alchemy 0.0.8 → 0.1.2

package/src/components/aws/policy.ts

@@ -0,0 +1,245 @@
+import {
+  AttachRolePolicyCommand,
+  CreatePolicyCommand,
+  CreatePolicyVersionCommand,
+  DeletePolicyCommand,
+  DeletePolicyVersionCommand,
+  DetachRolePolicyCommand,
+  GetPolicyCommand,
+  GetPolicyVersionCommand,
+  IAMClient,
+  ListPolicyVersionsCommand,
+  NoSuchEntityException,
+} from "@aws-sdk/client-iam";
+import { ignore } from "../../error";
+import { Resource } from "../../resource";
+
+// Type-safe policy document types
+export type Effect = "Allow" | "Deny";
+
+export interface PolicyStatement {
+  Sid?: string;
+  Effect: Effect;
+  Action: string | string[];
+  Resource?: string | string[];
+  Condition?: Record<string, Record<string, string | string[]>>;
+  Principal?: Record<string, string | string[]>;
+  NotPrincipal?: Record<string, string | string[]>;
+  NotAction?: string | string[];
+  NotResource?: string | string[];
+}
+
+export interface PolicyDocument {
+  Version: "2012-10-17";
+  Statement: PolicyStatement[];
+}
+
+// Policy resource
+export interface PolicyProps {
+  policyName: string;
+  document: PolicyDocument;
+  description?: string;
+  path?: string;
+  tags?: Record<string, string>;
+}
+
+export interface PolicyOutput extends PolicyProps {
+  id: string; // Same as policyName
+  arn: string;
+  defaultVersionId: string;
+  attachmentCount: number;
+  createDate: Date;
+  updateDate: Date;
+  isAttachable: boolean;
+}
+
+export class Policy extends Resource(
+  "iam::Policy",
+  async (ctx, props: PolicyProps): Promise<PolicyOutput> => {
+    const client = new IAMClient({});
+    const policyArn = `arn:aws:iam::${process.env.AWS_ACCOUNT_ID}:policy${props.path || "/"}${props.policyName}`;
+
+    if (ctx.event === "delete") {
+      try {
+        // List and delete all non-default versions first
+        const versions = await client.send(
+          new ListPolicyVersionsCommand({
+            PolicyArn: policyArn,
+          }),
+        );
+
+        for (const version of versions.Versions || []) {
+          if (!version.IsDefaultVersion) {
+            await client.send(
+              new DeletePolicyVersionCommand({
+                PolicyArn: policyArn,
+                VersionId: version.VersionId,
+              }),
+            );
+          }
+        }
+
+        // Delete the policy
+        await client.send(
+          new DeletePolicyCommand({
+            PolicyArn: policyArn,
+          }),
+        );
+      } catch (error: any) {
+        if (error.name !== NoSuchEntityException.name) {
+          throw error;
+        }
+      }
+      return {
+        ...props,
+        id: props.policyName,
+        arn: policyArn,
+        defaultVersionId: "v1",
+        attachmentCount: 0,
+        createDate: new Date(),
+        updateDate: new Date(),
+        isAttachable: true,
+      };
+    } else {
+      try {
+        // Check if policy exists
+        const existingPolicy = await client.send(
+          new GetPolicyCommand({
+            PolicyArn: policyArn,
+          }),
+        );
+
+        // Get current policy version
+        const currentVersion = await client.send(
+          new GetPolicyVersionCommand({
+            PolicyArn: policyArn,
+            VersionId: existingPolicy.Policy!.DefaultVersionId!,
+          }),
+        );
+
+        const currentDocument = JSON.parse(
+          decodeURIComponent(currentVersion.PolicyVersion!.Document!),
+        );
+
+        // If policy document changed, create new version
+        if (
+          JSON.stringify(currentDocument) !== JSON.stringify(props.document)
+        ) {
+          // List versions to check if we need to delete old ones
+          const versions = await client.send(
+            new ListPolicyVersionsCommand({
+              PolicyArn: policyArn,
+            }),
+          );
+
+          // Delete oldest version if we have 5 versions (maximum allowed)
+          if (versions.Versions?.length === 5) {
+            const oldestVersion = versions.Versions.sort(
+              (a, b) => a.CreateDate!.getTime() - b.CreateDate!.getTime(),
+            )[0];
+
+            if (!oldestVersion.IsDefaultVersion) {
