@studion/infra-code-blocks 0.6.12 → 0.8.0-next.0

package/dist/v2/components/ecs-service/index.d.ts

@@ -0,0 +1,156 @@
+import * as pulumi from '@pulumi/pulumi';
+import * as aws from '@pulumi/aws';
+import * as awsx from '@pulumi/awsx';
+import { Size } from '../../../types/size';
+type PersistentStorage = {
+    fileSystem: aws.efs.FileSystem;
+    accessPoint: aws.efs.AccessPoint;
+};
+export declare namespace EcsService {
+    /**
+     * Create a named volume that can be mounted into one or more containers.
+     * Used with Amazon EFS to enable persistent storage across:
+     * - Container restarts
+     * - Multiple containers
+     */
+    type PersistentStorageVolume = {
+        name: pulumi.Input<string>;
+    };
+    /**
+     * Specifies how an EFS volume is mounted into a container.
+     * `sourceVolume`: Name of the defined ECS service volume.
+     * `containerPath`: Path into which the volume is mounted in the container.
+     *
+     * @see {@link PersistentStorageVolume} - Required to define volumes before mounting
+     * @see {@link Container} - Where `mountPoints` are specified
+     */
+    type PersistentStorageMountPoint = {
+        sourceVolume: pulumi.Input<string>;
+        containerPath: pulumi.Input<string>;
+        readOnly?: pulumi.Input<boolean>;
+    };
+    /**
+     * Container configuration for the ECS task definition.
+     * Multiple containers can be defined to create multi-container tasks.
+     */
+    type Container = {
+        name: pulumi.Input<string>;
+        image: pulumi.Input<string>;
+        portMappings?: pulumi.Input<pulumi.Input<aws.ecs.PortMapping>[]>;
+        command?: pulumi.Input<pulumi.Input<string>[]>;
+        mountPoints?: PersistentStorageMountPoint[];
+        environment?: pulumi.Input<aws.ecs.KeyValuePair[]>;
+        secrets?: pulumi.Input<aws.ecs.Secret[]>;
+        dependsOn?: pulumi.Input<aws.ecs.ContainerDependency[]>;
+        /**
+         * If `false`, task can continue running if this container fails.
+         * Should be `false` for containers that execute and then tear down.
+         *
+         * Examples: Database migration, or configuration containers
+         *
+         * All containers not marked as `false` will be essential by default.
+         */
+        essential?: pulumi.Input<boolean>;
+        healthCheck?: pulumi.Input<aws.ecs.HealthCheck>;
+    };
+    type Tags = {
+        [key: string]: pulumi.Input<string>;
+    };
+    type LoadBalancerConfig = {
+        containerName: pulumi.Input<string>;
+        containerPort: pulumi.Input<number>;
+        targetGroupArn: aws.lb.TargetGroup['arn'];
+    };
+    type RoleInlinePolicy = aws.types.input.iam.RoleInlinePolicy;
+    type Args = {
+        cluster: pulumi.Input<aws.ecs.Cluster>;
+        vpc: pulumi.Input<awsx.ec2.Vpc>;
+        containers: EcsService.Container[];
+        loadBalancers?: pulumi.Input<LoadBalancerConfig[]>;
+        volumes?: pulumi.Input<pulumi.Input<EcsService.PersistentStorageVolume>[]>;
+        /**
+         * Number of instances of the task definition to place and keep running.
+         * @default 1
+         */
+        desiredCount?: pulumi.Input<number>;
+        /**
+         * CPU and memory size used for running the container.
+         * Available predefined options are:
+         * - `small` (0.25 vCPU, 0.5 GB memory)
+         * - `medium` (0.5 vCPU, 1 GB memory)
+         * - `large` (1 vCPU memory, 2 GB memory)
+         * - `xlarge` (2 vCPU, 4 GB memory)
+         *
+         * @default "small"
+         */
+        size?: pulumi.Input<Size>;
+        /**
+         * Custom service security group
+         * In case no security group is provided, default security group will be automatically created.
+         */
+        securityGroup?: pulumi.Input<aws.ec2.SecurityGroup>;
+        assignPublicIp?: pulumi.Input<boolean>;
+        taskExecutionRoleInlinePolicies?: pulumi.Input<pulumi.Input<RoleInlinePolicy>[]>;
+        taskRoleInlinePolicies?: pulumi.Input<pulumi.Input<RoleInlinePolicy>[]>;
+        /**
+         * Registers tasks with AWS Cloud Map and creates discoverable DNS entries for each task.
+         * Simplifies service-to-service communication by enabling service finding based on DNS records such as `http://serviceName.local`.
+         *
+         * @default false
+         */
+        enableServiceAutoDiscovery?: pulumi.Input<boolean>;
+        autoscaling?: pulumi.Input<{
+            /**
+             * Is autoscaling enabled or disabled.
+             *
+             * @default false
+             */
+            enabled: pulumi.Input<boolean>;
+            /**
+             * Min capacity of the scalable target.
+             *
+             * @default 1
+             */
+            minCount?: pulumi.Input<number>;
+            /**
