@stacksjs/ts-cloud-core 0.1.1

package/src/cloudformation/builders/cache.ts

@@ -0,0 +1,334 @@
+import type { CloudFormationBuilder } from '../builder'
+import { Fn } from '../types'
+
+export interface CacheConfig {
+  redis?: {
+    nodeType: string
+    numCacheNodes: number
+    engine: 'redis'
+    engineVersion: string
+    port?: number
+    parameterGroup?: {
+      maxmemoryPolicy?: string
+      timeout?: string
+      [key: string]: string | undefined
+    }
+    snapshotRetentionLimit?: number
+    snapshotWindow?: string
+    automaticFailoverEnabled?: boolean
+  }
+  memcached?: {
+    nodeType: string
+    numCacheNodes: number
+    engine: 'memcached'
+    engineVersion: string
+    port?: number
+  }
+  elasticache?: {
+    nodeType: string
+    numCacheNodes: number
+    engine: string
+    engineVersion: string
+  }
+}
+
+/**
+ * Add ElastiCache resources to CloudFormation template
+ */
+export function addCacheResources(
+  builder: CloudFormationBuilder,
+  config: CacheConfig,
+): void {
+  if (config.redis) {
+    addRedisCluster(builder, config.redis)
+  }
+
+  if (config.memcached) {
+    addMemcachedCluster(builder, config.memcached)
+  }
+
+  if (config.elasticache) {
+    addElastiCacheCluster(builder, config.elasticache)
+  }
+}
+
+/**
+ * Add Redis cluster
+ */
+function addRedisCluster(
+  builder: CloudFormationBuilder,
+  config: CacheConfig['redis'],
+): void {
+  if (!config) return
+
+  // Cache Subnet Group
+  builder.addResource('CacheSubnetGroup', 'AWS::ElastiCache::SubnetGroup', {
+    Description: 'Subnet group for ElastiCache Redis cluster',
+    SubnetIds: [
+      Fn.ref('PrivateSubnet1'),
+      Fn.ref('PrivateSubnet2'),
+    ],
+    Tags: [
+      { Key: 'Name', Value: Fn.sub('${AWS::StackName}-cache-subnet-group') },
+    ],
+  }, {
+    dependsOn: ['PrivateSubnet1', 'PrivateSubnet2'],
+  })
+
+  // Cache Security Group
+  builder.addResource('CacheSecurityGroup', 'AWS::EC2::SecurityGroup', {
+    GroupDescription: 'Security group for ElastiCache Redis',
+    VpcId: Fn.ref('VPC'),
+    SecurityGroupIngress: [{
+      IpProtocol: 'tcp',
+      FromPort: config.port || 6379,
+      ToPort: config.port || 6379,
+      SourceSecurityGroupId: Fn.ref('AppSecurityGroup'),
+    }],
+    Tags: [
+      { Key: 'Name', Value: Fn.sub('${AWS::StackName}-cache-sg') },
+    ],
+  }, {
+    dependsOn: ['VPC', 'AppSecurityGroup'],
+  })
+
+  // Parameter Group
+  if (config.parameterGroup && Object.keys(config.parameterGroup).length > 0) {
+    builder.addResource('CacheParameterGroup', 'AWS::ElastiCache::ParameterGroup', {
+      Description: 'Parameter group for Redis',
+      CacheParameterGroupFamily: `redis${config.engineVersion.split('.')[0]}`,
+      Properties: config.parameterGroup,
+    })
+  }
+
+  // Replication Group (Redis cluster with replication)
+  if (config.numCacheNodes > 1 || config.automaticFailoverEnabled) {
+    builder.addResource('RedisReplicationGroup', 'AWS::ElastiCache::ReplicationGroup', {
+      ReplicationGroupDescription: 'Redis replication group',
+      ReplicationGroupId: Fn.sub('${AWS::StackName}-redis'),
+      Engine: 'redis',
+      EngineVersion: config.engineVersion,
+      CacheNodeType: config.nodeType,
+      NumCacheClusters: config.numCacheNodes,
