@studion/infra-code-blocks 0.0.8 → 0.0.9

package/README.md

@@ -131,6 +131,7 @@ export type WebServerService = {
   environment?:
     | aws.ecs.KeyValuePair[]
     | ((services: Services) => aws.ecs.KeyValuePair[]);
+  secrets?: aws.ecs.Secret[];
   image: pulumi.Input<string>;
   port: pulumi.Input<number>;
   domain: pulumi.Input<string>;
@@ -181,6 +182,27 @@ const project = new studion.Project('demo-project', {
 });
 ```
 
+In order to pass sensitive information to the container use `secrets` instead of `environment`. AWS will fetch values from
+Secret Manager based on arn that is provided for the `valueFrom` field.
+
+```ts
+const project = new studion.Project('demo-project', {
+  environment: 'DEVELOPMENT',
+  services: [
+    {
+      type: 'WEB_SERVER',
+      serviceName: 'api',
+      image: imageUri,
+      port: 3000,
+      domain: 'api.my-domain.com',
+      secrets: [
+        { name: 'DB_PASSWORD', valueFrom: 'arn-of-the-secret-manager-secret' },
+      ],
+    },
+  ],
+});
+```
+
 ### Database
 
 AWS RDS Postgres instance.
@@ -331,6 +353,7 @@ export type WebServerArgs = {
   maxCount?: pulumi.Input<number>;
   size?: pulumi.Input<Size>;
   environment?: aws.ecs.KeyValuePair[];
+  secrets?: aws.ecs.Secret[];
   healtCheckPath?: pulumi.Input<string>;
   taskExecutionRoleInlinePolicies?: pulumi.Input<
     pulumi.Input<RoleInlinePolicy>[]
@@ -444,3 +467,4 @@ const project = new studion.Project('demo-project', {
 
 - [ ] Add worker service for executing tasks
 - [ ] Add MongoDB service
+- [ ] Make db username & password fields optional and autogenerate db username & password if they are not provided

package/dist/components/web-server.d.ts

@@ -61,9 +61,16 @@ export type WebServerArgs = {
      */
     size?: pulumi.Input<Size>;
     /**
-     * The environment variables to pass to a container. Defaults to [].
+     * The environment variables to pass to a container. Don't use this field for
+     * sensitive information such as passwords, API keys, etc. For that purpose,
+     * please use the `secrets` property.
+     * Defaults to [].
      */
     environment?: aws.ecs.KeyValuePair[];
+    /**
+     * The secrets to pass to the container. Defaults to [].
+     */
+    secrets?: aws.ecs.Secret[];
     /**
      * Path for the health check request. Defaults to "/healtcheck".
      */

package/dist/components/web-server.js

@@ -26,6 +26,7 @@ const defaults = {
     maxCount: 10,
     size: 'small',
     environment: [],
+    secrets: [],
     healtCheckPath: '/healtcheck',
     taskExecutionRoleInlinePolicies: [],
     taskRoleInlinePolicies: [],
@@ -128,6 +129,20 @@ class WebServer extends pulumi.ComponentResource {
                 },
             ],
         }, { parent: this });
+        const secretManagerSecretsInlinePolicy = {
+            name: `${name}-secret-manager-access`,
+            policy: JSON.stringify({
+                Version: '2012-10-17',
+                Statement: [
+                    {
+                        Sid: 'AllowContainerToGetSecretManagerSecrets',
+                        Effect: 'Allow',
+                        Action: ['secretsmanager:GetSecretValue'],
+                        Resource: '*',
+                    },
+                ],
+            }),
+        };
         const taskExecutionRole = new aws.iam.Role(`${name}-ecs-task-exec-role`, {
             name: `${name}-ecs-task-exec-role`,
             assumeRolePolicy,
@@ -135,7 +150,10 @@ class WebServer extends pulumi.ComponentResource {
                 'arn:aws:iam::aws:policy/CloudWatchFullAccess',
                 'arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess',
             ],
-            inlinePolicies: argsWithDefaults.taskExecutionRoleInlinePolicies,
+            inlinePolicies: [
+                secretManagerSecretsInlinePolicy,
+                ...argsWithDefaults.taskExecutionRoleInlinePolicies,
+            ],
         }, { parent: this });
         const execCmdInlinePolicy = {
             name: `${name}-ecs-exec`,
@@ -191,10 +209,11 @@ class WebServer extends pulumi.ComponentResource {
                 argsWithDefaults.image,
                 argsWithDefaults.port,
                 argsWithDefaults.environment,
+                argsWithDefaults.secrets,
                 this.logGroup.name,
                 awsRegion,
             ])
-                .apply(([containerName, image, port, environment, logGroup, region]) => {
+                .apply(([containerName, image, port, environment, secrets, logGroup, region,]) => {
                 return JSON.stringify([
                     {
                         readonlyRootFilesystem: false,
@@ -216,6 +235,7 @@ class WebServer extends pulumi.ComponentResource {
                             },
                         },
                         environment,
+                        secrets,
                     },
                 ]);
             }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@studion/infra-code-blocks",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "description": "Studion common infra components",
   "keywords": [
     "infrastructure",