@stacksjs/cloud 0.58.47 → 0.58.49

package/src/cloud/cdn.ts

@@ -0,0 +1,374 @@
+/* eslint-disable no-new */
+import type { aws_certificatemanager as acm, aws_lambda as lambda, aws_s3 as s3, aws_wafv2 as wafv2 } from 'aws-cdk-lib'
+import { Duration, Fn, CfnOutput as Output, aws_cloudfront as cloudfront, aws_cloudfront_origins as origins, aws_route53 as route53, aws_route53_targets as targets } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import { config } from '@stacksjs/config'
+import { hasFiles } from '@stacksjs/storage'
+import { path as p } from '@stacksjs/path'
+import { env } from '@stacksjs/env'
+import type { NestedCloudProps } from '../types'
+import type { EnvKey } from '../../../../env'
+
+export interface CdnStackProps extends NestedCloudProps {
+  certificate: acm.Certificate
+  logBucket: s3.Bucket
+  publicBucket: s3.Bucket
+  firewall: wafv2.CfnWebACL
+  originRequestFunction: lambda.Function
+  zone: route53.IHostedZone
+  webServer: lambda.Function
+  webServerUrl: lambda.FunctionUrl
+  cliSetupUrl: lambda.FunctionUrl
+  askAiUrl: lambda.FunctionUrl
+  summarizeAiUrl: lambda.FunctionUrl
+}
+
+export class CdnStack {
+  distribution: cloudfront.Distribution
+  originAccessIdentity: cloudfront.OriginAccessIdentity
+  cdnCachePolicy: cloudfront.CachePolicy
+  apiCachePolicy: cloudfront.CachePolicy | undefined
+  vanityUrl: string
+  props: CdnStackProps
+
+  constructor(scope: Construct, props: CdnStackProps) {
+    this.props = props
+
+    this.originAccessIdentity = new cloudfront.OriginAccessIdentity(scope, 'OAI')
+
+    this.cdnCachePolicy = new cloudfront.CachePolicy(scope, 'CdnCachePolicy', {
+      comment: 'Stacks CDN Cache Policy',
+      cachePolicyName: `${props.slug}-${props.appEnv}-cdn-cache-policy`,
+      minTtl: config.cloud.cdn?.minTtl ? Duration.seconds(config.cloud.cdn.minTtl) : undefined,
+      defaultTtl: config.cloud.cdn?.defaultTtl ? Duration.seconds(config.cloud.cdn.defaultTtl) : undefined,
+      maxTtl: config.cloud.cdn?.maxTtl ? Duration.seconds(config.cloud.cdn.maxTtl) : undefined,
+      cookieBehavior: this.getCookieBehavior(config.cloud.cdn?.cookieBehavior),
+    })
+
+    // the actual CDN distribution
+    this.distribution = new cloudfront.Distribution(scope, 'Cdn', {
+      domainNames: [props.domain],
+      defaultRootObject: 'index.html',
+      comment: `CDN for ${config.app.url}`,
+      certificate: props.certificate,
+      enableLogging: true,
+      logBucket: props.logBucket,
+      httpVersion: cloudfront.HttpVersion.HTTP2_AND_3,
+      priceClass: cloudfront.PriceClass.PRICE_CLASS_ALL,
+      enabled: true,
+      minimumProtocolVersion: cloudfront.SecurityPolicyProtocol.TLS_V1_2_2021,
+      webAclId: props.firewall.attrArn,
+      enableIpv6: true,
+
+      defaultBehavior: {
+        origin: new origins.S3Origin(props.publicBucket, {
+          originAccessIdentity: this.originAccessIdentity,
+        }),
+        edgeLambdas: [
+          {
+            eventType: cloudfront.LambdaEdgeEventType.ORIGIN_REQUEST,
+            functionVersion: props.originRequestFunction.currentVersion,
+          },
+        ],
+        compress: config.cloud.cdn?.compress,
+        allowedMethods: this.allowedMethods(),
+        cachedMethods: this.cachedMethods(),
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: this.cdnCachePolicy,
+      },
+
+      additionalBehaviors: this.additionalBehaviors(scope, props),
+
+      // Add custom error responses
+      errorResponses: [
+        {
+          httpStatus: 403,
