grada-run 0.0.2 → 0.32.0

package/templates/terraform/database.tf

@@ -0,0 +1,71 @@
+# 1. Isolated Subnets (No Internet Gateway routing)
+resource "aws_subnet" "db_isolated" {
+  count             = 2
+  vpc_id            = aws_vpc.main.id
+  cidr_block        = cidrsubnet(aws_vpc.main.cidr_block, 8, count.index + 10)
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+
+  tags = {
+    Name = "${local.app_name}-db-isolated-${count.index}"
+  }
+}
+
+resource "aws_db_subnet_group" "main" {
+  name       = "${local.app_name}-db-subnet-group"
+  subnet_ids = aws_subnet.db_isolated[*].id
+}
+
+# 2. Database Security Group
+resource "aws_security_group" "rds" {
+  name   = "${local.app_name}-rds-sg"
+  vpc_id = aws_vpc.main.id
+
+  # ONLY allow inbound traffic from the ECS Fargate tasks
+  ingress {
+    from_port       = 5432
+    to_port         = 5432
+    protocol        = "tcp"
+    security_groups = [aws_security_group.ecs_tasks.id]
+  }
+}
+
+# 3. The PostgreSQL Instance
+resource "aws_db_instance" "postgres" {
+  identifier        = "${local.app_name}-db"
+  engine            = "postgres"
+  engine_version    = "16"
+  instance_class    = "db.t4g.micro"
+  allocated_storage = 20
+  storage_encrypted = true
+
+  # Clean up dashes for the database name (e.g. my-project -> my_project)
+  db_name  = replace(local.app_name, "-", "_")
+  username = "dbadmin"
+
+  # AWS automatically creates and manages the secret in Secrets Manager!
+  manage_master_user_password = true
+
+  db_subnet_group_name   = aws_db_subnet_group.main.name
+  vpc_security_group_ids = [aws_security_group.rds.id]
+
+  skip_final_snapshot = true
+  publicly_accessible = false
+}
+
+# 4. IAM Permission for RDS Master Password Secret
+resource "aws_iam_role_policy" "rds_secret_access" {
+  name = "${local.app_name}-rds-secret-policy"
+  role = aws_iam_role.execution_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = ["secretsmanager:GetSecretValue"]
+        Resource = [
+          aws_db_instance.postgres.master_user_secret[0].secret_arn
+        ]
+      }
+    ]
+  })
+}

package/templates/terraform/main-lambda.tf

@@ -0,0 +1,229 @@
+# grada generated infrastructure (Lambda target)
+# Scale-to-zero web service: container image + Lambda Web Adapter, fronted by
+# API Gateway HTTP API v2 and CloudFront. See templates/terraform/main.tf for
+# the ECS Fargate equivalent.
+provider "aws" {
+  region = "{{REGION}}"
+
+  default_tags {
+    tags = {
+      ManagedBy = "grada"
+    }
+  }
+}
+
+# Alias for us-east-1-only services (CloudFront ACM certificates). Lives here
+# — not in domain.tf — so removing a custom domain never orphans the provider
+# configuration Terraform needs to destroy the certificate.
+# tflint-ignore: terraform_unused_declarations
+provider "aws" {
+  alias  = "us_east_1"
+  region = "us-east-1"
+
+  default_tags {
+    tags = {
+      ManagedBy = "grada"
+    }
+  }
+}
+
+locals {
+  # Workspace suffix for PR preview environments (e.g., "-pr-123"). Empty for production.
+  env_suffix = terraform.workspace == "default" ? "" : "-${terraform.workspace}"
+
+  # Dynamic naming variable to prevent collisions
+  app_name = "{{PROJECT_NAME}}${local.env_suffix}"
+}
+
+# --- CloudWatch Logs ---
+resource "aws_cloudwatch_log_group" "app" {
+  name              = "/aws/lambda/${local.app_name}-fn"
+  retention_in_days = 30
+}
+
+# --- ECR Repository (Shared across workspaces) ---
+resource "aws_ecr_repository" "app" {
+  count                = terraform.workspace == "default" ? 1 : 0
+  name                 = "{{PROJECT_NAME}}-repo"
+  # trivy:ignore:AVD-AWS-0031 - Mutable tags allow the CI/CD pipeline to reuse the 'latest' tag for simplified deployments
+  image_tag_mutability = "MUTABLE"
+  force_delete         = true
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+}
+
+# In PR workspaces, fetch the existing production repository
+data "aws_ecr_repository" "existing_app" {
+  count = terraform.workspace != "default" ? 1 : 0
+  name  = "{{PROJECT_NAME}}-repo"
+}
+
+locals {
+  ecr_url = terraform.workspace == "default" ? aws_ecr_repository.app[0].repository_url : data.aws_ecr_repository.existing_app[0].repository_url
+}
+
+# --- IAM: Execution Role ---
+# Kept for addon compatibility (same name as the ECS target). The Lambda
+# function itself assumes the task role below.
