stacks 0.58.73 → 0.59.2

package/core/cloud/src/cloud/search-engine.ts

@@ -1,108 +0,0 @@
-// async manageSearchEngine() {
-//   const vpc = this.vpc
-
-//   // Security Group
-//   const bastionSecurityGroup = new ec2.SecurityGroup(this, 'BastionSecurityGroup', {
-//     vpc,
-//     allowAllOutbound: true,
-//     securityGroupName: `${this.appName}-${appEnv}-bastion-sg`,
-//   })
-
-//   const opensearchSecurityGroup = new ec2.SecurityGroup(this, 'OpenSearchSecurityGroup', {
-//     vpc,
-//     securityGroupName: `${this.appName}-${appEnv}-opensearch-sg`,
-//   })
-
-//   opensearchSecurityGroup.addIngressRule(bastionSecurityGroup, ec2.Port.tcp(443))
-
-//   // Service-linked role that Amazon OpenSearch Service will use
-//   const iamClient = new IAMClient({})
-//   const response = await iamClient.send(
-//     new ListRolesCommand({
-//       PathPrefix: '/aws-service-role/opensearchservice.amazonaws.com/',
-//     }),
-//   )
-
-//   // Only if the role for OpenSearch Service doesn't exist, it will be created.
-//   if (response.Roles && response.Roles?.length === 0) {
-//     new iam.CfnServiceLinkedRole(this, 'OpenSearchServiceLinkedRole', {
-//       awsServiceName: 'es.amazonaws.com',
-//     })
-//   }
-
-//   // Bastion host to access Opensearch Dashboards
-//   new ec2.BastionHostLinux(this, 'BastionHost', {
-//     vpc,
-//     securityGroup: bastionSecurityGroup,
-//     machineImage: ec2.MachineImage.latestAmazonLinux2023(),
-//     blockDevices: [
-//       {
-//         deviceName: '/dev/xvda',
-//         volume: ec2.BlockDeviceVolume.ebs(10, {
-//           encrypted: true,
-//         }),
-//       },
-//     ],
-//   })
-
-//   // OpenSearch domain
-//   const domain = new opensearch.Domain(this, 'OpenSearchDomain', {
-//     version: opensearch.EngineVersion.OPENSEARCH_2_9,
-//     nodeToNodeEncryption: true,
-//     enforceHttps: true,
-//     encryptionAtRest: {
-//       enabled: true,
-//     },
-//     vpc,
-//     // unsure if there are "better" ways to do this
-//     vpcSubnets: [
-//       { subnetGroupName: `${this.appName}-${appEnv}-private-subnet-1` },
-//       { subnetGroupName: `${this.appName}-${appEnv}-private-subnet-2` },
-//     ],
-
-//     capacity: {
-//       masterNodes: 2,
-//       dataNodes: 2,
-//       multiAzWithStandbyEnabled: true,
-//     },
-//     ebs: {
-//       volumeSize: 10,
-//       volumeType: ec2.EbsDeviceVolumeType.GP3, // or opensearch.EbsVolumeType.IO1
-//     },
-//     removalPolicy: RemovalPolicy.DESTROY,
-//     zoneAwareness: {
-//       enabled: true,
-//       availabilityZoneCount: 2,
-//     },
-//     securityGroups: [opensearchSecurityGroup],
-//   })
-
-//   domain.addAccessPolicies(
-//     new iam.PolicyStatement({
-//       principals: [new iam.AnyPrincipal()],
-//       actions: ['es:ESHttp*'],
-//       resources: [`${domain.domainArn}/*`],
-//     }),
-//   )
-
-//   // // Lambda
-//   // const dataIndexFunction = PythonFunction(this, 'DataIndex', {
-//   //   runtime: lambda.Runtime.PYTHON_3_10,
-//   //   entry: 'lambda',
-//   //   vpc,
-//   //   environment: {
-//   //     OPENSEARCH_HOST: domain.domainEndpoint,
-//   //   },
-//   // })
-
-//   // domain.connections.allowFrom(dataIndexFunction, Port.tcp(443))
-
-//   // Outputs
-//   new Output(this, 'OpenSearchDomainHost', {
-//     value: domain.domainEndpoint,
-//   })
-
-//   // new Output(this, 'IndexingFunctionName', {
-//   //   value: dataIndexFunction.functionName,
-//   // })
-// }

package/core/cloud/src/cloud/security.ts

@@ -1,259 +0,0 @@
-// waf and encryption
