dcl-ops-lib 5.26.4 → 6.0.1

package/README.md

@@ -2,5 +2,6 @@
 
 Used to compile pulumi projects
 
+
 # License
-Published under Apache-2.0
+Published under Apache-2.0

package/StaticWebsite.d.ts

@@ -1,5 +1,5 @@
 import { Input } from "@pulumi/pulumi";
-export declare type StaticWebsite = {
+export type StaticWebsite = {
     domain: string;
     certificateArn?: string;
     additionalDomains?: string[];

package/acceptAlb.d.ts

@@ -1,10 +1,4 @@
-import * as awsx from "@pulumi/awsx";
-/** @deprecated use makeSecurityGroupAccessibleFromSharedAlb instead */
-export declare const acceptAlbSecurityGroup: () => Promise<awsx.ec2.SecurityGroup>;
-/** @deprecated use makeSecurityGroupAccessibleFromSharedAlb instead */
-export declare function acceptAlbSecurityGroupId(): Promise<import("@pulumi/pulumi").Output<string>>;
-/** @deprecated use makeSecurityGroupAccessibleFromSharedAlbV2 */
-export declare function makeSecurityGroupAccessibleFromSharedAlb(securityGroup: awsx.ec2.SecurityGroup): void;
-/** @deprecated Makes a given securityGropup accesible by the shared supra ALB */
-export declare function makeSecurityGroupAccessibleFromSharedAlbV2(securityGroup: awsx.ec2.SecurityGroup, ruleName?: string): void;
-export default acceptAlbSecurityGroup;
+import * as aws from "@pulumi/aws";
+/** Makes a given securityGropup accesible by the shared supra ALB */
+export declare function makeSecurityGroupAccessibleFromSharedAlb(securityGroup: aws.ec2.SecurityGroup, ruleName?: string): void;
+export default makeSecurityGroupAccessibleFromSharedAlb;

package/acceptAlb.js

@@ -1,46 +1,12 @@
 "use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.makeSecurityGroupAccessibleFromSharedAlbV2 = exports.makeSecurityGroupAccessibleFromSharedAlb = exports.acceptAlbSecurityGroupId = exports.acceptAlbSecurityGroup = void 0;
-const awsx = require("@pulumi/awsx");
+exports.makeSecurityGroupAccessibleFromSharedAlb = void 0;
 const aws = require("@pulumi/aws");
 const utils_1 = require("./utils");
 const values_1 = require("./values");
-const withCache_1 = require("./withCache");
-/** @deprecated use makeSecurityGroupAccessibleFromSharedAlb instead */
-exports.acceptAlbSecurityGroup = (0, withCache_1.default)(() => __awaiter(void 0, void 0, void 0, function* () {
-    const config = yield (0, values_1.getEnvConfiguration)();
-    return awsx.ec2.SecurityGroup.fromExistingId(`accept-alb-sg-reference`, config.acceptAlb);
-}));
-/** @deprecated use makeSecurityGroupAccessibleFromSharedAlb instead */
-function acceptAlbSecurityGroupId() {
-    return __awaiter(this, void 0, void 0, function* () {
-        return (yield (0, exports.acceptAlbSecurityGroup)()).id;
-    });
-}
-exports.acceptAlbSecurityGroupId = acceptAlbSecurityGroupId;
-/** @deprecated use makeSecurityGroupAccessibleFromSharedAlbV2 */
-function makeSecurityGroupAccessibleFromSharedAlb(securityGroup) {
-    new awsx.ec2.IngressSecurityGroupRule("accept-alb-ingress-rule", securityGroup, {
-        sourceSecurityGroupId: (0, values_1.getEnvConfiguration)().then(($) => $.albSecurityGroupId),
-        description: `Allow access from the supra ALB`,
-        fromPort: 0,
-        toPort: 0,
-        protocol: "-1",
-    });
-}
-exports.makeSecurityGroupAccessibleFromSharedAlb = makeSecurityGroupAccessibleFromSharedAlb;
-/** @deprecated Makes a given securityGropup accesible by the shared supra ALB */
-function makeSecurityGroupAccessibleFromSharedAlbV2(securityGroup, ruleName = "") {
-    new aws.ec2.SecurityGroupRule((0, utils_1.withRuleName)("accept-alb-ingress-rule-v2", ruleName), {
+/** Makes a given securityGropup accesible by the shared supra ALB */
+function makeSecurityGroupAccessibleFromSharedAlb(securityGroup, ruleName = "") {
+    new aws.ec2.SecurityGroupRule((0, utils_1.withRuleName)("accept-alb-ingress-rule", ruleName), {
         securityGroupId: securityGroup.id,
         sourceSecurityGroupId: (0, values_1.getEnvConfiguration)().then(($) => $.albSecurityGroupId),
         description: `Allow access from the supra ALB`,
@@ -50,6 +16,6 @@ function makeSecurityGroupAccessibleFromSharedAlbV2(securityGroup, ruleName = ""
         type: "egress",
     }, { deleteBeforeReplace: true });
 }
-exports.makeSecurityGroupAccessibleFromSharedAlbV2 = makeSecurityGroupAccessibleFromSharedAlbV2;
-exports.default = exports.acceptAlbSecurityGroup;
+exports.makeSecurityGroupAccessibleFromSharedAlb = makeSecurityGroupAccessibleFromSharedAlb;
+exports.default = makeSecurityGroupAccessibleFromSharedAlb;
 //# sourceMappingURL=acceptAlb.js.map

package/acceptBastion.d.ts

@@ -1,9 +1,3 @@
-import * as awsx from "@pulumi/awsx";
-/** @deprecated please use makeSecurityGroupAccessTheInternet */
-export declare const acceptBastionSecurityGroup: () => Promise<awsx.ec2.SecurityGroup>;
-/** @deprecated please use makeSecurityGroupAccessTheInternet */
-export declare function acceptBastionSecurityGroupId(): Promise<import("@pulumi/pulumi").Output<string>>;
-/** @deprecated use makeSecurityGroupAccessibleFromBastionV2 */
-export declare function makeSecurityGroupAccessibleFromBastion(securityGroup: awsx.ec2.SecurityGroup): void;
-export declare function makeSecurityGroupAccessibleFromBastionV2(securityGroup: awsx.ec2.SecurityGroup, ruleName?: string): void;
-export default acceptBastionSecurityGroup;
+import * as aws from "@pulumi/aws";
+export declare function makeSecurityGroupAccessibleFromBastion(securityGroup: aws.ec2.SecurityGroup, ruleName?: string): void;
+export default makeSecurityGroupAccessibleFromBastion;

package/acceptBastion.js

@@ -9,41 +9,16 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.makeSecurityGroupAccessibleFromBastionV2 = exports.makeSecurityGroupAccessibleFromBastion = exports.acceptBastionSecurityGroupId = exports.acceptBastionSecurityGroup = void 0;
-const awsx = require("@pulumi/awsx");
+exports.makeSecurityGroupAccessibleFromBastion = void 0;
 const aws = require("@pulumi/aws");
 const values_1 = require("./values");
 const withCache_1 = require("./withCache");
 const utils_1 = require("./utils");
-/** @deprecated please use makeSecurityGroupAccessTheInternet */
-exports.acceptBastionSecurityGroup = (0, withCache_1.default)(() => __awaiter(void 0, void 0, void 0, function* () {
-    const config = yield (0, values_1.getEnvConfiguration)();
-    return awsx.ec2.SecurityGroup.fromExistingId(`accept-bastion-sg-reference`, config.acceptBastion);
-}));
-/** @deprecated please use makeSecurityGroupAccessTheInternet */
-function acceptBastionSecurityGroupId() {
-    return __awaiter(this, void 0, void 0, function* () {
-        return (yield (0, exports.acceptBastionSecurityGroup)()).id;
-    });
-}
-exports.acceptBastionSecurityGroupId = acceptBastionSecurityGroupId;
 const bastionSecurityGroupId = (0, withCache_1.default)(() => __awaiter(void 0, void 0, void 0, function* () {
     const config = yield (0, values_1.getEnvConfiguration)();
     return config.bastionSecurityGroupId;
 }));
-/** @deprecated use makeSecurityGroupAccessibleFromBastionV2 */
-function makeSecurityGroupAccessibleFromBastion(securityGroup) {
-    new aws.ec2.SecurityGroupRule("accesible-from-bastion", {
-        securityGroupId: securityGroup.id,
-        sourceSecurityGroupId: bastionSecurityGroupId(),
-        fromPort: -1,
-        toPort: -1,
-        type: "ingress",
-        protocol: "-1",
-    }, { deleteBeforeReplace: true });
-}
-exports.makeSecurityGroupAccessibleFromBastion = makeSecurityGroupAccessibleFromBastion;
-function makeSecurityGroupAccessibleFromBastionV2(securityGroup, ruleName = "") {
+function makeSecurityGroupAccessibleFromBastion(securityGroup, ruleName = "") {
     new aws.ec2.SecurityGroupRule((0, utils_1.withRuleName)("accesible-from-bastion-v2", ruleName), {
         securityGroupId: securityGroup.id,
         sourceSecurityGroupId: bastionSecurityGroupId(),
@@ -53,6 +28,6 @@ function makeSecurityGroupAccessibleFromBastionV2(securityGroup, ruleName = "")
         protocol: "-1",
     }, { deleteBeforeReplace: true });
 }
-exports.makeSecurityGroupAccessibleFromBastionV2 = makeSecurityGroupAccessibleFromBastionV2;
-exports.default = exports.acceptBastionSecurityGroup;
+exports.makeSecurityGroupAccessibleFromBastion = makeSecurityGroupAccessibleFromBastion;
+exports.default = makeSecurityGroupAccessibleFromBastion;
 //# sourceMappingURL=acceptBastion.js.map