+          responsePagePath: '/index.html',
+          responseHttpStatus: 200,
+          ttl: Duration.seconds(0),
+        },
+      ],
+    })
+
+    new route53.ARecord(scope, 'AliasRecord', {
+      recordName: props.domain,
+      zone: props.zone,
+      target: route53.RecordTarget.fromAlias(new targets.CloudFrontTarget(this.distribution)),
+    })
+
+    new Output(scope, 'DistributionId', {
+      value: this.distribution.distributionId,
+    })
+
+    new Output(scope, 'AppUrl', {
+      value: `https://${props.domain}`,
+      description: 'The URL of the deployed application',
+    })
+
+    this.vanityUrl = `https://${this.distribution.domainName}`
+    new Output(scope, 'AppVanityUrl', {
+      value: this.vanityUrl,
+      description: 'The vanity URL of the deployed application',
+    })
+
+    // this.originAccessIdentity = originAccessIdentity
+    // this.cdnCachePolicy = cdnCachePolicy
+  }
+
+  getCookieBehavior(behavior: string | undefined): cloudfront.CacheCookieBehavior | undefined {
+    switch (behavior) {
+      case 'all':
+        return cloudfront.CacheCookieBehavior.all()
+      case 'none':
+        return cloudfront.CacheCookieBehavior.none()
+      case 'allowList':
+        // If you have a list of cookies, replace `myCookie` with your cookie
+        return cloudfront.CacheCookieBehavior.allowList(...config.cloud.cdn?.allowList.cookies || [])
+      default:
+        return undefined
+    }
+  }
+
+  allowedMethods(): cloudfront.AllowedMethods {
+    switch (config.cloud.cdn?.allowedMethods) {
+      case 'ALL':
+        return cloudfront.AllowedMethods.ALLOW_ALL
+      case 'GET_HEAD':
+        return cloudfront.AllowedMethods.ALLOW_GET_HEAD
+      case 'GET_HEAD_OPTIONS':
+        return cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS
+      default:
+        return cloudfront.AllowedMethods.ALLOW_ALL
+    }
+  }
+
+  cachedMethods(): cloudfront.CachedMethods {
+    switch (config.cloud.cdn?.cachedMethods) {
+      case 'GET_HEAD':
+        return cloudfront.CachedMethods.CACHE_GET_HEAD
+      case 'GET_HEAD_OPTIONS':
+        return cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS
+      default:
+        return cloudfront.CachedMethods.CACHE_GET_HEAD
+    }
+  }
+
+  allowedMethodsFromString(methods?: 'ALL' | 'GET_HEAD' | 'GET_HEAD_OPTIONS'): cloudfront.AllowedMethods {
+    if (!methods)
+      return cloudfront.AllowedMethods.ALLOW_ALL
+
+    switch (methods) {
+      case 'ALL':
+        return cloudfront.AllowedMethods.ALLOW_ALL
+      case 'GET_HEAD':
+        return cloudfront.AllowedMethods.ALLOW_GET_HEAD
+      case 'GET_HEAD_OPTIONS':
+        return cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS
+      default:
+        return cloudfront.AllowedMethods.ALLOW_ALL
+    }
+  }
+
+  cachedMethodsFromString(methods?: 'GET_HEAD' | 'GET_HEAD_OPTIONS'): cloudfront.CachedMethods {
+    if (!methods)
+      return cloudfront.CachedMethods.CACHE_GET_HEAD
+
+    switch (methods) {
+      case 'GET_HEAD':
+        return cloudfront.CachedMethods.CACHE_GET_HEAD
+      case 'GET_HEAD_OPTIONS':
+        return cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS
+      default:
+        return cloudfront.CachedMethods.CACHE_GET_HEAD
+    }
+  }
+
+  shouldDeployApi() {
+    return config.cloud.api
+  }
+
+  apiBehaviorOptions(scope: Construct, props: CdnStackProps): Record<string, cloudfront.BehaviorOptions> {
+    const hostname = Fn.select(2, Fn.split('/', props.webServerUrl.url))
