@stacksjs/cloud 0.65.0 → 0.67.0

package/src/cloud/security.ts

@@ -1,272 +0,0 @@
-import type { aws_route53 as route53 } from 'aws-cdk-lib'
-import type { Construct } from 'constructs'
-import type { NestedCloudProps } from '../types'
-// waf and encryption
-import { config } from '@stacksjs/config'
-import {
-  aws_certificatemanager as acm,
-  aws_cloudfront as cloudfront,
-  Duration,
-  aws_kms as kms,
-  RemovalPolicy,
-  Tags,
-  aws_wafv2 as wafv2,
-} from 'aws-cdk-lib'
-
-export interface StorageStackProps extends NestedCloudProps {
-  zone: route53.IHostedZone
-}
-
-export class SecurityStack {
-  firewall: wafv2.CfnWebACL
-  kmsKey: kms.Key
-  certificate: acm.Certificate
-  originAccessIdentity: cloudfront.OriginAccessIdentity
-
-  constructor(scope: Construct, props: StorageStackProps) {
-    const firewallOptions = config.cloud.firewall
-
-    if (!firewallOptions)
-      throw new Error('No firewall options found in config')
-
-    const options = {
-      defaultAction: { allow: {} },
-      scope: 'CLOUDFRONT',
-      visibilityConfig: {
-        sampledRequestsEnabled: true,
-        cloudWatchMetricsEnabled: true,
-        metricName: 'firewallMetric',
-      },
-      rules: this.getFirewallRules(scope),
-    }
-
-    this.firewall = new wafv2.CfnWebACL(scope, 'StacksWebFirewall', options)
-    Tags.of(this.firewall).add('Name', 'waf-cloudfront', { priority: 300 })
-    Tags.of(this.firewall).add('Purpose', 'CloudFront', { priority: 300 })
-    Tags.of(this.firewall).add('CreatedBy', 'CloudFormation', {
-      priority: 300,
-    })
-
-    this.kmsKey = new kms.Key(scope, 'EncryptionKey', {
-      alias: 'stacks-encryption-key',
-      description: 'KMS key for Stacks Cloud',
-      enableKeyRotation: true,
-      removalPolicy: RemovalPolicy.DESTROY,
-      pendingWindow: Duration.days(30),
-    })
-
-    this.certificate = new acm.Certificate(scope, 'Certificate', {
-      domainName: props.domain,
-      validation: acm.CertificateValidation.fromDns(props.zone),
-      subjectAlternativeNames: [`www.${props.domain}`, `api.${props.domain}`, `docs.${props.domain}`],
-    })
-
-    this.originAccessIdentity = new cloudfront.OriginAccessIdentity(scope, 'OAI')
-  }
-
-  getFirewallRules(scope: Construct): wafv2.CfnWebACL.RuleProperty[] {
-    const rules: wafv2.CfnWebACL.RuleProperty[] = []
-    const priorities = []
-
-    if (config.security.firewall?.countryCodes?.length) {
-      priorities.push(1)
-      rules.push({
-        name: 'CountryRule',
-        priority: priorities.length,
-        statement: {
-          geoMatchStatement: {
-            countryCodes: config.security.firewall.countryCodes as string[],
-          },
-        },
-        action: {
-          block: {},
-        },
-        visibilityConfig: {
-          sampledRequestsEnabled: true,
-          cloudWatchMetricsEnabled: true,
-          metricName: 'CountryRule',
-        },
-      })
-    }
-
-    if (config.security.firewall?.ipAddresses?.length) {
-      const ipSet = new wafv2.CfnIPSet(scope, 'IpSet', {
-        name: 'IpSet',
-        description: 'IP Set',
-        scope: 'CLOUDFRONT',
-        addresses: config.security.firewall.ipAddresses as string[],
-        ipAddressVersion: 'IPV4',
-      })
-
-      priorities.push(1)
-      rules.push({
-        name: 'IpAddressRule',
-        priority: priorities.length,
-        statement: {
-          ipSetReferenceStatement: {
-            arn: ipSet.attrArn,
-          },
-        },
-        action: {
-          block: {},
-        },
-        visibilityConfig: {
-          sampledRequestsEnabled: true,
-          cloudWatchMetricsEnabled: true,
-          metricName: 'IpAddressRule',
-        },
-      })
-    }
-
-    if (config.security.firewall?.httpHeaders?.length) {
-      config.security.firewall.httpHeaders.forEach((header: string | undefined, index: number) => {
-        priorities.push(1)
-        rules.push({
-          name: `HttpHeaderRule${index}`,
-          priority: priorities.length,
