terruvim-core-test 0.0.1

package/dist/src/factories/createTaskDefinition.js

@@ -0,0 +1,49 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTaskDefinition = createTaskDefinition;
+const aws = __importStar(require("@pulumi/aws"));
+function createTaskDefinition(params, provider) {
+    return new aws.ecs.TaskDefinition(`${params.name}-task`, {
+        family: params.name,
+        cpu: params.cpu.toString(),
+        memory: params.memory.toString(),
+        networkMode: "awsvpc",
+        requiresCompatibilities: ["FARGATE"],
+        executionRoleArn: params.executionRoleArn,
+        taskRoleArn: params.taskRoleArn,
+        containerDefinitions: params.containerDefinitions,
+    }, Object.assign({}, params.dependsOn ? { dependsOn: params.dependsOn } : undefined, provider ? { provider } : undefined));
+}

package/dist/src/factories/createVpcEndpoint.js

@@ -0,0 +1,49 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createVpcEndpoint = createVpcEndpoint;
+const aws = __importStar(require("@pulumi/aws"));
+function createVpcEndpoint({ name, vpcId, serviceName, vpcEndpointType, subnetIds, routeTableIds, securityGroupIds, privateDnsEnabled, tags, provider, }) {
+    return new aws.ec2.VpcEndpoint(name, {
+        vpcId,
+        serviceName,
+        vpcEndpointType,
+        subnetIds,
+        routeTableIds,
+        securityGroupIds,
+        privateDnsEnabled,
+        tags,
+    }, provider ? { provider } : undefined);
+}

package/dist/src/factories/dashboardFactory.js

@@ -0,0 +1,94 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DashboardFactory = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const resourceFactory_1 = require("./resourceFactory");
+const validateDashboardConfig_1 = require("./validateDashboardConfig");
+const createAwsCloudwatchDashboard_1 = require("./createAwsCloudwatchDashboard");
+class DashboardFactory extends resourceFactory_1.ResourceFactory {
+    async createResource(config) {
+        function getProp(key) {
+            if (!config)
+                return undefined;
+            if (key in config)
+                return config[key];
+            if (config.configuration && key in config.configuration)
+                return config.configuration[key];
+            return undefined;
+        }
+        const dashboardConfig = {
+            id: getProp("id"),
+            name: getProp("name"),
+            widgets: getProp("widgets"),
+            description: getProp("description"),
+            tags: getProp("tags"),
+            provider: getProp("provider"),
+            hooks: getProp("hooks"),
+            notes: getProp("notes")
+        };
+        (0, validateDashboardConfig_1.validateDashboardConfig)(dashboardConfig);
+        return await (0, createAwsCloudwatchDashboard_1.createAwsCloudwatchDashboard)(dashboardConfig);
+    }
+    getOutputs(resource) {
+        return {
+            id: resource.id,
+            url: pulumi.interpolate `https://console.aws.amazon.com/cloudwatch/home#dashboards:name=${resource.dashboardName}`,
+        };
+    }
+    validateConfig(config) {
+        function getProp(key) {
+            if (!config)
+                return undefined;
+            if (key in config)
+                return config[key];
+            if (config.configuration && key in config.configuration)
+                return config.configuration[key];
+            return undefined;
+        }
+        const dashboardConfig = {
+            id: getProp("id"),
+            name: getProp("name"),
+            widgets: getProp("widgets"),
+            description: getProp("description"),
+            tags: getProp("tags"),
+            provider: getProp("provider"),
+            hooks: getProp("hooks"),
+            notes: getProp("notes")
+        };
+        (0, validateDashboardConfig_1.validateDashboardConfig)(dashboardConfig);
+    }
+}
+exports.DashboardFactory = DashboardFactory;