package/acceptDb.d.ts

@@ -1,4 +1,4 @@
-import * as awsx from "@pulumi/awsx";
-export declare const acceptDbSecurityGroup: () => Promise<awsx.ec2.SecurityGroup>;
-export declare function acceptDbSecurityGroupId(): Promise<import("@pulumi/pulumi").Output<string>>;
+import * as aws from "@pulumi/aws";
+export declare const acceptDbSecurityGroup: () => Promise<aws.ec2.GetSecurityGroupResult>;
+export declare function acceptDbSecurityGroupId(): Promise<string>;
 export default acceptDbSecurityGroup;

package/acceptDb.js

@@ -10,12 +10,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.acceptDbSecurityGroupId = exports.acceptDbSecurityGroup = void 0;
-const awsx = require("@pulumi/awsx");
+const aws = require("@pulumi/aws");
 const values_1 = require("./values");
 const withCache_1 = require("./withCache");
 exports.acceptDbSecurityGroup = (0, withCache_1.default)(() => __awaiter(void 0, void 0, void 0, function* () {
     const config = yield (0, values_1.getEnvConfiguration)();
-    return awsx.ec2.SecurityGroup.fromExistingId(`accept-db-sg-reference`, config.dbSecurity);
+    return aws.ec2.getSecurityGroup({ name: config.dbSecurity });
 }));
 function acceptDbSecurityGroupId() {
     return __awaiter(this, void 0, void 0, function* () {

package/accessTheInternet.d.ts

@@ -1,16 +1,5 @@
-import * as awsx from "@pulumi/awsx";
-/** @deprecated please use makeSecurityGroupAccessibleByCloudflare */
-export declare const accessCloudflareSecurityGroup: () => Promise<awsx.ec2.SecurityGroup>;
-/** @deprecated please use makeSecurityGroupAccessTheInternet */
-export declare const accessTheInternetSecurityGroup: () => Promise<awsx.ec2.SecurityGroup>;
-/** @deprecated please use makeSecurityGroupAccessTheInternet */
-export declare function accessTheInternetSecurityGroupId(): Promise<import("@pulumi/pulumi").Output<string>>;
-export default accessTheInternetSecurityGroup;
-/** @deprecated please use makeSecurityGroupAccessibleByCloudflare */
-export declare function accessFromCloudflareSecurityGroup(): Promise<import("@pulumi/pulumi").Output<string>>;
-/** @deprecated use makeSecurityGroupAccessTheInternetV2 */
-export declare function makeSecurityGroupAccessTheInternet(securityGroup: awsx.ec2.SecurityGroup): void;
+import * as aws from "@pulumi/aws";
 /** Enables egress traffic to 0.0.0.0/0/all */
-export declare function makeSecurityGroupAccessTheInternetV2(securityGroup: awsx.ec2.SecurityGroup, ruleName?: string): void;
+export declare function makeSecurityGroupAccessTheInternetV2(securityGroup: aws.ec2.SecurityGroup, ruleName?: string): void;
 /** Enables ingress traffic from cloudflare CIDRs */
-export declare function makeSecurityGroupAccessibleByCloudflare(securityGroup: awsx.ec2.SecurityGroup): Promise<void>;
+export declare function makeSecurityGroupAccessibleByCloudflare(securityGroup: aws.ec2.SecurityGroup): Promise<void>;

package/accessTheInternet.js

@@ -9,49 +9,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.makeSecurityGroupAccessibleByCloudflare = exports.makeSecurityGroupAccessTheInternetV2 = exports.makeSecurityGroupAccessTheInternet = exports.accessFromCloudflareSecurityGroup = exports.accessTheInternetSecurityGroupId = exports.accessTheInternetSecurityGroup = exports.accessCloudflareSecurityGroup = void 0;
-const awsx = require("@pulumi/awsx");
+exports.makeSecurityGroupAccessibleByCloudflare = exports.makeSecurityGroupAccessTheInternetV2 = void 0;
 const aws = require("@pulumi/aws");
 const cloudflare = require("@pulumi/cloudflare");
-const supra_1 = require("./supra");
-const values_1 = require("./values");
-const withCache_1 = require("./withCache");
 const utils_1 = require("./utils");
-/** @deprecated please use makeSecurityGroupAccessibleByCloudflare */
-exports.accessCloudflareSecurityGroup = (0, withCache_1.default)(() => __awaiter(void 0, void 0, void 0, function* () {
-    const config = yield (0, values_1.getEnvConfiguration)(); // ?
-    return awsx.ec2.SecurityGroup.fromExistingId(`accept-cloudflare-web-sg-reference`, supra_1.supra.getOutputValue(`cloudflareAcceptWeb`));
-}));
-/** @deprecated please use makeSecurityGroupAccessTheInternet */
-exports.accessTheInternetSecurityGroup = (0, withCache_1.default)(() => __awaiter(void 0, void 0, void 0, function* () {
-    const config = yield (0, values_1.getEnvConfiguration)(); // ?
-    return awsx.ec2.SecurityGroup.fromExistingId(`access-the-internet-sg-reference`, supra_1.supra.getOutputValue(`accessTheInternet`));
-}));
-/** @deprecated please use makeSecurityGroupAccessTheInternet */
-function accessTheInternetSecurityGroupId() {
-    return __awaiter(this, void 0, void 0, function* () {
-        return (yield (0, exports.accessTheInternetSecurityGroup)()).id;
-    });
-}
-exports.accessTheInternetSecurityGroupId = accessTheInternetSecurityGroupId;
-exports.default = exports.accessTheInternetSecurityGroup;
-/** @deprecated please use makeSecurityGroupAccessibleByCloudflare */
-function accessFromCloudflareSecurityGroup() {
-    return __awaiter(this, void 0, void 0, function* () {
-        return (yield (0, exports.accessCloudflareSecurityGroup)()).id;
-    });
-}
-exports.accessFromCloudflareSecurityGroup = accessFromCloudflareSecurityGroup;
-/** @deprecated use makeSecurityGroupAccessTheInternetV2 */
-function makeSecurityGroupAccessTheInternet(securityGroup) {
-    securityGroup.createEgressRule("access-the-internet", {
-        cidrBlocks: ["0.0.0.0/0"],
-        fromPort: -1,
-        toPort: -1,
-        protocol: "-1",
-    });
-}
-exports.makeSecurityGroupAccessTheInternet = makeSecurityGroupAccessTheInternet;
 /** Enables egress traffic to 0.0.0.0/0/all */
 function makeSecurityGroupAccessTheInternetV2(securityGroup, ruleName = "") {
     new aws.ec2.SecurityGroupRule((0, utils_1.withRuleName)("access-the-internet-v2", ruleName), {
@@ -70,20 +31,24 @@ function makeSecurityGroupAccessibleByCloudflare(securityGroup) {
         const ips = yield cloudflare.getIpRanges({});
         for (let block of ips.ipv4CidrBlocks) {
             const hash = (0, utils_1.sha256hash)(block).substring(0, 6);
-            securityGroup.createIngressRule(`accept-cf-80-${hash}`, {
+            new aws.ec2.SecurityGroupRule(`accept-cf-80-${hash}`, {
                 protocol: "tcp",
                 fromPort: 80,
                 toPort: 80,
                 cidrBlocks: [block],
+                type: "ingress",
+                securityGroupId: securityGroup.id,
                 description: `pulumi-supra-${hash}`,
-            });
-            securityGroup.createIngressRule(`accept-cf-443-${hash}`, {
+            }, { deleteBeforeReplace: true });
+            new aws.ec2.SecurityGroupRule(`accept-cf-443-${hash}`, {
                 protocol: "tcp",
                 fromPort: 443,
                 toPort: 443,
                 cidrBlocks: [block],
+                type: "ingress",
+                securityGroupId: securityGroup.id,
                 description: `pulumi-supra-${hash}`,
-            });
+            }, { deleteBeforeReplace: true });
         }
     });
 }