-import { config } from '@stacksjs/config'
-import type { aws_route53 as route53 } from 'aws-cdk-lib'
-import { Duration, RemovalPolicy, Tags, aws_certificatemanager as acm, aws_kms as kms, aws_wafv2 as wafv2 } from 'aws-cdk-lib'
-import type { Construct } from 'constructs'
-import type { NestedCloudProps } from '../types'
-
-export interface StorageStackProps extends NestedCloudProps {
-  zone: route53.IHostedZone
-}
-
-export class SecurityStack {
-  firewall: wafv2.CfnWebACL
-  kmsKey: kms.Key
-  certificate: acm.Certificate
-
-  constructor(scope: Construct, props: StorageStackProps) {
-    const firewallOptions = config.cloud.firewall
-
-    if (!firewallOptions)
-      throw new Error('No firewall options found in config')
-
-    const options = {
-      defaultAction: { allow: {} },
-      scope: 'CLOUDFRONT',
-      visibilityConfig: {
-        sampledRequestsEnabled: true,
-        cloudWatchMetricsEnabled: true,
-        metricName: 'firewallMetric',
-      },
-      rules: this.getFirewallRules(),
-    }
-
-    this.firewall = new wafv2.CfnWebACL(scope, 'StacksWebFirewall', options)
-    Tags.of(this.firewall).add('Name', 'waf-cloudfront', { priority: 300 })
-    Tags.of(this.firewall).add('Purpose', 'CloudFront', { priority: 300 })
-    Tags.of(this.firewall).add('CreatedBy', 'CloudFormation', { priority: 300 })
-
-    this.kmsKey = new kms.Key(scope, 'EncryptionKey', {
-      alias: 'stacks-encryption-key',
-      description: 'KMS key for Stacks Cloud',
-      enableKeyRotation: true,
-      removalPolicy: RemovalPolicy.DESTROY,
-      pendingWindow: Duration.days(30),
-    })
-
-    this.certificate = new acm.Certificate(scope, 'Certificate', {
-      domainName: props.domain,
-      validation: acm.CertificateValidation.fromDns(props.zone),
-      subjectAlternativeNames: [`www.${props.domain}`, `api.${props.domain}`],
-    })
-  }
-
-  getFirewallRules() {
-    const rules: wafv2.CfnWebACL.RuleProperty[] = []
-    const priorities = []
-
-    if (config.security.firewall?.countryCodes?.length) {
-      priorities.push(1)
-      rules.push({
-        name: 'CountryRule',
-        priority: priorities.length,
-        statement: {
-          geoMatchStatement: {
-            countryCodes: config.security.firewall.countryCodes,
-          },
-        },
-        action: {
-          block: {},
-        },
-        visibilityConfig: {
-          sampledRequestsEnabled: true,
-          cloudWatchMetricsEnabled: true,
-          metricName: 'CountryRule',
-        },
-      })
-    }
-
-    if (config.security.firewall?.ipAddresses?.length) {
-      const ipSet = new wafv2.CfnIPSet(this, 'IpSet', {
-        name: 'IpSet',
-        description: 'IP Set',
-        scope: 'CLOUDFRONT',
-        addresses: config.security.firewall.ipAddresses,
-        ipAddressVersion: 'IPV4',
-      })
-
-      priorities.push(1)
-      rules.push({
-        name: 'IpAddressRule',
-        priority: priorities.length,
-        statement: {
-          ipSetReferenceStatement: {
-            arn: ipSet.attrArn,
-          },
-        },
-        action: {
-          block: {},
-        },
-        visibilityConfig: {
-          sampledRequestsEnabled: true,
-          cloudWatchMetricsEnabled: true,
-          metricName: 'IpAddressRule',
-        },
-      })
-    }
-
-    if (config.security.firewall?.httpHeaders?.length) {
-      config.security.firewall.httpHeaders.forEach((header, index) => {
-        priorities.push(1)
-        rules.push({
-          name: `HttpHeaderRule${index}`,
-          priority: priorities.length,
-          statement: {