+             * Max capacity of the scalable target.
+             *
+             * @default 1
+             */
+            maxCount?: pulumi.Input<number>;
+        }>;
+        /**
+         * A map of tags to assign to the resource.
+         */
+        tags?: pulumi.Input<EcsService.Tags>;
+    };
+}
+export declare class EcsService extends pulumi.ComponentResource {
+    name: string;
+    vpc: pulumi.Output<awsx.ec2.Vpc>;
+    logGroup: aws.cloudwatch.LogGroup;
+    taskDefinition: pulumi.Output<aws.ecs.TaskDefinition>;
+    taskExecutionRole: aws.iam.Role;
+    taskRole: aws.iam.Role;
+    service: aws.ecs.Service;
+    securityGroups: pulumi.Output<aws.ec2.SecurityGroup>[];
+    serviceDiscoveryService?: aws.servicediscovery.Service;
+    persistentStorage?: PersistentStorage;
+    constructor(name: string, args: EcsService.Args, opts?: pulumi.ComponentResourceOptions);
+    static createTcpPortMapping(port: pulumi.Input<number>): aws.ecs.PortMapping;
+    private createLogGroup;
+    private createTaskDefinition;
+    private createTaskDefinitionVolumes;
+    private createContainerDefinition;
+    private createTaskExecutionRole;
+    private createTaskRole;
+    addSecurityGroup(securityGroup: pulumi.Output<aws.ec2.SecurityGroup>): void;
+    private createDefaultSecurityGroup;
+    private createEcsService;
+    private createServiceDiscovery;
+    private createPrivateDnsNameSpace;
+    private enableAutoscaling;
+    private createPersistentStorage;
+}
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/v2/components/ecs-service/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/v2/components/ecs-service/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,IAAI,MAAM,cAAc,CAAC;AACrC,OAAO,EAAc,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAOvD,KAAK,iBAAiB,GAAG;IACvB,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC;IAC/B,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAA;CACjC,CAAC;AAEF,yBAAiB,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,KAAY,uBAAuB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;KAAE,CAAC;IAEtE;;;;;;;OAOG;IACH,KAAY,2BAA2B,GAAG;QACxC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;KAClC,CAAC;IAEF;;;OAGG;IACH,KAAY,SAAS,GAAG;QACtB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,YAAY,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,WAAW,CAAC,EAAE,2BAA2B,EAAE,CAAC;QAC5C,WAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC;QACxD;;;;;;;WAOG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,WAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;KAChD,CAAC;IAEF,KAAY,IAAI,GAAG;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;KAAE,CAAC;IAE5D,KAAY,kBAAkB,GAAG;QAC/B,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;KAC3C,CAAC;IAEF,KAAY,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAEpE,KAAY,IAAI,GAAG;QACjB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,UAAU,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;QACnC,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAC3E;;;WAGG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC;;;;;;;;;WASG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B;;;WAGG;QACH,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACpD,cAAc,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,+BAA+B,CAAC,EAAE,MAAM,CAAC,KAAK,CAC5C,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CACjC,CAAC;QACF,sBAAsB,CAAC,EAAE,MAAM,CAAC,KAAK,CACnC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CACjC,CAAC;QACF;;;;;WAKG;QACH,0BAA0B,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,WAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC;YACzB;;;;eAIG;YACH,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/B;;;;eAIG;YACH,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChC;;;;eAIG;YACH,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;SACjC,CAAC,CAAC;QACH;;WAEG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;KACtC,CAAC;CACH;AAiCD,qBAAa,UAAW,SAAQ,MAAM,CAAC,iBAAiB;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACtD,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;IAChC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;IACvD,uBAAuB,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC;IACvD,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;gBAGpC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,CAAC,IAAI,EACrB,IAAI,GAAE,MAAM,CAAC,wBAA6B;WAgD9B,oBAAoB,CAChC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GACzB,GAAG,CAAC,GAAG,CAAC,WAAW;IAQtB,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,oBAAoB;IAkC5B,OAAO,CAAC,2BAA2B;IAoBnC,OAAO,CAAC,yBAAyB;IA0BjC,OAAO,CAAC,uBAAuB;IAuC/B,OAAO,CAAC,cAAc;IAkCf,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,IAAI;IAIlF,OAAO,CAAC,0BAA0B;IAsClC,OAAO,CAAC,gBAAgB;IA6BxB,OAAO,CAAC,sBAAsB;IAuB9B,OAAO,CAAC,yBAAyB;IAYjC,OAAO,CAAC,iBAAiB;IAsDzB,OAAO,CAAC,uBAAuB;CA6EhC"}