+    const origin = (path: '/api' | '/api/*' = '/api') => {
+      return new origins.HttpOrigin(hostname, {
+        originPath: path,
+        protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
+      })
+    }
+
+    return {
+      '/api': {
+        origin: origin(),
+        compress: true,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
+        cachePolicy: this.setApiCachePolicy(scope),
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+      },
+      '/api/*': {
+        origin: origin('/api/*'),
+        compress: true,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
+        cachePolicy: this.apiCachePolicy,
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+      },
+    }
+  }
+
+  docsBehaviorOptions(props: CdnStackProps): Record<string, cloudfront.BehaviorOptions> {
+    return {
+      '/docs': {
+        origin: new origins.S3Origin(props.publicBucket, {
+          originAccessIdentity: this.originAccessIdentity,
+          originPath: '/docs',
+        }),
+        compress: true,
+        allowedMethods: this.allowedMethodsFromString(config.cloud.cdn?.allowedMethods),
+        cachedMethods: this.cachedMethodsFromString(config.cloud.cdn?.cachedMethods),
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
+      },
+      '/docs/*': {
+        origin: new origins.S3Origin(props.publicBucket, {
+          originAccessIdentity: this.originAccessIdentity,
+          originPath: '/docs',
+        }),
+        compress: true,
+        allowedMethods: this.allowedMethodsFromString(config.cloud.cdn?.allowedMethods),
+        cachedMethods: this.cachedMethodsFromString(config.cloud.cdn?.cachedMethods),
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
+      },
+    }
+  }
+
+  aiBehaviorOptions(scope: Construct, props: CdnStackProps): Record<string, cloudfront.BehaviorOptions> {
+    const hostname = Fn.select(2, Fn.split('/', props.askAiUrl.url))
+    const summaryHostname = Fn.select(2, Fn.split('/', props.summarizeAiUrl.url))
+
+    const aiCachePolicy = new cloudfront.CachePolicy(scope, 'AiCachePolicy', {
+      comment: 'Stacks AI Cache Policy',
+      cachePolicyName: `${this.props.slug}-${this.props.appEnv}-ai-cache-policy`,
+      defaultTtl: Duration.seconds(0),
+      // minTtl: config.cloud.cdn?.minTtl ? Duration.seconds(config.cloud.cdn.minTtl) : undefined,
+      cookieBehavior: cloudfront.CacheCookieBehavior.none(),
+      headerBehavior: cloudfront.CacheHeaderBehavior.allowList('Accept', 'x-api-key', 'Authorization', 'Content-Type'),
+      queryStringBehavior: cloudfront.CacheQueryStringBehavior.all(),
+    })
+
+    return {
+      '/ai/ask': {
+        origin: new origins.HttpOrigin(hostname, {
+          originPath: '/ai',
+          protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
+        }),
+        compress: false,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: aiCachePolicy,
+      },
+      '/ai/summary': {
+        origin: new origins.HttpOrigin(summaryHostname, {
+          originPath: '/ai',
+          protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
+        }),
+        compress: false,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: aiCachePolicy,
+      },
+    }
+  }
+
+  cliSetupBehaviorOptions(scope: Construct, props: CdnStackProps): Record<string, cloudfront.BehaviorOptions> {
+    const hostname = Fn.select(2, Fn.split('/', props.cliSetupUrl.url))
+
+    return {
+      '/install': {
+        origin: new origins.HttpOrigin(hostname, {
+        // origin: new origins.HttpOrigin('tipevv3dfx35fb7ptyq7nrxtga0qkcgc.lambda-url.us-east-1.on.aws', {