+data "aws_iam_policy_document" "ecs_trust" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["ecs-tasks.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "execution_role" {
+  name               = "${local.app_name}-execution-role"
+  assume_role_policy = data.aws_iam_policy_document.ecs_trust.json
+}
+
+resource "aws_iam_role_policy_attachment" "execution_role_policy" {
+  role       = aws_iam_role.execution_role.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
+}
+
+# --- IAM: Task Role (Lambda function role) ---
+# Allows your application code running INSIDE the container to access AWS services.
+# Trusted by both Lambda and ECS task principals so every addon
+# `aws_iam_role_policy` attachment targeting this role works on both targets.
+data "aws_iam_policy_document" "lambda_task_trust" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["lambda.amazonaws.com", "ecs-tasks.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "task_role" {
+  name               = "${local.app_name}-task-role"
+  assume_role_policy = data.aws_iam_policy_document.lambda_task_trust.json
+}
+
+# VPC ENI management plus CloudWatch Logs delivery (this single managed
+# policy includes the AWSLambdaBasicExecutionRole log permissions).
+resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
+  role       = aws_iam_role.task_role.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
+# Allows application code to read the shared Secrets Manager vault at
+# runtime via the APP_SECRETS_ARN environment variable (non-VPC functions
+# reach Secrets Manager directly; VPC-attached functions should prefer
+# plain environment variables injected with `grada add`).
+resource "aws_iam_role_policy" "app_secrets_access" {
+  name = "${local.app_name}-app-secrets-policy"
+  role = aws_iam_role.task_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = ["secretsmanager:GetSecretValue"]
+        Resource = [local.secret_arn]
+      }
+    ]
+  })
+}
+
+# --- Lambda Function (container image + Web Adapter) ---
+resource "aws_lambda_function" "app" {
+  function_name = "${local.app_name}-fn"
+  role          = aws_iam_role.task_role.arn
+  package_type  = "Image"
+  # Lambda requires an image in a private same-account ECR repository.
+  # On Day 0 `grada apply` seeds a minimal placeholder under :latest
+  # (see src/utils/lambda-ecr.js); every CI push then deploys the real image
+  # via `aws lambda update-function-code`, which Terraform intentionally
+  # ignores here so code deploys and `terraform apply` never fight.
+  image_uri     = "${local.ecr_url}:latest"
+  architectures = ["x86_64"]
+  memory_size   = 512
+  timeout       = 30
+
+{{LAMBDA_IMAGE_CONFIG}}
+{{LAMBDA_VPC_CONFIG}}
+  environment {
+    variables = {
+      PORT            = "{{PORT}}"
+      AWS_LWA_PORT    = "{{PORT}}"
+      APP_SECRETS_ARN = local.secret_arn
+{{DB_ENV_VARS}}{{COMPOSE_WEB_ENV_VARS}}
+    }
+  }
+
+  lifecycle {
+    ignore_changes = [image_uri]
+  }
+
+  depends_on = [aws_cloudwatch_log_group.app]
+}
+
+# --- API Gateway HTTP API v2 ---
+resource "aws_apigatewayv2_api" "main" {
+  name          = "${local.app_name}-http-api"
+  protocol_type = "HTTP"
+}
+
+resource "aws_apigatewayv2_integration" "lambda" {
+  api_id                 = aws_apigatewayv2_api.main.id
+  integration_type       = "AWS_PROXY"
+  integration_uri        = aws_lambda_function.app.invoke_arn
+  payload_format_version = "2.0"
+}
+
+# The $default open route is intentional: authentication (if any) lives in the
+# application, matching the public-ALB posture of the ECS target.