package/dist/v2/components/ecs-service/index.js

@@ -0,0 +1,362 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EcsService = void 0;
+const pulumi = require("@pulumi/pulumi");
+const aws = require("@pulumi/aws");
+const constants_1 = require("../../../constants");
+const policies_1 = require("./policies");
+const config = new pulumi.Config('aws');
+const awsRegion = config.require('region');
+/**
+ * Standard directory permissions:
+ * - Owner: read, write, execute (7)
+ * - Group: read, execute (5)
+ * - Others: read, execute (5)
+ */
+const STANDARD_DIRECTORY_PERMISSIONS = '0755';
+const FIRST_POSIX_NON_ROOT_USER = {
+    userId: 1000,
+    groupId: 1000,
+    permissions: STANDARD_DIRECTORY_PERMISSIONS
+};
+const defaults = {
+    desiredCount: 1,
+    size: 'small',
+    environment: [],
+    secrets: [],
+    volumes: [],
+    enableServiceAutoDiscovery: false,
+    assignPublicIp: false,
+    taskExecutionRoleInlinePolicies: [],
+    taskRoleInlinePolicies: [],
+    autoscaling: {
+        enabled: false,
+        minCount: 1,
+        maxCount: 1,
+    },
+};
+class EcsService extends pulumi.ComponentResource {
+    constructor(name, args, opts = {}) {
+        super('studion:ecs:Service', name, {}, opts);
+        const argsWithDefaults = Object.assign({}, defaults, args);
+        const taskExecutionRoleInlinePolicies = pulumi.output(args.taskExecutionRoleInlinePolicies || defaults.taskExecutionRoleInlinePolicies);
+        const taskRoleInlinePolicies = pulumi.output(args.taskRoleInlinePolicies || defaults.taskRoleInlinePolicies);
+        this.name = name;
+        this.securityGroups = [];
+        this.vpc = pulumi.output(argsWithDefaults.vpc);
+        this.logGroup = this.createLogGroup();
+        this.taskExecutionRole = this.createTaskExecutionRole(taskExecutionRoleInlinePolicies);
+        this.taskRole = this.createTaskRole(taskRoleInlinePolicies);
+        if (argsWithDefaults.volumes.length) {
+            this.persistentStorage = this.createPersistentStorage(this.vpc);
+        }
+        this.taskDefinition = this.createTaskDefinition(argsWithDefaults.containers, pulumi.output(argsWithDefaults.volumes), this.taskExecutionRole, this.taskRole, argsWithDefaults.size, Object.assign(Object.assign({}, constants_1.commonTags), argsWithDefaults.tags));
+        if (argsWithDefaults.enableServiceAutoDiscovery) {
+            this.serviceDiscoveryService = this.createServiceDiscovery();
+        }
+        this.service = this.createEcsService(argsWithDefaults);
+        if (argsWithDefaults.autoscaling.enabled) {
+            this.enableAutoscaling(pulumi.output(argsWithDefaults.cluster).name, this.service.name, argsWithDefaults.autoscaling.minCount, argsWithDefaults.autoscaling.maxCount);
+        }
+        this.registerOutputs();
+    }
+    static createTcpPortMapping(port) {
+        return {
+            containerPort: port,
+            hostPort: port,
+            protocol: 'tcp'
+        };
+    }
+    createLogGroup() {
+        const logGroup = new aws.cloudwatch.LogGroup(`${this.name}-log-group`, {
+            retentionInDays: 14,
+            namePrefix: `/ecs/${this.name}-`,
+            tags: constants_1.commonTags,
+        }, { parent: this });
+        return logGroup;
+    }
+    createTaskDefinition(containers, volumes, taskExecutionRole, taskRole, size, tags) {
+        const stack = pulumi.getStack();
+        const { cpu, memory } = pulumi.output(size).apply(parseSize);
+        const containerDefinitions = containers.map(container => {
+            return this.createContainerDefinition(container);
+        });
+        const taskDefinitionVolumes = this.createTaskDefinitionVolumes(volumes);
+        return pulumi.all(containerDefinitions).apply(containerDefinitions => {
+            return taskDefinitionVolumes.apply(volumes => {
+                return new aws.ecs.TaskDefinition(`${this.name}-task-definition`, Object.assign(Object.assign({ family: `${this.name}-task-definition-${stack}`, networkMode: 'awsvpc', executionRoleArn: taskExecutionRole.arn, taskRoleArn: taskRole.arn, cpu,