-            byteMatchStatement: {
-              fieldToMatch: {
-                singleHeader: {
-                  name: header,
-                },
-              },
-              positionalConstraint: 'EXACTLY',
-              searchString: 'true',
-              textTransformations: [
-                {
-                  priority: index,
-                  type: 'NONE',
-                },
-              ],
-            },
-          },
-          action: {
-            block: {},
-          },
-          visibilityConfig: {
-            sampledRequestsEnabled: true,
-            cloudWatchMetricsEnabled: true,
-            metricName: `HttpHeaderRule${index}`,
-          },
-        })
-      })
-    }
-
-    // if (config.security.firewall?.queryString?.length) {
-    //   priorities.push(1)
-    //   rules.push({
-    //     name: 'QueryStringRule',
-    //     priority: priorities.length,
-    //     statement: {
-    //       byteMatchStatement: {
-    //         fieldToMatch: {
-    //           queryString: {},
-    //         },
-    //         positionalConstraint: 'EXACTLY',
-    //         searchString: config.security.firewall.queryString.join(', '),
-    //         textTransformations: [
-    //           {
-    //             priority: 0,
-    //             type: 'NONE',
-    //           },
-    //         ],
-    //       },
-    //     },
-    //     action: {
-    //       block: {},
-    //     },
-    //     visibilityConfig: {
-    //       sampledRequestsEnabled: true,
-    //       cloudWatchMetricsEnabled: true,
-    //       metricName: 'QueryStringRule',
-    //     },
-    //   })
-    // }
-
-    // if (config.security.firewall?.rateLimitPerMinute) {
-    //   priorities.push(1)
-    //   rules.push({
-    //     name: 'RateLimitRule',
-    //     priority: priorities.length,
-    //     statement: {
-    //       rateBasedStatement: {
-    //         limit: config.security.firewall.rateLimitPerMinute,
-    //         aggregateKeyType: 'IP',
-    //       },
-    //     },
-    //     action: {
-    //       block: {},
-    //     },
-    //     visibilityConfig: {
-    //       sampledRequestsEnabled: true,
-    //       cloudWatchMetricsEnabled: true,
-    //       metricName: 'RateLimitRule',
-    //     },
-    //   })
-    // }
-
-    // if (config.security.firewall?.useIpReputationLists) {
-    //   priorities.push(1)
-    //   rules.push({
-    //     name: 'IpReputationRule',
-    //     priority: priorities.length,
-    //     statement: {
-    //       managedRuleGroupStatement: {
-    //         vendorName: 'AWS',
-    //         name: 'AWSManagedRulesAmazonIpReputationList',
-    //       },
-    //     },
-    //     action: {
-    //       block: {},
-    //     },
-    //     visibilityConfig: {
-    //       sampledRequestsEnabled: true,
-    //       cloudWatchMetricsEnabled: true,
-    //       metricName: 'IpReputationRule',
-    //     },
-    //   })
-    // }
-
-    // if (config.security.firewall?.useKnownBadInputsRuleSet) {
-    //   priorities.push(1)
-    //   rules.push({
-    //     name: 'KnownBadInputsRule',
-    //     priority: priorities.length,
-    //     statement: {
-    //       managedRuleGroupStatement: {
-    //         vendorName: 'AWS',
-    //         name: 'AWSManagedRulesKnownBadInputsRuleSet',
-    //       },
-    //     },
-    //     action: {
-    //       block: {},
-    //     },
-    //     visibilityConfig: {
-    //       sampledRequestsEnabled: true,
-    //       cloudWatchMetricsEnabled: true,
-    //       metricName: 'KnownBadInputsRule',
-    //     },
