVpcResource]);
+        actionOutputs[securityGroup.resourceId] = securityGroup;
         return actionOutputs;
     }
 };

package/dist/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution-server-security-group/actions/add-aws-ecs-execution-server-security-group.overlay.action.js.map

@@ -1 +1 @@
-{"version":3,"file":"add-aws-ecs-execution-server-security-group.overlay.action.js","sourceRoot":"","sources":["../../../../../../../src/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution-server-security-group/actions/add-aws-ecs-execution-server-security-group.overlay.action.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EACL,MAAM,EAGN,UAAU,EAEV,OAAO,EAEP,cAAc,EACd,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,qDAAqD,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,iDAAiD,CAAC;AAE5E,OAAO,EAAE,yCAAyC,EAAE,MAAM,uDAAuD,CAAC;AAElH;;GAEG;AAEI,IAAM,kDAAkD,GAAxD,MAAM,kDAAkD;IAC7D;;OAEG;IACH,MAAM,CAAC,IAAU;QACf,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG;YAC9B,IAAI,CAAC,IAAI,YAAY,yCAAyC;YAC9D,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,iDAAiD,CAAC;YACzE,IAAI,CAAC,KAAK,KAAK,WAAW,CAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,IAAqD,EACrD,YAAyD,EACzD,aAA4B;QAE5B,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;QACvC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC;QAE7C,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;QAE5D,MAAM,CAAC,mBAAmB,CAAC,GAAG,MAAM,oBAAoB,CAAC,0BAA0B,CAAC,SAAS,EAAE;YAC7F,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE;YAC5C,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE;SAC3C,CAAC,CAAC;QAEH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,gBAAgB,GAAG,CAAC,MAAM,YAAY,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC;YAE7G,MAAM,aAAa,GAAG,IAAI,aAAa,CACrC,WAAW,gBAAgB,CAAC,iBAAiB,EAAE,EAC/C;gBACE,YAAY;gBACZ,WAAW;gBACX,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;aACJ,EACD,CAAC,mBAAmB,CAAC,CACtB,CAAC;YAEF,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,aAAa,CAAC;QAC1D,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;CACF,CAAA;AAvDY,kDAAkD;IAD9D,MAAM,CAAC,yCAAyC,CAAC;GACrC,kDAAkD,CAuD9D;;AAED;;GAEG;AAEI,IAAM,yDAAyD,GAA/D,MAAM,yDAAyD;IAGpE;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM;QACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,kDAAkD,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF,CAAA;AAZY,yDAAyD;IADrE,OAAO,CAAqD,kDAAkD,CAAC;GACnG,yDAAyD,CAYrE"}
+{"version":3,"file":"add-aws-ecs-execution-server-security-group.overlay.action.js","sourceRoot":"","sources":["../../../../../../../src/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution-server-security-group/actions/add-aws-ecs-execution-server-security-group.overlay.action.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EACL,MAAM,EAGN,UAAU,EAEV,OAAO,EAGP,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,qDAAqD,CAAC;AAEpF,OAAO,EAAE,SAAS,EAAE,MAAM,iDAAiD,CAAC;AAE5E,OAAO,EAAE,yCAAyC,EAAE,MAAM,uDAAuD,CAAC;AAElH;;GAEG;AAEI,IAAM,kDAAkD,GAAxD,MAAM,kDAAkD;IAC7D;;OAEG;IACH,MAAM,CAAC,IAAU;QACf,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG;YAC9B,IAAI,CAAC,IAAI,YAAY,yCAAyC;YAC9D,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,iDAAiD,CAAC;YACzE,IAAI,CAAC,KAAK,KAAK,WAAW,CAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,IAAqD,EACrD,YAAyD,EACzD,aAA4B;QAE5B,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;QACvC,MAAM,CAAC,4BAA4B,EAAE,GAAG,0BAA0B,CAAC,GAAG,oBAAoB,CAAC,OAAO,CAAC;QAEnG,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;QAE5D,yDAAyD;QACzD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAY,CAAC;QACjF,MAAM,CAAC,mBAAmB,CAAC,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE;YACvF,qBAAqB,EAAE,KAAK;SAC7B,CAAC,CAAC;QAEH,4EAA4E;QAC5E,MAAM,KAAK,GAA+C,EAAE,CAAC;QAC7D,KAAK,MAAM,WAAW,IAAI;YACxB,4BAA4B,CAAC,UAAU,CAAC,KAAK;YAC7C,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;SACjF,EAAE,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;oBAC9B,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;oBACxB,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;oBAC5B,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;oBAChC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAC3B,CAAC;gBACF,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,KAAK,CAAC,IAAI,CAAC;wBACT,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;qBACpB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,MAAM,aAAa,GAAG,IAAI,aAAa,CACrC,WAAW,4BAA4B,CAAC,UAAU,CAAC,iBAAiB,EAAE,EACtE,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,EACpC,CAAC,mBAAmB,CAAC,CACtB,CAAC;QAEF,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,aAAa,CAAC;QAExD,OAAO,aAAa,CAAC;IACvB,CAAC;CACF,CAAA;AAtEY,kDAAkD;IAD9D,MAAM,CAAC,yCAAyC,CAAC;GACrC,kDAAkD,CAsE9D;;AAED;;GAEG;AAEI,IAAM,yDAAyD,GAA/D,MAAM,yDAAyD;IAGpE;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM;QACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,kDAAkD,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF,CAAA;AAZY,yDAAyD;IADrE,OAAO,CAAqD,kDAAkD,CAAC;GACnG,yDAAyD,CAYrE"}