+                    memory, requiresCompatibilities: ['FARGATE'], containerDefinitions: JSON.stringify(containerDefinitions) }, ((volumes === null || volumes === void 0 ? void 0 : volumes.length) ? { volumes } : {})), { tags: Object.assign(Object.assign({}, constants_1.commonTags), tags) }), { parent: this });
+            });
+        });
+    }
+    createTaskDefinitionVolumes(volumes) {
+        return volumes.apply(volumes => {
+            if (!volumes.length || !this.persistentStorage)
+                return;
+            return volumes.map(volume => ({
+                name: pulumi.output(volume).name,
+                efsVolumeConfiguration: {
+                    fileSystemId: this.persistentStorage.fileSystem.id,
+                    transitEncryption: 'ENABLED',
+                    authorizationConfig: {
+                        accessPointId: this.persistentStorage.accessPoint.id,
+                        iam: 'ENABLED',
+                    },
+                }
+            }));
+        });
+    }
+    createContainerDefinition(container) {
+        return this.logGroup.name.apply(logGroupName => (Object.assign(Object.assign(Object.assign(Object.assign({}, container), { readonlyRootFilesystem: false }), container.mountPoints && {
+            mountPoints: container.mountPoints.map(mountPoint => pulumi.all([
+                mountPoint.sourceVolume,
+                mountPoint.containerPath,
+                mountPoint.readOnly
+            ]).apply(([sourceVolume, containerPath, readOnly]) => ({
+                containerPath,
+                sourceVolume,
+                readOnly: readOnly !== null && readOnly !== void 0 ? readOnly : false,
+            })))
+        }), { logConfiguration: {
+                logDriver: 'awslogs',
+                options: {
+                    'awslogs-group': logGroupName,
+                    'awslogs-region': awsRegion,
+                    'awslogs-stream-prefix': 'ecs',
+                },
+            } })));
+    }
+    createTaskExecutionRole(inlinePolicies) {
+        const secretManagerSecretsInlinePolicy = {
+            name: `${this.name}-secret-manager-access`,
+            policy: JSON.stringify({
+                Version: '2012-10-17',
+                Statement: [
+                    {
+                        Sid: 'AllowContainerToGetSecretManagerSecrets',
+                        Effect: 'Allow',
+                        Action: ['ssm:GetParameters', 'secretsmanager:GetSecretValue'],
+                        Resource: '*',
+                    },
+                ],
+            }),
+        };
+        const taskExecutionRole = new aws.iam.Role(`${this.name}-task-exec-role`, {
+            namePrefix: `${this.name}-task-exec-role-`,
+            assumeRolePolicy: policies_1.assumeRolePolicy,
+            managedPolicyArns: [
+                'arn:aws:iam::aws:policy/CloudWatchFullAccess',
+                'arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess',
+            ],
+            inlinePolicies: inlinePolicies.apply(policies => [
+                secretManagerSecretsInlinePolicy,
+                ...policies,
+            ]),
+            tags: constants_1.commonTags,
+        }, { parent: this });
+        return taskExecutionRole;
+    }
+    createTaskRole(inlinePolicies) {
+        const execCmdInlinePolicy = {
+            name: `${this.name}-exec`,
+            policy: JSON.stringify({
+                Version: '2012-10-17',
+                Statement: [
+                    {
+                        Sid: 'AllowContainerToCreateECSExecSSMChannel',
+                        Effect: 'Allow',
+                        Action: [
+                            'ssmmessages:CreateControlChannel',
+                            'ssmmessages:CreateDataChannel',
+                            'ssmmessages:OpenControlChannel',
+                            'ssmmessages:OpenDataChannel',
+                        ],
