@studion/infra-code-blocks 0.1.9 → 0.2.0

package/dist/components/ecs-service.d.ts

@@ -0,0 +1,125 @@
+import * as pulumi from '@pulumi/pulumi';
+import * as aws from '@pulumi/aws';
+import { Size } from '../types/size';
+export declare const awsRegion: string;
+export declare const assumeRolePolicy: aws.iam.PolicyDocument;
+export type RoleInlinePolicy = {
+    /**
+     * Name of the role policy.
+     */
+    name?: pulumi.Input<string>;
+    /**
+     * Policy document as a JSON formatted string.
+     */
+    policy?: pulumi.Input<string>;
+};
+export type EcsServiceArgs = {
+    /**
+     * The ECR image used to start a container.
+     */
+    image: pulumi.Input<string>;
+    /**
+     * Exposed service port.
+     */
+    port: pulumi.Input<number>;
+    /**
+     * The aws.ecs.Cluster resource.
+     */
+    cluster: aws.ecs.Cluster;
+    vpcId: pulumi.Input<string>;
+    /**
+     * The IPv4 CIDR block for the VPC.
+     */
+    vpcCidrBlock: pulumi.Input<string>;
+    /**
+     * If the `assignPublicIp` parameter is set to `true`, the publicSubnetIds
+     * must be provided; otherwise, provide the privateSubnetIds.
+     */
+    subnetIds: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Number of instances of the task definition to place and keep running. Defaults to 1.
+     */
+    desiredCount?: pulumi.Input<number>;
+    /**
+     * CPU and memory size used for running the container. Defaults to "small".
+     * Available predefined options are:
+     * - small (0.25 vCPU, 0.5 GB memory)
+     * - medium (0.5 vCPU, 1 GB memory)
+     * - large (1 vCPU memory, 2 GB memory)
+     * - xlarge (2 vCPU, 4 GB memory)
+     */
+    size?: pulumi.Input<Size>;
+    /**
+     * The environment variables to pass to a container. Don't use this field for
+     * sensitive information such as passwords, API keys, etc. For that purpose,
+     * please use the `secrets` property.
+     * Defaults to [].
+     */
+    environment?: aws.ecs.KeyValuePair[];
+    /**
+     * The secrets to pass to the container. Defaults to [].
+     */
+    secrets?: aws.ecs.Secret[];
+    /**
+     * Enable service auto discovery and assign DNS record to service.
+     * Defaults to false.
+     */
+    enableServiceAutoDiscovery: pulumi.Input<boolean>;
+    /**
+     * Location of persistent storage volume.
+     */
+    persistentStorageVolumePath?: pulumi.Input<string>;
+    /**
+     * Alternate docker CMD instruction.
+     */
+    dockerCommand?: pulumi.Input<string[]>;
+    /**
+     * Autoscaling options for ecs service.
+     */
+    autoscaling?: pulumi.Input<{
+        /**
+         * Is autoscaling enabled or disabled. Defaults to false.
+         */
+        enabled: pulumi.Input<boolean>;
+        /**
+         * Min capacity of the scalable target. Defaults to 1.
+         */
+        minCount?: pulumi.Input<number>;
+        /**
+         * Max capacity of the scalable target. Defaults to 1.
+         */
+        maxCount?: pulumi.Input<number>;
+    }>;
+    lbTargetGroupArn?: aws.lb.TargetGroup['arn'];
+    /**
+     * Custom service security group
+     * In case no security group is provided, default security group will be used.
+     */
+    securityGroup?: aws.ec2.SecurityGroup;
+    /**
+     * Assign public IP address to service.
+     */
+    assignPublicIp?: pulumi.Input<boolean>;
+    taskExecutionRoleInlinePolicies?: pulumi.Input<pulumi.Input<RoleInlinePolicy>[]>;
+    taskRoleInlinePolicies?: pulumi.Input<pulumi.Input<RoleInlinePolicy>[]>;
+    /**
+     * A map of tags to assign to the resource.