+          originPath: '/cli-setup',
+          protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
+        }),
+        compress: false,
+        allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
+        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+        cachePolicy: new cloudfront.CachePolicy(scope, 'CliSetupCachePolicy', {
+          comment: 'Stacks CLI Setup Cache Policy',
+          cachePolicyName: `${this.props.slug}-${this.props.appEnv}-cli-setup-cache-policy`,
+          defaultTtl: Duration.seconds(0),
+          // minTtl: config.cloud.cdn?.minTtl ? Duration.seconds(config.cloud.cdn.minTtl) : undefined,
+          cookieBehavior: cloudfront.CacheCookieBehavior.none(),
+          headerBehavior: cloudfront.CacheHeaderBehavior.none(),
+          queryStringBehavior: cloudfront.CacheQueryStringBehavior.none(),
+        }),
+      },
+    }
+  }
+
+  shouldDeployAiEndpoints() {
+    return config.cloud.ai
+  }
+
+  shouldDeployCliSetup() {
+    return config.cloud.cli
+  }
+
+  shouldDeployDocs() {
+    return hasFiles(p.projectPath('docs'))
+  }
+
+  additionalBehaviors(scope: Construct, props: CdnStackProps): Record<string, cloudfront.BehaviorOptions> {
+    let behaviorOptions: Record<string, cloudfront.BehaviorOptions> = {}
+
+    if (this.shouldDeployApi()) {
+      const keysToRemove = ['_HANDLER', '_X_AMZN_TRACE_ID', 'AWS_REGION', 'AWS_EXECUTION_ENV', 'AWS_LAMBDA_FUNCTION_NAME', 'AWS_LAMBDA_FUNCTION_MEMORY_SIZE', 'AWS_LAMBDA_FUNCTION_VERSION', 'AWS_LAMBDA_INITIALIZATION_TYPE', 'AWS_LAMBDA_LOG_GROUP_NAME', 'AWS_LAMBDA_LOG_STREAM_NAME', 'AWS_ACCESS_KEY', 'AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AWS_SESSION_TOKEN', 'AWS_LAMBDA_RUNTIME_API', 'LAMBDA_TASK_ROOT', 'LAMBDA_RUNTIME_DIR', '_']
+      keysToRemove.forEach(key => delete env[key as EnvKey])
+
+      behaviorOptions = this.apiBehaviorOptions(scope, props)
+    }
+
+    // if docMode is used, we don't need to add a behavior for the docs
+    // because the docs will be the root of the site
+    if (this.shouldDeployDocs() && !config.app.docMode) {
+      behaviorOptions = {
+        ...this.docsBehaviorOptions(props),
+        ...behaviorOptions,
+      }
+    }
+
+    if (this.shouldDeployAiEndpoints()) {
+      behaviorOptions = {
+        ...this.aiBehaviorOptions(scope, props),
+        ...behaviorOptions,
+      }
+    }
+
+    if (this.shouldDeployCliSetup()) {
+      behaviorOptions = {
+        ...this.cliSetupBehaviorOptions(scope, props),
+        ...behaviorOptions,
+      }
+    }
+
+    return behaviorOptions
+  }
+
+  setApiCachePolicy(scope: Construct) {
+    if (this.apiCachePolicy)
+      return this.apiCachePolicy
+
+    this.apiCachePolicy = new cloudfront.CachePolicy(scope, 'ApiCachePolicy', {
+      comment: 'Stacks API Cache Policy',
+      cachePolicyName: `${this.props.slug}-${this.props.appEnv}-api-cache-policy`,
+      defaultTtl: Duration.seconds(0),
+      // minTtl: config.cloud.cdn?.minTtl ? Duration.seconds(config.cloud.cdn.minTtl) : undefined,
+      cookieBehavior: cloudfront.CacheCookieBehavior.none(),
+      headerBehavior: cloudfront.CacheHeaderBehavior.allowList('Accept', 'x-api-key', 'Authorization', 'Content-Type'),
+      queryStringBehavior: cloudfront.CacheQueryStringBehavior.none(),
+    })
+
+    return this.apiCachePolicy
+  }
+}

package/src/cloud/cli.ts

@@ -0,0 +1,45 @@
+/* eslint-disable no-new */