package/alb.d.ts

@@ -1,6 +1,5 @@
 import * as aws from "@pulumi/aws";
-import * as awsx from "@pulumi/awsx";
-export declare type ElbValues = {
+export type ElbValues = {
     dns: string;
     elbArn: string;
     elbUrn: string;
@@ -9,6 +8,6 @@ export declare type ElbValues = {
 };
 export declare const getAlb: () => Promise<{
     dns: string;
-    alb: awsx.elasticloadbalancingv2.ApplicationLoadBalancer;
+    alb: aws.lb.GetLoadBalancerResult;
     listener: aws.lb.GetListenerResult;
 }>;

package/alb.js

@@ -11,8 +11,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAlb = void 0;
 const aws = require("@pulumi/aws");
-const awsx = require("@pulumi/awsx");
-const domain_1 = require("./domain");
 const supra_1 = require("./supra");
 const withCache_1 = require("./withCache");
 const cache = {
@@ -25,9 +23,9 @@ const cache = {
 };
 exports.getAlb = (0, withCache_1.default)(() => __awaiter(void 0, void 0, void 0, function* () {
     const dns = yield supra_1.supra.getOutputValue("dns");
-    const loadBalancer = yield supra_1.supra.getOutputValue("albInstance");
+    const loadBalancer = yield supra_1.supra.getOutputDetails("albInstance");
     const elbValues = yield supra_1.supra.getOutputValue("elbValues");
-    const alb = new awsx.lb.ApplicationLoadBalancer(`${domain_1.env}-alb-all`, { loadBalancer });
+    const alb = yield aws.lb.getLoadBalancer({ arn: JSON.parse(loadBalancer.value).arn });
     const listener = yield aws.lb.getListener({ arn: elbValues.listenerArn });
     return { dns, alb, listener };
 }));

package/cloudflare.d.ts

@@ -1,12 +1,12 @@
 import * as pulumi from "@pulumi/pulumi";
 import * as cloudflare from "@pulumi/cloudflare";
-export declare type DeployWorkerConfig = {
+export type DeployWorkerConfig = {
     jsWorkerFileName: string;
     routes: pulumi.Input<string>[];
     env?: Record<string, pulumi.Input<string>>;
     overrides?: cloudflare.WorkerScriptArgs;
 };
-export declare type SetRecordConfig = {
+export type SetRecordConfig = {
     recordName: string;
     type: "CNAME" | "A" | "TXT";
     value: pulumi.Input<string>;
@@ -17,8 +17,9 @@ export declare type SetRecordConfig = {
     proxied: true;
 });
 export declare function getZoneId(): Promise<string>;
+export declare function getAccountId(): string;
 export declare function deployWorker(workerName: string, config: DeployWorkerConfig): Promise<{
-    [x: string]: pulumi.Output<string> | cloudflare.WorkerScript;
-    worker: cloudflare.WorkerScript;
+    [x: string]: pulumi.Output<string> | import("@pulumi/cloudflare/workerScript").WorkerScript;
+    worker: import("@pulumi/cloudflare/workerScript").WorkerScript;
 }>;
-export declare function setRecord(config: SetRecordConfig): Promise<cloudflare.Record>;
+export declare function setRecord(config: SetRecordConfig): Promise<import("@pulumi/cloudflare/record").Record>;

package/cloudflare.js

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setRecord = exports.deployWorker = exports.getZoneId = void 0;
+exports.setRecord = exports.deployWorker = exports.getAccountId = exports.getZoneId = void 0;
 const pulumi = require("@pulumi/pulumi");
 const cloudflare = require("@pulumi/cloudflare");
 const domain_1 = require("./domain");
@@ -23,6 +23,15 @@ function getZoneId() {
     });
 }
 exports.getZoneId = getZoneId;
+function getAccountId() {
+    if (process.env.CLOUDFLARE_ACCOUNT_ID) {
+        return process.env.CLOUDFLARE_ACCOUNT_ID;
+    }
+    else {
+        throw new Error("CLOUDFLARE_ACCOUNT_ID not set");
+    }
+}
+exports.getAccountId = getAccountId;
 function deployWorker(workerName, config) {
     return __awaiter(this, void 0, void 0, function* () {
         // get file contents
@@ -34,7 +43,7 @@ function deployWorker(workerName, config) {
         });
         // create the worker
         const worker = new cloudflare.WorkerScript(`${workerName}-${domain_1.publicTLD}`, Object.assign({ name: `${workerName}-${domain_1.publicTLD}`, content,
-            plainTextBindings }, (config.overrides || {})));
+            plainTextBindings, accountId: getAccountId() }, (config.overrides || {})));
         const ret = { [workerName + "-" + domain_1.publicTLD]: worker.id, worker };
         // create the routes
         let count = 0;

package/createBucketWithUser.d.ts

@@ -1,8 +1,7 @@
-import * as aws from "@pulumi/aws";
 import { BucketArgs } from "@pulumi/aws/s3/bucket";
 import * as pulumi from "@pulumi/pulumi";
 export declare function createBucketWithUser(name: string, bucketArgs?: BucketArgs): {
-    role: aws.iam.Role;
+    role: import("@pulumi/aws/iam/role").Role;
     user: pulumi.Output<string>;
     bucket: pulumi.Output<string>;
     bucketPolicyId: pulumi.Output<string>;