+     */
+    tags?: pulumi.Input<{
+        [key: string]: pulumi.Input<string>;
+    }>;
+};
+export declare class EcsService extends pulumi.ComponentResource {
+    name: string;
+    logGroup: aws.cloudwatch.LogGroup;
+    taskDefinition: aws.ecs.TaskDefinition;
+    serviceDiscoveryService?: aws.servicediscovery.Service;
+    service: aws.ecs.Service;
+    constructor(name: string, args: EcsServiceArgs, opts?: pulumi.ComponentResourceOptions);
+    private createLogGroup;
+    private createPersistentStorage;
+    private createTaskDefinition;
+    private createServiceDiscovery;
+    private createEcsService;
+    private enableAutoscaling;
+}

package/dist/components/ecs-service.js

@@ -0,0 +1,323 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EcsService = exports.assumeRolePolicy = exports.awsRegion = void 0;
+const pulumi = require("@pulumi/pulumi");
+const aws = require("@pulumi/aws");
+const constants_1 = require("../constants");
+const config = new pulumi.Config('aws');
+exports.awsRegion = config.require('region');
+exports.assumeRolePolicy = {
+    Version: '2012-10-17',
+    Statement: [
+        {
+            Action: 'sts:AssumeRole',
+            Principal: {
+                Service: 'ecs-tasks.amazonaws.com',
+            },
+            Effect: 'Allow',
+            Sid: '',
+        },
+    ],
+};
+const defaults = {
+    desiredCount: 1,
+    size: 'small',
+    environment: [],
+    secrets: [],
+    enableServiceAutoDiscovery: false,
+    assignPublicIp: false,
+    taskExecutionRoleInlinePolicies: [],
+    taskRoleInlinePolicies: [],
+    autoscaling: {
+        enabled: false,
+        minCount: 1,
+        maxCount: 1,
+    },
+};
+class EcsService extends pulumi.ComponentResource {
+    constructor(name, args, opts = {}) {
+        super('studion:ecs:Service', name, {}, opts);
+        const argsWithDefaults = Object.assign({}, defaults, args);
+        this.name = name;
+        this.logGroup = this.createLogGroup();
+        this.taskDefinition = this.createTaskDefinition(args);
+        if (argsWithDefaults.enableServiceAutoDiscovery) {
+            this.serviceDiscoveryService = this.createServiceDiscovery(argsWithDefaults.vpcId);
+        }
+        this.service = this.createEcsService(args, opts);
+        if (argsWithDefaults.autoscaling.enabled) {
+            this.enableAutoscaling(args);
+        }
+        this.registerOutputs();
+    }
+    createLogGroup() {
+        const logGroup = new aws.cloudwatch.LogGroup(`${this.name}-log-group`, {
+            retentionInDays: 14,
+            namePrefix: `/ecs/${this.name}-`,
+            tags: constants_1.commonTags,
+        }, { parent: this });
+        return logGroup;
+    }
+    createPersistentStorage({ vpcId, vpcCidrBlock, subnetIds, }) {
+        const efs = new aws.efs.FileSystem(`${this.name}-efs`, {
+            encrypted: true,
+            lifecyclePolicies: [
+                {
+                    transitionToPrimaryStorageClass: 'AFTER_1_ACCESS',
+                },
+                {
+                    transitionToIa: 'AFTER_7_DAYS',
+                },
+            ],
+            performanceMode: 'generalPurpose',
+            throughputMode: 'bursting',
+            tags: Object.assign(Object.assign({}, constants_1.commonTags), { Name: `${this.name}-data` }),
+        }, { parent: this });
+        const securityGroup = new aws.ec2.SecurityGroup(`${this.name}-persistent-storage-security-group`, {
+            vpcId: vpcId,
+            ingress: [
+                {
+                    fromPort: 2049,
+                    toPort: 2049,
+                    protocol: 'tcp',
+                    cidrBlocks: [vpcCidrBlock],
+                },
+            ],
+            tags: constants_1.commonTags,
+        }, { parent: this });
+        pulumi.all([subnetIds]).apply(([ids]) => {
+            ids.forEach(it => {