package/dist/src/factories/dataProtectionPolicyBuilder.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_DATA_IDENTIFIERS = void 0;
+exports.buildDataProtectionPolicy = buildDataProtectionPolicy;
+function buildDataProtectionPolicy(config, logGroupName, defaultDataIdentifiers, contextPrefix = "Log Group") {
+    if (config.policy) {
+        return config.policy;
+    }
+    let needsAuditStatement = false;
+    let needsRedactionStatement = false;
+    if (config.operations) {
+        needsAuditStatement = config.operations.audit?.enabled === true;
+        needsRedactionStatement = config.operations.redaction?.enabled === true;
+    }
+    else {
+        needsAuditStatement = config.enableAudit === true;
+        needsRedactionStatement = config.enableRedaction === true;
+    }
+    const dataIdentifiers = config.dataIdentifiers || defaultDataIdentifiers;
+    const auditLogGroup = config.auditLogGroup || config.operations?.audit?.logGroup || "/aws/logs/audit/PROJECT-prod";
+    const statements = [];
+    if (needsAuditStatement) {
+        statements.push({
+            Sid: "DataProtectionAuditStatement",
+            DataIdentifier: dataIdentifiers,
+            Operation: {
+                Audit: {
+                    FindingsDestination: {
+                        CloudWatchLogs: {
+                            LogGroup: auditLogGroup
+                        }
+                    }
+                }
+            }
+        });
+    }
+    if (needsRedactionStatement) {
+        statements.push({
+            Sid: "DataProtectionDeidentifyStatement",
+            DataIdentifier: dataIdentifiers,
+            Operation: {
+                Deidentify: {
+                    MaskConfig: config.operations?.redaction?.maskConfig?.MaskConfig || {}
+                }
+            }
+        });
+    }
+    if (statements.length === 0) {
+        throw new Error(`${contextPrefix}: Data Protection Policy for ${logGroupName} must have at least one operation`);
+    }
+    if (statements.length > 2) {
+        throw new Error(`${contextPrefix}: AWS CloudWatch LogDataProtectionPolicy can only have maximum 2 statements, got ${statements.length} for ${logGroupName}`);
+    }
+    const policy = {
+        Name: "DataProtectionPolicy",
+        Description: `Data protection policy for ${logGroupName}`,
+        Version: "2021-06-01",
+        Statement: statements
+    };
+    if (logGroupName.includes('compliance') || logGroupName.includes('audit')) {
+    }
+    return policy;
+}
+exports.DEFAULT_DATA_IDENTIFIERS = {
+    GENERAL: [
+        "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
+        "arn:aws:dataprotection::aws:data-identifier/CreditCardNumber",
+        "arn:aws:dataprotection::aws:data-identifier/PhoneNumber-US"
+    ],
+    VPC_FLOW_LOGS: [
+        "arn:aws:dataprotection::aws:data-identifier/IpAddress",
+        "arn:aws:dataprotection::aws:data-identifier/EmailAddress"
+    ],
+    DATABASE_LOGS: [
+        "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
+        "arn:aws:dataprotection::aws:data-identifier/CreditCardNumber",
+        "arn:aws:dataprotection::aws:data-identifier/PhoneNumber-US"
+    ],
+    APPLICATION_LOGS: [
+        "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
+        "arn:aws:dataprotection::aws:data-identifier/AwsSecretKey",
+        "arn:aws:dataprotection::aws:data-identifier/CreditCardNumber",
+        "arn:aws:dataprotection::aws:data-identifier/PhoneNumber-US"
+    ],
+    ECS_LOGS: [
+        "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
+        "arn:aws:dataprotection::aws:data-identifier/AwsSecretKey",
+        "arn:aws:dataprotection::aws:data-identifier/CreditCardNumber",
+        "arn:aws:dataprotection::aws:data-identifier/PhoneNumber-US",
+        "arn:aws:dataprotection::aws:data-identifier/IpAddress"
+    ],
+    CODEPIPELINE_LOGS: [
+        "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
+        "arn:aws:dataprotection::aws:data-identifier/AwsSecretKey",
+        "arn:aws:dataprotection::aws:data-identifier/IpAddress"
+    ],
+    API_GATEWAY_LOGS: [
+        "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
+        "arn:aws:dataprotection::aws:data-identifier/IpAddress",
+        "arn:aws:dataprotection::aws:data-identifier/CreditCardNumber",
+        "arn:aws:dataprotection::aws:data-identifier/PhoneNumber-US"
+    ]
+};