package/createFargateTask.d.ts

@@ -1,28 +1,26 @@
 import * as aws from "@pulumi/aws";
-import * as awsx from "@pulumi/awsx";
-import { ApplicationTargetGroupHealthCheck } from "@pulumi/awsx/lb";
 import * as pulumi from "@pulumi/pulumi";
 import { ExtraExposedServiceOptions } from "./exposePublicService";
-export declare const getDefaultLogs: (serviceName: string, logGroup: aws.cloudwatch.LogGroup) => pulumi.Output<aws.ecs.LogConfiguration>;
-export declare function getClusterInstance(cluster: string | awsx.ecs.Cluster | undefined): awsx.ecs.Cluster;
-export declare type ALBMapping = {
+export declare const getDefaultLogs: (serviceName: string, logGroup: aws.cloudwatch.LogGroup) => aws.ecs.LogConfiguration;
+export declare function getClusterInstance(cluster: string | aws.ecs.Cluster | undefined): Promise<pulumi.Output<string> | string>;
+export type ALBMapping = {
     domain: string;
     dockerListeningPort: number;
-    healthCheck?: Partial<ApplicationTargetGroupHealthCheck>;
+    healthCheck?: Partial<aws.types.input.alb.TargetGroupHealthCheck>;
     extraExposedServiceOptions?: ExtraExposedServiceOptions;
 };
 export declare function getFargateExecutionRole(name: string, policyArnNamedMap: Record<string, pulumi.Input<string> | aws.iam.Policy>): {
-    role: aws.iam.Role;
-    policies: aws.iam.RolePolicyAttachment[];
+    role: import("@pulumi/aws/iam/role").Role;
+    policies: import("@pulumi/aws/iam/rolePolicyAttachment").RolePolicyAttachment[];
 };
 export declare function getFargateTaskRole(name: string, policyArnNamedMap: Record<string, pulumi.Input<string> | aws.iam.Policy>): {
-    role: aws.iam.Role;
-    policies: aws.iam.RolePolicyAttachment[];
+    role: import("@pulumi/aws/iam/role").Role;
+    policies: import("@pulumi/aws/iam/rolePolicyAttachment").RolePolicyAttachment[];
 };
-export declare type FargateTaskOptions = {
+export type FargateTaskOptions = {
     securityGroups?: (string | pulumi.Output<string>)[];
-    cluster?: awsx.ecs.Cluster | string;
-    healthCheck?: Partial<ApplicationTargetGroupHealthCheck>;
+    cluster?: aws.ecs.Cluster | string;
+    healthCheck?: Partial<aws.types.input.alb.TargetGroupHealthCheck>;
     desiredCount?: number;
     memoryReservation?: number;
     cpuReservation?: number;
@@ -38,7 +36,7 @@ export declare type FargateTaskOptions = {
     extraALBMappings?: ALBMapping[];
     executionRolePolicies?: Record<string, pulumi.Input<string> | aws.iam.Policy>;
     taskRolePolicies?: Record<string, pulumi.Input<string> | aws.iam.Policy>;
-    secrets?: aws.ecs.Secret[] | pulumi.Input<aws.ecs.Secret[]>;
+    secrets?: aws.ecs.Secret[];
     ignoreServiceDiscovery?: boolean;
     team: "dapps" | "platform" | "data" | "marketing" | "infra";
     metrics?: {
@@ -50,8 +48,8 @@ export declare type FargateTaskOptions = {
     dependsOn?: pulumi.Resource[];
     volumes?: aws.types.input.ecs.TaskDefinitionVolume[] | pulumi.Input<aws.types.input.ecs.TaskDefinitionVolume[]>;
     deregistrationDelay?: pulumi.Input<number>;
-    mountPoints?: pulumi.Input<aws.ecs.MountPoint[]>;
-    repositoryCredentials?: pulumi.Input<aws.ecs.RepositoryCredentials>;
+    mountPoints?: aws.ecs.MountPoint[];
+    repositoryCredentials?: aws.ecs.RepositoryCredentials;
 };
 /**
  *
@@ -65,38 +63,38 @@ export declare type FargateTaskOptions = {
  * @param options.healthCheckPath
  * @param options.policyArnNamedMap key-value named map of policies to attach to the default execution role for this task
  */
-export declare function createFargateTask(serviceName: string, dockerImage: string | Promise<string> | pulumi.OutputInstance<string> | awsx.ecs.ContainerImageProvider, dockerListeningPort: number, environment: {
+export declare function createFargateTask(serviceName: string, dockerImage: string | Promise<string> | pulumi.OutputInstance<string>, dockerListeningPort: number, environment: {
     name: string;
     value: pulumi.Input<string>;
     secret?: boolean;
 }[], hostname: string, options: FargateTaskOptions): Promise<{
-    service: awsx.ecs.FargateService;
+    service: import("@pulumi/aws/ecs/service").Service;
     endpoint: string;
     exposed?: undefined;
 } | {
     endpoint: string;
-    service: awsx.ecs.FargateService;
+    service: import("@pulumi/aws/ecs/service").Service;
     exposed: {
         domain: string;
         certificate: pulumi.Input<string>;
-        record: void | aws.route53.Record;
-        targetGroup: awsx.elasticloadbalancingv2.ApplicationTargetGroup;
-        cloudflareRecord: void | import("@pulumi/cloudflare").Record;
+        record: import("@pulumi/aws/route53/record").Record | undefined;
+        targetGroup: import("@pulumi/aws/alb/targetGroup").TargetGroup;
+        cloudflareRecord: import("@pulumi/cloudflare/record").Record | undefined;
     };
 }>;
-export declare type InternalServiceOptions = {
+export type InternalServiceOptions = {
     serviceName: string;
-    cluster?: string | awsx.ecs.Cluster;
-    securityGroups?: awsx.ec2.SecurityGroupOrId[];
+    cluster?: string | aws.ecs.Cluster;
+    securityGroups?: (string | pulumi.Output<string>)[];
     ignoreServiceDiscovery?: boolean;
     serviceDiscoveryPort?: number;
     desiredCount?: number;
     executionRole?: aws.iam.Role;
     taskRole?: aws.iam.Role;
-    containerInfo: awsx.ecs.Container;
+    containerInfo: aws.ecs.ContainerDefinition;
     assignPublicIp?: boolean;
     dependsOn?: pulumi.Resource[];
     volumes?: pulumi.Input<aws.types.input.ecs.TaskDefinitionVolume[]>;
     team: string;
 };
-export declare function createInternalService(config: InternalServiceOptions): Promise<awsx.ecs.FargateService>;
+export declare function createInternalService(config: InternalServiceOptions): Promise<import("@pulumi/aws/ecs/service").Service>;