-          statement: {
-            byteMatchStatement: {
-              fieldToMatch: {
-                singleHeader: {
-                  name: header,
-                },
-              },
-              positionalConstraint: 'EXACTLY',
-              searchString: 'true',
-              textTransformations: [
-                {
-                  priority: 0,
-                  type: 'NONE',
-                },
-              ],
-            },
-          },
-          action: {
-            block: {},
-          },
-          visibilityConfig: {
-            sampledRequestsEnabled: true,
-            cloudWatchMetricsEnabled: true,
-            metricName: `HttpHeaderRule${index}`,
-          },
-        })
-      })
-    }
-
-    // if (config.security.firewall?.queryString?.length) {
-    //   priorities.push(1)
-    //   rules.push({
-    //     name: 'QueryStringRule',
-    //     priority: priorities.length,
-    //     statement: {
-    //       byteMatchStatement: {
-    //         fieldToMatch: {
-    //           queryString: {},
-    //         },
-    //         positionalConstraint: 'EXACTLY',
-    //         searchString: config.security.firewall.queryString.join(', '),
-    //         textTransformations: [
-    //           {
-    //             priority: 0,
-    //             type: 'NONE',
-    //           },
-    //         ],
-    //       },
-    //     },
-    //     action: {
-    //       block: {},
-    //     },
-    //     visibilityConfig: {
-    //       sampledRequestsEnabled: true,
-    //       cloudWatchMetricsEnabled: true,
-    //       metricName: 'QueryStringRule',
-    //     },
-    //   })
-    // }
-
-    // if (config.security.firewall?.rateLimitPerMinute) {
-    //   priorities.push(1)
-    //   rules.push({
-    //     name: 'RateLimitRule',
-    //     priority: priorities.length,
-    //     statement: {
-    //       rateBasedStatement: {
-    //         limit: config.security.firewall.rateLimitPerMinute,
-    //         aggregateKeyType: 'IP',
-    //       },
-    //     },
-    //     action: {
-    //       block: {},
-    //     },
-    //     visibilityConfig: {
-    //       sampledRequestsEnabled: true,
-    //       cloudWatchMetricsEnabled: true,
-    //       metricName: 'RateLimitRule',
-    //     },
-    //   })
-    // }
-
-    // if (config.security.firewall?.useIpReputationLists) {
-    //   priorities.push(1)
-    //   rules.push({
-    //     name: 'IpReputationRule',
-    //     priority: priorities.length,
-    //     statement: {
-    //       managedRuleGroupStatement: {
-    //         vendorName: 'AWS',
-    //         name: 'AWSManagedRulesAmazonIpReputationList',
-    //       },
-    //     },
-    //     action: {
-    //       block: {},
-    //     },
-    //     visibilityConfig: {
-    //       sampledRequestsEnabled: true,
-    //       cloudWatchMetricsEnabled: true,
-    //       metricName: 'IpReputationRule',
-    //     },
-    //   })
-    // }
-
-    // if (config.security.firewall?.useKnownBadInputsRuleSet) {
-    //   priorities.push(1)
-    //   rules.push({
-    //     name: 'KnownBadInputsRule',
-    //     priority: priorities.length,
-    //     statement: {
-    //       managedRuleGroupStatement: {
-    //         vendorName: 'AWS',
-    //         name: 'AWSManagedRulesKnownBadInputsRuleSet',
-    //       },
-    //     },
-    //     action: {
-    //       block: {},
-    //     },
-    //     visibilityConfig: {
-    //       sampledRequestsEnabled: true,
-    //       cloudWatchMetricsEnabled: true,
-    //       metricName: 'KnownBadInputsRule',
-    //     },
-    //   })
-    // }
-    // also add
-    //     }, {
-    //   "name": "AWSManagedRulesAnonymousIpList",
-    //   "priority": 40,
-    //   "overrideAction": "none",
-    //   "excludedRules": []
-    // }, {
-    //   "name": "AWSManagedRulesLinuxRuleSet",
-    //   "priority": 50,
-    //   "overrideAction": "none",
-    //   "excludedRules": []
-    // }, {