+      AutomaticFailoverEnabled: config.automaticFailoverEnabled || false,
+      MultiAZEnabled: config.automaticFailoverEnabled || false,
+      Port: config.port || 6379,
+      CacheSubnetGroupName: Fn.ref('CacheSubnetGroup'),
+      SecurityGroupIds: [Fn.ref('CacheSecurityGroup')],
+      CacheParameterGroupName: config.parameterGroup
+        ? Fn.ref('CacheParameterGroup')
+        : undefined,
+      SnapshotRetentionLimit: config.snapshotRetentionLimit || 5,
+      SnapshotWindow: config.snapshotWindow || '03:00-05:00',
+      PreferredMaintenanceWindow: 'sun:05:00-sun:06:00',
+      AtRestEncryptionEnabled: true,
+      TransitEncryptionEnabled: true,
+      Tags: [
+        { Key: 'Name', Value: Fn.sub('${AWS::StackName}-redis') },
+      ],
+    }, {
+      dependsOn: config.parameterGroup
+        ? ['CacheSubnetGroup', 'CacheSecurityGroup', 'CacheParameterGroup']
+        : ['CacheSubnetGroup', 'CacheSecurityGroup'],
+    })
+
+    // Output
+    builder.addOutputs({
+      RedisEndpoint: {
+        Description: 'Redis primary endpoint',
+        Value: Fn.getAtt('RedisReplicationGroup', 'PrimaryEndPoint.Address'),
+        Export: {
+          Name: Fn.sub('${AWS::StackName}-redis-endpoint'),
+        },
+      },
+      RedisPort: {
+        Description: 'Redis port',
+        Value: Fn.getAtt('RedisReplicationGroup', 'PrimaryEndPoint.Port'),
+        Export: {
+          Name: Fn.sub('${AWS::StackName}-redis-port'),
+        },
+      },
+    })
+  }
+  else {
+    // Single node Redis cluster
+    builder.addResource('RedisCacheCluster', 'AWS::ElastiCache::CacheCluster', {
+      ClusterName: Fn.sub('${AWS::StackName}-redis'),
+      Engine: 'redis',
+      EngineVersion: config.engineVersion,
+      CacheNodeType: config.nodeType,
+      NumCacheNodes: 1,
+      Port: config.port || 6379,
+      CacheSubnetGroupName: Fn.ref('CacheSubnetGroup'),
+      VpcSecurityGroupIds: [Fn.ref('CacheSecurityGroup')],
+      CacheParameterGroupName: config.parameterGroup
+        ? Fn.ref('CacheParameterGroup')
+        : undefined,
+      SnapshotRetentionLimit: config.snapshotRetentionLimit || 5,
+      SnapshotWindow: config.snapshotWindow || '03:00-05:00',
+      PreferredMaintenanceWindow: 'sun:05:00-sun:06:00',
+      Tags: [
+        { Key: 'Name', Value: Fn.sub('${AWS::StackName}-redis') },
+      ],
+    }, {
+      dependsOn: config.parameterGroup
+        ? ['CacheSubnetGroup', 'CacheSecurityGroup', 'CacheParameterGroup']
+        : ['CacheSubnetGroup', 'CacheSecurityGroup'],
+    })
+
+    // Output
+    builder.addOutputs({
+      RedisEndpoint: {
+        Description: 'Redis endpoint',
+        Value: Fn.getAtt('RedisCacheCluster', 'RedisEndpoint.Address'),
+        Export: {
+          Name: Fn.sub('${AWS::StackName}-redis-endpoint'),
+        },
+      },
+      RedisPort: {
+        Description: 'Redis port',
+        Value: Fn.getAtt('RedisCacheCluster', 'RedisEndpoint.Port'),
+        Export: {
+          Name: Fn.sub('${AWS::StackName}-redis-port'),
+        },
+      },
+    })
+  }
+}
+
+/**
+ * Add Memcached cluster
+ */
+function addMemcachedCluster(
+  builder: CloudFormationBuilder,
+  config: CacheConfig['memcached'],
+): void {
+  if (!config) return
+