package/dist/src/factories/ec2Factory.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Ec2Factory = void 0;
+const resourceFactory_1 = require("./resourceFactory");
+const createAwsEc2Instance_1 = require("./createAwsEc2Instance");
+class Ec2Factory extends resourceFactory_1.ResourceFactory {
+    async createResource(config, provider) {
+        let vpcSecurityGroupIds = config.configuration.vpcSecurityGroupIds;
+        if (config.inputs) {
+            if (config.inputs.sgId) {
+                vpcSecurityGroupIds = [config.inputs.sgId];
+            }
+            else if (config.inputs.securityGroupIds) {
+                vpcSecurityGroupIds = config.inputs.securityGroupIds;
+            }
+        }
+        let ebsBlockDevices = undefined;
+        if (config.configuration.blockDeviceMappings) {
+            ebsBlockDevices = config.configuration.blockDeviceMappings.map((bd) => ({
+                deviceName: bd.deviceName,
+                ...bd.ebs,
+            }));
+        }
+        const args = {
+            ami: config.configuration.ami,
+            instanceType: config.configuration.instanceType,
+            subnetId: config.configuration.subnetId || config.inputs?.subnetId,
+            vpcSecurityGroupIds,
+            keyName: config.configuration.keyName,
+            iamInstanceProfile: config.configuration.iamInstanceProfile,
+            userData: config.configuration.userData,
+            ebsBlockDevices,
+            monitoring: config.configuration.monitoring,
+            ebsOptimized: config.configuration.ebsOptimized,
+            instanceInitiatedShutdownBehavior: config.configuration.instanceInitiatedShutdownBehavior,
+            associatePublicIpAddress: config.configuration.associatePublicIpAddress,
+            privateIp: config.configuration.privateIp,
+            creditSpecification: config.configuration.creditSpecification,
+            placementGroup: config.configuration.placementGroup,
+            tenancy: config.configuration.tenancy,
+            hibernation: config.configuration.hibernation,
+            enclaveOptions: config.configuration.enclaveOptions,
+            capacityReservationSpecification: config.configuration.capacityReservationSpecification,
+            launchTemplate: config.configuration.launchTemplate,
+            metadataOptions: config.configuration.metadataOptions,
+            cpuOptions: config.configuration.cpuOptions,
+            disableApiTermination: config.configuration.disableApiTermination,
+            sourceDestCheck: config.configuration.sourceDestCheck,
+            secondaryPrivateIps: config.configuration.secondaryPrivateIps,
+            ipv6Addresses: config.configuration.ipv6Addresses,
+            tags: config.configuration.tags,
+        };
+        return (0, createAwsEc2Instance_1.createAwsEc2Instance)(`${config.meta.environment}-${config.id}`, args, provider);
+    }
+    getOutputs(resource) {
+        return {
+            id: resource.id,
+            publicIp: resource.publicIp,
+        };
+    }
+    validateConfig(config) {
+        if (!config.configuration || !config.configuration.ami || !config.configuration.instanceType) {
+            throw new Error("EC2 config must include configuration with ami and instanceType");
+        }
+    }
+}
+exports.Ec2Factory = Ec2Factory;

package/dist/src/factories/ecsClusterFactory.js

@@ -0,0 +1,90 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClusterFactory = void 0;
+const aws = __importStar(require("@pulumi/aws"));
+const resourceFactory_1 = require("./resourceFactory");
+const buildEcsClusterArgs_1 = require("./buildEcsClusterArgs");
+const dataProtectionPolicyBuilder_1 = require("./dataProtectionPolicyBuilder");
+class ClusterFactory extends resourceFactory_1.ResourceFactory {
+    buildDataProtectionPolicyDocument(config) {
+        if (!config?.enabled) {
+            return null;
+        }
+        return (0, dataProtectionPolicyBuilder_1.buildDataProtectionPolicy)(config, "/ecs/cluster-logs", dataProtectionPolicyBuilder_1.DEFAULT_DATA_IDENTIFIERS.ECS_LOGS, "ECS Cluster");
+    }
+    buildDataProtectionPolicy(config, logGroup, meta) {
+        if (!config?.enabled) {
+            return undefined;
+        }
+        const policyDocument = this.buildDataProtectionPolicyDocument(config);
+        if (!policyDocument) {
+            return undefined;
+        }
+        return new aws.cloudwatch.LogDataProtectionPolicy(`${meta.environment}-ecs-cluster-data-protection-policy`, {
+            logGroupName: logGroup.name,
+            policyDocument: JSON.stringify(policyDocument)
+        }, {
+            dependsOn: [logGroup]
+        });
+    }
+    createResource(config, provider) {
+        const args = (0, buildEcsClusterArgs_1.buildEcsClusterArgs)(config.configuration, config.meta);
+        const cluster = new aws.ecs.Cluster(`${config.meta.environment}-${config.id}`, args, provider ? { provider } : undefined);
+        if (config.configuration.cloudwatchLogsDataProtection?.enabled) {
+            const logGroupName = `/ecs/${config.configuration.name}`;
+            const logGroup = new aws.cloudwatch.LogGroup(`${config.meta.environment}-${config.id}-log-group`, {
+                name: logGroupName,
+                retentionInDays: 365,
+                tags: config.configuration.tags
+            }, provider ? { provider } : undefined);
+            this.buildDataProtectionPolicy(config.configuration.cloudwatchLogsDataProtection, logGroup, config.meta);
+        }
+        return cluster;
+    }
+    getOutputs(resource) {
+        return {
+            id: resource.id,
+            name: resource.name,
+            arn: resource.arn,
+        };
+    }
+    validateConfig(config) {
+        if (!config.configuration || !config.configuration.name) {
+            throw new Error("Cluster config must include configuration with name");
+        }
+    }
+}
+exports.ClusterFactory = ClusterFactory;