+              await client.send(
+                new DeletePolicyVersionCommand({
+                  PolicyArn: policyArn,
+                  VersionId: oldestVersion.VersionId!,
+                }),
+              );
+            }
+          }
+
+          // Create new version
+          await client.send(
+            new CreatePolicyVersionCommand({
+              PolicyArn: policyArn,
+              PolicyDocument: JSON.stringify(props.document),
+              SetAsDefault: true,
+            }),
+          );
+        }
+
+        const policy = await client.send(
+          new GetPolicyCommand({
+            PolicyArn: policyArn,
+          }),
+        );
+
+        return {
+          ...props,
+          id: props.policyName,
+          arn: policy.Policy!.Arn!,
+          defaultVersionId: policy.Policy!.DefaultVersionId!,
+          attachmentCount: policy.Policy!.AttachmentCount!,
+          createDate: policy.Policy!.CreateDate!,
+          updateDate: policy.Policy!.UpdateDate!,
+          isAttachable: policy.Policy!.IsAttachable!,
+        };
+      } catch (error: any) {
+        if (error.name === "NoSuchEntity") {
+          // Create new policy
+          const newPolicy = await client.send(
+            new CreatePolicyCommand({
+              PolicyName: props.policyName,
+              PolicyDocument: JSON.stringify(props.document),
+              Description: props.description,
+              Path: props.path,
+              Tags: props.tags
+                ? Object.entries(props.tags).map(([Key, Value]) => ({
+                    Key,
+                    Value,
+                  }))
+                : undefined,
+            }),
+          );
+
+          return {
+            ...props,
+            id: props.policyName,
+            arn: newPolicy.Policy!.Arn!,
+            defaultVersionId: newPolicy.Policy!.DefaultVersionId!,
+            attachmentCount: newPolicy.Policy!.AttachmentCount!,
+            createDate: newPolicy.Policy!.CreateDate!,
+            updateDate: newPolicy.Policy!.UpdateDate!,
+            isAttachable: newPolicy.Policy!.IsAttachable!,
+          };
+        }
+        throw error;
+      }
+    }
+  },
+) {}
+
+// PolicyAttachment resource
+export interface PolicyAttachmentProps {
+  policyArn: string;
+  roleName: string;
+}
+
+export interface PolicyAttachmentOutput extends PolicyAttachmentProps {}
+
+export class PolicyAttachment extends Resource(
+  "iam::PolicyAttachment",
+  async (ctx, props: PolicyAttachmentProps) => {
+    const client = new IAMClient({});
+
+    if (ctx.event === "delete") {
+      await ignore(NoSuchEntityException.name, () =>
+        client.send(
+          new DetachRolePolicyCommand({
+            PolicyArn: props.policyArn,
+            RoleName: props.roleName,
+          }),
+        ),
+      );
+    } else {
+      await client.send(
+        new AttachRolePolicyCommand({
+          PolicyArn: props.policyArn,
+          RoleName: props.roleName,
+        }),
+      );
+    }
+
+    return props;
+  },
+) {}

package/src/components/aws/queue.ts

@@ -0,0 +1,222 @@
+import {
+  CreateQueueCommand,
+  DeleteQueueCommand,
+  GetQueueAttributesCommand,
+  GetQueueUrlCommand,
+  SQSClient,
+} from "@aws-sdk/client-sqs";
+import { Resource } from "../../resource";
+
+export interface QueueProps {
+  queueName: string;
+  fifo?: boolean;
+  visibilityTimeout?: number;
+  messageRetentionPeriod?: number;
+  maximumMessageSize?: number;
+  delaySeconds?: number;
+  receiveMessageWaitTimeSeconds?: number;
+  contentBasedDeduplication?: boolean;
+  deduplicationScope?: "messageGroup" | "queue";
+  fifoThroughputLimit?: "perQueue" | "perMessageGroupId";
+  tags?: Record<string, string>;
+}
+
+export interface QueueOutput extends QueueProps {
+  id: string; // Same as queueName
+  arn: string;
+  url: string;
+}
+
+export class Queue extends Resource(
+  "sqs::Queue",
+  async (ctx, props: QueueProps) => {
+    const client = new SQSClient({});
+    const queueName = props.fifo ? `${props.queueName}.fifo` : props.queueName;
+
+    if (ctx.event === "delete") {
+      try {
+        // Get queue URL first
+        const urlResponse = await client.send(