+  // Cache Subnet Group
+  if (!builder.hasResource('CacheSubnetGroup')) {
+    builder.addResource('CacheSubnetGroup', 'AWS::ElastiCache::SubnetGroup', {
+      Description: 'Subnet group for ElastiCache',
+      SubnetIds: [
+        Fn.ref('PrivateSubnet1'),
+        Fn.ref('PrivateSubnet2'),
+      ],
+    }, {
+      dependsOn: ['PrivateSubnet1', 'PrivateSubnet2'],
+    })
+  }
+
+  // Cache Security Group
+  if (!builder.hasResource('CacheSecurityGroup')) {
+    builder.addResource('CacheSecurityGroup', 'AWS::EC2::SecurityGroup', {
+      GroupDescription: 'Security group for ElastiCache Memcached',
+      VpcId: Fn.ref('VPC'),
+      SecurityGroupIngress: [{
+        IpProtocol: 'tcp',
+        FromPort: config.port || 11211,
+        ToPort: config.port || 11211,
+        SourceSecurityGroupId: Fn.ref('AppSecurityGroup'),
+      }],
+      Tags: [
+        { Key: 'Name', Value: Fn.sub('${AWS::StackName}-cache-sg') },
+      ],
+    }, {
+      dependsOn: ['VPC', 'AppSecurityGroup'],
+    })
+  }
+
+  // Memcached Cluster
+  builder.addResource('MemcachedCacheCluster', 'AWS::ElastiCache::CacheCluster', {
+    ClusterName: Fn.sub('${AWS::StackName}-memcached'),
+    Engine: 'memcached',
+    EngineVersion: config.engineVersion,
+    CacheNodeType: config.nodeType,
+    NumCacheNodes: config.numCacheNodes,
+    Port: config.port || 11211,
+    CacheSubnetGroupName: Fn.ref('CacheSubnetGroup'),
+    VpcSecurityGroupIds: [Fn.ref('CacheSecurityGroup')],
+    PreferredMaintenanceWindow: 'sun:05:00-sun:06:00',
+    Tags: [
+      { Key: 'Name', Value: Fn.sub('${AWS::StackName}-memcached') },
+    ],
+  }, {
+    dependsOn: ['CacheSubnetGroup', 'CacheSecurityGroup'],
+  })
+
+  // Output
+  builder.addOutputs({
+    MemcachedEndpoint: {
+      Description: 'Memcached configuration endpoint',
+      Value: Fn.getAtt('MemcachedCacheCluster', 'ConfigurationEndpoint.Address'),
+      Export: {
+        Name: Fn.sub('${AWS::StackName}-memcached-endpoint'),
+      },
+    },
+    MemcachedPort: {
+      Description: 'Memcached port',
+      Value: Fn.getAtt('MemcachedCacheCluster', 'ConfigurationEndpoint.Port'),
+      Export: {
+        Name: Fn.sub('${AWS::StackName}-memcached-port'),
+      },
+    },
+  })
+}
+
+/**
+ * Add generic ElastiCache cluster
+ */
+function addElastiCacheCluster(
+  builder: CloudFormationBuilder,
+  config: CacheConfig['elasticache'],
+): void {
+  if (!config) return
+
+  const isRedis = config.engine === 'redis'
+
+  // Reuse subnet and security groups from Redis/Memcached functions
+  if (!builder.hasResource('CacheSubnetGroup')) {
+    builder.addResource('CacheSubnetGroup', 'AWS::ElastiCache::SubnetGroup', {
+      Description: 'Subnet group for ElastiCache',
+      SubnetIds: [
+        Fn.ref('PrivateSubnet1'),
+        Fn.ref('PrivateSubnet2'),
+      ],
+    }, {
+      dependsOn: ['PrivateSubnet1', 'PrivateSubnet2'],
+    })
+  }
+
+  if (!builder.hasResource('CacheSecurityGroup')) {
+    builder.addResource('CacheSecurityGroup', 'AWS::EC2::SecurityGroup', {
+      GroupDescription: 'Security group for ElastiCache',
+      VpcId: Fn.ref('VPC'),
+      SecurityGroupIngress: [{
+        IpProtocol: 'tcp',
+        FromPort: isRedis ? 6379 : 11211,
+        ToPort: isRedis ? 6379 : 11211,