package/createFargateTask.js

@@ -11,27 +11,27 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createInternalService = exports.createFargateTask = exports.getFargateTaskRole = exports.getFargateExecutionRole = exports.getClusterInstance = exports.getDefaultLogs = void 0;
 const aws = require("@pulumi/aws");
-const awsx = require("@pulumi/awsx");
 const pulumi = require("@pulumi/pulumi");
 const acceptAlb_1 = require("./acceptAlb");
 const acceptBastion_1 = require("./acceptBastion");
 const domain_1 = require("./domain");
 const exposePublicService_1 = require("./exposePublicService");
 const network_1 = require("./network");
-const utils_1 = require("./utils");
 const vpc_1 = require("./vpc");
 const supra_1 = require("./supra");
 const stack_1 = require("./stack");
 const prometheus_1 = require("./prometheus");
 const accessTheInternet_1 = require("./accessTheInternet");
-const getDefaultLogs = (serviceName, logGroup) => pulumi.all([logGroup.id]).apply(([logGroupId]) => ({
-    logDriver: "awslogs",
-    options: {
-        "awslogs-group": logGroupId,
-        "awslogs-region": "us-east-1",
-        "awslogs-stream-prefix": serviceName,
-    },
-}));
+const getDefaultLogs = (serviceName, logGroup) => {
+    return {
+        logDriver: "awslogs",
+        options: {
+            "awslogs-group": logGroup.name.apply((name) => name),
+            "awslogs-region": "us-east-1",
+            "awslogs-stream-prefix": serviceName,
+        },
+    };
+};
 exports.getDefaultLogs = getDefaultLogs;
 const extraOpts = {
     customTimeouts: {
@@ -42,29 +42,28 @@ const extraOpts = {
 };
 const cachedClusterInstances = {};
 function getClusterInstance(cluster) {
-    if (undefined === cluster) {
-        const defaultClusterName = `${domain_1.env}-main`;
-        cluster = defaultClusterName;
-    }
-    if (typeof cluster === "string") {
-        if (!cachedClusterInstances[cluster]) {
-            cachedClusterInstances[cluster] = new awsx.ecs.Cluster(cluster + "-ref", {
-                cluster: aws.ecs.Cluster.get(cluster + "-ref-2", cluster),
-            });
+    return __awaiter(this, void 0, void 0, function* () {
+        if (undefined === cluster) {
+            const defaultClusterName = `${domain_1.env}-main`;
+            cluster = (yield aws.ecs.getCluster({ clusterName: defaultClusterName }, { async: true })).arn;
+        }
+        if (typeof cluster === "string") {
+            if (!cachedClusterInstances[cluster]) {
+                cachedClusterInstances[cluster] = (yield aws.ecs.getCluster({ clusterName: cluster }, { async: true })).arn;
+            }
+            return cachedClusterInstances[cluster];
         }
-        return cachedClusterInstances[cluster];
-    }
-    return cluster;
+        return cluster.arn;
+    });
 }
 exports.getClusterInstance = getClusterInstance;
 function getFargateExecutionRole(name, policyArnNamedMap) {
-    const assumeRolePolicy = awsx.ecs.TaskDefinition.defaultRoleAssumeRolePolicy();
+    const assumeRolePolicy = aws.iam.assumeRolePolicyForPrincipal({
+        Service: "ecs-tasks.amazonaws.com",
+    });
     const dependsOn = Object.values(policyArnNamedMap).filter(($) => $ instanceof pulumi.Resource);
     const role = new aws.iam.Role(name, { assumeRolePolicy }, { dependsOn });
     const policies = [];
-    awsx.ecs.TaskDefinition.defaultExecutionRolePolicyARNs().forEach((policyArn) => {
-        policies.push(new aws.iam.RolePolicyAttachment(`${name}-default-${(0, utils_1.sha256hash)(policyArn)}`, { role, policyArn }, { parent: role }));
-    });
     Object.entries(policyArnNamedMap).forEach(([key, policyArn]) => {
         if (policyArn instanceof aws.iam.Policy) {
             policies.push(new aws.iam.RolePolicyAttachment(`${name}-${key}`, { role, policyArn: policyArn.arn }, { parent: role }));
@@ -77,13 +76,12 @@ function getFargateExecutionRole(name, policyArnNamedMap) {
 }
 exports.getFargateExecutionRole = getFargateExecutionRole;
 function getFargateTaskRole(name, policyArnNamedMap) {
-    const assumeRolePolicy = awsx.ecs.TaskDefinition.defaultRoleAssumeRolePolicy();
+    const assumeRolePolicy = aws.iam.assumeRolePolicyForPrincipal({
+        Service: "ecs-tasks.amazonaws.com",
+    });
     const dependsOn = Object.values(policyArnNamedMap).filter(($) => $ instanceof pulumi.Resource);
     const role = new aws.iam.Role(name, { assumeRolePolicy }, { dependsOn });
     const policies = [];
-    awsx.ecs.TaskDefinition.defaultTaskRolePolicyARNs().forEach((policyArn) => {
-        policies.push(new aws.iam.RolePolicyAttachment(`${name}-default-${(0, utils_1.sha256hash)(policyArn)}`, { role, policyArn }, { parent: role }));
-    });
     Object.entries(policyArnNamedMap).forEach(([key, policyArn]) => {
         if (policyArn instanceof aws.iam.Policy) {
             policies.push(new aws.iam.RolePolicyAttachment(`${name}-${key}`, { role, policyArn: policyArn.arn }, { parent: role }));
@@ -138,7 +136,10 @@ function createFargateTask(serviceName, dockerImage, dockerListeningPort, enviro
             dependsOn = [];
         }
         if (undefined === mountPoints) {
-            dependsOn = [];
+            mountPoints = [];
+        }
+        if (undefined === secrets) {
+            secrets = [];
         }
         const { role: executionRole, policies: executionPolicies } = getFargateExecutionRole(`${serviceName}-${version}-execution`, executionRolePolicies || {});
         dependsOn.push(...executionPolicies);
@@ -158,8 +159,9 @@ function createFargateTask(serviceName, dockerImage, dockerListeningPort, enviro
         // this port should be the internal port used for administrative purposes
         let serviceDiscoveryPort = dockerListeningPort;
         const vpc = yield (0, vpc_1.getVpc)();
-        const taskSecurityGroup = new awsx.ec2.SecurityGroup(`${serviceName}-${version}`, {
-            vpc,
+        const taskSecurityGroup = new aws.ec2.SecurityGroup(`${serviceName}-${version}`, {
+            vpcId: vpc.id,
+            tags: { ServiceName: serviceName, Team: team },
         });
         if (dockerLabels.ECS_PROMETHEUS_EXPORTER_PORT) {
             let fromPort = 0;
@@ -170,11 +172,13 @@ function createFargateTask(serviceName, dockerImage, dockerListeningPort, enviro
                 if (toPort == 0 || toPort < port)
                     toPort = port;
                 // create a security group to enable metrics access by cwagent from inside the VPC
-                taskSecurityGroup.createIngressRule(`metrics-${port}`, {
+                new aws.ec2.SecurityGroupRule(`metrics-${port}`, {
+                    type: "ingress",
                     fromPort: port,
                     toPort: port,
                     protocol: "tcp",
-                    cidrBlocks: [vpc.vpc.cidrBlock],
+                    cidrBlocks: [vpc.cidrBlock],
+                    securityGroupId: taskSecurityGroup.id,
                 });
                 if (!extraPortMappings.find(($) => $.hostPort != metrics.port) && (port != dockerListeningPort || dontExpose)) {
                     extraPortMappings.push({
@@ -189,7 +193,7 @@ function createFargateTask(serviceName, dockerImage, dockerListeningPort, enviro
             (0, prometheus_1.makeSecurityGroupAccessibleByPrometheus)(taskSecurityGroup, fromPort, toPort);
         }
         // enable egress traffic from the task to the internet
-        (0, accessTheInternet_1.makeSecurityGroupAccessTheInternet)(taskSecurityGroup);
+        (0, accessTheInternet_1.makeSecurityGroupAccessTheInternetV2)(taskSecurityGroup);
         // make the container fully accessible from the bastion of the environment
         (0, acceptBastion_1.makeSecurityGroupAccessibleFromBastion)(taskSecurityGroup);
         if (dontExpose) {
@@ -202,7 +206,8 @@ function createFargateTask(serviceName, dockerImage, dockerListeningPort, enviro
                 ignoreServiceDiscovery,
                 securityGroups: [taskSecurityGroup.id, ...securityGroups],
                 containerInfo: {
-                    secrets,
+                    name: serviceName,
+                    secrets: [],
                     environment,
                     essential,
                     image: dockerImage,
@@ -228,8 +233,12 @@ function createFargateTask(serviceName, dockerImage, dockerListeningPort, enviro
         for (let extraALBMapping of extraALBMappings) {
             const exposedExtra = yield (0, exposePublicService_1.exposePublicService)(`${serviceName}-${extraALBMapping.dockerListeningPort}-${version}`, extraALBMapping.domain, extraALBMapping.dockerListeningPort, extraALBMapping.healthCheck, undefined, extraALBMapping.extraExposedServiceOptions);
             extraALBMappingsExposed.push(exposedExtra.targetGroup);
+            extraPortMappings.push({
+                containerPort: extraALBMapping.dockerListeningPort,
+                hostPort: extraALBMapping.dockerListeningPort,
+            });
         }
-        const portMapping = exposed.targetGroup;
+        const portMapping = { containerPort: dockerListeningPort, hostPort: dockerListeningPort };
         // make the service accesible by the ALB
         (0, acceptAlb_1.makeSecurityGroupAccessibleFromSharedAlb)(taskSecurityGroup);
         const service = yield createInternalService({
@@ -243,9 +252,10 @@ function createFargateTask(serviceName, dockerImage, dockerListeningPort, enviro
             securityGroups: [taskSecurityGroup.id, ...securityGroups],
             serviceDiscoveryPort,
             containerInfo: {
+                name: serviceName,
                 secrets,
                 environment,
-                portMappings: [...extraPortMappings, ...extraALBMappingsExposed, portMapping],
+                portMappings: [...extraPortMappings, portMapping],
                 essential,
                 image: dockerImage,
                 command,
@@ -292,26 +302,27 @@ function createInternalService(config) {
             retentionInDays: 60,
             tags: { ServiceName: serviceName, Team: team },
         });
-        return new awsx.ecs.FargateService((0, stack_1.getStackScopedName)(serviceName), {
-            cluster: getClusterInstance(cluster),
+        const taskDefinition = new aws.ecs.TaskDefinition((0, stack_1.getStackScopedName)(serviceName) + "-taskdefinition", {
+            executionRoleArn: executionRole === null || executionRole === void 0 ? void 0 : executionRole.arn,
+            taskRoleArn: taskRole === null || taskRole === void 0 ? void 0 : taskRole.arn,
+            tags: { ServiceName: serviceName, Team: team },
+            containerDefinitions: JSON.stringify([Object.assign(Object.assign({}, containerInfo), { logConfiguration: (0, exports.getDefaultLogs)(serviceName, logGroup) })]),
+            volumes: volumes,
+            family: (0, stack_1.getStackScopedName)(serviceName),
+        }, { dependsOn: [logGroup] });
+        return new aws.ecs.Service((0, stack_1.getStackScopedName)(serviceName), {
+            cluster: yield getClusterInstance(cluster),
             tags: { ServiceName: serviceName, StackId: (0, stack_1.getStackId)() },
-            subnets: yield (0, network_1.getPrivateSubnetIds)(),
-            securityGroups: securityGroups,
+            networkConfiguration: {
+                subnets: yield (0, network_1.getPrivateSubnetIds)(),
+                securityGroups: securityGroups,
+                assignPublicIp
+            },
             serviceRegistries,
             desiredCount,
             enableEcsManagedTags: true,
-            assignPublicIp,
             waitForSteadyState: false,
-            taskDefinitionArgs: {
-                executionRole,
-                taskRole,
-                tags: { ServiceName: serviceName, Team: team },
-                logGroup,
-                containers: {
-                    [serviceName]: Object.assign({ logConfiguration: (0, exports.getDefaultLogs)(serviceName, logGroup) }, containerInfo),
-                },
-                volumes: volumes,
-            },
+            taskDefinition: taskDefinition.arn,
         }, Object.assign(Object.assign({}, extraOpts), { dependsOn }));
     });
 }