+resource "aws_apigatewayv2_route" "default" {
+  api_id    = aws_apigatewayv2_api.main.id
+  route_key = "$default"
+  target    = "integrations/${aws_apigatewayv2_integration.lambda.id}"
+}
+
+resource "aws_apigatewayv2_stage" "default" {
+  api_id      = aws_apigatewayv2_api.main.id
+  name        = "$default"
+  auto_deploy = true
+}
+
+resource "aws_lambda_permission" "apigw" {
+  statement_id  = "AllowAPIGatewayInvoke"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.app.function_name
+  principal     = "apigateway.amazonaws.com"
+  source_arn    = "${aws_apigatewayv2_api.main.execution_arn}/*/*"
+}
+
+# --- Outputs ---
+output "api_gateway_url" {
+  description = "Direct API Gateway HTTP API URL (Bypasses CloudFront/CDN)"
+  value       = aws_apigatewayv2_api.main.api_endpoint
+}
+
+output "ecr_repository_url" {
+  description = "The URL of the ECR repository"
+  value       = local.ecr_url
+}
+
+# --- CloudWatch Alarms ---
+resource "aws_cloudwatch_metric_alarm" "lambda_errors" {
+  alarm_name          = "${local.app_name}-high-lambda-errors"
+  comparison_operator = "GreaterThanThreshold"
+  evaluation_periods  = "2"
+  metric_name         = "Errors"
+  namespace           = "AWS/Lambda"
+  period              = "60"
+  statistic           = "Sum"
+  threshold           = "10"
+  alarm_description   = "Triggers if the Lambda function reports more than 10 errors in 2 minutes."
+
+  dimensions = {
+    FunctionName = aws_lambda_function.app.function_name
+  }
+}

package/templates/terraform/main.tf

@@ -0,0 +1,296 @@
+# grada generated infrastructure
+provider "aws" {
+  region = "{{REGION}}"
+
+  default_tags {
+    tags = {
+      ManagedBy = "grada"
+    }
+  }
+}
+
+# Alias for us-east-1-only services (CloudFront ACM certificates). Lives here
+# — not in domain.tf — so removing a custom domain never orphans the provider
+# configuration Terraform needs to destroy the certificate.
+# tflint-ignore: terraform_unused_declarations
+provider "aws" {
+  alias  = "us_east_1"
+  region = "us-east-1"
+
+  default_tags {
+    tags = {
+      ManagedBy = "grada"
+    }
+  }
+}
+
+locals {
+  # Safely read the keys generated by the CLI, default to empty list if file doesn't exist
+  secret_keys = fileexists("${path.module}/secret_keys.json") ? jsondecode(file("${path.module}/secret_keys.json")) : []
+  
+  # Workspace suffix for PR preview environments (e.g., "-pr-123"). Empty for production.
+  env_suffix = terraform.workspace == "default" ? "" : "-${terraform.workspace}"
+  
+  # Dynamic naming variable to prevent collisions
+  app_name = "{{PROJECT_NAME}}${local.env_suffix}"
+}
+
+# --- CloudWatch Logs ---
+resource "aws_cloudwatch_log_group" "app_logs" {
+  name              = "/ecs/${local.app_name}"
+  retention_in_days = 14
+}
+
+# --- ECR Repository (Shared across workspaces) ---
+resource "aws_ecr_repository" "app" {
+  count                = terraform.workspace == "default" ? 1 : 0
+  name                 = "{{PROJECT_NAME}}-repo"
+  # trivy:ignore:AVD-AWS-0031 - Mutable tags allow the CI/CD pipeline to reuse the 'latest' tag for simplified deployments
+  image_tag_mutability = "MUTABLE"
+  force_delete         = true
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+}
+
+# In PR workspaces, fetch the existing production repository
+data "aws_ecr_repository" "existing_app" {
+  count = terraform.workspace != "default" ? 1 : 0
+  name  = "{{PROJECT_NAME}}-repo"
+}
+
+locals {
+  ecr_url = terraform.workspace == "default" ? aws_ecr_repository.app[0].repository_url : data.aws_ecr_repository.existing_app[0].repository_url
+}
+
+# --- IAM: Execution Role ---
+# Allows the underlying AWS Fargate agent to pull images and push logs
+data "aws_iam_policy_document" "ecs_trust" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["ecs-tasks.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "execution_role" {
+  name               = "${local.app_name}-execution-role"
+  assume_role_policy = data.aws_iam_policy_document.ecs_trust.json
+}
+
+resource "aws_iam_role_policy_attachment" "execution_role_policy" {
+  role       = aws_iam_role.execution_role.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
+}
+
+# --- IAM: Task Role ---
+# Allows your application code running INSIDE the container to access AWS services
+resource "aws_iam_role" "task_role" {
+  name               = "${local.app_name}-task-role"
+  assume_role_policy = data.aws_iam_policy_document.ecs_trust.json
+}
+
+# --- IAM: ECS Exec (SSM) permissions for the task role ---
+# Required for `npx grada-run exec` — lets Fargate open an SSM session.