+        SourceSecurityGroupId: Fn.ref('AppSecurityGroup'),
+      }],
+      Tags: [
+        { Key: 'Name', Value: Fn.sub('${AWS::StackName}-cache-sg') },
+      ],
+    }, {
+      dependsOn: ['VPC', 'AppSecurityGroup'],
+    })
+  }
+
+  // ElastiCache Cluster
+  builder.addResource('CacheCluster', 'AWS::ElastiCache::CacheCluster', {
+    ClusterName: Fn.sub(`\${AWS::StackName}-${config.engine}`),
+    Engine: config.engine,
+    EngineVersion: config.engineVersion,
+    CacheNodeType: config.nodeType,
+    NumCacheNodes: config.numCacheNodes,
+    CacheSubnetGroupName: Fn.ref('CacheSubnetGroup'),
+    VpcSecurityGroupIds: [Fn.ref('CacheSecurityGroup')],
+    Tags: [
+      { Key: 'Name', Value: Fn.sub(`\${AWS::StackName}-${config.engine}`) },
+    ],
+  }, {
+    dependsOn: ['CacheSubnetGroup', 'CacheSecurityGroup'],
+  })
+}

package/src/cloudformation/builders/cdn.ts

@@ -0,0 +1,278 @@
+import type { CloudFormationBuilder } from '../builder'
+import { Fn } from '../types'
+
+export interface CDNConfig {
+  enabled: boolean
+  origins?: Array<{
+    id: string
+    domainName: string
+    pathPattern?: string
+    originPath?: string
+  }>
+  customDomain?: {
+    domain: string
+    certificateArn: string
+  }
+  cachePolicy?: {
+    minTTL?: number
+    defaultTTL?: number
+    maxTTL?: number
+  }
+  compress?: boolean
+  http3?: boolean
+  errorPages?: {
+    [code: string]: string
+  }
+  edgeFunctions?: Array<{
+    eventType: 'viewer-request' | 'viewer-response' | 'origin-request' | 'origin-response'
+    functionArn: string
+    name: string
+  }>
+  priceClass?: 'PriceClass_All' | 'PriceClass_200' | 'PriceClass_100'
+}
+
+/**
+ * Add CloudFront distribution to CloudFormation template
+ */
+export function addCDNResources(
+  builder: CloudFormationBuilder,
+  config: CDNConfig,
+): void {
+  if (!config.enabled) {
+    return
+  }
+
+  // Origin Access Identity for S3 origins
+  builder.addResource('CloudFrontOriginAccessIdentity', 'AWS::CloudFront::CloudFrontOriginAccessIdentity', {
+    CloudFrontOriginAccessIdentityConfig: {
+      Comment: Fn.sub('${AWS::StackName} CloudFront OAI'),
+    },
+  })
+
+  // Build origins list
+  const origins: any[] = []
+  const cacheBehaviors: any[] = []
+
+  // Default origin from S3 if no custom origins specified
+  if (!config.origins || config.origins.length === 0) {
+    // Assume there's a static bucket
+    origins.push({
+      Id: 'S3Origin',
+      DomainName: Fn.getAtt('StaticBucket', 'DomainName'),
+      S3OriginConfig: {
+        OriginAccessIdentity: Fn.sub('origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}'),
+      },
+    })
+  }
+  else {
+    // Use custom origins
+    config.origins.forEach((origin, index) => {
+      const originConfig: any = {
+        Id: origin.id,
+        DomainName: origin.domainName,
+      }
+
+      if (origin.originPath) {
+        originConfig.OriginPath = origin.originPath
+      }
+
+      // Determine origin type
+      if (origin.domainName.includes('s3')) {
+        originConfig.S3OriginConfig = {
+          OriginAccessIdentity: Fn.sub('origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}'),
+        }
+      }
+      else {
+        // Custom origin (ALB, API Gateway, etc.)