+                const mountTarget = new aws.efs.MountTarget(`${this.name}-mount-target-${it}`, {
+                    fileSystemId: efs.id,
+                    subnetId: it,
+                    securityGroups: [securityGroup.id],
+                }, { parent: this });
+            });
+        });
+        return efs;
+    }
+    createTaskDefinition(args) {
+        const argsWithDefaults = Object.assign({}, defaults, args);
+        const stack = pulumi.getStack();
+        const secretManagerSecretsInlinePolicy = {
+            name: `${this.name}-secret-manager-access`,
+            policy: JSON.stringify({
+                Version: '2012-10-17',
+                Statement: [
+                    {
+                        Sid: 'AllowContainerToGetSecretManagerSecrets',
+                        Effect: 'Allow',
+                        Action: ['secretsmanager:GetSecretValue'],
+                        Resource: '*',
+                    },
+                ],
+            }),
+        };
+        const taskExecutionRole = new aws.iam.Role(`${this.name}-ecs-task-exec-role`, {
+            namePrefix: `${this.name}-ecs-task-exec-role-`,
+            assumeRolePolicy: exports.assumeRolePolicy,
+            managedPolicyArns: [
+                'arn:aws:iam::aws:policy/CloudWatchFullAccess',
+                'arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess',
+            ],
+            inlinePolicies: [
+                secretManagerSecretsInlinePolicy,
+                ...argsWithDefaults.taskExecutionRoleInlinePolicies,
+            ],
+            tags: constants_1.commonTags,
+        }, { parent: this });
+        const execCmdInlinePolicy = {
+            name: `${this.name}-ecs-exec`,
+            policy: JSON.stringify({
+                Version: '2012-10-17',
+                Statement: [
+                    {
+                        Sid: 'AllowContainerToCreateECSExecSSMChannel',
+                        Effect: 'Allow',
+                        Action: [
+                            'ssmmessages:CreateControlChannel',
+                            'ssmmessages:CreateDataChannel',
+                            'ssmmessages:OpenControlChannel',
+                            'ssmmessages:OpenDataChannel',
+                        ],
+                        Resource: '*',
+                    },
+                ],
+            }),
+        };
+        const taskRole = new aws.iam.Role(`${this.name}-ecs-task-role`, {
+            namePrefix: `${this.name}-ecs-task-role-`,
+            assumeRolePolicy: exports.assumeRolePolicy,
+            inlinePolicies: [
+                execCmdInlinePolicy,
+                ...argsWithDefaults.taskRoleInlinePolicies,
+            ],
+            tags: constants_1.commonTags,
+        }, { parent: this });
+        const parsedSize = pulumi.all([argsWithDefaults.size]).apply(([size]) => {
+            const mapCapabilities = ({ cpu, memory }) => ({
+                cpu: String(cpu),
+                memory: String(memory),
+            });
+            if (typeof size === 'string') {
+                return mapCapabilities(constants_1.PredefinedSize[size]);
+            }
+            if (typeof size === 'object') {
+                return mapCapabilities(size);
+            }
+            throw Error('Incorrect EcsService size argument');
+        });
+        const taskDefinition = new aws.ecs.TaskDefinition(`${this.name}-task-definition`, Object.assign(Object.assign({ family: `${this.name}-task-definition-${stack}`, networkMode: 'awsvpc', executionRoleArn: taskExecutionRole.arn, taskRoleArn: taskRole.arn, cpu: parsedSize.cpu, memory: parsedSize.memory, requiresCompatibilities: ['FARGATE'], containerDefinitions: pulumi
+                .all([
+                this.name,
+                argsWithDefaults.image,
+                argsWithDefaults.port,