-    //   })
-    // }
-    // also add
-    //     }, {
-    //   "name": "AWSManagedRulesAnonymousIpList",
-    //   "priority": 40,
-    //   "overrideAction": "none",
-    //   "excludedRules": []
-    // }, {
-    //   "name": "AWSManagedRulesLinuxRuleSet",
-    //   "priority": 50,
-    //   "overrideAction": "none",
-    //   "excludedRules": []
-    // }, {
-    //   "name": "AWSManagedRulesUnixRuleSet",
-    //   "priority": 60,
-    //   "overrideAction": "none",
-    //   "excludedRules": [],
-    // }];
-
-    return rules
-  }
-}

package/core/cloud/src/cloud/storage.ts

@@ -1,168 +0,0 @@
-import type { aws_kms as kms } from 'aws-cdk-lib'
-import { RemovalPolicy, Tags, aws_backup as backup, aws_iam as iam, aws_s3 as s3 } from 'aws-cdk-lib'
-import type { Construct } from 'constructs'
-import type { NestedCloudProps } from '../types'
-
-export interface StorageStackProps extends NestedCloudProps {
-  kmsKey: kms.Key
-}
-
-export class StorageStack {
-  publicBucket: s3.Bucket
-  privateBucket: s3.Bucket
-  logBucket: s3.Bucket
-  bucketPrefix: string
-  vault: backup.BackupVault
-  backupPlan: backup.BackupPlan
-  backupRole: iam.Role
-
-  constructor(scope: Construct, props: StorageStackProps) {
-    this.bucketPrefix = `${props.slug}-${props.appEnv}`
-
-    this.publicBucket = new s3.Bucket(scope, 'PublicBucket', {
-      bucketName: `${this.bucketPrefix}-public-${props.timestamp}`,
-      versioned: true,
-      autoDeleteObjects: true,
-      removalPolicy: RemovalPolicy.DESTROY,
-      encryption: s3.BucketEncryption.S3_MANAGED,
-    })
-
-    Tags.of(this.publicBucket).add('daily-backup', 'true')
-
-    this.privateBucket = new s3.Bucket(scope, 'PrivateBucket', {
-      bucketName: `${this.bucketPrefix}-private-${props.timestamp}`,
-      versioned: true,
-      removalPolicy: RemovalPolicy.DESTROY,
-      autoDeleteObjects: true,
-      encryption: s3.BucketEncryption.S3_MANAGED,
-      enforceSSL: true,
-      publicReadAccess: false,
-      blockPublicAccess: {
-        blockPublicAcls: true,
-        blockPublicPolicy: true,
-        ignorePublicAcls: true,
-        restrictPublicBuckets: true,
-      },
-    })
-
-    Tags.of(this.privateBucket).add('daily-backup', 'true')
-
-    this.logBucket = new s3.Bucket(scope, 'LogsBucket', {
-      bucketName: `${this.bucketPrefix}-logs-${props.timestamp}`,
-      removalPolicy: RemovalPolicy.RETAIN, // somehow, if we try to auto-delete logs, it fails bc the bucket is not empty (even though objects should be deleted) -> that's why we let buddy cloud:cleanup handle this which is auto triggered when buddy undeploy is ran
-      // autoDeleteObjects: true,
-      blockPublicAccess: new s3.BlockPublicAccess({
-        blockPublicAcls: false,
-        ignorePublicAcls: true,
-        blockPublicPolicy: true,
-        restrictPublicBuckets: true,
-      }),
-      objectOwnership: s3.ObjectOwnership.BUCKET_OWNER_PREFERRED,
-    })
-
-    Tags.of(this.logBucket).add('daily-backup', 'true')
-
-    this.backupRole = this.createBackupRole(scope)
-
-    // Daily 35 day retention
-    this.vault = new backup.BackupVault(scope, 'BackupVault', {
-      backupVaultName: `${props.slug}-${props.appEnv}-daily-backup-vault`,
-      encryptionKey: props.kmsKey,
-      removalPolicy: RemovalPolicy.DESTROY,
-    })
-
-    this.backupPlan = backup.BackupPlan.daily35DayRetention(scope, 'BackupPlan', this.vault)
-
-    this.backupPlan.addSelection('Selection', {
-      role: this.backupRole,
-      resources: [backup.BackupResource.fromTag('daily-backup', 'true')],
-    })
-  }
-
-  createBackupRole(scope: Construct) {