+import { Duration, CfnOutput as Output, aws_lambda as lambda } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export interface CliStackProps extends NestedCloudProps {
+}
+
+export class CliStack {
+  cliSetupUrl: lambda.FunctionUrl
+
+  constructor(scope: Construct, props: CliStackProps) {
+    const cliSetupFunc = new lambda.Function(scope, 'CliSetupFunction', {
+      functionName: `${props.slug}-${props.appEnv}-cli-setup`,
+      description: 'Lambda function that triggers setup script for a Stacks project',
+      runtime: lambda.Runtime.NODEJS_20_X,
+      handler: 'index.handler',
+      code: lambda.Code.fromAsset('src/cloud/lambda/cli-setup'), // path relative to the cloud root package dir
+      timeout: Duration.seconds(30),
+    })
+
+    // create a Lambda.FunctionUrl to be used in the CloudFront OriginRequestPolicy
+    // this will be used to trigger the function
+    this.cliSetupUrl = new lambda.FunctionUrl(scope, 'CliSetupFunctionUrl', {
+      function: cliSetupFunc,
+      authType: lambda.FunctionUrlAuthType.NONE,
+      cors: {
+        allowedOrigins: ['*'],
+      },
+    })
+
+    new Output(scope, 'CliSetupVanityUrl', {
+      value: `${this.cliSetupUrl.url}cli-setup`,
+    })
+
+    new Output(scope, 'CliSetupUrl', {
+      value: `https://${props.domain}/install`,
+      description: 'URL to trigger the CLI setup function',
+    })
+
+    // once deployed, need to create logic in the cdn origin request to check if the request is for the cli
+    // if it is, then we need the to use the function url as the origin
+    // if it is not, then we need don't adjust the origin
+  }
+}

package/src/cloud/compute.ts

@@ -0,0 +1,80 @@
+/* eslint-disable no-new */
+import type { aws_certificatemanager as acm, aws_ec2 as ec2, aws_efs as efs, aws_route53 as route53 } from 'aws-cdk-lib'
+import { Duration, CfnOutput as Output, aws_lambda as lambda, aws_logs as logs, aws_secretsmanager as secretsmanager } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import { path as p } from '@stacksjs/path'
+import { env } from '@stacksjs/env'
+import type { NestedCloudProps } from '../types'
+import type { EnvKey } from '../../../../env'
+
+export interface ComputeStackProps extends NestedCloudProps {
+  vpc: ec2.Vpc
+  fileSystem: efs.FileSystem
+  zone: route53.IHostedZone
+  certificate: acm.Certificate
+}
+
+export class ComputeStack {
+  apiServer: lambda.Function
+  apiServerUrl: lambda.FunctionUrl
+
+  constructor(scope: Construct, props: ComputeStackProps) {
+    const vpc = props.vpc
+    const fileSystem = props.fileSystem
+
+    if (!fileSystem)
+      throw new Error('The file system is missing. Please make sure it was created properly.')
+
+    // const dockerImageAsset = new ecr_assets.DockerImageAsset(scope, 'ServerBuildImage', {
+    //   directory: p.cloudPath('src/server'),
+    // })
+
+    this.apiServer = new lambda.Function(scope, 'WebServer', {
+      functionName: `${props.slug}-${props.appEnv}-web-server`,
+      description: 'The web server for the Stacks application',
+      code: lambda.Code.fromAssetImage(p.frameworkPath('server')),
+      handler: lambda.Handler.FROM_IMAGE,
+      runtime: lambda.Runtime.FROM_IMAGE,
+      vpc,
+      memorySize: 512, // replace with your actual memory size
+      timeout: Duration.minutes(5), // replace with your actual timeout
+      logRetention: logs.RetentionDays.ONE_WEEK,
+      architecture: lambda.Architecture.ARM_64,
+      // filesystem: lambda.FileSystem.fromEfsAccessPoint(props.accessPoint, '/mnt/efs'),
+    })
+