+                argsWithDefaults.environment,
+                argsWithDefaults.secrets,
+                argsWithDefaults.persistentStorageVolumePath,
+                argsWithDefaults.dockerCommand,
+                this.logGroup.name,
+                exports.awsRegion,
+            ])
+                .apply(([containerName, image, port, environment, secrets, persistentStorageVolumePath, command, logGroup, region,]) => {
+                return JSON.stringify([
+                    Object.assign(Object.assign({ readonlyRootFilesystem: false, name: containerName, image, essential: true, portMappings: [
+                            {
+                                containerPort: port,
+                                protocol: 'tcp',
+                            },
+                        ] }, (persistentStorageVolumePath && {
+                        mountPoints: [
+                            {
+                                containerPath: persistentStorageVolumePath,
+                                sourceVolume: `${this.name}-volume`,
+                            },
+                        ],
+                    })), { logConfiguration: {
+                            logDriver: 'awslogs',
+                            options: {
+                                'awslogs-group': logGroup,
+                                'awslogs-region': region,
+                                'awslogs-stream-prefix': 'ecs',
+                            },
+                        }, command,
+                        environment,
+                        secrets }),
+                ]);
+            }) }, (argsWithDefaults.persistentStorageVolumePath && {
+            volumes: [
+                {
+                    name: `${this.name}-volume`,
+                    efsVolumeConfiguration: {
+                        fileSystemId: this.createPersistentStorage(argsWithDefaults).id,
+                        transitEncryption: 'ENABLED',
+                    },
+                },
+            ],
+        })), { tags: Object.assign(Object.assign({}, constants_1.commonTags), argsWithDefaults.tags) }), { parent: this });
+        return taskDefinition;
+    }
+    createServiceDiscovery(vpcId) {
+        const privateDnsNamespace = new aws.servicediscovery.PrivateDnsNamespace(`${this.name}-private-dns-namespace`, {
+            vpc: vpcId,
+            name: this.name,
+            tags: constants_1.commonTags,
+        }, { parent: this });
+        return new aws.servicediscovery.Service(`mongo-service`, {
+            name: this.name,
+            dnsConfig: {
+                namespaceId: privateDnsNamespace.id,
+                dnsRecords: [
+                    {
+                        ttl: 10,
+                        type: 'A',
+                    },
+                ],
+                routingPolicy: 'MULTIVALUE',
+            },
+            tags: constants_1.commonTags,
+        }, { parent: this });
+    }
+    createEcsService(args, opts) {
+        const argsWithDefaults = Object.assign({}, defaults, args);
+        const securityGroup = argsWithDefaults.securityGroup ||
+            new aws.ec2.SecurityGroup(`${this.name}-service-security-group`, {
+                vpcId: argsWithDefaults.vpcId,
+                ingress: [
+                    {
+                        fromPort: 0,
+                        toPort: 0,
+                        protocol: '-1',
+                        cidrBlocks: [argsWithDefaults.vpcCidrBlock],
+                    },
+                ],
+                egress: [
+                    {
+                        fromPort: 0,
+                        toPort: 0,
+                        protocol: '-1',
+                        cidrBlocks: ['0.0.0.0/0'],
+                    },
+                ],
+                tags: constants_1.commonTags,
+            }, { parent: this });