+        originConfig.CustomOriginConfig = {
+          HTTPPort: 80,
+          HTTPSPort: 443,
+          OriginProtocolPolicy: 'https-only',
+          OriginSSLProtocols: ['TLSv1.2'],
+        }
+      }
+
+      origins.push(originConfig)
+
+      // Add cache behavior for non-default origins
+      if (index > 0 || origin.pathPattern) {
+        cacheBehaviors.push({
+          PathPattern: origin.pathPattern || `/${origin.id}/*`,
+          TargetOriginId: origin.id,
+          ViewerProtocolPolicy: 'redirect-to-https',
+          AllowedMethods: ['GET', 'HEAD', 'OPTIONS'],
+          CachedMethods: ['GET', 'HEAD'],
+          Compress: config.compress !== false,
+          ForwardedValues: {
+            QueryString: true,
+            Cookies: {
+              Forward: 'none',
+            },
+          },
+          MinTTL: config.cachePolicy?.minTTL || 0,
+          DefaultTTL: config.cachePolicy?.defaultTTL || 86400,
+          MaxTTL: config.cachePolicy?.maxTTL || 31536000,
+        })
+      }
+    })
+  }
+
+  // Default cache behavior
+  const defaultCacheBehavior: any = {
+    TargetOriginId: origins[0].Id,
+    ViewerProtocolPolicy: 'redirect-to-https',
+    AllowedMethods: ['GET', 'HEAD', 'OPTIONS'],
+    CachedMethods: ['GET', 'HEAD'],
+    Compress: config.compress !== false,
+    ForwardedValues: {
+      QueryString: true,
+      Cookies: {
+        Forward: 'none',
+      },
+    },
+    MinTTL: config.cachePolicy?.minTTL || 0,
+    DefaultTTL: config.cachePolicy?.defaultTTL || 86400,
+    MaxTTL: config.cachePolicy?.maxTTL || 31536000,
+  }
+
+  // Lambda@Edge functions
+  if (config.edgeFunctions && config.edgeFunctions.length > 0) {
+    defaultCacheBehavior.LambdaFunctionAssociations = config.edgeFunctions.map(fn => ({
+      EventType: fn.eventType,
+      LambdaFunctionARN: fn.functionArn,
+    }))
+  }
+
+  // CloudFront distribution
+  const distributionConfig: any = {
+    Enabled: true,
+    HttpVersion: config.http3 ? 'http3' : 'http2',
+    IPV6Enabled: true,
+    Origins: origins,
+    DefaultCacheBehavior: defaultCacheBehavior,
+    PriceClass: config.priceClass || 'PriceClass_100',
+    ViewerCertificate: {},
+  }
+
+  // Cache behaviors for additional origins
+  if (cacheBehaviors.length > 0) {
+    distributionConfig.CacheBehaviors = cacheBehaviors
+  }
+
+  // Custom domain
+  if (config.customDomain) {
+    distributionConfig.Aliases = [config.customDomain.domain]
+    distributionConfig.ViewerCertificate = {
+      AcmCertificateArn: config.customDomain.certificateArn,
+      SslSupportMethod: 'sni-only',
+      MinimumProtocolVersion: 'TLSv1.2_2021',
+    }
+  }
+  else {
+    distributionConfig.ViewerCertificate = {
+      CloudFrontDefaultCertificate: true,
+    }
+  }
+
+  // Custom error responses
+  if (config.errorPages) {
+    distributionConfig.CustomErrorResponses = Object.entries(config.errorPages).map(([code, path]) => ({
+      ErrorCode: Number.parseInt(code),