+          new GetQueueUrlCommand({
+            QueueName: queueName,
+          }),
+        );
+
+        // Delete the queue
+        await client.send(
+          new DeleteQueueCommand({
+            QueueUrl: urlResponse.QueueUrl,
+          }),
+        );
+
+        // Wait for queue to be deleted
+        let queueDeleted = false;
+        while (!queueDeleted) {
+          try {
+            await client.send(
+              new GetQueueUrlCommand({
+                QueueName: queueName,
+              }),
+            );
+            // If we get here, queue still exists
+            await new Promise((resolve) => setTimeout(resolve, 1000));
+          } catch (error: any) {
+            if (error.name === "QueueDoesNotExist") {
+              queueDeleted = true;
+            } else {
+              throw error;
+            }
+          }
+        }
+      } catch (error: any) {
+        if (error.name !== "QueueDoesNotExist") {
+          throw error;
+        }
+      }
+
+      return {
+        ...props,
+        id: props.queueName,
+        arn: `arn:aws:sqs:${client.config.region}:${process.env.AWS_ACCOUNT_ID}:${queueName}`,
+        url: "",
+      };
+    } else {
+      // Create queue with attributes
+      const attributes: Record<string, string> = {};
+
+      if (props.visibilityTimeout !== undefined) {
+        attributes["VisibilityTimeout"] = props.visibilityTimeout.toString();
+      }
+      if (props.messageRetentionPeriod !== undefined) {
+        attributes["MessageRetentionPeriod"] =
+          props.messageRetentionPeriod.toString();
+      }
+      if (props.maximumMessageSize !== undefined) {
+        attributes["MaximumMessageSize"] = props.maximumMessageSize.toString();
+      }
+      if (props.delaySeconds !== undefined) {
+        attributes["DelaySeconds"] = props.delaySeconds.toString();
+      }
+      if (props.receiveMessageWaitTimeSeconds !== undefined) {
+        attributes["ReceiveMessageWaitTimeSeconds"] =
+          props.receiveMessageWaitTimeSeconds.toString();
+      }
+
+      // FIFO specific attributes
+      if (props.fifo) {
+        attributes["FifoQueue"] = "true";
+        if (props.contentBasedDeduplication) {
+          attributes["ContentBasedDeduplication"] = "true";
+        }
+        if (props.deduplicationScope) {
+          attributes["DeduplicationScope"] = props.deduplicationScope;
+        }
+        if (props.fifoThroughputLimit) {
+          attributes["FifoThroughputLimit"] = props.fifoThroughputLimit;
+        }
+      }
+
+      // Convert tags to AWS format
+      const tags = props.tags
+        ? Object.entries(props.tags).reduce(
+            (acc, [key, value]) => ({ ...acc, [key]: value }),
+            {},
+          )
+        : undefined;
+
+      try {
+        // Create the queue
+        const createResponse = await client.send(
+          new CreateQueueCommand({
+            QueueName: queueName,
+            Attributes: attributes,
+            tags,
+          }),
+        );
+
+        // Get queue attributes
+        const attributesResponse = await client.send(
+          new GetQueueAttributesCommand({
+            QueueUrl: createResponse.QueueUrl,
+            AttributeNames: ["QueueArn"],
+          }),
+        );
+
+        return {
+          ...props,
+          id: props.queueName,
+          arn: attributesResponse.Attributes!.QueueArn!,
+          url: createResponse.QueueUrl!,
+        };
+      } catch (error: any) {
+        if (error.name === "QueueAlreadyExists") {
+          // Get existing queue URL
+          const urlResponse = await client.send(
+            new GetQueueUrlCommand({
+              QueueName: queueName,
+            }),
+          );
+
+          // Get queue attributes
+          const attributesResponse = await client.send(
+            new GetQueueAttributesCommand({
+              QueueUrl: urlResponse.QueueUrl,
+              AttributeNames: ["QueueArn"],
+            }),
+          );
+
+          return {
+            ...props,
+            id: props.queueName,
+            arn: attributesResponse.Attributes!.QueueArn!,
+            url: urlResponse.QueueUrl!,
+          };
+        } else if (error.name === "QueueDeletedRecently") {