+    const keysToRemove = ['_HANDLER', '_X_AMZN_TRACE_ID', 'AWS_REGION', 'AWS_EXECUTION_ENV', 'AWS_LAMBDA_FUNCTION_NAME', 'AWS_LAMBDA_FUNCTION_MEMORY_SIZE', 'AWS_LAMBDA_FUNCTION_VERSION', 'AWS_LAMBDA_INITIALIZATION_TYPE', 'AWS_LAMBDA_LOG_GROUP_NAME', 'AWS_LAMBDA_LOG_STREAM_NAME', 'AWS_ACCESS_KEY', 'AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AWS_SESSION_TOKEN', 'AWS_LAMBDA_RUNTIME_API', 'LAMBDA_TASK_ROOT', 'LAMBDA_RUNTIME_DIR', '_']
+    keysToRemove.forEach(key => delete env[key as EnvKey])
+
+    const secrets = new secretsmanager.Secret(scope, 'StacksSecrets', {
+      secretName: `${props.slug}-${props.appEnv}-secrets`,
+      description: 'Secrets for the Stacks application',
+      generateSecretString: {
+        secretStringTemplate: JSON.stringify(env),
+        generateStringKey: Object.keys(env).join(',').length.toString(),
+      },
+    })
+
+    secrets.grantRead(this.apiServer)
+    this.apiServer.addEnvironment('SECRETS_ARN', secrets.secretArn)
+
+    this.apiServerUrl = new lambda.FunctionUrl(scope, 'StacksServerUrl', {
+      function: this.apiServer,
+      authType: lambda.FunctionUrlAuthType.NONE, // becomes a public API
+      cors: {
+        allowedOrigins: ['*'],
+      },
+    })
+
+    const apiPrefix = 'api'
+    new Output(scope, 'ApiUrl', {
+      value: `https://${props.domain}/${apiPrefix}`,
+      description: 'The URL of the deployed application',
+    })
+
+    new Output(scope, 'ApiVanityUrl', {
+      value: this.apiServerUrl.url,
+      description: 'The Vanity URL of the deployed application',
+    })
+  }
+}

package/src/cloud/dashboard.ts

@@ -0,0 +1,85 @@
+/* eslint-disable no-new */
+// TODO: finish this cloudwatch dashboard
+// import type { aws_lambda as lambda } from 'aws-cdk-lib'
+import { Aws, CfnOutput as Output, aws_cloudwatch as cloudwatch } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export interface DashboardStackProps extends NestedCloudProps {
+  dashboardName?: string
+}
+
+export class DashboardStack {
+  // lambdaFunction: lambda.Function
+  dashboard: cloudwatch.Dashboard
+
+  constructor(scope: Construct, props: DashboardStackProps) {
+    const dashboardName = props.dashboardName || 'StacksDashboard'
+
+    // Create Sample Lambda Function which will create metrics
+    // this.lambdaFunction = new Function(this, 'SampleLambda', {
+    //   handler: 'lambda-handler.handler',
+    //   runtime: Runtime.PYTHON_3_7,
+    //   code: new AssetCode(`./lambda`),
+    //   memorySize: 512,
+    //   timeout: Duration.seconds(10),
+    // })
+
+    // Create CloudWatch Dashboard
+    this.dashboard = new cloudwatch.Dashboard(scope, 'SampleLambdaDashboard', {
+      dashboardName,
+    })
+
+    // Create Title for Dashboard
+    this.dashboard.addWidgets(new cloudwatch.TextWidget({
+      markdown: `# Dashboard: ${this.lambdaFunction.functionName}`,
+      height: 1,
+      width: 24,
+    }))
+
+    // Create CloudWatch Dashboard Widgets: Errors, Invocations, Duration, Throttles
+    this.dashboard.addWidgets(new cloudwatch.GraphWidget({
+      title: 'Invocations',
+      left: [this.lambdaFunction.metricInvocations()],
+      width: 24,
+    }))
+
+    this.dashboard.addWidgets(new cloudwatch.GraphWidget({
+      title: 'Errors',
+      left: [this.lambdaFunction.metricErrors()],
+      width: 24,
+    }))
+
+    this.dashboard.addWidgets(new cloudwatch.GraphWidget({
+      title: 'Duration',
+      left: [this.lambdaFunction.metricDuration()],
+      width: 24,
+    }))
+
+    this.dashboard.addWidgets(new cloudwatch.GraphWidget({
+      title: 'Throttles',