package/dist/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution-server-security-group/aws-ecs-execution-server-security-group.overlay.d.ts

@@ -6,12 +6,20 @@ import { AwsEcsExecutionServerSecurityGroupOverlaySchema } from './aws-ecs-execu
  * @internal
  */
 export declare class AwsEcsExecutionServerSecurityGroupOverlay extends AOverlay<AwsEcsExecutionServerSecurityGroupOverlaySchema, AwsEcsExecutionServerSecurityGroupOverlay> {
-    anchors: (MatchingAnchor<AwsSecurityGroupAnchorSchema> | AwsSecurityGroupAnchor)[];
+    anchors: [
+        AwsSecurityGroupAnchor,
+        MatchingAnchor<AwsSecurityGroupAnchorSchema>,
+        ...MatchingAnchor<AwsSecurityGroupAnchorSchema>[]
+    ];
     properties: AwsEcsExecutionServerSecurityGroupOverlaySchema['properties'];
     /**
      * @internal
      */
-    constructor(overlayId: string, properties: AwsEcsExecutionServerSecurityGroupOverlaySchema['properties'], anchors: (MatchingAnchor<AwsSecurityGroupAnchorSchema> | AwsSecurityGroupAnchor)[]);
+    constructor(overlayId: string, properties: AwsEcsExecutionServerSecurityGroupOverlaySchema['properties'], anchors: [
+        AwsSecurityGroupAnchor,
+        MatchingAnchor<AwsSecurityGroupAnchorSchema>,
+        ...MatchingAnchor<AwsSecurityGroupAnchorSchema>[]
+    ]);
     /**
      * @internal
      */

package/dist/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution-server-security-group/aws-ecs-execution-server-security-group.overlay.js.map

@@ -1 +1 @@
-{"version":3,"file":"aws-ecs-execution-server-security-group.overlay.js","sourceRoot":"","sources":["../../../../../../src/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution-server-security-group/aws-ecs-execution-server-security-group.overlay.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAkC,OAAO,EAAE,MAAM,eAAe,CAAC;AAGlF,OAAO,EAAE,+CAA+C,EAAE,MAAM,qDAAqD,CAAC;AAEtH;;GAEG;AAEI,IAAM,yCAAyC,GAA/C,MAAM,yCAA0C,SAAQ,QAG9D;IAIC;;OAEG;IACH,YACE,SAAiB,EACjB,UAAyE,EACzE,OAAkF;QAElF,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,WAAW;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAA;AAxBY,yCAAyC;IADrD,OAAO,CAAC,OAAO,EAAE,iDAAiD,EAAE,+CAA+C,CAAC;;GACxG,yCAAyC,CAwBrD"}
+{"version":3,"file":"aws-ecs-execution-server-security-group.overlay.js","sourceRoot":"","sources":["../../../../../../src/modules/execution/aws-ecs-execution/overlays/aws-ecs-execution-server-security-group/aws-ecs-execution-server-security-group.overlay.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAkC,OAAO,EAAE,MAAM,eAAe,CAAC;AAGlF,OAAO,EAAE,+CAA+C,EAAE,MAAM,qDAAqD,CAAC;AAEtH;;GAEG;AAEI,IAAM,yCAAyC,GAA/C,MAAM,yCAA0C,SAAQ,QAG9D;IAQC;;OAEG;IACH,YACE,SAAiB,EACjB,UAAyE,EACzE,OAIC;QAED,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,WAAW;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAA;AAhCY,yCAAyC;IADrD,OAAO,CAAC,OAAO,EAAE,iDAAiD,EAAE,+CAA+C,CAAC;;GACxG,yCAAyC,CAgCrD"}

