deploy-stack 0.4.0 → 0.6.0

package/README.md

@@ -33,6 +33,8 @@ You retain complete ownership of your infrastructure code without relying on bla
 * **Remote State with Native S3 Locking:** Automatically creates an encrypted S3 state bucket utilizing modern native S3 concurrency locking.
 * **Built-in Secrets Sync:** Provides a dedicated CLI workflow to securely push local `.env` variables into AWS Secrets Manager and map them directly into containers at runtime.
 * **Non-Destructive:** Safely analyzes existing directories and prompts for confirmation before updating any files.
+* **Zero-Config Detection:** Automatically resolves output directories for Vite, Astro, SvelteKit, CRA, and more.
+* **Safe Teardown:** Completely remove all generated AWS resources and empty S3 state buckets with a single `destroy` command.
 
 ---
 
@@ -81,6 +83,12 @@ npx deploy-stack secrets push .env.production
 
 ---
 
+## 🗑️ Infrastructure Teardown
+To safely completely remove your ECS cluster, load balancers, and empty the remote S3 state bucket, run:
+`npx deploy-stack destroy`
+
+---
+
 ## 📁 Generated File Structure
 
 Running the CLI generates a modular architecture tailored to your service:

package/bin/cli.js

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import path from 'path';
+import { mainStack } from '../src/commands/init.js';
+import { destroyStack } from '../src/commands/destroy.js';
 import { runDoctor } from '../src/commands/doctor.js';
 import { pushSecrets } from '../src/commands/secrets.js';
-import { mainStack } from '../src/commands/init.js';
 
 // 1. Extract the telemetry flag and set the environment variable
 const rawArgs = process.argv.slice(2);
@@ -22,6 +23,8 @@ if (args[0] === 'secrets' && args[1] === 'push') {
     pushSecrets(envFile, projectName).catch(console.error);
 } else if (args[0] === 'doctor') {
     runDoctor().catch(console.error);
+} else if (args[0] === 'destroy') {
+    destroyStack().catch(console.error);
 } else {
     mainStack().catch(console.error);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploy-stack",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Provision production-ready AWS infrastructure and CI/CD pipelines in seconds.",
   "type": "module",
   "bin": {

package/src/commands/destroy.js

@@ -0,0 +1,77 @@
+import fsSync from 'fs';
+import path from 'path';
+import { intro, outro, confirm, spinner, cancel } from '@clack/prompts';
+import color from 'picocolors';
+import { execSync } from 'child_process';
+import { teardownStateBucket } from '../utils/aws.js';
+import { checkDependency } from '../utils/system.js';
+import { trackEvent, flushTelemetry } from '../core/telemetry.js';
+
+export async function destroyStack() {
+    intro(color.bgRed(color.white(' deploy-stack destroy 🗑️  ')));
+
+    const tfDirPath = path.join(process.cwd(), 'terraform');
+    const backendFilePath = path.join(tfDirPath, 'backend.tf');
+
+    if (!fsSync.existsSync(backendFilePath)) {
+        console.error(color.red('✖ No terraform/backend.tf found in the current directory.'));
+        console.log(color.yellow('Are you in the root of a deploy-stack project?'));
+        process.exit(1);
+    }
+
+    const hasTerraform = await checkDependency('terraform');
+    if (!hasTerraform) {
+        console.error(color.red('✖ Terraform is not installed.'));
+        process.exit(1);
+    }
+
+    const proceed = await confirm({
+        message: color.red('⚠️  WARNING: This will permanently destroy all AWS resources associated with this project. Are you absolutely sure?'),
+        initialValue: false,
+    });
+
+    if (!proceed) {
+        cancel('Destruction cancelled. Your infrastructure is safe.');
+        process.exit(0);
+    }
+
+    const s = spinner();
+
+    // 1. Extract Bucket and Region from backend.tf
+    const backendContent = fsSync.readFileSync(backendFilePath, 'utf-8');
+    const bucketMatch = backendContent.match(/bucket\s*=\s*"([^"]+)"/);
+    const regionMatch = backendContent.match(/region\s*=\s*"([^"]+)"/);
+
+    const bucketName = bucketMatch ? bucketMatch[1] : null;
+    const region = regionMatch ? regionMatch[1] : 'us-east-1';
+
+    // 2. Execute Terraform Destroy
+    console.log(color.cyan('\nInitiating Terraform destroy (this may take a few minutes)...\n'));
+    try {
+        execSync('terraform destroy -auto-approve', { cwd: tfDirPath, stdio: 'inherit' });
+    } catch (error) {
+        console.error(color.red('\n✖ Terraform destroy failed. Please check the output above.'));
+        process.exit(1);
+    }
+
+    // 3. Clean up the S3 State Bucket
+    if (bucketName) {
+        s.start(`Emptying and deleting S3 state bucket: ${bucketName}...`);
+        try {
+            await teardownStateBucket(region, bucketName);
+            s.stop(`S3 bucket ${bucketName} successfully deleted.`);
+        } catch (error) {
+            s.stop(`❌ Failed to delete S3 bucket. You may need to delete it manually in the AWS Console.`);
+            console.error(color.red(`AWS Error: ${error.message}`));
+        }
+    }
+
+    trackEvent('project_destroyed', {
+        region,
+        bucket: bucketName,
+        success: true
+    });
+    await flushTelemetry();
+
+    outro(color.green('✅ Infrastructure successfully destroyed. Your AWS bill is safe.'));
+}