+        const service = new aws.ecs.Service(`${this.name}-service`, Object.assign(Object.assign(Object.assign(Object.assign({ name: this.name, cluster: argsWithDefaults.cluster.id, launchType: 'FARGATE', desiredCount: argsWithDefaults.desiredCount, taskDefinition: this.taskDefinition.arn, enableExecuteCommand: true }, (argsWithDefaults.lbTargetGroupArn && {
+            loadBalancers: [
+                {
+                    containerName: this.name,
+                    containerPort: argsWithDefaults.port,
+                    targetGroupArn: argsWithDefaults.lbTargetGroupArn,
+                },
+            ],
+        })), { networkConfiguration: {
+                assignPublicIp: argsWithDefaults.assignPublicIp,
+                subnets: argsWithDefaults.subnetIds,
+                securityGroups: [securityGroup.id],
+            } }), (argsWithDefaults.enableServiceAutoDiscovery &&
+            this.serviceDiscoveryService && {
+            serviceRegistries: {
+                registryArn: this.serviceDiscoveryService.arn,
+            },
+        })), { tags: Object.assign(Object.assign({}, constants_1.commonTags), argsWithDefaults.tags) }), {
+            parent: this,
+            dependsOn: opts.dependsOn,
+        });
+        return service;
+    }
+    enableAutoscaling(args) {
+        const argsWithDefaults = Object.assign({}, defaults, args);
+        const autoscalingTarget = new aws.appautoscaling.Target(`${this.name}-autoscale-target`, {
+            minCapacity: argsWithDefaults.autoscaling.minCount,
+            maxCapacity: argsWithDefaults.autoscaling.maxCount,
+            resourceId: pulumi.interpolate `service/${argsWithDefaults.cluster.name}/${this.service.name}`,
+            serviceNamespace: 'ecs',
+            scalableDimension: 'ecs:service:DesiredCount',
+            tags: constants_1.commonTags,
+        }, { parent: this });
+        const memoryAutoscalingPolicy = new aws.appautoscaling.Policy(`${this.name}-memory-autoscale-policy`, {
+            policyType: 'TargetTrackingScaling',
+            resourceId: autoscalingTarget.resourceId,
+            scalableDimension: autoscalingTarget.scalableDimension,
+            serviceNamespace: autoscalingTarget.serviceNamespace,
+            targetTrackingScalingPolicyConfiguration: {
+                predefinedMetricSpecification: {
+                    predefinedMetricType: 'ECSServiceAverageMemoryUtilization',
+                },
+                targetValue: 70,
+            },
+        }, { parent: this });
+        const cpuAutoscalingPolicy = new aws.appautoscaling.Policy(`${this.name}-cpu-autoscale-policy`, {
+            policyType: 'TargetTrackingScaling',
+            resourceId: autoscalingTarget.resourceId,
+            scalableDimension: autoscalingTarget.scalableDimension,
+            serviceNamespace: autoscalingTarget.serviceNamespace,
+            targetTrackingScalingPolicyConfiguration: {
+                predefinedMetricSpecification: {
+                    predefinedMetricType: 'ECSServiceAverageCPUUtilization',
+                },
+                targetValue: 70,
+            },
+        }, { parent: this });
+    }
+}
+exports.EcsService = EcsService;

package/dist/components/mongo.d.ts

@@ -0,0 +1,27 @@
+import * as pulumi from '@pulumi/pulumi';
+import * as aws from '@pulumi/aws';
+import { EcsService, EcsServiceArgs } from './ecs-service';
+export type MongoArgs = Pick<EcsServiceArgs, 'size' | 'cluster' | 'vpcId' | 'vpcCidrBlock' | 'tags'> & {
+    /**
+     * Username for the master DB user.
+     */
+    username: pulumi.Input<string>;
+    /**
+     * Password for the master DB user. If not specified it will be autogenerated.
+     * The value will be stored as a secret in AWS Secret Manager.
+     */
+    password?: pulumi.Input<string>;
+    privateSubnetIds: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Exposed service port. Defaults to 27017.