-    const backupRole = new iam.Role(scope, 'BackupRole', {
-      assumedBy: new iam.ServicePrincipal('backup.amazonaws.com'),
-    })
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: [
-          's3:GetInventoryConfiguration',
-          's3:PutInventoryConfiguration',
-          's3:ListBucketVersions',
-          's3:ListBucket',
-          's3:GetBucketVersioning',
-          's3:GetBucketNotification',
-          's3:PutBucketNotification',
-          's3:GetBucketLocation',
-          's3:GetBucketTagging',
-        ],
-        resources: ['arn:aws:s3:::*'],
-        sid: 'S3BucketBackupPermissions',
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: [
-          's3:GetObjectAcl',
-          's3:GetObject',
-          's3:GetObjectVersionTagging',
-          's3:GetObjectVersionAcl',
-          's3:GetObjectTagging',
-          's3:GetObjectVersion',
-        ],
-        resources: ['arn:aws:s3:::*/*'],
-        sid: 'S3ObjectBackupPermissions',
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: ['s3:ListAllMyBuckets'],
-        resources: ['*'],
-        sid: 'S3GlobalPermissions',
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: ['kms:Decrypt', 'kms:DescribeKey'],
-        resources: ['*'],
-        sid: 'KMSBackupPermissions',
-        conditions: {
-          StringLike: {
-            'kms:ViaService': 's3.*.amazonaws.com',
-          },
-        },
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: [
-          'events:DescribeRule',
-          'events:EnableRule',
-          'events:PutRule',
-          'events:DeleteRule',
-          'events:PutTargets',
-          'events:RemoveTargets',
-          'events:ListTargetsByRule',
-          'events:DisableRule',
-        ],
-        resources: ['arn:aws:events:*:*:rule/AwsBackupManagedRule*'],
-        sid: 'EventsPermissions',
-      }),
-    )
-
-    backupRole.addToPolicy(
-      new iam.PolicyStatement({
-        actions: ['cloudwatch:GetMetricData', 'events:ListRules'],
-        resources: ['*'],
-        sid: 'EventsMetricsGlobalPermissions',
-      }),
-    )
-
-    return backupRole
-  }
-}

package/core/cloud/src/edge/origin-request.ts

@@ -1,49 +0,0 @@
-const config = {
-  suffix: '.html',
-  appendToDirs: 'index.html',
-  removeTrailingSlash: false,
-}
-
-const regexSuffixless = /\/[^/.]+$/ // e.g. "/some/page" but not "/", "/some/" or "/some.jpg"
-const regexTrailingSlash = /.+\/$/ // e.g. "/some/" or "/some/page/" but not root "/"
-
-export function handler(event, context, callback) {
-  const { request } = event.Records[0].cf
-  const { uri } = request
-  const { suffix, appendToDirs } = config
-
-  // Append ".html" to origin request
-  if (suffix && uri.match(regexSuffixless)) {
-    request.uri = uri + suffix
-    callback(null, request)
-    return
-  }
-
-  // Append "index.html" to origin request
-  if (appendToDirs && uri.match(regexTrailingSlash)) {
-    request.uri = uri + appendToDirs
-    callback(null, request)
-    return
-  }
-
-  // Redirect (301) non-root requests ending in "/" to URI without trailing slash
-  // if (removeTrailingSlash && uri.match(/.+\/$/)) {
-  //   const response = {
-  //     // body: '',
-  //     // bodyEncoding: 'text',
-  //     headers: {
-  //       location: [{
-  //         key: 'Location',
-  //         value: uri.slice(0, -1),
-  //       }],
-  //     },
-  //     status: '301',
-  //     statusDescription: 'Moved Permanently',
-  //   }
-  //   callback(null, response)
-  //   return
-  // }
-
-  // If nothing matches, return request unchanged
-  callback(null, request)
-}