package/src/commands/init.js

@@ -232,6 +232,7 @@ export async function mainStack() {
     trackEvent('project_provisioned', {
         projectName: actualProjectName,
         framework: finalFramework,
+        specific_framework: detectedFramework?.name || finalFramework,
         region: project.region,
         size: project.size,
         setup_mode: setupType,
@@ -260,6 +261,11 @@ export async function mainStack() {
     outro(`
     ${color.green('✅ Project provisioned successfully!')}
 
+    ${color.blue('🛡️ DevSecOps Enabled:')}
+       Automated Trivy vulnerability scanning for your Docker container 
+       and Terraform has been added to your CI/CD pipeline. 
+       Check the 'Summary' page of your GitHub Actions runs for reports.
+
     ${frameworkWarnings}
     
     Next steps:

package/src/utils/aws.js

@@ -1,5 +1,6 @@
 import { STSClient, GetCallerIdentityCommand } from '@aws-sdk/client-sts';
-import { S3Client, CreateBucketCommand, PutBucketVersioningCommand } from '@aws-sdk/client-s3';
+import { S3Client, CreateBucketCommand, PutBucketVersioningCommand, PutBucketTaggingCommand } from '@aws-sdk/client-s3';
+import { DeleteBucketCommand, ListObjectVersionsCommand, DeleteObjectsCommand } from "@aws-sdk/client-s3";
 
 export async function provisionStateBucket(region, projectName) {
     const stsClient = new STSClient({ region });
@@ -23,6 +24,15 @@ export async function provisionStateBucket(region, projectName) {
             CreateBucketConfiguration: region === 'us-east-1' ? undefined : { LocationConstraint: region }
         }));
 
+        await s3Client.send(new PutBucketTaggingCommand({
+            Bucket: stateBucketName,
+            Tagging: {
+                TagSet: [
+                    { Key: "ManagedBy", Value: "deploy-stack" }
+                ]
+            }
+        }));
+
         await s3Client.send(new PutBucketVersioningCommand({
             Bucket: stateBucketName,
             VersioningConfiguration: { Status: 'Enabled' }
@@ -35,4 +45,36 @@ export async function provisionStateBucket(region, projectName) {
     }
 
     return { awsAccountId, stateBucketName };
+}
+
+export async function teardownStateBucket(region, bucketName) {
+    const client = new S3Client({ region });
+
+    try {
+        // 1. Fetch all object versions and delete markers
+        const listCommand = new ListObjectVersionsCommand({ Bucket: bucketName });
+        const { Versions, DeleteMarkers } = await client.send(listCommand);
+
+        const objectsToDelete = [];
+        if (Versions) objectsToDelete.push(...Versions.map(v => ({ Key: v.Key, VersionId: v.VersionId })));
+        if (DeleteMarkers) objectsToDelete.push(...DeleteMarkers.map(v => ({ Key: v.Key, VersionId: v.VersionId })));
+
+        // 2. Delete all contents if any exist
+        if (objectsToDelete.length > 0) {
+            const deleteCommand = new DeleteObjectsCommand({
+                Bucket: bucketName,
+                Delete: { Objects: objectsToDelete }
+            });
+            await client.send(deleteCommand);
+        }
+
+        // 3. Delete the now-empty bucket
+        const deleteBucketCommand = new DeleteBucketCommand({ Bucket: bucketName });
+        await client.send(deleteBucketCommand);
+
+        return true;
+    } catch (error) {
+        if (error.name === 'NoSuchBucket') return true; // Already deleted
+        throw error;
+    }
 }