package/createImageFromContext.d.ts

@@ -1,12 +1,11 @@
-import * as aws from "@pulumi/aws";
 import * as docker from "@pulumi/docker";
 import * as pulumi from "@pulumi/pulumi";
-export declare function createImageFromContext(name: string, context: string, options?: Partial<docker.DockerBuild>, imageOpts?: pulumi.ComponentResourceOptions): {
-    ecr: aws.ecr.Repository;
+export declare function createImageFromContext(name: string, context: string, options?: Partial<docker.types.input.DockerBuild>, imageOpts?: pulumi.ComponentResourceOptions): {
+    ecr: import("@pulumi/aws/ecr/repository").Repository;
     registry: pulumi.Output<{
         server: string;
         username: string;
         password: string;
     }>;
-    image: docker.Image;
+    image: import("@pulumi/docker/image").Image;
 };

package/createImageFromContext.js

@@ -9,7 +9,7 @@ function createImageFromContext(name, context, options, imageOpts) {
     const registry = (0, getImageRegistryAndCredentials_1.getImageRegistryAndCredentials)(ecr);
     const image = new docker.Image(`${name}-image`, {
         imageName: ecr.repositoryUrl,
-        build: Object.assign({ context, cacheFrom: true, env: {
+        build: Object.assign({ context, args: {
                 DOCKER_BUILDKIT: "1",
             } }, options),
         registry: registry,

package/domain.js

@@ -4,7 +4,7 @@ exports.publicDomain = exports.domain = exports.publicTLD = exports.envTLD = exp
 const env = process.env["ENVIRONMENT"];
 exports.env = env;
 if (env === undefined) {
-    throw new Error("Set the ENVIRONMENT environment before proceeding");
+    throw new Error("Set the ENVIRONMENT environment before proceeding.");
 }
 /** Internal TLD { prd=co stg=net dev=io }, managed by AWS */
 let envTLD = "";

package/exposePublicService.d.ts

@@ -1,17 +1,15 @@
 import * as pulumi from "@pulumi/pulumi";
 import * as aws from "@pulumi/aws";
-import * as awsx from "@pulumi/awsx";
-import * as cf from "@pulumi/cloudflare";
-import { ApplicationTargetGroupHealthCheck } from "@pulumi/awsx/lb";
-export declare type ProxiedCloudflareDomain = {
+import { alb as albTypes } from "@pulumi/aws/types/input";
+export type ProxiedCloudflareDomain = {
     createCloudflareProxiedSubdomain: true;
 };
-export declare type UnproxiedCloudflareDomain = {
+export type UnproxiedCloudflareDomain = {
     createCloudflareDNSWithoutProxy: true;
     ttl: number;
 };
-export declare type CloudflareDomainOptions = ProxiedCloudflareDomain | UnproxiedCloudflareDomain | {};
-export declare type ExtraExposedServiceOptions = CloudflareDomainOptions & {
+export type CloudflareDomainOptions = ProxiedCloudflareDomain | UnproxiedCloudflareDomain | {};
+export type ExtraExposedServiceOptions = CloudflareDomainOptions & {
     skipInternalDomain?: boolean;
     targetGroupConditions?: pulumi.Input<aws.types.input.alb.ListenerRuleCondition>[];
 };
@@ -24,10 +22,10 @@ export declare type ExtraExposedServiceOptions = CloudflareDomainOptions & {
  * @param domain
  * @param port
  */
-export declare function exposePublicService(name: string, domain: string, port: number, healthCheck?: Partial<ApplicationTargetGroupHealthCheck>, vpc?: awsx.ec2.Vpc, extraOptions?: ExtraExposedServiceOptions, deregistrationDelay?: pulumi.Input<number>): Promise<{
+export declare function exposePublicService(name: string, domain: string, port: number, healthCheck?: Partial<albTypes.TargetGroupHealthCheck>, vpc?: aws.ec2.Vpc, extraOptions?: ExtraExposedServiceOptions, deregistrationDelay?: pulumi.Input<number>): Promise<{
     domain: string;
     certificate: pulumi.Input<string>;
-    record: void | aws.route53.Record;
-    targetGroup: awsx.elasticloadbalancingv2.ApplicationTargetGroup;
-    cloudflareRecord: void | cf.Record;
+    record: import("@pulumi/aws/route53/record").Record | undefined;
+    targetGroup: import("@pulumi/aws/alb/targetGroup").TargetGroup;
+    cloudflareRecord: import("@pulumi/cloudflare/record").Record | undefined;
 }>;

package/exposePublicService.js

@@ -11,7 +11,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.exposePublicService = void 0;
 const aws = require("@pulumi/aws");
-const awsx = require("@pulumi/awsx");
 const domain_1 = require("./domain");
 const alb_1 = require("./alb");
 const certificate_1 = require("./certificate");
@@ -50,13 +49,13 @@ function exposePublicService(name, domain, port, healthCheck = {}, vpc, extraOpt
         const createInternalDomain = !onlyCloudflare;
         const certificate = (0, certificate_1.getCertificateFor)(domain);
         const slug = name;
-        const targetVpc = vpc ? vpc : awsx.ec2.Vpc.getDefault();
+        const targetVpc = vpc ? vpc : yield aws.ec2.getVpc({ default: true }, { async: true });
         const targetDeregistrationDelay = deregistrationDelay ? deregistrationDelay : 300;
-        const targetGroup = alb.createTargetGroup("tg-" + slug.substr(-32 + 12) /* last 32 chars, and take 7 chars for the -hash appended by pulumi */, {
+        const targetGroup = new aws.alb.TargetGroup("tg-" + slug.substr(-32 + 12), {
             protocol: "HTTP",
             port,
             healthCheck: healthCheckValue,
-            vpc: targetVpc,
+            vpcId: targetVpc.id,
             deregistrationDelay: targetDeregistrationDelay,
         });
         const domainParts = (0, getDomainAndSubdomain_1.getDomainAndSubdomain)(domain);
@@ -71,8 +70,8 @@ function exposePublicService(name, domain, port, healthCheck = {}, vpc, extraOpt
                 type: "A",
                 aliases: [
                     {
-                        name: alb.loadBalancer.dnsName,
-                        zoneId: alb.loadBalancer.zoneId,
+                        name: alb.dnsName,
+                        zoneId: alb.zoneId,
                         evaluateTargetHealth: false,
                     },
                 ],
@@ -85,7 +84,7 @@ function exposePublicService(name, domain, port, healthCheck = {}, vpc, extraOpt
                 cloudflareRecord = yield (0, cloudflare_1.setRecord)({
                     recordName: domainParts.subdomain,
                     type: "CNAME",
-                    value: alb.loadBalancer.dnsName,
+                    value: alb.dnsName,
                     proxied: false,
                     ttl: extraOptions.ttl || 600,
                 });
@@ -94,7 +93,7 @@ function exposePublicService(name, domain, port, healthCheck = {}, vpc, extraOpt
                 cloudflareRecord = yield (0, cloudflare_1.setRecord)({
                     recordName: domainParts.subdomain,
                     type: "CNAME",
-                    value: alb.loadBalancer.dnsName,
+                    value: alb.dnsName,
                     proxied: true,
                 });
             }
@@ -106,7 +105,7 @@ function exposePublicService(name, domain, port, healthCheck = {}, vpc, extraOpt
                 actions: [
                     {
                         type: "forward",
-                        targetGroupArn: targetGroup.targetGroup.arn,
+                        targetGroupArn: targetGroup.arn,
                     },
                 ],
             });