+                        Resource: '*',
+                    },
+                ],
+            }),
+        };
+        return new aws.iam.Role(`${this.name}-task-role`, {
+            namePrefix: `${this.name}-task-role-`,
+            assumeRolePolicy: policies_1.assumeRolePolicy,
+            inlinePolicies: inlinePolicies.apply(policies => [
+                execCmdInlinePolicy,
+                ...policies,
+            ]),
+            tags: constants_1.commonTags,
+        }, { parent: this });
+    }
+    addSecurityGroup(securityGroup) {
+        this.securityGroups.push(securityGroup);
+    }
+    createDefaultSecurityGroup() {
+        const securityGroup = pulumi.all([
+            this.vpc,
+            this.vpc.vpcId,
+            this.vpc.vpc.cidrBlock
+        ]).apply(([vpc, vpcId, cidrBlock]) => {
+            return new aws.ec2.SecurityGroup(`${this.name}-service-security-group`, {
+                vpcId,
+                ingress: [
+                    {
+                        fromPort: 0,
+                        toPort: 0,
+                        protocol: '-1',
+                        cidrBlocks: [cidrBlock],
+                    },
+                ],
+                egress: [
+                    {
+                        fromPort: 0,
+                        toPort: 0,
+                        protocol: '-1',
+                        cidrBlocks: ['0.0.0.0/0'],
+                    },
+                ],
+                tags: constants_1.commonTags,
+            }, { parent: this, dependsOn: [vpc] });
+        });
+        this.addSecurityGroup(securityGroup);
+    }
+    createEcsService(ecsServiceArgs) {
+        if (!this.securityGroups.length)
+            this.createDefaultSecurityGroup();
+        const networkConfiguration = {
+            assignPublicIp: ecsServiceArgs.assignPublicIp,
+            subnets: ecsServiceArgs.assignPublicIp ? this.vpc.publicSubnetIds : this.vpc.privateSubnetIds,
+            securityGroups: pulumi
+                .all(this.securityGroups)
+                .apply(groups => groups.map(it => it.id)),
+        };
+        return new aws.ecs.Service(`${this.name}-service`, Object.assign(Object.assign(Object.assign({ name: this.name, cluster: pulumi.output(ecsServiceArgs.cluster).id, launchType: 'FARGATE', desiredCount: ecsServiceArgs.desiredCount, taskDefinition: this.taskDefinition.arn, enableExecuteCommand: true, networkConfiguration }, ecsServiceArgs.loadBalancers && { loadBalancers: ecsServiceArgs.loadBalancers }), this.serviceDiscoveryService && {
+            serviceRegistries: {
+                registryArn: this.serviceDiscoveryService.arn,
+            },
+        }), { tags: Object.assign(Object.assign({}, constants_1.commonTags), ecsServiceArgs.tags) }), { parent: this, });
+    }
+    createServiceDiscovery() {
+        const privateDnsNamespace = this.createPrivateDnsNameSpace();
+        return new aws.servicediscovery.Service(`${this.name}-service-discovery`, {
+            name: this.name,
+            dnsConfig: {
+                namespaceId: privateDnsNamespace.id,
+                dnsRecords: [
+                    {
+                        ttl: 10,
+                        type: 'A',
+                    },
+                ],
+                routingPolicy: 'MULTIVALUE',
+            },
+            tags: constants_1.commonTags,
+        }, { parent: this });
+    }
+    createPrivateDnsNameSpace() {
+        return new aws.servicediscovery.PrivateDnsNamespace(`${this.name}-private-dns-namespace`, {
+            vpc: this.vpc.vpcId,
+            name: this.name,
+            tags: constants_1.commonTags,
+        }, { parent: this });
+    }
+    enableAutoscaling(clusterName, serviceName, minCount, maxCount) {
+        const autoscalingTarget = new aws.appautoscaling.Target(`${this.name}-autoscale-target`, {
+            minCapacity: minCount,
+            maxCapacity: maxCount,
+            resourceId: pulumi.interpolate `service/${clusterName}/${serviceName}`,