package/templates/README.md

@@ -29,7 +29,7 @@ This infrastructure provisions a highly available Application Load Balancer (ALB
    ```
 
 3. **Automated CI/CD (Keyless via OIDC):**
-   Push this repository to GitHub. Your deployment pipeline uses AWS IAM OpenID Connect (OIDC) to authenticate securely with temporary credentials—**no long-lived AWS secret keys are required in GitHub Secrets**. Every push to `main` will automatically build, package, and deploy your application.
+   Push this repository to GitHub. Your deployment pipeline uses AWS IAM OpenID Connect (OIDC) to authenticate securely with temporary credentials—**no long-lived AWS secret keys are required in GitHub Secrets**. Every push to `{{DEPLOY_BRANCH}}` will automatically build, package, and deploy your application.
 
 ### ⚠️ Troubleshooting: OIDC Provider Already Exists
 AWS only permits one GitHub Actions OIDC provider per AWS account. If `terraform apply` fails with an `EntityAlreadyExists` error regarding the OIDC provider, it indicates GitHub Actions was previously configured in this account.
@@ -48,13 +48,11 @@ Re-run `terraform apply` to link directly to your existing provider.
 
 If you are done testing and want to stop all AWS billing, you must destroy the infrastructure. 
 
-Because our Terraform configuration is set to force-delete the ECR image repository (even if images are present), teardown is a single, clean command:
-
+Run the automated teardown command from the root of your project:
 ```bash
-cd terraform
-terraform destroy
+npx deploy-stack destroy
 ```
-*Type `yes` when prompted. This will permanently delete the Load Balancer, ECS cluster, log groups, and associated networking components.*
+*Type `yes` when prompted. This will execute a safe Terraform teardown of your Load Balancer, ECS cluster, and networking components, followed by automatically emptying and deleting your remote S3 state bucket.*
 
 ## ⚠️ Critical Application Prerequisites
 
@@ -94,8 +92,19 @@ Make sure your app is configured correctly:
 * **Express.js:** `app.listen(port, '0.0.0.0', () => ...)`
 * **FastAPI:** `uvicorn.run(app, host="0.0.0.0", port=8000)`
 
-### 4. Static Sites (Vite, Astro, React, Vue)
+### 4. Static Sites (Vite, Astro, React, Vue, SvelteKit)
 
 If you are deploying a static site, your application is served via a highly optimized, unprivileged Nginx container. 
-1. **Build Folder:** Different frameworks output compiled assets to different folders. Open your `Dockerfile` and ensure the `COPY --from=builder` command points to the correct folder (`dist`, `build`, or `out`).
-2. **Health Checks:** You do not need to configure a custom `/health` route. Nginx will automatically return a `200 OK` when AWS pings the root `/` index page.
+* **Zero-Config Build:** The CLI automatically detected your framework's output folder (`dist`, `build`, etc.) and pre-configured your Dockerfile. 
+* **Health Checks:** You do not need to configure a custom `/health` route. Nginx will automatically return a `200 OK` when AWS pings the root `/` index page.
+
+## 🛡️ Security Scanning
+
+This pipeline includes automated DevSecOps guardrails using [Trivy](https://trivy.dev/). 
+Every time you push code, the pipeline will scan both your Docker container and your 
+Terraform configurations for vulnerabilities and misconfigurations. 
+
+To view the security reports:
+1. Navigate to the **Actions** tab in GitHub.
+2. Click on the latest deployment run.
+3. Scroll down the **Summary** page to view the generated vulnerability tables.