package/lambda.d.ts

@@ -1,7 +1,7 @@
-import * as awsx from "@pulumi/awsx";
 import * as aws from "@pulumi/aws";
+import * as apigateway from "@pulumi/aws-apigateway";
 import * as pulumi from "@pulumi/pulumi";
-export declare type LambdaOptions = {
+export type LambdaOptions = {
     folderName: string;
     extra?: Partial<aws.lambda.FunctionArgs>;
     attachRolePolicyArn?: Record<string, pulumi.Input<string>>;
@@ -9,11 +9,10 @@ export declare type LambdaOptions = {
 export declare function createGateway(options: {
     fullyQualifiedDomainName: string;
 }, fn: (addRoute: (config: LambdaOptions & {
-    method: awsx.apigateway.Method;
+    method: apigateway.types.enums.Method;
     path: string;
-    extraRoute?: awsx.apigateway.BaseRoute;
 }) => Promise<void>) => Promise<void>): Promise<{
-    gateway: awsx.apigateway.API;
-    record: aws.route53.Record;
+    gateway: import("@pulumi/aws-apigateway/restAPI").RestAPI;
+    record: import("@pulumi/aws/route53/record").Record;
     lambdasDomain: string;
 }>;

package/lambda.js

@@ -10,8 +10,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createGateway = void 0;
-const awsx = require("@pulumi/awsx");
 const aws = require("@pulumi/aws");
+const apigateway = require("@pulumi/aws-apigateway");
 const pulumi = require("@pulumi/pulumi");
 const path_1 = require("path");
 const domain_1 = require("./domain");
@@ -66,7 +66,7 @@ function createLambda(fullyQualifiedDomainName, config) {
             });
         }
         const name = (0, stack_1.getStackScopedName)((subdomain || "ROOTDOMAIN") + "-" + lambdaName);
-        const lambda = new aws.lambda.Function(name, Object.assign({ name: name, handler: `${(0, path_1.basename)(file, ".js")}.handler`, timeout: 900, memorySize: 1024, runtime: "nodejs14.x", code: (extra === null || extra === void 0 ? void 0 : extra.code) ||
+        const lambda = new aws.lambda.Function(name, Object.assign({ name: name, handler: `${(0, path_1.basename)(file, ".js")}.handler`, timeout: 900, memorySize: 1024, runtime: "nodejs18.x", code: (extra === null || extra === void 0 ? void 0 : extra.code) ||
                 new pulumi.asset.AssetArchive({
                     [(0, path_1.basename)(file)]: new pulumi.asset.FileAsset(file),
                 }), role: (extra === null || extra === void 0 ? void 0 : extra.role) || lambdaApiGatewayRole.arn }, extra));
@@ -78,9 +78,13 @@ function createGateway(options, fn) {
         const routes = [];
         yield fn(function configureApiGatewayLambda(config) {
             return __awaiter(this, void 0, void 0, function* () {
-                const { method, path, extraRoute } = config;
+                const { method, path } = config;
                 const lambda = yield createLambda(options.fullyQualifiedDomainName, config);
-                routes.push(Object.assign({ method: method, path, eventHandler: lambda }, extraRoute));
+                routes.push({
+                    method: method,
+                    path,
+                    eventHandler: lambda
+                });
             });
         });
         if (routes.length == 0) {
@@ -88,15 +92,15 @@ function createGateway(options, fn) {
         }
         const stageName = domain_1.env;
         // Create a public HTTP endpoint (using AWS APIGateway)
-        const gateway = new awsx.apigateway.API((0, stack_1.getStackScopedName)(options.fullyQualifiedDomainName.replace(/\./g, "-")), {
+        const gateway = new apigateway.RestAPI((0, stack_1.getStackScopedName)(options.fullyQualifiedDomainName.replace(/\./g, "-")), {
             routes: routes,
+            stageName
+        });
+        new aws.apigateway.Stage((0, stack_1.getStackScopedName)(`${options.fullyQualifiedDomainName.replace(/\./g, "-")}-stage`), {
+            restApi: gateway.api.id,
+            deployment: gateway.deployment.id,
             stageName,
-            restApiArgs: {
-                name: "rest-api",
-            },
-            stageArgs: {
-                xrayTracingEnabled: true,
-            },
+            xrayTracingEnabled: true
         });
         const { record, lambdasDomain } = yield configureApiGatewayDomain(options.fullyQualifiedDomainName, gateway);
         return {
@@ -120,7 +124,7 @@ function configureApiGatewayDomain(fullyQualifiedDomainName, gateway) {
             deleteBeforeReplace: true,
         });
         const webDomainMapping = new aws.apigateway.BasePathMapping((0, stack_1.getStackScopedName)(subdomain + "-bpm"), {
-            restApi: gateway.restAPI,
+            restApi: gateway.api.id,
             stageName: gateway.stage.stageName,
             domainName: webDomain.id,
         }, { dependsOn: [webDomain], deleteBeforeReplace: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dcl-ops-lib",
-  "version": "5.26.4",
+  "version": "6.0.1",
   "scripts": {
     "build": "tsc && cp bin/* . && node test.js",
     "clean": "rm *.d.ts *.js *.js.map"
@@ -20,18 +20,20 @@
     "extends": "@semantic-release/gitlab-config"
   },
   "devDependencies": {
-    "@semantic-release/gitlab-config": "^10.0.1",
-    "@types/mime": "^3.0.1",
-    "@types/node": "^18.7.13",
-    "semantic-release": "^19.0.5",
-    "typescript": "^4.7.4"
+    "@semantic-release/gitlab-config": "^13.0.0",
+    "@types/mime": "^3.0.4",
+    "@types/node": "^20.9.3",
+    "semantic-release": "^22.0.8",
+    "typescript": "^5.3.2"
   },
   "dependencies": {
-    "@pulumi/aws": "5.11.0",
-    "@pulumi/awsx": "0.40.0",
-    "@pulumi/cloudflare": "4.9.0",
-    "@pulumi/docker": "3.4.1",
-    "@pulumi/pulumi": "3.38.0",
+    "@pulumi/aws": "6.9.0",
+    "@pulumi/aws-apigateway": "^2.0.1",
+    "@pulumi/aws-native": "^0.86.0",
+    "@pulumi/awsx": "2.2.0",
+    "@pulumi/cloudflare": "5.15.0",
+    "@pulumi/docker": "4.5.0",
+    "@pulumi/pulumi": "3.94.2",
     "mime": "^3.0.0"
   }
 }

package/prometheus.d.ts

@@ -1,9 +1,5 @@
 import * as pulumi from "@pulumi/pulumi";
-import * as awsx from "@pulumi/awsx";
+import * as aws from "@pulumi/aws";
 export declare const prometheusStack: () => Promise<pulumi.StackReference>;
 export declare const prometheusSecurityGroupId: () => Promise<string>;
-/**
- * @deprecated use makeSecurityGroupAccessibleByPrometheusV2
- */
-export declare function makeSecurityGroupAccessibleByPrometheus(securityGroup: awsx.ec2.SecurityGroup, fromPort?: number, toPort?: number): void;
-export declare function makeSecurityGroupAccessibleByPrometheusV2(securityGroup: awsx.ec2.SecurityGroup, fromPort?: number, toPort?: number, ruleName?: string): void;
+export declare function makeSecurityGroupAccessibleByPrometheus(securityGroup: aws.ec2.SecurityGroup, fromPort?: number, toPort?: number, ruleName?: string): void;