-    //   "name": "AWSManagedRulesUnixRuleSet",
-    //   "priority": 60,
-    //   "overrideAction": "none",
-    //   "excludedRules": [],
-    // }];
-
-    return rules
-  }
-}

package/src/cloud/storage.ts

@@ -1,197 +0,0 @@
-import type { aws_cloudfront as cloudfront, aws_kms as kms } from 'aws-cdk-lib'
-import type { Construct } from 'constructs'
-import type { NestedCloudProps } from '../types'
-import { config } from '@stacksjs/config'
-import { path as p } from '@stacksjs/path'
-import { hasFiles } from '@stacksjs/storage'
-import { aws_backup as backup, aws_iam as iam, RemovalPolicy, aws_s3 as s3, Tags } from 'aws-cdk-lib'
-
-export interface StorageStackProps extends NestedCloudProps {
-  kmsKey: kms.Key
-  originAccessIdentity: cloudfront.OriginAccessIdentity
-}
-
-export class StorageStack {
-  publicBucket: s3.Bucket
-  privateBucket: s3.Bucket
-  docsBucket?: s3.Bucket
-  logBucket: s3.Bucket
-  bucketPrefix: string
-  vault: backup.BackupVault
-  backupPlan: backup.BackupPlan
-  backupRole: iam.Role
-
-  constructor(scope: Construct, props: StorageStackProps) {
-    this.bucketPrefix = `${props.slug}-${props.appEnv}`
-
-    this.publicBucket = new s3.Bucket(scope, 'PublicBucket', {
-      bucketName: `${this.bucketPrefix}-public-${props.timestamp}`,
-      versioned: true,
-      autoDeleteObjects: true,
-      removalPolicy: RemovalPolicy.DESTROY,
-      encryption: s3.BucketEncryption.S3_MANAGED,
-      websiteIndexDocument: 'index.html',
-      websiteErrorDocument: 'index.html',
-      publicReadAccess: true,
-      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ACLS,
-    })
-
-    Tags.of(this.publicBucket).add('daily-backup', 'true')
-
-    if (this.shouldDeployDocs()) {
-      this.docsBucket = new s3.Bucket(scope, 'DocsBucket', {
-        bucketName: `${this.bucketPrefix}-docs-${props.timestamp}`,
-        versioned: true,
-        autoDeleteObjects: true,
-        removalPolicy: RemovalPolicy.DESTROY,
-        encryption: s3.BucketEncryption.S3_MANAGED,
-        websiteIndexDocument: 'index.html',
-        websiteErrorDocument: 'index.html',
-        publicReadAccess: true,
-        blockPublicAccess: s3.BlockPublicAccess.BLOCK_ACLS,
-      })
-
-      Tags.of(this.docsBucket).add('weekly-backup', 'true')
-    }
-
-    this.privateBucket = new s3.Bucket(scope, 'PrivateBucket', {
-      bucketName: `${this.bucketPrefix}-private-${props.timestamp}`,
-      versioned: true,
-      removalPolicy: RemovalPolicy.DESTROY,
-      autoDeleteObjects: true,
-      encryption: s3.BucketEncryption.S3_MANAGED,
-      enforceSSL: true,
-      publicReadAccess: false,
-      blockPublicAccess: {
-        blockPublicAcls: true,
-        blockPublicPolicy: true,
-        ignorePublicAcls: true,
-        restrictPublicBuckets: true,
-      },
-    })
-
-    Tags.of(this.privateBucket).add('daily-backup', 'true')
-
-    this.logBucket = new s3.Bucket(scope, 'LogsBucket', {
-      bucketName: `${this.bucketPrefix}-logs-${props.timestamp}`,
-      removalPolicy: RemovalPolicy.RETAIN, // somehow, if we try to auto-delete logs, it fails bc the bucket is not empty (even though objects should be deleted) -> that's why we let buddy cloud:cleanup handle this which is auto triggered when buddy undeploy is ran
-      // autoDeleteObjects: true,
-      blockPublicAccess: new s3.BlockPublicAccess({
-        blockPublicAcls: false,
-        ignorePublicAcls: true,
-        blockPublicPolicy: true,
-        restrictPublicBuckets: true,
-      }),
-      objectOwnership: s3.ObjectOwnership.BUCKET_OWNER_PREFERRED,
-    })
-
-    Tags.of(this.logBucket).add('daily-backup', 'true')
-
-    this.backupRole = this.createBackupRole(scope)
-
-    // Daily 35 day retention
-    this.vault = new backup.BackupVault(scope, 'BackupVault', {
-      backupVaultName: `${props.slug}-${props.appEnv}-daily-backup-vault`,
-      encryptionKey: props.kmsKey,
-      removalPolicy: RemovalPolicy.DESTROY,
-    })
-
-    this.backupPlan = backup.BackupPlan.daily35DayRetention(scope, 'BackupPlan', this.vault)