+          // Queue was recently deleted, wait and retry
+          const maxRetries = 3;
+          let retryCount = 0;
+
+          while (retryCount < maxRetries) {
+            try {
+              // Wait for 60 seconds before retrying
+              await new Promise((resolve) => setTimeout(resolve, 61000));
+
+              // Retry creating the queue
+              const createResponse = await client.send(
+                new CreateQueueCommand({
+                  QueueName: queueName,
+                  Attributes: attributes,
+                  tags,
+                }),
+              );
+
+              // Get queue attributes
+              const attributesResponse = await client.send(
+                new GetQueueAttributesCommand({
+                  QueueUrl: createResponse.QueueUrl,
+                  AttributeNames: ["QueueArn"],
+                }),
+              );
+
+              return {
+                ...props,
+                id: props.queueName,
+                arn: attributesResponse.Attributes!.QueueArn!,
+                url: createResponse.QueueUrl!,
+              };
+            } catch (retryError: any) {
+              if (
+                retryError.name !== "QueueDeletedRecently" ||
+                retryCount === maxRetries - 1
+              ) {
+                throw retryError;
+              }
+              retryCount++;
+            }
+          }
+        }
+        throw error;
+      }
+    }
+  },
+) {}

package/src/components/aws/role.ts

@@ -0,0 +1,245 @@
+import {
+  CreateRoleCommand,
+  DeleteRoleCommand,
+  DeleteRolePolicyCommand,
+  EntityAlreadyExistsException,
+  GetRoleCommand,
+  IAMClient,
+  NoSuchEntityException,
+  PutRolePolicyCommand,
+  type Tag,
+  TagRoleCommand,
+  UpdateAssumeRolePolicyCommand,
+  UpdateRoleCommand,
+} from "@aws-sdk/client-iam";
+import { ignore } from "../../error";
+import { type Context, Resource } from "../../resource";
+import type { PolicyDocument } from "./policy";
+
+export interface RoleProps {
+  roleName: string;
+  assumeRolePolicy: PolicyDocument;
+  description?: string;
+  path?: string;
+  maxSessionDuration?: number;
+  permissionsBoundary?: string;
+  policies?: Array<{
+    policyName: string;
+    policyDocument: PolicyDocument;
+  }>;
+  managedPolicyArns?: string[];
+  tags?: Record<string, string>;
+}
+
+export interface RoleOutput extends RoleProps {
+  id: string; // Same as roleName
+  arn: string;
+  uniqueId: string; // Unique identifier for the role
+  roleId: string; // The stable and unique string identifying the role
+  createDate: Date;
+}
+
+export class Role extends Resource(
+  "iam::Role",
+  async (ctx: Context<RoleOutput>, props: RoleProps): Promise<RoleOutput> => {
+    const client = new IAMClient({});
+
+    if (ctx.event === "delete") {
+      // Delete any inline policies first
+      if (props.policies) {
+        for (const policy of props.policies) {
+          await ignore(NoSuchEntityException.name, () =>
+            client.send(
+              new DeleteRolePolicyCommand({
+                RoleName: props.roleName,
+                PolicyName: policy.policyName,
+              }),
+            ),
+          );
+        }
+      }
+
+      await ignore(NoSuchEntityException.name, () =>
+        client.send(
+          new DeleteRoleCommand({
+            RoleName: props.roleName,
+          }),
+        ),
+      );
+      return {
+        ...props,
+        id: props.roleName,
+        arn: `arn:aws:iam::${process.env.AWS_ACCOUNT_ID}:role/${props.roleName}`,
+        uniqueId: "",
+        roleId: "",
+        createDate: new Date(),
+      };
+    }
+
+    const assumeRolePolicyDocument = JSON.stringify(props.assumeRolePolicy);
+    let role;
+
+    try {
+      if (ctx.event === "create") {
+        // Try to create the role
+        await client.send(
+          new CreateRoleCommand({
+            RoleName: props.roleName,
+            AssumeRolePolicyDocument: assumeRolePolicyDocument,
+            Description: props.description,
+            Path: props.path,
+            MaxSessionDuration: props.maxSessionDuration,
+            PermissionsBoundary: props.permissionsBoundary,