+resource "aws_iam_role_policy" "ecs_exec" {
+  name = "${local.app_name}-ecs-exec-policy"
+  role = aws_iam_role.task_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "ssmmessages:CreateControlChannel",
+          "ssmmessages:CreateDataChannel",
+          "ssmmessages:OpenControlChannel",
+          "ssmmessages:OpenDataChannel"
+        ]
+        Resource = "*"
+      }
+    ]
+  })
+}
+
+# --- ECS Cluster ---
+resource "aws_ecs_cluster" "main" {
+  name = "${local.app_name}-cluster"
+}
+
+# --- ECS Task Definition ---
+resource "aws_ecs_task_definition" "app" {
+  family                   = "${local.app_name}-task"
+  network_mode             = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  cpu                      = "{{CPU}}"
+  memory                   = "{{MEMORY}}"
+  execution_role_arn       = aws_iam_role.execution_role.arn
+  task_role_arn            = aws_iam_role.task_role.arn
+
+  container_definitions = jsonencode([
+    {
+      name      = "${local.app_name}-container"
+      image     = "${local.ecr_url}:${terraform.workspace == "default" ? "latest" : terraform.workspace}"
+      essential = true
+
+      environment = [
+        {{COMPOSE_WEB_ENV_VARS}}
+        {{DB_ENV_VARS}}
+      ]
+
+      # Dynamically map every secret key found in the local JSON file
+      secrets = concat(
+        [
+          for key in local.secret_keys : {
+            name      = key
+            valueFrom = "${local.secret_arn}:${key}::"
+          }
+        ],
+        [
+          {{TASK_SECRETS}}
+        ]
+      )
+      
+      {{TASK_COMMAND}}
+
+      portMappings = [
+        {
+          containerPort = {{PORT}}
+          hostPort      = {{PORT}}
+          protocol      = "tcp"
+        }
+      ]
+
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          "awslogs-group"         = aws_cloudwatch_log_group.app_logs.name
+          "awslogs-region"        = "{{REGION}}"
+          "awslogs-stream-prefix" = "ecs"
+        }
+      }
+    }{{EXTRA_CONTAINERS}}
+  ])
+}
+
+# --- Application Load Balancer ---
+# trivy:ignore:AVD-AWS-0053 - This ALB is intended to be publicly facing behind CloudFront
+resource "aws_lb" "main" {
+  name               = substr("${local.app_name}-alb", 0, 32)
+  load_balancer_type = "application"
+  security_groups    = [aws_security_group.alb.id]
+  subnets            = aws_subnet.public[*].id
+  drop_invalid_header_fields = true
+}
+
+resource "aws_lb_target_group" "app" {
+  name        = substr("${local.app_name}-tg", 0, 32)
+  port        = {{PORT}}
+  protocol    = "HTTP"
+  vpc_id      = aws_vpc.main.id
+  target_type = "ip"
+
+  health_check {
+    path                = "{{HEALTH_CHECK_PATH}}"
+    matcher             = "200-399"
+    interval            = 30
+    timeout             = 5
+    healthy_threshold   = 2
+    unhealthy_threshold = 3
+  }
+}
+
+# trivy:ignore:AVD-AWS-0054 - CloudFront handles HTTPS edge termination; ALB uses HTTP to avoid complex ACM DNS validation for users
+resource "aws_lb_listener" "http" {
+  load_balancer_arn = aws_lb.main.arn
+  port              = "80"
+  protocol          = "HTTP"
+
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.app.arn
+  }
+}
+
+# --- ECS Service ---
+resource "aws_ecs_service" "app" {
+  name                   = "${local.app_name}-service"
+  cluster                = aws_ecs_cluster.main.id
+  task_definition        = aws_ecs_task_definition.app.arn
+  launch_type            = "FARGATE"
+  desired_count          = {{DESIRED_COUNT}}
+  enable_execute_command = true
+
+  deployment_circuit_breaker {
+    enable   = true
+    rollback = true
+  }
+
+  # Code-only deploys register new task definition revisions outside
+  # Terraform (see .github/workflows/deploy.yml). Without this, the next
+  # `terraform apply` would revert the service to the revision in state.