+            serviceNamespace: 'ecs',
+            scalableDimension: 'ecs:service:DesiredCount',
+            tags: constants_1.commonTags,
+        }, { parent: this });
+        const memoryAutoscalingPolicy = new aws.appautoscaling.Policy(`${this.name}-memory-autoscale-policy`, {
+            policyType: 'TargetTrackingScaling',
+            resourceId: autoscalingTarget.resourceId,
+            scalableDimension: autoscalingTarget.scalableDimension,
+            serviceNamespace: autoscalingTarget.serviceNamespace,
+            targetTrackingScalingPolicyConfiguration: {
+                predefinedMetricSpecification: {
+                    predefinedMetricType: 'ECSServiceAverageMemoryUtilization',
+                },
+                targetValue: 70,
+            },
+        }, { parent: this });
+        const cpuAutoscalingPolicy = new aws.appautoscaling.Policy(`${this.name}-cpu-autoscale-policy`, {
+            policyType: 'TargetTrackingScaling',
+            resourceId: autoscalingTarget.resourceId,
+            scalableDimension: autoscalingTarget.scalableDimension,
+            serviceNamespace: autoscalingTarget.serviceNamespace,
+            targetTrackingScalingPolicyConfiguration: {
+                predefinedMetricSpecification: {
+                    predefinedMetricType: 'ECSServiceAverageCPUUtilization',
+                },
+                targetValue: 70,
+            },
+        }, { parent: this });
+    }
+    createPersistentStorage(vpc) {
+        const efs = new aws.efs.FileSystem(`${this.name}-efs`, {
+            encrypted: true,
+            lifecyclePolicies: [
+                {
+                    transitionToPrimaryStorageClass: 'AFTER_1_ACCESS',
+                },
+                {
+                    transitionToIa: 'AFTER_7_DAYS',
+                },
+            ],
+            performanceMode: 'generalPurpose',
+            throughputMode: 'bursting',
+            tags: Object.assign(Object.assign({}, constants_1.commonTags), { Name: `${this.name}-data` }),
+        }, { parent: this });
+        const securityGroup = new aws.ec2.SecurityGroup(`${this.name}-persistent-storage-security-group`, {
+            vpcId: vpc.vpcId,
+            ingress: [
+                {
+                    fromPort: 2049,
+                    toPort: 2049,
+                    protocol: 'tcp',
+                    cidrBlocks: [vpc.vpc.cidrBlock],
+                },
+            ],
+            tags: constants_1.commonTags,
+        }, { parent: this });
+        this.vpc.privateSubnetIds.apply((subnetIds) => {
+            subnetIds.forEach(subnetId => {
+                const mountTarget = new aws.efs.MountTarget(`${this.name}-mount-target-${subnetId}`, {
+                    fileSystemId: efs.id,
+                    subnetId,
+                    securityGroups: [securityGroup.id],
+                }, { parent: this });
+            });
+        });
+        const accessPoint = new aws.efs.AccessPoint(`${this.name}-efs-ap`, {
+            fileSystemId: efs.id,
+            posixUser: {
+                uid: FIRST_POSIX_NON_ROOT_USER.userId,
+                gid: FIRST_POSIX_NON_ROOT_USER.groupId,
+            },
+            rootDirectory: {
+                path: '/data',
+                creationInfo: {
+                    ownerUid: FIRST_POSIX_NON_ROOT_USER.userId,
+                    ownerGid: FIRST_POSIX_NON_ROOT_USER.groupId,
+                    permissions: FIRST_POSIX_NON_ROOT_USER.permissions,
+                },
+            },
+        });
+        return { fileSystem: efs, accessPoint };
+    }
+}
+exports.EcsService = EcsService;
+function parseSize(size) {
+    const mapCapabilities = ({ cpu, memory }) => ({
+        cpu: String(cpu),
+        memory: String(memory),
+    });
+    if (typeof size === 'string') {
+        return mapCapabilities(constants_1.PredefinedSize[size]);
+    }
+    if (typeof size === 'object') {
+        return mapCapabilities(size);
+    }
+    throw Error('Incorrect EcsService size argument');
+}