+     */
+    port?: pulumi.Input<number>;
+};
+export declare class Mongo extends pulumi.ComponentResource {
+    name: string;
+    service: EcsService;
+    passwordSecret: aws.secretsmanager.Secret;
+    constructor(name: string, args: MongoArgs, opts?: pulumi.ComponentResourceOptions);
+    private createRandomPassword;
+    private createPasswordSecret;
+}

package/dist/components/mongo.js

@@ -0,0 +1,63 @@
+"use strict";
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Mongo = void 0;
+const pulumi = require("@pulumi/pulumi");
+const aws = require("@pulumi/aws");
+const random = require("@pulumi/random");
+const constants_1 = require("../constants");
+const ecs_service_1 = require("./ecs-service");
+class Mongo extends pulumi.ComponentResource {
+    constructor(name, args, opts = {}) {
+        super('studion:Mongo', name, args, opts);
+        const port = args.port || 27017;
+        const { username, password, privateSubnetIds } = args, ecsServiceArgs = __rest(args, ["username", "password", "privateSubnetIds"]);
+        this.name = name;
+        const mongoPassword = password || this.createRandomPassword();
+        this.passwordSecret = this.createPasswordSecret(mongoPassword);
+        this.service = new ecs_service_1.EcsService(name, Object.assign(Object.assign({}, ecsServiceArgs), { port, image: 'mongo:7.0.3@sha256:238b1636bdd7820c752b91bec8a669f92568eb313ad89a1fc4a92903c1b40489', desiredCount: 1, autoscaling: { enabled: false }, enableServiceAutoDiscovery: true, persistentStorageVolumePath: '/data/db', dockerCommand: ['mongod', '--port', port.toString()], assignPublicIp: false, subnetIds: privateSubnetIds, environment: [
+                {
+                    name: 'MONGO_INITDB_ROOT_USERNAME',
+                    value: username,
+                },
+            ], secrets: [
+                {
+                    name: 'MONGO_INITDB_ROOT_PASSWORD',
+                    valueFrom: this.passwordSecret.arn,
+                },
+            ] }), Object.assign(Object.assign({}, opts), { parent: this }));
+        this.registerOutputs();
+    }
+    createRandomPassword() {
+        const password = new random.RandomPassword(`${this.name}-mongo-password`, {
+            length: 16,
+            overrideSpecial: '_%$',
+            special: true,
+        });
+        return password.result;
+    }
+    createPasswordSecret(password) {
+        const project = pulumi.getProject();
+        const stack = pulumi.getStack();
+        const passwordSecret = new aws.secretsmanager.Secret(`${this.name}-password-secret`, {
+            namePrefix: `${stack}/${project}/MongoPassword-`,
+            tags: constants_1.commonTags,
+        }, { parent: this });
+        const passwordSecretValue = new aws.secretsmanager.SecretVersion(`${this.name}-password-secret-value`, {
+            secretId: passwordSecret.id,
+            secretString: password,
+        }, { parent: this, dependsOn: [passwordSecret] });
+        return passwordSecret;
+    }
+}
+exports.Mongo = Mongo;

package/dist/components/nuxt-ssr.d.ts

@@ -0,0 +1,43 @@
+import * as pulumi from '@pulumi/pulumi';
+import * as aws from '@pulumi/aws';
+import { AcmCertificate } from './acm-certificate';
+import { EcsService, EcsServiceArgs } from './ecs-service';
+export type NuxtSSRArgs = Pick<EcsServiceArgs, 'image' | 'port' | 'cluster' | 'vpcId' | 'vpcCidrBlock' | 'desiredCount' | 'autoscaling' | 'size' | 'environment' | 'secrets' | 'tags'> & {
+    publicSubnetIds: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The domain which will be used to access the service.
+     * The domain or subdomain must belong to the provided hostedZone.
+     */
+    domain?: pulumi.Input<string>;
+    /**
+     * The ID of the hosted zone.
+     */
+    hostedZoneId?: pulumi.Input<string>;
+    /**
+     * Path for the health check request. Defaults to "/".
+     */
+    healthCheckPath?: pulumi.Input<string>;
+};
+export declare class NuxtSSR extends pulumi.ComponentResource {
+    name: string;
+    service: EcsService;
+    certificate?: AcmCertificate;
+    lbSecurityGroup: aws.ec2.SecurityGroup;
+    serviceSecurityGroup: aws.ec2.SecurityGroup;
+    customCFHeader: {
+        name: pulumi.Output<string>;
+        value: pulumi.Output<string>;
+    };
+    lb: aws.lb.LoadBalancer;
+    lbTargetGroup: aws.lb.TargetGroup;
+    lbHttpListener: aws.lb.Listener;
+    cloudfront: aws.cloudfront.Distribution;
+    constructor(name: string, args: NuxtSSRArgs, opts?: pulumi.ComponentResourceOptions);
+    private createTlsCertificate;
+    private createCustomCFHeader;
+    private createLoadBalancer;
+    private createSecurityGroup;
+    private createEcsService;
+    private createCloudfrontDistribution;
+    private createDnsRecord;
+}