+  lifecycle {
+    ignore_changes = [task_definition]
+  }
+
+  network_configuration {
+    subnets          = aws_subnet.public[*].id
+    security_groups  = [aws_security_group.ecs_tasks.id]
+    assign_public_ip = true 
+  }
+
+  load_balancer {
+    target_group_arn = aws_lb_target_group.app.arn
+    container_name   = "${local.app_name}-container"
+    container_port   = {{PORT}}
+  }
+
+  depends_on = [aws_lb_listener.http]
+}
+
+# Allow the ECS agent to read the specific secret from Secrets Manager
+resource "aws_iam_role_policy" "secrets_policy" {
+  name   = "{{PROJECT_NAME}}-secrets-policy"
+  role   = aws_iam_role.execution_role.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = ["secretsmanager:GetSecretValue"]
+        Resource = [local.secret_arn]
+      }
+    ]
+  })
+}
+
+# --- Outputs ---
+output "alb_direct_url" {
+  description = "Direct Load Balancer URL (Bypasses CloudFront/CDN)"
+  value       = "http://${aws_lb.main.dns_name}"
+}
+
+output "ecr_repository_url" {
+  description = "The URL of the ECR repository"
+  value       = local.ecr_url
+}
+
+# --- CloudWatch Alarms ---
+resource "aws_cloudwatch_metric_alarm" "alb_5xx_errors" {
+  alarm_name          = "${local.app_name}-high-5xx-errors"
+  comparison_operator = "GreaterThanThreshold"
+  evaluation_periods  = "2"
+  metric_name         = "HTTPCode_Target_5XX_Count"
+  namespace           = "AWS/ApplicationELB"
+  period              = "60"
+  statistic           = "Sum"
+  threshold           = "10"
+  alarm_description   = "Triggers if the ALB receives more than 10 5XX errors in 2 minutes."
+  
+  dimensions = {
+    LoadBalancer = aws_lb.main.arn_suffix
+  }
+}

package/templates/terraform/network.tf

@@ -0,0 +1,95 @@
+# --- VPC & Networking ---
+resource "aws_vpc" "main" {
+  cidr_block           = "10.0.0.0/16"
+  enable_dns_hostnames = true
+  enable_dns_support   = true
+
+  tags = {
+    Name = "${local.app_name}-vpc"
+  }
+}
+
+# Fetch available zones in the current region
+data "aws_availability_zones" "available" {
+  state = "available"
+}
+
+resource "aws_internet_gateway" "main" {
+  vpc_id = aws_vpc.main.id
+}
+
+# Create 2 Public Subnets
+# trivy:ignore:AVD-AWS-0164 - Public subnets are used to avoid the $30/mo cost of a NAT Gateway for outbound container traffic
+resource "aws_subnet" "public" {
+  count                   = 2
+  vpc_id                  = aws_vpc.main.id
+  cidr_block              = cidrsubnet(aws_vpc.main.cidr_block, 8, count.index)
+  availability_zone       = data.aws_availability_zones.available.names[count.index]
+  map_public_ip_on_launch = true
+
+  tags = {
+    Name = "${local.app_name}-public-subnet-${count.index + 1}"
+  }
+}
+
+# Route internet traffic through the Gateway
+resource "aws_route_table" "public" {
+  vpc_id = aws_vpc.main.id
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.main.id
+  }
+}
+
+resource "aws_route_table_association" "public" {
+  count          = 2
+  subnet_id      = aws_subnet.public[count.index].id
+  route_table_id = aws_route_table.public.id
+}
+
+# --- Security Groups ---
+# ALB SG: Allow public internet access on HTTP
+resource "aws_security_group" "alb" {
+  name        = "${local.app_name}-alb-sg"
+  description = "Allow inbound HTTP to ALB"
+  vpc_id      = aws_vpc.main.id
+
+  ingress {
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    # trivy:ignore:AVD-AWS-0104 - Allow ALB to route out to standard AWS services
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+# ECS SG: Allow traffic ONLY from the ALB on the app's specific port
+resource "aws_security_group" "ecs_tasks" {
+  name        = "${local.app_name}-ecs-sg"
+  description = "Allow inbound access from the ALB only"
+  vpc_id      = aws_vpc.main.id
+
+  ingress {
+    from_port       = {{PORT}}
+    to_port         = {{PORT}}
+    protocol        = "tcp"
+    security_groups = [aws_security_group.alb.id]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    # trivy:ignore:AVD-AWS-0104 - Allow containers to pull images and hit external APIs
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+{{VERCEL_EDGE_ROUTING}}