package/dist/v2/components/ecs-service/policies.d.ts

@@ -0,0 +1,3 @@
+import * as aws from '@pulumi/aws';
+export declare const assumeRolePolicy: aws.iam.PolicyDocument;
+//# sourceMappingURL=policies.d.ts.map

package/dist/v2/components/ecs-service/policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../../../../src/v2/components/ecs-service/policies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AAEnC,eAAO,MAAM,gBAAgB,EAAE,GAAG,CAAC,GAAG,CAAC,cAYtC,CAAC"}

package/dist/v2/components/ecs-service/policies.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assumeRolePolicy = void 0;
+exports.assumeRolePolicy = {
+    Version: '2012-10-17',
+    Statement: [
+        {
+            Action: 'sts:AssumeRole',
+            Principal: {
+                Service: 'ecs-tasks.amazonaws.com',
+            },
+            Effect: 'Allow',
+            Sid: '',
+        },
+    ],
+};

package/dist/v2/components/grafana/dashboards/index.d.ts

@@ -0,0 +1,3 @@
+export { default as WebServerSloDashboardBuilder } from "./web-server-slo";
+export * as panel from './panels';
+//# sourceMappingURL=index.d.ts.map

package/dist/v2/components/grafana/dashboards/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/v2/components/grafana/dashboards/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,KAAK,KAAK,MAAM,UAAU,CAAC"}

package/dist/v2/components/grafana/dashboards/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.panel = exports.WebServerSloDashboardBuilder = void 0;
+var web_server_slo_1 = require("./web-server-slo");
+Object.defineProperty(exports, "WebServerSloDashboardBuilder", { enumerable: true, get: function () { return web_server_slo_1.default; } });
+exports.panel = require("./panels");