package/templates/docker/nextjs.Dockerfile

@@ -21,10 +21,17 @@ ENV NODE_ENV=production
 ENV PORT={{PORT}}
 ENV HOSTNAME="0.0.0.0"
 
-# Copy the standalone output from the builder stage
-COPY --from=builder /app/.next/standalone ./
-COPY --from=builder /app/.next/static ./.next/static
-COPY --from=builder /app/public ./public
+# Create an unprivileged user and group
+RUN addgroup -g 1001 -S nodejs && \
+    adduser -S nextjs -u 1001 -G nodejs
+
+# Copy the standalone output and assign ownership to the unprivileged user
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+
+# Switch to the unprivileged user before executing
+USER nextjs
 
 EXPOSE {{PORT}}
 

package/templates/docker/node.Dockerfile

@@ -5,16 +5,14 @@ ENV NODE_ENV=production
 
 WORKDIR /app
 
-# 2. Copy only dependency files first to cache the npm install layer
-COPY package*.json ./
+# 2. Copy dependency manifests with non-root ownership
+COPY --chown=node:node package*.json ./
+RUN npm ci --omit=dev
 
-# 3. Use npm ci for strict, deterministic, and faster CI/CD installs
-RUN npm ci
+# 3. Copy application code with non-root ownership
+COPY --chown=node:node . .
 
-# 4. Copy the rest of the application source code
-COPY . .
-
-# 5. DevSecOps best practice: do not run the container as root
+# 4. DevSecOps best practice: do not run the container as root
 USER node
 
 EXPOSE {{PORT}}

package/templates/docker/python.Dockerfile

@@ -13,10 +13,8 @@ RUN adduser --disabled-password --gecos '' appuser
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY . .
-
-# Secure file permissions
-RUN chown -R appuser:appuser /app
+# Copy with ownership
+COPY --chown=appuser:appuser . .
 
 # Drop root privileges
 USER appuser

package/templates/docker/static.Dockerfile

@@ -11,7 +11,7 @@ COPY . .
 RUN npm run build
 
 # STAGE 2: Serve with Hardened Nginx
-FROM nginx:alpine
+FROM nginxinc/nginx-unprivileged:alpine
 
 # Adjusts BUILD_DIR to match your framework's output folder
 COPY --from=builder /app/{{BUILD_DIR}} /usr/share/nginx/html
@@ -28,18 +28,5 @@ RUN echo "server {" > /etc/nginx/conf.d/default.conf && \
     echo "    }" >> /etc/nginx/conf.d/default.conf && \
     echo "}" >> /etc/nginx/conf.d/default.conf
 
-# Silence unprivileged user directive warning in main config
-RUN sed -i 's/^user\s\+nginx;/# user nginx;/' /etc/nginx/nginx.conf
-
-# DevSecOps Hardening: Drop root privileges for the Nginx process
-RUN chown -R nginx:nginx /usr/share/nginx/html && \
-    chown -R nginx:nginx /var/cache/nginx && \
-    chown -R nginx:nginx /var/log/nginx && \
-    chown -R nginx:nginx /etc/nginx/conf.d && \
-    touch /var/run/nginx.pid && \
-    chown -R nginx:nginx /var/run/nginx.pid
-
-USER nginx
-
 EXPOSE {{PORT}}
 CMD ["nginx", "-g", "daemon off;"]

package/templates/github/deploy.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches:
       - {{DEPLOY_BRANCH}}
+    schedule:
+    - cron: '0 0 * * 0'
 
 env:
   AWS_REGION: {{REGION}}
@@ -24,6 +26,29 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@v4
 
+      # --- 1. IaC SECURITY SCAN ---
+      - name: Scan Terraform for Misconfigurations
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          scan-ref: 'terraform/'
+          scanners: 'vuln,secret,misconfig'
+          format: 'table'
+          exit-code: '0' # Informational only, will not break the build
+          severity: 'CRITICAL,HIGH'
+          output: 'trivy-iac-summary.txt'
+
+      - name: Publish IaC Summary
+        if: always()
+        run: |
+          if [ -f trivy-iac-summary.txt ]; then
+            echo "### 🏗️ Terraform Misconfiguration Scan" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            cat trivy-iac-summary.txt >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+          fi
+
+      # --- 2. DEPLOYMENT PREP ---
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
@@ -34,13 +59,43 @@ jobs:
         id: login-ecr
         uses: aws-actions/amazon-ecr-login@v2
 