+            Tags: [
+              ...Object.entries(props.tags || {}).map(([Key, Value]) => ({
+                Key,
+                Value,
+              })),
+              {
+                Key: "alchemy_stage",
+                Value: ctx.stage,
+              },
+              {
+                Key: "alchemy_resource",
+                Value: ctx.resourceID,
+              },
+            ],
+          }),
+        );
+      }
+    } catch (error: any) {
+      if (
+        error instanceof EntityAlreadyExistsException &&
+        ctx.event === "create"
+      ) {
+        // Check if we were the ones who created it
+        const existingRole = await client.send(
+          new GetRoleCommand({
+            RoleName: props.roleName,
+          }),
+        );
+        const roleTags =
+          existingRole.Role?.Tags?.reduce(
+            (acc, tag) => {
+              acc[tag.Key!] = tag.Value!;
+              return acc;
+            },
+            {} as Record<string, string>,
+          ) || {};
+
+        if (
+          roleTags.alchemy_stage !== ctx.stage ||
+          roleTags.alchemy_resource !== ctx.resourceID
+        ) {
+          throw error;
+        }
+      } else if (error.name !== NoSuchEntityException.name) {
+        throw error;
+      }
+    }
+
+    // Get or update the role
+    role = await client.send(
+      new GetRoleCommand({
+        RoleName: props.roleName,
+      }),
+    );
+
+    // Update assume role policy if it changed
+    if (role.Role?.AssumeRolePolicyDocument !== assumeRolePolicyDocument) {
+      await client.send(
+        new UpdateAssumeRolePolicyCommand({
+          RoleName: props.roleName,
+          PolicyDocument: assumeRolePolicyDocument,
+        }),
+      );
+    }
+
+    // Update role description and max session duration if they changed
+    if (
+      role.Role?.Description !== props.description ||
+      role.Role?.MaxSessionDuration !== props.maxSessionDuration
+    ) {
+      await client.send(
+        new UpdateRoleCommand({
+          RoleName: props.roleName,
+          Description: props.description,
+          MaxSessionDuration: props.maxSessionDuration,
+        }),
+      );
+    }
+
+    // Update tags
+    const newTags = {
+      ...props.tags,
+      alchemy_stage: ctx.stage,
+      alchemy_resource: ctx.resourceID,
+    };
+    const tags: Tag[] = Object.entries(newTags).map(([Key, Value]) => ({
+      Key,
+      Value,
+    }));
+    await client.send(
+      new TagRoleCommand({
+        RoleName: props.roleName,
+        Tags: tags,
+      }),
+    );
+
+    // Handle policy changes
+    const previousPolicies =
+      ctx.event === "update" ? ctx.output.policies || [] : [];
+    const currentPolicies = props.policies || [];
+
+    // Delete policies that were removed
+    for (const oldPolicy of previousPolicies) {
+      if (
+        !currentPolicies.some(
+          (p: { policyName: string }) => p.policyName === oldPolicy.policyName,
+        )
+      ) {
+        await ignore(NoSuchEntityException.name, () =>
+          client.send(
+            new DeleteRolePolicyCommand({
+              RoleName: props.roleName,
+              PolicyName: oldPolicy.policyName,
+            }),
+          ),
+        );
+      }
+    }
+
+    // Update or create policies
+    for (const policy of currentPolicies) {
+      const oldPolicy = previousPolicies.find(
+        (p) => p.policyName === policy.policyName,
+      );
+      if (
+        !oldPolicy ||
+        JSON.stringify(oldPolicy.policyDocument) !==
+          JSON.stringify(policy.policyDocument)
+      ) {
+        await client.send(
+          new PutRolePolicyCommand({
+            RoleName: props.roleName,
+            PolicyName: policy.policyName,
+            PolicyDocument: JSON.stringify(policy.policyDocument),
+          }),
+        );
+      }
+    }
+
+    if (!role?.Role) {
+      throw new Error(`Failed to create or update role ${props.roleName}`);
+    }
+
+    return {
+      ...props,
+      id: props.roleName,
+      arn: role.Role.Arn!,
+      uniqueId: role.Role.RoleId!,
+      roleId: role.Role.RoleId!,
+      createDate: role.Role.CreateDate!,
+    };
+  },
+) {}