package/dist/modules/execution/aws-lambda-execution/aws-lambda-execution.module.d.ts

@@ -0,0 +1,57 @@
+import { AModule, type Execution } from '@quadnix/octo';
+import { AwsLambdaExecutionModuleSchema } from './index.schema.js';
+import { AwsLambdaExecution } from './models/execution/index.js';
+import { AwsLambdaExecutionOverlay } from './overlays/aws-lambda-execution/index.js';
+/**
+ * `AwsLambdaExecutionModule` is a Lambda-based AWS execution module that provides an implementation for
+ * the `Execution` model. It runs a deployment's container image as a Lambda function, in a serverless
+ * region.
+ *
+ * The server and the deployment create nothing; this module creates everything Lambda needs to run
+ * them: an IAM role trusting Lambda and holding the server's grants, the function, and a URL that only
+ * signed requests may call. The role gets no permission to write logs.
+ *
+ * The function runs outside a VPC, so it ignores the server's security group rules. The deployment
+ * must name an image octo publishes into ECR, set a memory from 128 to 10240 MiB and a
+ * timeout from 1 to 900 seconds, and listen on at most one tcp port. A deployment that does not is
+ * rejected before anything is created. The function runs on the processor the image is published for,
+ * and the Lambda Web Adapter forwards each request to the deployment's port, as `AWS_LWA_PORT`.
+ *
+ * @example
+ * TypeScript
+ * ```ts
+ * import { type Deployment, type Environment, type Subnet, stub } from '@quadnix/octo';
+ * import { AwsLambdaExecutionModule } from '@quadnix/octo-aws-cdk/modules/execution/aws-lambda-execution';
+ *
+ * octo.loadModule(AwsLambdaExecutionModule, 'my-execution-module', {
+ *   deployment: stub<Deployment>('${{my-deployment-module.model.deployment}}'),
+ *   environment: stub<Environment>('${{my-environment-module.model.environment}}'),
+ *   environmentVariables: { LOG_LEVEL: 'info' },
+ *   executionId: 'backend-v1-qa',
+ *   subnet: stub<Subnet>('${{my-subnet-module.model.subnet}}'),
+ * });
+ * ```
+ *
+ * @group Modules/Execution/AwsLambdaExecution
+ *
+ * @reference Resources {@link IamRoleSchema}
+ * @reference Resources {@link LambdaFunctionSchema}
+ *
+ * @see {@link AwsLambdaExecutionModuleSchema} for the input schema.
+ * @see {@link AModule} to learn more about modules.
+ * @see [Execution](/api/octo/class/Execution) to learn more about the `Execution` model.
+ */
+export declare class AwsLambdaExecutionModule extends AModule<AwsLambdaExecutionModuleSchema, Execution> {
+    /**
+     * Creates the execution, checks its deployment has what Lambda needs, and joins it to the image,
+     * buckets and tables it uses.
+     */
+    onInit(inputs: AwsLambdaExecutionModuleSchema): Promise<(AwsLambdaExecution | AwsLambdaExecutionOverlay)[]>;
+    /**
+     * Resolves the account and the AWS region this execution runs in.
+     */
+    registerMetadata(inputs: AwsLambdaExecutionModuleSchema): Promise<{
+        awsAccountId: string;
+        awsRegionId: string;
+    }>;
+}