package/prometheus.js

@@ -9,9 +9,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.makeSecurityGroupAccessibleByPrometheusV2 = exports.makeSecurityGroupAccessibleByPrometheus = exports.prometheusSecurityGroupId = exports.prometheusStack = void 0;
+exports.makeSecurityGroupAccessibleByPrometheus = exports.prometheusSecurityGroupId = exports.prometheusStack = void 0;
 const pulumi = require("@pulumi/pulumi");
-const awsx = require("@pulumi/awsx");
+const aws = require("@pulumi/aws");
 const domain_1 = require("./domain");
 const withCache_1 = require("./withCache");
 const utils_1 = require("./utils");
@@ -22,27 +22,16 @@ exports.prometheusSecurityGroupId = (0, withCache_1.default)(() => __awaiter(voi
     const prom = yield (0, exports.prometheusStack)();
     return (yield prom.requireOutputValue("prometheusSecurityGroupId"));
 }));
-/**
- * @deprecated use makeSecurityGroupAccessibleByPrometheusV2
- */
-function makeSecurityGroupAccessibleByPrometheus(securityGroup, fromPort = 0, toPort = 0) {
-    new awsx.ec2.IngressSecurityGroupRule(`accept-prom-${fromPort}-${toPort}`, securityGroup, {
+function makeSecurityGroupAccessibleByPrometheus(securityGroup, fromPort = 0, toPort = 0, ruleName = "") {
+    new aws.ec2.SecurityGroupRule((0, utils_1.withRuleName)("access-the-internet-v2", ruleName), {
         sourceSecurityGroupId: (0, exports.prometheusSecurityGroupId)(),
         description: `Allow access from prometheus`,
         fromPort,
         toPort,
         protocol: "-1",
-    });
+        type: "egress",
+        securityGroupId: securityGroup.id,
+    }, { deleteBeforeReplace: true });
 }
 exports.makeSecurityGroupAccessibleByPrometheus = makeSecurityGroupAccessibleByPrometheus;
-function makeSecurityGroupAccessibleByPrometheusV2(securityGroup, fromPort = 0, toPort = 0, ruleName = "") {
-    new awsx.ec2.IngressSecurityGroupRule((0, utils_1.withRuleName)(`accept-prom-${fromPort}-${toPort}-v2`, ruleName), securityGroup, {
-        sourceSecurityGroupId: (0, exports.prometheusSecurityGroupId)(),
-        description: `Allow access from prometheus`,
-        fromPort,
-        toPort,
-        protocol: "-1",
-    });
-}
-exports.makeSecurityGroupAccessibleByPrometheusV2 = makeSecurityGroupAccessibleByPrometheusV2;
 //# sourceMappingURL=prometheus.js.map

package/secrets.d.ts

@@ -1,3 +1,2 @@
-import * as aws from '@pulumi/aws';
 import * as pulumi from '@pulumi/pulumi';
-export declare function secretToSSM(name: string, secureString: pulumi.Output<string>): aws.ssm.Parameter;
+export declare function secretToSSM(name: string, secureString: pulumi.Output<string>): import("@pulumi/aws/ssm/parameter").Parameter;

package/values.d.ts

@@ -1,9 +1,8 @@
-import { Subnet } from "@pulumi/awsx/ec2";
-export declare type EnvironmentValues = {
+export type EnvironmentValues = {
     defaultSecurityGroupId: string;
-    publicSubnets: Subnet[];
-    privateSubnets: Subnet[];
-    internalSubnets: Subnet[];
+    publicSubnets: string[];
+    privateSubnets: string[];
+    internalSubnets: string[];
     /** @deprecated */
     acceptAlb: string;
     /** @deprecated */

package/values.js

@@ -10,16 +10,16 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getEnvConfiguration = void 0;
+const aws = require("@pulumi/aws");
 const supra_1 = require("./supra");
-const vpc_1 = require("./vpc");
 const withCache_1 = require("./withCache");
 exports.getEnvConfiguration = (0, withCache_1.default)(function () {
     return __awaiter(this, void 0, void 0, function* () {
         return {
             defaultSecurityGroupId: yield supra_1.supra.getOutputValue("acceptBastionSecurityGroupId"),
-            publicSubnets: yield (yield (0, vpc_1.vpc)()).publicSubnets,
-            privateSubnets: yield (yield (0, vpc_1.vpc)()).privateSubnets,
-            internalSubnets: yield (yield (0, vpc_1.vpc)()).isolatedSubnets,
+            publicSubnets: (yield aws.ec2.getSubnets({ filters: [{ name: "tag:type", values: ["public"] }] })).ids,
+            privateSubnets: (yield aws.ec2.getSubnets({ filters: [{ name: "tag:type", values: ["private"] }] })).ids,
+            internalSubnets: (yield aws.ec2.getSubnets({ filters: [{ name: "tag:type", values: ["internal"] }] })).ids,
             acceptAlb: yield supra_1.supra.getOutputValue("acceptAlbSecurityGroupId"),
             acceptBastion: yield supra_1.supra.getOutputValue("acceptBastionSecurityGroupId"),
             dbSecurity: yield supra_1.supra.getOutputValue("acceptDbSecurityGroupId"),

package/vpc.d.ts

@@ -1,3 +1,3 @@
-import * as awsx from '@pulumi/awsx';
-export declare function vpc(): Promise<awsx.ec2.Vpc>;
+import * as aws from '@pulumi/aws';
+export declare function vpc(): Promise<aws.ec2.GetVpcResult>;
 export declare const getVpc: typeof vpc;

package/vpc.js

@@ -10,14 +10,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getVpc = exports.vpc = void 0;
-const awsx = require("@pulumi/awsx");
+const aws = require("@pulumi/aws");
 const supra_1 = require("./supra");
 let vpcReference;
 function vpc() {
     return __awaiter(this, void 0, void 0, function* () {
         if (!vpcReference) {
-            vpcReference = awsx.ec2.Vpc.fromExistingIds(`vpc-reference`, {
-                vpcId: yield supra_1.supra.getOutputValue('vpcId')
+            vpcReference = yield aws.ec2.getVpc({
+                id: yield supra_1.supra.getOutputValue('vpcId')
             });
         }
         return vpcReference;

package/getSecurityGroup.d.ts

@@ -1,6 +0,0 @@
-import * as awsx from "@pulumi/awsx";
-import { Output } from '@pulumi/pulumi';
-export declare function createSecurityGroupFunction(name: string, id: string | Output<string>): {
-    getSecurityGroup: () => Promise<awsx.ec2.SecurityGroup | Output<awsx.ec2.SecurityGroup>>;
-    getSecurityGroupId: () => Promise<Output<string>>;
-};

package/getSecurityGroup.js

@@ -1,51 +0,0 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createSecurityGroupFunction = void 0;
-const awsx = require("@pulumi/awsx");
-function createSecurityGroupFunction(name, id) {
-    let securityGroupOutput;
-    let securityGroupPromise;
-    function getSecurityGroup() {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!securityGroupOutput) {
-                if (!securityGroupPromise) {
-                    securityGroupPromise = new Promise((resolve, reject) => __awaiter(this, void 0, void 0, function* () {
-                        try {
-                            resolve(awsx.ec2.SecurityGroup.fromExistingId(name, id));
-                        }
-                        catch (e) {
-                            reject(e);
-                        }
-                    }));
-                    return yield securityGroupPromise;
-                }
-                else {
-                    return yield securityGroupPromise;
-                }
-            }
-            else {
-                return securityGroupOutput;
-            }
-        });
-    }
-    function getSecurityGroupId() {
-        return __awaiter(this, void 0, void 0, function* () {
-            return (yield getSecurityGroup()).id;
-        });
-    }
-    return {
-        getSecurityGroup: getSecurityGroup,
-        getSecurityGroupId: getSecurityGroupId
-    };
-}
-exports.createSecurityGroupFunction = createSecurityGroupFunction;
-//# sourceMappingURL=getSecurityGroup.js.map

package/setupDatabasePermissions.d.ts

@@ -1,2 +0,0 @@
-import * as pulumi from "@pulumi/pulumi";
-export declare function setupDatabasePermissions(databaseName: string, databaseUsername: pulumi.Output<string>, databasePassword: pulumi.Output<string>): void;

package/setupDatabasePermissions.js

@@ -1,18 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.setupDatabasePermissions = void 0;
-function setupDatabasePermissions(databaseName, databaseUsername, databasePassword) {
-    // Creating users in terraform+pulumi+aws+postgres is utterly broken.
-    // Need to do this manually.
-    // 
-    // CREATE DATABASE databaseName;
-    // CREATE ROLE databaseUsername WITH LOGIN PASSWORD 'password';
-    // GRANT ALL PRIVILEGES ON DATABASE databaseUsername TO databaseUsername;
-    throw new Error(`You need to do the DB setup manually. Sorry about it!
-    Please connect to the db through the bastion node and run:
-       CREATE DATABASE databaseName;
-       CREATE ROLE databaseUsername WITH LOGIN PASSWORD 'password';
-       GRANT ALL PRIVILEGES ON DATABASE databaseUsername TO databaseUsername;`);
-}
-exports.setupDatabasePermissions = setupDatabasePermissions;
-//# sourceMappingURL=setupDatabasePermissions.js.map