+      left: [this.lambdaFunction.metricThrottles()],
+      width: 24,
+    }))
+
+    // Create Widget to show last 20 Log Entries
+    this.dashboard.addWidgets(new cloudwatch.LogQueryWidget({
+      logGroupNames: [this.lambdaFunction.logGroup.logGroupName],
+      queryLines: [
+        'fields @timestamp, @message',
+        'sort @timestamp desc',
+        'limit 20',
+      ],
+      width: 24,
+    }))
+
+    // Generate Output
+    const cloudwatchDashboardURL = `https://${Aws.REGION}.console.aws.amazon.com/cloudwatch/home?region=${Aws.REGION}#dashboards:name=${dashboardName}`
+
+    new Output(scope, 'DashboardOutput', {
+      value: cloudwatchDashboardURL,
+      description: 'The CloudWatch Dashboard URL',
+      exportName: 'StacksDashboardURL',
+    })
+  }
+}

package/src/cloud/deployment.ts

@@ -0,0 +1,41 @@
+/* eslint-disable no-new */
+import type { aws_cloudfront as cloudfront, aws_s3 as s3 } from 'aws-cdk-lib'
+import { AssetHashType, aws_s3_deployment as s3deploy } from 'aws-cdk-lib'
+import { config } from '@stacksjs/config'
+import { websiteSourceHash } from '@stacksjs/utils'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export interface DeploymentStackProps extends NestedCloudProps {
+  publicBucket: s3.Bucket
+  privateBucket: s3.Bucket
+  cdn: cloudfront.Distribution
+}
+
+export class DeploymentStack {
+  privateSource: string
+  docsSource: string
+  websiteSource: string
+
+  constructor(scope: Construct, props: DeploymentStackProps) {
+    // following paths are relative to where the command is run from
+    this.privateSource = '../../../private'
+    this.docsSource = '../../docs/dist/'
+    this.websiteSource = config.app.docMode === true ? this.docsSource : '../../views/dist/'
+
+    new s3deploy.BucketDeployment(scope, 'Website', {
+      sources: [s3deploy.Source.asset(this.websiteSource, {
+        assetHash: websiteSourceHash,
+        assetHashType: AssetHashType.CUSTOM,
+      })],
+      destinationBucket: props.publicBucket,
+      distribution: props.cdn,
+      distributionPaths: ['/*'],
+    })
+
+    new s3deploy.BucketDeployment(scope, 'PrivateFiles', {
+      sources: [s3deploy.Source.asset(this.privateSource)],
+      destinationBucket: props.privateBucket,
+    })
+  }
+}

package/src/cloud/dns.ts

@@ -0,0 +1,34 @@
+/* eslint-disable no-new */
+import { RemovalPolicy, aws_route53 as route53, aws_s3 as s3, aws_route53_targets as targets } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export class DnsStack {
+  zone: route53.IHostedZone
+
+  constructor(scope: Construct, props: NestedCloudProps) {
+    // lets see if the zone already exists because Buddy should have created it already
+    this.zone = route53.PublicHostedZone.fromLookup(scope, 'AppUrlHostedZone', {
+      domainName: props.domain,
+    })
+
+    // setup the www redirect
+    // Create a bucket for www.yourdomain.com and configure it to redirect to yourdomain.com
+    const wwwBucket = new s3.Bucket(scope, 'WwwBucket', {
+      bucketName: `www.${props.domain}`,
+      websiteRedirect: {
+        hostName: props.domain,
+        protocol: s3.RedirectProtocol.HTTPS,
+      },
+      removalPolicy: RemovalPolicy.DESTROY,
+      autoDeleteObjects: true,
+    })
+
+    // Create a Route53 record for www.yourdomain.com
+    new route53.ARecord(scope, 'WwwAliasRecord', {
+      recordName: `www.${props.domain}`,
+      zone: this.zone,
+      target: route53.RecordTarget.fromAlias(new targets.BucketWebsiteTarget(wwwBucket)),
+    })
+  }
+}