-
-    this.backupPlan.addSelection('Selection', {
-      role: this.backupRole,
-      resources: [backup.BackupResource.fromTag('daily-backup', 'true')],
-    })
-  }
-
-  createBackupRole(scope: Construct): iam.Role {
-    const backupRole = new iam.Role(scope, 'BackupRole', {
-      assumedBy: new iam.ServicePrincipal('backup.amazonaws.com'),
-    })
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: [
-          's3:GetInventoryConfiguration',
-          's3:PutInventoryConfiguration',
-          's3:ListBucketVersions',
-          's3:ListBucket',
-          's3:GetBucketVersioning',
-          's3:GetBucketNotification',
-          's3:PutBucketNotification',
-          's3:GetBucketLocation',
-          's3:GetBucketTagging',
-        ],
-        resources: ['arn:aws:s3:::*'],
-        sid: 'S3BucketBackupPermissions',
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: [
-          's3:GetObjectAcl',
-          's3:GetObject',
-          's3:GetObjectVersionTagging',
-          's3:GetObjectVersionAcl',
-          's3:GetObjectTagging',
-          's3:GetObjectVersion',
-        ],
-        resources: ['arn:aws:s3:::*/*'],
-        sid: 'S3ObjectBackupPermissions',
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: ['s3:ListAllMyBuckets'],
-        resources: ['*'],
-        sid: 'S3GlobalPermissions',
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: ['kms:Decrypt', 'kms:DescribeKey'],
-        resources: ['*'],
-        sid: 'KMSBackupPermissions',
-        conditions: {
-          StringLike: {
-            'kms:ViaService': 's3.*.amazonaws.com',
-          },
-        },
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: [
-          'events:DescribeRule',
-          'events:EnableRule',
-          'events:PutRule',
-          'events:DeleteRule',
-          'events:PutTargets',
-          'events:RemoveTargets',
-          'events:ListTargetsByRule',
-          'events:DisableRule',
-        ],
-        resources: ['arn:aws:events:*:*:rule/AwsBackupManagedRule*'],
-        sid: 'EventsPermissions',
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: ['cloudwatch:GetMetricData', 'events:ListRules'],
-        resources: ['*'],
-        sid: 'EventsMetricsGlobalPermissions',
-      }),
-    )
-
-    return backupRole
-  }
-
-  shouldDeployDocs(): boolean {
-    return (hasFiles(p.projectPath('docs')) || config.app.docMode) ?? false
-  }
-}

package/src/edge/origin-request.ts

@@ -1,55 +0,0 @@
-const config = {
-  suffix: '.html',
-  removeTrailingSlash: false,
-}
-
-const regexSuffixless = /\/[^/.]+$/ // e.g. "/some/page" but not "/", "/some/" or "/some.jpg"
-const regexTrailingSlash = /.+\/$/ // e.g. "/some/" or "/some/page/" but not root "/"
-
-// TODO: narrow types here
-export function handler(event: any, context: any, callback: any): void {
-  const { request } = event.Records[0].cf
-  const { uri } = request
-  const { suffix } = config
-
-  if (uri === '/') {
-    request.uri = '/index.html'
-    callback(null, request)
-    return
-  }
-
-  // Append ".html" to origin request
-  if (uri.match(regexSuffixless)) {
-    request.uri = uri + suffix
-    callback(null, request)
-    return
-  }
-
-  // Remove trailing slash and append ".html" to origin request
-  if (uri.match(regexTrailingSlash)) {
-    request.uri = `${uri.slice(0, -1)}.html`
-    callback(null, request)
-    return
-  }
-
-  // Redirect (301) non-root requests ending in "/" to URI without trailing slash
-  // if (removeTrailingSlash && uri.match(/.+\/$/)) {
-  //   const response = {
-  //     // body: '',
-  //     // bodyEncoding: 'text',
-  //     headers: {
-  //       location: [{
-  //         key: 'Location',
-  //         value: uri.slice(0, -1),
-  //       }],
-  //     },
-  //     status: '301',
-  //     statusDescription: 'Moved Permanently',
-  //   }
-  //   callback(null, response)
-  //   return
-  // }
-
-  // If nothing matches, return request unchanged
-  callback(null, request)
-}