+      ResponseCode: 200,
+      ResponsePagePath: path,
+      ErrorCachingMinTTL: 300,
+    }))
+  }
+
+  // Default root object
+  distributionConfig.DefaultRootObject = 'index.html'
+
+  // Comment
+  distributionConfig.Comment = Fn.sub('${AWS::StackName} CloudFront Distribution')
+
+  builder.addResource('CloudFrontDistribution', 'AWS::CloudFront::Distribution', {
+    DistributionConfig: distributionConfig,
+  }, {
+    dependsOn: 'CloudFrontOriginAccessIdentity',
+  })
+
+  // Update S3 bucket policy to allow CloudFront access
+  if (!config.origins || config.origins.length === 0) {
+    builder.addResource('StaticBucketPolicyForCloudFront', 'AWS::S3::BucketPolicy', {
+      Bucket: Fn.ref('StaticBucket'),
+      PolicyDocument: {
+        Version: '2012-10-17',
+        Statement: [{
+          Sid: 'AllowCloudFrontAccess',
+          Effect: 'Allow',
+          Principal: {
+            CanonicalUser: Fn.getAtt('CloudFrontOriginAccessIdentity', 'S3CanonicalUserId'),
+          },
+          Action: 's3:GetObject',
+          Resource: Fn.join('', [
+            Fn.getAtt('StaticBucket', 'Arn'),
+            '/*',
+          ]),
+        }],
+      },
+    }, {
+      dependsOn: ['StaticBucket', 'CloudFrontOriginAccessIdentity'],
+    })
+  }
+
+  // Route53 DNS record for custom domain
+  if (config.customDomain) {
+    // Note: This assumes a hosted zone exists
+    // In a real implementation, you'd need to either create or import the hosted zone
+    builder.addResource('CloudFrontDNSRecord', 'AWS::Route53::RecordSet', {
+      HostedZoneName: Fn.sub(`${extractRootDomain(config.customDomain.domain)}.`),
+      Name: config.customDomain.domain,
+      Type: 'A',
+      AliasTarget: {
+        HostedZoneId: 'Z2FDTNDATAQYW2', // CloudFront hosted zone ID (constant)
+        DNSName: Fn.getAtt('CloudFrontDistribution', 'DomainName'),
+        EvaluateTargetHealth: false,
+      },
+    }, {
+      dependsOn: 'CloudFrontDistribution',
+    })
+  }
+
+  // Outputs
+  builder.addOutputs({
+    CloudFrontDistributionId: {
+      Description: 'CloudFront distribution ID',
+      Value: Fn.ref('CloudFrontDistribution'),
+      Export: {
+        Name: Fn.sub('${AWS::StackName}-cloudfront-id'),
+      },
+    },
+    CloudFrontDomainName: {
+      Description: 'CloudFront distribution domain name',
+      Value: Fn.getAtt('CloudFrontDistribution', 'DomainName'),
+      Export: {
+        Name: Fn.sub('${AWS::StackName}-cloudfront-domain'),
+      },
+    },
+  })
+
+  if (config.customDomain) {
+    builder.addOutputs({
+      CloudFrontURL: {
+        Description: 'CloudFront custom domain URL',
+        Value: Fn.sub(`https://${config.customDomain.domain}`),
+      },
+    })
+  }
+}
+
+/**
+ * Extract root domain from subdomain
+ */
+function extractRootDomain(domain: string): string {
+  const parts = domain.split('.')
+  if (parts.length >= 2) {
+    return parts.slice(-2).join('.')
+  }
+  return domain
+}