-      - name: Build, tag, and push image to Amazon ECR
+      # --- 3. BUILD ---
+      - name: Build Docker image
         id: build-image
         env:
           ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
           IMAGE_TAG: latest
         run: |
           docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
+
+      # --- 4. CONTAINER SECURITY SCAN ---
+      - name: Scan Container for Vulnerabilities (SARIF Output)
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: '${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:latest'
+          format: 'table'
+          output: 'trivy-container-summary.txt'
+          exit-code: '0' # Informational only, will not break the build
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
+
+      - name: Publish Container Summary
+        if: always()
+        run: |
+          if [ -f trivy-container-summary.txt ]; then
+            echo "### 🛡️ Container Security Scan Results" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            cat trivy-container-summary.txt >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+          fi
+
+      # --- 5. DEPLOY ---
+      - name: Push image to Amazon ECR
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          IMAGE_TAG: latest
+        run: |
           docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
           echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
 

package/templates/terraform/cloudfront.tf

@@ -8,6 +8,7 @@ data "aws_cloudfront_origin_request_policy" "all_viewer" {
   name = "Managed-AllViewerExceptHostHeader"
 }
 
+# trivy:ignore:AVD-AWS-0011 - WAF is omitted by default to prevent unexpected monthly costs for users
 resource "aws_cloudfront_distribution" "cdn" {
   enabled             = true
   is_ipv6_enabled     = true

package/templates/terraform/main.tf

@@ -17,8 +17,13 @@ resource "aws_cloudwatch_log_group" "app_logs" {
 # --- ECR Repository ---
 resource "aws_ecr_repository" "app" {
   name                 = "{{PROJECT_NAME}}-repo"
+  # trivy:ignore:AVD-AWS-0031 - Mutable tags allow the CI/CD pipeline to reuse the 'latest' tag for simplified deployments
   image_tag_mutability = "MUTABLE"
   force_delete         = true
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
 }
 
 # --- IAM: Execution Role ---
@@ -100,11 +105,13 @@ resource "aws_ecs_task_definition" "app" {
 }
 
 # --- Application Load Balancer ---
+# trivy:ignore:AVD-AWS-0053 - This ALB is intended to be publicly facing behind CloudFront
 resource "aws_lb" "main" {
   name               = "{{PROJECT_NAME}}-alb"
   load_balancer_type = "application"
   security_groups    = [aws_security_group.alb.id]
   subnets            = aws_subnet.public[*].id
+  drop_invalid_header_fields = true
 }
 
 resource "aws_lb_target_group" "app" {
@@ -124,6 +131,7 @@ resource "aws_lb_target_group" "app" {
   }
 }
 
+# trivy:ignore:AVD-AWS-0054 - CloudFront handles HTTPS edge termination; ALB uses HTTP to avoid complex ACM DNS validation for users
 resource "aws_lb_listener" "http" {
   load_balancer_arn = aws_lb.main.arn
   port              = "80"

package/templates/terraform/network.tf

@@ -19,6 +19,7 @@ resource "aws_internet_gateway" "main" {
 }
 
 # Create 2 Public Subnets
+# trivy:ignore:AVD-AWS-0164 - Public subnets are used to avoid the $30/mo cost of a NAT Gateway for outbound container traffic
 resource "aws_subnet" "public" {
   count                   = 2
   vpc_id                  = aws_vpc.main.id
@@ -64,6 +65,7 @@ resource "aws_security_group" "alb" {
     from_port   = 0
     to_port     = 0
     protocol    = "-1"
+    # trivy:ignore:AVD-AWS-0104 - Allow ALB to route out to standard AWS services
     cidr_blocks = ["0.0.0.0/0"]
   }
 }
@@ -85,6 +87,7 @@ resource "aws_security_group" "ecs_tasks" {
     from_port   = 0
     to_port     = 0
     protocol    = "-1"
+    # trivy:ignore:AVD-AWS-0104 - Allow containers to pull images and hit external APIs
     cidr_blocks = ["0.0.0.0/0"]
   }
 }