package/dist/v2/components/grafana/dashboards/panels.d.ts

@@ -0,0 +1,6 @@
+import { Grafana } from './types';
+export declare function createStatPercentagePanel(title: string, position: Grafana.Panel.Position, dataSource: string, metric: Grafana.Metric): Grafana.Panel;
+export declare function createTimeSeriesPercentagePanel(title: string, position: Grafana.Panel.Position, dataSource: string, metric: Grafana.Metric): Grafana.Panel;
+export declare function createTimeSeriesPanel(title: string, position: Grafana.Panel.Position, dataSource: string, metric: Grafana.Metric, unit?: string, min?: number, max?: number): Grafana.Panel;
+export declare function createBurnRatePanel(title: string, position: Grafana.Panel.Position, dataSource: string, metric: Grafana.Metric): Grafana.Panel;
+//# sourceMappingURL=panels.d.ts.map

package/dist/v2/components/grafana/dashboards/panels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"panels.d.ts","sourceRoot":"","sources":["../../../../../src/v2/components/grafana/dashboards/panels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQlC,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAChC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,CAAC,MAAM,GACrB,OAAO,CAAC,KAAK,CAsBf;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAChC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,CAAC,MAAM,GACrB,OAAO,CAAC,KAAK,CAUf;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAChC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,CAAC,MAAM,EACtB,IAAI,CAAC,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,KAAK,CAwBf;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAChC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,CAAC,MAAM,GACrB,OAAO,CAAC,KAAK,CAkCf"}

package/dist/v2/components/grafana/dashboards/panels.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createStatPercentagePanel = createStatPercentagePanel;
+exports.createTimeSeriesPercentagePanel = createTimeSeriesPercentagePanel;
+exports.createTimeSeriesPanel = createTimeSeriesPanel;
+exports.createBurnRatePanel = createBurnRatePanel;
+const percentageFieldConfig = {
+    unit: 'percent',
+    min: 0,
+    max: 100
+};
+function createStatPercentagePanel(title, position, dataSource, metric) {
+    return {
+        title,
+        gridPos: position,
+        type: 'stat',
+        datasource: dataSource,
+        targets: [{
+                expr: metric.query,
+                legendFormat: metric.label
+            }],
+        fieldConfig: {
+            defaults: Object.assign(Object.assign({}, percentageFieldConfig), (metric.thresholds ? {
+                thresholds: {
+                    mode: 'absolute',
+                    steps: metric.thresholds
+                }
+            } : {}))
+        }
+    };
+}
+function createTimeSeriesPercentagePanel(title, position, dataSource, metric) {
+    return createTimeSeriesPanel(title, position, dataSource, metric, percentageFieldConfig.unit, percentageFieldConfig.min, percentageFieldConfig.max);
+}
+function createTimeSeriesPanel(title, position, dataSource, metric, unit, min, max) {
+    return {
+        title,
+        type: 'timeseries',
+        datasource: dataSource,
+        gridPos: position,
+        targets: [{
+                expr: metric.query,
+                legendFormat: metric.label
+            }],
+        fieldConfig: {
+            defaults: Object.assign({ unit,
+                min,
+                max }, (metric.thresholds ? {
+                thresholds: {
+                    mode: 'absolute',
+                    steps: metric.thresholds
+                }
+            } : {}))
+        }
+    };
+}
+function createBurnRatePanel(title, position, dataSource, metric) {
+    return {
+        type: 'stat',
+        title,
+        gridPos: position,
+        datasource: dataSource,
+        targets: [{
+                expr: metric.query,
+                legendFormat: metric.label
+            }],
+        options: {
+            reduceOptions: {
+                calcs: ['last'],
+                fields: '',
+                values: false
+            },
+            colorMode: 'value',
+            graphMode: 'none',
+            textMode: 'value'
+        },
+        fieldConfig: {
+            defaults: {
+                unit: 'none',
+                thresholds: {
+                    mode: 'absolute',
+                    steps: [
+                        { color: 'green', value: null },
+                        { color: 'orange', value: 1 },
+                        { color: 'red', value: 2 }
+                    ]
+                }
+            }
+        },
+    };
+}